Remote VASP serving residents in South Korea
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in South Korea with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VASP registration with KoFIU is mandatory under the Act on Reporting and Using Specified Financial Transaction Information (2021 amendment)
- ISMS certification from KISA is required
- Real-name verified bank account partnership with a domestic Korean bank is required (critical bottleneck — only 5 exchanges have achieved this)
- Travel Rule compliance at KRW 1,000,000 threshold under FATF Recommendation 16, with expansion toward lower thresholds
- Suspicious transaction reporting (STR) to KoFIU
- KYC/AML obligations enforced by KoFIU
- Compensation reserves and mandatory insurance under VAUPA
- 100% cold storage for custody reserves
Key Restrictions
- Remote cross-border VASP service to residents without a local entity and bank partnership is not legally permitted — real-name bank account partnership requires a Korean entity
- Minimum equity capital of KRW 3B (~$2.2M USD) for exchanges under VAUPA
- ICOs effectively banned since 2017 (administrative guidance)
- Token listing requires issuer self-assessment per exchange rules
- Must comply with Travel Rule information-sharing obligations for transactions over KRW 1,000,000 (threshold lowering underway)
Key Risks
- High enforcement risk — unlicensed remote operators (e.g., Binance) have been blocked/excluded; no non-compliant offshore exchange can operate
- The real-name bank account partnership is a critical bottleneck — only 5 exchanges (Upbit, Bithumb, Coinone, Korbit, Gopax) have achieved compliance
- VAUPA (effective July 2024) imposes severe penalties including life imprisonment for gains over KRW 5B from unfair trading
- Regulatory consolidation ongoing with proposed Digital Asset Basic Act (2026), creating uncertainty
- Domain blocks and payment gateway restrictions are likely enforcement tools against unlicensed operators
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
VASP: VASP registration with KoFIU + ISMS certification mandatory. KRW 3B (~$2.2M USD) minimum equity capital for exchanges under VAUPA. Real-name verified bank account partnership required (critical bottleneck — only 5 exchanges achieved this: Upbit, Bithumb, Coinone, Korbit, Gopax).
EXCHANGE: VASP registration + real-name bank account partnership. Upbit dominates ~80% market share. ICOs effectively banned since 2017 (administrative guidance). Token listing requires exchange self-assessment.
Act on Reporting and Using Specified Financial Transaction Information (amended) (2021) — VASP registration, AML/CFT
Virtual Asset User Protection Act (VAUPA) (2024) — Investor protection, unfair trading/insider trading prohibition, mandatory insurance/reserves, KRW 3B minimum equity capital for exchanges
Act on Reporting and Use of Specific Financial Transaction Information: Requires VASPs to register with KoFIU and comply with AML/CTF standards.
Act on the Protection of Virtual Asset Users (2024): Focuses on user protection, prohibits unfair practices like market manipulation, and enforces AML protocols.
Korea Financial Intelligence Unit (KoFIU): Handles VASP registration, AML reporting, and guidelines. (Official site: kofiu.go.kr)
Korea Internet & Security Agency (KISA): Issues mandatory Information Security Management System (ISMS) certifications for exchanges.
Travel Rule adopted — threshold: KRW 1,000,000
Threshold Amounts: Originally 1 million KRW; expansions lower it to cover smaller transactions, aiming for zero-threshold transparency to close smurfing gaps.
VASPs Covered: All registered VASPs must comply with FATF Recommendation 16, including identity sharing for sender/recipient data in VA transfers; now extends to stablecoins and blocks non-compliant offshore exchanges.
Act on Reporting and Using Specified Financial Transaction Information (effective 2022).
Upcoming Digital Asset Basic Act: Proposed for early 2026 by National Assembly to consolidate regulations on exchanges, token issuance, custody, stablecoins, and ETFs.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — remote VASP service to Korean residents is not feasible without establishing a local Korean entity, obtaining VASP registration with KoFIU, securing ISMS certification, and forging a real-name bank account partnership (a critical bottleneck achieved by only 5 exchanges); unlicensed cross-border operation carries severe enforcement risk.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?