South Korea’s first CBDC pilot has been conducted without any independent government security inspection, with participating banks relying mainly on their own pre-launch reviews before testing began.
Summary
- South Korea’s first CBDC pilot proceeded without an independent government security inspection, with pre launch reviews relying partly on participating banks.
- Documents submitted by the Financial Supervisory Service show no separate security audit was conducted during or after the Bank of Korea’s pilot.
- The findings come as South Korea continues expanding work on CBDCs, deposit tokens and won backed stablecoins under its digital asset roadmap.
South Korean newspaper Maeil Business, citing data submitted by the Financial Supervisory Service (FSS) to People Power Party lawmaker Lee Heon-seung, reported that financial authorities did not carry out separate security inspections during the first phase of the Bank of Korea’s central bank digital currency (CBDC) pilot, which ran from April to June last year.
Instead, the only security work completed before the pilot started consisted of an IT security review and vulnerability assessment carried out in February. According to the report, those reviews relied partly on self-inspection teams from participating lenders Woori Bank and NongHyup Bank alongside the Financial Security Institute and cybersecurity firm SK Shields.
The arrangement has raised questions because institutions taking part in the pilot also helped assess the security of the systems being tested. According to the documents reviewed by Maeil Business, no evidence was provided that an independent government inspection or external audit took place after the pilot concluded.
Report raises questions over independent oversight
The report said the Bank of Korea later addressed security concerns in its published report on the first real-transaction CBDC pilot after questions emerged about the safety of deposit tokens used during testing.
In a section titled “Misconceptions and Facts About Digital Currency,” the central bank rejected claims that deposit tokens are vulnerable to information technology security risks. The Bank of Korea said it had carried out extensive security reviews across the system before launching Project Han River, the country’s CBDC testing program.
However, Maeil Business argued that the explanation amounted to the central bank defending the adequacy of its own review rather than presenting findings from an independent third-party assessment. The newspaper also said the material submitted by regulators did not show that outside security auditors examined the system after the pilot ended.
According to the publication, the absence of an external review is significant because the pilot involved testing infrastructure that could eventually support part of South Korea’s future payment system. It added that the conclusion that security concerns lacked merit was based on assessments prepared by organizations directly involved in the project.
The report also pointed to limited supervisory coordination during the CBDC initiative. Data submitted by the FSS showed that over the past three years, only one formal consultation took place between banking institutions and the regulator on CBDC or deposit token-related products. The consultation involved Shinhan Bank and an insurance product linked to deposit tokens.
At the same time, the newspaper reported that banks have yet to establish dedicated teams focused specifically on CBDC and deposit token supervision, raising further questions about regulatory preparedness as the pilot moved forward.
Responding to the criticism, the Bank of Korea told Maeil Business that additional inspections during or after the pilot were considered unnecessary because comprehensive security checks had already been completed before testing began. The central bank said the approach followed supervisory procedures established by the Financial Supervisory Service.
An unnamed industry official quoted by the newspaper said real-world CBDC testing is intended not only to validate technology but also to build public confidence. According to the official, relying primarily on project participants to evaluate and explain the system’s security makes it more difficult to establish objective credibility. The official added that independent security verification and external audits after pilot completion would help strengthen market confidence.
CBDC program continues to evolve alongside stablecoin plans
The report comes as South Korea continues reshaping its digital payments strategy, with authorities increasingly balancing CBDC development against new policies supporting won-backed stablecoins.
The Bank of Korea launched Project Han River as a retail CBDC experiment involving seven commercial banks. Earlier plans called for expanding the second phase to include peer-to-peer transfers and merchant payments.
However, Bloomberg reported in June 2025 that the central bank suspended preparations for the second phase after participating banks raised concerns over implementation costs and the absence of a clear commercial model. The report also said regulators had begun placing more attention on building a legal framework for privately issued won-backed stablecoins under the proposed Digital Asset Basic Act.
Government policy has continued developing on both fronts since then.
Earlier this month, Gyeonggi Province announced South Korea’s first government-backed blockchain stablecoin pilot, scheduled to begin in August and run through February 2027. According to blockchain publication NexBlock, the project will examine how a blockchain-based stablecoin can be issued, circulated and settled before later testing fraud prevention, privacy protections and public-sector payment use cases.
Separately, financial authorities unveiled a roadmap on July 19 to make the Korean won a freely convertible currency while introducing legislation governing the issuance and circulation of won-backed stablecoins.
According to local publication Etnews, the roadmap was jointly prepared by the Financial Services Commission, the Bank of Korea, the Financial Supervisory Service and the Korea Securities Depository. Besides stablecoins, it also includes plans to expand institutional CBDC pilot programs connected to tokenized government bonds and deposit tokens, while supporting participation in the Bank for International Settlements’ Project Agora for cross-border payment infrastructure.
The Bank of Korea has maintained that deposit tokens operate separately from privately issued stablecoins. Under its proposals, deposit tokens would represent commercial bank deposits on blockchain infrastructure built on top of the central bank’s wholesale CBDC system, with potential applications including government subsidies, public vouchers and other digital payment services.
