Preventing Data Center Outages... Mandatory Disaster Recovery Center Installation for Card Companies

Expansion of Mandatory Disaster Recovery Centers
to Ensure Stable Operation of Financial Systems

To prevent financial service outages like the KakaoTalk blackout caused by the data center fire two years ago, the installation of disaster recovery centers will be mandatory for card companies, savings banks, and electronic financial service providers.

The Financial Services Commission announced on the 5th that it has approved and will immediately implement a partial amendment to the Electronic Financial Supervision Regulations at its regular meeting.

According to the amendment, in addition to banks, financial investment firms, and insurance companies that are currently required to install disaster recovery centers, certain large-scale specialized credit finance companies and electronic financial service providers will also be required to establish disaster recovery centers.

Specialized credit finance companies such as card and capital companies subject to this requirement are those with total assets of 2 trillion KRW or more and 300 or more regular employees, while electronic financial service providers such as Payment Gateway (PG) companies are subject if their total transaction amount exceeds 2 trillion KRW.

Furthermore, to strengthen consumer protection, the minimum compensation limits for liability insurance in the event of electronic financial accidents will be raised. Financial investment firms with assets of 2 trillion KRW or more will see the limit increase from 500 million KRW to 1 billion KRW, and prepaid electronic financial service providers will see it rise from 100 million KRW to 200 million KRW.

However, regulations related to the installation of disaster recovery centers and the increase in liability insurance limits will be applied one year later, considering the insurance subscription period and facility construction period of financial companies. Regulations related to the protection of board resolutions on major deliberations and decisions of the Information Security Committee will be enforced from August 5, six months later.

This measure was prepared to prevent financial service outages similar to the Kakao "blackout incident" triggered by the SK C&C Pangyo data center fire over two years ago. A financial authority official explained, "This follows the need to strengthen financial IT system resilience and provide prompt consumer damage relief from disasters or electronic intrusions after the 2022 Kakao data center fire."

Additionally, the amendment reorganizes the excessively detailed financial security standards, which were centered on conduct rules, into principle-based standards, reducing the number of conduct rules from 293 to 166.

This content was produced with the assistance of AI translation services.