South Korea CBDC pilot lacked independent security audit

South Korea's inaugural central bank digital currency trial, conducted between April and June 2025, proceeded without an independent government security audit, raising questions about regulatory oversight as the country advances its digital payments strategy. The pilot, known as Project Han River, involved multiple commercial banks but relied on security assessments conducted internally by the participating institutions before testing began, with no separate external verification performed during or after the trial period.

According to documentation submitted by the Financial Supervisory Service, the only security work completed prior to the pilot's launch was an information technology security review and vulnerability assessment conducted in February 2025. That assessment involved internal audit teams from Woori Bank and NongHyup Bank, alongside the Financial Security Institute and cybersecurity firm SK Shields. The arrangement has drawn criticism because the institutions helping to evaluate the system's security were also directly involved in testing it. The documents showed no evidence that an independent government inspection or external audit was conducted following the...