South Korea -- Securities Classification Regulatory Overview

A Korean security token is a digitized form of a security as defined in the Financial Investment Services and Capital Markets Act; tokens structured as investment contract securities (investors jointly fund a business and earn returns from its performance) fall under the same securities regulation.

No FSC licence is required to issue security tokens: offerings must meet the same FSCMA securities registration and disclosure requirements as ordinary securities, and from 4 February 2027 issuers notify and apply for electronic registration with the Korea Securities Depository.

Korea has no VASP licence; since Law 21358 (19 February 2026) KoFIU may refuse a VASP report if the firm, its CEO, officers or major shareholders lack sound finances or social credit, or if it lacks AML compliance staff, IT and internal controls (FTI Act Art. 7(3)(5)–(6)).

Under the Specified Financial Transaction Information Act, virtual asset service providers that buy, sell, exchange, transfer, custody or broker virtual assets must report to KoFIU and perform customer due diligence (Art. 5-2); KoFIU states that NFT trading, deposit and lending services and DeFi are outside the reporting duty.

Korea's 20% tax on individuals' virtual-asset income above KRW 2.5 million was enacted by Law 17757 (29 December 2020) and deferred three times, last on 31 December 2024; it applies to transfers and lending from 1 January 2027, so no crypto income tax on individuals applies in 2026.

For crypto, the Financial Services Commission supervises and inspects virtual asset service providers under the Virtual Asset User Protection Act (Arts. 13–15) and may delegate work to the FSS (Art. 18); VASPs do not hold FSC licences but report to KoFIU, which sits under the FSC.

The Korea Financial Intelligence Unit (KoFIU) sits under the Financial Services Commission (FTI Act Art. 3); it receives suspicious transaction reports, accepts virtual asset service provider reports and supervises and inspects their AML/CFT compliance (Arts. 4, 7, 15).

Korean crypto exchanges do not register as securities trading platforms: they report to KoFIU as virtual asset service providers under the Specified Financial Transaction Information Act (Art. 7), and KoFIU listed 28 reported VASPs as of 30 September 2026.

Token offerings that are securities under the Financial Investment Services and Capital Markets Act must satisfy the same securities registration and disclosure requirements as ordinary securities offerings (FSC, 15 January 2026).

The Specified Financial Transaction Information Act sets no minimum capital amount for virtual asset service providers, but Law 21358 (19 February 2026) lets KoFIU refuse a report from a VASP whose finances or social credit, or those of its CEO, officers or major shareholders, fall short of the decree standard (Art. 7(3)(5)).

A Korean VASP files a report with KoFIU, not the FSC, covering its name, representative, major shareholders and place of business (FTI Act Art. 7(1)); KoFIU may refuse it without ISMS certification or a real-name bank account and may delegate report work to the FSS (Art. 7(3), (8)).

KoFIU's VASP list (30 September 2026) shows report processing times from about seven weeks (Upbit: filed 20 August 2021, accepted 6 October 2021) to almost two years (ABC Cloud Wallet: filed 10 June 2024, accepted 23 April 2026); BitGo Korea filed on 4 September 2025 and was accepted on 18 August 2026.

FTI Act Art. 5-2 requires Korean VASPs to verify each customer's identity and beneficial owner; the purpose of the transaction and the source of funds must also be verified only where money-laundering or terrorist-financing risk is suspected (Art. 5-2(1)(2)).

Korean law sets no KRW 50 million EDD threshold: enhanced checks on purpose and source of funds are risk-based (FTI Act Art. 5-2(1)(2)), and the monetary trigger for customer due diligence on a one-off virtual-asset transaction is KRW 1 million (Enforcement Decree Art. 10-3).

Korean VASPs and other financial institutions must report suspicious transactions to KoFIU "without delay" and state the grounds for suspicion (FTI Act Art. 4(1), (3)); the statute sets no 24-hour deadline.

Operating a Korean crypto business without a KoFIU report carries up to 5 years' imprisonment or a KRW 50 million fine (FTI Act Art. 17(1)); unfair trading under the Virtual Asset User Protection Act carries at least 1 year's imprisonment or a fine of 3–5 times the gain (Art. 19(1)).

KoFIU sanctioned Korea's major exchanges under the FTI Act: Dunamu (Upbit) a 3-month partial suspension (25 Feb 2025) and a KRW 35.2bn fine (6 Nov 2025); Korbit an institutional warning and KRW 2.73bn fine (2 Jan 2026); Bithumb a 6-month partial suspension and KRW 36.8bn fine (16 Mar 2026); Coinone a 3-month partial suspension and KRW 5.26bn fine (14 Apr 2026).

Virtual-asset income is not a capital gain under Korean law: it is separately taxed other income (Income Tax Act Art. 14(3)(8)(c)), kept out of global income and taxed at 20% of the amount above KRW 2.5 million, with the rules applying to transfers and lending from 1 January 2027.

Korean virtual asset service providers must verify customers when an account is opened or a one-off virtual-asset transaction reaches KRW 1 million (FTI Act Art. 5-2(1); Decree Art. 10-3(1)(1-2)), and KoFIU supervises and inspects their compliance (Art. 15).

Korea does not tax crypto trading gains in 2026: income from transferring or lending virtual assets is "other income" (Income Tax Act Art. 21(1)(27)), taxed at 20% above KRW 2.5 million a year only on transfers and lending from 1 January 2027.