DeFi protocol frontend in South Korea
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in South Korea with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VASP registration with KoFIU is mandatory if the frontend is deemed a VASP under Korean law (Act on Reporting and Using Specified Financial Transaction Information).
- ISMS (Information Security Management System) certification from KISA required for VASPs.
- Real-name verified bank account partnership required — this is a critical bottleneck and is only achievable with a local entity and a partnership with a Korean bank.
- Mandatory KYC/AML on all users; suspicion transaction reporting (STR) to KoFIU.
- If classified as an exchange (fee-taking, order routing), KRW 3B (~$2.2M) minimum equity capital required under VAUPA.
- Compensation reserves and 100% cold storage for user assets (if the frontend handles custody or facilitates trades) required under VAUPA.
Key Restrictions
- Any DeFi frontend that charges fees, routes users to specific pools, or screens/intermediates transactions likely falls under the VASP registration regime, requiring a locally-incorporated entity.
- Real-name bank account partnership is a structural bottleneck — only 5 exchanges (Upbit, Bithumb, Coinone, Korbit, Gopax) have achieved this; a new entrant would need a new bank partnership or an alternative structure.
- Geofencing out Korean residents (IP blocking, nationality checks, residence checks) is likely required to avoid VASP classification if the frontend operator does not hold a Korean VASP license.
- Token listing on any Korean-facing frontend requires exchange self-assessment and compliance with FSC token screening guidelines.
- ICO-style token offerings directed at Korean residents are effectively banned (administrative guidance since 2017).
- Fee-taking strongly increases the risk of classification as a regulated exchange/VASP — differential treatment for non-fee interfaces is unclear.
Key Risks
- Regulatory ambiguity: Korean law defines VASP broadly and does not explicitly carve out non-custodial DeFi frontends — the FSC/KoFIU may assert jurisdiction over any interface serving Korean residents.
- Enforcement risk: FSC expanded supervisory powers under VAUPA (2024) and can investigate unfair trading, market manipulation, and unregistered VASP activities with severe penalties (including life imprisonment for gains over KRW 5B).
- No clear DeFi exemption: Unlike some jurisdictions, Korea has not issued a non-binding interpretation that DeFi frontends are unregulated — the default is that any entity facilitating virtual asset transactions for Korean residents is a VASP.
- Bottleneck risk: Even with a compliant structure, the real-name account partnership is controlled by a small number of Korean banks and may be practically unavailable to new entrants.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Act on Reporting and Using Specified Financial Transaction Information (amended) (2021) — VASP registration, AML/CFT
Virtual Asset User Protection Act (VAUPA) (2024) — Investor protection, unfair trading/insider trading prohibition, mandatory insurance/reserves, KRW 3B minimum equity capital for exchanges
VASP: VASP registration with KoFIU + ISMS certification mandatory. KRW 3B (~$2.2M USD) minimum equity capital for exchanges under VAUPA. Real-name verified bank account partnership required (critical bottleneck — only 5 exchanges achieved this: Upbit, Bithumb, Coinone, Korbit, Gopax).
Act on Reporting and Use of Specific Financial Transaction Information: Requires VASPs to register with KoFIU and comply with AML/CTF standards.
Evidence fact kr.aml.act-on-the-protection-of-virtual-asset-users not found (may have been renamed).
Korea Financial Intelligence Unit (KoFIU): Handles VASP registration, AML reporting, and guidelines. (Official site: kofiu.go.kr)
Financial Services Commission (FSC): Oversees VASPs, enforces consumer protection, investigates unfair practices, and issues guidelines; gained expanded supervisory powers under recent acts.
Korea Internet & Security Agency (KISA): Issues mandatory Information Security Management System (ISMS) certifications for exchanges.
Act on the Reporting and Use of Specific Financial Transaction Information (March 2020 Amendment): Effective March 2021; legalized crypto, mandated VASP registration, real-name accounts, ISMS certification, and AML/KYC.
Act on the Protection of Virtual Asset Users (2024): Focuses on user protection, prohibits unfair practices like market manipulation, and enforces AML protocols.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A DeFi frontend serving Korean residents likely triggers VASP registration requirements unless it is strictly non-custodial, charges no fees, and geofences out Korean residents; fee-taking or user-intermediation strongly pushes it into the full exchange licensing regime (real-name bank account, KRW 3B capital, ISMS certification), which is practically very difficult to obtain.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?