Impact of the T-Mon and WeMakePrice Incident: Non-Financial Firms Now Under Financial Regulation

Incidents such as the T-Mon and WeMakePrice (TMON-WeMakePrice) scandal and the KakaoPay data breach have highlighted how events in traditionally non-financial sectors can significantly impact the financial system.

Incidents such as the T-Mon and WeMakePrice (TMON-WeMakePrice) scandal and the KakaoPay data breach have highlighted how events in traditionally non-financial sectors can significantly impact the financial system. In response, financial authorities have decided to strengthen indirect regulations on non-financial firms. This blog explores the growing need for managing atypical operational risks and the new regulatory approaches being considered by the financial authorities.

Recent incidents, including the T-Mon and WeMakePrice scandal and the KakaoPay data breach, have shown how problems originating from non-financial sectors can extend their impact to the financial system. As a result, financial authorities are moving to strengthen indirect regulations on non-financial firms to enhance market stability.

On September 5th, the Financial Supervisory Service (FSS) held its first meeting of the 'Operational Risk Management Task Force (TF)' to discuss strategies for strengthening management in the banking, insurance, card, and information technology (IT) sectors. Lee Se-hoon, Senior Deputy Governor of the FSS, stated, "With the acceleration of digitalization in finance, the trend of separating the production and sale of financial products is intensifying, and non-financial firms such as payment gateway companies (PGs) are increasingly participating in financial activities." This trend has created a growing need for managing not only traditional risks like market and credit risks but also atypical operational risks such as embezzlement, payment risks, and IT system failures, leading to a reconsideration of supervisory approaches.

According to the FSS, several major operational risk events occurred over the past year, including embezzlement cases (Woori, Nonghyup, and Kyongnam Banks), consumer losses related to Hong Kong H-Index linked equity securities (ELS), data breaches (KakaoPay, Woori Card), and legal risks (irregular foreign remittances). Lee pointed out that "failure to manage atypical operational risks can lead to consumer damage and reputational risks, causing direct losses to financial institutions."

To address these issues, financial authorities plan to establish an operational risk regulatory framework that indirectly regulates non-financial firms, such as PG companies and large corporate insurance agencies (GAs). This approach will involve financial institutions overseeing relevant non-financial firms, while the supervisory authorities will directly regulate the financial institutions themselves. The FSS explained, "We will create guidelines to ensure proper evaluation and management."

For each sector, credit card companies will be required to verify the appropriateness of PG companies, ensuring safe transaction environments in the online payment market. In the insurance sector, insurance companies will be rated based on various factors, including the sales quality of their affiliated GAs. For the IT sector, measures will be taken to prevent excessive reliance on a single company for outsourcing or partnerships, thereby avoiding risk concentration.

Lee also mentioned that "the task force will develop detailed implementation plans for each sector during the second half of this year and conduct pilot operations in a phased manner after gathering feedback from relevant industries." He added, "We will also gradually review ways to enhance operational risk management for small and medium-sized financial sectors, such as savings banks, mutual finance companies, and capital firms."

As digitalization accelerates in the financial market and non-financial firms increase their participation, new types of operational risks are emerging. To address these changes, financial authorities are moving to implement indirect regulations for non-financial firms. It will be important to monitor how these regulatory changes will enhance the safety and fairness of the financial market. Successful implementation of these new regulatory measures will require active cooperation and engagement from all industry stakeholders.