Self-custodial wallet / non-custodial software in South Korea
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in South Korea without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- No AML/KYC obligations attach because the publisher never holds, controls, or has access to user funds — the AML/CTF framework (Act on Reporting and Using Specified Financial Transaction Information, VAUPA) targets VASPs providing custody, exchange, or transmission services (kr.licensing.vasp, kr.licensing.custody, kr.licensing.exchange)
- Software publishers of self-custodial wallets are not classified as VASPs under the Act on Reporting and Using Specified Financial Transaction Information (amended 2021), which requires registration with KoFIU only for entities providing virtual asset exchange, transfer, custody, or brokerage (kr.licensing.legislation-act-on-reporting-and-using-specified-financial-transaction-i, kr.licensing.vasp)
- No suspicious transaction reporting (STR) obligation absent VASP status
Key Restrictions
- The software publisher must not offer any custody, exchange, brokerage, or transmission services — doing so would trigger VASP registration with KoFIU, ISMS certification, and real-name bank account requirements (kr.licensing.vasp)
- The publisher must not collect, hold, or control user private keys or funds; the product must be truly non-custodial to avoid classification under custody provisions (kr.licensing.custody)
- No specific license or registration is required purely for software publishing of a non-custodial wallet, as Korean VASP regulation focuses on service providers that handle virtual assets on behalf of users (kr.licensing.vasp)
Key Risks
- Regulatory ambiguity risk — KoFIU or FSC could reinterpret the definition of 'virtual asset service provider' to include software that facilitates transactions, even without custody (kr.aml.korea-financial-intelligence-unit-kofiu, kr.aml.financial-services-commission-fsc-oversees)
- Enforcement risk — if any ancillary service (e.g., in-app swap, fiat on-ramp integration, staking) is bundled with the wallet, the combined offering could be deemed a VASP service requiring registration (kr.licensing.vasp)
- Upcoming Digital Asset Basic Act (proposed 2026) may expand the regulatory perimeter to cover wallet software or impose new disclosure/consumer-protection requirements (kr.aml.upcoming-digital-asset-basic-act)
- Consumer protection expectations under VAUPA could create litigation risk if users suffer losses and allege the software publisher had a duty to warn or protect (kr.licensing.legislation-virtual-asset-user-protection-act-vaupa)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Act on Reporting and Using Specified Financial Transaction Information (amended) (2021) — VASP registration, AML/CFT
Virtual Asset User Protection Act (VAUPA) (2024) — Investor protection, unfair trading/insider trading prohibition, mandatory insurance/reserves, KRW 3B minimum equity capital for exchanges
VASP: VASP registration with KoFIU + ISMS certification mandatory. KRW 3B (~$2.2M USD) minimum equity capital for exchanges under VAUPA. Real-name verified bank account partnership required (critical bottleneck — only 5 exchanges achieved this: Upbit, Bithumb, Coinone, Korbit, Gopax).
CUSTODY: Included under VASP registration; 100% cold storage for reserves required. Compensation reserves mandatory under VAUPA.
EXCHANGE: VASP registration + real-name bank account partnership. Upbit dominates ~80% market share. ICOs effectively banned since 2017 (administrative guidance). Token listing requires exchange self-assessment.
Act on Reporting and Use of Specific Financial Transaction Information: Requires VASPs to register with KoFIU and comply with AML/CTF standards.
Act on the Protection of Virtual Asset Users (2024): Focuses on user protection, prohibits unfair practices like market manipulation, and enforces AML protocols.
Korea Financial Intelligence Unit (KoFIU): Handles VASP registration, AML reporting, and guidelines. (Official site: kofiu.go.kr)
Financial Services Commission (FSC): Oversees VASPs, enforces consumer protection, investigates unfair practices, and issues guidelines; gained expanded supervisory powers under recent acts.
Upcoming Digital Asset Basic Act: Proposed for early 2026 by National Assembly to consolidate regulations on exchanges, token issuance, custody, stablecoins, and ETFs.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a non-custodial wallet software publisher does not trigger VASP classification or AML obligations under current Korean law, provided it never holds, controls, or accesses user funds, but risk exists from potential regulatory expansion under the upcoming Digital Asset Basic Act and from bundling any ancillary services that could cross into VASP territory.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?