South Korea's Crypto Rules: FIU Registration and the Virtual Asset User Protection Act

The short version: Korea regulates crypto businesses in two layers. Since a March 2021 amendment to the Act on Reporting and Using Specified Financial Transaction Information, virtual asset service providers must report (register) with the FIU. The Virtual Asset User Protection Act, enacted on 18 Jul 2023, has applied since 19 Jul 2024 (FSC).

FIU Registration

To operate legally, a business needs, among other things, information security management (ISMS) certification and must report to the FIU; the same applies to an offshore business that serves Korean residents (FSC). 28 virtual asset service providers are on the FIU's list of reported businesses in South Korea (list). Reports expire unless renewed: 17 operators let theirs lapse.

Virtual Asset User Protection Act

According to the FSC, the Act requires service providers to keep customers' deposits at banks, keep users' virtual assets separate from their own, carry insurance or a reserve against hacking and outages, and run a surveillance system that reports suspicious trading to the Financial Supervisory Service. Unfair trading such as price manipulation can lead to criminal punishment or a penalty surcharge, and the FSS and FSC can inspect and sanction providers. The Act drew on 19 bills pending at the National Assembly (FSC, 17 Jul 2024).

Next Steps

The FSC said an amendment to the Specified Financial Information Act taking effect in August 2026 bars anyone who took part in unregistered business from becoming a major shareholder of a registered provider for a set period (FSC). We have not verified an official date for a second-phase crypto law, so none is shown.