FSC Eases Network Separation Rules for Security AI

On May 21, FSC Chair Lee Eog-weon held a press briefing at the Government Complex in Seoul and announced a move to loosen network separation rules so AI can be used for security purposes. Per Asiae, Lee said, "With the release of high-performance AI models such as Mythos, it is urgent to build robust security systems, so we plan to urgently relax network separation regulations for AI used for security purposes." Asiae also reports Lee saying, "If a financial institution with strong security capabilities wishes to utilize AI, we will temporarily ease the network separation regulation after an expert review, starting in June."

Seoul Economic Daily reports the FSC held a "Roundtable on Financial Sector Security Threats Related to Advanced AI" on May 22, chaired by Vice Chairman Kwon Dae-young, and that the regulator has convened multiple sessions since concerns surfaced around Anthropic's Mythos. Seoul Economic Daily and MK report the initial eligibility threshold is being limited to roughly 49 financial firms with total assets exceeding 10 trillion won, and that the first cohort of about 10 companies may be selected in June-July to receive non-action opinions or temporary relief. The FSC website has a related press release describing measures to improve the network separation regulatory regime (FSC press release snippet).

MK and Sedaily report industry pushback that many fintech firms, challenger banks, and smaller institutions will be excluded by the quantitative thresholds. MK notes complaints that prominent fintechs such as Kakao Pay, Naver Pay, Toss, and some internet banks may not meet the combined asset-and-employee tests being used for initial eligibility.

Industry observers frame this as an attempt to enable "AI-for-security" workflows, including vulnerability identification and automated defensive tooling delivered via cloud or Security-as-a-Service (SaaS). Companies deploying AI-driven security controls typically require secure data flows, model telemetry, and controlled external connectivity for model updates and threat intelligence ingestion; stringent physical network separation rules can complicate those operational requirements.

Regulatory relief focused on security AI is consistent with patterns seen elsewhere where regulators carve exceptions to legacy controls to permit managed use of cloud-native or SaaS capabilities for cybersecurity. Observers note that starting with a limited, high-assurance cohort is a common regulatory approach to balance operational innovation against systemic risk.

Monitor the FSC's application criteria and the expert-review process for granting temporary exemptions, because those documents will determine which technical architectures are acceptable (on-premises isolated inference, air-gapped hybrids, encrypted telemetry, third-party SaaS with attestations). Also watch whether the FSC publishes technical requirements or certification paths for CISOs seeking exemptions, and whether selected firms publish post-implementation reports documenting controls and incident outcomes.

This is a regulatory adjustment reported as narrowly targeted to permit use of AI for defensive purposes under expert review and limited initial eligibility.