Five major bank CEOs face questioning over hacking and interest rates

Heads of Shinhan, KB Kookmin, Hana, Woori, and Nonghyup banks faced a National Assembly audit on the 19th regarding hacking responses and interest rates. Lawmakers questioned Shinhan Bank's execution of only 31.7 billion won of its 49.3 billion won information protection budget and criticized KB Kookmin Bank's response to a September information leak.

During the National Assembly Political Affairs Committee audit held at the National Assembly on the 19th, the heads of the five major banks—Jung Sang-hyuk of Shinhan Bank, Lee Hwan-ju of KB Kookmin Bank, Lee Ho-seong of Hana Bank, Jung Jin-wan of Woori Bank, and Kang Tae-young of Nonghyup Bank—were questioned regarding hacking responsibilities, interest rates, and corporate governance.

The gap between customer protection measures and their actual implementation in the banking sector emerged as a major issue during a National Assembly Political Affairs Committee audit. Lawmakers questioned the preventive measures taken against hacking incidents and the conditions for compensation, while also inquiring why some banks reduced preferential interest rates more significantly than they lowered add-on rates. There were also calls to reflect management responsibility for financial accidents in executive bonuses and reappointment evaluations.

The audit of the Financial Supervisory Service and other entities on the 19th saw the attendance of Lee Hwan-ju (CEO of KB Kookmin Bank), Jung Sang-hyuk (CEO of Shinhan Bank), Lee Ho-seong (CEO of Hana Bank), Jung Jin-wan (CEO of Woori Bank), and Kang Tae-young (CEO of Nonghyup Bank) as witnesses. Inquiries that began due to successive hacking incidents in the banking sector expanded to cover general management issues, including loan interest rates, microfinance, and the governance of financial groups.

Before promises of compensation... why were accidents not prevented?

The questioning regarding hacking focused on management prior to the incidents. While the bank CEOs pledged to increase security budgets and personnel, lawmakers pressed them on how much of the existing budget had been executed and how they had responded to previously identified risks.

Democratic Party of Korea lawmaker Kim Hyun-jung pointed out that Shinhan Bank had not sufficiently responded to previously raised security risks. Kim presented data showing that although the need to inspect information protection investments to prepare for new AI attacks was raised at a Shinhan Financial Group board meeting last year, only approximately 31.7 billion won of the 49.3 billion won information protection budget had been executed.

Kim emphasized that verifying whether such investments and inspections are properly carried out is part of the bank CEO's management responsibility. She argued that even if an executive in charge of security handles practical matters, the role of overseeing whether those actions are appropriate and providing the necessary personnel and budget lies with the bank CEO. Jung Sang-hyuk explained that this particular attack was different from previous ones, but admitted, "I will acknowledge that there were shortcomings."

Regarding KB Kookmin Bank, the initial response to a customer information leak this past September became a point of contention. Democratic Party of Korea lawmaker Kim Yong-man pointed out that when a hacker first gained access on the night of September 27, KB Kookmin Bank merely viewed it as routine abnormal traffic and limited its response to blocking that IP. He criticized the response as insufficient, noting that an additional leak of information from 81 customers occurred in the early hours of the 29th through a bypass attack using a different IP. In response, Lee Hwan-ju said, "I feel a great deal of regret for not being able to block and respond more swiftly."

Following the incidents, the debate shifted to the extent and conditions of compensation for damages. Lawmakers expressed concern that even if banks compensate for secondary damages, relief may be difficult if the burden of proof remains on the customer. In particular, People Power Party lawmaker Kim Jae-seop took issue with the fact that KB Kookmin Bank's compensation policy included the condition of being "proven." He argued that if a customer suffers financial fraud after an information leak, it would be difficult to receive compensation if they must directly prove the connection between the two events.

Questions were also raised regarding whether Shinhan Bank provides sufficient protection for damaged customers. The inquiry rate for whether information was leaked, presented by Kim, was approximately 22% of all targets. Since a significant number of customers did not directly check if their information was leaked, the implication was that compensation should not be limited only to those who have already suffered damage.

Hana Bank was asked for specific compensation policies. Lee Ho-seong explained that the bank has implemented fee waivers and is pursuing enrollment in financial safety insurance with customer consent. He further promised that the bank would compensate if damages related to the information leak occur.

Reducing preferential rates while lowering add-on rates... examining customer benefits

During discussions on loan interest rates, the effectiveness of institutional improvements in reaching customers was debated. Democratic Party of Korea lawmaker Min Byeong-deok pointed out that following the amendment to the Banking Act, which prevents certain statutory costs from being reflected in loan interest rates, KB Kookmin Bank and Nonghyup Bank lowered their add-on rates but reduced preferential interest rates even more significantly.

Loan interest rates are determined by adding an add-on rate to the base rate and subtracting the preferential rate. Even if the add-on rate decreases, if the preferential rate being discounted is reduced by a larger amount, the effect of the rate reduction for the customer can be offset.

According to data presented by Rep. Min, while KB Kookmin Bank lowered its add-on rate by 0.08%p from June to August, it reduced preferential interest rates by 0.31%p. Nonghyup Bank also lowered its add-on rate by 0.26%p and reduced preferential interest rates by 0.61%p. The value obtained by subtracting the preferential interest rate from the add-on rate increased by 0.23%p and 0.35%p, respectively. Rep. Min criticized, "By lowering the add-on rate but reducing the preferential interest rate even further, the share taken by the banks actually became larger."

In the realm of microfinance, a gap was revealed between the creation of products and actual customer usage. A representative case is the Stepping Stone Loan, which helps customers who have faithfully repaid policy-based microfinance to enter the banking sector. According to data presented by Rep. Park Min-gyu of the Democratic Party of Korea, out of approximately 14.1 billion won in new Stepping Stone Loan transactions as of August this year, the supply from the four major banks—KB Kookmin, Shinhan, Hana, and Woori—amounted to only 130 million won, accounting for just 0.9%.

Rep. Park pointed to the poor performance of non-face-to-face transactions as the cause, noting that unlike general credit loans, Stepping Stone Loans often require customers to visit a branch even after undergoing preliminary screening via an app. He pointed out, "The transaction performance of each bank must be managed and inspected."

The heads of the four major banks decided to promote the establishment of non-face-to-face systems and linkage with microfinance platforms. Lee Chan-jin, Governor of the Financial Supervisory Service, stated that he would consult with the Financial Services Commission regarding plans to set supply targets for each bank and reflect them in inclusive finance evaluations.

The question of who will take responsibility for customer protection and internal control results also came under fire. Demands were made to inspect the duty of management to prevent accidents and reflect those results in the compensation and personnel appointments of management.

Rep. Kim Hyun-jung pointed out that while Shinhan Bank's internal regulations include provisions to recalculate scheduled performance bonuses by reflecting losses, there have been no instances of cutting or reclaiming executive performance bonuses over the past two years. She also mentioned that the unpaid performance-linked shares of President Jung Sang-hyuk amounted to approximately 5.3 billion won as of the end of June this year. The intent is that if strengthening internal controls is recognized as performance and rewarded, management issues must also be reflected in evaluations.

President Jung said, "Depending on the results of the financial authorities' inspections, compensation items are matters that can be sufficiently reviewed by the board of directors." Lee Chan-jin, Governor of the Financial Supervisory Service, also stated, "We are inspecting including that part," in response to an inquiry on whether the overall management duty of bank presidents is being inspected.

Inquiries regarding the criteria for appointing bank presidents also continued. When Rep. Han Chang-min of the SPD asked President Jung Sang-hyuk about his responsibility for the failure to protect customer information and his intention to seek re-appointment, President Jung replied, "I have not thought about that part right now," adding that he is focusing on victim relief and preventing recurrence.

Rep. Park Hong-bae of the Democratic Party of Korea raised an issue regarding Hana Financial Group changing its term limit regulations ahead of Chairman Ham Young-joo's potential re-appointment. President Lee Ho-seong drew a line, stating that matters of the holding company's board of directors are not within his jurisdiction. In relation to this, Lee Chan-jin, Governor of the Financial Supervisory Service, said he would inspect the management appointment process and consult with the Financial Services Commission regarding institutional improvements related to term and age limits.

Rep. Lee Kang-il of the Democratic Party of Korea emphasized, "Bank president appointments should be decided by the board of directors through a comprehensive inspection of capabilities such as performance and internal control, rather than by the influence of the chairman."

Read the original (Korean)