In relation to virtual assets, the FSC, the Korea Financial Intelligence Unit (KoFIU), and the Financial Supervisory Service (FSS) each perform distinct regulatory functions.

• FSC: responsible for establishing national policies related to blockchain technology and virtual assets.
• FSS: through its dedicated departments for virtual asset supervision and investigation, the FSS conducts inspections and supervisory activities of financial institutions and enforces sanctions against unfair trading practices involving virtual assets, thereby ensuring effective market oversight.
• KoFIU: as an agency under the FSC, KoFIU operates the AML system and works to prevent money laundering and terrorist financing. It is also responsible for the registration and reporting of VASPs and plays a key role in preventing criminal activities involving blockchain and virtual assets.

To comply with the Financial Action Task Force (FATF) international standards on combating money laundering and the financing of terrorism and proliferation, Korea amended the Act on Reporting and Using Specified Financial Transaction Information, becoming the first jurisdiction to legally implement the “Travel Rule.” More recently, an enforcement decree has been proposed to extend the Travel Rule to transactions below KRW1 million.

In addition, in response to the International Organization of Securities Commissions (IOSCO) policy recommendations on crypto and digital asset markets, Korea enacted the Act on the Protection of Virtual Asset Users and its enforcement decree, introducing various investor protection and market integrity measures, including the segregation of customer deposits and virtual assets from the proprietary assets of VASPs.

Furthermore, in line with the Bank for International Settlements (BIS)’s emphasis on the need for stablecoin regulation, discussions on the legalisation and regulatory framework for stablecoins are currently ongoing in Korea.

Classification of Tokens and Related Regulation

Korean laws and regulations do not explicitly define a formal classification system for tokens. Under the current Act on the Protection of Virtual Asset Users, virtual assets are defined broadly, while central bank digital currencies (CBDCs), certain NFTs that meet specified criteria, and electronic payment instruments under the Electronic Financial Transactions Act (EFTA) are, in principle, excluded from the scope of virtual assets.

Meanwhile, financial authorities take the view that classification of virtual assets should be determined not only by their technical form but also by their economic substance, and that applicable regulations are applied accordingly.

Security tokens

Where a token qualifies as a “security” under the Financial Investment Services and Capital Markets Act (FSCMA) ‒ ie, where investors acquire certain rights ‒ the token is classified as a security token and becomes subject to existing capital markets regulations. Accordingly, licensing requirements (eg, investment brokerage business authorisation) and securities registration requirements apply. In this regard, amendments to the ESA introducing a tokenised securities framework based on DLT have been enacted and are scheduled to take effect in February 2027.

Payment instruments

Where a token is used as a means of payment, it may fall under electronic money or prepaid electronic payment instruments under the EFTA. However, financial authorities generally take the position that highly volatile virtual assets such as Bitcoin do not qualify as electronic payment instruments under the Act. Moreover, electronic payment instruments are explicitly excluded from the definition of virtual assets, reflecting a regulatory intent to distinguish virtual assets from payment instruments.

Discussion regarding stablecoins that may be used for payments and settlements have become increasingly active recently. It is expected that the forthcoming DABA will introduce a regulatory framework for stablecoins and may explicitly provide that they do not fall within the scope of electronic payment instruments under the EFTA. Overall, Korea adopts a dual-track regulatory approach, applying both the existing regulatory framework and a separate virtual asset-specific regulatory regime in parallel.

Regulation of Virtual Assets

Currently, virtual assets in Korea are primarily regulated under the Act on Reporting and Using Specified Financial Transaction Information and the Act on the Protection of Virtual Asset Users.

Under the former, VASPs are subject to registration obligations, compliance requirements, and AML duties. Specifically, any entity seeking to conduct virtual asset-related business such as trading, exchange, or custody must meet certain requirements (including information security management system certification) and register with the financial authorities as a VASP. In addition, VASPs are required to comply with AML obligations, including the Travel Rule, customer due diligence (KYC), and suspicious transaction reporting (STR). They must also segregate customers’ deposits and virtual assets from their own proprietary assets.

In this regard, legislative amendments and enforcement decrees currently under consideration would expand the scope of the Travel Rule by abolishing the current threshold of KRW1 million, thereby broadening its application. In addition, where transactions involve overseas VASPs or private wallets, VASPs would be required to assess and manage money laundering risks and take appropriate measures based on the level of risk.

Meanwhile, the Act on the Protection of Virtual Asset Users prohibits unfair trading practices involving virtual assets, including the use of undisclosed material information, market manipulation, and fraudulent trading.

Furthermore, under the amended Act on the Prevention of Telecommunications-based Financial Fraud and Refund of Damages (the “Telecom Fraud Refund Act”), which is scheduled to take effect on 1 October 2026, virtual asset exchanges will be subject to anti-scam and victim recovery obligations comparable to those imposed on traditional financial institutions. Accordingly, exchanges must continuously monitor for suspected fraudulent transactions, promptly suspend accounts when fraud is suspected, and support the recovery and refund of assets to victims.

In addition, as noted above, Korea is preparing to enact DABA, which is expected to:

• further classify digital asset businesses into categories such as trading/exchange, brokerage, custody/management, payment/transfer, discretionary management, advisory, order transmission, and agency services;
• introduce a regulatory framework for stablecoins; and
• establish additional requirements related to the issuance of digital assets.

Korean financial authorities have taken the position that brokerage of Bitcoin futures exchange-traded funds (ETFs) may be permitted, whereas issuance and brokerage of Bitcoin spot ETFs may raise issues of violation under the FSCMA. This is because, under the FSCMA, ETFs are premised on having an eligible “underlying asset,” and virtual assets are generally not regarded as satisfying the requirements for such underlying assets.

However, under the FSCMA, “collective investment” does not necessarily require a traditional underlying asset, but instead defines the investable asset as any “asset with economic value.” Accordingly, investment vehicles that invest in virtual assets may, in principle, be structured as collective investment schemes under the FSCMA and become subject to its regulatory framework.

In practice, however, several legal uncertainties remain, particularly regarding whether a trust company responsible for custody and management of collective investment assets is permitted to hold virtual assets directly, or whether such custody may be delegated to a VASP. Due to these uncertainties, and given that corporate acquisition of virtual assets has historically not been permitted, there have been no domestic investment funds in Korea that directly invest in virtual assets.

For reference, a legislative amendment to the FSCMA has been proposed and is currently pending in the National Assembly. The Bill would explicitly include virtual assets as eligible “underlying assets” under the FSCMA and would also permit trust companies to hold virtual assets as part of their custodial asset pool.

Financial authorities in Korea have prohibited all forms of initial coin offerings (ICOs) since 2017.

However, under the forthcoming DABA, it is expected that a regulatory framework for the issuance of digital assets will be introduced. This is likely to include entry requirements for digital asset issuers, as well as obligations relating to the preparation and disclosure of digital asset white papers and other related disclosure requirements.

Article 10 of the Act on the Protection of Virtual Asset Users regulates unfair trading practices in virtual asset markets, which generally include the use of undisclosed material information, market manipulation, and fraudulent trading. These provisions are substantially similar to the prohibition on unfair trading practices under the FSCMA.

In addition, unlike traditional securities markets, the Act imposes certain additional obligations specific to virtual asset markets, including a prohibition on trading self-issued virtual assets, a prohibition on unjustified suspension or restriction of deposits and withdrawals, and an obligation to monitor and detect abnormal transactions.

Recently, the KoFIU has imposed severe administrative sanctions on virtual asset exchanges, including partial business suspension orders and substantial monetary penalties. These enforcement actions have been subject to legal challenges, with companies filing administrative lawsuits seeking revocation of the sanctions, and related disputes are currently ongoing.

Specifically, in 2025, KoFIU imposed a three-month partial business suspension order (prohibiting the transfer of virtual assets by new customers) and a fine of approximately KRW35.2 billion on Dunamu, the operator of the virtual asset exchange Upbit. The regulator found that Dunamu had violated several obligations, including the prohibition on transactions with unregistered VASPs, customer due diligence requirements (such as improper use of identification document copies, failure to properly verify addresses, and failure to verify the authenticity of drivers’ licences), transaction restriction obligations, and suspicious transaction reporting obligations. Dunamu has filed an administrative lawsuit seeking cancellation of the suspension order, and it reportedly prevailed at first instance, with the case currently pending on appeal. In addition, an objection has been filed against the fine, and related proceedings are ongoing.

Similarly, in March 2026, KoFIU imposed sanctions on Bithumb, including a fine of approximately KRW36.8 billion and a six-month partial business suspension (prohibiting the transfer of virtual assets by new customers), based on comparable violations. In April 2026, Coinone was also sanctioned with a fine of approximately KRW5.2 billion and a three-month partial business suspension (also restricting transfers for new customers). Both Bithumb and Coinone have also initiated administrative litigation seeking revocation of these sanctions.

Meanwhile, KoFIU has also taken enforcement measures against unregistered foreign VASPs operating in Korea. These measures include:

• notifying the public of such unregistered providers to discourage transactions with them;
• reporting such providers to investigative authorities; and
• pursuing measures to block domestic access to their websites and mobile applications.

Korea operates a VASP registration regime, under which any person conducting the following activities as a business must register with the financial authorities:

• buying and selling virtual assets;
• exchanging virtual assets for other virtual assets;
• transferring virtual assets, as specified by Presidential Decree;
• custody or management of virtual assets; and
• acting as an intermediary, broker, or agent for the above activities.

In addition, under the Act on the Protection of Virtual Asset Users and the Act on Reporting and Using Specified Financial Transaction Information, the VASP registration requirements apply on an extraterritorial basis. Accordingly, even if the relevant activities are conducted outside Korea, they may still be subject to the registration obligation if they have an effect within Korea. In this regard, the financial authorities have taken the position that foreign VASPs may be deemed to have a sufficient domestic nexus ‒ and therefore be subject to VASP registration ‒ where they, for example, provide Korean-language websites, run marketing events targeting Korean customers, or enable the purchase of virtual assets using credit cards.

Under the Act on Reporting and Using Specified Financial Transaction Information, a person who intends to operate a virtual asset-related business must file a VASP registration with the financial authorities and obtain acceptance of such filing.

However, the financial authorities may refuse to accept a VASP registration filing if certain statutory non-acceptance requirements are met. In this regard, the Act provides the following grounds for refusal. Notably, the requirements under items (iii) to (v) concerning major shareholders, as well as items (iv) and (v), were newly introduced through an amendment on 19 February 2026, and are scheduled to take effect on 20 August 2026:

• (i) failure to obtain Information Security Management System (ISMS) certification;
• (ii) (in cases involving exchange between fiat currency and virtual assets) failure to conduct financial transactions through real-name verified deposit and withdrawal accounts;
• (iii) persons (including representatives, officers, and major shareholders) with a history of violating laws such as the Act on Regulation and Punishment of Criminal Proceeds Concealment or the Narcotics Control Act;
• (iv) failure to maintain sound financial condition or adequate social credibility; and
• (v) failure to maintain appropriate organisational structure, personnel, IT infrastructure, and internal control systems.

Among these, the “sound financial condition” requirement, scheduled to take effect on 20 August 2026, is part of prudential regulatory measures. According to the currently proposed amendments to the Enforcement Decree of the Act and related supervisory regulations, financial authorities seeking VASP registration are expected to be required to satisfy certain conditions, such as:

• a debt-to-equity ratio of 200% or less;
• no record of credit default or similar impairment of financial credibility over the past three years;
• no designation as a distressed financial institution or revocation of licence/authorisation/registration within the past five years; and
• the lapse of a certain period following prior administrative sanctions.

Under the Enforcement Decree and supervisory regulations of the Act on Reporting and Using Specified Financial Transaction Information, VASPs are required to report information regarding their major shareholders at the time of filing for VASP registration. In addition, where there is any change to such major shareholder information, a change report must be submitted within 14 days from the date of the change.

However, under the amended Act (amended on 19 February 2026, and scheduled to take effect on 20 August 2026), the scope of reportable major shareholder information has been expanded, and supervisory regulations are expected to be revised to require that change reports be submitted at least 30 days prior to the effective date of such changes.

At the same time, new screening and disqualification criteria for major shareholders have been introduced. As discussed in 3.2 Set-Up Requirements, according to the proposed amendments to the Enforcement Decree and supervisory regulations, a domestic corporate major shareholder of a VASP must satisfy certain prudential requirements, including:

• a debt-to-equity ratio of 200% or less;
• not being a major shareholder or related party of a distressed financial institution or a financial institution whose licence, authorisation, or registration has been revoked under financial regulatory laws;
• no record of bank account transaction suspension within the past five years; and
• not having been subject to bankruptcy or rehabilitation proceedings within the past five years.

For reference, if a major shareholder fails to meet these requirements at the time of a change report, the registration or change filing may be revoked ex officio by the authorities.

Under the Korean Act on Reporting and Use of Certain Financial Transaction Information, Korea’s VASP registration regime applies only to business activities conducted within the Korean market, and there is currently no separate framework for the mutual recognition of licences. However, as Korea was the first country in the world to implement the Travel Rule, it may be relatively easier to demonstrate a high level of AML compliance.

Regulations on Issuance and Sale of Virtual Assets

Under the Act on Reporting and Using Specified Financial Transaction Information, VASPs are subject to a registration requirement with the KoFIU. Accordingly, any person engaging in the business of trading, exchanging, or brokering virtual assets must obtain VASP registration.

However, where a virtual asset issuer merely sells its own issued virtual assets, such activity may not necessarily be regarded as a “business” requiring VASP registration, depending on factors such as whether the activity is conducted for profit and whether the sales are conducted repeatedly and continuously.

Meanwhile, even foreign VASPs are required to register with KoFIU if they are deemed to be “conducting business targeting Korean users,” in which case they must also comply with obligations under Korean AML laws. Korean financial authorities determine whether a foreign VASP targets Korean users by considering factors such as:

• whether Korean-language services are provided;
• whether marketing or promotional activities target Korean users; and
• whether KRW-denominated transactions or payment methods are supported.

Under the current legal framework, there are no explicit statutory requirements governing white papers, offering documents, or disclosure obligations in connection with the issuance or sale of virtual assets. However, the proposed DABA currently under discussion is expected to introduce such requirements. Accordingly, the progress and contents of the proposed legislation should be closely monitored.

Regulations on Advertising of Virtual Assets

Current Korean virtual asset laws do not specifically regulate advertising relating to virtual assets. However, the proposed DABA reportedly includes provisions governing the subjects, content, methods, and procedures of virtual asset advertising.

In addition, VASPs remain subject to the general requirements of the Act on Fair Labelling and Advertising. Furthermore, as a form of industry self-regulation, the DAXA has issued the “Best Practice Guidelines for Advertising and Promotional Activities of VASPs”.

The key elements of these guidelines include:

• disclosure of risks such as potential loss of principal, user responsibility for investment losses, and advertisement validity periods;
• disclosure of fee rates charged to users;
• prohibition on guaranteeing compensation for losses; and
• prohibition on offering unfair economic benefits or incentives.

Under Korean law, the obligation to register as a VASP is determined based on the actual activities substantively carried out by the relevant business operator. Accordingly, merely partnering with or relying on an already licensed entity does not allow another party to conduct virtual asset business activities without its own registration.

Therefore, if external firms are deemed to be substantively engaging in activities such as virtual asset trading or related services, there is a risk that they may independently be subject to VASP registration requirements with the KoFIU, even where another entity’s licence structure is being used.

Conversely, where all virtual asset trading activities and related brokerage, intermediation, or agency functions are conducted solely by another properly licensed entity, and the external firms do not themselves substantively perform regulated activities, separate VASP registration by the external firms would generally not be required.

Korean financial authorities recognise that “fully decentralised DeFi services” present regulatory challenges because it is difficult to identify a responsible operating entity and determine the applicable legal jurisdiction. The authorities have indicated that they intend to continue developing an appropriate regulatory framework for such services. As of now, however, no relevant regulations exist in Korea expressly prohibiting fully decentralised DeFi services. That said, where a DeFi arrangement is not truly decentralised and a specific operator effectively retains control over the platform or service, such operator may be deemed to be conducting a virtual asset business and therefore become subject to the Act on Reporting and Using Specified Financial Transaction Information and the Act on the Protection of Virtual Asset Users.

Meanwhile, no such regulation expressly prohibits centralised finance (CeFi) companies from utilising DeFi protocols. However, in practice, there are significant compliance constraints. In particular, VASPs are required to:

• comply with the Travel Rule by collecting, transmitting, and retaining sender and recipient information for virtual asset transfers exceeding KRW1 million;
• maintain virtual assets of the same type and quantity as those entrusted by users; and
• securely store at least 80% of users’ virtual assets in cold wallets segregated from internet-connected systems.

These obligations may create practical difficulties for VASPs seeking to utilise DeFi protocols.

In Korea, there are currently no specific laws or regulations governing organisational structures for operating DeFi services or decentralised autonomous organisations (DAOs). In this regard, Korean financial authorities have taken the position that, in the case of fully decentralised DeFi services, it is difficult to identify a responsible operating entity, making the applicable regulatory framework unclear. In addition, regulators appear to view DAOs as organisational structures whose legal form and governance rights are not currently reflected in Korea’s Civil Act or Commercial Act.

Meanwhile, quite a lot of corporations, including stock companies, have developed and operated DeFi-related services. In many such cases, however, the services would likely not be regarded as fully decentralised DeFi. Although certain operational functions may have been implemented through smart contracts, the relevant corporations generally remained responsible for development, commercialisation, incentive structures, branding, and overall project management.

Since there are currently no dedicated regulations specifically applicable to DeFi, the legal requirements applicable to a particular DeFi arrangement are generally determined based on the specific structure and characteristics of the relevant business model under existing legal and regulatory frameworks.

Although there have not been many publicly confirmed cases involving damage arising specifically from DeFi services in Korea, there is currently no dedicated legal framework governing DeFi. As a result, liability relating to DeFi services appears to be assessed under existing legal frameworks, with responsibility potentially imposed on the operators or developers of the relevant services.

Kronos DAO (2022)

Kronos DAO, a DeFi project operating on the Klaytn blockchain, withdrew funds from a DAO wallet without prior notice and exchanged them for its self-issued stablecoin. However, prosecutors declined to indict, reportedly on the grounds that there was no clearly established legal duty to provide prior notice and that intentional misconduct relating to the loss of funds could not be sufficiently proven.

KLAYswap Hack (2022)

In 2022, approximately KRW2.2 billion worth of virtual assets were stolen through a hacking incident involving KLAYswap, a DeFi service developed by Ozys. KLAYswap subsequently announced full compensation for affected users, and no separate regulatory sanctions or criminal prosecutions in connection with the incident have been identified.

Orbit Bridge Hack (2024)

In 2024, approximately USD82 million worth of virtual assets were stolen through a hacking incident involving Orbit Bridge, a cross-chain service developed by Ozys. In connection with the incident, Ozys filed a damages claim against its Chief Information Security Officer (CISO), who had been responsible for establishing and managing the company’s information security system. However, the court dismissed the claim, finding insufficient evidence that the CISO had engaged in unlawful conduct that lowered the level of security or caused the incident. Separately, in civil claims brought by users, the court reportedly recognised Ozys’s liability for damages to a certain extent.

In individual transactions, it would generally be permissible for the parties to agree on settlement using virtual assets as consideration on a case-by-case basis.

However, virtual assets are not typically eligible to be issued as electronic payment instruments or electronic money under the EFTA. The Act on the Protection of Virtual Asset Users excludes electronic payment instruments and electronic money from the definition of virtual assets, and in practice, the FSS has not approved licensing for issuance or management businesses that attempt to structure virtual assets as prepaid electronic payment instruments.

Meanwhile, even if a payment service involving virtual assets is operated, if the business involves activities such as trading, custody, management, brokerage, intermediation, or agency services on a commercial basis, a VASP registration may be required. In this context, where a company issues a virtual asset and enables users to use it for purchases at merchants through an affiliated settlement network, the affiliated company that circulates or facilitates the use of such virtual asset in settlement may also be required to register as a VASP.

In addition, where virtual assets are used for cross-border payments or settlement of import/export transactions, the Foreign Exchange Transactions Act applies, and unreported cross-border payments may constitute a violation of foreign exchange regulations. Notably, legislation amending the Foreign Exchange Transactions Act to require VASPs engaged in cross-border virtual asset transfers to register under the Act was passed by the National Assembly on 7 May 2026. Accordingly, future changes to reporting and registration obligations should be closely monitored.

Previously, there was insufficient institutional infrastructure for the issuance and distribution of tokenised assets, and fractional investment products were only introduced on a limited basis through regulatory sandboxes and other innovative financial service regimes. However, with the recent amendments to the FSCMA and the ESA, a regulatory framework for real-world assets (RWA) tokenisation has now been established. Accordingly, security tokens are now brought within the existing regulatory perimeter, including the FSCMA and the ESA.

First, since security tokens qualify as securities (financial investment instruments) under the FSCMA, they are subject to the same regulatory regime as other forms of securities. This includes issuance-related regulations such as the obligation to file securities registration statements, prohibitions on unfair trading practices, and business conduct regulations. Under the amended FSCMA, distribution-related rules applicable to securities are also fully extended to investment contract securities, including tokenised securities.

In addition, the FSCMA introduces an OTC brokerage system for equity securities and trust beneficiary securities, thereby establishing a legal framework for multilateral OTC trading. In this regard, the financial authorities have maintained the position that issuance and distribution markets should be separated in relation to emerging securities such as fractional investment products. Accordingly, authorisation procedures are currently underway for OTC brokerage platforms dealing with beneficiary interests (ie, fractional investment OTC exchanges). However, it remains under discussion whether such authorisation will extend to tokenised trust beneficiary securities.

Meanwhile, the amended ESA provides a legal basis for the use of DLT, thereby recognising the legal effect of securities issued in token form. Previously, full dematerialisation using DLT was not permitted, requiring issuance of electronic securities that were strictly matched on a 1:1 basis with tokens. Under the revised framework, electronic securities utilising distributed ledger systems are now recognised. Furthermore, the introduction of an “issuer account management institution” system provides an alternative to centralised electronic registration and custody. The amended ESA is scheduled to take effect on 4 February 2027.