South Korea's FSS Considers Lifting Air-Gap Rules for Financial Firms with Strong AI Security

According to a report by South Korean tech media outlet Byline Network, Lee Seok, the Director General of Digital Finance at the Financial Supervisory Service (FSS), stated on October 26, 2026, at the Seoul FinTech Week conference that the regulator is considering a significant policy shift: fully lifting current air-gap (network separation) restrictions for financial institutions that possess sufficient AI security capabilities.

Network separation has long been a cornerstone of financial regulation in many jurisdictions, designed to prevent cyberattacks by physically or logically isolating internal business networks from the external internet. However, Lee noted that while this was once a powerful and simple security measure, it has become ill-suited for the AI era and is cited as a factor hindering the competitiveness of financial firms. He pointed out that even within isolated environments, some systems inevitably require internet connectivity, and over-reliance on air-gapping has led to lax management of external access, revealing security vulnerabilities.

The FSS began implementing a phased roadmap to relax these rules in August 2024. The first stage allowed the use of external generative AI and SaaS services through regulatory sandboxes. The second stage aims to formalize verified pilot projects into standard regulations, while the third stage focuses on establishing a medium-to-long-term security framework where financial institutions bear responsibility for their own security outcomes.

As part of the preparation for the second stage, the FSS has launched tests for relaxing network isolation specifically for generative AI and SaaS usage. In June, 10 institutions were selected from 49 applicants for the first round of testing. Lee stated that the results would be shared across the industry, with plans to expand participation for subsequent rounds.