API Development in Seoul

Financial Services / Banking and Securities

A major Korean financial group (KRW 550T in total assets, comprising a commercial bank, securities firm, insurance company, credit card company, and asset management firm — 22 million retail customers across all subsidiaries) needed to build a MyData-compliant API platform and create a unified financial data service. (1) MyData compliance deadline: the FSC mandated that all financial institutions provide MyData-compliant APIs by the regulatory deadline. The financial group needed to expose customer financial data (bank accounts, securities positions, insurance policies, card transactions, and asset management holdings) through standardised APIs — enabling licensed MyData operators to access customer-authorised data. Each subsidiary had different data systems, formats, and technology stacks — creating a fragmentation challenge for unified API delivery. (2) Competitive MyData service: beyond compliance, the group wanted to launch its own MyData service — aggregating not just its own subsidiaries' data, but data from competitor banks, brokerages, and insurers. The MyData service needed to become the customer's primary financial management interface — providing a unified view of all financial assets and liabilities across the entire Korean financial system. (3) API performance at Korean scale: Korea's digital adoption rates are among the world's highest — 95% smartphone penetration, 88% mobile banking usage. The API platform needed to handle extreme usage patterns — salary day API surges (25th of each month — 5x normal traffic as millions of customers check accounts and make payments), market hours (9:00-15:30 KST — high-frequency securities data API calls), and promotional events (Kakao Pay and Naver Pay campaigns generating sudden API call spikes). (4) K-ISMS-P certification: the API platform needed to satisfy K-ISMS-P certification requirements — mandatory for organisations handling personal information of more than 1 million individuals. This required comprehensive security controls, audit logging, and incident response capabilities specifically designed for API operations. (5) Korean authentication ecosystem: APIs needed to support Korea's unique authentication methods — public certificate (formerly mandatory for banking, now one of several options), carrier-based identity verification (mobile phone identity confirmation), biometric authentication (fingerprint, face recognition via Samsung Pass and PASS app), and Kakao/Naver authentication (social login with banking-grade security).

We built a comprehensive MyData open finance API platform over 16 weeks. (1) MyData provider APIs (data supply): unified API layer across all five subsidiaries — banking APIs (account balances, transaction history, loan details, deposit and savings information), securities APIs (portfolio positions, trade history, dividends, market data), insurance APIs (policy information, premium payments, claims history, coverage details), card APIs (transaction history, billing statements, reward points, spending analysis), and asset management APIs (fund holdings, performance data, contribution history). Data canonicalisation: each subsidiary's internal data format mapped to the FSC MyData standard format — ensuring consistent API responses regardless of which subsidiary's data was requested. Real-time and batch: account balances provided in real-time (sub-200ms), while transaction history used optimised pagination for large datasets (some customers had 10+ years of history across multiple accounts). (2) MyData operator service (data aggregation): the group's own MyData application aggregating data from competitor institutions — connecting to 65 other financial institutions through their MyData APIs. Customer onboarding: streamlined consent flow — customers authorised data collection from all their financial institutions in a single session (rather than visiting each institution separately). Financial dashboard: APIs powering a comprehensive financial dashboard — total net worth, asset allocation across all institutions, spending analysis, insurance coverage gaps, and retirement readiness scoring. AI-powered insights: APIs feeding ML models for personalised financial recommendations — based on aggregated data from all institutions (not just the group's own products). (3) Performance architecture: auto-scaling (handling salary day surges — 5x traffic spikes on the 25th of each month), caching (frequently accessed data like account balances cached with appropriate freshness intervals), rate limiting (protecting backend systems from excessive API calls while meeting MyData SLA requirements — 99.5% availability, sub-3 second response time), and circuit breakers (graceful degradation when competitor institutions' APIs experienced latency — showing cached data rather than failing). (4) K-ISMS-P security: encryption (ARIA-256 for data at rest, TLS 1.3 for transit — satisfying Korean national encryption standards), access control (multi-factor authentication for API access, role-based permissions per K-ISMS-P requirements), audit logging (comprehensive API access logs — who accessed what data, when, and through which application), personal information lifecycle (automated data retention and deletion per K-ISMS-P requirements — data not accessed for the consent period automatically purged), and incident response (automated breach detection and notification workflows — meeting the 24-hour PIPC notification requirement). (5) Korean authentication: supporting all major authentication methods — public certificate, carrier identity verification (all three Korean carriers), biometric (Samsung Pass, PASS app), and social authentication (Kakao, Naver) — with appropriate security levels for different API operations (view-only vs. transaction initiation).

MyData compliance: all five subsidiaries passed FSC MyData compliance review on the first assessment — 3 months ahead of the regulatory deadline. The group was among the first major financial groups to achieve full compliance, generating positive regulatory and media coverage. MyData service adoption: 4.5 million users registered for the group's MyData service within 12 months — making it the third-largest MyData service in Korea. Users connected an average of 3.8 external financial institutions (beyond the group's own subsidiaries). Daily active users: 1.8 million (40% DAU/MAU ratio — indicating strong engagement). Revenue impact: MyData users showed 35% higher product adoption within the group (cross-selling from aggregated financial insights). KRW 2.8T in new assets under management attracted from competitor institutions — customers moved money to the group after seeing their full financial picture through the MyData dashboard. Customer acquisition: 680,000 net-new customers acquired through the MyData service in 12 months — users who joined specifically for the aggregation service and subsequently opened accounts with the group. Performance: 99.97% API availability (exceeding the 99.5% FSC requirement). Average response time: 145ms for account balances, 320ms for transaction history. Salary day handling: zero degradation during 5x traffic spikes (auto-scaling performed as designed). K-ISMS-P: certification achieved on the first assessment — the API platform specifically cited as exemplary by the auditor for its comprehensive logging and personal information lifecycle management. Security: zero breaches, 28 attempted attacks detected and blocked in 12 months. Annual value: KRW 890B (new assets under management — revenue from managing KRW 2.8T in assets attracted from competitors), KRW 340B (customer acquisition — lifetime value of 680,000 net-new customers), KRW 156B (cross-selling — 35% increase in product adoption among MyData users), KRW 45B (operational efficiency — standardised APIs replacing point-to-point integrations across subsidiaries) = KRW 1,431B (approximately USD 1.1B). Development cost: KRW 8.5B (approximately USD 6.5M). Payback: under 3 days.