Centralized exchange in South Korea
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in South Korea with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VASP registration with KoFIU required under the Act on Reporting and Using Specified Financial Transaction Information (amended 2021)
- Mandatory ISMS (Information Security Management System) certification from KISA
- Real-name verified bank account partnership required (major bottleneck — only 5 exchanges have achieved this)
- KYC/AML enforcement under KoFIU supervision with suspicious transaction reporting (STR) obligations
- Travel Rule compliance: identity sharing for originator/beneficiary info on transfers ≥ KRW 1,000,000 (threshold being lowered toward zero under 2025 expansion with a 6-month grace period)
- Compensation reserves (insurance/reserves) mandatory under VAUPA
- Market manipulation, insider trading, and unfair practices prohibited under Virtual Asset User Protection Act with severe penalties (up to life imprisonment for gains > KRW 5 billion)
Key Restrictions
- Must obtain VASP registration with KoFIU + ISMS certification + real-name bank account partnership
- Minimum equity capital of KRW 3B (~$2.2M USD) for exchanges under VAUPA
- 100% cold storage of reserves required — no hot-wallet custody model without a compliant cold-storage solution
- Token listing requires exchange self-assessment; ICOs effectively banned since 2017 under administrative guidance
- Real-name bank account partnerships are a critical bottleneck — effectively only 5 domestic exchanges have achieved this (Upbit, Bithumb, Coinone, Korbit, Gopax)
- Upcoming Digital Asset Basic Act (proposed for early 2026) may impose additional ownership caps and governance rules
Key Risks
- Real-name account bottleneck — foreign operators are effectively locked out unless they partner with a Korean bank, which is extremely difficult
- Upbit ~80% market share creates significant competitive and regulatory asymmetry risk
- VAUPA penalties for unfair trading/insider trading include life imprisonment for gains over KRW 5B — severe enforcement exposure
- Travel Rule expansion to lower thresholds creates ongoing compliance system upgrade costs
- Regulatory landscape in flux with Digital Asset Basic Act expected 2026 — current rules may change significantly
- ICOs effectively banned — no clear path to do compliant token offerings alongside exchange services
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Act on Reporting and Using Specified Financial Transaction Information (amended) (2021) — VASP registration, AML/CFT
Virtual Asset User Protection Act (VAUPA) (2024) — Investor protection, unfair trading/insider trading prohibition, mandatory insurance/reserves, KRW 3B minimum equity capital for exchanges
VASP: VASP registration with KoFIU + ISMS certification mandatory. KRW 3B (~$2.2M USD) minimum equity capital for exchanges under VAUPA. Real-name verified bank account partnership required (critical bottleneck — only 5 exchanges achieved this: Upbit, Bithumb, Coinone, Korbit, Gopax).
CUSTODY: Included under VASP registration; 100% cold storage for reserves required. Compensation reserves mandatory under VAUPA.
EXCHANGE: VASP registration + real-name bank account partnership. Upbit dominates ~80% market share. ICOs effectively banned since 2017 (administrative guidance). Token listing requires exchange self-assessment.
Act on Reporting and Use of Specific Financial Transaction Information: Requires VASPs to register with KoFIU and comply with AML/CTF standards.
Act on the Protection of Virtual Asset Users (2024): Focuses on user protection, prohibits unfair practices like market manipulation, and enforces AML protocols.
Digital Asset Basic Act: Imposes ownership caps (e.g., 20% max per shareholder) and governance rules to enhance transparency and AML.
Financial Services Commission (FSC): Primary regulator for VASPs, enforces consumer protection and investigates unfair practices. (Official site: fsc.go.kr)
Korea Financial Intelligence Unit (KoFIU): Handles VASP registration, AML reporting, and guidelines. (Official site: kofiu.go.kr)
Financial Supervisory Service (FSS): Investigates abnormal transactions and develops guidelines. (Official site: fss.or.kr)
Financial Services Commission (FSC): Oversees VASPs, enforces consumer protection, investigates unfair practices, and issues guidelines; gained expanded supervisory powers under recent acts.
Financial Supervisory Service (FSS): Supports FSC by probing abnormal transactions and clarifying rules (e.g., on NFTs).
Korea Financial Intelligence Unit (KoFIU): Handles VASP registration, AML reporting, and guidelines. (Official site: kofiu.go.kr)
Korea Internet & Security Agency (KISA): Issues mandatory Information Security Management System (ISMS) certifications for exchanges.
Act on the Reporting and Use of Specific Financial Transaction Information (March 2020 Amendment): Effective March 2021; legalized crypto, mandated VASP registration, real-name accounts, ISMS certification, and AML/KYC.
Act on the Protection of Virtual Asset Users (2024): Focuses on user protection, prohibits unfair practices like market manipulation, and enforces AML protocols.
Upcoming Digital Asset Basic Act: Proposed for early 2026 by National Assembly to consolidate regulations on exchanges, token issuance, custody, stablecoins, and ETFs.
Travel Rule adopted — threshold: KRW 1,000,000
Adoption and Effective Date: Adopted and in force since March 25, 2022. Expansion announced February 5, 2025, with a six-month grace period for upgrades, targeting full effect around August 2025, though further revisions continue into 2026.
Threshold Amounts: Originally 1 million KRW; expansions lower it to cover smaller transactions, aiming for zero-threshold transparency to close smurfing gaps.
VASPs Covered: All registered VASPs must comply with FATF Recommendation 16, including identity sharing for sender/recipient data in VA transfers; now extends to stablecoins and blocks non-compliant offshore exchanges.
Technical Implementation Requirements: VASPs require system upgrades for data collection/sharing (e.g., originator/beneficiary info); FSC provides workshops, technical guidance, and a support desk during transitions. No specific protocol mandated, but aligns with global interoperability challenges.
Act on Reporting and Using Specified Financial Transaction Information (effective 2022).
FSC announcements (February 2025 expansion).
Ongoing FSC/KoFIU AML overhauls (2026).
FSC announcements (February 2025 expansion).
Ongoing FSC/KoFIU AML overhauls (2026).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a centralized exchange may operate in Korea only after obtaining VASP registration with KoFIU, ISMS certification, a real-name bank account partnership (a severe bottleneck), meeting KRW 3B minimum capital, and complying with VAUPA custody, consumer protection, and Travel Rule obligations.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?