Kakao Pay CEO Shin Won-keun / Yonhap

Kakao Pay, the settlement and payment subsidiary of the beleaguered Kakao Corp., handed over 40 million users' data to its second-largest shareholder, Alipay Singapore Holdings, without consent from its users, Korea's financial supervisor said Wednesday. The holding company with over a 32 percent stake in Kakao Pay is an affiliate of Alipay, tied to China's Ant Group.

Central to the issue is whether the Kakao subsidiary needed user consent before the transfer and whether the handlers of the encrypted data ensured easy access to the data for users at any time.

The uncovering of the Kakao subsidiary's irregularity will trigger wider scrutiny of the settlement and payment market players in the country, as indicated by the authorities' characterization of the incident as "deserving of grave sanctions beyond criminal penalties."

According to the Financial Supervisory Service (FSS), the data was acquired by Alipay, linked to Chinese conglomerate Alibaba Group, as revealed by its inspection of the Kakao subsidiary over foreign exchange trading.

"The identified offense is under review for a potential violation of related laws, after which sanctions will be in progress," the FSS said.

The Kakao subsidiary maintains the data was handed over to provide Apple App Store payment services to Kakao Pay users, as mediated legitimately by Alipay.

"Reports of Kakao Pay unlawfully handing over user data without consent to Apple or Alipay are not true," Kakao Pay said in a statement.

The process of data transfer did not, it added, require user consent and proceeded in accordance with a chain-of-delegation procedure, as clearly guided by Apple.

However, the law governing the use and protection of credit information requires user consent before collecting their data or providing it to a third party. Consent was needed because Alipay is an overseas entity.

Kakao Pay said the encrypted data is strictly limited to user verification to prevent financial fraud and is not available for marketing or other purposes.

Still, industry insiders express concern that Chinese entities can use the data for marketing purposes, exploiting information on users' spending habits and health conditions to the disadvantage of their Korean competitors.

This is the latest blow to the Kakao subsidiary, already significantly weakened by the arrest and indictment of Kakao founder and CEO Kim Beom-su on suspicion of stock manipulation.