Security control direction and the role of AI DLP as generative AI adoption expands
For Security, Compliance, IT Planning & AI Teams | Based on Electronic Financial Regulations (2026.4.20) & FSC AI Guidelines (2026.6)
Current Challenges
The April 2026 network separation relaxation enables broader cloud AI and collaboration tool use.
Responsibility for controls shifts from regulation to internal financial institution systems.
Employees entering customer PII, credit info, internal docs, or source code into external AI via prompts or file uploads
Use of unauthorized AI services or personal accounts makes it impossible to track who sent what and where
Binary allow/block approach cannot provide role-proportionate, risk-level controls
Prompt input history is not captured by existing web/email/document security logs, making 'when/who/what' impossible to prove in incidents
Financial Sector AI Guidelines (2026.6)
While the guidelines assume voluntary adoption, the 7 principles serve as a common baseline for financial AI adoption. The Security principle directly connects to AI DLP requirements.
Executive oversight, role assignment, AI governance
Compliance with financial & AI regulations throughout all stages
AI as a tool; final decisions and accountability rest with employees
Use of reliable data and models
Minimizing financial stability risks throughout design and training
Prioritizing the interests of financial consumers
Security standards and inspection frameworks, including detection and masking of sensitive I/O data
Electronic Financial Supervision Regulation (2026.4.20)
Network separation relaxation is a transfer of control responsibility, not a loosening of controls.
Financial institutions must implement their own input-stage monitoring and logging.
Security Principle — Sensitive I/O Control
Implement functions that automatically detect and mask or remove personal/credit data and other confidential information found in AI inputs and outputs
Security Principle — Overseas Transfer & Reuse Check
When using commercial GenAI, confirm data's potential overseas transfer and verify that input data will not be reused for model training
FinTech Security — Terminal Upload Control
For terminals querying GenAI, implement upload monitoring and blocking, encryption of sensitive data, and media control measures to prevent leakage
Network Separation Alternative — Monitoring, Logging & Access Control
Monitor and control entry/processing/leakage of sensitive data / Collect logs during access and use / Control external internet access beyond approved SaaS / Control third-party app and plugin connections
GenAI Security Management Areas
Six security management areas reorganized from a practical perspective based on guideline and regulatory requirements.
Visibility into which AI services employees use and what data they share
Guideline 7.5 / Regulation §2-2
Identify unauthorized services and personal account usage; control external connections
Annex 7 Access Control / Guideline 7.7
Detect and block entry of personal IDs, credit info, and internal documents
Guideline 7.2 / Annex 7 Sensitive Data
Detect and block sensitive files uploaded as attachments to AI services
FinTech Security 3.1 / Annex 7
Auto-detect, mask, remove, or block personal and credit data at I/O stage
Guideline 7.2 (p.71–73) / PIPA
Maintain tamper-proof logs of all AI interactions for audit and incident response
Regulation §2-2 / Annex 7 Log Collection
Live Demo
See how FlowGuard detects and controls sensitive financial data in real time when employees enter it into ChatGPT.
FlowGuard AI DLP Scope
FlowGuard is not a complete regulatory solution but one applicable tool within a broader security control framework.
Security controls outside this scope should be implemented alongside separate solutions or internal institutional frameworks.
Implementation Approach
We recommend a phased approach that accounts for the complex regulatory environment and security review procedures of financial institutions.
Visualize which AI services are used and what data is entered for a limited department/group. Measure security risk level before deciding on full deployment.
Configure detection/blocking policies aligned with FSS guidelines and Annex 7 requirements. Validate false positive rate and business impact in a pilot department before adjusting policies.
Deploy organization-wide and establish AI usage dashboard, audit logs, and semi-annual compliance reporting. Auto-generate evidence documentation for FSS examinations.
Start with a PoC diagnostic alongside FlowGuard. Dedicated technical support provided for financial institution security and compliance teams.
Dedicated financial sector implementation support · Security review materials provided separately