On-shore VASP in South Korea
Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.
On-shore VASP is conditionally permitted in South Korea with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VASP registration with KoFIU required under Act on Reporting and Using Specified Financial Transaction Information (amended 2021)
- ISMS certification from KISA mandatory
- Real-name verified bank account partnership required (critical bottleneck — only 5 banks/exchanges have achieved this)
- Travel Rule compliance — identity sharing for originator/beneficiary data for transfers ≥ KRW 1,000,000 (threshold being lowered to close smurfing gaps)
- AML/KYC obligations enforced by KoFIU under Act on Reporting and Use of Specific Financial Transaction Information
- Suspicious Transaction Report (STR) filing to KoFIU
- Unfair trading / market manipulation prohibited under Virtual Asset User Protection Act (VAUPA) 2024 with severe penalties (life imprisonment for gains >KRW 5B)
- Compensation reserves mandatory under VAUPA
- 100% cold storage of customer reserves required for custodians
- Token listings require exchange self-assessment (no ICOs — effectively banned since 2017)
- Ownership caps per shareholder (e.g., 20% max) under Digital Asset Basic Act
- Individuals: 20% tax on crypto gains above KRW 2.5M (effective 2025 deferred to 2027); businesses face heightened reporting to NTS
Key Restrictions
- Must be locally incorporated in South Korea
- Minimum equity capital of KRW 3B (~$2.2M USD) for exchanges under VAUPA
- Real-name verified bank account partnership is a critical structural requirement — only Upbit, Bithumb, Coinone, Korbit, and Gopax have achieved this
- ICOs effectively banned since 2017 (administrative guidance)
- Token listing requires exchange-conducted self-assessment
- Travel Rule threshold originally KRW 1,000,000 — being lowered toward zero-threshold transparency
- ISMS certification from KISA is mandatory before registration
Key Risks
- Real-name bank account partnership bottleneck — only 5 operators have succeeded, creating high barrier to entry
- Regulatory ambiguity: Digital Asset Basic Act still proposed (target early 2026) — further changes expected
- Severe penalties under VAUPA (life imprisonment for gains >KRW 5B from unfair trading)
- Tax enforcement risk: NTS plans dedicated crypto monitoring units; blockchain traceability aids enforcement
- Travel Rule system upgrades ongoing with six-month grace period from Feb 2025 — compliance gap risk
- Upbit dominance (~80% market share) creates concentrated competitive risk
- ICO ban restricts token launch models
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Act on Reporting and Using Specified Financial Transaction Information (amended) (2021) — VASP registration, AML/CFT
Virtual Asset User Protection Act (VAUPA) (2024) — Investor protection, unfair trading/insider trading prohibition, mandatory insurance/reserves, KRW 3B minimum equity capital for exchanges
VASP: VASP registration with KoFIU + ISMS certification mandatory. KRW 3B (~$2.2M USD) minimum equity capital for exchanges under VAUPA. Real-name verified bank account partnership required (critical bottleneck — only 5 exchanges achieved this: Upbit, Bithumb, Coinone, Korbit, Gopax).
CUSTODY: Included under VASP registration; 100% cold storage for reserves required. Compensation reserves mandatory under VAUPA.
EXCHANGE: VASP registration + real-name bank account partnership. Upbit dominates ~80% market share. ICOs effectively banned since 2017 (administrative guidance). Token listing requires exchange self-assessment.
Act on Reporting and Use of Specific Financial Transaction Information: Requires VASPs to register with KoFIU and comply with AML/CTF standards.
Act on the Protection of Virtual Asset Users (2024): Focuses on user protection, prohibits unfair practices like market manipulation, and enforces AML protocols.
Digital Asset Basic Act: Imposes ownership caps (e.g., 20% max per shareholder) and governance rules to enhance transparency and AML.
Financial Services Commission (FSC): Primary regulator for VASPs, enforces consumer protection and investigates unfair practices. (Official site: fsc.go.kr)
Korea Financial Intelligence Unit (KoFIU): Handles VASP registration, AML reporting, and guidelines. (Official site: kofiu.go.kr)
Financial Supervisory Service (FSS): Investigates abnormal transactions and develops guidelines. (Official site: fss.or.kr)
Financial Services Commission (FSC): Oversees VASPs, enforces consumer protection, investigates unfair practices, and issues guidelines; gained expanded supervisory powers under recent acts.
Financial Supervisory Service (FSS): Supports FSC by probing abnormal transactions and clarifying rules (e.g., on NFTs).
Korea Financial Intelligence Unit (KoFIU): Handles VASP registration, AML reporting, and guidelines. (Official site: kofiu.go.kr)
Korea Internet & Security Agency (KISA): Issues mandatory Information Security Management System (ISMS) certifications for exchanges.
Act on the Reporting and Use of Specific Financial Transaction Information (March 2020 Amendment): Effective March 2021; legalized crypto, mandated VASP registration, real-name accounts, ISMS certification, and AML/KYC.
Act on the Protection of Virtual Asset Users (2024): Focuses on user protection, prohibits unfair practices like market manipulation, and enforces AML protocols.
Upcoming Digital Asset Basic Act: Proposed for early 2026 by National Assembly to consolidate regulations on exchanges, token issuance, custody, stablecoins, and ETFs.
Travel Rule adopted — threshold: KRW 1,000,000
Adoption and Effective Date: Adopted and in force since March 25, 2022. Expansion announced February 5, 2025, with a six-month grace period for upgrades, targeting full effect around August 2025, though further revisions continue into 2026.
Threshold Amounts: Originally 1 million KRW; expansions lower it to cover smaller transactions, aiming for zero-threshold transparency to close smurfing gaps.
VASPs Covered: All registered VASPs must comply with FATF Recommendation 16, including identity sharing for sender/recipient data in VA transfers; now extends to stablecoins and blocks non-compliant offshore exchanges.
Technical Implementation Requirements: VASPs require system upgrades for data collection/sharing (e.g., originator/beneficiary info); FSC provides workshops, technical guidance, and a support desk during transitions. No specific protocol mandated, but aligns with global interoperability challenges.
Act on Reporting and Using Specified Financial Transaction Information (effective 2022).
Evidence fact kr.tax not found (may have been renamed).
Individuals: Must track acquisition costs, sales, and fees; NTS plans dedicated crypto monitoring units for data collection and evasion prevention pre-2027. Blockchain traceability aids enforcement.
Businesses: Similar tracking required; virtual asset service providers (VASPs) face heightened reporting to NTS.
2026 Tax Reform Bill (enacted Dec 31, 2024): Defers tax to 2027; applies to fiscal years from Jan 1, 2026, but gains tax starts 2027.
Digital Asset Basic Act: Supports framework for oversight and taxation (20% on gains >$35,900).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — on-shore VASPs in South Korea are permitted but face a high licensing burden requiring VASP registration with KoFIU, ISMS certification from KISA, minimum KRW 3B equity capital (for exchanges), and a critical real-name verified bank account partnership (only 5 operators have succeeded), plus rigorous AML/Travel Rule obligations, effective ICO ban, and impending tax and regulatory consolidation under the Digital Asset Basic Act (targeting 2026).
Questions this verdict aims to answer
- What license(s) are required to operate locally?
- What capital, governance, and reporting obligations apply?
- What is the application process and timeline?