All regulated financial firms

On July 29, 2026, South Korea's Financial Supervisory Service (FSS) published third-party IT risk management guidelines applicable to financial firms relying on external IT services including cloud and SaaS providers. The guidance makes the board of directors the final owner of third-party IT risk and assigns management the responsibility for building and maintaining the control framework. Financial firms must regularly update information on outsourced providers' financial condition, security posture, data handling, encryption, incident response, and infrastructure. Providers that could materially affect operations or consumers must be designated as 'major third parties' and reviewed at least twice annually. Firms must also maintain business continuity plans, exit strategies, and verify data return and deletion after contract termination. Industry associations plan to develop sector-specific best practices with implementation expected after November 2026.

Verified from source: The Financial Supervisory Service issued 'third-party IT risk management guidelines for financial companies' to systematically manage risks from expanded use of external IT services such as cloud and SaaS. The guidelines assign the board of directors ultimate responsibility for third-party IT risk management and define roles for management and a central management department.