# Korea fines Kakao Pay KRW 5.97bn for sending 40m users' data to Alipay to build a credit-risk scoring model

Source: https://www.bankingnewsai.com/ai-incidents/kakao-pay-2025-alipay-credit-score-data-fine
Last updated: Oct 21, 2026

Kakao Pay · Governance finding · severity 3 of 5

South Korea's Personal Information Protection Commission (PIPC) decided on 22 January 2025 that Kakao Pay had transferred personal data on about 40 million users to Alipay without consent so that Alipay, acting for Apple, could build a model calculating "NSF" (non-sufficient funds) scores for Apple's payment services. Per the PIPC, Kakao Pay sent 54.2 billion items in three transfers in 2018, including data on users who never used Apple services. The PIPC imposed a KRW 5.968 billion surcharge and corrective orders on Kakao Pay, fined Apple KRW 2.405 billion and ordered Alipay to destroy the scoring model. The Seoul Administrative Court upheld Kakao Pay's penalty on 11 June 2026; Kakao Pay has appealed, and police raided its headquarters in July 2026.

## Key facts

|  |  |
| --- | --- |
| Date | Jan 22, 2025 (disclosed Jan 23, 2025) |
| Institution | Kakao Pay |
| Country | South Korea |
| AI system | NSF score model · Customer-level scoring model estimating the risk of non-sufficient funds for Apple payments, built from transferred user data · vendor: Alipay |
| AI? | Machine-learning system (inferred from the record) — The sources describe a machine-learning model; nobody on the record labelled it AI. |
| Category | Regulatory finding (Governance finding) |
| Status | Regulator finding |
| Severity | 3 of 5 — A regulatory finding with a KRW 5.97 billion surcharge covering data on about 40 million users, upheld in court, followed by a separate FSS sanction and a police investigation. |

## What happened?

Per the PIPC's findings, reported by BusinessKorea and Maeil Business, Kakao Pay relayed customer payment information to Apple through Alipay, which Apple had engaged to process payment-related data including the calculation of an NSF score: a 0-100 customer-level score estimating the chance that an Apple service user lacks funds to cover bundled small payments. Between April and July 2018 Kakao Pay sent the personal information of all its users to Alipay three times so that Alipay could build the NSF score calculation model, without the users' consent. [1][2]

The data covered 24 items, including mobile phone numbers, email addresses and fields related to the likelihood of insufficient funds such as Kakao Pay sign-up date and stored balance. The transmissions totalled about 54.2 billion items, about 40 million people after removing duplicates. Fewer than 20% of Kakao Pay users had registered a payment method with Apple, but the transfers included Android and other non-Apple users. [2][4]

At a general meeting on 22 January 2025, announced the next day, the PIPC imposed a KRW 5.968 billion penalty surcharge and corrective orders on Kakao Pay for an overseas transfer without a legal basis, a KRW 2.405 billion surcharge and a KRW 2.2 million fine on Apple for failing to disclose the overseas outsourcing, and ordered Alipay to destroy the NSF score model calculated with the data. The PIPC rejected Kakao Pay's argument that Alipay was merely its processor. [1][2]

On 11 June 2026 the Seoul Administrative Court dismissed Kakao Pay's suit against the PIPC. It found the transfer was not simple outsourcing but an unauthorised cross-border provision of personal data to Apple via Alipay, and said users could not be regarded as having consented to their information being used "as a kind of credit-assessment metric". Separately, the Financial Supervisory Service issued Kakao Pay an institutional warning in February 2026 with penalties of KRW 12.98 billion and KRW 4.8 million, and police, acting on an FSS referral made in March, searched Kakao Pay's headquarters in July 2026. [3][4][5]

## Timeline

- Apr 2018 — Kakao Pay begins the first of three transfers of all users' data to Alipay for the NSF score model (April to July 2018), per the PIPC. [1][2]
- Jan 23, 2025 — The PIPC announces its 22 January decision: a KRW 5.968 billion surcharge on Kakao Pay, KRW 2.405 billion on Apple, and an order for Alipay to destroy the NSF score model. [1][2]
- Feb 2026 — The Financial Supervisory Service issues Kakao Pay an institutional warning and penalties of KRW 12.98 billion and KRW 4.8 million. [5]
- Jun 11, 2026 — The Seoul Administrative Court upholds the PIPC's surcharge and corrective order against Kakao Pay. [3][4]
- Jul 2026 — Police search Kakao Pay's headquarters over suspected violations of the credit information and electronic financial transaction laws; Kakao Pay has appealed the June ruling. [5]

## What was the impact?

- Financial: KRW 5.968 billion PIPC surcharge on Kakao Pay (about US$3.9 million); KRW 2.405 billion on Apple; separate FSS penalties of KRW 12.98 billion
- Customers: About 40 million Kakao Pay users (54.2 billion data items)
- Other: Alipay was ordered to destroy the NSF score model built with the data. No direct financial loss to users has been reported. [1][3][5]

## How did Kakao Pay respond?

Kakao Pay apologised in January 2025 for "the concern caused" and said the transfer was an essential procedure to provide a safe payment environment. After the June 2026 ruling it said it had transferred the data under lawful procedures and with strong encryption to prevent fraudulent payments for Apple services, and that it regretted the court's judgment; it has since appealed, contending the transfer was lawful outsourcing. [2][3][5]

## What was the outcome?

As of 21 October 2026 the PIPC surcharge and corrective order stand after the Seoul Administrative Court dismissed Kakao Pay's challenge; Kakao Pay's appeal is pending. The FSS has separately sanctioned Kakao Pay, which has challenged that fine in court, and a police investigation into the company and some executives and staff is under way after the July 2026 search. [3][4][5]

## FAQ

### Why was Kakao Pay fined over Alipay?

South Korea's Personal Information Protection Commission found that Kakao Pay sent personal data on about 40 million users to Alipay without consent in 2018 so Alipay could build a model scoring Apple users' risk of insufficient funds. It imposed a KRW 5.968 billion surcharge in January 2025, which a Seoul court upheld in June 2026.

### What is the NSF score in the Kakao Pay case?

NSF stands for non-sufficient funds. Per the PIPC, it was a 0-100 score per user, calculated by Alipay for Apple, estimating the chance that a customer lacks funds when several small Apple service payments are bundled. The court described it as a kind of credit-assessment metric, and Alipay was ordered to destroy the model.

### Did a court uphold the Kakao Pay penalty?

Yes. On 11 June 2026 the Seoul Administrative Court dismissed Kakao Pay's suit against the PIPC, ruling that users had not specifically consented to their data being used as a credit-assessment metric. Kakao Pay has appealed, and police searched its headquarters in July 2026 in a separate criminal investigation.

### Was the Kakao Pay case about AI?

Indirectly. The sanctioned conduct was an unlawful data transfer, and the data was used to build a statistical scoring model; neither the PIPC nor the court, as reported, described the model as AI. The case is recorded here as a governance finding about data used to train a credit-risk scoring model.

## Sources

1. [PIPC Fines KakaoPay, Apple, and Alipay for Illegal Overseas Data Transfers](https://www.businesskorea.co.kr/news/articleView.html?idxno=234309) — BusinessKorea, Jan 23, 2025 (news): "Alipay, the recipient of the data, has been ordered to destroy the NSF (Non-Sufficient Funds) score model that was calculated using the illegally obtained personal information."
2. [Kakao Pay and Apple Pay, which handed over the personal information of about 40 million people to China's Alipay, fined](https://www.mk.co.kr/en/it/11225392) — Maeil Business, Jan 23, 2025 (news): "Kakao Pay sent the personal information of all Kakao Pay users to Alipay without consent three times between April and July 2018 so that Alipay, Apple's trustee, could build an NSF score calculation model."
3. [Court upholds near-6 billion won penalty on Kakao Pay over user data sent to Alipay](https://koreajoongangdaily.com/business/court-upholds-near6-billion-won-penalty-on-kakao-pay-over-user-data-sent-to-alipay/12705262) — Korea JoongAng Daily, Jun 11, 2026 (news): "The regulator found that Kakao Pay provided the user data to help build a model for calculating so-called NSF scores, which Apple had commissioned Alipay to produce."
4. [Court Upholds 6 Billion Won Fine Against KakaoPay Over Alipay Data Transfer](https://en.sedaily.com/society/2026/06/11/court-upholds-6-billion-won-fine-on-kakao-pay-over-alipay) — Seoul Economic Daily, Jun 11, 2026 (news): "The court determined that KakaoPay's transfer of customer information was not a simple business consignment, but rather an unauthorized cross-border transfer of personal information to a third party, Apple, via Apple's contractor Alipay."
5. [Police raid Kakao Pay over alleged leak of 40 million users' data to Alipay](https://www.ajupress.com/view/20260709134048744) — Aju Press, Jul 9, 2026 (news): "Regulators have already come down hard on Kakao Pay. The commission fined the company 5.97 billion won in January last year, and the FSS in February issued an institutional warning, a heavy sanction, along with penalties of 12.98 billion won and 4.8 million won."

All AI incidents at banks: https://www.bankingnewsai.com/ai-incidents

---

Canonical page: https://www.bankingnewsai.com/ai-incidents/kakao-pay-2025-alipay-credit-score-data-fine
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — the register of AI incidents at banks: https://www.bankingnewsai.com/ai-incidents. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.