South Korea: crypto & digital assets regulation

Regulated

South Korea VASP licensing under 2024 Protection Act; FSC/KoFIU oversight

Lead regulator:
Financial Services Commission (FSC)
Key law:
Act on the Protection of Virtual Asset Users (2024)
Last updated:
2026-07-12

South Korea has established a formal regulatory framework for virtual assets, primarily governed by the Act on the Protection of Virtual Asset Users which took effect in July 2024. The Financial Services Commission (FSC) serves as the primary regulator, overseeing licensing and market conduct, while the Korea Financial Intelligence Unit (KoFIU) handles financial crime reporting and supervision.

Licensed Virtual Asset Service Providers (VASPs) are mandated to segregate customer deposits in designated banks and store over 80% of user assets in cold wallets to enhance security. The regime also requires robust internal controls, detailed reporting of compliance systems, and the establishment of a Digital Asset Protection Foundation to safeguard user funds in the event of VASP insolvency.

Recent regulatory developments include a phased allowance for corporate virtual asset transactions, starting with liquidation purposes, and permissions for non-profit corporations and exchanges to sell virtual assets for operational funding. These measures aim to balance market innovation with strict user protection and financial stability.

Who regulates

  • Financial Services Commission (FSC)

    Primary regulator overseeing the Act on the Protection of Virtual Asset Users, licensing, and policy direction.

    [1][2][3][4][5]
  • Korea Financial Intelligence Unit (KoFIU)

    Handles financial crime reporting, AML/CFT supervision, and market surveys of registered VASPs.

    [6][7][8]

Core laws & rules

  • Act on the Protection of Virtual Asset Users (2024)

    Establishes the legal framework for VASP licensing, user protection, asset segregation, and market order. It mandates that customer deposits be safeguarded in banks and requires strict internal controls.

    [4][5]
  • Act on Reporting and Using Specified Financial Transaction Information (2024)

    Mandates VASPs to report detailed compliance systems, major shareholders, and other specified financial transaction information to KoFIU.

    [8]

Licensing & registration

  • Virtual Asset Service Provider (VASP) Registration

    Entities must register with KoFIU and comply with the Act on the Protection of Virtual Asset Users. Registered VASPs are subject to regular surveys and must maintain strict internal controls and asset segregation. Timeline: Registration and compliance requirements fully effective from July 19, 2024.

    [4]

Restrictions & warnings

  • VASPs must store over 80% of user assets in cold wallets and keep customer deposits in designated banks. Corporate transactions in virtual assets are generally restricted, with phased allowances for liquidation and specific operational needs.

    [5][2]
  • Non-profit corporations and exchanges are permitted to sell virtual assets only under strict internal controls and for specific purposes like asset disposal or operational funding, limited to eligible assets.

    [1]

Direction of travel

  • The regulatory environment is evolving towards greater institutional integration, with the phased allowance of corporate transactions and the establishment of a Digital Asset Protection Foundation to manage insolvency risks.

    [2][3]
  • KoFIU continues to monitor market growth and VASP compliance through regular surveys, indicating a focus on maintaining market integrity and user protection as the sector expands.

    [6][7]

Email alerts for South Korea updates

New circulars, rules and guidance — a digest in your inbox, same day.

This guide is compiled automatically from 8 primary-source documents published by South Korea's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-07-12). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.