The Bank of Korea CBDC audit gap at the centre of South Korea’s first retail digital currency pilot was starker than previously understood: documents submitted by the Bank of Korea to the Financial Supervisory Service (FSS) show no independent government security inspection took place during or after the pilot, which ran from April to June last year.
The findings were reported by South Korean newspaper Maeil Business, citing FSS data submitted to People Power Party lawmaker Lee Heon-seung. The only security work completed before the pilot launched was an IT security review and vulnerability assessment carried out in February, which itself relied partly on self-inspection teams from participating lenders Woori Bank and NongHyup Bank, alongside the Financial Security Institute and cybersecurity firm SK Shields.
Institutions taking part in the pilot, in other words, also helped assess the security of the systems they were testing.
The Bank of Korea CBDC Audit Gap and What the FSS Documents Show
The Bank of Korea subsequently addressed security criticism in its published report on Project Han River, the retail CBDC testing programme. In a section titled ‘Misconceptions and Facts About Digital Currency,’ the central bank rejected claims that deposit tokens carry IT security risks, citing the extensive reviews it conducted before launch.
Maeil Business argued that response amounted to the central bank defending the adequacy of its own process rather than presenting findings from an independent third party. The FSS documents, per the newspaper, contained no evidence that outside auditors examined the system after the pilot concluded.
An unnamed industry official quoted by Maeil Business said real-world CBDC testing is intended not only to validate technology but to build public confidence. Relying primarily on project participants to evaluate and explain a system’s security, the official said, makes objective credibility harder to establish.
The supervisory picture beyond security was also thin. FSS data showed that over the past three years, only one formal consultation took place between banking institutions and the regulator on CBDC or deposit token products, involving Shinhan Bank and an insurance product linked to deposit tokens. Banks have yet to establish dedicated supervision teams focused on CBDC and deposit tokens.
Phase 2 Launched After Reported Suspension, Expanding to Nine Banks
The audit questions arrive as the programme itself has moved forward. The first phase of Project Han River involved seven commercial banks and cost participants a combined 35 billion won (approximately $23 million), according to Ledger Insights.
Bloomberg reported in June 2025 that the central bank had suspended preparations for Phase 2 after participating banks raised concerns over implementation costs and the absence of a clear commercial model. However, Ledger Insights reported in March 2026 that Phase 2 subsequently launched, with participation expanding to nine banks by adding Gyeongnam Bank and IM Bank alongside previous participants. According to Ledger Insights, Governor Rhee Chang-yong personally visited bank CEOs to secure their participation after the mid-2025 press reports of suspension.
Phase 2 is intended to lay groundwork for commercialisation, covering peer-to-peer transfers and merchant payments.
Stablecoin Framework Pulls Policy in a Different Direction
While the CBDC programme advances, South Korea’s regulatory attention is also shifting toward privately issued won-backed stablecoins. Financial authorities published a roadmap on 19 July, jointly prepared by the Financial Services Commission, the Bank of Korea, the FSS and the Korea Securities Depository, to make the Korean won a freely convertible currency and establish legislation governing stablecoin issuance and circulation.
The proposed Digital Asset Basic Act would allow South Korean companies with at least KRW 500 million (approximately $367,876) in equity capital to issue stablecoins, provided reserves are held to guarantee refunds, according to Fintech News Hong Kong. Asset-linked digital assets would require approval from the Financial Services Commission.
The drafting process has not been smooth. The Bank of Korea has insisted stablecoin issuance should be restricted to banks holding at least 51% ownership stakes in issuers, while the Financial Services Commission has warned that approach could stifle innovation and favoured broader participation including fintech and technology firms, according to CoinDesk.
The Bank of Korea has maintained that deposit tokens and privately issued stablecoins are distinct instruments. Under its proposals, deposit tokens would represent commercial bank deposits on blockchain infrastructure sitting above the central bank’s wholesale CBDC layer, with applications ranging from government subsidies to public vouchers.
Separately, the CBDC Tracker maintained by the Human Rights Foundation notes South Korea’s participation in the Bank for International Settlements’ Project Agora for cross-border payment infrastructure, and Gyeonggi Province has announced a government-backed blockchain stablecoin pilot running from August through February 2027.
With Phase 2 now live and the stablecoin legislative framework still being negotiated, the FSS’s response to the audit criticism, or its absence, will be the more consequential signal to watch.
