Is Crypto Legal in South Korea?

Travel Rule adopted — in force since 25 March 2022 for transfers of KRW 1,000,000 or more between virtual asset service providers (FTI Enforcement Decree Art. 10-10(1)); Presidential Decree 36592 of 18 August 2026 extends it to all such transfers regardless of amount from 19 February 2027.

Adoption and Effective Date: the travel rule took effect on 25 March 2022 under Article 10-10 of the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information; KoFIU announced on 5 February 2026 a plan to extend it below KRW 1 million, and Presidential Decree 36592 of 18 August 2026 does so with effect from 19 February 2027 (the rest of that decree took effect on 20 August 2026).

Threshold Amounts: the travel rule applies to transfers between virtual asset service providers worth KRW 1 million or more (FTI Enforcement Decree Art. 10-10(1), since 25 March 2022); Presidential Decree 36592 of 18 August 2026 removes the threshold so that every VASP-to-VASP transfer is covered from 19 February 2027.

VASPs Covered: the travel rule applies to every reported virtual asset service provider that transfers virtual assets to another provider (Act on Reporting and Using Specified Financial Transaction Information Art. 6(3); Enforcement Decree Art. 10-10); per the FSC (24 March 2022), transfers to overseas providers proceed only after the sender and receiver are confirmed to be the same person and money-laundering risk is low.

Technical Implementation Requirements: the originating virtual asset service provider must send the names and virtual asset addresses of the sender and recipient with the transfer, and supply the sender's resident registration or passport number within 3 business days when KoFIU or the receiving provider requests it (FTI Enforcement Decree Art. 10-10(2)-(4)); providers must keep sender and recipient information for 5 years, with a fine of up to KRW 30 million for breach (FSC, 24 March 2022).

The travel rule rests on the Act on Reporting and Using Specified Financial Transaction Information, whose virtual asset provisions took effect on 25 March 2021 (Law 17113 of 24 March 2020); Article 6(3) applies the wire-transfer information duty to virtual asset service providers, and the Enforcement Decree rule implementing it took effect on 25 March 2022.

Korea taxes income from transferring or lending virtual assets at 20% on the amount above KRW 2.5 million a year (Income Tax Act Art. 64-3(2), added by Law 17757 of 29 December 2020); after three deferrals, the last on 31 December 2024, it applies from 1 January 2027.

From 1 January 2027, individuals computing virtual-asset income deduct the actual acquisition cost plus incidental costs of acquisition, transfer or lending (Income Tax Act Art. 37(1)(3)); for assets held before 2027, cost is the higher of the 31 December 2026 market value and actual cost (Art. 37(5)).

From 1 January 2027, virtual asset service providers under the Virtual Asset User Protection Act must submit users' transaction records to the tax authorities by the end of the second month after each quarter or year (Income Tax Act Art. 164-4); the penalty for non-submission applies to transactions from 1 January 2028.

The Income Tax Act amendment of 31 December 2024 (Law 20615) deferred virtual-asset income tax for the third time, to transfers and lending from 1 January 2027; the earlier deferrals were enacted on 8 December 2021 and 31 December 2022.

Korea's tax on virtual-asset income (20% above KRW 2.5 million a year, from 1 January 2027) is in the Income Tax Act; the Digital Asset Basic Act is bill 2210736, proposed on 11 June 2025 and still unprocessed in the National Policy Committee on 14 October 2026.

South Korea has no stablecoin issuer licensing regime as of 14 October 2026: the bills on value-stable digital assets (가치안정형 디지털자산), bill 2211784 proposed 28 July 2025 and bill 2212298 proposed 21 August 2025, and the Digital Asset Basic Act bill 2210736 proposed 11 June 2025, are all before the National Policy Committee with no decision recorded, and the FSC referred on 4 September 2026 to "the pending legislation on stablecoin".

Stablecoin rules are not part of the Virtual Asset User Protection Act in force since 19 July 2024; the FSC refers to a separate "phase-2" Digital Asset Act (「디지털자산법」(2단계법)) still under consideration (20 July 2026) and to pending stablecoin legislation (4 September 2026), and the stablecoin bills on the National Assembly record (2211784 of 28 July 2025 and 2212298 of 21 August 2025) are member bills with no decision recorded as of 14 October 2026.

No Korean statute specifically regulates stablecoins as of 14 October 2026; the Bank of Korea states that it "has not yet decided whether or not to issue a CBDC" and notes that stablecoins are already widely used in certain sectors, and under the Virtual Asset User Protection Act it may request data from virtual asset service providers for monetary, financial-stability and payment-system purposes (Art. 16).

A Korean security token is a digitized form of a security as defined in the Financial Investment Services and Capital Markets Act; tokens structured as investment contract securities (investors jointly fund a business and earn returns from its performance) fall under the same securities regulation.

No FSC licence is required to issue security tokens: offerings must meet the same FSCMA securities registration and disclosure requirements as ordinary securities, and from 4 February 2027 issuers notify and apply for electronic registration with the Korea Securities Depository.

Korea has no VASP licence; since Law 21358 (19 February 2026) KoFIU may refuse a VASP report if the firm, its CEO, officers or major shareholders lack sound finances or social credit, or if it lacks AML compliance staff, IT and internal controls (FTI Act Art. 7(3)(5)–(6)).

Under the Specified Financial Transaction Information Act, virtual asset service providers that buy, sell, exchange, transfer, custody or broker virtual assets must report to KoFIU and perform customer due diligence (Art. 5-2); KoFIU states that NFT trading, deposit and lending services and DeFi are outside the reporting duty.

Korea's 20% tax on individuals' virtual-asset income above KRW 2.5 million was enacted by Law 17757 (29 December 2020) and deferred three times, last on 31 December 2024; it applies to transfers and lending from 1 January 2027, so no crypto income tax on individuals applies in 2026.

For crypto, the Financial Services Commission supervises and inspects virtual asset service providers under the Virtual Asset User Protection Act (Arts. 13–15) and may delegate work to the FSS (Art. 18); VASPs do not hold FSC licences but report to KoFIU, which sits under the FSC.

The Korea Financial Intelligence Unit (KoFIU) sits under the Financial Services Commission (FTI Act Art. 3); it receives suspicious transaction reports, accepts virtual asset service provider reports and supervises and inspects their AML/CFT compliance (Arts. 4, 7, 15).

Korean crypto exchanges do not register as securities trading platforms: they report to KoFIU as virtual asset service providers under the Specified Financial Transaction Information Act (Art. 7), and KoFIU listed 28 reported VASPs as of 30 September 2026.

Token offerings that are securities under the Financial Investment Services and Capital Markets Act must satisfy the same securities registration and disclosure requirements as ordinary securities offerings (FSC, 15 January 2026).

The Specified Financial Transaction Information Act sets no minimum capital amount for virtual asset service providers, but Law 21358 (19 February 2026) lets KoFIU refuse a report from a VASP whose finances or social credit, or those of its CEO, officers or major shareholders, fall short of the decree standard (Art. 7(3)(5)).

A Korean VASP files a report with KoFIU, not the FSC, covering its name, representative, major shareholders and place of business (FTI Act Art. 7(1)); KoFIU may refuse it without ISMS certification or a real-name bank account and may delegate report work to the FSS (Art. 7(3), (8)).

KoFIU's VASP list (30 September 2026) shows report processing times from about seven weeks (Upbit: filed 20 August 2021, accepted 6 October 2021) to almost two years (ABC Cloud Wallet: filed 10 June 2024, accepted 23 April 2026); BitGo Korea filed on 4 September 2025 and was accepted on 18 August 2026.

FTI Act Art. 5-2 requires Korean VASPs to verify each customer's identity and beneficial owner; the purpose of the transaction and the source of funds must also be verified only where money-laundering or terrorist-financing risk is suspected (Art. 5-2(1)(2)).

Korean law sets no KRW 50 million EDD threshold: enhanced checks on purpose and source of funds are risk-based (FTI Act Art. 5-2(1)(2)), and the monetary trigger for customer due diligence on a one-off virtual-asset transaction is KRW 1 million (Enforcement Decree Art. 10-3).

Korean VASPs and other financial institutions must report suspicious transactions to KoFIU "without delay" and state the grounds for suspicion (FTI Act Art. 4(1), (3)); the statute sets no 24-hour deadline.

Operating a Korean crypto business without a KoFIU report carries up to 5 years' imprisonment or a KRW 50 million fine (FTI Act Art. 17(1)); unfair trading under the Virtual Asset User Protection Act carries at least 1 year's imprisonment or a fine of 3–5 times the gain (Art. 19(1)).

KoFIU sanctioned Korea's major exchanges under the FTI Act: Dunamu (Upbit) a 3-month partial suspension (25 Feb 2025) and a KRW 35.2bn fine (6 Nov 2025); Korbit an institutional warning and KRW 2.73bn fine (2 Jan 2026); Bithumb a 6-month partial suspension and KRW 36.8bn fine (16 Mar 2026); Coinone a 3-month partial suspension and KRW 5.26bn fine (14 Apr 2026).

Virtual-asset income is not a capital gain under Korean law: it is separately taxed other income (Income Tax Act Art. 14(3)(8)(c)), kept out of global income and taxed at 20% of the amount above KRW 2.5 million, with the rules applying to transfers and lending from 1 January 2027.

Korean virtual asset service providers must verify customers when an account is opened or a one-off virtual-asset transaction reaches KRW 1 million (FTI Act Art. 5-2(1); Decree Art. 10-3(1)(1-2)), and KoFIU supervises and inspects their compliance (Art. 15).

Korea does not tax crypto trading gains in 2026: income from transferring or lending virtual assets is "other income" (Income Tax Act Art. 21(1)(27)), taxed at 20% above KRW 2.5 million a year only on transfers and lending from 1 January 2027.