YOON&YANG

On October 1, 2026, the Financial Services Commission (FSC) published proposed amendments to the Regulation on Supervision of Credit Information Business (the “Supervision Regulation”). The key change is a move away from the general administrative surcharge standards in the Regulation on Examination and Sanctions of Financial Institutions (the “Examination and Sanctions Regulation”), which have applied across the financial sector, toward a separate framework tailored to violations involving personal credit information.  
 

The proposed amendments would add Article 3-9 and Appendix 9 to the Supervision Regulation. They would introduce more detailed base rates for administrative surcharges and require the calculation to take into account the type and sensitivity of personal credit information, the scale and impact of harm to data subjects, preventive internal controls, and remediation efforts. The FSC expects these changes to improve the transparency, predictability, and proportionality of sanctions.

1. Background

2. Key Changes to the Proposed Administrative Surcharge Framework

3. Comparison with the Personal Information Protection Act

4. Practical Implications for Financial Institutions

1. Background  
 

Following amendments to the Credit Information Act in 2020, administrative surcharges may be imposed not only for the disclosure or leakage of personal credit information, but also for unauthorized provision or use of such information and the improper handling of pseudonymized data. The statutory ceiling was also raised from 3% of revenue related to the violation to 3% of total revenue.

Until now, the Credit Information Act has not had its own detailed-calculation framework for the administrative surcharges. The general standards in the Examination and Sanctions Regulation have therefore applied. Those standards are designed for a wide range of financial-law violations and assess seriousness based mainly on factors such as the motive and method of the violation, unjust enrichment, the scale of harm, market impact, and the duration and frequency of violations. 
 

Violations involving credit information, however, call for additional considerations, including the sensitivity of the data, the risk of direct financial harm such as fraud or unauthorized payments, and the number of affected data subjects. The existing standards also use only three rates—50%, 75%, and 100% of the statutory ceiling—meaning that even relatively minor violations begin at 50% of the maximum amount. 
 

To address these concerns, the FSC has proposed a separate framework for calculating the administrative surcharges in the Supervision Regulation for violations of the Credit Information Act.

2. Key Changes to the Proposed Administrative Surcharge Framework  
 

A. More Detailed Base Rates and a Lower Minimum Rate

The proposed framework applies base rates ranging from 1% to 100%, depending on the severity score. For violations of lower severity (scores from 1.0 to below 1.6), the rate ranges from 1% to below 30%. For serious violations (scores from 1.6 to below 2.3), it ranges from 30% to below 65%. For very serious violations (scores of 2.3 or higher), it ranges from 65% to 100%. A score of 1.0 corresponds to a 1% base rate. For scores of 1.1 or above, the rate starts at 5% and increases by 5 percentage points for each additional 0.1 point above 1.1.

In short, whereas the current system generally applies a base rate of 50% of the statutory ceiling even to minor violations, the proposed framework would allow the rate to start as low as 1% and increase according to the seriousness of the conduct.

This three-tier, continuous-rate structure appears to draw on the administrative surcharge framework in Appendix 7 to the Regulation on Supervision of Financial Consumer Protection, introduced in November 2025.

B. New Severity Factors for Credit Information Violations

In addition to the general factors in the existing standards—motive and method, unjust enrichment, scale of harm, market impact, and the duration and frequency of violations—the proposal introduces two factors tailored to credit information violations: 
 

• First, the “type and nature of personal credit information.” Information closely linked to direct financial harm, such as asset theft, fraudulent payments, or financial fraud, may be assessed as more serious. Information with a lower likelihood of causing direct financial harm may, depending on the facts, be assessed at a moderate level. 
 

• Second, the “scale and impact of harm to data subjects.” A violation may be assessed as more serious where substantial harm has occurred, or is likely to occur, across a large number of data subjects. Importantly, actual monetary loss need not be established: the sensitivity of the information and the scope of the incident may themselves support a finding of a high risk of serious harm.

C. Changes to Aggravating and Mitigating Factors

The proposal keeps the general cap on increases at 50% of the base surcharge, while increasing the maximum reduction from 50% to 75%. This may provide greater scope for meaningful reductions where the violation is minor, the exposure is limited, or remediation has been thorough.

By contrast, more serious violations with a significant social impact may face stronger increases. The proposal identifies special aggravating factors that could increase the base surcharge by up to 100%, including: (i) repeating the same violation within three years of a prior surcharge; (ii) causing harm to 10 million or more individuals through intentional conduct or gross negligence; and (iii) failing to comply with an order under the Credit Information Act.

The proposal also expressly recognizes preventive compliance efforts as mitigating factors. Relevant considerations may include maintaining an excellent record of personal credit information management and protection for three or more consecutive years, obtaining a personal-information protection certification recognized by the Personal Information Protection Commission and establishing and effectively operating internal audit and control systems.

The FSC may also increase or reduce the final surcharge after taking into account cooperation with an examination, efforts to remedy the violation or prevent recurrence, the principles of equity and proportionality under Articles 9 and 10 of the General Act on Public Administration, and the proper balancing of relevant interests under Article 21 of that Act.

3. Comparison with the Personal Information Protection Act  
 

Like the administrative surcharge regime under the Personal Information Protection Act (the “PIPA”), the proposal would reflect the type of information, the impact on data subjects, preventive efforts, and remediation measures when determining the level of sanctions.
 

There is, however, an important difference. Under the PIPA, revenue unrelated to the violation is expressly excluded from total revenue when calculating administrative surcharges. Under the Credit Information Act, the statutory ceiling continues to be based on total revenue. Rather than changing that rule through legislation, the proposal seeks to improve proportionality by refining the base rates and broadening the scope for reductions.
 

The PIPA also permits administrative surcharges of up to 10% of total revenue in certain cases, including repeated violations, large-scale incidents affecting 10 million or more individuals through intentional conduct or gross negligence, and leaks resulting from non-compliance with corrective orders. The proposed Credit Information Act framework does not raise the statutory ceiling, but treats similar circumstances as special aggravating factors for serious violations.

4. Practical Implications for Financial Institutions

The proposed framework may make administrative surcharges more proportionate for minor violations or incidents with limited harm, while creating a clearer basis for stronger sanctions in cases involving large-scale incidents, a risk of direct financial harm, or repeated violations.
 

When responding to an incident or regulatory examination, financial institutions should do more than contest whether a violation occurred. They should organize and substantiate the facts relevant to each severity factor and each aggravating or mitigating circumstance. Because the financial authorities will have greater discretion than under the existing framework, institutions should also actively present case-specific factors supporting mitigation.
 

Financial institutions should also retain evidence that their data-protection controls operate effectively. This means not only allocating an information-security budget, but also complying with security requirements for personal credit information and maintaining records of monitoring, internal controls, and remediation. Such records may be important evidence in assessing the seriousness of a violation, preventive efforts, post-incident remediation, and potential reductions in the surcharge.

Drawing on extensive experience advising financial institutions, platforms, and fintech companies, Yoon & Yang’s Digital Finance Center provides practical, tailored legal advice. Please contact us if you have any questions about these developments.

[Korean Version]