Financial Authorities Allow Remote Access to 'Critical Terminals' of Financial Firms Amid COVID-19 Remote Work (Comprehensive)

Response to Citibank Inquiry: Recent Non-Action Opinion Reply
"Cannot Restrict Remote Work Based on Job Duties"

[Asia Economy Reporter Kim Hyo-jin] Amid active implementation of remote work by companies due to concerns over the spread of the novel coronavirus infection (COVID-19), financial authorities have expressed the opinion that remote access to 'important terminals (PCs)' of financial company employees is conditionally possible.

This is based on the judgment that it is difficult to restrict remote work measures depending on the job category or the nature of the tasks.

According to financial authorities on the 20th, the Financial Supervisory Service (FSS) responded on the 17th with a non-action opinion letter regarding a query from Korea Citibank about whether important terminals are included in the scope of remote access allowed for COVID-19 related remote work.

A non-action opinion letter is a system where, before a financial company takes specific business or management measures or actions, the financial authorities determine whether such measures or actions violate financial supervisory regulations to eliminate legal uncertainty and prevent disadvantages.

Current electronic financial supervisory regulations require each financial company to designate important terminals considering the importance and use of related data, apply strengthened protection measures such as prohibiting external removal, remote access, and groupware access, and do not allow exceptions to network separation application.

This applies to terminals mainly used by employees handling personal information of financial consumers and terminals directly accessing information processing systems for operation, development, and security purposes.

Since February, when the spread of COVID-19 intensified, financial authorities have repeatedly issued non-action opinions to financial companies and financial associations stating that "if there is a significant loss of personnel making it difficult to secure business continuity due to infectious diseases or a high likelihood thereof, remote work through remote access can be implemented," but this is the first time a judgment has been made regarding remote access to important terminals.

The FSS explained, "Considering the seriousness of COVID-19, it is judged that remote work cannot be restricted depending on the work," and "in unavoidable situations, remote work can be performed through remote access even on important terminals."

However, to minimize the possibility of information leakage from important terminals, the FSS ordered ▲ prior approval of remote work employees and terminals ▲ application of the same security controls as company terminals ▲ encryption of communication and two-factor authentication during remote access ▲ strengthened monitoring of abnormal signs in remote access and data import/export. It also instructed that remote access should be immediately blocked once the emergency situation ends.

This content was produced with the assistance of AI translation services.