South Korea -- AML/CFT Compliance Regulatory Overview

South Korea regulates cryptocurrency/virtual asset service providers (VASPs) through strict AML/CFT requirements under key laws including the Act on Reporting and Use of Specific Financial Transaction Information (since 2021) and the Act on the Protection of Virtual Asset Users (effective July 2024), with additional measures from the Digital Asset Basic Act. These frameworks mandate VASP registration with the Korea Financial Intelligence Unit (KoFIU), real-name accounts, insurance against hacks, and alignment with FATF standards for market integrity and investor protection.[3][4][5]

Key AML/CFT Legislation

• Act on Reporting and Use of Specific Financial Transaction Information: Requires VASPs to register with KoFIU and comply with AML/CTF standards.[3][5]
• Act on the Protection of Virtual Asset Users (2024): Focuses on user protection, prohibits unfair practices like market manipulation, and enforces AML protocols.[4][5]
• Digital Asset Basic Act: Imposes ownership caps (e.g., 20% max per shareholder) and governance rules to enhance transparency and AML.[2]

Customer Due Diligence (CDD) Requirements

VASPs must conduct Customer Due Diligence (CDD), including simplified and enhanced due diligence where applicable, alongside sanctions screening.[5] This applies to services like buying/selling virtual assets, exchanges, transfers, storage, and intermediation.[5] The Travel Rule mandates sharing sender/receiver details (names, IDs, accounts) for transactions over KRW 1 million (~USD 800).[3]

Suspicious Transaction Reporting

VASPs are required to monitor transactions, track suspicious activities, and report them, with appointment of a money laundering reporting officer (MLRO) and internal AML policies.[1][5] This includes company-wide risk assessments and ongoing transaction monitoring.[5]

Record-Keeping Obligations

VASPs must maintain records of transactions and compliance activities, supporting suspicious transaction tracking and regulatory audits, in line with KoFIU guidelines.[1][2]

Oversight Authority

Compliance is overseen by:

• Financial Services Commission (FSC): Primary regulator for VASPs, enforces consumer protection and investigates unfair practices. (Official site: fsc.go.kr)
• Korea Financial Intelligence Unit (KoFIU): Handles VASP registration, AML reporting, and guidelines. (Official site: kofiu.go.kr)
• Financial Supervisory Service (FSS): Investigates abnormal transactions and develops guidelines. (Official site: fss.or.kr)[1][2][3][4]