Kakao Pay · Governance finding · severity 3 of 5
South Korea's Personal Information Protection Commission (PIPC) decided on 22 January 2025 that Kakao Pay had transferred personal data on about 40 million users to Alipay without consent so that Alipay, acting for Apple, could build a model calculating "NSF" (non-sufficient funds) scores for Apple's payment services. Per the PIPC, Kakao Pay sent 54.2 billion items in three transfers in 2018, including data on users who never used Apple services. The PIPC imposed a KRW 5.968 billion surcharge and corrective orders on Kakao Pay, fined Apple KRW 2.405 billion and ordered Alipay to destroy the scoring model. The Seoul Administrative Court upheld Kakao Pay's penalty on 11 June 2026; Kakao Pay has appealed, and police raided its headquarters in July 2026.
Record last reviewed Oct 21, 2026 · Markdown
Date
Jan 22, 2025 · disclosed Jan 23, 2025
Institution
Kakao Pay
Country
South Korea
AI system
NSF score model · Customer-level scoring model estimating the risk of non-sufficient funds for Apple payments, built from transferred user data · vendor: Alipay
AI?
Machine-learning system (inferred from the record)
The sources describe a machine-learning model; nobody on the record labelled it AI.
Category
Status
Regulator finding
Severity
3 of 5
Impact
KRW 5.968 billion PIPC surcharge on Kakao Pay (about US$3.9 million); KRW 2.405 billion on Apple; separate FSS penalties of KRW 12.98 billion · ≈ $3.9 million · About 40 million Kakao Pay users (54.2 billion data items) · Alipay was ordered to destroy the NSF score model built with the data. No direct financial loss to users has been reported.
What happened?
Per the PIPC's findings, reported by BusinessKorea and Maeil Business, Kakao Pay relayed customer payment information to Apple through Alipay, which Apple had engaged to process payment-related data including the calculation of an NSF score: a 0-100 customer-level score estimating the chance that an Apple service user lacks funds to cover bundled small payments. Between April and July 2018 Kakao Pay sent the personal information of all its users to Alipay three times so that Alipay could build the NSF score calculation model, without the users' consent.[1][2]
The data covered 24 items, including mobile phone numbers, email addresses and fields related to the likelihood of insufficient funds such as Kakao Pay sign-up date and stored balance. The transmissions totalled about 54.2 billion items, about 40 million people after removing duplicates. Fewer than 20% of Kakao Pay users had registered a payment method with Apple, but the transfers included Android and other non-Apple users.[2][4]
At a general meeting on 22 January 2025, announced the next day, the PIPC imposed a KRW 5.968 billion penalty surcharge and corrective orders on Kakao Pay for an overseas transfer without a legal basis, a KRW 2.405 billion surcharge and a KRW 2.2 million fine on Apple for failing to disclose the overseas outsourcing, and ordered Alipay to destroy the NSF score model calculated with the data. The PIPC rejected Kakao Pay's argument that Alipay was merely its processor.[1][2]
On 11 June 2026 the Seoul Administrative Court dismissed Kakao Pay's suit against the PIPC. It found the transfer was not simple outsourcing but an unauthorised cross-border provision of personal data to Apple via Alipay, and said users could not be regarded as having consented to their information being used "as a kind of credit-assessment metric". Separately, the Financial Supervisory Service issued Kakao Pay an institutional warning in February 2026 with penalties of KRW 12.98 billion and KRW 4.8 million, and police, acting on an FSS referral made in March, searched Kakao Pay's headquarters in July 2026.[3][4][5]
When did it happen?
- Apr 2018
Kakao Pay begins the first of three transfers of all users' data to Alipay for the NSF score model (April to July 2018), per the PIPC.[1][2]
- Jan 23, 2025
The PIPC announces its 22 January decision: a KRW 5.968 billion surcharge on Kakao Pay, KRW 2.405 billion on Apple, and an order for Alipay to destroy the NSF score model.[1][2]
- Feb 2026
The Financial Supervisory Service issues Kakao Pay an institutional warning and penalties of KRW 12.98 billion and KRW 4.8 million.[5]
- Jun 11, 2026
The Seoul Administrative Court upholds the PIPC's surcharge and corrective order against Kakao Pay.[3][4]
- Jul 2026
Police search Kakao Pay's headquarters over suspected violations of the credit information and electronic financial transaction laws; Kakao Pay has appealed the June ruling.[5]
What was the impact?
- Financial: KRW 5.968 billion PIPC surcharge on Kakao Pay (about US$3.9 million); KRW 2.405 billion on Apple; separate FSS penalties of KRW 12.98 billion · ≈ $3.9 million[1][3][5]
- Customers: About 40 million Kakao Pay users (54.2 billion data items)[1][3][5]
- Other: Alipay was ordered to destroy the NSF score model built with the data. No direct financial loss to users has been reported.[1][3][5]
Severity 3 of 5: A regulatory finding with a KRW 5.97 billion surcharge covering data on about 40 million users, upheld in court, followed by a separate FSS sanction and a police investigation.
How did Kakao Pay respond?
Kakao Pay apologised in January 2025 for "the concern caused" and said the transfer was an essential procedure to provide a safe payment environment. After the June 2026 ruling it said it had transferred the data under lawful procedures and with strong encryption to prevent fraudulent payments for Apple services, and that it regretted the court's judgment; it has since appealed, contending the transfer was lawful outsourcing.[2][3][5]
What was the outcome, and did regulators act?
As of 21 October 2026 the PIPC surcharge and corrective order stand after the Seoul Administrative Court dismissed Kakao Pay's challenge; Kakao Pay's appeal is pending. The FSS has separately sanctioned Kakao Pay, which has challenged that fine in court, and a police investigation into the company and some executives and staff is under way after the July 2026 search.[3][4][5]
Why was Kakao Pay fined over Alipay?
South Korea's Personal Information Protection Commission found that Kakao Pay sent personal data on about 40 million users to Alipay without consent in 2018 so Alipay could build a model scoring Apple users' risk of insufficient funds. It imposed a KRW 5.968 billion surcharge in January 2025, which a Seoul court upheld in June 2026.
What is the NSF score in the Kakao Pay case?
NSF stands for non-sufficient funds. Per the PIPC, it was a 0-100 score per user, calculated by Alipay for Apple, estimating the chance that a customer lacks funds when several small Apple service payments are bundled. The court described it as a kind of credit-assessment metric, and Alipay was ordered to destroy the model.
Did a court uphold the Kakao Pay penalty?
Yes. On 11 June 2026 the Seoul Administrative Court dismissed Kakao Pay's suit against the PIPC, ruling that users had not specifically consented to their data being used as a credit-assessment metric. Kakao Pay has appealed, and police searched its headquarters in July 2026 in a separate criminal investigation.
Was the Kakao Pay case about AI?
Indirectly. The sanctioned conduct was an unlawful data transfer, and the data was used to build a statistical scoring model; neither the PIPC nor the court, as reported, described the model as AI. The case is recorded here as a governance finding about data used to train a credit-risk scoring model.
- PIPC Fines KakaoPay, Apple, and Alipay for Illegal Overseas Data Transfers news
- Kakao Pay and Apple Pay, which handed over the personal information of about 40 million people to China's Alipay, fined news
- Court upholds near-6 billion won penalty on Kakao Pay over user data sent to Alipay news
- Court Upholds 6 Billion Won Fine Against KakaoPay Over Alipay Data Transfer news
- Police raid Kakao Pay over alleged leak of 40 million users' data to Alipay news
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning