E-book보기 | 대한민국영문법령

이북보기
검색 검색	페이지이동 Article		프린트 목차 연혁

STATUTES

THE REPUBLIC OF KOREA

Volume

ELECTRONIC FINANCIAL TRANSACTIONS ACT

CHAPTER I GENERAL PROVISIONS

Article 1 (Purpose)

The purpose of this Act is to ensure the safety and reliability of electronic financial transactions by clarifying their legal relations and to promote financial conveniences for people and contribute to national economic development by creating a foundation for the sound development of the electronic financial industry.

Article 2 (Definitions)

The terms used in this Act are defined as follows: <Amended on Apr. 27, 2007; Feb. 29, 2008; Mar. 21, 2012; Jun. 1, 2012; May 22, 2013; Jun. 9, 2020>

1. The term "electronic financial transaction" means any transaction whereby a financial company or an electronic financial business entity provides financial products and services through electronic apparatus (hereinafter referred to as "electronic financial business") and users use them in a non-facing and automated manner without any direct contact with employees of the financial company or electronic financial business entity;

Article 1 ~ 2

2. The term "electronic payment transaction" means any electronic financial transaction whereby a person providing a payment (hereinafter referred to as "payer") requires a financial company or an electronic financial business entity to transfer money to another person receiving the payment (hereinafter referred to as "payee") by electronic payment means;

3. The term "financial company" means any of the following institutions, organizations or business entities:

(a) An institution referred to in subparagraphs 1 through 5, 7 and 8 of Article 38 of the Act on the Establishment of Financial Services Commission;

(b) A specialized credit financial company established under the Specialized Credit Finance Business Act;

(d) A community credit cooperative and Korean Federation of Community Credit Cooperatives established under the Community Credit Cooperatives Act;

(e) Any other person prescribed by Presidential Decree, which is an institution, organization, or a business entity carrying on financial business and other finance-related

Article 2

business pursuant to statutes;

4. The term "electronic financial business entity" means any person who has obtained permission or whose business has been registered (excluding any financial company) pursuant to Article 28;

5. The term "subsidiary electronic financial business entity" means any person prescribed by the Financial Services Commission established under Article 3 of the Act on the Establishment, etc. of Financial Services Commission (hereinafter referred to as the "Financial Services Commission"), who assists in electronic financial transactions; or vicariously performs the part of such transactions for a financial company or an electronic financial business entity; or who operates a payment gateway system;

6. The term "payment gateway system" means any financial data processing system that deals with business affairs relating to the settlement of accounts and payments by transmitting electronic financial transaction information between a financial company and an electronic financial business entity;

7. The term "user" means any person who conducts an electronic financial transaction under a contract concluded with a financial company or an electronic financial business entity for facilitating electronic financial transactions (hereinafter referred to as "electronic financial transaction contract");

Article 2

8. The term "electronic apparatus" means any apparatus used to transmit or process electronic financial transaction information by electronic means, such as a cash dispenser, automatic teller machine, debit terminal, computer, telephone, or other devices that transmit or process information by electronic means;

9. The term "electronic document" means any information prepared, transmitted, received or stored pursuant to subparagraph 1 of Article 2 of the Framework Act on Electronic Documents and Transactions;

10. The term "means of access" means any of the following means or information which is used to issue a transaction request in electronic financial transactions or to secure the authenticity and accuracy of users and the details of such transaction:

(a) An electronic card or other electronic information equivalent thereto;

(b) Digital signature generation information under subparagraph 3 of Article 2 of the Digital Signature Act and certificates under subparagraph 6 of the same Article;

(d) Biological

Article 2

information of users;

(e) A password required to use the means or information referred to in item (a) or (b);

11. The term "electronic payment means" means an electronic funds transfer, electronic debit payment means, electronic prepayment means, electronic currency, a credit card, an electronic bond or other means of payment by electronic means;

12. The term "electronic funds transfer" means any transfer of funds by any of the following methods from an account opened with a financial company or an electronic financial business entity (limited to any account linked to a financial company; hereinafter the same shall apply) to another account through electronic apparatus for the purpose of transferring funds between a payer and a payee:

(a) A payment request made by a payer to a financial company or an electronic financial business entity;

(b) A collection request made by a payee (hereinafter referred to as "collection transfer") to a financial company or an electronic financial business entity;

13. The term "electronic debit payment means" means any certificate (excluding

Article 2

any certificate available for loans), or information on such certificate, issued by a financial company or an electronic financial business entity to simultaneously supply goods or services and pay their prices by the method of transferring funds from the account of a financial company between a user and a chain store by electronic means;

14. The term "electronic prepayment means" means any certificate, or information on such certificate, issued with transferable monetary values stored by electronic means, which meets all of the following requirements: Provided, That this shall not include any electronic currency:

(a) It shall be used to purchase goods or services from a third person other than the issuer (including specially related persons prescribed by Presidential Decree) and pay their prices;

(b) It shall be able to purchase goods or services in at least two business categories (referring to mid-classification business categories in the Korean Standard Industrial Classification publicly announced by the Commissioner of the National Statistical Office pursuant to Article 22 (1) of the Statistics Act; hereafter the same shall apply in this Article);

15. The term "electronic currency" means any certificate, or information on such certificate, issued with transferable monetary values stored by electronic means, which meets all of the

Article 2

following requirements:

(a) It shall be used in the areas and chain stores which meet the standards prescribed by Presidential Decree;

(b) It shall meet the requirements referred to in subparagraph 14 (a);

(c) It shall be able to purchase goods or services in at least five business categories and the number of such business categories shall be at least that prescribed by Presidential Decree;

(d) It shall be issued in exchange for the same value of cash or deposits;

(e) It shall be exchangeable for cash or deposits under guarantee of the issuer;

16. The term "electronic bond" means any creditor's monetary claims stated in an electronic document, which meets the following requirements:

(a) The debtor shall designate the creditor;

(b) It shall include the contents of debts;

Article 2

under subparagraph 2 of Article 2 of the Digital Signature Act;

(d) It shall be registered with an electronic bond management agency under Article 29 (1) (hereinafter referred to as "electronic bond management agency") via a financial company;

(e) The debtor shall transmit an electronic document which meets all requirements referred to in items (a) through (c) to the creditor pursuant to Article 6 (1) of the Framework Act on Electronic Documents and Transactions and the creditor shall receive it in accordance with Article 6 (2) of that Act;

17. The term "transaction request" means any request whereby a user asks a financial company or an electronic financial business entity to process electronic financial transactions pursuant to the electronic financial transaction contract;

18. The term "error" means any case where an electronic financial transaction fails to be made pursuant to the electronic financial transaction contract or the user's transaction request neither intentionally nor with negligence;

19. The term "electronic payment settlement agency service" means any service to transmit or receive payment settlement information in purchasing goods or using services by electronic

Article 2

means or to execute as an agent or mediate the settlement of prices thereof;

20. The term "chain store" means any person, other than a financial company or an electronic financial business entity, who supplies goods or services to users in transactions conducted by an electronic debit payment means, electronic prepayment means or electronic currency under a contract concluded with a financial company or an electronic financial business entity;

21. The term "electronic financial infrastructure" means any information processing system used in electronic financial transactions and information and communication network defined in Article 2 (1) 1 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc.;

22. The term “electronic infringement” means any attack on electronic financial infrastructure by means of hacking, computer virus, logic bomb, mail bomb, denial of service, high-powered electromagnetic wave, etc.

Article 3 (Scope of Application)

(1) Except as otherwise provided in other statutes, this Act shall apply to all electronic financial transactions: Provided, That this Act shall not apply to the electronic financial transactions prescribed by Presidential Decree among those conducted under a separate contract between a financial company and an electronic financial business entity. <Amended on May 22, 2013>

Article 3

(2) The provisions of Chapter V shall not apply to the financial companies referred to in subparagraph 3 (c) and (d) of Article 2. <Amended on May 22, 2013>

(3) The following shall not apply to the financial companies prescribed by Presidential Decree, considering the frequency of electronic financial transactions, size of company, etc. among financial companies: <Newly Inserted on May 22, 2013>

1. Meeting the standards set by the Financial Services Commission for the information technology sector, in terms of human resources, facilities, electronic apparatus, etc. and electronic financial business under Article 21 (2);

2. Establishing and submitting plans for the information technology sector under Article 21 (4);

3. Appointing the chief information security officer under Article 21-2;

4. Analyzing and assessing the vulnerability of electronic financial infrastructure under Article 21-3.

Article 4 (Principle of Reciprocity)

This Act shall also apply to a foreigner or foreign corporation: Provided, That with respect to any foreigner or foreign corporation of

Article 4

the State which fails to provide protections corresponding to this Act for any national or corporation of the Republic of Korea, any protection under this Act or the treaties acceded to or concluded by the Republic of Korea may be restricted commensurately therewith.

CHAPTER II RIGHTS AND DUTIES OF PARTIES TO ELECTRONIC FINANCIAL TRANSACTIONS

SECTION 1 Common Provisions

Article 5 (Use of Electronic Documents)

(1) Articles 4 through 7, 9, and 10 of the Framework Act on Electronic Documents and Transactions shall apply to electronic documents used for electronic financial transactions. <Amended on Jun. 1, 2012>

(2) Each electronic document received by a financial company or an electronic financial business entity in relation to a transaction request shall be deemed independent, respectively: Provided, That where the financial company or electronic financial business entity and a user undergoes the procedures for confirmation on an electronic financial transaction contract concluded among them, such procedures shall prevail. <Amended on May 22, 2013>

Article 6 (Selection, Use, and Management of Means of Access)

(1) A financial company

Article 5 ~ 6

or an electronic financial business entity shall select, use and manage the means of access necessary for electronic financial transactions and confirm the identity and authority of a user, the details of a transaction request, etc. <Amended on May 22, 2013>

(2) A financial company or an electronic financial business entity shall issue the means of access only if an application is made by the user after verifying the identity of such user: Provided, That it may be also issued without the user's application nor the verification of the user's identity in any of the following cases: <Amended on May 22, 2013>

1. In case of an electronic prepayment means or electronic currency referred to in the proviso of Article 16 (1);

2. Where a user’s consent is obtained for the renewal, replacement, etc. of the means of access, as prescribed by Presidential Decree.

(3) Except as otherwise provided in other statutes, no one shall commit any of the following acts with respect to the use and management of a means of access: Provided, That the same shall not apply to cases (excluding the act referred to in subparagraph 3 and other acts of arranging or brokering such act) where it is necessary to transfer an electronic prepayment means or electronic currency, or to offer it as security under Article 18: <Amended on Dec. 31, 2008; Jan. 20, 2015; Jan. 27, 2016; May 19, 2020>

1. Transferring

Article 6

or takin over a means of access;

2. Borrowing or lending a means of access, or storing, delivering or distributing a means of access, accompanied by receipt, demand or promise of any compensation;

3. Borrowing or lending a means of access, or storing, delivering or distributing a means of access, for the purpose of using it for any crime or with the knowledge of the fact that it will be used for any crime;

4. Providing a means of access as the object of pledge;

5. Acts of arranging, brokering, advertising, receiving, requesting, or promising for the actions of subparagraphs 1 through 4.

(4) Where a financial company, electronic financial business operator or subsidiary electronic financial business operator (hereinafter referred to as "financial company, etc.") has acquired a user's means of access, such as an error in the operation of electronic apparatus, when it returns such means of access to the user, it may identify the user by requesting, etc. the identification. <Newly Inserted on May 19, 2020>

(5) Grounds for requesting the identity verification under paragraph (4) and the method of identification shall be prescribed by Presidential Decree. <Newly Inserted on May 19, 2020>

Article 6

Article 6-2 (Suspension of Using Telephone Numbers Used in Illegal Advertisements)

(1) When the Prosecutor General, Commissioner of the National Police Agency, or Governor of the Financial Supervisory Service (referring to the Governor of the Financial Supervisory Service under Article 29 of the Act on the Establishment, etc. of Financial Services Commission; hereafter the same shall apply) identifies a telephone number used in illegal advertisements referred to in Article 6 (3) 5, he or she may request the Minister of Science and Information and Communications Technology (ICT) to suspend provision of telecommunications services related to the relevant telephone number. <Amended on Jul. 26, 2017>

(2) A person to whom provision of telecommunications services is suspended following a request made pursuant to paragraph (1) may raise an objection to the person who requested suspension of provision of telecommunications services.

(3) Matters necessary for the procedures, etc. regarding raising of an objection under paragraph (2) shall be prescribed by Presidential Decree.

[This Article Newly Inserted on Jan. 27, 2016]

Article 6-3 (Use and Management of Account Information)

No person shall be allowed to receive or provide information related to an account,

Article 6-2 ~ 6-3

or keep, deliver or distribute such information in using or managing account-related information for any crime, or knowing that such information will be used for any crime.

[This Article Newly Inserted on May 19, 2020]

Article 7 (Confirmation of Transaction Details)

(1) Any financial company or electronic financial business entity shall ensure that a user can confirm the transaction details through an electronic apparatus (including electronic apparatus, if any, stipulated in advance between the financial company or electronic financial business entity and the user) used for electronic financial transactions. <Amended on May 22, 2013>

(2) Any financial company or electronic financial business entity shall, upon a user's request to deliver relevant transaction details in writing (excluding any electronic document; hereinafter the same shall apply), deliver to him or her a document stating the details of his or her transaction within two weeks after receipt of such request. <Amended on May 22, 2013>

(3) Matters concerning the coverage period, types and scope of the transaction details offered pursuant to paragraphs (1) and (2) and other matters shall be prescribed by Presidential Decree.

Article 8 (Correction of Errors)

Article 7 ~ 8

(1) When a user recognizes the existence of any error in electronic financial transactions, he or she may request the relevant financial company or electronic financial business entity to correct such error. <Amended on May 22, 2013>

(2) Upon receipt of a request to correct an error under paragraph (1), any financial company or electronic financial business entity shall immediately investigate and effect appropriate corrections to the processed transaction, and inform the user of the causes of the error and the results of correction by the methods prescribed by Presidential Decree within two weeks after receipt of such request. <Amended on Dec. 31, 2008; May 22, 2013>

(3) When any financial company or electronic financial business entity recognizes the existence of any error in electronic financial transactions, it or he or she shall immediately investigate and effect appropriate corrections to the processed transaction, and inform the user of the causes of the error and the results of correction in the methods prescribed by Presidential Decree within two weeks after recognizing such error. <Amended on Dec. 31, 2008; May 22, 2013>

Article 9 (Liability of Financial Companies or Electronic Financial Business Entities)

(1) When a user suffers any loss due to any of the following incidents, the relevant financial company or electronic financial business entity shall be liable for indemnifying him or her for the

Article 9

loss: <Amended on May 22, 2013>

1. An incident caused by the forgery or alteration of the means of access;

2. An incident caused in the course of electronically transmitting or processing the conclusion of a contract or a transaction request;

3. An incident caused by the use of a means of access acquired by fraudulent or other illegal means by invading electronic apparatus for electronic financial transactions or an information and communication network defined in Article 2 (1) 1 of the Act on Promotion of Information and Communications Network Utilization and Information Protection.

(2) Notwithstanding paragraph (1), a financial company or an electronic financial business entity may require a user to fully or partially bear the liability for any loss in any of the following cases: <Amended on May 22, 2013>

1. Where, with respect to any incident caused by the intention or gross negligence of the user, a prior agreement is made with the user to the effect that all or part of the loss may be borne by the user;

2. Where a corporate user (excluding any small enterprise defined in Article 2 (2) of the Framework Act on Small and Medium Enterprises) suffers any loss although the financial company

Article 9

or electronic financial business entity fulfills the duty of due care reasonably required to prevent incidents, such as the establishment and strict observance of security procedures.

(3) The intention or gross negligence of the user referred to in paragraph (2) 1 shall be limited to that stipulated in the terms and conditions of electronic financial transactions (hereinafter referred to as "terms and conditions") within the limits prescribed by Presidential Decree.

(4) Every financial company or electronic financial business entity shall take measures necessary to discharge the liability provided for in paragraph (1), such as purchasing insurance, joining a mutual aid society or accumulating reserves, pursuant to the standards determined by the Financial Services Commission. <Amended on Feb. 29, 2008; May 22, 2013>

[Title Amended on May 22, 2013]

Article 10 (Liability for Loss or Theft of Means of Access)

(1) Upon receipt of a user's notification of the loss or theft of the means of access, the relevant financial company or electronic financial business entity shall be liable for compensating the user for any loss he or she might suffer due to the use of such means of access by a third party from the time such notification is received: Provided, That the same shall not apply to cases prescribed by Presidential Decree where any damage is caused by the loss, theft, etc. of electronic prepayment means or electronic currency. <Amended on May 22, 2013>

Article 10

(2) Notwithstanding paragraphs (1) and (2) of this Article and Article 9, if any provision of other Acts and subordinate statutes applicable favorably to the user exists, such provision shall prevail.

Article 11 (Status of Subsidiary Electronic Financial Business Entities)

(1) The intention or negligence of a subsidiary electronic financial business entity (including any electronic bond management agency; hereafter the same shall apply in this Chapter) in relation to electronic financial transactions shall be deemed the intention or negligence of the relevant financial company or electronic financial business entity. <Amended on May 22, 2013>

(2) When any financial company or electronic financial business entity compensates the user for any loss caused by the intention or negligence of its or his or her subsidiary electronic financial business entity, it or he or she may exercise the right of indemnity over the subsidiary electronic financial business entity. <Amended on May 22, 2013>

(3) Any user may give various notifications he or she is obligated to give to a financial company or an electronic financial business entity to its or his or her subsidiary electronic financial business entity pursuant to an agreement made with the financial company or electronic financial business entity. In such cases,

Article 11

a notification given to the subsidiary electronic financial business entity shall be deemed to have been given to the relevant financial company or electronic financial business entity. <Amended on May 22, 2013>

SECTION 2 Electronic Payment Transactions

Article 12 (Validity of Electronic Payment Transaction Contracts)

(1) Any financial company or electronic financial business entity shall make a payment by transmitting the amount requested by a payer or payee on a transaction request to the payee or his or her financial company or electronic financial business entity, pursuant to an agreement made with the payer or payee to facilitate electronic payment transactions. <Amended on May 22, 2013>

(2) When any financial company or electronic financial business entity becomes unable to transmit the amount requested pursuant to paragraph (1), it or he or she shall return to the payer the amount received for electronic payment transactions. In such cases, when the failure to transmit the amount is caused by the negligence of the payer, the expenses incurred in relation to such transmission may be deducted. <Amended on May 22, 2013>

Article 13 (Time when Payment Takes Effect)

(1) Where a payment is made by electronic payment means, such payment shall take

Article 12 ~ 13

effect at the time set forth in the following: <Amended on May 22, 2013; Oct. 15, 2014>

1. For electronic funds transfers: When the information on the amount transferred on a transaction request is completely recorded on the ledger of the account of a financial company or an electronic financial business entity with which the payee's account is opened;

2. For withdrawal of cash directly from electronic apparatus: When the payee receives such cash;

3. For payments made by an electronic prepayment means or electronic currency: When the information on the amount requested on a transaction request gets to the electronic apparatus designated by the payee;

4. For payments made by other electronic payment means: When the information on the amount requested on a transaction request is completely input in the electronic apparatus of a financial company or an electronic financial business entity with which the payee's account is opened.

(2) The financial companies or electronic financial business entities prescribed by Presidential Decree in consideration of their total assets, etc. shall, upon their user’s request, ensure that payment of electronic funds transfer takes effect after a certain time has elapsed since such user makes such transaction request, in accordance with the procedures and methods prescribed by Presidential Decree. <Newly Inserted on Oct. 15,

Article 13

2014>

Article 14 (Withdrawal of Transaction Requests)

(1) Any user may withdraw his or her transaction request before the payment takes effect pursuant to each subparagraph of Article 13 (1). <Amended on Oct. 15, 2014>

(2) Notwithstanding paragraph (1), a financial company or an electronic financial business entity and its user may, pursuant to a prior agreement, determine differently the timing for withdrawing a transaction request with respect to any batch transaction, reserved transaction, etc. <Amended on May 22, 2013>

(3) Any financial company or electronic financial business entity shall include in its or his or her terms and conditions the matters relating to the methods and procedures for withdrawing a transaction request under paragraph (1) and the prior agreement under paragraph (2). <Amended on May 22, 2013>

Article 15 (Consent to Withdraw Deposits by Transfer)

(1) Any financial company or electronic financial business entity shall obtain consent from the payer in advance to the withdrawal of deposits to effect a collection transfer, as prescribed by Presidential Decree. <Amended on May 22, 2013>

(2) Any payer may request a financial company or an electronic financial business

Article 14 ~ 15

entity to revoke his or her consent to withdrawal under paragraph (1) before the withdrawal of deposits is completely recorded on the ledger of the payer's account pursuant to a transaction request of the payee. <Amended on May 22, 2013>

(3) Notwithstanding paragraph (2), a financial company or an electronic financial business entity may, pursuant to a prior agreement made with the payer, determine differently the timing for revoking the consent with respect to any batch transaction, reserved transaction, etc. <Amended on May 22, 2013>

(4) Any financial company or electronic financial business entity shall include in its or his or her terms and conditions the matters relating to the methods and procedures for revoking the consent and the prior agreement under paragraphs (2) and (3). <Amended on May 22, 2013>

Article 16 (Issuance, Use, and Exchange of Electronic Currencies)

(1) Any financial company or electronic financial business entity that issues an electronic currency (hereinafter referred to as "electronic currency issuer") shall, in issuing the electronic currency, assign identifiable numbers to the means of access and manage it by linking the numbers to the user's real name (hereinafter referred to as "real name") defined in subparagraph 4 of Article 2 of the Act on Real Name Financial Transactions and Confidentiality or deposit account: Provided, That the same shall not apply to any electronic currency, the upper limit of whose face value does not exceed the amount prescribed

Article 16

by Presidential Decree. <Amended on May 22, 2013>

(2) The electronic currency issuer shall issue the electronic currency in exchange for the same value of cash or deposits.

(3) The electronic currency issuer shall take necessary measures to keep and use the issued electronic currency so that electronic currency holders can use it.

(4) The electronic currency issuer shall, upon a request by its holder, have the duty to exchange such electronic currency for cash or deposits.

(5) The methods and procedures for the issuance and exchange of electronic currency under paragraphs (1) through (4) shall be prescribed by Presidential Decree.

Article 17 (Validity of Payment by Electronic Currencies)

When an electronic currency holder pays the prices of goods or services by electronic currency pursuant to an agreement with the payee, the duty to pay such prices shall be deemed fulfilled.

Article 18 (Transferability of Electronic Currencies)

(1) The holder of an electronic prepayment means or electronic currency may transfer it to a third party or offer it as a security pursuant to an agreement with its issuer.

(2) When an electronic

Article 17 ~ 18

prepayment means or ele currency is transferred to a third party or offered as a security under paragraph (1), it shall be necessarily done via the issuer's central computer system: Provided, That the same shall not apply to any electronic prepayment means whose real name is not confirmed or the electronic currency referred to in the proviso of Article 16 (1).

Article 19 (Refund of Electronic Prepayment Means)

(1) Any financial company or electronic financial business entity that issues an electronic prepayment means shall, upon a request by its holder, refund the balance recorded on such electronic prepayment means pursuant to a prior agreement. <Amended on May 22, 2013>

(2) Any financial company or electronic financial business entity shall enter, in the terms and conditions, the agreement on the refund under paragraph (1) and the fact that it or he or she will fully pay the balance recorded on the electronic prepayment means in any of the following cases: <Amended on May 22, 2013>

1. Where the electronic prepayment means becomes unavailable because it is impracticable for a chain store to supply goods or services due to an act of God, etc.;

2. Where a chain store cannot supply goods or services due to any defect in the electronic prepayment means;

3. Where the balance recorded on the electronic prepayment means falls below

Article 19

a fixed rate. In such cases, the fixed rate shall not be less than 20/100.

Article 20 (Requisite for Setting Up Transfer of Electronic Bonds)

(1) The transfer of electronic bonds shall be deemed to satisfy the requisite for setting up against the obligor referred to in Article 450 (1) of the Civil Act when meeting all the following requirements: <Amended on Jun. 9, 2020>

1. The notice made by the transferor to transfer the electronic bonds or the obligor's consent thereto shall be given through an electronic document bearing the digital signature (referring to the digital signature by which the real name of the signer can be verified) under subparagraph 2 of Article 2 of the Digital Signature Act;

2. The electronic document stating the notice or consent referred to in subparagraph 1 shall be registered with an electronic bond management agency.

(2) The electronic document stating the notice or consent referred to in paragraph (1) shall be deemed to satisfy the requisite for setting up against the obligor referred to in Article 450 (2) of the Civil Act when completing the time-stamp stipulated in Article 18 of the Digital Signature Act and meeting all the requirements referred to in paragraph (1). <Amended on Jun. 9, 2020>

CHAPTER III ENSURING SAFETY OF ELECTRONI

Article 20

C FINANCIAL TRANSACTIONS AND PROTECTION OF USERS

Article 21 (Duty to Ensure Safety)

(1) A financial company, etc. shall fulfill its fiduciary duty of care in good faith so as to ensure safety in handling electronic financial transactions. <Amended on May 22, 2013; May 19, 2020>

(2) In order to ensure the safety and reliability of electronic financial transactions, a financial company etc. shall comply with the standards determined by the Financial Services Commission with respect to the information technology sector, such as human resources, facilities, electronic apparatus, and expenses for conducting electronic transmissions or processing, the electronic financial affairs and certification methods including the use of certificates under the Digital Signature Act. <Amended on Feb. 29, 2008; May 22, 2013; Oct. 15, 2014>

(3) The Financial Services Commission shall not compel the use of any specific technology or service when determining the standards referred to in paragraph (2) and shall endeavor to promote the fair competition of security technologies and certification technologies. <Amended on Oct. 15, 2014>

(4) For safe electronic financial transactions, the financial companies or

Article 21

electronic financial business entities prescribed by Presidential Decree shall annually establish a plan for the information technology sector and submit it to the Financial Services Commission after obtaining confirmation and signature of its or his or her representative, as prescribed by Presidential Decree. <Newly Inserted on May 22, 2013>

Article 21-2 (Appointment of Chief Information Security Officers)

(1) Any financial company or electronic financial business entity shall appoint a chief information security officer to be responsible for managing electronic financial business and information technology security which forms the basis of electronic financial business. <Amended on May 22, 2013>

(2) A financial company or an electronic financial business entity prescribed by Presidential Decree in consideration of its or his or her total assets, number of employees, etc. shall appoint one of the executives (including any person prescribed in Article 401-2 (1) 3 of the Commercial Act) as a chief information security officer. <Amended on May 22, 2013>

(3) The chief information security officer of the financial companies or electronic financial business entities prescribed by Presidential Decree in consideration of its or his or her total assets, number of employees, etc. shall not concurrently perform duties in the information technology sector other than those referred to in paragraph (4). <Newly Inserted on Oct. 15, 2014>

Article 21-2

(4) A chief information security officer under paragraph (1) shall perform the following duties: <Amended on Oct. 15, 2014>

1. Establishing strategies and plans for securing the stability of electronic financial transactions under Article 21 (2) and protecting the users thereof;

2. Protecting the information technology sector;

3. Managing human resources and forming a budget, which are necessary for the security of the information technology sector;

4. Preventing electronic financial transaction accidents, and taking measures therefor;

5. Other matters prescribed by Presidential Decree for securing the stability of electronic financial transactions.

(5) Matters necessary for qualifications, etc. for a chief information security officer shall be prescribed by Presidential Decree. <Amended on Oct. 15, 2014>

[This Article Newly Inserted on Nov. 14, 2011]

Article 21-3 (Analyzing and Assessing Vulnerability of Electronic Financial Infrastructure)

(1) To ensure the

Article 21-3

safety and reliability of electronic financial transactions, a financial company and an electronic financial business entity shall analyze and assess the following matters with respect to its or his or her electronic financial infrastructure and report the findings therefrom (referring to the findings from analysis and assessment of vulnerability, where conducted under Article 9 of the Act on the Protection of Information and Communications Infrastructure) to the Financial Services Commission:

1. Matters relating to the organization, facilities, and internal control of the information technology sector;

2. Matters relating to electronic apparatus and the means of access of the information technology sector;

3. Matters relating to measures to respond to infringements in order to maintain electronic financial transactions;

4. Other matters specified by Presidential Decree.

(2) A financial company and an electronic financial business entity shall establish and implement a plan to take necessary complementary measures based on the findings from analysis and assessment of vulnerability in the electronic financial infrastructure under paragraph (1).

(3) The Financial Services Commission may require public officials under its control to inspect the findings from analysis and assessment of vulnerability in the electronic financial infrastructure

Article 21-3

under paragraph (1) and the actual status of implementing complementary measures pursuant to paragraph (2).

(4) Details of and procedures for analysis and assessment of vulnerability in the electronic financial infrastructure under paragraph (1) and the establishment and implementation of the plan under paragraph (2) and other necessary matters shall be prescribed by Presidential Decree.

[This Article Newly Inserted on May 22, 2013]

Article 21-4 (Prohibition against Electronic Infringement)

No person shall perform any of the following acts:

1. For anyone without access authority to access electronic financial infrastructure, or for anyone with access authority to fabricate, destroy, conceal or leak the stored data beyond his or her authority;

2. Installing programs, such as computer virus, logic bomb, or mail bomb, for the purpose of destroying data of electronic financial infrastructure or obstructing the operation of electronic financial infrastructure;

3. Causing errors or hindrance to electronic financial infrastructure by methods, such as sending mass signal, high-powered electromagnetic wave or data simultaneously or having fraudulent commands be processed, for the purpose of obstructing the stable operation of electronic financial infrastructure.

Article 21-4

[This Article Newly Inserted on May 22, 2013]

Article 21-5 (Notification of Infringement Incidents)

(1) If an incident, such as disturbance or paralysis of electronic financial infrastructure, occurs due to an electronic infringement (hereinafter referred to as “infringement incident”), the relevant financial company and electronic financial business entity shall, without delay, inform the Financial Services Commission thereof.

(2) If an infringement incident occurs, the relevant financial company and electronic financial business entity shall analyze the causes thereof and take necessary measures to prevent the spread of damage.

[This Article Newly Inserted on May 22, 2013]

Article 21-6 (Response to Infringement Incidents)

(1) The Financial Services Commission shall perform the following duties to respond to infringement incidents:

1. Collecting and disseminating information on infringement incidents;

2. Issuing preannouncements and warnings about infringement incidents;

3. Taking emergency

Article 21-5 ~ 21-6

measures against infringement incidents;

4. Other matters prescribed by Presidential Decree for responding to infringement incidents.

(2) Procedures and methods necessary for performing the duties referred to in paragraph (1) and other matters shall be prescribed by Presidential Decree.

[This Article Newly Inserted on May 22, 2013]

Article 22 (Creation, Preservation and Destruction of Electronic Financial Transaction Records)

(1) A financial company, etc. shall create the records (hereafter referred to as “electronic financial transaction records” in this Article) necessary to trace and search the details of electronic financial transactions or to verify or correct any error in such details and shall preserve them for a period prescribed by Presidential Decree within up to five years. <Amended on May 22, 2013; Oct. 15, 2014>

(2) If the preservation period under paragraph (1) elapses and any commercial transaction relation, including financial transactions, is terminated, a financial company, etc. shall, within five years, destroy the relevant electronic financial transaction records (excluding credit information under the Credit Information Use and Protection Act; hereafter the same shall apply in this paragraph): Provided, That this shall not apply

Article 22

in any of the following cases: <Newly Inserted on Oct. 15, 2014>

1. Where it is inevitable to meet any obligation under other statutes;

2. Other cases determined by the Financial Services Commission, where it is necessary to preserve electronic financial transaction records.

(3) The types, preservation methods, destruction procedures and methods of electronic financial transaction records to be preserved by financial companies, etc. in accordance with paragraphs (1) and (2), and the standards for determining the day when a commercial transaction relation is terminated shall be prescribed by Presidential Decree. <Amended on May 22, 2013; Oct. 15, 2014>

[Title Amended on Oct. 15, 2014]

Article 23 (Issuance and Limit of Use of Electronic Payment Means)

(1) The Financial Services Commission may require a financial company or an electronic financial business entity to set the following limits or take other necessary measures, in consideration of the characteristics of electronic payment means, as prescribed by Presidential Decree: <Amended on Feb. 29, 2008; May 22, 2013>

1. The upper limit

Article 23

of the face value of an electronic currency and electronic prepayment means to be issued;

2. The limit of use of electronic funds transfer;

3. The limit of use of electronic debit payment means.

(2) The Financial Services Commission may require a financial company or an electronic financial business entity to set the upper limit of cash withdrawal from electronic apparatus or may take other necessary measures, as prescribed by Presidential Decree. <Newly Inserted on May 22, 2013>

[Title Amended on May 22, 2013]

Article 24 (Clarification of Terms and Conditions and Notification of Alterations thereof)

(1) Any financial company or electronic financial business entity shall clarify the terms and conditions in concluding a contract for electronic financial transactions with a user, and, at the request of a user, deliver a copy of the terms and conditions to the user, along with explaining the details thereof, in the manner prescribed by the Financial Services Commission. <Amended on Feb. 29, 2008; May 22, 2013>

(2) No financial company or electronic financial business entity shall, if it or he or she has concluded a contract in violation of paragraph (1), assert that the details of the terms and conditions are included in the relevant contract. <Amended on May

Article 24

22, 2013>

(3) Any financial company or electronic financial business entity shall, if it or he or she has altered the terms and conditions, publish the altered terms and conditions and inform the users thereof by one month prior to the enforcement of the altered terms and conditions, in the manner prescribed by the Financial Services Commission: Provided, That if the terms and conditions are urgently altered due to any amendment to Acts and subordinate statutes, it or he or she shall promptly publish the terms and conditions so altered and inform the users thereof in such manner prescribed by the Financial Services Commission. <Amended on Feb. 29, 2008; May 22, 2013>

(4) Any user may terminate a contract for electronic financial transactions by no later than the business day immediately preceding the enforcement date of the altered terms and conditions after the details of the altered terms and conditions are published or informed pursuant to paragraph (3). When the user fails to raise an objection against the details of the altered terms and conditions within the period referred to in the first sentence, he or she shall be deemed to have approved the altered terms and conditions.

Article 25 (Preparation and Alteration of Terms and Conditions)

(1) When a financial company or an electronic financial business entity intends to prepare or alter the terms and conditions for electronic financial transactions, it or he or she shall in advance report thereon to the Financial Services Commission: Provided,

Article 25

That in cases determined by the Financial Services Commission which do not adversely affect the rights, interests or duties of users, a report may be file to the Financial Services Commission within 10 days after the terms and conditions is prepared or altered. <Amended on Feb. 29, 2008; May 22, 2013>

(2) The Financial Services Commission may recommend a financial company or an electronic financial business entity to alter the terms and conditions under paragraph (1) if necessary to maintain orderly electronic financial transactions. <Amended on Feb. 29, 2008; May 22, 2013>

(3) The Financial Services Commission may determine the period and procedures for reporting the preparation or alteration of the terms and conditions under paragraph (1) and other necessary matters. <Amended on Feb. 29, 2008>

(4) Paragraphs (1) through (3) shall not apply to the financial companies defined in subparagraph 3 (c) and (d) of Article 2. <Amended on May 22, 2013>

Article 26 (Provision of Electronic Financial Transaction Information)

No one who recognizes the existence of any of the following matters in the course of performing duties relating to electronic financial transactions shall provide or disclose such information to any third party or use it for any purpose other than his or her duties without the consent of the relevant user: Provided,

Article 26

That the same shall not apply to cases provided for in the proviso of Article 4 (1) of the Act on Real Name Financial Transactions and Confidentiality or in any other statute:

1. The matters relating to the identity of the user;

2. The information or materials relating to the accounts, the means of access, and the details and results of electronic financial transactions of the user.

Article 27 (Settlement and Mediation of Disputes)

(1) Any financial company or electronic financial business entity shall prepare procedures to reflect reasonable opinions or complaints presented by users in relation to electronic financial transactions and to compensate for any loss sustained by users in the course of conducting electronic financial transactions, as prescribed by Presidential Decree. <Amended on May 22, 2013>

(2) When a user has an objection to the processing of electronic financial transactions, he or she may demand the settlement of dispute, such as compensation for losses, pursuant to the procedures determined under paragraph (1) or file an application for mediation of dispute with the Financial Supervisory Service, the Korea Consumer Agency, etc. <Amended on May 22, 2013>

(3) Detailed procedures and methods for the settlement of disputes and the application for mediation of disputes under paragraphs (1) and

Article 27

(2) a other matters shall be prescribed by Presidential Decree.

(4) Any financial company or electronic financial business entity shall clarify the procedures referred to in paragraphs (1) through (3) in concluding a contract for electronic financial transactions. <Amended on May 22, 2013>

CHAPTER IV PERMISSION, REGISTRATION AND FUNCTIONS OF ELECTRONIC FINANCIAL BUSINESS

Article 28 (Permission and Registration of Electronic Financial Business)

(1) Any person who intends to engage in a business issuing and managing electronic currencies shall obtain permission therefor from the Financial Services Commission: Provided, That the same shall not apply to the banks provided for in the Banking Act and other financial companies prescribed by Presidential Decree. <Amended on Feb. 29, 2008; May 17, 2010; May 22, 2013>

(2) Any person who intends to provide any of the following services shall register himself or herself with the Financial Services Commission: Provided, That the same shall not apply to the banks provided for in the Banking Act and other financial companies

Article 28

prescribed by Presidential Decree: <Amended on Feb. 29, 2008; May 17, 2010; May 22, 2013>

1. Electronic funds transfer services;

2. Issuance and management of electronic debit payment means;

3. Issuance and management of electronic prepayment means;

4. Electronic payment settlement agency services;

5. Other electronic financial services prescribed by Presidential Decree.

(3) Notwithstanding paragraph (2), any of the following persons may provide the services referred to in each subparagraph of the said paragraph without registering himself or herself with the Financial Services Commission: <Amended on Feb. 29, 2008>

1. Any person who issues an electronic prepayment means falling under any of the following cases:

(a) Where it is only used at chain stores meeting the standards prescribed by Presidential Decree, such as the chain stores located within specially designated buildings;

(b) Where the total balance of its issued amount does not exceed

Article 28

the amount prescribed by Presidential Decree;

(c) Where it is an electronic prepayment means, the price of which has not been pre-paid directly by a user and is covered by a refund guarantee insurance, etc. as prescribed by Presidential Decree to discharge the liability for monetary values stored by the user;

2. Any person who performs the electronic payment settlement agency services prescribed by Presidential Decree, such as delivering information only for the electronic processing of electronic payment transactions without direct involvement in the transfer of funds.

(4) Article 4, Chapters II (excluding Article 19) and III (excluding Articles 21 (4), 21-2, 21-3, 23 and 25), and Articles 37, 38, 39 (1) and (6), 41 (1), 43 (2) and (3), 46, 46-2, and 47 concerning electronic financial business entities shall apply mutatis mutandis to the persons who issue electronic prepayment means exempted from registration under paragraph (3) 1 (c): Provided, That Articles 25, 39 (2) through (5), and 40 (2) and (3) shall apply mutatis mutandis where the financial incidents prescribed by Presidential Decree occur, such as insolvency due to any illegal or unjust act committed by the relevant executive officers or employees. <Amended on May 22, 2013; Oct. 15, 2014>

(5) The Financial Services Commission may attach a condition to the permission

Article 28

granted under paragraph (1). <Amended on Feb. 29, 2008>

Article 29 (Registration of Electronic Bond Management Agencies)

(1) Any person who intends to engage in a business registering and managing electronic bonds shall register himself or herself with the Financial Services Commission. <Amended on Feb. 29, 2008>

(2) Articles 21, 22, 39, 41, and 43 shall apply mutatis mutandis to the electronic bond management agencies which are registered to carry out the business of registering and managing electronic bonds pursuant to paragraph (1).

(3) The procedures and methods for the registration of electronic bonds by electronic bond management agencies and other necessary matters shall be prescribed by Presidential Decree.

Article 30 (Capital)

(1) Any person who intends to obtain permission pursuant to Article 28 (1) shall be a stock company with a capital of at least five billion won.

(2) Either of the following entities is eligible for registration pursuant to Article 28 (2) 1 through 3, and its capital or total investment shall exceed the amount prescribed by Presidential Decree, which is at least two billion won for each category of business: <Amended on May 22, 2013>

1. A company provided

Article 29 ~ 30

for in Article 170 of the Commercial Act;

2. A corporation incorporated under a special Act (limited to the issuance and management of electronic prepayment means under Article 28 (2) 3 to perform the duties provided for in the relevant Act).

(3) An entity eligible for registration pursuant to Article 28 (2) 4 and 5 and Article 29 shall be a company provided for in Article 170 of the Commercial Act or a corporation stipulated in Article 32 of the Civil Act, the capital, total investments or fundamental property of which exceeds the amount prescribed by Presidential Decree, which is at least the amount referred to in the following subparagraphs for each category of business: <Amended on Mar. 29, 2016>

1. A person who intends to operate below the standard defined by the Financial Services Commission, within the scope in which the total amount of electronic financial transactions per quarter does not exceed three billion won (excluding a person who intends to register pursuant to Article 29): An amount prescribed by Presidential Decree of at least 300 million won;

2. A person not falling under subparagraph 1: An amount prescribed by Presidential Decree of at least 500 million won.

(4) Where a person falling under paragraph (3) 1 registers pursuant to Article

Article 30

28 and continues to exceed the standard defined by the Financial Services Commission under paragraph (3) 1 for at least two consecutive quarters, he or she shall report the relevant details to the Financial Services Commission, and shall satisfy the requirements for capital under paragraph (3) 2 within the period set by the Financial Services Commission. <Newly Inserted on Mar. 29, 2016>

Article 31 (Requirements for Permission and Registration)

(1) Any person who intends to obtain permission or file for registration pursuant to Articles 28 and 29 shall meet all of the following requirements. Subparagraphs 4 and 5 shall only apply to permission:

1. He/she shall hold the capital or fundamental property referred to in Article 30;

2. He/she shall be equipped with professional human resources and physical installations, such as computer equipment, sufficient to protect users and carry out the intended business;

3. He/she shall meet the standards of financial soundness prescribed by Presidential Decree;

4. The person shall have a feasible and sound business plan;

5. He/she shall secure the major investors prescribed by Presidential Decree, with sufficient investment capability, sound financial

Article 31

state and social credit.

(2) Matters necessary for the detailed requirements for permission and registration under paragraph (1) shall be determined by the Financial Services Commission. <Amended on Feb. 29, 2008>

Article 32 (Disqualification for Permission and Registration)

None of the following persons are entitled to permission or registration under Articles 28 and 29: <Amended on Feb. 29, 2008>

1. A corporation for which one year has not yet passed since its registration was cancelled pursuant to Article 34, and a person who was a large stockholder (referring to any such investor prescribed by Presidential Decree; hereinafter the same shall apply) of the corporation at the time of cancellation of such registration and for whom one year has not yet passed since the registration was cancelled;

2. A corporation for which three years have not yet passed since its permission or registration was revoked pursuant to Article 43 (1), and a person who was a large stockholder of the corporation at the time of such revocation and for whom three years have not yet passed since such revocation;

3. A company which is in process of the rehabilitation procedure pursuant to the Debtor Rehabilitation and Bankruptcy Act and

Article 32

the large stockholders of such company;

4. Any person who has failed to pay a debt within an agreed period in financial transactions and other commercial transactions and who is determined by the Financial Services Commission;

5. Any person who has been punished by a fine or heavier punishment for violating the finance-related Acts or subordinate statutes prescribed by Presidential Decree within the three years preceding the date of application for permission or registration;

6. A corporation whose large stockholder falls under any of subparagraphs 1 through 5.

Article 33 (Applications for Permission, Registration and Authorization)

(1) Any person who intends to obtain permission or authorization or file for registration pursuant to Article 28, 29, or 45 shall submit an application therefor to the Financial Services Commission, as prescribed by Presidential Decree. <Amended on Feb. 29, 2008; May 22, 2013>

(2) Upon receipt of an application under paragraph (1), the Financial Services Commission shall grant permission, registration, or authorization and notify the applicant of the results, as prescribed by Presidential Decree. <Amended on Feb. 29, 2008; May 22, 2013>

Article 33

(3) When the Financial Services Commission grants permission, registration or authorization pursuant to Articles 28, 29, and 45, it shall, without delay, publish the details thereof in the Official Gazette and inform the general public thereof through computer communications, etc. <Amended on Feb. 29, 2008; May 22, 2013>

[Title Amended on May 22, 2013]

Article 33-2 (Preliminary Permission)

(1) Any person who intends to obtain permission under Article 28 (1) (hereafter referred to as “final permission” in this Article) may, in advance, file an application for preliminary permission with the Financial Services Commission.

(2) When the Financial Services Commission decides whether to grant preliminary permission under paragraph (1), it shall verify that the person who intends to obtain preliminary permission meets all requirements for final permission.

(3) The Financial Services Commission may impose terms and conditions on the preliminary license referred to in paragraph (2).

(4) Where a person who has obtained a preliminary license files an application for a formal license, the Financial Services Commission shall determine whether to grant a formal license after verifying whether that person have complied with the conditions of a preliminary license and met all requirements for a formal

Article 33-2

license.

(5) Article 33 (1) and (2) shall apply mutatis mutandis to preliminary permission.

[This Article Newly Inserted on May 22, 2013]

Article 34 (Cancellation of Registration Subject to Application)

(1) Any person who has been granted registration pursuant to Articles 28 (2) and 29 may file an application for the cancellation of such registration, as prescribed by Presidential Decree.

(2) The Financial Services Commission shall, upon receipt of an application under paragraph (1), cancel the registration without delay. <Amended on Feb. 29, 2008>

(3) When the Financial Services Commission has cancelled registration pursuant to paragraph (2), it shall, without delay, publish the details thereof in the Official Gazette and inform the general public thereof through computer communications, etc. <Amended on Feb. 29, 2008>

Article 35 (Restriction on Concurrent Businesses)

(1) Any electronic financial business entity who has obtained permission pursuant to Article 28 (1) shall be prohibited from concurrently engaging in any business other than the following:

1. Services provided

Article 34 ~ 35

for in the subparagraphs of Article 28 (2) (limited to registered ones);

2. Business permitted pursuant to Article 28 (1) and other business prescribed by Presidential Decree and necessary to provide the services referred to in subparagraph 1.

(2) Notwithstanding paragraph (1), any electronic financial business entity who has obtained permission pursuant to Article 28 (1) may engage in the business other than those referred to in the subparagraphs of paragraph (1), if it or he or she is provided with payment guarantee by the financial companies prescribed by Presidential Decree or purchase refund guarantee insurance for all of the non-refunded portions of electronic currency. <Amended on May 22, 2013>

Article 36 (Prohibition of Use of Similar Names)

(1) The name 'electronic currency' shall be used only for the electronic currency referred to in subparagraph 15 of Article 2.

(2) Any person who has failed to obtain permission pursuant to Article 28 (1) may not use the phrase ‘electronic currency' in his or her trade name.

Article 37 (Matters to be Observed by Chain Stores)

(1) No chain store shall refuse to provide goods or services, or treat any user unfavorably, on the grounds that transactions are conducted by electronic debit payment means, electronic prepayment

Article 36 ~ 37

means or elecronic currency (hereinafer referred o as "electronic currency, etc.").

(2) No chain store shall charge users a merchant fee to be borne by such store.

(3) No chain store shall commit any of the following acts:

1. Pretending that a transaction is conducted by electronic currency, etc. without providing goods or services;

2. Conducting transactions by electronic currency, etc. in excess of actual turnover;

3. Conducting transactions by electronic currency, etc. under the name of another chain store;

4. Lending the name of the chain store to a third party;

5. Conducting, as an agent, transactions by electronic currency, etc.

(4) A person other than a chain store shall not conduct any transaction by electronic currency, etc. under the name of a chain store.

Article 38 (Recruitment of Chain Stores)

(1) In recruiting a chain store, any financial company or electronic financial business entity shall confirm whether the store seeking membership actually carries on its own business: Provided, That

Article 38

the same shall not apply to a chain store which has already been confirmed pursuant to Article 16-2 of the Specialized Credit Finance Business Act. <Amended on May 22, 2013>

(2) No financial company or electronic financial business entity shall have its or his or her chain store bear a loss incurred by either of the following transactions: Provided, That the same shall not apply where a financial company or an electronic financial business entity concludes a contract with its or his or her chain store to the effect that such loss shall be fully or partially borne by the chain store when the financial company or electronic financial business entity proves the intention or gross negligence of the chain store in connection with the transaction: <Amended on May 22, 2013>

1. A transaction conducted using a lost or stolen electronic currency, etc.;

2. A transaction conducted using a forged or altered electronic currency, etc.

(3) Any financial company or electronic financial business entity shall inform its or his or her chain stores of the following matters, in the manner prescribed by the Financial Services Commission: <Amended on Feb. 29, 2008; May 22, 2013>

1. A merchant fee to be borne by chain stores;

Article 38

2. Liability for chain stores under paragraph (2);

3. Matters to be observed by chain stores under Article 37.

(4) When a chain store is sentenced to a punishment for violating Article 37 or receives a written notification of such violation from the relevant administrative agency, and thus falls under the grounds prescribed by Presidential Decree, the relevant financial company or electronic financial business entity shall, without delay, terminate the contract with the said chain store unless any special ground exists to the contrary. <Amended on May 22, 2013>

CHAPTER V SUPERVISION OF ELECTRONIC FINANCIAL BUSINESS

Article 39 (Supervision and Inspection)

(1) The Financial Supervisory Service (referring to the Financial Supervisory Service established under Article 24 (1) of the Act on the Establishment of Financial Services Commission; hereinafter the same shall apply) shall supervise whether financial companies and electronic financial business entities abide by this Act or orders issued under this Act, following instructions from the Financial Services Commission. <Amended on Feb. 29, 2008; May 22, 2013>

(2) The Governor of the Financial Supervisory Service may require a financial

Article 39

company or an electronic financi business entity to report on its or his or her business operations and financial conditions if necessary to conduct supervision under paragraph (1). <Amended on Feb. 29, 2008; May 22, 2013; Jan. 27, 2016>

(3) The Governor of the Financial Supervisory Service may inspect the electronic financial business and other related financial conditions of a financial company and an electronic financial business entity and, if deemed necessary to conduct such inspection, ask the financial company and the electronic financial business entity to submit data relating to its or his or her business operations and financial conditions or to order the attendance of all relevant persons. <Amended on May 22, 2013>

(4) Any person who conducts an inspection pursuant to paragraph (3) shall carry an identification indicating his or her authority and present it to relevant persons.

(5) Upon conducting an inspection pursuant to paragraph (3), the Governor of the Financial Supervisory Service shall report the findings therefrom to the Financial Services Commission, as determined by the Financial Services Commission. <Amended on Feb. 29, 2008>

(6) When a financial company or an electronic financial business entity is deemed likely to undermine the sound operation of the financial company or electronic financial business entity in violation of any provision of this Act or any order issued under

Article 39

this Act, the Financial Services Commission may, upon recommendation of the Governor of the Financial Supervisory Service, take any of the following measures or authorize the Governor of the Financial Supervisory Service to take any measure referred to in subparagraphs 1 through 3: <Amended on Feb. 29, 2008; May 22, 2013; Apr. 18, 2017>

1. Corrective order against violations;

2. Issuing a caution or warning against a financial company or an electronic financial business entity;

3. Demanding caution, warning or reprimand against an executive officer or employee;

4. Recommending dismissal of an executive officer (excluding an operating officer under subparagraph 5 of Article 2 of the Act on Corporate Governance of Financial Companies; hereafter the same shall apply in Article 39-2) or suspending performance of his or her duties.

Article 39-2 (Notice of Measures Taken against Retired Executive Officers)

(1) Where, if a retired executive officer or employee (including an operating officer under subparagraph 5 of Article 2 of the Act on Corporate Governance of Financial Companies) of a financial company or electronic financial business entity held office as such, he or she would be deemed to be subject to any measure falling under Article 39 (6) 3 or 4, the Financial Services

Article 39-2

Commission (including the Governor of the Financial Supervisory Service authorized to take measures pursuant to Article 39 (6)) may notify the head of such financial company or electronic financial business entity of the details of such measure.

(2) The head of a financial company or electronic financial business entity in receipt of a notification under paragraph (1) shall notify the retired executive officer or employee of such fact, and keep and maintain the content of such notification.

[This Article Newly Inserted on Apr. 18, 2017]

Article 40 (Supervision and Inspection of Outside Orders)

(1) Where a financial company or an electronic financial business entity concludes or alters a contract with its or his or her subsidiary electronic financial business entity for affiliation, entrustment or outside orders (hereafter referred to as “outside order, etc.” in this Article) in relation to electronic financial transactions (including where a subsidiary electronic financial business entity concludes or alters a contract with another subsidiary electronic financial business entity for outside orders, etc.), it or he or she shall meet the standards determined by the Financial Services Commission to ensure the safety and reliability of electronic financial transactions and the soundness of the financial company and electronic financial business entity. <Amended on Feb. 29, 2008; May 22, 2013>

(2) Where the contents

Article 40

of a contract under paragraph (1) are deemed likely to undermine the operational soundness of a financial company or an electronic financial business entity and the rights and interests of users, the Financial Services Commission may direct the financial company or electronic financial business entity to correct or supplement the relevant contents of the contract. <Amended on Feb. 29, 2008; May 22, 2013>

(3) When the Governor of the Financial Supervisory Service conducts an inspection of a financial company or an electronic financial business entity in relation to outside orders, etc. under paragraph (1), he or she may request its or his or her subsidiary electronic financial business entity to submit data pursuant to the standards determined by the Financial Services Commission. <Amended on Feb. 29. 2008; May 22, 2013>

(4) When a subsidiary electronic financial business entity fails to submit data under paragraph (3) or submit insufficient data, the Governor of the Financial Supervisory Service may investigate the relevant subsidiary electronic financial business entity. <Newly Inserted on May 22, 2013>

(5) The Governor of the Financial Supervisory Service may request the following from a subsidiary electronic financial business entity, if deemed necessary for conducting an investigation under paragraph (4): <Newly Inserted on May 22, 2013>

1. Submitting

Article 40

a written statement relating to matters subject to such investigation;

2. Submitting a ledger, document or other articles necessary for such investigation;

3. Attendance of a relevant person.

(6) A subsidiary electronic financial business entity entrusted with any duties related to the data protection of the information technology sector shall not re-entrust such duties to a third party: Provided, That this shall not apply to cases recognized by the Financial Services Commission within the extent not impairing the protection and safe processing of electronic financial transaction information. <Newly Inserted on Oct. 15, 2014>

(7) Article 39 (4) shall apply mutatis mutandis to investigations conducted under paragraph (4). <Newly Inserted on May 22, 2013; Oct. 15, 2014>

[Title Amended on May 22, 2013]

Article 41 (Requests, etc. for Submission of Data by Bank of Korea)

(1) When the Monetary Policy Committee deems it necessary for implementing monetary credit policies and facilitating the smooth operation of payment and settlement systems in relation to electronic payment transactions, the Bank of Korea may request a financial

Article 41

company or an electronic fin business entity to submit data. In such cases, the scope of data so requested shall be limited to a necessary minimum in consideration of the work burden of the relevant financial company and electronic financial business entity. <Amended on May 22, 2013>

(2) When the Monetary Policy Committee deems it necessary for implementing monetary credit policies, the Bank of Korea may request the Financial Supervisory Service to inspect the electronic currency issuer and the financial company and electronic financial business entity registered to provide the service referred to in Article 28 (2) 1 or to conduct a joint inspection thereof with the Bank of Korea. <Amended on May 22, 2013>

(3) Articles 87 and 88 of the Bank of Korea Act and Article 62 of the Act on the Establishment of Financial Services Commission shall apply mutatis mutandis to the methods and procedures for making requests under paragraphs (1) and (2). <Amended on Feb. 29, 2008>

Article 42 (Keeping Separate Accounts and Guidance for Sound Management)

(1) A financial company and an electronic financial business entity shall keep separate accounts by the category of business provided for in Article 28 (1) and (2) to analyze the performance of business relating to fund management and electronic financial transactions, and prepare a report on the business relating to

Article 42

electronic financial transactions and the outcomes of management and submit it to the Financial Services Commission, as determined by the Financial Services Commission. <Amended on Feb. 29, 2008; May 22, 2013; Oct. 15, 2014>

(2) The Financial Services Commission may set the standards for management guidance for the following matters to direct the sound management of a financial company or an electronic financial business entity that performs the business relating to electronic financial transactions and to prevent electronic financial incidents, as prescribed by Presidential Decree: <Amended on Feb. 29, 2008; May 22, 2013>

1. Matters relating to the appropriateness of capital;

2. Matters relating to the soundness of assets;

3. Matters relating to liquidity;

4. Other matters necessary to secure soundness of management.

(3) Where any financial company or electronic financial business entity that has obtained permission under Article 28 (1) is deemed likely to severely undermine the soundness of its or his or her own management, such as failing to meet the standards for management guidance under paragraph (2), the Financial Services Commission may request it or him or her to take necessary measures to improve its or his or her own management, such

Article 42

as increasing capital and limiting dividends. <Amended on Feb. 29, 2008; May 22, 2013>

(4) Articles 10, 11 (1), (4) and (5), 13-2, 14, 14-2 through 14-4, 14-7, 15 through 19, 27, and 28 of the Act on the Structural Improvement of the Financial Industry shall apply mutatis mutandis to the measures, etc. necessary to be taken when the financial standing of the financial company or electronic financial business entity that has obtained permission under Article 28 (1) falls short of the standards for management guidance under paragraph (2) or is evidently deemed to fall short of the said standards due to any serious financial incident or insolvency claims. <Amended on May 22, 2013>

Article 43 (Revocation of Permission or Registration)

(1) When a financial company or an electronic financial business entity falls under any of the following cases, the Financial Services Commission may revoke permission or registration under Article 28: <Amended on Feb. 29, 2008; May 22, 2013>

1. Where it, he, or she has obtained permission or registration under Article 28 by fraudulent or other illegal means;

2. Where it, he, or she falls under any of subparagraphs 1 through 5 of Article 32;

3. Where it, he, or she has violated an order to suspend business issued

Article 43

under paragraph (2);

4. Where it, he, or she has failed to run a business for one or more consecutive years without any just ground;

5. Where it, he, or she has virtually closed its or his or her business due to the merger, bankruptcy or business closure of the relevant corporation or on other grounds.

(2) When a financial company or an electronic financial business entity falls under any of the following cases, the Financial Services Commission may order it or him or her to wholly or partially suspend the relevant business with a given period of up to six months: <Amended on Feb. 29, 2008; May 22, 2013; Mar. 29, 2016>

1. Where it or he or she has violated Article 6 (1) or (2), 16 (1) through (4), 19 (1), 21 (1) or (2), 21-5 (2), 35, 36, or 38 (3) or (4);

2. Where it or he or she has failed to investigate an error and effect appropriate corrections, in violation of Article 8 (2) and (3);

3. Where it or he or she has failed to comply with any measure, direction or order taken or issued by the Financial Services Commission under Article 23, 39 (6), 40 (2) or 42 (3).

4. Where it or he or she fails to file a report under Article 30 (4) or

Article 43

fails to satisfy the equiements within the peiod.

(3) A financial company or an electronic financial business entity, whose business is wholly or partially suspended or permission or registration is revoked under paragraphs (1) and (2), may even so continue to perform the payment and settlement business of electronic financial transactions conducted prior to such disposition. <Amended on May 22, 2013>

(4) When the Financial Services Commission revokes permission or registration under paragraph (1), it shall, without delay, publish the details thereof in the Official Gazette and inform the general public thereof through computer communications, etc. <Amended on Feb. 29, 2008>

Article 44 (Hearings)

When the Financial Services Commission intends to revoke permission or registration under Article 43 (1), it shall hold a hearing thereon. <Amended on Feb. 29, 2008>

Article 45 (Authorization for Merger, Dissolution, or Business Closure)

(1) When any electronic financial business entity who has obtained permission pursuant to Article 28 (1) intends to engage in any of the following activities, he or she shall obtain authorization therefor from the Financial Services Commission, as prescribed by Presidential Decree: <Amended on Feb. 29, 2008; May

Article 44 ~ 45

22, 2013>

1. A merger with another financial company or electronic financial business entity;

2. Dissolution or the closure of electronic financial business;

3. Transfer and takeover all or part of business.

(2) The Financial Services Commission may attach a condition to authorization under paragraph (1). <Amended on Feb. 29, 2008>

Article 45-2 (Preliminary Authorization)

(1) Any person who intends to obtain authorization under Article 45 (1) (hereafter referred to as “final authorization” in this Article) may, in advance, file an application for preliminary authorization with the Financial Services Commission.

(2) When the Financial Services Commission decides whether to grant preliminary authorization under paragraph (1), it shall verify whether the person who intends to obtain preliminary authorization meets all requirements for final authorization.

(3) The Financial Services Commission may impose conditions on preliminary authorization under paragraph (2).

(4) Where a person who has obtained preliminary authorization applies for substantive

Article 45-2

authorization, the Financial Services Commission shall decide whether to grant substantive authorization after verifying that the person has fulfilled the imposed conditions on preliminary authorization under paragraph (3) and meets all requirements for substantive authorization.

(5) Article 33 (1) and (2) shall apply mutatis mutandis to preliminary authorization.

[This Article Newly Inserted on May 22, 2013]

Article 46 (Penalty Surcharges)

(1) Where a financial company or an electronic financial business entity provides or discloses any electronic financial transaction information to any other person, or uses it for any purpose other than its duties in violation of Article 21 (1) or (2), the Financial Services Commission may impose a penalty surcharge not exceeding five billion won. <Newly Inserted on Oct. 15, 2014>

(2) Where a financial company or an electronic financial business entity comes to fall under any of the subparagraphs of Article 43 (2) (excluding cases where a penalty surcharge is imposed under paragraph (1)), the Financial Services Commission may, as prescribed by Presidential Decree, impose a penalty surcharge not exceeding 50 million won in lieu of an order to suspend business. <Amended on Feb. 29, 2008; May 22, 2013; Oct. 15, 2014>

(3) The amount

Article 46

of a penalty surcharge for each type, severity, etc. of violations subject to the imposition of a penalty surcharge under paragraph (1) or (2) and other necessary matters shall be prescribed by Presidential Decree. <Amended on Oct. 15, 2014>

(4) Where a penalty surcharge under paragraph (1) or (2) is not paid within a prescribed period, the Financial Services Commission shall collect it in the same manner as delinquent national taxes are collected. <Amended on Feb. 29, 2008; Oct. 15, 2014>

(5) The Financial Services Commission may entrust duties concerning both collection of penalty surcharges and dispositions on default to the Commissioner of the National Tax Service, as prescribed by Presidential Decree. <Amended on Feb. 29, 2008; Oct. 15, 2014>

Article 46-2 (Refund of Overpayments or Erroneous Payments)

(1) Where a person obliged to pay a penalty surcharge requests a refund of the overpaid or erroneously paid penalty surcharge on grounds of adjudication on the objection or a court ruling, the Financial Services Commission shall, without delay, make a refund thereof, and shall refund the overpaid or erroneously paid penalty surcharge confirmed by the Financial Services Commission, even without a request from the person obliged to pay such penalty surcharge.

(2) If a person entitled to a refund has to pay other penalty surcharges to the Financial Services Commission, the Financial Services Commission

Article 46-2

may appropriate the refund for such penalty surcharges when making a refund of overpayments or erroneous payments under paragraph (1).

(3) When making a refund of overpayments or erroneous payments under paragraph (1), the Financial Services Commission shall refund additional money calculated by applying the interest rate on additional money prescribed by Presidential Decree, for the period from the day following the payment date of the penalty surcharge to the date of refund.

[This Article Newly Inserted on May 22, 2013]

CHAPTER Ⅵ SUPPLEMENTARY PROVISIONS

Article 47 (Statistical Surveys of Electronic Financial Transactions)

(1) The Bank of Korea may conduct a statistical survey of electronic financial businesses and electronic financial transactions to apprehend the current status of electronic financial transactions and to establish and implement effective monetary credit policies. In such cases, it may request necessary data from a government agency, financial company, etc., and a corporation and organization related to electronic financial transactions. <Amended on May 22, 2013>

(2) Upon receipt of a request for data under paragraph (1), a government agency, financial company, etc., and a corporation and organization related to electronic financial transactions shall comply

Article 47

with such request unless any just ground exists to the contrary. <Amended on May 22, 2013>

(3) Matters necessary for the subject matter, methods and procedures of the statistical survey under paragraph (1) shall be prescribed by Presidential Decree.

Article 48 (Delegation of Authority)

The Financial Services Commission may entrust the Governor of the Financial Supervisory Service with part of its authority under this Act, as prescribed by Presidential Decree. <Amended on Feb. 29, 2008>

CHAPTER VII PENTALTY PROVISIONS

Article 49 (Penalty Provisions)

(1) Any of the following persons shall be punished by imprisonment with labor for not more than 10 years, or by a fine not exceeding 100 million won: <Newly Inserted on Oct. 15, 2014>

1. A person who accesses any electronic financial infrastructure or fabricate, destroy, conceal, or leak any stored data, in violation of subparagraph 1 of Article 21-4;

2. A person who destroys any data or installs programs, such as a computer virus, a logic bomb, a mail bomb, in violation of subparagraph 2 of Article 21-4;

3. A person who

Article 48 ~ 49

sends mass signal, high-pwered electrmagnetic wave r data simultaneously or causes errors or hindrance to electronic financial infrastructure, in violation of subparagraph 3 of Article 21-4;

4. A person who provides or leaks any electronic financial transaction information to any other person or uses such information for any purpose other than his or her duties (including a person issuing an electronic prepayment means applicable mutatis mutandis pursuant to Article 28 (4)), in violation of Article 26.

(2) Any of the following persons shall be punished by imprisonment with labor for not more than seven years, or by a fine not exceeding 50 million won: <Amended on May 22, 2013; Oct. 15, 2014>

1. A person who forges or alters a means of access;

2. A person who arranges the sale of, sells, exports, imports, or uses a forged or altered means of access;

3. A person who arranges the sale of, sells, exports, imports, or uses a lost or stolen means of access;

4. A person who intrudes into any electronic financial infrastructure or any electronic apparatus for electronic financial transactions to acquire a means of access by fraud or other unjustifiable means, or conducts electronic financial transactions by using the means of access so acquired;

Article 49

5. A person who arranges the sale of, sells, exports, imports or uses a means of access which was extorted, embezzled, or acquired by deceiving or blackmailing other person;

6. Deleted. <Oct. 15, 2014>

(3) Electronic currencies shall be deemed valuable securities with respect to which a person might be charged with any of the crimes prescribed in Articles 214 through 217 of the Criminal Act, and a crime involving with electronic currencies shall be subject to the punishment provided for in each of such Articles, correspondingly. <Amended on Oct. 15, 2014>

(4) Any of the following persons shall be punished by imprisonment for not more than five year or by a fine not exceeding 30 million won: <Newly Inserted on May 19, 2020>

1. Any person who acquires or transfers a means of access in violation of Article 6 (3) 1;

2. Any person who borrows or lends a means of access, or storing, delivering or distributing a means of access, in violation of Article 6 (3) 2 or 3;

3. Any pledger or pledgee who violates Article 6 (3) 4;

4. Any person

Article 49

who conducts arrangement, brokerage, advertisement, or solicitation while receiving, requesting, or promising in return, in violation of Article 6 (3) 5;

5. A person who is provided with or provides information related to an account, or a person who keeps, conveys, or distributes an account, in violation of Article 6-3.

(5) Any of the following persons shall be punished by imprisonment with prison labor for not more than three year, or by a fine not exceeding 20 million won: <Amended on Dec. 31, 2008; Jan. 20, 2015; Jan. 27, 2016; May 19, 2020>

1. Deleted; <May 19, 2020>

2. Deleted; <May 19, 2020>

3. Deleted; <May 19, 2020>

4. Deleted; <May 19, 2020>

5. Any person who performs the duties without permission or registration under Article 28 or 29;

6. Any person who obtains permission or registration under Article 28 or 29 by fraudulent or other illegal means;

7. Any person who conducts a transaction by electronic currency, etc. under the name of another chain store in violation of Article 37 (3) 3;

Article 49

8. Any person who has conducted, as an agent, transactions by electronic currency, etc. in violation of Article 37 (3) 5;

9. Any person who conducts a transaction by electronic currency, etc. under the name of another chain store in violation of Article 37 (4);

10. Any person who peruses or is provided with electronic financial transaction information by fraudulent or other illegal means.

(6) A person who steals another's property shall be punished by imprisonment for not more than one years or by a fine not exceeding 10 million won. <Amended on May 19, 2020>

1. Deleted; <Dec. 31, 2008>

2. Deleted; <May 22, 2013>

3. Any person who refuses to provide goods or services, or treats any user unfavorably, on grounds of transaction by electronic currency, etc. in violation of Article 37 (1);

4. Any person who charges a user a merchant fee to be borne by the relevant chain store in violation of Article 37 (2);

5. Any person

Article 49

who lend the name of a chain store to a third party in violation of Article 37 (3) 4;

6. Any person who engages in an activity falling under any subparagraph of Article 45 (1) without authorization under Article 45 (1).

(7) An attempt to commit the crimes referred to in paragraphs (1) 1, 2, and 3 and (2) 1, 2, and 4 shall be subject to punishment. <Amended on Oct. 15, 2014; May 19, 2020>

(8) Imprisonment with labor and a fine under paragraphs (1) through (7) may be imposed concurrently. <Amended on May 19, 2020>

Article 50 (Joint Penalty Provisions)

(1) If the representative of a corporation, or any agent, employee or other employed persons of a corporation or individual has committed any offence falling under Article 49 (1), (2), (3) (limited to where any person is subject to the punishment prescribed in Article 216 of the Criminal Act) and (4) through (7) in connection with the duties of such corporation or individual, not only shall such offender be punished, but also such corporation or individual shall be punished by the fines prescribed in the relevant Article: Provided, That where such corporation or individual has not been negligent in giving due attention and supervision concerning the relevant duties to prevent such offense, this shall not apply. <Amended on Oct. 15, 2014; May 19, 2020>

(2) If the representative

Article 50

of a corporation, or any agent, employee or other employed persons of a corporation or individual has committed any offense falling under Article 49 (3) (limited to where any person is subject to the punishment prescribed in Article 214, 215, or 217 of the Criminal Act) in connection with the duties of such corporation or individual, not only shall such offender be punished, but also such corporation or individual shall be punished by a fine not exceeding 50 million won: Provided, That where such corporation or individual has not been negligent in giving due attention and supervision concerning the relevant duties to prevent such offense, this shall not apply. <Amended on Oct. 15, 2014>

[This Article Wholly Amended on Nov. 14, 2011]

Article 51 (Administrative Fines)

(1) Any of the following persons (in cases falling under subparagraph 3, including persons who issue electronic prepayment means to which the relevant provisions apply mutatis mutandis pursuant to the proviso of Article 28 (4)) shall be subject to an administrative fine not exceeding 50 million won: <Amended on Oct. 15, 2014; Apr. 18, 2017>

1. A person who fails to either perform his or her duties with the due care of a good manager or comply with the standards determined by the Financial Services Commission, in violation of Article 21 (1) or (2);

2. A person who uses the name ‘electronic currency’, in violation of Article

Article 51

36;

3. A person who refuses, obstructs or evades an inspection, data submission, a request for attendance and an investigation under Article 39 (3) (including cases where Article 39 (3) applies mutatis mutandis in Article 29 (2)) or Article 40 (3) and (4);

4. A person who fails to submit a report or submits a false report, in violation of Article 42 (1).

(1) Any of the following persons shall be subject to an administrative fine not exceeding 20 million won: <Amended on Feb. 15, 2014; Apr. 18, 2017>

1. A person who fails to have the payment of electronic funds transfer take effect, in violation of Article 13 (2);

2. A person who fails to appoint the chief information security officer or appoint an executive officer as the chief information security officer, in violation of Article 21-2 (1) or (2);

3. A person who has the chief information security officer concurrently perform duties in the information technology sector other than those under Article 21-2 (4) or himself/herself concurrently performs duties in such sector, in violation of paragraph (3) of that Article;

4. A person who fails to analyze and assess the vulnerabilities of the electronic

Article 51

financial infrastructure, in violation of Article 21-3 (1);

5. A person who fails to formulate and implement a plan for complying with complementary measures, in violation Article 21-3 (2);

6. A person who fails to destroy any record of electronic financial transactions, in violation of Article 22 (2);

7. A person who makes a re-entrustment to a third party, in violation of Article 40 (6).

(3) Any of the following persons (including any person issuing an electronic prepayment means applicable mutatis mutandis pursuant to Article 28 (4), in cases falling under subparagraphs 1, 6 through 8, and 10) shall be punished by an administrative fine not exceeding 10 million won: <Amended on Apr. 18, 2017>

1. Any person who fails to deliver a document stating the details of a transaction, in violation of Article 7 (2);

2. Any person who fails to inform the relevant user of the causes of an error and results of correction, in violation of Article 8 (2) and (3);

3. Any person who transfers an electronic prepayment means or electronic currency to a third party or provides it as a security, in violation of Article 18 (2);

Article 51

4. Any person who fails to submit a plan for the information technology sector, in violation of Article 21 (4);

5. Any person who fails to report the findings from analysis and assessment of vulnerability in electronic financial infrastructure, in violation of Article 21-3 (1);

6. Any person who fails to inform the Financial Services Commission of an infringement incident, in violation of Article 21-5 (1);

7. Any person who fails to create or keep records in violation of Article 22 (1) (including where it is applicable mutatis mutandis under Article 29 (2));

8. Any person who fails to clarify, explain, deliver, publish or notify the terms and conditions, in violation of Article 24 (1) or (3);

9. Any person who fails to report to the Financial Services Commission, in violation of Article 25 (1);

10. Any person who fails to prepare the procedures for the settlement of disputes, in violation of Article 27 (1);

11. Deleted; <Apr. 18, 2017>

12. Any person who fails to keep separate accounts by the category of business provided for in Article 28 (1) and (2), in violation

Article 51

of Article 42 (1).

(5) Administrative fines under paragraphs (1) through (4) shall be imposed and collected by the Financial Services Commission, as prescribed by Presidential Decree. <Amended on Apr. 18, 2017>

[This Article Wholly Amended on May 22, 2013]

ADDENDA <Act No. 7929, Apr. 28, 2006>

Article 1 (Enforcement Date)

This Act shall enter into force on January 1, 2007.

Article 2 (Transitional Measures concerning Means of Access, etc.)

The means of access and electronic payment means issued as at the time this Act enters into force shall be deemed to have been issued pursuant to this Act.

Article 3 (Transitional Measures concerning Permission and Registration)

(1) Any person who is engaged in issuing or managing electronic currency as at the time this Act enters into force shall obtain permission therefor from the Financial Supervisory Commission pursuant to Article 28 (1) within three months from the date when this Act takes effect.

Addenda

(2) Any person who is engaged in performing electronic funds transfer services, the issuance and management business of electronic debit payment means or electronic prepayment means or electronic payment settlement agency services, etc. as at the time this Act enters into force shall file a registration with the Financial Supervisory Commission pursuant to Article 28 (2) within six months from the date when this Act takes effect.

(3) Any person who is engaged in the business of electronic bond management agency as at the time this Act enters into force shall file a registration with the Financial Supervisory Commission pursuant to Article 29 within three months from the date when this Act takes effect.

Article 4 Omitted.

ADDENDA <Act No. 8387, Apr. 27, 2007>

Article 1 (Enforcement Date)

This Act shall enter into force six months after the date of its promulgation.

Articles 2 through 9 Omitted.

ADDENDA <Act No. 8863, Feb. 29, 2008>

Article 1 (Enforcement Date)

This Act shall enter

Addenda

into force on the date of its promulgation.

Articles 2 through 5 Omitted.

ADDENDUM <Act No. 9325, Dec. 31, 2008>

This Act shall enter into force three months after the date of its promulgation.

ADDENDA <Act No. 10303, May 17, 2010>

Article 1 (Enforcement Date)

This Act shall enter into force six months after the date of its promulgation. (Proviso Omitted.)

Articles 2 through 10 Omitted.

ADDENDUM <Act No. 11087, Nov. 14, 2011>

This Act shall enter into force six months after the date of its promulgation.

ADDENDA <Act No. 11407, Mar. 21, 2012>

Article 1 (Enforcement Date)

This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)

Articles 2 and 3 Omitted.

Addenda

ADDENDA <Act No. 11461, Jun. 1, 2012>

Article 1 (Enforcement Date)

This Act shall enter into force three months after the date of its promulgation.

Articles 2 through 10 Omitted.

ADDENDA <Act No. 11814, May 22, 2013>

Article 1 (Enforcement Date)

This Act shall enter into force six months after the date of its promulgation.

Article 2 (Applicability to Submission of Plans for Information Technology Sector)

The submission of a plan for the information technology sector under the amended provisions of Article 21 (4) shall begin to apply from the business year beginning after this Act enters into force.

Article 3 (Transitional Measures concerning Penalty Provisions and Administrative Fines)

The application of penalty provisions and the imposition of administrative fines for violations committed before this Act enters into

Addenda

force shall be governed by the former provisions.

ADDENDA <Act No. 12837, Oct. 15, 2014>

Article 1 (Enforcement Date)

This Act shall enter into force six months after the date of its promulgation: Provided, That the amended provisions of Articles 13 (2) and 21 (2) and (3) shall enter into force one year after the date of its promulgation.

Article 2 (Applicability to Prohibition against Concurrent Position of Chief Information Security Officers)

The amended provisions of Article 21-2 (3) shall apply beginning with the first chief information security officer appointed (including cases where he or she is reappointed) after this Act enters into force.

Article 3 (Applicability to Prohibition against Re-Entrustment of Duties Related to Information Protection)

The amended provisions of Article 40 (6) shall apply beginning with the first case where any duty is re-entrusted or a re-entrustment period is extended after this Act enters into force.

Article 4 (Applicability to Imposition of Penalty Surcharges)

The amended provisions of Article 46 (1) shall apply beginning with the first

Addenda

financial company or electronic financial business entity who commits any violation after this Act enters into force.

Article 5 (Transitional Measures concerning Penalty Provisions and Administrative Fines)

The application of penalty provisions and the imposition of an administrative fine for any violation committed before this Act enters into force shall be governed by the former provisions of this Act.

ADDENDA <Act No. 13069, Jan. 20, 2015>

Article 1 (Enforcement Date)

This Act shall enter into force on the date of its promulgation.

Article 2 (Transitional Measures concerning Penalty Provisions)

The application of penalty provisions to any violation committed before this Act enters into force shall be governed by the former provisions of this Act.

ADDENDUM <Act No. 13929, Jan. 27, 2016>

This Act shall enter into force on the date of its promulgation: Provided, That the amended provisions of Article 6-2 shall enter into force six months after the date of its pro

Addenda

mulgation.

ADDENDUM <Act No. 14132, Mar. 29, 2016>

This Act shall enter into force three months after the date of its promulgation.

ADDENDA <Act No. 14828, Apr. 18, 2017>

Article 1 (Enforcement Date)

This Act shall enter into force six months after the date of its promulgation.

Article 2 (Applicability to Notification of Details of Measures against Retired Executive Officer)

The amended provisions of Article 39-2 shall also apply to the executive officers and employees who have committed a violation before this Act enters into force, but resign or retire thereafter.

Article 3 (Transitional Measures concerning Demand for Suspension of Performance of Duties)

Notwithstanding the amended provisions of Article 39 (6) 4 (limited to the suspension of performance of duties), the former provision shall apply to the violations committed before this Act enters into force.

ADDENDA <Act No. 14839, Jul. 26, 2017>

Addenda

Article 1 (Enforcement Date)

This Act shall enter into force on the date of its promulgation: Provided, That among the Acts amended pursuant to Article 5 of the Addenda, amendments to the Acts which have been promulgated before this Act enters into force, but the enforcement dates of which have not yet arrive, shall enter into force on the enforcement dates of the relevant Acts, respectively.

Articles 2 through 6 Omitted.

ADDENDUM <Act No. 17297, May 19, 2020>

This Act shall enter into force six months after the date of its promulgation: Provided, That the amended provisions of Articles 6 (4) and (5) and 21 shall enter into force six months after the date of its promulgation.

ADDENDA <Act No. 17354, Jun. 9, 2020>

Article 1 (Enforcement Date)

This Decree shall enter into force six months after the date of its promulgation. (Proviso Omitted.)

Articles 2 through 8 Omitted.

Addenda