iMBank opened 1,657 accounts
without customer consent
[Article Summary]
• Period of Occurrence : August 2021 ~ July 2023
• Scale of Impact : 1,547 customers affected / 1,657 accounts opened without consent
• Discovery Route : Customer complaint → Internal Audit → Financial Supervisory Service emergency inspection (Aug 2023)
• Outcome : 3 month business suspension, KRW 2 billion fine, disciplinary action for 177 employees
[Background]
• Strengthened performance-driven organizational culture ahead of its transition to a nationwide commercial bank
• Required customer consent procedures were omitted during account opening
• Failure to report the issue to the Financial Supervisory Service even after conducting an internal audit
[Prevention Points]
• Implement an automated abnormal account-opening detection and monitoring system
• Strengthen approval and authorization controls
• Expand post-transaction reviews through full-scope and data-driven monitoring
- Related Internal control operation status in HMC
iM Bank Case Elements
• Opening accounts without customer consent
• Lack of approval procedures and segregation of duties
• Absence of post-monitoring
• Delayed reporting
Similar Risks in HMC
• Creation of new vendors, part codes, etc.
without proper approval
• Lack of segregation of duties in the Purchase request →purchase
order → goods receipt process
• Insufficient verification when approving
changes in payment accounts
• Insufficient review of usage logs for
overseas subsidiary accounts and
system access
• Downplaying issues with suspected
fraud
• Delayed reporting after identifying asset
inspection issues, inventory
discrepancies, and other errors
HMC Controls
• [Control] Approval required for registration and modification of vendor information
• [Control] Management of material master creation and changes
• [Control] Preparation and approval of purchase orders
• [Control] Segregation of duties in purchasing and expenditure management
• [Control] Review of new bank account opening and closures
• [Operation] Timely reporting of design and operating effectiveness evaluation results
• [Operation] Communication of internal control over financial reporting(ICFR) status to the Audit Committee
The iM Bank case reinforces that the core of internal controls lies not merely in having controls in place, but in ensuring they are actually operating effectively. To prevent similar risks, our company maintains and continuously strengthens segregation of duties, master data validation, treasury controls, and enterprise-level log-based monitoring.
[Contact Us]
Please contact to the email below if you have any questions. hyeju.kim@hyundai.com (Accounting Policy Team Hyeju Kim Manager)
This newsletter has been sent for executives and employees to comply with K-SOX training obligation under the Korean External Audit Act (Enforcement Decree Article 9)