South Korea Compliance Report

Generated 2026-10-23

Framework In Development

Regulatory Overview

Regulatory Status: Active legislative/regulatory process underway
Key Regulator(s): National Assembly's National Policy Committee, Financial Services Commission
Risk Level: low
Primary Legislation: Act on Reporting and Using Specified Financial Transaction Information, Law 19563 of 18 July 2023, in force 19 July 2024
Travel Rule: Adopted — Threshold: Implemented
Tax Reporting: Korea taxes income from transferring or lending virtual assets at 20% on the amount above KRW 2.5 million a year (Income Tax Act Art. 64-3(2), added by Law 17757 of 29 December 2020); after three deferrals, the last on 31 December 2024, it applies from 1 January 2027.. From 1 January 2027, individuals computing virtual-asset income deduct the actual acquisition cost plus incidental costs of acquisition, transfer or lending (Income Tax Act Art. 37(1)(3)); for assets held before 2027, cost is the higher of the 31 December 2026 market value and actual cost (Art. 37(5)).. From 1 January 2027, virtual asset service providers under the Virtual Asset User Protection Act must submit users' transaction records to the tax authorities by the end of the second month after each quarter or year (Income Tax Act Art. 164-4); the penalty for non-submission applies to transactions from 1 January 2028.. The Income Tax Act amendment of 31 December 2024 (Law 20615) deferred virtual-asset income tax for the third time, to transfers and lending from 1 January 2027; the earlier deferrals were enacted on 8 December 2021 and 31 December 2022.. Korea's tax on virtual-asset income (20% above KRW 2.5 million a year, from 1 January 2027) is in the Income Tax Act; the Digital Asset Basic Act is bill 2210736, proposed on 11 June 2025 and still unprocessed in the National Policy Committee on 14 October 2026.

Key Facts

aml Under Article 7(1) of the Act on Reporting and Using Specified Financial Transaction Information, a virtual asset service provider must file a report (신고) with the Korea Financial Intelligence Unit before operating, and is subject to the Act's customer due diligence and suspicious-transaction reporting duties from 25 March 2021 (Law 17113 of 24 March 2020); operating without a report carries up to 5 years' imprisonment or a fine of up to KRW 50 million (Art. 17(1)). The Digital Asset Basic Act (디지털자산기본법안, bill 2210736, proposed 11 June 2025) is a pending bill before the National Assembly's National Policy Committee with no committee or plenary decision recorded as of 14 October 2026, so no shareholder ownership cap applies under it; the screening of VASP major shareholders that is in force comes from Law 21358 of 19 February 2026, which adds major shareholders to the KoFIU report and lets KoFIU refuse a report where the provider, its officers or major shareholders lack sound financial standing or social credit (Act on Reporting and Using Specified Financial Transaction Information, Art. 7(1)(1-2) and 7(3)(5)). Financial Services Commission (FSC): Primary regulator for VASPs, enforces consumer protection and investigates unfair practices. (Official site: fsc.go.kr) The Financial Supervisory Service receives exchanges' notices of suspected unfair trading (Virtual Asset User Protection Act Art. 12(2)), investigates at the FSC's direction (Art. 14(1)) and inspects virtual asset service providers under delegated FSC authority (Art. 18), and KoFIU entrusts it with reviewing VASP reports, refusals and renewals under the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information (Art. 10-17). Under the Virtual Asset User Protection Act, in force 19 July 2024, the Financial Services Commission supervises and inspects virtual asset service providers (Art. 13), investigates unfair trading with the Financial Supervisory Service (Art. 14), may order corrective action, issue warnings or suspend all or part of a provider's business (Art. 15), and may impose penalty surcharges for unfair trading (Art. 17). Financial Supervisory Service (FSS): Supports FSC by probing abnormal transactions and clarifying rules (e.g., on NFTs). The Korea Financial Intelligence Unit receives and accepts virtual asset service provider reports under Article 7 of the Act on Reporting and Using Specified Financial Transaction Information (28 providers accepted as of 30 September 2026), receives suspicious transaction reports, which must be filed without delay (Art. 4(1)), and supervises, inspects and sanctions reporting entities for AML compliance (Art. 15). Information security management system (ISMS) certification, which a virtual asset service provider needs for its KoFIU report to be accepted (Act on Reporting and Using Specified Financial Transaction Information Art. 7(3)(1)), is granted under Article 47 of the Information and Communications Network Act by the Minister of Science and ICT, who may have the Korea Internet & Security Agency (KISA) or a designated certification body carry out certification audits and issue certificates (Art. 47(6)).
general The amended Act on Electronic Registration of Stocks and Bonds (passed 15 January 2026, in effect from 4 February 2027) recognises a blockchain-based distributed ledger as a securities registry, so security tokens become a legally recognised digitized form of securities. An amendment to the Financial Investment Services and Capital Markets Act, passed by the National Assembly on 15 January 2026 and taking effect one year after promulgation, permits investment contract securities to be circulated (intermediated) through securities businesses; previously only issuers could recruit investors directly. Investment contract securities (including non-standardized products tied to real estate, art, or livestock projects) Under the amended Electronic Registration Act (effective 4 February 2027), a security-token issuer must follow statutory procedures and qualifications to notify and apply for electronic registration with the Korea Securities Depository, which also screens securities firms connecting to the distributed ledger under its DLT guidelines. Korea will not create a separate licence for tokenized securities: firms already authorised for a financial investment business may handle them within their licensed areas, intermediating tokenized-securities trades requires prior consultation with the FSS, and an unlicensed investment broker intermediating security tokens violates the FSCMA (FSC, 15 Jan and 4 Sep 2026). Security tokens are securities under the Financial Investment Services and Capital Markets Act, so an unlicensed investment brokerage firm that intermediates security-token trades breaks the law, and security token offerings face the same registration and disclosure rules as ordinary securities (FSC, 15 January 2026). Integrate distributed ledger operational efficiency with established investor protection frameworks Enable distributed ledger-based securities account management
licensing FSC — Financial policy and regulation KoFIU — Financial intelligence, VASP registration Act on Reporting and Using Specified Financial Transaction Information — VASP reporting to KoFIU and AML/CFT duties added by Law 17113 of 24 March 2020 (in force 25 March 2021); Law 21358 of 19 February 2026, in force six months after promulgation, adds major shareholders to the report and new refusal grounds on financial soundness, social credit and internal controls (Art. 7(1)(1-2), 7(3)(5)-(6)). Virtual Asset User Protection Act (Law 19563 of 18 July 2023, in force 19 July 2024) — user deposit and asset protection (Arts. 6-7), mandatory insurance, mutual aid or reserves against hacking and outages (Art. 8; FSC rule proposal minimum KRW 3 billion for KRW-market exchanges and KRW 500 million for other providers, a cover requirement rather than equity capital), and prohibition of insider trading, market manipulation and other unfair trading (Art. 10). A virtual asset service provider must report to the Korea Financial Intelligence Unit (Act on Reporting and Using Specified Financial Transaction Information, Art. 7), which may refuse the report without ISMS certification or a real-name verified bank deposit and withdrawal account unless KoFIU exempts the provider (Art. 7(3)(1)-(2)); since Law 21358 of 19 February 2026 the report also covers major shareholders; an accepted report is valid for 3 years and must be renewed (Enforcement Decree Art. 10-15); KoFIU listed 28 providers with accepted reports as of 30 September 2026. Under the Virtual Asset User Protection Act a provider holding users' virtual assets must keep them segregated from its own and actually hold the same type and quantity (Art. 7(2)), and must store offline a share set by decree (Art. 7(3)): the Enforcement Decree sets at least 70%, at the ratio the FSC fixes by notice (Decree Art. 11(1)), and the FSC's 11 December 2023 rule proposal set that ratio at 80%; user KRW deposits must be placed with a bank or similar custodian at 100% or more of the total (Decree Art. 8(3)), and insurance or reserves against hacking and outages are mandatory (Act Art. 8). A virtual asset exchange must report to the Korea Financial Intelligence Unit under Article 7 of the Act on Reporting and Using Specified Financial Transaction Information, and KoFIU may refuse the report if the exchange lacks ISMS certification or does not deal through a real-name verified deposit and withdrawal account linking the exchange's and its customers' accounts at the same bank (Art. 7(3)(1)-(2)); under the Virtual Asset User Protection Act an exchange must monitor abnormal trading continuously and notify the FSC and FSS of suspected unfair trading (Art. 12).
securities The South Korean government has implemented a comprehensive regulatory framework for cryptocurrencies and digital assets, aiming to balance innovation with investor protection. A Korean security token is a digitized form of a security as defined in the Financial Investment Services and Capital Markets Act; tokens structured as investment contract securities (investors jointly fund a business and earn returns from its performance) fall under the same securities regulation. No FSC licence is required to issue security tokens: offerings must meet the same FSCMA securities registration and disclosure requirements as ordinary securities, and from 4 February 2027 issuers notify and apply for electronic registration with the Korea Securities Depository. Korea has no VASP licence; since Law 21358 (19 February 2026) KoFIU may refuse a VASP report if the firm, its CEO, officers or major shareholders lack sound finances or social credit, or if it lacks AML compliance staff, IT and internal controls (FTI Act Art. 7(3)(5)–(6)). Under the Specified Financial Transaction Information Act, virtual asset service providers that buy, sell, exchange, transfer, custody or broker virtual assets must report to KoFIU and perform customer due diligence (Art. 5-2); KoFIU states that NFT trading, deposit and lending services and DeFi are outside the reporting duty. These requirements include verifying the identity of users, monitoring transactions for suspicious activity, and reporting to relevant authorities. The FSC has conducted several enforcement actions against non-compliant entities, imposing fines and suspending operations. Recent actions target platforms that fail to adhere to licensing and AML/KYC standards, emphasizing the government's commitment to market integrity.
stablecoin Stablecoins are proposed to be treated as foreign exchange payment vehicles, subjecting cross-border transactions to oversight by foreign exchange authorities without new licensing categories. This integrates them into existing financial regulations rather than classifying them as securities or e-money; tokenized real-world assets (RWAs) linked to stablecoins require trust custody under the Capital Markets Act. Domestic small-scale payments (e.g., for goods/services) may be exempt from foreign exchange reporting. Issuers must maintain full or over-collateralized reserves, stored in regulated financial institutions, mirroring bank-style rules. For KRW-pegged stablecoins, requirements cover collateral management and internal controls; major banks are developing a KRW stablecoin with launch targeted for late 2025/early 2026. South Korea has no stablecoin issuer licensing regime as of 14 October 2026: the bills on value-stable digital assets (가치안정형 디지털자산), bill 2211784 proposed 28 July 2025 and bill 2212298 proposed 21 August 2025, and the Digital Asset Basic Act bill 2210736 proposed 11 June 2025, are all before the National Policy Committee with no decision recorded, and the FSC referred on 4 September 2026 to "the pending legislation on stablecoin". Stablecoin rules are not part of the Virtual Asset User Protection Act in force since 19 July 2024; the FSC refers to a separate "phase-2" Digital Asset Act (「디지털자산법」(2단계법)) still under consideration (20 July 2026) and to pending stablecoin legislation (4 September 2026), and the stablecoin bills on the National Assembly record (2211784 of 28 July 2025 and 2212298 of 21 August 2025) are member bills with no decision recorded as of 14 October 2026. Not explicitly detailed in proposals; focus is on reserves ensuring 1:1 redeemability, with prohibitions preventing investment-like features.
status South Korea regulatory status: virtual asset service providers report to the Korea Financial Intelligence Unit under the Act on Reporting and Using Specified Financial Transaction Information (since 25 March 2021; 28 accepted as of 30 September 2026) and are subject to the Virtual Asset User Protection Act (since 19 July 2024) for user-asset protection and unfair-trading rules; the travel rule applies since 25 March 2022; the Digital Asset Basic Act (bill 2210736) and stablecoin bills are pending as of 14 October 2026.
tax Korea taxes income from transferring or lending virtual assets at 20% on the amount above KRW 2.5 million a year (Income Tax Act Art. 64-3(2), added by Law 17757 of 29 December 2020); after three deferrals, the last on 31 December 2024, it applies from 1 January 2027. From 1 January 2027, individuals computing virtual-asset income deduct the actual acquisition cost plus incidental costs of acquisition, transfer or lending (Income Tax Act Art. 37(1)(3)); for assets held before 2027, cost is the higher of the 31 December 2026 market value and actual cost (Art. 37(5)). From 1 January 2027, virtual asset service providers under the Virtual Asset User Protection Act must submit users' transaction records to the tax authorities by the end of the second month after each quarter or year (Income Tax Act Art. 164-4); the penalty for non-submission applies to transactions from 1 January 2028. The Income Tax Act amendment of 31 December 2024 (Law 20615) deferred virtual-asset income tax for the third time, to transfers and lending from 1 January 2027; the earlier deferrals were enacted on 8 December 2021 and 31 December 2022. Korea's tax on virtual-asset income (20% above KRW 2.5 million a year, from 1 January 2027) is in the Income Tax Act; the Digital Asset Basic Act is bill 2210736, proposed on 11 June 2025 and still unprocessed in the National Policy Committee on 14 October 2026. Income Tax Act amendments proposed; opposition (People Power Party) bill seeks to scrap 22% tax entirely.
travel rule Travel Rule adopted — in force since 25 March 2022 for transfers of KRW 1,000,000 or more between virtual asset service providers (FTI Enforcement Decree Art. 10-10(1)); Presidential Decree 36592 of 18 August 2026 extends it to all such transfers regardless of amount from 19 February 2027. Adoption and Effective Date: the travel rule took effect on 25 March 2022 under Article 10-10 of the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information; KoFIU announced on 5 February 2026 a plan to extend it below KRW 1 million, and Presidential Decree 36592 of 18 August 2026 does so with effect from 19 February 2027 (the rest of that decree took effect on 20 August 2026). Threshold Amounts: the travel rule applies to transfers between virtual asset service providers worth KRW 1 million or more (FTI Enforcement Decree Art. 10-10(1), since 25 March 2022); Presidential Decree 36592 of 18 August 2026 removes the threshold so that every VASP-to-VASP transfer is covered from 19 February 2027. VASPs Covered: the travel rule applies to every reported virtual asset service provider that transfers virtual assets to another provider (Act on Reporting and Using Specified Financial Transaction Information Art. 6(3); Enforcement Decree Art. 10-10); per the FSC (24 March 2022), transfers to overseas providers proceed only after the sender and receiver are confirmed to be the same person and money-laundering risk is low. Technical Implementation Requirements: the originating virtual asset service provider must send the names and virtual asset addresses of the sender and recipient with the transfer, and supply the sender's resident registration or passport number within 3 business days when KoFIU or the receiving provider requests it (FTI Enforcement Decree Art. 10-10(2)-(4)); providers must keep sender and recipient information for 5 years, with a fine of up to KRW 30 million for breach (FSC, 24 March 2022). The travel rule rests on the Act on Reporting and Using Specified Financial Transaction Information, whose virtual asset provisions took effect on 25 March 2021 (Law 17113 of 24 March 2020); Article 6(3) applies the wire-transfer information duty to virtual asset service providers, and the Enforcement Decree rule implementing it took effect on 25 March 2022. FSC announcements (February 2025 expansion). Ongoing FSC/KoFIU AML overhauls (2026).

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-10-14. View full profile