Korea Branch Compliance Officer - Insurance cheat sheet

A foreign insurer operating a branch must obtain a life or non-life insurance business licence under the Insurance Business Act (IBA); the branch is the licensed entity, not the parent.

Branch licensing requires filing of the parent's articles, a certified copy of the home-country licence, and evidence of a minimum capital or deposit base held in Korea as prescribed by the FSC.

The FSC (Financial Services Commission) sets policy and grants licences; the FSS (Financial Supervisory Service) conducts examination and enforcement; both operate under the FSC Act and the IBA.

Solvency is measured by the K-ICS (Korean Insurance Capital Standard), a risk-based regime aligned with IFRS 17 that replaced the RBC framework; insurers must maintain the prescribed solvency ratio and file regular reports.

The branch must maintain a claims reserve and a policyholder protection reserve; assets backing Korean policyholder liabilities must generally be held in Korea to satisfy localisation rules.

Product filings: most products require filing with the FSC before sale; some file-and-use items can be sold after filing, while designated products need prior approval.

Sanctions for violations include business suspension, fines, licence revocation, and criminal penalties for officers; the FSS may issue management-improvement orders and corrective orders.

Reporting duties include periodic business reports, solvency reports, and immediate reporting of material events such as a change in the parent's home-country supervisory status.

The Financial Consumer Protection Act (FCPA) imposes six sales-conduct duties: suitability, appropriateness, explanation, prohibition of unfair sales, prohibition of improper solicitation, and advertising rules.

Suitability applies to designated products (e.g., investment-linked and certain savings products); the seller must collect income, assets, and investment purpose and document the assessment.

Appropriateness applies to products such as credit-linked and high-risk products; the seller must assess the consumer's ability to bear loss before recommending.

The explanation duty requires delivery of key product documents and a written confirmation that the consumer understood the material risks; the confirmation must be retained.

Cooling-off (청약철회) rights allow consumers to withdraw within a statutory period for eligible products; the branch must disclose the right and process withdrawals without penalty.

Improper solicitation includes door-to-door sales outside permitted hours, repeated unsolicited contact, and pressure tactics; records of consent and contact must be kept.

Advertising must be accurate and not misleading; mandatory risk warnings and the phrase indicating that the product is protected (or not) by the deposit-protection scheme must appear.

Complaint handling and dispute mediation run through the FSS and the Financial Dispute Mediation Committee; the branch must maintain a complaint register and meet response deadlines.

The Act on Prevention of Money Laundering and Financing of Terrorism (AML Act) applies to insurers as financial institutions; the branch must appoint an AML officer and adopt a written AML policy.

Customer due diligence (CDD) is mandatory at onboarding and on trigger events; enhanced due diligence (EDD) applies to politically exposed persons, high-risk jurisdictions, and unusual transactions.

The branch must verify identity using official documents and, for legal persons, identify beneficial owners holding the prescribed threshold (generally 25% or more).

Suspicious transaction reports (STRs) go to the Korea Financial Intelligence Unit (KoFIU) via the FIU reporting system; tipping off the customer is prohibited.

Recordkeeping: CDD records, transaction records, and STR copies must be retained for the statutory period (generally five years after the transaction or account closure).

Sanctions screening must cover the UN, EU, and Korean sanctions lists, plus OFAC where the parent applies US rules; matches require freezing and reporting to the competent authority.

The branch must screen customers, beneficial owners, payees, and reinsurance counterparties both at onboarding and on list updates.

An independent AML audit or testing function must review the AML programme periodically, and staff must receive periodic AML training with attendance records.

The compliance officer (준법감시인) must be independent of business lines, have access to the board or branch management, and report compliance risk at least annually.

The three-lines-of-defence model: business units own risk, compliance and risk functions monitor, and internal audit provides independent assurance.

The compliance programme must include a risk assessment, policies and procedures, training, monitoring and testing, and issue-tracking with remediation deadlines.

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with laws, regulations, and internal policies.

Monitoring should be risk-based and documented; findings must be logged, assigned an owner, and tracked to closure with evidence.

The compliance officer must escalate material breaches to the FSS and senior management promptly and must not be overruled without documented escalation.

Conflicts between sales incentives and compliance must be managed; the compliance function should review incentive schemes for conduct risk.

Regulatory change management: new or amended rules must be mapped to affected processes, and implementation must be tested and evidenced.

The Korean branch is subject to local governance requirements even where it reports to an overseas parent; local management must have authority over local operations.

The branch manager (지점장) is the local representative with legal responsibility for the branch's compliance with Korean law.

Outsourcing of material functions (e.g., IT, claims processing, call centres) requires prior assessment, a written agreement, and notification or approval where prescribed by the FSS.

The branch remains responsible for outsourced activities; the regulator expects oversight, service-level monitoring, and exit plans for critical outsourced functions.

Operational risk includes process failures, people, systems, and external events; the branch must maintain a risk register, incident reporting, and business continuity plans.

Business continuity and disaster recovery plans must be tested periodically, and critical systems must have recovery objectives documented.

Intra-group arrangements (shared services, reinsurance, funding) must be on arm's-length terms and documented; the FSS may review them for transfer of risk.

The parent's home-country supervisor and the FSS may share information; the branch must maintain records that support both supervisory reviews.

The Personal Information Protection Act (PIPA) governs collection, use, and third-party provision of personal data; consent must be informed, specific, and separately obtained where required.

Sensitive information (health, biometric, financial) requires separate consent and stronger safeguards; insurance underwriting data is typically sensitive.

Cross-border transfer of personal data requires a legal basis: consent, contract necessity, or an adequacy decision; the transfer details must be disclosed to the data subject.

The branch must appoint a privacy officer, maintain a personal data processing register, and conduct impact assessments for high-risk processing.

Security requirements include access controls, encryption of sensitive data, logging, and periodic vulnerability assessment; breaches must be notified to the data subject and the PIPC within prescribed timelines.

The Network Act (Information and Communications Network Act) adds rules for electronic marketing, cookies, and technical security measures.

Financial-sector rules from the FSS require segregation of duties in IT, change management controls, and incident reporting for cyber events.

Data minimisation and retention limits apply: personal data must be destroyed when the purpose is fulfilled, subject to statutory retention obligations.

The FSS coordinates with home-country supervisors of foreign branches through supervisory colleges, memoranda of understanding, and information-sharing arrangements.

The branch must notify the FSS of material changes at the parent, including changes in ownership, licence status, or supervisory action in the home country.

Consolidated supervision by the home supervisor does not displace local Korean requirements; the branch must meet both sets of obligations where they overlap.

Reporting to the FSS includes periodic financial and solvency returns, annual business reports, and ad hoc reports on material events.

Cross-border data sharing with the parent must comply with PIPA transfer rules and any supervisory confidentiality conditions.

Sanctions and AML reporting may require parallel reporting to KoFIU and to the home supervisor; timing and content must be coordinated to avoid tipping off.

The branch must maintain a regulatory calendar and a log of all filings, with evidence of submission and follow-up on regulator queries.

Regulators may conduct on-site examinations; the branch must prepare document packages and designate a liaison for the examination.

Conflicts of interest must be identified, disclosed, and managed; personal trading by staff in insurance-linked securities requires pre-clearance and monitoring.

Gifts and entertainment must follow a written policy with thresholds; acceptance of benefits that could influence decisions is prohibited.

Confidentiality obligations continue after employment; client and supervisory information must not be disclosed except as required by law or with consent.

Whistleblowing channels must be independent and protect reporters from retaliation; the branch must log and investigate reports.

Marketing and sales incentives must not create mis-selling risk; compliance should review incentive structures and clawback arrangements.

Outside business activities and directorships require approval to prevent conflicts with the branch's duties.

Fair treatment of customers is a supervisory expectation: conduct must not exploit consumer misunderstanding or vulnerability.

Ethics training and attestations must be completed periodically and retained as evidence of the control environment.

A foreign insurer operating a branch must obtain a life or non-life insurance business licence under the Insurance Business Act (IBA); the branch is the licensed entity, not the parent.

Branch licensing requires filing of the parent's articles, a certified copy of the home-country licence, and evidence of a minimum capital or deposit base held in Korea as prescribed by the FSC.

The FSC (Financial Services Commission) sets policy and grants licences; the FSS (Financial Supervisory Service) conducts examination and enforcement; both operate under the FSC Act and the IBA.

Solvency is measured by the K-ICS (Korean Insurance Capital Standard), a risk-based regime aligned with IFRS 17 that replaced the RBC framework; insurers must maintain the prescribed solvency ratio and file regular reports.

The branch must maintain a claims reserve and a policyholder protection reserve; assets backing Korean policyholder liabilities must generally be held in Korea to satisfy localisation rules.

Product filings: most products require filing with the FSC before sale; some file-and-use items can be sold after filing, while designated products need prior approval.

Sanctions for violations include business suspension, fines, licence revocation, and criminal penalties for officers; the FSS may issue management-improvement orders and corrective orders.

Reporting duties include periodic business reports, solvency reports, and immediate reporting of material events such as a change in the parent's home-country supervisory status.

The Financial Consumer Protection Act (FCPA) imposes six sales-conduct duties: suitability, appropriateness, explanation, prohibition of unfair sales, prohibition of improper solicitation, and advertising rules.

Suitability applies to designated products (e.g., investment-linked and certain savings products); the seller must collect income, assets, and investment purpose and document the assessment.

Appropriateness applies to products such as credit-linked and high-risk products; the seller must assess the consumer's ability to bear loss before recommending.

The explanation duty requires delivery of key product documents and a written confirmation that the consumer understood the material risks; the confirmation must be retained.

Cooling-off (청약철회) rights allow consumers to withdraw within a statutory period for eligible products; the branch must disclose the right and process withdrawals without penalty.

Improper solicitation includes door-to-door sales outside permitted hours, repeated unsolicited contact, and pressure tactics; records of consent and contact must be kept.

Advertising must be accurate and not misleading; mandatory risk warnings and the phrase indicating that the product is protected (or not) by the deposit-protection scheme must appear.

Complaint handling and dispute mediation run through the FSS and the Financial Dispute Mediation Committee; the branch must maintain a complaint register and meet response deadlines.

The Act on Prevention of Money Laundering and Financing of Terrorism (AML Act) applies to insurers as financial institutions; the branch must appoint an AML officer and adopt a written AML policy.

Customer due diligence (CDD) is mandatory at onboarding and on trigger events; enhanced due diligence (EDD) applies to politically exposed persons, high-risk jurisdictions, and unusual transactions.

The branch must verify identity using official documents and, for legal persons, identify beneficial owners holding the prescribed threshold (generally 25% or more).

Suspicious transaction reports (STRs) go to the Korea Financial Intelligence Unit (KoFIU) via the FIU reporting system; tipping off the customer is prohibited.

Recordkeeping: CDD records, transaction records, and STR copies must be retained for the statutory period (generally five years after the transaction or account closure).

Sanctions screening must cover the UN, EU, and Korean sanctions lists, plus OFAC where the parent applies US rules; matches require freezing and reporting to the competent authority.

The branch must screen customers, beneficial owners, payees, and reinsurance counterparties both at onboarding and on list updates.

An independent AML audit or testing function must review the AML programme periodically, and staff must receive periodic AML training with attendance records.

The compliance officer (준법감시인) must be independent of business lines, have access to the board or branch management, and report compliance risk at least annually.

The three-lines-of-defence model: business units own risk, compliance and risk functions monitor, and internal audit provides independent assurance.

The compliance programme must include a risk assessment, policies and procedures, training, monitoring and testing, and issue-tracking with remediation deadlines.

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with laws, regulations, and internal policies.

Monitoring should be risk-based and documented; findings must be logged, assigned an owner, and tracked to closure with evidence.

The compliance officer must escalate material breaches to the FSS and senior management promptly and must not be overruled without documented escalation.

Conflicts between sales incentives and compliance must be managed; the compliance function should review incentive schemes for conduct risk.

Regulatory change management: new or amended rules must be mapped to affected processes, and implementation must be tested and evidenced.

The Korean branch is subject to local governance requirements even where it reports to an overseas parent; local management must have authority over local operations.

The branch manager (지점장) is the local representative with legal responsibility for the branch's compliance with Korean law.

Outsourcing of material functions (e.g., IT, claims processing, call centres) requires prior assessment, a written agreement, and notification or approval where prescribed by the FSS.

The branch remains responsible for outsourced activities; the regulator expects oversight, service-level monitoring, and exit plans for critical outsourced functions.

Operational risk includes process failures, people, systems, and external events; the branch must maintain a risk register, incident reporting, and business continuity plans.

Business continuity and disaster recovery plans must be tested periodically, and critical systems must have recovery objectives documented.

Intra-group arrangements (shared services, reinsurance, funding) must be on arm's-length terms and documented; the FSS may review them for transfer of risk.

The parent's home-country supervisor and the FSS may share information; the branch must maintain records that support both supervisory reviews.

The Personal Information Protection Act (PIPA) governs collection, use, and third-party provision of personal data; consent must be informed, specific, and separately obtained where required.

Sensitive information (health, biometric, financial) requires separate consent and stronger safeguards; insurance underwriting data is typically sensitive.

Cross-border transfer of personal data requires a legal basis: consent, contract necessity, or an adequacy decision; the transfer details must be disclosed to the data subject.

The branch must appoint a privacy officer, maintain a personal data processing register, and conduct impact assessments for high-risk processing.

Security requirements include access controls, encryption of sensitive data, logging, and periodic vulnerability assessment; breaches must be notified to the data subject and the PIPC within prescribed timelines.

The Network Act (Information and Communications Network Act) adds rules for electronic marketing, cookies, and technical security measures.

Financial-sector rules from the FSS require segregation of duties in IT, change management controls, and incident reporting for cyber events.

Data minimisation and retention limits apply: personal data must be destroyed when the purpose is fulfilled, subject to statutory retention obligations.

The FSS coordinates with home-country supervisors of foreign branches through supervisory colleges, memoranda of understanding, and information-sharing arrangements.

The branch must notify the FSS of material changes at the parent, including changes in ownership, licence status, or supervisory action in the home country.

Consolidated supervision by the home supervisor does not displace local Korean requirements; the branch must meet both sets of obligations where they overlap.

Reporting to the FSS includes periodic financial and solvency returns, annual business reports, and ad hoc reports on material events.

Cross-border data sharing with the parent must comply with PIPA transfer rules and any supervisory confidentiality conditions.

Sanctions and AML reporting may require parallel reporting to KoFIU and to the home supervisor; timing and content must be coordinated to avoid tipping off.

The branch must maintain a regulatory calendar and a log of all filings, with evidence of submission and follow-up on regulator queries.

Regulators may conduct on-site examinations; the branch must prepare document packages and designate a liaison for the examination.

Conflicts of interest must be identified, disclosed, and managed; personal trading by staff in insurance-linked securities requires pre-clearance and monitoring.

Gifts and entertainment must follow a written policy with thresholds; acceptance of benefits that could influence decisions is prohibited.

Confidentiality obligations continue after employment; client and supervisory information must not be disclosed except as required by law or with consent.

Whistleblowing channels must be independent and protect reporters from retaliation; the branch must log and investigate reports.

Marketing and sales incentives must not create mis-selling risk; compliance should review incentive structures and clawback arrangements.

Outside business activities and directorships require approval to prevent conflicts with the branch's duties.

Fair treatment of customers is a supervisory expectation: conduct must not exploit consumer misunderstanding or vulnerability.

Ethics training and attestations must be completed periodically and retained as evidence of the control environment.