skip to main contents skip to main menu

Government Legislation

  • Home
  • Legislative Information
  • Government Legislation
  • Partial amendments to the Supervisory Regulations on Credit Information Business
    • Competent Ministry :
    • Advance Publication of Legislation : 2022-05-25
    • Opinion Submission Deadline : 2022-06-01

Some of the Supervisory Regulations on Credit Information will be amended as follows:

“Article 5 (1) of the Enforcement Rule” in Article 13 (1) and (2) shall be changed to “Article 5 of the Enforcement Rule,” respectively.

In Article 15 (1), “Article 5 (2) 1 through 21” of the Enforcement Decree shall be changed to “Article 2 (6) 7 (a) through (ap) of the Enforcement Decree.”


Article 15-2 (1) shall be changed as follows: in the parts other than subparagraphs of paragraph 2 of the same Article, “combination requesting institutions (referring to combination requesting institutions pursuant to Article 14-2 (2) of the Enforcement Decree. Hereinafter the same shall apply.)” shall be changed to “combination requesting institutions;” paragraphs (6) and (7) of the same Article shall be changed to paragraphs (8) and (9), respectively; paragraphs (3) through (5) of the same Article shall be changed to as paragraphs (4) through (6), respectively; paragraphs (3) and (7) are newly inserted in the same Article as follows:


  (1) Each combination requesting institution (referring to a combination requesting institution pursuant to Article 14-2 (2) of the Enforcement Decree. Hereinafter the same shall apply.) shall apply for data-set combination by submitting an application for data-set combination in accordance with Form 8-2 pursuant to Article 14-2 (2) of the Enforcement Decree. However, in a case where an institution that intends to use a data set (hereinafter referred to as an “institution using a data set” in this Article) to be combined applies for data-set combination on behalf of some or all of the combination requesting institutions, an institution using a data set can apply for data-set combination by submitting an application for combination with a written consent stating that the combination requesting institutions agree to the application for the combination to a data-specialized institution.


  (3) When requested by a combination requesting institution, the data-specialized institution shall receive only the combination key from the combination requesting institution before receiving the data set and shall be able to deliver the extracted combination key in order to extract and combine only a part of the data set. In such cases, the data-specialized institution shall prepare protection measures and take necessary actions when extracting and delivering the combination key so that no combination requesting institution can grasp the characteristics of the data set possessed by other combination requesting institutions through the extracted combination key.


  (7) A data-specialized institution may allow a combination requesting institution or an institution using a data set to support adequacy evaluation, etc. if a combination requesting institution or an institution using a data set requests it. In such cases, the data-specialized institution shall decide whether to allow it considering stability, security, and the possibility of re-identification.


In Article 15-2 (5) (formerly paragraph (4)) 1, the “name of the institution subject to the combination” shall be changed to “the name of the institution using a data set”; in the main sentence of paragraph 6 (formerly paragraph 5) of the same Article, “data-specialized institution (referring to a data-specialized institution under Article 14-2 (2) of the Enforcement Decree. Hereinafter the same shall apply.)” shall be referred to as “data-specialized institution”; the same paragraph proviso shall be as follows:


  However, this shall not apply to cases where any of the following arise:

The following subparagraphs shall be newly inserted in Article 15-2 (6) (formerly paragraph (5)).

  1. Where there is no possibility of a conflict of interest considering the purpose of the combination, the institution using a data set, and whether related consideration has been paid;

  2. Where a data-specialized institution (excluding those who were commerce enterprises and corporations under Article 45-3 (1) of the Act before being designated as a data-specialized institution) combines data sets satisfying all of the following requirements:

    A. Other data-specialized institutions shall conduct adequacy evaluation under Article 14-2 (3) 5 of the Enforcement Decree (hereinafter referred to as “adequacy evaluation” in this Article).

    B. A data-specialized institution shall report matters related to the combination of data sets prescribed by the Governor of the Financial Supervisory Service, such as the results of adequacy evaluation, to the Financial Supervisory Service as prescribed by the Governor of the Financial Supervisory Service.

    C. An adequacy evaluation shall not be requested or conducted crossing with other data-specialized institutions to circumvent the requirements under item (a).


Among the parts other than each item of Article 23-3 (3) 1, “a bank under Article 5 (2) 1 of the Enforcement Decree, a financial investment business entity (limited to investment brokers), under subparagraph 8 of the same Article, XXX under subparagraph 8 of the same Article" shall be changed to the following: “Article 2 (6) 7 (g) of the Enforcement Decree; subparagraph XXX (ah) (from Article XXX, subparagraph 16; and "a bank under item (aj) of the same subparagraph, a financial investment business entity (limited to investment brokers) under item (ak) of the same subparagraph", respectively. 


In Article 24-2, “Article 19 (4) of the Enforcement Decree” shall be changed to “Article 19 (5) of the Enforcement Decree.”

Article 26-2 shall be newly inserted as follows:

Information subject to additional intensive management and utilization (information subject to additional intensive management and utilization) pursuant to the proviso to Article 21 (3) of the Article 26-2 of the Enforcement Decree shall refer to the information specified in attached Table 6 and not specified in attached Table 2 of the Enforcement Decree.


“Financial capacity” in Article 28-3 (2) shall be changed to “financial capacity” and “other requirements determined and publicly notified by the Financial Services Commission” in Article 22-4 (1) 4 of the Enforcement Decree. Paragraph 8 of the same Article shall be amended and paragraphs 9 and 10 of the same Article are newly inserted as follows:

  (8) The validity period of designation as a data-specialized institution shall be three years from the date of designation. If a data-specialized institution wants to receive re-designation, it can apply for it from six to nine months before the expiration date of the designation period.


  (9) Article 22-4 (1) through (6) of the Enforcement Decree shall apply mutatis mutandis to details regarding re-designation pursuant to paragraph 8. In this case, “designation” shall be construed as “re-designation.”


  (10) Article 5 (5) through (12) shall apply mutatis mutandis to the inspection period for designation of a data-specialized institution, the imposition of designation conditions, and preliminary designation. In this case, “license” or “authorization” shall be construed as “designation.”

In Article 40-4, the part other than the title shall be paragraph 1, and paragraph 2 shall be newly inserted in the same Article as follows:

  (2) “Methods recognized and publicly notified by the Financial Services Commission” in Article 30-3 (3) 5 of the Enforcement Decree shall refer to methods similar to the methods under Article 30-3 (3) 1 through 4 of the Enforcement Decree, which have safety, security, and convenience of access.

In Article 43-9 (1) 1, “persons (regional banks among the banks under subparagraph 1) under Article 5 (2) 1 through 7 of the Enforcement Decree” shall be changed to “persons under Article 2 (6) 7 (a), (e), (ad), (aj) (excluding regional banks), (al), and (an) through (ap) of the Enforcement Decree”; in subparagraph 2 of the same paragraph, “Article 5 (2) 1” of the Enforcement Decree shall be changed to “Article 2 (6) 7 (b), (f), (g), (ae), (ah), (ai) (excluding resolution financial companies), and (aj) of the same subparagraph of the Enforcement Decree”; in the same paragraph, “persons in subparagraphs 8 (excluding transfer agency companies) and 15 through 18, 20, and 21 (resolution financial companies)” shall be changed to “(ak) (transfer agency companies)” of the same subparagraph; in the proviso to subparagraph 3 of the same paragraph, “Article 5 (2) 9 through 14 and 19 of the Enforcement Decree” shall be changed to “Article 2 (6) 7 (c), (d), (h) through (ac), (af), (ag), and (am) of the Enforcement Decree.”


The main sentence of Article 43-10, subparagraph 2 shall be changed as follows:

   Institutions under each item of Article 2 (6) 7 of the Enforcement Decree.

Attached Table 2-2 and Attached Table 2-4 shall be the same as attached Forms 1 and 2, respectively.

“Article 2 (2) of the Enforcement Decree” in subparagraph 3 of Attached Table 3 Ⅱ shall be changed to “Article 2 (2) of the Enforcement Decree,” and “personal credit information” in subparagraph 3 of the same Table Ⅲ shall be changed to as “personal credit information.”


In subparagraph 2 (a) of attached Table 4, “(a) of 1” shall be changed to “1 (a),” and in subparagraph 3 (a) of the same Table, “(a) of 1” shall be changed to “1 (a).”


“Institutions falling under each subparagraph of Article 5 (2) of the Enforcement Decree” in attached Table 5-2, subparagraph 1 (a) (2) shall be changed to “institutions falling under each item of Article 2 (6) 7 of the Enforcement Decree.”

In the title of Attached Table 6, “(related to Article 24-2 and Article 26-4 (3))” shall be changed to “(related to Article 24-2, Article 26-2, and Article 26-4 (3)).”


Subparagraph 2 (1) (e) of attached Table 6 shall be newly inserted as follows, and “certification for community companies” in subparagraph shall be changed to “certification of community companies, social venture companies, and similar companies.” “When registering information held by public organizations” shall be changed to “when to register information held by public organizations.”


 E.   Relevant other financial transactions 

 State of other financial transactions (including the name, type1), etc. of transaction institutions)

 Among the institutions under Article 21 (2) of 

the Enforcement Decree, the institution holding the relevant registration information

 The relevant

 individual

 Within seven business days from the date of occurrence of the reason 

for registration

 Among the institutions

under Article 21 (2) of 

the Enforcement Decree, the institution holding 

the relevant registration

 information



Note 1) The Committee for Intensive Management of Credit information determines the type applying mutatis mutandis the scope of financial assets under subparagraph 2 of Article 2 of the Act on Real Name Financial Transactions and Confidentiality.


In the parts other than 1 (b) and (2) of Attached Table 7, the text without “.” shall be changed to “: Provided, that institutions falling under Article 22-4 (1) 1 (b) of the Enforcement Decree shall be excluded.”

In the main sentences of parts other than those of subparagraph 3 (1) to (3) of Attached Table 7, “net assets” shall be changed to “an institution that falls under Article 22-4 (1) 1 (b) of the Enforcement Decree, or net assets.”

In the main sentence of Attached Table 8 II (1), “separate internal management plan” shall be changed to “internal management plan.”


Attached Form 8-2 shall be changed to attached Form 3.

In the attached Form 15-2, “Article 36 No 2 (1) of the Act” shall be changed to “Article 36-2 (1) of the Act.”


Regulatory effect assessment
  • 신용정보업감독규정(규제영향분석서)_20220524.hwp [download]
Legislative proposal (draft)
  • 신용정보업감독규정 일부규정개정안.hwp [download]