Blockchain 2024

Last Updated June 13, 2024

South Korea

Law and Practice

Authors



Bae, Kim & Lee LLC was founded in 1980 and is a full-service law firm covering all major practice areas, including corporate law, M&A transactions, dispute resolution (arbitration and litigation), white-collar criminal defence, competition law, tax law, capital markets law, finance, IP, employment law, real estate, technology, TMT, maritime, and insurance matters. With more than 650 professionals located across its offices in Seoul, Beijing, Hong Kong, Shanghai, Hanoi, Ho Chi Minh City, Yangon and Dubai, Bae, Kim & Lee LLC offers its clients a wide range of expertise through a vast network of offices. The firm is composed of a diverse mix of Korean and foreign attorneys, tax advisers, industry analysts, former government officials, and other specialists. A number of its professionals are multilingual and have worked at well-known law firms in other countries, enabling them to assist international clients as well as South Korean clients abroad successfully with cross-border transactions.

Development of South Korean Blockchain Market During Past 12 Months

Following the Financial Services Commission (FSC)’s announcement in 2023 of a plan to incorporate security tokens into the regulatory framework, expectations for the legalisation of security tokens in South Korea have heightened. In the current situation, where legalisation has not yet occurred, the service providers have to operate their security token businesses under the regulatory sandbox programme. As of now, the FSC accepted applications from five companies for regulatory sandbox exemption and granted exemptions from regulations under the Financial Investment Services and Capital Markets Act (FISCMA) and Personal Information Protection Act (PIPA), mostly in connection with the issuing and trading of tokenised real estate trust beneficiary securities.

The Virtual Asset User Protection Act (VAUPA) was enacted on 18 July 2023 to promote protection of virtual asset users and prevent unfair trading practices, and it will come into effect on 19 July 2024. The VAUPA aims to regulate Virtual Asset Service Providers (VASPs) to segregate user deposits and VASPs’ proprietary assets in order to manage them separately. Also, the VAUPA imposes certain obligations on VASPs to subscribe to insurances (eg, fraternal insurances) or set up reserve funds in preparation for any detrimental incidents, such as hackings.

The VAUPA classifies the following acts as unfair trading practice and imposes criminal penalties, fines, and sanction for violations thereof:

  • the use of non-public material information;
  • market manipulation;
  • fraudulent and unfair trading practices; and
  • trading in self-issued coins.

Furthermore, VASPs that are involved in operating virtual asset markets are required to report any suspicious trading activities and take appropriate measures in response.

The Bank of Korea (BOK) and regulatory authorities have jointly announced that they have prepared detailed plans for the “Central Bank Digital Currency (CBDC) Usability Test”. According to these plans, the test will be divided into two main parts ‒ namely, “real transaction testing” and “technical experiments in a virtual environment”. Banks participating in the real transaction test will be allowed to issue deposit tokens through the financial regulatory sandbox. They will also be responsible for recruiting and managing participants (such as individuals and shops), developing user wallets, and facilitating payment of usage fees. The real transaction test is scheduled to be conducted in the second half of 2024.

Outlook for Next 12 Months

In July 2023, an amendment bill for the FISCMA and an amendment bill for the Act on Electronic Registration of Stocks and Bonds (AERSB) were introduced to permit security token issuance and distribution to a certain extent. The government intended to finalise the amendments to the relevant legislations during 2023 to allow a one-year preparation period before permitting security tokens by the end of 2024, but the amendment bills were not passed. As the newly elected 22nd National Assembly is scheduled to convene in June 2024 following the general election in April 2024, it is expected that the above-mentioned amended bills will be put on agenda in the National Assembly and their progress should be closely monitored.

After Bitcoin spot exchange-traded funds (ETFs) were approved in the USA, the FSC has taken the stance that it will neither allow South Korean asset management companies to set up Bitcoin spot ETFs nor permit South Koreans to invest in such ETFs listed in the USA. In response to the growing number of voices advocating for the approval of Bitcoin spot ETFs in South Korea, the opposition party recently announced plans to request that the FSC reconsider its statutory interpretation regarding Bitcoin spot ETFs. It remains to be seen whether the government’s stance on Bitcoin spot ETFs will change soon.

Until now, virtual asset exchanges have restricted or prohibited transactions for corporate clients ‒ particularly with regard to the trading of digital assets and fiat currency – without any specific legal or regulatory justification. These actions were taken in response to the stringent stance of regulatory authorities toward digital assets. There has been growing and persistent opposition to these measures, prompting the need to monitor whether regulatory authorities will reconsider their stance. The opposition party announced their commitment in the general election to permit corporates to open customer accounts with South Korean exchanges.

Under the amended Income Tax Act, which comes into effect from January 2025, income earned by individuals by transferring or lending digital assets will be subject to income tax. For further discussion, please see 6.1 Tax Regime.

As the financial regulatory authorities have taken a conservative stance on financial products involving virtual assets, the predominant actual use of digital assets in the financial sector is currently concentrated within virtual asset exchanges, which are regulated and permitted by the Act on Reporting and Using Specified Financial Transaction Information (the “AML Act”). Decentralised finance (“DeFi”) platforms that engage in activities such as staking, deposits, and loans are also operational. Regulatory discussions regarding these activities have not yet taken place.

In the market, there is a significant interest in the issuance and circulation of security tokens, which tokenise various forms of investment contract security and trust beneficiary certificates. However, the FSC currently takes a negative stance on tokenising other types of securities such as stocks or corporate bonds that already have existing trading markets. On the other hand, regulatory authorities have indeed relaxed some regulations for tokens issued with tangible assets such as real estate or gold as underlying assets through the financial regulatory sandbox programme. However, considering the low approval rate for exemptions granted through financial regulatory sandboxes and the stringent stance of regulatory authorities towards virtual assets, it is realistic to conclude that there are currently no proofs of concept that can be definitively said to be permitted.

The Game Rating and Administration Committee does not permit Play-to-Earn (P2E) games, owing to potential violations of prize-giving prohibition or restrictions on exchanges of prizes, etc, under the Game Industry Promotion Act. Therefore, for example, business models that allow in-game rewards such as game items to be exchanged for digital assets listed on virtual asset exchanges will generally be prohibited.

Blockchain technology is also being utilised in various other industries. By way of example, the government utilises blockchain technology in areas such as identification verification (eg, driver’s licences) and vaccination certification for COVID-19. Blockchain’s characteristic resistance to alteration can be leveraged to ensure security and authenticity in these applications.

There is no law or regulation in South Korea that provides for the effectiveness of the issuance of, registration of, transfer of, or creation of a pledge on digital assets including security tokens with an irrevocable effect (ie, finality) that are registered on a blockchain-based distributed ledger.

However, there is a legislative proposal containing relevant regulations on this issue ‒ although it has not yet been enacted into law. The proposed amendment to the AERSB includes recognising distributed ledger-registered securities as a type of electronically registered security. The proposed amendment does not distinguish the validity and effectiveness of registration on a distributed ledger from that of the existing conventional electronic registration framework. Therefore, if the proposed amendment passes, the provisions relating to the validity and effectiveness of the existing conventional electronic registration and effective transfer of electronically registered securities, etc, under the current AERSB will apply to distributed ledger-registered securities, as follows.

  • For the electronic securities held by an account management institution, the securities shall be registered in the “proprietary account book” of the account management institution managed by an electronic registry. For the electronic securities held by ordinary customers, the securities shall be registered in the “customer account” book managed by the account management institution (customer account book and proprietary account book, together the “electronic register”). Any person registered in the electronic register may rely on the presumption that such person has lawfully acquired the legal rights to the relevant electronically registered securities.
  • In the case of transferring electronic securities, the effectiveness of the transfer occurs at the time when the transferor’s account is debited and the transferee’s account is credited in the electronic register.
  • The creation of a pledge on electronic securities shall take effect after the registration in the electronic register of the fact that the electronic securities are subject to the pledge and the relevant pledgee’s details.
  • As regards securities that are electronically registered as a trust property, the relevant trustee may rely on the effectiveness of the registration to defend against any third-party claims towards the registered securities.

Currently, there is no law or regulation ‒ nor any official method ‒ in South Korea to legally categorise the types of digital assets. However, the existing relevant laws and regulations can be applied to certain digital assets depending on their legal nature. Thus, in practice, digital assets are classified based on the applicable laws.

The FISCMA applies to “financial investment instrument” products. Financial investment instrument essentially means a right acquired by an agreement to pay money or anything else with property value (hereinafter referred to as “money, etc”) at a specific point in the present or the future ‒ with the intent to earn a profit or avoid a loss ‒ where there is a risk that the total amount of such money, etc, paid (or payable) to acquire that right (excluding sums such as sales commissions) may exceed the total amount of money, etc, already recovered or recoverable from such right (including sums such as termination fees). Thus, digital assets that are subject to the FISCMA will be categorised as a “security token”.

Virtual asset exchanges in South Korea sometimes request that applicants for virtual asset listing submit a legal opinion stating that the subject digital asset does not fall within security.

Under the Electronic Financial Transactions Act (EFTA), electronic payment means refer to electronic funds transfers, electronic debit payment means, electronic prepayment means, electronic currency, credit cards, electronic bonds, or other means of payment by electronic means. Thus, digital assets that are subject to EFTA will be categorised as a “payment token” as at a practical level. It is often considered whether a digital asset qualifies as electronic prepayment means or electronic currency.

The term “electronic prepayment means” means any certificate (or information on such certificate) issued with transferable monetary values stored by electronic means that meets all of the following requirements (excluding any electronic currency). (Please note that the definition of electronic prepayment means has been amended and will take effect from 15 September 2024.)

  • It shall be used to purchase goods or services from a third person other than the issuer (including specially related persons prescribed by Presidential Decree) and pay the prices.
  • It shall be able to purchase goods or services in at least two business categories (referring to mid-size business categories in the Korean Standard Industrial Classification).

The term “electronic currency” means any certificate, or information on such certificate, issued with transferable monetary values stored by electronic means that meets all of the following requirements:

  • it shall be used in the areas and franchise stores that meet the standards prescribed by Presidential Decree;
  • it shall be used to purchase goods or services from a third person other than the issuer (including specially related persons prescribed by Presidential Decree) and pay the prices;
  • it shall be able to purchase goods or services in at least five business categories (referring to mid-size business categories in the Korean Standard Industrial Classification) and the number of such business categories shall be at least that prescribed by Presidential Decree;
  • it shall be issued in exchange for the same value of cash or deposits; and
  • it shall be exchangeable for cash or deposits under the guarantee of the issuer.

Under the AML Act, there is just a general definition of “virtual assets”. Virtual assets are defined as electronic representations (including all rights thereto) that have economic value and that can be traded or transferred electronically, except for the following:

  • electronic representation or information about such representation that cannot be exchanged for money, goods, or services, etc, and the purpose and use of which is restricted by the issuer;
  • tangible and intangible products obtained through the use of game products under Article 32 (1) 7 of the Game Industry Promotion Act;
  • electronic prepayment means under subparagraph 14 of Article 2 of the EFTA, as well as electronic currency under subparagraph 15 of the same Article;
  • electronically registered stocks under subparagraph 4 of Article 2 of the AERSB;
  • electronic bills under subparagraph 2 of Article 2 of the Issuance and Distribution of Electronic Bills Act; and
  • electronic bills of lading under Article 862 of the Commercial Act

The VAUPA has adopted the same definition of “virtual asset” as the foregoing. The draft enforcement decree of the VAUPA further excludes non-fungible tokens (NFTs) ‒ which are electronic tokens that exist uniquely and cannot be mutually replaced, primarily available for collection purposes or for confirming transactions between parties – from the scope of “virtual asset” unless notified otherwise by the FSC. Hence, digital assets falling under this category are generally to be considered “utility tokens”.

Please note that there are no laws or regulations applicable to digital assets categorised as stablecoins. However, based on the legal nature of the stablecoin, it may be subject to the FISCMA or the EFTA.

In South Korea, there are no specific laws that allow tokenised securities or that provide for traditional securities to be issued in the form of tokens. Thus, no traditional securities have been issued in the form of tokens.

However, under the Special Act on Support for Financial Innovation (SASFI), if tokenised securities meet several requirements, their issuance and trading are allowed under the regulatory sandbox programme.

The FSC accepted applications from five companies for the regulatory sandbox programme and granted exemptions from regulations under the FISCMA and the PIPA, specifically in connection with the issuing and trading of tokenised real estate trust beneficiary securities. These companies applied for an exemption from the FISCMA regulations that apply to investment brokerage for securities and the opening of securities exchanges in order to operate trading platform services for tokens issued based on real estate trust beneficiary securities. The FSC approved the applications and it can be inferred from these cases that for Security Token Offerings (STOs) – such as tokens issued for real estate trust beneficiary securities – restrictions under the FISCMA apply, unless otherwise approved for a regulatory sandbox by the authorities.

Around April 2022, the FSC issued a guideline on fragmented property investment (a new form of investment where two or more people invest in or trade fragmented interests in real property or any rights with the value of assets), clarifying that the FISCMA may apply to fragmented property investment. Therefore, if securities tokens fall under the category of fragmented investment products, the tokens should be issued and distributed in compliance with all regulations under the FISCMA, such as the submission of a securities registration statement, etc, as required in the ordinary issuance of the securities. However, if the tokens are recognised as innovative, they could be exempted from the obligation by applying for the financial regulation sandbox programme.

In February 2023, the FSC announced its plan to revise the regulatory framework on the securities-type token issuance and distribution (the “STO Guideline”) and that it is intending to amend the FISCMA to permit STOs in compliance with laws and regulations. In July 2023, amendment bill for the FISCMA and amendment bill for the AERSB were introduced to permit STO issuance and distribution to a certain extent. According to the amendment bills prepared by the FSC, tokenised securities means securities that are electronically registered in an account book that is in a distributed ledger form. A distributed ledger is defined as a ledger and its management system in which information about securities is jointly recorded in chronological order by multiple participants and is protected from unauthorised deletion and subsequent alteration through joint management and technical measures.

The government intended to finalise the amendments to the relevant legislations during 2023 to allow a one-year preparation period before permitting STOs by the end of 2024, but the amendment bills were not passed. For further details, please see1.1 Evolution of the Blockchain Market.

There are no specific rules or restrictions that regulate stablecoins. As stated in 2.2 Categorisation, depending on their structure and nature, stablecoins may constitute securities under the FISCMA and businesses involving stablecoins may constitute electronic prepayment means or electronic currency business, subject to the registration requirements provided under the EFTA.

The Korean Prosecutors’ Office brought criminal lawsuits against several key people involved in Terra Project based on the grounds that Luna may be considered securities under the FISCMA. Terra is a stablecoin that was issued and maintains its price at around USD1 under a protocol and Luna is another coin that can be exchanged for Terra. Luna was created to maintain the price of Terra.

However, the FSC has publicly stated that it views stablecoins as different from other digital assets in terms of their potential effect on financial stability due to the possibility of their rapid proliferation and ability to combine with various financial services. As such, the FSC believes it is necessary to establish international regulations and supervisory measures. Likewise, the Bank of Korea has opined that it views stablecoins as having the potential to provide stable value and benefits, such as cost reduction and financial inclusion compared to other existing digital assets; however,, because the existing regulatory and supervisory system is only effective to a limited extent in appropriately dealing with the potential risks, there is a great need to implement appropriate regulations such as greater transparency of stablecoin issuers and the sufficient provision of information for any risk assessment.

Currently, the South Korean regulatory authorities are known to have had initial discussions regarding the regulatory framework and methods for stablecoins. Therefore, it is necessary to closely monitor the direction and progress of these discussions.

The FSC has been consistently stating from the past that NFTs are not considered typical virtual assets, but if used as means of payment or investment, etc, they may be considered a type of virtual asset.

In the recent draft enforcement decree of the VAUPA, the definition of virtual asset excludes electronic tokens that exist uniquely and cannot be mutually replaced, primarily for collection purposes or for confirming transactions between parties (unless notified otherwise by the FSC). However, the FSC further added through media press releases that characterisation as an NFT is based on the substance rather than the use of the term NFT. Thus, even if labelled as an NFT, if it is issued in large quantities and can be mutually interchangeable with other tokens or if it can be used as a means of payment for specific goods or services, it is included within the scope of virtual assets.

It is the authors’ understanding that the financial authorities are currently preparing for a detailed guideline regarding NFTs to be publicly disclosed.

There are no regulations prohibiting the use of digital assets as electronic payment means under the EFTA. However, it is known that the FSC internally reviewed and concluded that “virtual assets cannot be considered electronic prepayment means due to their constantly fluctuating value”. Therefore, it seems challenging for typical digital assets to qualify as electronic payment means in the context of the EFTA.

Separately from the EFTA, there had been cases where digital assets were used as payment instruments. A private payment gateway service provider had rendered a payment service through which customers can purchase goods and services using a certain cryptocurrency issued by its affiliate and secured millions of users for a couple of years. However, it ceased to offer the payment service in 2023.

The structure of the payment gateway service provider involved purchasing tokens that were used as payment means and selling them to other merchants to settle payments. The issue was whether the token-to-Korean won trading was perceived as a virtual asset service that was subject to reporting requirements under the AML Act. The FSC claimed that the service was subject to such reporting requirements and, therefore, the payment gateway service provider sought to open verified real-name bank accounts. However, banks refused to open a verified real-name bank account. It should be noted that there are practical challenges in obtaining a verified real-name bank account, which is mandatory for token-to-Korean won trading.

However, it is the authors’ understanding that what the financial authorities were really concerned about was that the entity who issued the digital asset, which will be used as a payment means, and the entity who conducts payment settlements through the digital asset should not be affiliates of the same entity.

Furthermore, under the Special Act on Regulation-Free Zones and Regional Specialised Development Zones, the Busan Blockchain Regulation-Free Zone is designated as a regulation-free zone, and payment and settlement using stablecoins (digital vouchers) is recognised as an exception.

Discussion regarding this matter seems to be undeveloped and it is not widely known whether digital assets are accepted as collateral.

Regarding Wemix tokens, one of the reasons for their delisting from local virtual asset exchanges was the failure to disclose the amount of Wemix tokens provided as collateral for borrowing from DeFi platforms and not including such collateral amount in the total circulating supply. In the preliminary injunction case related to this matter, the court ruled that providing Wemix as collateral for borrowing constituted supply circulation and therefore the delisting decision was deemed lawful.

South Korean law does not clearly define smart contracts; however, they can qualify as regular contracts under the Civil Act if they meet the standard contractual elements of offer, acceptance, and mutual consensus. Under the Civil Code, a contract becomes legally binding when an offer is made and accepted; smart contracts could be treated similarly and are enforceable if concluded validly. But it is debatable what constitutes offer and acceptance in smart contracts. The Framework Act on Electronic Documents and Transactions defines an “electronic transaction” as a transaction conducted fully or partially by electronic documents when buying and selling goods or services. Given this, smart contracts ‒ which process transactions electronically ‒ are likely included under this definition. However, an electronic transaction itself as defined above cannot be regarded as legally enforceable.

At present, there is no legal framework or legislation in place that governs using blockchain technology or digital assets in general.

In financial respects, the AML laws of Korea obligate VASPs such as crypto-exchanges and custodians to report suspicious transactions, provide information on the sender and recipient to the recipient’s VASP under the Travel Rule, and ‒ most importantly – file a report to the Korea Financial Intelligence Unit (FIU) before commencing any virtual asset services. The FIU may accept a VASP’s report only when the VASP meets all requirements stipulated under the law. By way of example, according to the AML laws, VASPs must obtain Information Security Management System (ISMS) certification and – to engage in any digital asset business where digital assets may be exchanged for fiat currencies – a VASP must operate only through a verified real-name bank account (ie, an account that allows banking transactions only between the VASP and customer accounts opened with the same bank). If any of the above-mentioned requirements are not met, the FIU may refuse to accept a VASP’s reporting, without which a VASP cannot conduct any digital asset business. As of 14 May 2024, only five crypto-exchanges were issued verified real-name bank accounts, and the FIU has accepted the reports of 37 VASPs that have completed filing.

Also, the VAUPA – enacted on 18 July 2023 to promote protection of virtual asset users and prevent unfair trading practices – will come into effect on 19 July 2024. For further details of the VAUPA, please see 1.1 Evolution of the Blockchain Market.

Other than the above-mentioned legislations, there are no legal framework or legislation in place that govern using blockchain technology or digital assets. However, the regulators have the discretion to “retrofit” ‒ ie, apply the existing legal framework to digital assets. This includes, but is not limited to, the Criminal Act, the Foreign Exchange Transaction Act (FETA), the FISCMA, the EFTA and various taxation laws. By way of example, digital assets may be considered as objects of a property crime under the Criminal Act. Under the FETA, transactions involving digital assets may require the filing of foreign exchange reports to the Bank of Korea or a foreign exchange bank, depending on whether the digital assets constitute a means of payment or a security as defined under the FETA. For the FISCMA and the EFTA, please see 2.2 Categorisation and 2.3 Tokenised Securities.

Regarding the taxation laws, previously, income generated by domestic corporations through disposing of digital assets was subject to corporate tax while income earned by individuals was not. However, the Income Tax Act has been amended such that – from 2025 – income earned by an individual from trading digital assets will be taxed, and the Corporate Tax Act has been amended such that income earned by foreign corporations is now categorised as a domestic source of income.

It should be noted that the FSC announced in March 2023 that they will allow securities tokens as one form of securities under the FISCMA and the AERSB through amendments thereof. However, the amendments to the FISCMA and the AERSB have not yet passed, with the National Assembly scheduled to convene in June 2024. It will be some time before the amendments to the FISCMA and the AERSB will be passed by Parliament.

As of now, the only reporting requirements related to virtual assets are those under the AML Act. The AML Act defines VASPs as anyone who engages in any of the following activities as a business:

  • trading virtual assets;
  • exchanging virtual assets for other virtual assets;
  • storing and/or managing virtual assets;
  • at the request of customers, transferring virtual assets for the trading, exchange, storage or management thereof; and
  • brokering, intermediating or acting as an agent with regard to the trading of virtual assets and the exchange of virtual assets for other virtual assets.

VASPs are obligated, inter alia, to report to the FIU. Such reporting primarily entails two prongs of requirements, as follows.

  • ISMS certification – a VASP must obtain the ISMS certification under the IT Network Act, which is awarded to entities that have established and are operating a “comprehensive management system” that includes administrative, technical and physical protective measures to ensure the safety and reliability of their network system. This process, which takes at least six to eight months to complete, involves extensive evaluation of the applicant’s network system.
  • Opening and use of a verified real-name account (“real-name account”) – a VASP must conduct financial transactions only through a real-name account (ie, an account that only allows financial transactions between the VASP and customer accounts opened with the same financial institution). One important exception to this requirement is that VASPs that do not exchange virtual assets with fiat are not required to open a real-name account. In order to create a real-name account, a VASP must meet specific criteria prescribed by the AML Act, such as:
    1. managing customer deposits separately from the VASP’s own assets;
    2. obtaining the ISMS certification;
    3. managing the transaction details separately for each customer; and
    4. successfully completing a due diligence process conducted by the financial institution (bank).

There is no legislation or guidelines on DeFi or decentralised autonomous organisations (DAOs) and thus no licence requirements applicable to DeFi or DAOs.

According to the VAUPA, in relation to the trading and other related transactions of virtual assets, one must not:

  • use false statements or representations regarding material facts;
  • omit necessary disclosures of material facts to avoid causing misunderstanding; or
  • act to obtain monetary or other economic benefit through certain statements or representations.

Additionally, other marketing restrictions under the existing laws also apply to digital assets as below.

If digital assets are sold via a “multi-level marketing business” without first registering with the Korea Fair Trade Commission (KFTC), that sale may be in violation of the Act on Door-to-Door Sales (the “Visit Sales Act”). A person in violation of this requirement may be subject either to imprisonment for not more than seven years or to a fine not exceeding KRW200 million or an amount equal to three times the total transaction amount.

The term “multi-level marketing” refers to the sale of goods or services through a sales organisation that has a recruitment scheme under which salespersons solicit other persons to join as subordinate salespersons by three or more levels and pay a bonus to salespersons in connection with the:

  • transaction performance of selling goods or services by the salesperson’s subordinate salespersons; or
  • outcomes of organisational management, education and training of the salesperson’s subordinate salespersons.

If anyone makes any indication or advertisement on his or her business for unspecified multiple persons to carry out any digital asset-related “fundraising business without permission” as defined under the Fundraising Act, they may be subject to imprisonment of not more than two years or a fine not exceeding KRW20 million.

The Financial Consumers Protection Act (FCPA) stipulates a number of regulations when advertising for the sale of financial products. However, the FCPA currently does not explicitly include digital assets as a financial product. Therefore, at present, the advertising regulations under the FCPA are not applicable in relation to investment in digital assets. However, specifically in the case of tokens that assume the characteristics of securities, the FISCMA regulations on securities may apply and hence the securities may be considered a financial product under the FCPA – in which case, the relevant advertising regulations apply.

In response to the Financial Action Task Force 2019 Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers, the AML Act was amended by the National Assembly on 25 March 2020, with an effective date of 25 March 2021. The key amendments are:

  • the classification of virtual asset services into the trading of virtual assets, exchange between virtual assets, transfer of virtual assets, storage and management of virtual assets, and the intermediation and brokerage of trading or exchanges; and
  • that all virtual asset companies must file a report with the FIU before starting operations.

Customer due diligence obligations, enhanced due diligence obligations and suspicious transaction reporting obligations, etc, as stipulated under the AML Act, apply only to digital asset business entities that constitute VASPs under the AML Act engaging in any digital asset business (eg, trading, exchanging, transferring, storing and managing, mediating and brokering).

To file a report with the FIU, a VASP must open a verified real-name bank account and obtain ISMS certification from the Korea Internet and Security Agency (KISA). However, VASPs that do not conduct fiat transactions are exempted from the requirement to open a verified real-name bank account.

The following is a summary of the major AML obligations of VASPs based on the “Major Cases of Illegal Acts Related to Anti-Money Laundering by VASPs” announced by the FSC on 29 September 2022:

  • to check a customer’s identification details including name, address, and contact information and to check customers who are highly likely to engage in money laundering – in particular, additional information including the purpose of the transaction and the source of the funds;
  • to verify the actual owner of a corporate customer and to check the name, date of birth, and nationality of the actual owner (eg, the owner with a stake of 25% or more – the largest shareholder);
  • to report without delay to the FIU suspicious acts of acquiring illegal assets (if supported by reasonable grounds for suspicion);
  • to report to the FIU if the other party to a financial transaction that has been reported as suspicious is still suspected to engage in suspicious activity – specifically, the VASP is to collect and verify the source of funds and the purpose of the transaction of a suspicious customer by collecting additional evidentiary documents from such customers; 
  • to prepare and operate a procedure for assessing the risks (including money-laundering, etc) before providing new virtual assets ‒ VASPs are required to prepare and keep in writing the evidentiary documents about the conduct of money-laundering risk assessment and, if they fail to present evidentiary documents in investigation, they may be sanctioned; and
  • to prepare and implement the criteria to restrict an act of brokering, arranging or representing the sale and exchange of virtual assets issued by a specially related person as defined by the Commercial Act – specifically, VASPs are required to check whether the foundation issuing virtual assets (of which trading is supported by the VASPs) and key officers and employees of the foundation are in a special relationship with the VASPs.

Further, from from 25 March 2022 ‒ due to the introduction of the Travel Rule in the AML laws – domestic VASPs are additionally obligated to observe the following rules.

  • If a VASP transfers virtual assets worth KRW1 million or more (approximately USD700 or more) to another VASP at the request of a customer, it is mandatory that the former VASP provide information related to the transmission and receipt of virtual assets (ie, name of the transmitter and recipient and the address of virtual assets) along with their transfer.
  • VASPs are required to retain the relevant information for five years after the end of a transaction.
  • In order to fulfil the above obligations, a technical solution for the Travel Rule should be prepared first. In the case of overseas VASPs who did not build such a solution, the transfer of virtual assets is permitted only if the transmitter and the recipient are confirmed to be the same person or entity and the foreign VASP is assessed to have a low money laundering risk.

Digital asset firms are not subject to the general legal restrictions regarding change in control. The only licensing obligations for digital assets are pursuant to the AML Act, which does not specify any change in control restrictions.

Nevertheless, the regulatory practice deviates from the regulatory outset. Under the AML Act, a VASP must report the status of its CEO and registered executives. Also, in cases of any change to reported matter, an amendment report must be submitted to the FIU. Generally, if there is a change in control, there will be changes to the executives and this would in turn require an amendment report to the FIU in practice. Moreover, regulatory authorities may indirectly regulate or influence the change in control by delaying the processing of the amendment report for the new directors without imposing explicit legal restrictions.

There is no specific law or regulation applicable. Digital asset firms are subject to the general insolvency laws and regime.

Currently, regulatory sandboxes related to blockchain primarily exempt the requirements associated with the FISCMA. There has not been a case where requirements under the AML Act or other requirements discussed in 4.1.2 Licensing, 4.1.3 Marketing, 4.1.4 Anti-money Laundering and Counter-Terrorism Financing (AML/CTF) Requirements and 4.1.5 Change in Control have been exempted.

Apart from the legal requirements, the following practices having similar regulatory effects should be considered. By way of example, in order to create a real-name account, a VASP must meet specific criteria prescribed by the AML Act, such as:

  • managing customer deposits separately from the VASP’s own assets;
  • obtaining the ISMS certification;
  • managing the transaction details separately for each customer; and
  • successfully completing a due diligence process conducted by the financial institution (bank).

The due diligence process by commercial banks typically tends to be very extensive and often exercises extreme caution due to their concerns about scrutiny by regulators.

So, even if a VASP meets all legal requirements, there is no guarantee that the VASP will be able to open a real-name account. There are only five South Korean exchanges that successfully opened a real-name account with commercial banks. No South Korean bank has yet opened a real-name account for a foreign VASP. Even if successful in opening the real-name account, the due diligence process is likely to take several months.

Moreover, South Korean crypto-exchanges do not permit transactions for corporate customers.

Currently, the FSC does not accept applications for collective investment schemes (ie, funds) investing into virtual assets under the FISCMA. Additionally, the foreign exchange reports submitted for investments in overseas investment funds involving virtual assets ‒ as required under the foreign exchange regulations ‒ are not accepted by the relevant bodies. Thus, regulated firms and funds with exposure to digital assets are not generally permitted.

Additionally, the FSC has taken the stance that it will not allow investments in Bitcoin spot ETFs in South Korea. It also does not permit South Koreans to invest in such ETFs listed in the USA.

According to the SASFI, when a service is designated as an innovative financial service, businesses are exempted from certain regulations related to licensing, registration, reporting, corporate governance, business scope, soundness, business conduct, and supervision and inspection of the business or business operator in the applicable financial-related laws as specified by SASFI. An innovative financial service refers to any financial service recognised as being distinct from existing financial services in terms of details, methods, forms of service delivery, or services provided in the course of conducting business related to such financial services. This regulatory scheme is commonly referred to as the financial regulatory sandbox programme.

Currently, there are a few businesses that have been designated as innovative financial services in relation to the FISCMA under the financial regulatory sandbox programme. These services include real estate beneficiary securities token issuance by trust companies and trading platform, as well as a financial bonds trust beneficiary securities (with real estate as collateral) trading platform.

Additionally, under the Special Act on Regulation-Free Zones and Regional Specialised Development Zones, certain regulation-free zones are designated (ie, areas where regulatory exemptions or special regulations are applied to foster innovative businesses or strategic industries). The Busan Blockchain Regulation-Free Zone (the BBRFZ) is designated as a regulation-free zone to benefit from various regulatory exemptions including the following. A real estate fund beneficiary securities token issuance and trading platform was designated as a regulatory sandbox in the BBRFZ.

Regulatory exemptions allowed for the above-mentioned sandboxes are as follows:

  • destroying personal information only off-chain is allowed exceptionally under the PIPA; and
  • exemption from licence for securities exchange and securities brokerage required under the FISCMA.

In response to the Financial Action Task Force 2019 Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers, the AML Act was amended by the National Assembly on 25 March 2020, with an effective date of 25 March 2021. Please see 4.1.4 Anti-money Laundering and Counter-Terrorism Financing (AML/CTF) Requirements for details.

As regards CBDC, the Bank of Korea issued a trial CBDC and is studying the technical possibility of operating a CBDC. So far, the Bank of Korea has confirmed normal operation of the basic functions of CBDC (minting, issuance and distribution) and, based on this, the Bank of Korea will assess the applicability of various additional functions (offline payments, etc). However, it is still unclear whether the Bank of Korea will issue CBDC in the future. For the actual issuance of CBDC, the Bank of Korea Act may have to be amended to allow a digital form of fiat currency instead of physical form notes.

Regulations regarding digital assets fall under the purview of various financial regulatory authorities such as the FSC and the FIU. Notably, the FIU serves as the primary regulatory body with regard to the AML Act, operating under the supervision of the FSC. Regulations pertaining to foreign exchange transactions are overseen by the Ministry of Economy and Finance (MOEF) and the Bank of Korea. Certain cross-border transactions involving digital assets, categorised as securities or payment means, may require reporting to the Bank of Korea or authorised foreign exchange banks. It is generally understood that these regulatory authorities adopt strict and conservative stances towards digital assets not to accept such reporting.

The Ministry of Science and ICT is responsible for general regulation and promotion of blockchain technology. Until recently, the industry promotion and policy-making tasks were managed by the National IT Industry Promotion Agency (NIPA), a subsidiary organisation of the Ministry of Science and ICT, but this has been transferred to KISA. Given that the Ministry of Science and ICT undertakes the role of promoting blockchain industry and technology, the Ministry tries to adopt an encouraging stance towards blockchain technology and industry by nature. The policy direction and stances of KISA should be observed going forwards.

Self-regulatory activities are voluntarily conducted by industry participants through Digital Asset Exchange Alliance (DAXA), the Korea Blockchain Industry Promotion Association, the Virtual Asset Finance Association, the Open Blockchain Industry Association, the Open Blockchain and Decentralised Identifier Association, the Korea NFT Contents Association, and the Korea NFT Association ‒ none of which have any legal basis for establishment. Thus, the self-regulations purported by these organisations have no legal enforceability or binding effect.

DAXA is formed by the five major South Korean virtual asset exchanges (GOPAX, BITHUMB, UPBIT, COBIT, KORBIT, and COINONE) that have opened up real-name Korean won-denominated bank accounts with Korean banks. DAXA is the most engaged and active in showing self-regulatory efforts.

The FSC formed the “Private Sector and Government Joint Task Force on Digital Assets” in August 2022 to discuss various issues relating to digital assets. According to press releases, the task force plans to discuss issues such as:

  • the legal nature and rights relationship of digital assets and measures to respond to digital asset-related crimes;
  • financial stability, CBDC and taxation issues related to digital assets;
  • regulatory framework for the issuance and distribution market for digital assets; and
  • comprehensive review of blockchain industry promotion.

The authors’ understanding is that the task force is engaged in various discussions on the regulation of NFTs and stablecoins, with specific details yet to be announced, and thus requires close monitoring going forwards.

In terms of the National Assembly, both the ruling party and the main opposition party have established special committees dedicated to digital assets under their respective umbrellas in order to carry out promised pledges. However, since the general election in April 2024, there have not been any meaningful activities.

Under the VAUPA (scheduled to be enforced on 19 July 2024), the FSC is permitted to establish a Virtual Asset Committee. Under the draft enforcement decree of the VAUPA, the Virtual Asset Committee’s role is to advise the FSC on policies and regulations relating to the virtual asset market and VASPs, and the committee will be composed of officials from the FSC, related administrative government agencies, legal professionals, professors, industry representatives and consumer representatives.

Please note that South Korea is not a common-law jurisdiction. The following court cases are provided to illustrate some meaningful insights in how virtual asset-related regulations are interpreted.

Cases Where Issuing Virtual Assets Can Constitute Fraud Under Criminal Law (Seoul Central District Court 2021GoHap925, 27 September 2022)

The lower court case ruling established the criteria for determining when issuance of virtual assets can be recognised as fraud under criminal law, as follows.

  • Issuer and White Paper misrepresentation ‒ when the issuer falsely represents or omits important information in documents that are essential for initial investment decision-making, such as the White Papers, so as to pretend that it has the requisite technical or business capabilities.
  • False disclosure – when exaggerated or false disclosures about the market conditions or the viability of the business is made, despite such disclosures being factually incorrect or having low chance of probability.
  • Inducement of unfair trading – when investment is induced by suggesting that high return can be achieved through abnormal price manipulations artificially inflating the price.

Thus, it is prudent to be cautious and avoid the above-mentioned scenarios when issuing virtual assets.

Cases Where Virtual Assets Can Be Recognised as Investment Contract Securities (Seoul Southern District Court 2019Gadan225099, 25 March 2020)

The lower court case ruling established the criteria for determining when a virtual asset can be recognised as investment contract security under the FISCMA. An investment contract security refers to instruments bearing the indication of a contractual right under which a specific investor is entitled to the profits earned or liable for losses sustained, depending on the results of a joint venture with a third person, which is mainly operated by a third person and in which the specific investor invests money, etc (Article 4, paragraph 6 of the FISCMA). As issuing investment contract securities requires compliance with the procedures stipulated by the FISCMA, if a virtual asset is recognised as an investment contract security, non-compliance of the issuance procedure would be violating the FISCMA. In this case, the court ruled that ‒ although the token holders received a share of the issuer’s profit – such profit distribution was incidental to the activity of the issuer promoting the use of the tokens in transactions and is not considered an inherent contractual right embodied in the token nor an essential function of the token. Therefore, the token in question was not recognised as an investment contract security under the FISCMA.

This ruling establishes that the key criterion for determining whether a virtual asset is subject to the security regulations under the FISCMA is whether an investor’s holding token results in the sharing of profits and losses arising from the issuer’s activity for the joint venture.

Whether NFTs Constitute Prizes in Gambling Games Under the Game Industry Act (Seoul Administrative Court 2021GuHap65484, 13 January 2023)

Under the Game Industry Promotion Act in South Korea, games that provide prizes convertible to monetary value are prohibited (ie, gambling games). In a case where a game company attempted to convert in-game items into NFTs, the court examined whether the NFTs are prohibited prizes under the Game Industry Promotion Act. The court held that when a large number of NFTs are created – as per other general tokens – the NFTs are considered to be fungible and convertible and, in fact, the NFTs can be easily traded or circulated via exchanges. Hence the NFTs can be prizes prohibited under the Game Industry Promotion Act. It is advisable to take caution of this ruling when NFTs are utilised in games so that it is not deemed convertible.

In 2017, the related ministries and governmental agencies (including the FSC) announced the “Emergency Measures Related to Virtual Currencies”, which set out certain regulations in connection with virtual assets. The content of this announcement has since become the foundational standard for the development of virtual asset regulations.

The regulations announced at the time included:

  • banks must confirm users’ identities and only allow deposits and withdrawals from the users’ own accounts (this later led to the real-name verification account regulation);
  • exchanges must prohibit account opening and trading for minors under the age of 18 and non-residents (foreigners); and
  • regulated financial companies must not hold, purchase, acquire as collateral, or invest in virtual currencies.

These restrictive regulations were introduced to prevent unprofessional retail individuals from being exposed to price-volatile digital asset investments and to prevent the virtual asset exchanges from deteriorating into speculative markets.

Since the announcement, the FSC has taken a strict and conservative approach towards financial products with virtual assets as the underlying asset. By way of example, the FSC stated that Bitcoin spot ETFs would potentially violate the regulations under the FISCMA and are contrary to the government’s stance because it means that financial companies would own virtual assets. This position has been reiterated even after Bitcoin spot ETFs were approved in the USA and thereby shows the FSC’s unrelenting position despite the regulatory shifts in several countries, including the USA.

However, as mentioned in 1.1 Evolution of the Blockchain Market, the opposition party recently announced plans to ask the FSC to reconsider its statutory interpretation regarding Bitcoin spot ETFs in response to the growing number of voices advocating for the approval of Bitcoin spot ETFs in South Korea.

Tax authorities have actively and widely interpreted the existing tax laws to impose taxes on digital assets. Consequently, numerous disputes have arisen regarding the legality of taxation under current laws such as the Inheritance and Gift Tax Act and the Value Added Tax Act, with many of the disputes still ongoing. Recently, the tax authorities have stated that transactions in which digital asset-issuing entities who provide digital assets for free to users who use specific services or meet certain conditions (such as “staking”, “hard forks” and “airdrops”) are generally subject to gift tax. As regards VAT, it was interpreted that the supply of digital assets that are mined by a business and sold on exchanges are not subject to VAT.

Meanwhile, the Income Tax Act and the Corporate Tax Act have been recently amended to include explicit provisions regarding digital assets. Under the amended Income Tax Act, which comes in to effect from January 2025, income earned by individuals by transferring or lending digital assets will be captured as “other income” under the law and thus will be subject to income tax. The amended Corporate Tax Act now clearly stipulates that income from digital assets is taxable for domestic corporations and it is clear that digital assets are included in domestic source income for foreign corporations with domestic business establishments. The criteria for determining whether income from digital assets constitutes “domestic source income” under the Income Tax Act and the Corporate Tax Act have not yet been clearly established.

However, the discussion on postponing the imposition of income tax for profits earned from transfer of digital assets is still ongoing. Therefore, it is necessary to closely monitor whether discussions to delay timing of taxation commencement will take place during the 22nd National Assembly, which is scheduled to start in June 2024.

In South Korea, regulations related to ESG and sustainability requirements regarding virtual asset activities (such as mining) have not been introduced. Although there have been reports in the news about the negative environmental impact of Bitcoin mining due to its significant energy consumption and greenhouse gas emission, there has not been sufficient drive for any legislative or policy discussions about it.

Personal information refers to information about a living individual that can identify the individual by itself or can easily be combined with other information to identify a specific individual (Article 2 of the PIPA). If information that meets these criteria is stored and processed on a blockchain, the storage and processing may be subject to regulation under the PIPA, even when such information is processed in an encrypted manner.

By way of example, to protect the right to be forgotten of data subjects (eg, individuals), the PIPA stipulates that personal information must be promptly destroyed when it is no longer necessary for the purpose of processing or when there is a deletion request from the data subject. For this purpose, “destroyed” refers to a method of permanently deleting the relevant personal information so that it cannot be restored or regenerated.

However, owing to the nature of the technology, the information stored in a blockchain is permanent and thus raises concerns about whether the services using blockchain technologies are in violation of the aforementioned regulations under the PIPA. Therefore, to address this concern, the government has revised the enforcement decree of the PIPA to permit anonymisation of personal information as a method of “destroying”, in addition permanent deletion. By anonymisation, the data subject should not be able to be easily identified when combined with other information. How easily a data subject can be identified will be determined by reasonably considering the time, cost and technology required.

Bae, Kim & Lee LLC

Centropolis B
26 Ujeongguk-ro
Jongno-gu
Seoul 03161
South Korea

+82 2 3404 0000

+82 2 3404 0001

bkl@bkl.co.kr www.bkl.co.kr/law?lang=en
Author Business Card

Trends and Developments


Authors



Lee & Ko has more than 50 experienced attorneys and industry specialists who have accumulated leading know-how and expertise on the full range of regulatory issues arising in the fintech space. Lee & Ko’s digital finance team provides well-balanced, insightful and useful guidance to clients across all legal, policy-making and business aspects of the fintech industry. Such expertise and know-how are supplemented by the team’s advanced understanding of the various technologies that underpin this sector, which enables the firm to focus on the issues that matter most to our clients. Lee & Ko’s ability to provide one-stop legal services spanning the full spectrum of legal issues affecting the fintech sector stands out as the firm’s greatest strength.

Overall Legislative and Regulatory Landscape for Blockchain in 2023

Previously, the only regulation applicable to digital assets in South Korea was the Act on Reporting and Using Specified Financial Transaction Information (the “AML Act”). The AML Act broadly defines virtual assets as “electronic certificates that have economic value and that can be traded or transferred electronically” and defines a Virtual Asset Service Provider (VASP) as an entity that engages in certain activities related to virtual assets, and VASPs are required to report to the financial authorities and comply with AML regulations. However, although it was commonly believed that digital assets would be subject to the same regulations as securities under the Financial Investment Services and Capital Markets Act (FISCMA) if such digital assets could be classified as securities, uncertainties persisted owing to the lack of clear guidance or interpretation by financial authorities on this issue.

Against such a backdrop, in February 2023, the financial authorities clarified that “security tokens” ‒ ie, digital assets that can be classified as securities ‒ are distinct from virtual assets under the AML Act and are subject to the same regulations as securities under the FISCMA, according to the “Measures to Overhaul Regulations to Permit Issuance and Circulation of Security Tokens” (the “ST Guidelines”). This ST Guidelines define “security tokens” as digitalised securities (referring to securities under the FISCMA) utilising distributed ledger technology and proposes the following:

  • principles for determining whether digital assets can be classified as security tokens; and
  • a plan to set up the regulatory framework for the issuance and distribution of security tokens.

Regarding virtual assets, which are digital assets that do not have the characteristics of securities, the Act on Protection of Virtual Asset Users (the “Virtual Asset User Protection Act”) ‒ designed to regulate the virtual asset industry ‒ was enacted on 18 July 2023 and is scheduled to take effect on 19 July 2024.

As discussed earlier, 2023 can be considered as the year that established the regulatory framework for the regulation of digital assets by:

  • dividing the blockchain-based digital assets into two broad categories (general virtual assets and security tokens); and
  • clarifying that general virtual assets are subject to the AML Act and the Virtual Asset User Protection Act, whereas security tokens are subject to the FISCMA.

Enactment of the Virtual Asset User Protection Act

As previously mentioned, the Virtual Asset User Protection Act, which is the first South Korean regulation on virtual asset services designed for the protection of users in the virtual asset market and the regulation of unfair trade practices, was enacted on 18 July 2023 and is scheduled to take effect on 19 July 2024.

Matters concerning the protection of virtual asset users

According to the Virtual Asset User Protection Act, VASPs are required to deposit or entrust users’ deposits with a financial institution (bank) separate from their own assets. Except in certain cases, these deposited or entrusted funds cannot be subject to set-off, seizure or provisional seizure, nor can they be transferred, assigned or provided as security. In the event of bankruptcy of a VASP, these deposited funds must be prioritised to be paid to the user.

In addition, VASPs must segregate their own virtual assets from users’ virtual assets and are obligated to ensure that they in effect hold the same types and quantities of virtual assets entrusted by users. Furthermore, at least 80% of the economic value (based on the average of the immediately preceding year) of the users’ virtual assets must be stored in cold wallets. Moreover, VASPs are required either to subscribe to insurance policies or mutual aid programmes or to establish reserves in anticipation of incidents such as hacking and computer failures.

Regulation of unfair trade practices

Similar to the FISCMA, the Virtual Asset User Protection Act stipulates that unfair acts in the virtual asset market are prohibited. Specifically, it prohibits:

  • the use of material non-public information;
  • market manipulation through matched orders, wash trading, etc;
  • trading virtual assets issued by the VASPs themselves or their related parties; and
  • fraudulent trade practices such as:
    1. employing improper means, schemes or tricks;
    2. making false statements of material facts; and
    3. using false market prices.

It is important to note that severe criminal penalties and financial penalties may be imposed for engaging in unfair trade practices. Criminal penalties include imprisonment for a minimum of one year (up to ten years in cases of violation of restrictions on trading in self-issued virtual assets) and financial penalties equivalent to at least three times (but not more than five times) the profit gained or loss avoided through the violation. For financial penalties, the amount can be up to twice the profit gained or loss avoided through the violation.

Moreover, VASPs that establish and operate virtual asset markets must monitor abnormal transactions at all times, immediately notify the financial authorities when suspicious behaviour is detected, and immediately report to the investigative agency if the offence is sufficiently substantiated. In addition, VASPs are prohibited from blocking users’ deposits and withdrawals of virtual assets without just cause.

ST Guidelines

On 6 February 2023, the Financial Services Commission (FSC) announced the “Measures to Overhaul Regulations to Permit Issuance and Circulation of Security Tokens” and the “Guideline on Security Tokens”. The ST Guidelines outline the basic principles for determining whether a digital asset utilising distributed ledger technology qualifies as a security. They clarify that such “security tokens”, which correspond to securities, are subject to securities regulations under the FISCMA. Additionally, they unveil plans to improve the relevant system to ensure that security tokens are issued and distributed in accordance with the FISCMA and the Act on Electronic Registration of Stocks and Bonds by amending those laws.

Under the FISCMA, various types of securities (eg, debt securities, equity securities, beneficiary certificates, derivatives-linked securities, and depositary receipts) are standardised, with established application cases. However, investment contract securities may be widely recognised and subject to interpretation due to their broad definition and the negative regulatory system of the FISCMA. Consequently, they are applied complementally in cases where they do not fall under the other types of securities. Digital asset business operators must closely examine whether the digital assets they issue, distribute, and/or handle may fall under each category of securities under the FISCMA (in particular, investment contract securities) by meeting the following requirements:

  • common enterprise;
  • investment of money and others;
  • mainly carried out by others;
  • contractual rights in which gains and losses resulting from the common enterprise vest; and
  • purpose of profit acquisition.

The FSC explicitly stated in the ST Guidelines its intention to test the distribution plan of investment contract securities and the issuance and distribution plan of beneficiary certificates as an innovative financial service (referred to as a “financial regulatory sandbox”) under the Special Act on Support for Financial Innovation to the extent that innovation is recognised. In this regard, it may also be an option for a business operator to consider applying for designation as an innovative financial service in accordance with the ST Guidelines.

Strengthened Regulation of Deposits and Management of Virtual Assets Due to the Haru Investment Case

Haru Investment advertised for guaranteed principal through risk-free management and highest returns in the industry for crypto deposits on its platform from 2020 to 2023, and abruptly suspended withdrawals in June 2023 after receiving approximately KRW1.4 trillion worth of cryptocurrencies. Around the same time, another virtual asset deposit service provider, Delio, also abruptly suspended withdrawals.

Haru Investment was incorporated in Singapore by a South Korean blockchain accelerator, but it was actually operated by Haru Investment Korea, a South Korean subsidiary of Haru Investment. However, Haru Investment Korea did not report itself as a VASP in accordance with the AML Act despite continuing to provide virtual asset management services in South Korea, owing to uncertainties concerning whether depositing and managing virtual assets fell within the activities that needed to be reported under the AML Act. Because Haru Investment Korea did not report itself as a VASP, it was not under the supervision of financial authorities and was essentially in the regulatory blind spot.

The Haru Investment case led to the need to strengthen the regulation of virtual asset deposit and management services and, subsequently, as shown in Potential Expansion of the Scope of VASPs, a number of interpretations by the FSC were published in order to expand the scope of VASPs from various perspectives.

In addition, the Virtual Asset User Protection Act does not provide for specific regulations on the deposit and management of virtual assets. However, it stipulates that VASPs are obligated to ensure that they in effect hold the same types and quantities of virtual assets entrusted by users, which made deposit and management services by VASPs impossible in fact.

Furthermore, the amended Act on the Regulation of Conducting Fundraising Business Without Permission ‒ scheduled to take effect on 28 May 2024 ‒ includes the act of raising funds using virtual assets within its scope of regulation. In other words, the previous Act on the Regulation of Conducting Fundraising Business Without Permission prohibited the act of raising “funds” from unspecified individuals by guaranteeing principal without obtaining authorisation or permission in accordance with other acts and regulations, but the amended act explicitly stipulates that the scope of “funds” includes virtual assets. The primary reason behind such amendment was the lack of a legal basis to punish Anchor Protocol’s promise to provide interest on deposits in the Terra-Luna case. In light of such background, it is likely that virtual asset deposit and management services that guarantee the return of the principal amount will also be prohibited under the aforementioned amended act.

Potential Expansion of the Scope of VASPs

Currently, the AML Act defines a VASP as an entity or person engaged in any of the following activities:

  • selling or buying virtual assets;
  • exchanging virtual assets for other virtual assets;
  • transferring virtual assets, as prescribed by the Presidential Decree of the Act;
  • safekeeping or managing virtual assets; and
  • brokering, arranging, or acting as an agent for the sale and purchase of virtual assets or the exchange of virtual assets for other virtual assets.

Initially, the financial authorities interpreted the scope of VASPs subject to the requirement for reporting to the financial authorities to be limited to “major” VASPs (such as virtual asset exchanges, custodians, and wallet service providers). To date, these major VASPs appear to be the main targets of the financial authorities’ watchful eyes.

However, in light of a number of interpretations in the second half of 2023, the authors’ take is that the financial authorities are now leaning towards a broader definition of a VASP than before, and that reporting to the financial authorities is required if a business falls under the definition. By way of example, the financial authorities hinted that the development and supply of “software programs that automatically trade virtual assets according to algorithms” and the provision of services through applications by securities companies, which allows customers to connect to virtual asset exchanges to buy and sell virtual assets without separate customer verification, may be included in the act of brokering, arranging, or acting as an agent for the sale and purchase of virtual assets under the Specified Finance Act.

In addition, the financial authorities provided their official interpretation that ‒ even if a company distributes virtual assets to an unspecified number of people for free (eg, via airdrop) ‒ it may be difficult to consider treating such a distribution of virtual assets alone as running a business. However, they cautioned that each case may be individually reviewed on potential profit-seeking and repetition/continuation aspects of such behaviours to determine whether an entity falls under the scope of a VASP.

Nonetheless, for now, it is unlikely that the financial authorities will take active measures ‒ such as notifying law enforcement agencies against unreported VASPs that are currently not under the scope of major VASPs ‒ unless there is a large number of victims or it becomes a social issue. In the long term, it is possible that the financial authorities will refer to overseas regulations such as the Markets in Crypto Assets Regulation (MiCA) to set forth the types of business activities of VASPs in a more specific manner in the form of legislation or guidelines.

In addition, as the financial authorities are expected to actively supervise the virtual asset market in 2024 under the Virtual Asset User Protection Act that will go into effect in the summer, it is possible that the financial authorities will clarify their stance or change their stance in step with the trends of the virtual asset market. It is thus necessary to monitor the regulatory and legislative trends of the financial authorities especially carefully with regard to the scope of VASPs.

Accounting and Disclosure Guidelines for Virtual Assets

The Guidelines for the Supervision of Accounting for Virtual Assets (the “Accounting Guidelines”) include considerations for:

  • accounting for token issuers;
  • accounting for token holders;
  • accounting for VASPs (exchanges); and
  • fair value measurement for virtual assets.

The Accounting Guidelines can be summarised as follows.

First, the Accounting Guidelines clarify the revenue recognition criteria for the transfer of virtual assets after the virtual asset issuer has “fulfilled all of the performance obligations described in the White Paper”. Virtual asset issuers are also required to clearly identify whether they have fulfilled their performance obligations at the time of token sale and, if they change their performance obligations after the sale without any significant reason (eg, a significant change in the White Paper), the related accounting treatment will be considered erroneous.

Second, the Accounting Guidelines clarify that reserved tokens that are kept internally by an issuer without transferring them to others after issuance (creation) cannot be recognised as assets. In addition, if the reserved tokens are transferred to a third party in the future, it may affect the value of the virtual assets already in circulation ‒ hence the quantity of reserved tokens and future utilisation plans should be disclosed as annotations. The information that must be disclosed in the annotations includes:

  • the size and obligations of issuing virtual assets, which are the main contents of the White Paper;
  • the status of internal reserves and free distribution;
  • the contents of the contract for entrusting virtual assets to customers; and
  • the risk of custody.

Third, the Accounting Guidelines propose the principle for classifying virtual assets as inventory assets, intangible assets, or financial instruments depending on the purpose for which the virtual assets were acquired by an entity and whether the virtual assets are considered financial instruments. In other words, as the International Financial Reporting Standards (IFRS) Interpretations Committee (June 2019) had previously suggested only classifying virtual asset holders as intangible assets or inventory assets depending on whether they are intended for sale, there have been conflicting views on whether it is permissible to classify virtual assets as financial assets or liabilities if they are token securities under the FISCMA.

However, according to the Accounting Guidelines, if token securities meet the definition of financial instruments under the Financial Instruments Standard (K-IFRS No 1032), they can be classified as financial assets or liabilities and the related standards can be applied. However, companies applying the general corporate accounting standards are required to designate an account category (eg, miscellaneous assets) that can represent the characteristics of virtual assets and present it in the financial statements.

Fourth, the Accounting Guidelines stipulate that VASPs (such as exchanges) should determine who has control over the tokens between customers and the service providers, in order to decide whether the VASPs recognise them as assets or liabilities. In other words, if the VASP is viewed to have control over the virtual assets entrusted to it by the customer, the VASP should recognise the virtual assets and the liabilities to the customer as assets and liabilities respectively and, if not, the VASP should disclose it in the annotations.

Fifth, the Accounting Guidelines provide specific conditions for the concepts of active market, fair value and the like in virtual asset transactions ‒ with detailed examples ‒ so that companies and auditors can refer to them when preparing financial statements and performing audits.

Finally, the Accounting Guidelines set forth that the main contents of the White Paper ‒ such as the size of virtual asset issuance and performance obligations, the status of internal reserve and free distribution, the contents of the contract for entrusting virtual assets to customers, and custodial risks ‒ should be disclosed in the annotations.

Hacking of Virtual Assets by Hacker Groups Such as Those From North Korea

Current situation regarding damages

Hacking cases by groups such as those from North Korea have been observed frequently in the virtual asset market. The pattern of hacking has evolved in parallel with enhanced security policies, as they used to focus on attacking exchanges in 2016 but now focus on attacking weaknesses in the decentralised finance (DeFi) transaction structure, and hackers are using any means possible to exploit all possible vulnerabilities, whether on-chain or off-chain.

The biggest problem with these attacks involving virtual assets is not only the scale of the damage, but also the fact that it is very difficult to track and arrest the hackers, which is why hackers continue to try to hack without much fear. For the victims of the cyber-attack, it is not easy to even analyse the intrusion path of the hacker group, so there are cases where the service provider itself goes bankrupt after civil and criminal lawsuits from cryptocurrency investors.

Ultimately, when it comes to the hacking of virtual assets by hacker groups such as those from North Korea, it would be ideal to recover the stolen crypto assets or cure the damage. However, in reality, this is not easy and thus it becomes necessary to determine the appropriate “response strategy, response direction, and response speed” by referring to the practice guidelines of the counter-hacking investigation by organisations such as the Korea Internet and Security Agency (KISA) and the police.

Limitations of KISA and police investigation

In the cyber-attack incidents by hacker groups such as those from North Korea, generally the police (the Cyber Terrorism Investigation Unit of the National Police Agency) and analysts from the KISA Infringement Response Centre work together to analyse the intrusion path. The police usually conduct the investigation to track down the suspect by securing the damaged system and logs, analysing the intrusion path, tracking coins, and international co-operation. On the other hand, KISA tends to operate a little faster owing to the practice’s nature, and produces the analysis report and makes conclusion earlier than the police.

Due to the increased number of hacking cases recently, it has become difficult for the police to focus on one case for detailed analysis. Thus, if KISA’s analysis report is generated first, it may be shared with the police and ‒ if necessary ‒ the police will analyse the intrusion path in more depth via the search-and-seizure process. However, in the case of the police investigation, even if the analysis of the intrusion path is completed quickly, the investigation to trace the suspect (eg, an international co-operation investigation) takes a very long time compared with a general police investigation. Therefore, it may take a long time for the police to analyse the intrusion path and trace the suspect ‒ usually several months but sometimes up to two to three years.

In addition, even when the suspect is identified, it can be very difficult to apprehend the suspect because most of the attacks are carried out in North Korea, China, Eastern Europe, Russia, and other countries with which Korea cannot easily co-operate in judicial matters. For this reason, the focus of KISA investigations and police investigations ‒ unlike general criminal cases ‒ is not to apprehend the suspect but to “analyse the intrusion path” and additionally to “identify security vulnerabilities and request improvements to the industry to prevent recurrence”. Also, given that the investigation usually takes such a long time, it is extremely difficult for victims to recover damages through the analysis and investigation process.

Lee & Ko

Hanjin Building
63 Namdaemun-ro
Jung-gu
Seoul 04532
South Korea

+82 2 772 4000

+82 2 772 4001

mail@leeko.com www.leeko.com
Author Business Card

Law and Practice

Authors



Bae, Kim & Lee LLC was founded in 1980 and is a full-service law firm covering all major practice areas, including corporate law, M&A transactions, dispute resolution (arbitration and litigation), white-collar criminal defence, competition law, tax law, capital markets law, finance, IP, employment law, real estate, technology, TMT, maritime, and insurance matters. With more than 650 professionals located across its offices in Seoul, Beijing, Hong Kong, Shanghai, Hanoi, Ho Chi Minh City, Yangon and Dubai, Bae, Kim & Lee LLC offers its clients a wide range of expertise through a vast network of offices. The firm is composed of a diverse mix of Korean and foreign attorneys, tax advisers, industry analysts, former government officials, and other specialists. A number of its professionals are multilingual and have worked at well-known law firms in other countries, enabling them to assist international clients as well as South Korean clients abroad successfully with cross-border transactions.

Trends and Developments

Authors



Lee & Ko has more than 50 experienced attorneys and industry specialists who have accumulated leading know-how and expertise on the full range of regulatory issues arising in the fintech space. Lee & Ko’s digital finance team provides well-balanced, insightful and useful guidance to clients across all legal, policy-making and business aspects of the fintech industry. Such expertise and know-how are supplemented by the team’s advanced understanding of the various technologies that underpin this sector, which enables the firm to focus on the issues that matter most to our clients. Lee & Ko’s ability to provide one-stop legal services spanning the full spectrum of legal issues affecting the fintech sector stands out as the firm’s greatest strength.

Compare law and practice by selecting locations and topic(s)

{{searchBoxHeader}}

Select Topic(s)

loading ...
{{topic.title}}

Please select at least one chapter and one topic to use the compare functionality.