[비즈한국] The CEOs of the 5 major commercial banks—KB Kookmin, Shinhan, Hana, Woori, and NH NongHyup—appeared together at the National Assembly’s parliamentary audit for the first time in 4 years. The bank heads faced intense questioning ranging from management and oversight responsibilities regarding personal information breach incidents to poor post-incident responses and victim compensation. As calls for substantial executive accountability—beyond mere promises to prevent recurrence—continued throughout the day, interest is also focusing on the future status of these bank CEOs.
On October 19, the CEOs of the 5 major commercial banks appeared as witnesses at the National Assembly's National Policy Committee audit. It has been 4 years since they all appeared at the audit hall together. The CEOs suffered through a grueling session, facing fierce criticism regarding various issues, including personal information leaks. The parliamentary inquiry, which began at 3:30 PM with the witness oath of KB Kookmin Bank CEO Lee Hwan-joo, lasted for about 3 hours.
Issues raised during the audit included: △responses related to personal information leak accidents, △compensation for damages from data leaks, △damages to financial vulnerable groups due to branch closures, △interest rate hikes through adjustments to prime and preferential rates, △governance issues of financial holding companies, and △the excessive collection of personal information by financial firms.
Regarding the personal information leak incidents, questioning focused on Shinhan Bank, which had the largest scale of leaked data. Representative Kim Hyun-jung of the Democratic Party of Korea asked Shinhan Bank CEO Jung Sang-hyuk, "The structure is set up so that victim compensation is paid using bank customer money, which is wrong," and asked if he intended to submit a management compensation proposal to the board of directors depending on the results of the Financial Supervisory Service (FSS) inspection. CEO Jung replied, "I believe it is a matter that can be fully reviewed by the board of directors depending on the inspection results."
Representative Jeon Hyun-hee of the Democratic Party of Korea pointed out, "There were prior warnings, such as overseas subsidiaries being sanctioned for information protection issues, but failing to respond was a neglect of management and oversight," adding, "You are not qualified to discuss a term extension." CEO Jung showed a cautious stance, saying, "There were many lacking areas," and, "I am not thinking about a term extension right now. The urgent matters are victim relief and preventive measures, and I will dedicate myself to those."
For Kookmin Bank, allegations were raised regarding delayed measures and concealment of accident records related to a hacking incident. Representative Kim Yong-man of the Democratic Party of Korea pointed out that although Kookmin Bank recognized the initial breach on the night of September 27, it only took simple measures, leading to additional personal information leakage in a second attack. He also raised the issue that the accident was reported to financial authorities only 80 hours after the first intrusion.
Representative Kim continued, "We received a tip that there was an instruction to conceal the accident related to log deletion," and asked, "In the process of three related departments meeting and reporting to the Chief Information Security Officer (CISO), it is said that an executive in charge of information protection mentioned deleting logs; did such a thing not happen?"
However, despite the continuous pressure from Representative Kim, CEO Lee Hwan-joo denied the allegations, stating, "(Attempts to conceal the accident) did not happen. I was not reported on it," and, "I never gave instructions to conceal it."
The compensation issue following the personal information leaks also came under fire. Representative Kim Jae-sub of the People Power Party said, "You are making compensation contingent on the occurrence of damages in personal information leak accidents; isn't this wrong?" and added, "Hana Bank didn't even have a concrete compensation policy. It is difficult to see this as an attitude that feels responsibility."
Hana Bank CEO Lee Ho-sung replied, "Naturally, it is normal to compensate if secondary damage occurs. The reason there was no mention of compensation was because a consolidation process was needed," adding, "We exempted fees as a primary measure, and secondarily, we are going through the consent process for customers to join financial security insurance. Once completed, we can prevent secondary damages. Currently, there are no secondary damages, but if they occur, I will definitely compensate in full."
Hana Bank also drew attention due to allegations of collusion with a coin multi-level marketing scam firm. Earlier this year, Hana Bank was the first among the 4 major financial holding companies to form a KRW stablecoin consortium. The core of the allegation is that when a party expressed interest in joining the consortium, Hana Bank CEO Lee Ho-sung arranged a meeting with a specialized consultant at a specific law firm, and this consultant induced them to sign a Memorandum of Understanding (MOU) with the blockchain firm 'Btoz.' Btoz is a company suspected of involvement in the 'KOK Coin' multi-level fraud, which has approximately 570,000 victims and raised over 2 trillion won.
Representative Lee Kang-il of the Democratic Party of Korea asked CEO Lee Ho-sung, "I heard from multiple sources that when they asked how to join Hana Bank's stablecoin consortium, CEO Lee had them meet with a specialized consultant from a specific law firm," and asked, "However, they say that when they went to that consultant, they were made to sign an MOU with Btoz. Isn't that consultant an ex-FSS official currently at Kim & Chang Law Offices?"
However, CEO Lee drew a line, stating, "I don't remember exactly," and, "Btoz is a company I don't know." When Representative Lee told FSS Governor Lee Chan-jin, "Former FSS officials are disturbing the financial market," and, "You need to review what was said to the Hana Bank CEO," Governor Lee replied, "I have been reported on the matter."
Criticism was also raised that financial firms are worsening the damage from information leaks by excessively collecting personal information. Representative Cho Jung-hun of the People Power Party said, "Looking at Shinhan Card's mandatory information, it includes children's kindergarten names, family card information, and Connection Information (CI). CI is important information, but isn't it a concept people don't know well? Banks manage optional information irresponsibly."
Regarding the 'dark pattern' problem of banks inducing consent when displaying marketing pop-ups in mobile banking, Representative Cho pointed out, "Other banks said they would rectify it by the first quarter of 2027, but Woori Bank reported they would do it by January 2028, the latest among the 5 major banks," and asked, "Isn't that too late?" Woori Bank CEO Jung Jin-wan immediately replied, "I received an internal report and told them to look into it again," and, "I will fix what can be fixed quickly."
Meanwhile, single-stock leveraged Exchange Traded Funds (ETFs) became a major subject of debate at the National Policy Committee audit. In particular, controversy arose when Financial Supervisory Service Governor Lee Chan-jin admitted that the review period had been shortened to list single-stock leveraged ETFs quickly.
Representative Park Dae-chul of the People Power Party criticized it as a 'rushed listing' tailored to the local elections, pointing out that while the average listing period for general ETFs is 62 days and 43 days for major index types, single-stock leveraged ETFs were listed in just 29 days. When Representative Park asked, "You listed riskier products in a shorter period," and, "Usually, doesn't the FSS review the securities registration statement after the exchange's preliminary review? Is this the first case where the FSS reviewed it before the preliminary review was finished?" Governor Lee replied, "It seems so." Governor Lee continued, "The Financial Services Commission announced the listing schedule as a policy last April. There is an aspect where the review was conducted quickly to meet this schedule."