Remote VASP serving residents in South Korea

A virtual asset service provider must report to the Korea Financial Intelligence Unit (Act on Reporting and Using Specified Financial Transaction Information, Art. 7), which may refuse the report without ISMS certification or a real-name verified bank deposit and withdrawal account unless KoFIU exempts the provider (Art. 7(3)(1)-(2)); since Law 21358 of 19 February 2026 the report also covers major shareholders; an accepted report is valid for 3 years and must be renewed (Enforcement Decree Art. 10-15); KoFIU listed 28 providers with accepted reports as of 30 September 2026.

A virtual asset exchange must report to the Korea Financial Intelligence Unit under Article 7 of the Act on Reporting and Using Specified Financial Transaction Information, and KoFIU may refuse the report if the exchange lacks ISMS certification or does not deal through a real-name verified deposit and withdrawal account linking the exchange's and its customers' accounts at the same bank (Art. 7(3)(1)-(2)); under the Virtual Asset User Protection Act an exchange must monitor abnormal trading continuously and notify the FSC and FSS of suspected unfair trading (Art. 12).

Act on Reporting and Using Specified Financial Transaction Information — VASP reporting to KoFIU and AML/CFT duties added by Law 17113 of 24 March 2020 (in force 25 March 2021); Law 21358 of 19 February 2026, in force six months after promulgation, adds major shareholders to the report and new refusal grounds on financial soundness, social credit and internal controls (Art. 7(1)(1-2), 7(3)(5)-(6)).

Virtual Asset User Protection Act (Law 19563 of 18 July 2023, in force 19 July 2024) — user deposit and asset protection (Arts. 6-7), mandatory insurance, mutual aid or reserves against hacking and outages (Art. 8; FSC rule proposal minimum KRW 3 billion for KRW-market exchanges and KRW 500 million for other providers, a cover requirement rather than equity capital), and prohibition of insider trading, market manipulation and other unfair trading (Art. 10).

KoFIU — Financial intelligence, VASP registration

FSC — Financial policy and regulation

Under Article 7(1) of the Act on Reporting and Using Specified Financial Transaction Information, a virtual asset service provider must file a report (신고) with the Korea Financial Intelligence Unit before operating, and is subject to the Act's customer due diligence and suspicious-transaction reporting duties from 25 March 2021 (Law 17113 of 24 March 2020); operating without a report carries up to 5 years' imprisonment or a fine of up to KRW 50 million (Art. 17(1)).

The Virtual Asset User Protection Act (Law 19563, enacted 18 July 2023, in force 19 July 2024) prohibits the use of material non-public information, market manipulation and fraudulent unfair trading in virtual assets (Art. 10); violators face at least 1 year's imprisonment or a fine of 3 to 5 times the gain (Art. 19(1)), rising to life or at least 5 years' imprisonment where the gain or loss avoided is KRW 5 billion or more (Art. 19(3)), and the FSC may impose a penalty surcharge of up to twice the gain, or up to KRW 4 billion where no gain can be calculated (Art. 17(1)).

The Korea Financial Intelligence Unit receives and accepts virtual asset service provider reports under Article 7 of the Act on Reporting and Using Specified Financial Transaction Information (28 providers accepted as of 30 September 2026), receives suspicious transaction reports, which must be filed without delay (Art. 4(1)), and supervises, inspects and sanctions reporting entities for AML compliance (Art. 15).

Information security management system (ISMS) certification, which a virtual asset service provider needs for its KoFIU report to be accepted (Act on Reporting and Using Specified Financial Transaction Information Art. 7(3)(1)), is granted under Article 47 of the Information and Communications Network Act by the Minister of Science and ICT, who may have the Korea Internet & Security Agency (KISA) or a designated certification body carry out certification audits and issue certificates (Art. 47(6)).

Travel Rule adopted — in force since 25 March 2022 for transfers of KRW 1,000,000 or more between virtual asset service providers (FTI Enforcement Decree Art. 10-10(1)); Presidential Decree 36592 of 18 August 2026 extends it to all such transfers regardless of amount from 19 February 2027.

Threshold Amounts: the travel rule applies to transfers between virtual asset service providers worth KRW 1 million or more (FTI Enforcement Decree Art. 10-10(1), since 25 March 2022); Presidential Decree 36592 of 18 August 2026 removes the threshold so that every VASP-to-VASP transfer is covered from 19 February 2027.

VASPs Covered: the travel rule applies to every reported virtual asset service provider that transfers virtual assets to another provider (Act on Reporting and Using Specified Financial Transaction Information Art. 6(3); Enforcement Decree Art. 10-10); per the FSC (24 March 2022), transfers to overseas providers proceed only after the sender and receiver are confirmed to be the same person and money-laundering risk is low.

The travel rule rests on the Act on Reporting and Using Specified Financial Transaction Information, whose virtual asset provisions took effect on 25 March 2021 (Law 17113 of 24 March 2020); Article 6(3) applies the wire-transfer information duty to virtual asset service providers, and the Enforcement Decree rule implementing it took effect on 25 March 2022.

The Digital Asset Basic Act (디지털자산기본법안, bill 2210736) was proposed on 11 June 2025 by Rep. Min Byung-duk and 36 other members and referred to the National Policy Committee; as of 14 October 2026 the National Assembly bill record shows no committee or plenary decision, and the FSC described stablecoin legislation as pending on 4 September 2026.