Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
South Korea regulates crypto through two connected systems. The Act on the Protection of Virtual Asset Users has applied since July 19, 2024 and governs customer-asset safeguards, market-abuse prohibitions, and supervision. A separate anti-money-laundering (AML) regime requires qualifying providers to report to the Korea Financial Intelligence Unit (KoFIU), perform customer due diligence, monitor transactions, and share transfer information. Amendments approved in 2026 change registration and transfer rules on different effective dates, so the applicable commencement date matters.
What South Korea regulates
South Korean law uses two definitions that are important throughout this article. A virtual asset is a digitally transferable economic value that can be electronically traded or transferred. The statutory definition has exclusions, so not every digital item or financial instrument is automatically a virtual asset. A virtual-asset service provider (VASP) is a business that performs covered activities such as selling, buying, exchanging, transferring, storing, or managing virtual assets for customers. A centralized cryptocurrency exchange is the clearest example, but the legal analysis depends on the activity and structure rather than on the word “exchange” alone.
The first layer is the user-protection statute. The Financial Services Commission (FSC) says the Act on the Protection of Virtual Asset Users covers safe custody of user assets, unfair-trading prohibitions, and supervision and sanctions for VASPs and market activity (FSC, Feb. 8, 2024). The second layer is the Act on Reporting and Using Specified Financial Transaction Information, commonly called the AML Act. It covers VASP reporting to KoFIU, customer due diligence, suspicious-transaction reporting, and transfer records. These layers overlap in practice but are not interchangeable: satisfying AML reporting duties does not replace customer-asset or market-conduct obligations.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Key dates and which rules apply
| Date | Event | What it means |
|---|---|---|
| July 18, 2023 | Act on the Protection of Virtual Asset Users enacted | Created the statutory framework for asset custody, fair trading, and supervision. |
| July 19, 2024 | User-protection Act took effect | Core operating duties and enforcement powers began applying to covered VASPs. |
| August 11, 2026 | FSC announced approved AML registration and rule changes | The announcement separates provisions with immediate specified dates from provisions beginning six months after promulgation. |
| August 20, 2026 | Registration-related changes and retired-employee sanction-notification provisions effective | Applicants and registered providers must use the amended criteria and notification process from this date. |
| Six months after promulgation | Other 2026 AML amendments begin | The expanded domestic travel rule and related provisions apply on the commencement date for the relevant subsection; do not assume every amendment started on August 20. |
| October 2, 2026 | Current statutory listing for the AML Act shows this effective date | Check the consolidated statute and subordinate rules when determining which version governs a transaction. |
The dates above come from FSC implementation notices and the National Law Information Center listing. Because the 2026 package has staggered commencement, an exchange, customer, or auditor should verify the specific provision’s effective date rather than relying on the announcement date.
Layer one: VASP registration and AML controls
Reporting to KoFIU
A business carrying out covered VASP activities must report its business to KoFIU under the AML Act. The FSC’s AML overview describes this as a reporting and registration framework, not a government endorsement of an exchange’s tokens or investment products. A provider that has not completed the applicable reporting process cannot be treated as compliant merely because it operates a website or has customers.
Customer due diligence and KYC
Yes, Korean crypto trading generally involves KYC because the AML framework requires VASPs to perform customer due diligence. The provider must identify and assess customers in the circumstances specified by the AML Act and implementing rules, maintain transaction records, and apply enhanced controls where risk warrants it. The exact documents and verification steps can differ by provider, customer type, product, and risk assessment. KYC confirms an identity for compliance purposes; it does not mean that a token has been reviewed or that a trade is safe.
Suspicious-transaction reporting and records
VASPs must submit suspicious-transaction reports to KoFIU when activity meets the statutory reporting test. They must also retain separate transaction details for users. The obligation is not limited to obvious criminal conduct: providers are expected to use monitoring systems and escalate activity that appears inconsistent with a customer profile or presents money-laundering or terrorist-financing risk.
Entry requirements for providers
The AML statute and subordinate rules include an Information Security Management System (ISMS) certification requirement and real-name verified deposit-and-withdrawal accounts, subject to specified exceptions. These should not be presented as unconditional requirements for every possible virtual-asset business model; applicability depends on the activity and the current implementing rules.
What changed in 2026 registration rules
The FSC’s August 11, 2026 announcement says registration reviews address more than a form and a corporate name. The criteria include:
- Financial soundness and credibility: the provider and relevant people must meet standards intended to screen out financially unstable or unsuitable operators.
- Executive and shareholder suitability: key executives’ qualifications and specified shareholder criteria are examined.
- Expertise and organization: the applicant needs skilled staff and an organization capable of operating the service.
- Cybersecurity and physical infrastructure: systems must support prevention, detection, response, and recovery for breaches and operational failures.
- Internal controls: governance must support both AML compliance and protection of virtual-asset users.
The registration changes took effect August 20, 2026, according to the FSC notice. Other amendments in the same package start six months after promulgation. This split matters when reviewing an application, a refusal, or an existing provider’s compliance status.
Layer two: custody and protection of customer assets
Separate handling of deposits
VASPs must safely keep and manage user deposits and virtual assets. The FSC’s June 25, 2024 implementation explanation says banks are the sole eligible financial institutions for handling and custody of user deposits under the framework. This is a custody requirement, not a promise that the government or a bank guarantees the market value of coins.
Cold-wallet requirement
More than 80% of the economic value of users’ virtual assets must be held in cold wallets, with the precise level set by subordinate FSC rules. Cold storage keeps signing keys offline and reduces exposure to an online attack, but it cannot eliminate insider risk, key-management failures, or losses caused by a token’s price collapse. In circumstances such as hacking, malfeasance, or business closure, the FSC may impose a particular cold-wallet ratio on an individual provider.
Insurance or reserves
A VASP must maintain liability insurance or reserves sufficient to meet compensation demands arising from hacking or computer failure, within the limits and conditions set by the rules. This mechanism addresses specified operational losses; it is not deposit insurance, a guarantee of principal, or protection against ordinary trading losses.
Fair trading: what exchanges must prevent
Insider trading and undisclosed information
The user-protection Act prohibits trading based on material information that has not been disclosed to the market. The rule is aimed at people who possess information capable of affecting a virtual asset’s price and use it before other market participants can act.
Price manipulation and other unfair conduct
Price manipulation and other unfair trading practices are also prohibited. The FSC’s implementation materials identify conduct such as artificial transactions or schemes intended to move prices or create a misleading appearance of supply and demand. The prohibition applies to market activity; it is not limited to a provider’s own trading desk.
Monitoring and reporting abnormal activity
The enforcement decree requires VASPs to monitor for suspicious or abnormal trading and promptly report it to authorities. FSC guidance specifically points to unusual price or volume volatility and rumors or reports that could influence prices as matters requiring attention. An exchange therefore needs surveillance controls, an escalation process, and records showing how alerts were handled.
Penalties and enforcement powers
The FSC says violations can result in criminal punishment or a penalty surcharge linked to unfair gains. Its description includes imprisonment of at least one year or fines of three to five times the unfair gain, with higher prison ranges as gains increase, and a surcharge of twice the unfair gain in the circumstances described by the law. These are statutory penalty structures, not an automatic sentence for every breach. Regulators may order corrective action or business suspension and can refer suspected cases to prosecutors (FSC, June 25, 2024).
The Korean travel rule for crypto transfers
The travel rule requires information about the sender and recipient to accompany certain virtual-asset transfers so providers can identify the parties and investigate suspicious movement of funds. It operates through VASPs and their compliance systems; a blockchain transaction by itself does not prove that the required information was exchanged.
Transfers between domestic registered VASPs
The August 2026 FSC notice expands the domestic rule from a KRW 1 million threshold to transfers of all amounts between registered domestic VASPs. The receiving provider must also secure the sender information supplied by the originating provider. A small transfer is therefore not automatically exempt once the applicable provision is in force.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Transfers involving foreign VASPs or wallet providers
A transfer between a domestic VASP and a foreign VASP or digital-wallet provider is allowed only under conditions stated in the amended rules. The notice identifies examples such as a low-risk counterparty or a transfer in which the sender and recipient are the same entity. High-risk transactions are prohibited under the stated framework.
KRW 10 million reporting threshold
A transfer of KRW 10 million or more to a foreign VASP or digital-wallet service provider must be reported to KoFIU regardless of the risk level, according to the FSC’s August 2026 notice. This reporting threshold is separate from the all-amount information-sharing rule for domestic registered VASPs.
How this affects a customer
- Complete the sending provider’s identity and account checks before initiating a transfer.
- Enter the recipient VASP or wallet details exactly as requested; mismatched ownership or missing information can cause a hold or rejection.
- Expect additional questions for a foreign counterparty, unusual destination, or high-value transfer.
- Keep records of the transaction, destination, and purpose so you can answer a compliance inquiry.
Supervision, inspections, and complaints
The FSC and related authorities can inspect VASPs, investigate suspected unfair trading, require corrective action, suspend business, and refer matters for prosecution. These powers mean registration is ongoing supervision rather than a one-time quality seal. A provider can remain subject to scrutiny over custody, cybersecurity, AML controls, surveillance, and disclosures after registration.
When a customer has a problem, the practical first step is to use the provider’s documented complaint and withdrawal process and preserve account, transaction, and communication records. Regulatory duties may support investigation or compensation claims in defined circumstances, but they do not guarantee that every complaint will recover funds or that a volatile asset will retain value.
Free tools Windows power users keep installed
One-click scans. No signup required.
Centralized exchanges and decentralized exchanges (DEXs)
A DEX is generally described as a peer-to-peer market without a centralized operator. That description does not establish that every protocol is outside Korean law: classification depends on who operates or controls the service and what activities are performed. The Financial Supervisory Service (FSS) consumer notice of June 16, 2026 focuses on user risk rather than issuing a blanket legal exemption.
| Question | Centralized VASP exchange | DEX or protocol activity |
|---|---|---|
| Identifiable provider | Usually a corporate provider subject to registration and reporting analysis. | May lack a single identifiable operator; legal classification depends on the facts. |
| Custody and recovery | Provider-level custody, cold-wallet, insurance or reserve duties may apply when the service is a covered VASP. | Users may interact directly with smart contracts and may have limited recovery or redress. |
| KYC and AML | CDD, suspicious-transaction reporting, and transfer-information duties operate through the intermediary. | No intermediary may perform those checks, although an associated business or operator could still have obligations. |
| Trading surveillance | Registered providers must monitor abnormal trading and report suspected misconduct. | Automated execution and fragmented liquidity can make surveillance and complaints harder. |
| Token and operational risks | Provider screening does not make every listed token safe or profitable. | FSS warns about rug pulls, lookalike tokens, concentrated ownership, low liquidity, misleading social-media promotion, and smart-contract or operational failures. |
The FSS recommends checking basic token information and concentration among top holders rather than relying uncritically on social-media claims. Its warning also notes that users may face difficulty obtaining redress after a DEX incident. Those are risk cautions, not a conclusion that every DEX is unlawful or that every centralized exchange is safe.
How to assess an exchange before trading
- Identify the legal operator. Record the company name, jurisdiction, and the service it actually provides, not just the brand displayed in an app.
- Check the current VASP reporting or registration position. Registration status can change, and the relevant activity may fall under an exception or a different category.
- Review custody disclosures. Look for explanations of customer-deposit handling, cold-wallet coverage, insurance or reserves, and withdrawal controls.
- Understand KYC and transfer checks. Confirm what information is required for domestic and foreign transfers and how rejected transactions are handled.
- Read market-conduct and complaint procedures. A credible process should explain surveillance, account restrictions, appeals, and incident notification.
- Separate compliance from investment quality. AML registration and user-protection duties do not verify a token’s technology, price, liquidity, or expected return.
What the framework does—and does not—promise
- It requires covered providers to implement custody, cybersecurity, AML, and market-surveillance controls.
- It gives regulators inspection, corrective-action, suspension, investigation, and referral powers.
- It can provide a route to compensation for specified hacking or computer-failure losses through required insurance or reserves.
- It does not guarantee deposits, trading profits, token prices, or recovery from every fraud.
- It does not mean every listed token has been vetted by the Korean government.
- It does not automatically place every decentralized protocol outside Korean law.
For a current compliance decision, use the consolidated Act on the Protection of Virtual Asset Users, the AML Act and its implementing rules, and the latest FSC and FSS notices. The 2026 amendments have separate commencement dates, so the date of the transaction and the exact business model both matter.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
