Governance, Outsourcing and Operational Risk for Foreign Branches
What this domain tests
Branch-level governance, the 업무위탁 (outsourcing) regime, cloud usage rules, and operational risk for foreign insurers operating in Korea - including intra-group arrangements with the parent.
Core rules
- A branch is headed by a 지점장 approved by the FSC on suitability grounds; the branch holds 영업기금 and is expected to have local risk management and compliance capability, not merely a sales office.
- Core functions - risk management, compliance, internal control and internal audit - cannot be outsourced. Material outsourcing requires a risk assessment, a written contract with audit and termination rights, FSS notification or approval, and approval of any 재위탁 (sub-outsourcing).
- Cloud arrangements follow the financial-sector cloud guidelines: materiality assessment, data location and access controls, exit plan, and protection against foreign authority access to Korean data.
- Related-party transactions with the parent (services, reinsurance, guarantees) must be on arm's-length terms and approved and disclosed under governance rules.
Worked example
A branch proposes moving policy administration to a group service centre in Manila. Steps: classify the function as material; perform an outsourcing risk assessment; confirm no core function is transferred; execute a contract with audit, confidentiality and exit clauses; complete cross-border data transfer requirements under privacy law; notify the FSS; and document the subcontracting chain.
Traps that cost marks
- Assuming head-office approval satisfies Korean outsourcing requirements.
- Overlooking sub-outsourcing, which needs separate approval.
- Treating cloud hosting as a purely IT decision without a materiality and exit analysis.