On April 27, the Korea Media and Communications Commission (hereinafter, the “KMCC”) reported the ‘2026 Review Plan for the Designation of New Identity Verification Agencies’ at its Fourth Meeting of 2026.
An “Identity Verification Agency” refers to an entity that verifies an individual's identity in an online environment through alternative means—such as Internal Personal Identification Number (i-PIN), mobile phone, credit card, or digital certificate—instead of a Resident Registration Number, as stipulated under the Act on Promotion of Information and Communications Network Utilization and Information Protection (the “Network Act”).
Pursuant to Article 23 3(1) of the Network Act, the KMCC, in designating an Identity Verification Agency, conducts a review of, among other matters: (i) plans for physical, technical, and administrative safeguards to ensure the security of identity verification services (subparagraph 1); (ii) the technical capabilities and financial capacity necessary to perform identity verification services (subparagraph 2); and (iii) the adequacy of the scale of facilities and infrastructure related to identity verification services (subparagraph 3).
In other words, under the Network Act, the KMCC designates as an Identity Verification Agency any entity that is recognized as having the capability to develop, provide, and manage alternative means of identity verification in lieu of Resident Registration Numbers, in a secure and reliable manner.
Designation as an Identity Verification Agency constitutes official recognition that the designated entity has implemented the high level security and personal information protection frameworks required under applicable law. Accordingly, such designation is expected to enhance user trust with respect to the services provided by the designated entity, which in turn is anticipated to directly result in an increase in brand value. Furthermore, amid the growing expansion of services that utilize identity verification—such as MyData services and mobile electronic notifications—driven by recent technological advancements, designation as an Identity Verification Agency is expected to further promote the activation of related services.
Currently, a total of 23 entities —including NICE Information Service, NH NongHyup Card, and Woori Bank— are designated as Identity Verification Agencies. The upcoming designation process for new applicants will proceed as follows: (i) submission of application documents from May 14 to 15; (ii) document review during May; and (iii) on site inspections in June, followed by interviews with officers responsible for identity verification services, and the final determination on designation is expected to be approved by resolution of the review committee in August.
An applicant may be designated as an Identity Verification Agency if it satisfies all 21 key review items and 2 quantitative evaluation items, out of a total of 87 review items, and achieves a score of at least 800 points across the remaining 64 items. Even if an applicant scores below 800 points, it may still be granted a conditional designation, provided that it satisfies all key review and quantitative evaluation items. In the case of a conditional designation, the applicant must fulfill the applicable conditions within the period specified by the KMCC.
▲ All key review items and quantitative evaluation items are satisfied AND a total score of 800 points or higher → Designation
▲ All key review items and quantitative evaluation items are satisfied AND a total score below 800 points → Non-Designation OR Conditional Designation
▲ All key review items and quantitative evaluation items are NOT satisfied, regardless of total score → Non-Designation
The KMCC plans to establish a review committee composed of up to 15 experts from various fields, including information security, law, and accounting.
Kim Jong cheol, Chairperson of the KMCC, stated, “As identity verification services involve the handling of highly valuable personal information of our citizens, the Commission will prioritize security and reliability in its review process.” He added, “We look forward to the active participation of companies that possess both innovative technological capabilities and a strong sense of responsibility.”
Key Implications
- Designation as an Identity Verification Agency is determined based on a dual threshold consisting of (i) eligibility with respect to key review items and quantitative evaluation items, and (ii) achievement of a minimum quantitative score of 800 points. Accordingly, regardless of an applicant’s total score, designation will not be approved if the applicant is determined to be “ineligible” with respect to any of the 21 key review items or the 2 quantitative evaluation items. Applicants preparing for designation should therefore prioritize full compliance with the key review and quantitative evaluation items, rather than focusing solely on optimizing total scores.
- Even where an applicant’s total score falls below 800 points, a conditional designation remains available, provided that the applicant is determined to satisfy all key review and quantitative evaluation items. Accordingly, applicants that are not yet fully prepared may consider a strategy of obtaining a conditional designation and subsequently supplementing any deficiencies in their quantitative scores. However, as failure to satisfy the imposed conditions within the prescribed period may result in revocation of the designation, such applicants should develop a concrete and practicable plan to ensure timely compliance with all conditions.
- Given that 23 entities—primarily major financial institutions—are currently designated as Identity Verification Agencies and have established strong positions in the market, newly designated entities will need to develop clear differentiators to secure market competitiveness. In particular, applicants should focus on areas such as enhanced technological convenience, specialized expertise in specific industry sectors, and innovative authentication methods that distinguish their services from those of existing entities.
About Shin & Kim’s ICT Group
Shin & Kim’s ICT Group provides comprehensive, one-stop legal services by leveraging the firm's distinctive expertise and extensive professional network in the ICT sector, having consistently earned the highest client recognition in recent years. Drawing upon our deep-seated capabilities in broadcasting, telecommunications, personal information protection, and internet IT, we deliver the highest level of legal advisory services encompassing regulatory trend analysis in broadcasting, telecommunications, and ICT; government affairs and legislative improvement & consulting; regulatory impact assessment; and corporate strategic planning. Furthermore, we possess extensive experience and exceptional expertise in personal information/AI compliance and risk management, providing holistic analysis and strategic responses to legal issues and regulatory risks associated with AI adoption and deployment across diverse industry sectors. Please feel free to contact us with any questions or if you require our assistance on any ICT-related legal matters.
[Korean version] 방미통위, ‘본인확인기관’ 신규 지정 개시
