Crypto ATM / kiosk operator in South Korea
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in South Korea with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VASP registration with KoFIU is mandatory under the Act on Reporting and Using Specified Financial Transaction Information (amended 2021)
- ISMS (Information Security Management System) certification from KISA is mandatory
- Real-name verified bank account partnership required — this is a critical bottleneck and only 5 exchanges (Upbit, Bithumb, Coinone, Korbit, Gopax) have achieved this
- Mandatory AML/CTF compliance under KoFIU supervision per the Act on Reporting and Use of Specific Financial Transaction Information
- Suspicious Transaction Reports (STRs) must be filed with KoFIU for all suspicious crypto-cash activity
- Cash transaction reporting likely required under general financial transaction reporting obligations — specific KRW cash thresholds for kiosks are not detailed in provided facts but standard financial institution cash-transaction reporting (CTR) at 10M+ KRW likely applies under the Act on Reporting and Use of Specific Financial Transaction Information
- Enhanced KYC obligations apply given high cash risk — real-name verified accounts are the baseline, and cash-in/cash-out at kiosks would likely require identity verification at or above exchange standards
Key Restrictions
- VASP registration is mandatory — no unregistered crypto-to-cash or cash-to-crypto operation is permitted
- Real-name verified bank account partnership is required, which has historically been a severe bottleneck (only 5 firms achieved this)
- VAUPA mandates KRW 3B (~$2.2M USD) minimum equity capital for exchanges — applicable by extension to cash-exchange kiosks if categorized as exchanges
- 100% cold storage of reserves required under VAUPA; compensation reserves also mandatory
- Must obtain ISMS certification from KISA — significant technical/operational investment required
- No specific kiosk/money-transmitter license exists — the operation falls under the VASP registration framework
- ICO ban (since 2017 administrative guidance) may restrict token offerings via kiosk interfaces
Key Risks
- Real-name bank account bottleneck is the single biggest practical barrier — no Korean bank has partnered with a kiosk operator, making cash-deposit/withdrawal channels difficult
- Regulatory treatment of crypto ATMs/kiosks is not explicitly addressed in the provided facts — they may be treated as exchanges or unregistered money transmitters
- High regulatory scrutiny of cash-based crypto transactions by KoFIU given AML concerns around money laundering and unregistered VASPs
- Enforcement risk: operating without full VASP registration and real-name banking partnership exposes operators to criminal penalties under the Act on Reporting and Using Specified Financial Transaction Information
- VAUPA (effective July 2024) imposes new investor protection requirements, insurance/reserve mandates that may be burdensome for kiosk operators
- FSC and FSS have expanded supervisory powers and can investigate abnormal transactions
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Act on Reporting and Using Specified Financial Transaction Information (amended) (2021) — VASP registration, AML/CFT
Virtual Asset User Protection Act (VAUPA) (2024) — Investor protection, unfair trading/insider trading prohibition, mandatory insurance/reserves, KRW 3B minimum equity capital for exchanges
VASP: VASP registration with KoFIU + ISMS certification mandatory. KRW 3B (~$2.2M USD) minimum equity capital for exchanges under VAUPA. Real-name verified bank account partnership required (critical bottleneck — only 5 exchanges achieved this: Upbit, Bithumb, Coinone, Korbit, Gopax).
CUSTODY: Included under VASP registration; 100% cold storage for reserves required. Compensation reserves mandatory under VAUPA.
EXCHANGE: VASP registration + real-name bank account partnership. Upbit dominates ~80% market share. ICOs effectively banned since 2017 (administrative guidance). Token listing requires exchange self-assessment.
Act on Reporting and Use of Specific Financial Transaction Information: Requires VASPs to register with KoFIU and comply with AML/CTF standards.
Act on the Protection of Virtual Asset Users (2024): Focuses on user protection, prohibits unfair practices like market manipulation, and enforces AML protocols.
Korea Financial Intelligence Unit (KoFIU): Handles VASP registration, AML reporting, and guidelines. (Official site: kofiu.go.kr)
Korea Internet & Security Agency (KISA): Issues mandatory Information Security Management System (ISMS) certifications for exchanges.
Financial Services Commission (FSC): Oversees VASPs, enforces consumer protection, investigates unfair practices, and issues guidelines; gained expanded supervisory powers under recent acts.
Financial Supervisory Service (FSS): Supports FSC by probing abnormal transactions and clarifying rules (e.g., on NFTs).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators in South Korea must obtain VASP registration (KoFIU), ISMS certification (KISA), and a real-name bank account partnership (historically a near-insurmountable bottleneck) to lawfully offer cash-to-crypto services, with no separate kiosk-specific license regime identified and significant regulatory ambiguity.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?