On 7 October 2026 South Korea's Financial Services Commission (FSC) designated 24 new "innovative financial services", bringing the cumulative total to 1,164, according to a StockHub aggregation of a Newspim report. The batch includes 21 generative-AI application services from 14 firms, among them Kakao Pay. It also includes a Naver Financial card-secured payment service for peer-to-peer secondhand trades and a non-face-to-face joint corporate loan from Toss Bank and Kwangju Bank. The report adds that the FSC will revise rules so fractional overseas stock trading can run without special exemptions, and that IBK Investment & Securities' existing fractional-trading designation was extended by two years. The report does not state the legal basis for these designations, and we have not independently confirmed the FSC's own release. This analysis therefore rests on the reported facts and on the public record of how the sandbox is built.
The case for caution
The strongest argument against a sandbox this large is that exemptions are a form of discretionary power. Each designation lets a firm do something the general rules would not allow. A regulator can pick winners, and consumers can end up as test subjects for a product whose failure modes are unknown. Generative AI sharpens the concern, because model errors in lending, advice or customer service can be opaque and hard to reverse. A skeptic could fairly say that 1,164 designations is a lot of bespoke exemptions, and that it is a symptom of rules that are too rigid, not a success.
What the framework actually guards against
The design answers much of that concern. The Financial Innovation Support Act, passed in December 2018 and effective from March 2019, sets the sandbox's terms. Applicants must show their service differs from existing offerings in content, method or form. A review committee of officials and experts in technology, finance, law and consumer rights makes the designation. Testing is limited to up to two years. Applicants must submit consumer-protection and risk-management plans. Exemptions are withheld where they could cause irreversible consumer harm or threaten financial stability. Designated providers also carry the burden of proving they were not negligent or intentional in any damage suit, which reverses the usual evidentiary position and puts the cost of failure on the firm.
That is a proportionate model. It tolerates controlled risk, conditions it on safeguards, and puts a clock on it. A time-limited, supervised exemption with reversed liability is a much better answer to new products than either a blanket ban or an unwatched free-for-all.
The sandbox's real test is exit, not entry
A sandbox that only admits firms is a permit system with better branding. The question that matters is what happens when the clock runs out. The 2021 revision, which took effect on 21 July 2021, addressed this directly. Providers can ask the FSC or the relevant authority for regulatory improvement three months before a designation expires. A committee decides whether the rule should change. If it does, the exemption can be extended by up to an additional year and six months while the change is made.
The October batch shows this mechanism operating. The FSC said it would revise rules so fractional overseas stock trading no longer needs separate exemptions, and that is the intended end-state. A temporary carve-out became a general rule once supervisors had watched it work. The same report says IBK's designation was extended by two years, so the pilot has run long enough to produce that evidence. If that pattern holds, the sandbox is functioning as a rulemaking tool and not as a permanent exception.
Scale matters here too. When the FSC added 15 services in December 2020, the cumulative total was 135 since the sandbox opened on 1 April 2019. The programme has grown roughly eightfold since, to 1,164. That growth can be read two ways. It may show regulators learning that supervised experimentation works, or it may show rules that are slow to update, so firms keep returning for exemptions.
Generative AI inside regulated finance
The 21 generative-AI designations are the most significant part of the batch. Banks and brokers want to use external AI models for customer service and internal tasks but face uncertainty about how existing rules on outsourcing, data handling and suitability apply. Testing those uses under supervision, with consumer-protection plans required, is a sounder route than waiting for a comprehensive AI statute that may be badly matched to financial use cases. Supervisors will see real incident data before they write permanent rules, and firms will get a clear boundary they can build against.
The risk is opacity. The public record for this batch is thin. The report we reviewed does not give the conditions attached to each designation, the data-handling terms or the review criteria applied to the AI services. If the sandbox is to earn trust, the FSC should publish, for each designation, its conditions, its end date and its eventual outcome.
What the FSC should publish
Three measures would turn a good design into a verifiable one:
- An outcome ledger. For each designation, publish whether it ended in a rule change, an extension, a conversion to a licence or a shutdown. A cumulative count of 1,164 says nothing about whether the sandbox changes the rules.
- Condition disclosure. Publish the consumer-protection and risk-management conditions for generative-AI designations, redacted for commercial sensitivity where needed.
- Incident reporting. Report aggregate harms, complaints and withdrawals so the public can see the safeguards working.
Korea's approach is a reasonable middle path between prohibition and laissez-faire. The tools exist in the statute: time limits, safeguards, reversed liability and a route to permanent reform. What is missing from the public record is evidence on how often that route is used. Publishing that data would show that the sandbox is moving the rulebook, and it would let other regulators judge the model on results.