1. Regulatory Overview: FSC and FSS
South Korea's crypto regulatory framework is primarily overseen by two bodies: the Financial Services Commission (FSC), which sets policy and issues regulations, and the Financial Supervisory Service (FSS), which conducts on-site inspections and day-to-day supervision of financial institutions, including crypto exchanges.
The legal foundation for crypto regulation is the Act on Reporting and Use of Certain Financial Transaction Information (commonly referred to as the SPCMLA or Special Payment Act), which was amended in 2020 to bring virtual asset service providers (VASPs) within its scope. This amendment made VASP registration mandatory and imposed comprehensive AML obligations for the first time.
A watershed development came in 2023 with the enactment of the Virtual Asset User Protection Act (VAUPA), South Korea's first dedicated investor protection legislation for crypto. VAUPA came into full force in July 2024 and represents the most significant expansion of Korea's crypto regulatory framework since the 2020 SPCMLA amendments.
2. VASP Registration Requirements
All VASPs operating in South Korea must register with the Financial Intelligence Unit (KoFIU), which operates under the FSC. Registration requirements include:
ISMS Certification
VASPs must obtain Information Security Management System (ISMS) certification from the Korea Internet and Security Agency (KISA). This cybersecurity requirement is unique to Korea and ensures that exchanges maintain robust information security practices before they can legally operate.
Real-Name Bank Account
VASPs must partner with a Korean bank to provide real-name verified accounts for Korean Won deposits and withdrawals. In practice, only a small number of Korean banks have agreed to provide this service, creating a significant barrier to entry.
AML Officer Appointment
A dedicated AML compliance officer must be appointed. The AML programme must comply with KoFIU's guidelines, including customer due diligence, transaction monitoring, and suspicious transaction reporting procedures.
Foreign VASPs may not provide virtual asset services to Korean residents without obtaining VASP registration. The FSC has issued enforcement actions and public warnings against unregistered foreign platforms that actively market to Korean users.
3. The Virtual Asset User Protection Act (VAUPA)
Enacted in 2023 and fully effective from July 2024, the VAUPA is South Korea's landmark investor protection legislation for crypto. It was driven partly by the Terra/LUNA collapse in 2022, in which Korean investors suffered massive losses from a project created by a Korean founder.
Key provisions of the VAUPA include:
- ▸Asset segregation: VASPs must segregate client virtual assets from their own assets. Client assets must be stored in cold wallets, and at least 80% must be insured or held in reserve funds.
- ▸Market abuse prohibition: The VAUPA explicitly prohibits insider trading and market manipulation of virtual assets — the first time these concepts have been applied to Korea's crypto market under dedicated legislation. Violations are subject to criminal penalties.
- ▸Abnormal trading monitoring: VASPs must establish systems to detect and report abnormal trading patterns to the FSS. The FSS has authority to investigate market manipulation and issue trading halts.
- ▸Compensation fund: VASPs must maintain a compensation reserve to cover potential losses to users from hacking or operational failures. The required reserve level is determined based on the exchange's trading volume.
The VAUPA represents a significant step toward bringing Korea's crypto regulation closer to the standards of traditional securities markets. It signals the FSC's view that virtual assets, regardless of their legal classification, should provide users with protections equivalent to those in conventional financial markets.
4. Real-Name Banking System
South Korea's real-name banking requirement is one of its most distinctive and restrictive regulatory features. Under regulations introduced in 2018, Korean crypto exchanges may only accept Korean Won deposits and withdrawals through bank accounts that are verified under the customer's real name — meaning the exchange account name and the bank account name must match.
In practice, this means each exchange must partner with a Korean bank willing to provide this verification service. As of 2026, only a handful of major Korean banks (including NH Bank, K Bank, and Kookmin Bank) have partnered with specific exchanges, creating a de facto oligopoly where a small number of large registered exchanges have bank partnerships, while smaller or newer entrants face an almost insurmountable barrier.
The real-name system effectively eliminated anonymous crypto trading and peer-to-peer OTC trading in Korea, and has been credited with making Korea's crypto market significantly more transparent and traceable than many other Asian markets.
5. AML and Travel Rule Compliance
South Korea implemented the FATF Travel Rule through the SPCMLA amendments in March 2022, requiring VASPs to collect and transmit originator and beneficiary information for crypto transfers above KRW 1 million (approximately USD 750). Korea uses the VerifyVASP system, developed by a Korean consortium, as its primary travel rule compliance infrastructure.
Registered Korean exchanges must verify the identity of wallet addresses before processing withdrawals to unhosted wallets above the travel rule threshold, and must refuse transfers to or from unregistered foreign VASPs for transactions above this amount. These requirements have positioned Korea as one of Asia's most technically advanced jurisdictions for travel rule compliance.
6. Crypto Tax Rules
South Korea's approach to crypto taxation has been repeatedly revised and delayed. The current regime, which came into effect in 2025 after multiple postponements, taxes crypto gains as "other income" at a flat rate of 20% (plus 2% local income tax) on net annual gains above KRW 2.5 million (approximately USD 1,900).
This "basic deduction" of KRW 2.5 million means most small-scale retail investors are effectively exempt from crypto tax in any given year. Professional traders and high-volume investors above the threshold must file annual returns reporting their crypto gains.
Crypto-to-crypto transactions are taxable events — the gain is calculated as the KRW value of the crypto received minus the KRW cost basis of the crypto disposed. Korean exchanges are required to provide users with annual trading summaries to facilitate tax reporting.
7. Major Regulated Exchanges
- ▸Upbit: Operated by Dunamu, Upbit is Korea's largest exchange by volume and one of the world's highest-volume KRW-pair exchanges. Partners with NH Bank for real-name accounts.
- ▸Bithumb: One of Korea's oldest and most recognised exchanges. Has faced multiple regulatory actions for AML deficiencies but remains fully registered and operational.
- ▸Coinone: Registered VASP with a bank partnership with NH Bank. Known for a more conservative token listing policy compared to Upbit.
- ▸Korbit: One of Korea's original exchanges, registered VASP. Has a smaller market share than Upbit/Bithumb but a strong compliance track record.