🌐 Language / 語言 / 言語 / Idioma: English 中文 日本語 Español 📋 Korean Law Insight | Korean Legal System By Attorney NOH UJIN | HANBYOL LAW LLC, Seoul Public Notary (공증) System in Korea: A Complete Legal Guide to Document Authentication for Foreign Individuals and Businesses Korea's notarization system — operating under the Notary Public Act (공증인법) and the Civil Procedure Code's provisions on notarial deeds — differs significantly from common-law notary systems familiar to many foreign businesspeople and individuals. Understanding how Korean public notaries (공증인) function is essential for anyone executing powers of attorney, loan agreements, corporate resolutions, or other documents intended for use in Korea or abroad. 1. What Is a Korean Public Notary, and How Does It Differ from the Western Notary? In common-law jurisdictions (US, UK, etc.), a "notary public" is typically a low-level official who verifies identity and witnesses signatures. I...
Get link
Facebook
X
Pinterest
Email
Other Apps
Credit Rating Agency and Credit Information Business Regulation in Korea: A Legal Guide for Foreign Financial Institutions (EN/中文/日本語/Español)
Get link
Facebook
X
Pinterest
Email
Other Apps
-
🌐 Language / 語言 / 言語 / Idioma:
📋 Korean Law Insight | Financial Regulation
By Attorney NOH UJIN | HANBYOL LAW LLC, Seoul
As Korea's financial markets become increasingly intertwined with global capital flows, foreign financial institutions, fintech companies, and lenders operating in Korea must navigate a complex regulatory regime governing credit rating agencies (CRAs) and credit information businesses. The Credit Information Use and Protection Act (신용정보의 이용 및 보호에 관한 법률, "CIUPA") and the Act on Use and Protection of Credit Information establish the framework for how credit data is collected, scored, shared, and used in lending, insurance, and investment decisions across Korea. For foreign companies entering the Korean credit information market — whether as credit rating agencies, credit bureaus, alternative data scorers, or buy-now-pay-later lenders — understanding this regime is essential to lawful market entry.
1. Regulatory Framework Overview
Korea's credit information industry is regulated primarily by the Financial Services Commission (FSC) and supervised day-to-day by the Financial Supervisory Service (FSS). Three categories of licensed entities operate in this space:
Credit Rating Agencies (CRAs): Entities like Korea Ratings, NICE Investors Service, and Korea Investors Service assess the creditworthiness of bonds, corporations, and structured products. Foreign CRAs (e.g., Moody's, S&P, Fitch) typically operate through joint ventures or affiliate arrangements with licensed domestic CRAs rather than direct licensing.
Comprehensive Credit Information Companies (CB companies): Entities such as NICE Information Service and Korea Credit Bureau (KCB) collect and process individual and corporate credit data to generate credit scores used by banks and card companies.
Credit Information Collection Agencies: Smaller-scope entities permitted to collect specific categories of credit information (e.g., debt collection-related data).
2. Licensing Requirements for Foreign Entrants
Under CIUPA Article 4, operating a credit information business without FSC authorization is a criminal offense punishable by imprisonment of up to five years or a fine of up to KRW 50 million. Foreign companies seeking to establish a CRA or CB business in Korea must:
Incorporate a Korean subsidiary (a Korean branch of a foreign CRA generally cannot independently hold a CB license);
Meet minimum capital requirements (typically KRW 5 billion for comprehensive CB companies, lower thresholds for specialized agencies);
Demonstrate IT security infrastructure compliant with FSS's Electronic Financial Supervision Regulations;
Appoint qualified data protection officers under PIPA (Personal Information Protection Act) given the sensitivity of credit data;
Submit a business plan demonstrating sound governance and conflict-of-interest management, particularly important for CRAs rating securities they may have advised on.
3. MyData and Open Banking Integration
Since 2022, Korea's MyData regime under the Credit Information Act allows licensed MyData operators to aggregate a consumer's financial data across institutions with consent. Foreign fintech companies wishing to provide MyData-based credit scoring or financial management services must obtain a separate MyData license, which has its own capital (KRW 500 million) and technical security requirements, including mandatory API-based data transmission (screen scraping was phased out by 2022).
4. Credit Information Use and Cross-Border Data Transfer
Credit information is classified as "sensitive" under both CIUPA and PIPA. Cross-border transfer of Korean consumers' credit data — for example, to a foreign parent company's centralized credit risk model — requires explicit consumer consent, a PIPA-compliant data transfer agreement, and in many cases, FSC pre-notification. The 2024 CIUPA amendments tightened restrictions on overseas outsourcing of credit scoring algorithms, requiring domestic data processing for Korean resident credit files unless specific safeguards (equivalent-level protection certification) are met.
5. Civil and Administrative Liability
Credit information companies and CRAs face liability for inaccurate credit reporting. Under CIUPA Article 43, companies are liable for damages caused by false or outdated credit information, with a reversed burden of proof placing the onus on the credit information company to demonstrate it exercised due care. Consumers also have statutory rights to request correction of inaccurate credit information and to demand disclosure of the basis for an adverse credit score — rights that foreign lenders using Korean credit data in automated decision systems must accommodate.
Frequently Asked Questions (FAQ)
Q1: Can a foreign credit rating agency operate directly in Korea without a Korean subsidiary?
No. Credit rating business for regulatory purposes (e.g., ratings used for bond issuance disclosure) generally requires a Korean-licensed CRA. Foreign CRAs typically enter via minority or majority equity stakes in existing licensed Korean CRAs, or provide "shadow ratings" used informally by international investors without regulatory recognition in Korea.
Q2: How does Korea's credit information regime compare to the U.S. Fair Credit Reporting Act (FCRA) and EU rules?
Aspect
Korea (CIUPA)
US (FCRA)
EU (GDPR/CRA Regulation)
Licensing
FSC authorization required
Registration with CFPB
ESMA registration for CRAs
Consumer correction rights
Statutory right to request correction
Dispute process under FCRA §611
GDPR Art. 16 rectification right
Cross-border data transfer
Consent + PIPA compliance + possible domestic processing mandate
Generally unrestricted domestically
GDPR adequacy/SCC required
Penalties for violation
Up to 5 years imprisonment / KRW 50M fine
Civil penalties, FTC enforcement
Up to 4% global turnover (GDPR)
Q3: What penalties apply for unauthorized credit information business?
Operating without FSC authorization under CIUPA Article 50 can result in imprisonment of up to five years or fines up to KRW 50 million, plus potential business closure orders and referral to prosecutors for aggravated cases involving large-scale data misuse.
Q4: Does a foreign bank's Korean branch need a separate CB license to use credit scores?
No — foreign bank branches may subscribe to and use credit information provided by licensed Korean CB companies (like KCB or NICE) without needing their own CB license, provided they comply with data use consent and retention rules under CIUPA.
Q5: What is the typical timeline and cost for obtaining a MyData license in Korea?
The FSC review process typically takes 4–6 months from application, including document review, on-site IT security inspection, and a pre-emptive consultation stage. Legal and compliance setup costs for foreign entrants commonly range from KRW 150–300 million including local counsel, security audits, and system certification.
Q6: Are alternative data scoring models (e.g., using telecom or e-commerce data) regulated the same way?
Yes. Under the 2020 CIUPA amendments ("Data 3 Laws" reform), any business that processes personal credit information to generate a credit assessment — including alternative data scorers — falls within the licensing perimeter if the output is used for financial decision-making by a third party.
Q7: What compliance steps should a foreign credit information business take before launch?
Engage Korean counsel to assess license category (CRA, comprehensive CB, or specialized CB)
Incorporate a Korean entity meeting minimum capital requirements
Build FSS-compliant IT security infrastructure (network segregation, encryption standards)
Appoint a PIPA-compliant Chief Privacy Officer and data protection staff
Draft consumer consent and credit information use disclosure forms in Korean
Submit FSC application with business plan and governance structure
Need Legal Assistance?
HANBYOL LAW LLC provides expert Korean legal counsel for international clients.
📧 ujin95@hanbl.co.kr | 🌐 www.hanbl.co.kr Initial consultations are complimentary.
A medida que los mercados financieros de Corea se entrelazan cada vez más con los flujos de capital globales, las instituciones financieras extranjeras, las empresas fintech y los prestamistas que operan en Corea deben navegar un régimen regulatorio complejo que rige las agencias de calificación crediticia (CRA) y las empresas de información crediticia. La Ley de Uso y Protección de Información Crediticia ("CIUPA") establece el marco para cómo se recopilan, califican, comparten y utilizan los datos crediticios en las decisiones de préstamo, seguro e inversión en Corea.
1. Resumen del Marco Regulatorio
La industria de información crediticia de Corea está regulada principalmente por la Comisión de Servicios Financieros (FSC) y supervisada diariamente por el Servicio de Supervisión Financiera (FSS). Operan tres categorías de entidades con licencia: agencias de calificación crediticia, empresas integrales de información crediticia (como NICE Information Service y KCB), y agencias de recopilación de información crediticia.
2. Requisitos de Licencia para Entrantes Extranjeros
Según el Artículo 4 de la CIUPA, operar un negocio de información crediticia sin autorización de la FSC es un delito penal castigado con hasta cinco años de prisión o una multa de hasta 50 millones de KRW. Las empresas extranjeras deben: constituir una subsidiaria coreana; cumplir con los requisitos de capital mínimo (típicamente 5 mil millones de KRW); demostrar infraestructura de seguridad de TI conforme a las regulaciones de la FSS; nombrar oficiales de protección de datos calificados bajo la PIPA; y presentar un plan de negocios que demuestre una gobernanza sólida.
3. Integración de MyData y Banca Abierta
Desde 2022, el régimen MyData de Corea bajo la Ley de Información Crediticia permite a los operadores de MyData con licencia agregar los datos financieros de un consumidor entre instituciones con consentimiento. Las empresas fintech extranjeras que deseen ofrecer servicios de puntuación crediticia basados en MyData deben obtener una licencia MyData separada.
4. Uso de Información Crediticia y Transferencia Transfronteriza de Datos
La información crediticia se clasifica como "sensible" tanto bajo la CIUPA como la PIPA. La transferencia transfronteriza de datos crediticios de consumidores coreanos requiere consentimiento explícito del consumidor, un acuerdo de transferencia de datos conforme a la PIPA y, en muchos casos, notificación previa a la FSC.
5. Responsabilidad Civil y Administrativa
Las empresas de información crediticia y las CRA enfrentan responsabilidad por informes crediticios inexactos. Bajo el Artículo 43 de la CIUPA, las empresas son responsables de los daños causados por información crediticia falsa u obsoleta, con una carga de prueba invertida.
Preguntas Frecuentes (FAQ)
P1: ¿Puede una agencia de calificación crediticia extranjera operar directamente en Corea sin una subsidiaria coreana?
No. El negocio de calificación crediticia para fines regulatorios generalmente requiere una CRA con licencia coreana.
P2: ¿Cómo se compara el régimen de información crediticia de Corea con la Ley de Informes Crediticios Justos (FCRA) de EE. UU. y las normas de la UE?
Aspecto
Corea (CIUPA)
EE.UU. (FCRA)
UE (GDPR/Reglamento CRA)
Licencia
Requiere autorización FSC
Registro con CFPB
Registro ESMA
Derecho de corrección
Derecho legal de solicitar corrección
Proceso de disputa FCRA §611
Derecho de rectificación Art. 16 GDPR
Transferencia transfronteriza
Consentimiento + cumplimiento PIPA
Generalmente sin restricciones
Requiere adecuación GDPR/SCC
Sanciones
Hasta 5 años prisión/50M KRW
Sanciones civiles, ejecución FTC
Hasta 4% facturación global (GDPR)
P3: ¿Qué sanciones aplican por negocio de información crediticia no autorizado?
Operar sin autorización de la FSC puede resultar en hasta cinco años de prisión o multas de hasta 50 millones de KRW, además de posibles órdenes de cierre de negocio.
P4: ¿Necesita una sucursal coreana de un banco extranjero una licencia CB separada para usar puntajes crediticios?
No — las sucursales de bancos extranjeros pueden suscribirse y usar información crediticia proporcionada por empresas CB coreanas con licencia sin necesitar su propia licencia CB.
P5: ¿Cuál es el plazo y costo típico para obtener una licencia MyData en Corea?
El proceso de revisión de la FSC típicamente toma de 4 a 6 meses. Los costos de configuración legal y de cumplimiento para entrantes extranjeros suelen oscilar entre 150 y 300 millones de KRW.
P6: ¿Los modelos de puntuación de datos alternativos están regulados de la misma manera?
Sí. Bajo las enmiendas de la CIUPA de 2020, cualquier negocio que procese información crediticia personal para generar una evaluación crediticia cae dentro del perímetro de licencia.
P7: ¿Qué pasos de cumplimiento debe tomar un negocio extranjero de información crediticia antes del lanzamiento?
Contratar asesoría legal coreana para evaluar la categoría de licencia
Constituir una entidad coreana que cumpla con los requisitos de capital mínimo
Construir infraestructura de seguridad de TI conforme a la FSS
Nombrar un Oficial de Privacidad conforme a la PIPA
Redactar formularios de consentimiento del consumidor en coreano
Presentar solicitud ante la FSC con plan de negocios
Someterse a inspección previa al lanzamiento de la FSS
🌐 Language / 語言 / 言語 / Idioma: English 中文 日本語 Español 📋 Korean Law Insight | Transportation Law By Attorney NOH UJIN | HANBYOL LAW LLC, Seoul Korea's passenger transport sector — taxis, car-sharing platforms, and ride-hailing-adjacent services — operates under one of the most tightly regulated mobility frameworks in Asia. Foreign mobility companies, investors, and platform operators considering entry into the Korean market must navigate the Passenger Transport Service Act (여객자동차 운수사업법), licensing quotas, and a legal environment shaped by years of conflict between incumbent taxi operators and new mobility platforms. This guide explains the legal landscape for taxi and car-sharing regulation in Korea. 1. The Passenger Transport Service Act: Licensing Structure All passenger transport businesses in Korea — including taxis, limousine services, and chartered vehicles — require a license under the Passenger Transport Service Act, issued by munici...
How Foreign Creditors Can Recover Debts in South Korea: A Step-by-Step Legal Guide How Foreign Creditors Can Recover Debts in South Korea: A Step-by-Step Legal Guide By Attorney NOH UJIN | HANBYOL LAW LLC, Seoul Labels: Debt Recovery • Cross-Border Litigation • Korean Legal System EN 中文 日本語 Español South Korea's sophisticated legal infrastructure makes it one of the more creditor-friendly jurisdictions in Asia — if you know how to navigate it. For foreign businesses owed money by Korean debtors, understanding the step-by-step legal process is essential to protecting your financial interests. This guide walks you through the primary pathways available under Korean law. 1. Understanding Your Legal Foundations Debt recovery in Korea is governed primarily by two statutes: the Civil Procedure Act (민사소송법) for initiating and conducting litigation, and the Civil E...
Commercial Arbitration in South Korea: What Foreign Businesses Must Know Commercial Arbitration in South Korea: What Foreign Businesses Must Know By Attorney NOH UJIN | HANBYOL LAW LLC, Seoul Labels: Cross-Border Litigation • Business Law • Korean Legal System EN 中文 日本語 Español South Korea has firmly positioned itself as a leading arbitration hub in Northeast Asia. Seoul is home to the Korean Commercial Arbitration Board (대한상사중재원, KCAB), one of the most active arbitral institutions in the region. For foreign businesses entering contracts with Korean counterparties — or seeking to enforce arbitral awards against them — a working knowledge of Korea's arbitration framework is indispensable. 1. The Legal Framework: The Korean Arbitration Act The primary statute governing arbitration in Korea is the Arbitration Act (중재법). Korea substantially reformed its Arbitr...
Comments
Post a Comment