Concerns Arise Over Bank of Korea’s CBDC Pilot Lacking Independent Audit

Bank of Korea’s CBDC Pilot Skips Independent Security Audit

South Korea’s first pilot program for a central bank digital currency (CBDC) has come under scrutiny for conducting its trials without an independent government security inspection. Instead, the pilot, which ran from April to June last year, was evaluated based primarily on self-review processes by participating banks.

Details of the Security Review Process

Documents from the Financial Supervisory Service (FSS) revealed that no separate security audit was performed during or after the pilot phase. Prior to the pilot’s commencement, a limited IT security review and vulnerability assessment took place in February, which relied heavily on internal assessments conducted by Woori Bank and NongHyup Bank, along with contributions from the Financial Security Institute and cybersecurity firm SK Shields.

Implications of Lack of Independent Oversight

The absence of an independent inspection raises significant concerns about the reliability of the evaluations conducted. Financial authorities did not provide evidence of an external audit taking place after the completion of the pilot. A report by the South Korean newspaper Maeil Business highlighted that the findings were based on assessments prepared by organizations directly involved in the project, which diminishes the objectivity of the security evaluations.

Bank of Korea’s Response

In response to the backlash, the Bank of Korea indicated that they deemed additional inspections unnecessary, as thorough security checks had been conducted prior to the pilot. They also mentioned that their security assessment complied with the established procedures outlined by the FSS. However, an industry insider pointed out that relying primarily on project participants for evaluations could undermine public confidence in the system’s security.

Future of CBDC and Regulatory Oversight

This situation emerges amidst South Korea’s ongoing efforts to enhance its digital payments framework, which includes not only CBDC development but also regulations surrounding won-backed stablecoins. Notably, Project Han River, the CBDC pilot initiative, involves seven commercial banks but has faced delays in expanding to further phases due to concerns regarding implementation costs and the lack of a clear commercial model.

Additionally, recent developments indicate that financial authorities are working on a legal framework for stablecoins while also planning to enhance the infrastructure supporting CBDCs, including potential connections to tokenized government bonds.