Regulations Governing the Security Maintenance and Administration of Financial Institutions Article 7

A financial institution shall include the execution of its security operations as an audit item in self-inspection and internal audit. If a security incident was averted or effectively stopped due to the good execution of security operations as mentioned in the preceding paragraph, the financial institution should award relevant personnel. Where poor execution in the first paragraph hereof is adverse to the prevention of security event or results in a security incident, the financial institution should discipline negligent personnel as well as the executive officers of related business unit. In case of a security incident, the competent authority may bar the financial institution from establishing a new branch or adding new business for one year starting from the date of the incident.