Electronic Transaction and Fintech Security

When electronic transaction and fintech services are provided, protection measures to ensure the safety and reliability of transactions must be established and implemented.

• "Electronic transaction" refers to a transaction in which all or part of it is processed by electronic documents when goods or services are traded (Article 2 of the Framework Act on Electronic Documents and Transactions).
• "Electronic commerce" refers to conducting commercial acts by the method of electronic transactions (Article 2 of the Act on Consumer Protection in Electronic Commerce, etc.).
• "Fintech" is a compound word of Finance and Technology, and collectively refers to changes in financial services and industry through the convergence of finance and IT (Financial Services Commission, Financial Terminology Dictionary).
• Electronic (commerce) transaction operators and fintech service providers must establish and implement protection measures (authentication, encryption, access control, etc.) to prevent security incidents in the course of collecting, storing/managing, and destroying users' personal information, trade secrets (transaction-related information whose disclosure could cause business losses, such as counterparty identification information and prices of goods or services), and payment information, in order to ensure the safety and reliability of electronic (commerce) transactions and fintech services.
• In the case of fintech services, it is necessary to reflect the type and characteristics of the fintech service, identify without omission the risk factors that may arise from the relevant fintech service, and apply the necessary protection measures.

※ Laws to consider when establishing electronic transaction and fintech protection measures (examples)

• Framework Act on Electronic Documents and Transactions
• Act on Consumer Protection in Electronic Commerce, etc.
• Electronic Financial Transactions Act
• Act on the Protection of Financial Consumers
• Act on Promotion of Information and Communications Network Utilization and Information Security, etc.
• Credit Information Use and Protection Act
• Personal Information Protection Act, etc.

When integrating with external systems such as payment systems to provide electronic transaction and fintech services, measures to protect the relevant information transmitted and received must be established/implemented, and safety must be inspected.

• An "electronic payment operator" refers to an issuer of electronic payment means, a provider of electronic payment services, or a person who assists or brokers the performance of electronic payment services through the relevant electronic payment means (Article 8 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, etc.), and refers to the following persons:

  • Financial companies, credit card companies, payment means issuers (persons who record/store monetary value or equivalent value on an electronic medium or information processing system and pay it when goods, etc. are purchased), telecommunications billing service providers, and electronic payment settlement agency or brokerage service operators (PG companies, etc.).

  ※ A PG (Payment Gateway) company is a service that handles transactions with financial institutions over the Internet as an agent, and is a company that provides, on others' behalf, various small-amount payment services such as credit card, account transfer, mobile phone payment, and ARS payment.

• Appropriate protection measures must be established/implemented and safety must be inspected so that damage between transaction parties does not arise from security incidents such as leakage, manipulation, or fraud of payment-related information transmitted and received between electronic (commerce) transaction operators and electronic payment operators or fintech service providers.