Crypto Asset Regulation Overview Series (9): South Korea, from VASP Registration to Security Tokenization

On October 1, 2026, South Korea's Financial Services Commission published proposed amendments to the accompanying rules of the Capital Markets Act and the Act on Electronic Registration of Stocks, Bonds, etc., setting out implementation details for securities tokenization. Stocks, bonds, funds, and certain fractional investment securities may be issued and circulated using distributed ledgers, with the related regime scheduled to take effect on February 4, 2027.

This reform adds a new capital markets entry point to South Korea's digital asset regulation. Ordinary virtual asset trading continues to operate along VASP registration, anti-money laundering, and user asset protection rules; tokens carrying securities rights enter the issuance, account management, trading venue, and investor protection regime. The two paths are separated by the nature of the asset rights, yet connected to each other through bank accounts, customer identification, and technological infrastructure.

In recent years, South Korea's regulatory system has expanded from exchange registration to asset segregation, market manipulation, cross-border transfers, and shareholder fitness review. Understanding this market requires examining the Act on Reporting and Using Specified Financial Transaction Information, the Virtual Asset User Protection Act, and capital markets-related laws side by side.

1. Regulation Is Carried Out Jointly by Five Types of Institutions

Figure 2 | South Korea's digital asset regulation connects ledger records, securities rights, and ongoing supervision

Figure 3 | Major regulatory bodies and infrastructure in South Korea's virtual asset market

The Financial Services Commission (FSC) is responsible for major policy, rulemaking, and administrative sanctions. The virtual asset regime, the accompanying rules of the user protection act, and the securities tokenization roadmap are all issued by the FSC. In cases of serious violations, the FSC may issue corrective orders, suspend business operations, and impose administrative fines.

The Financial Supervisory Service (FSS) undertakes examinations and investigations. Under Articles 13 to 15 of the Virtual Asset User Protection Act, the FSS may inspect whether a VASP properly protects customer assets and may investigate abnormal and unfair trading. When trading platforms identify major leads through routine monitoring, they are required to report them to the FSS.

The Korea Financial Intelligence Unit (KoFIU), located within the FSC system, is the core institution for VASP registration and anti-money laundering supervision. Article 7 of the Act on Reporting and Using Specified Financial Transaction Information requires VASPs to report to the KoFIU. Customer due diligence, suspicious transaction reporting, the travel rule, and cross-border virtual asset transfers are also mainly implemented under this law.

The Korea Internet & Security Agency (KISA) is responsible for Information Security Management System certification. ISMS certification is an important prerequisite for VASP registration, and the assessment scope includes information security organization, access control, system operations, and incident response. Service providers typically need to complete certification preparations before formal reporting.

Commercial banks handle real-name deposit and withdrawal accounts and customer fund custody. Korean won trading platforms need to cooperate with banks to provide customers with deposit and withdrawal accounts that can be verified under real-name requirements; banks also assess the VASP's money laundering risk, customer fund segregation, and internal controls. The Korea Securities Depository (KSD), meanwhile, performs the function of electronic registration infrastructure in the securities tokenization regime.

2. Asset Classification Determines Which Legal Path Applies

Article 2 of the Virtual Asset User Protection Act defines virtual assets as electronic certificates and related rights that have economic value and can be electronically traded or transferred. Certificates whose use is restricted by the issuer and which cannot be exchanged for currency, goods, or services, as well as prepaid payment instruments, electronic money, electronically registered stocks, electronic notes, and electronic bills of lading, are excluded from the definition.

When an asset carries securities rights such as shares, bonds, fund units, or investment contracts, South Korea's Financial Investment Services and Capital Markets Act (FSCMA) applies first. Registering a security on a blockchain does not change its profit rights, redemption rights, or issuer obligations. Issuance, sales, and secondary trading need to find a licensing entry point under the securities regime.

NFTs are likewise judged by their actual rights. Collectible-style NFTs with a single issuance and lacking fungibility are generally closer to ordinary digital certificates; products issued in large quantities, capable of fractional trading, promising returns, or forming a continuous trading market may fall within the scope of virtual assets or securities. Project names and technical formats do not replace analysis of holder rights.

Stablecoins currently fall mainly within the virtual asset framework, while payment, reserve, and issuance regimes continue to develop. Service providers engaged in exchange, transfer, custody, or matching services first apply VASP rules; if a stablecoin also carries securities profit rights, capital markets law requirements must also be considered.

3. VASP Registration Begins with KoFIU Reporting

Figure 4 | Main stages from registration preparation to ongoing operations for South Korean VASPs

Article 7 of the Act on Reporting and Using Specified Financial Transaction Information covers businesses engaged in the purchase and sale of virtual assets, coin-to-coin exchange, transfer, custody and management, and trading brokerage. Whether a digital wallet service provider falls within scope depends on whether it actually controls customer assets or executes transfers. Pure technical software and services capable of operating assets on behalf of customers produce different regulatory outcomes.

Reporting materials include information on the company and its representative, business premises, contact details, server locations, and anti-money laundering systems. A VASP needs to obtain ISMS certification issued by KISA and establish segregated management of customer transaction records, suspicious transaction reporting, and internal controls. Only after the KoFIU accepts the report may the company continue to carry out relevant business in South Korea.

Trading platforms that provide Korean won trading must also obtain a real-name deposit and withdrawal account with a bank. The partner bank verifies whether customer deposits are segregated, whether the company has received major penalties in recent years, whether transaction records are managed separately, and completes a money laundering risk assessment. Bank cooperation therefore constitutes both a product entry point and ongoing compliance oversight.

Amendments effective in August 2026 push registration review into corporate governance. In principle, a VASP's debt-to-equity ratio must not exceed 200%, it must not have defaulted in the past three years, and it must not be an insolvent financial institution or one whose license was revoked for violating financial law. The review scope extends to the chief executive officer, controlling shareholders, and the representatives of the largest corporate shareholders.

Companies must also demonstrate that they have professional staff, computing systems, cybersecurity facilities, and internal controls. The financial law violations, anti-money laundering violations, and institutional management records of executives and major shareholders all enter the fitness assessment. Registration thus expands from technical security and anti-money laundering reporting into a comprehensive review of financial soundness, ownership, and management credibility.

4. Anti-Money Laundering Obligations Run Through Every Transfer

VASPs need to complete customer identification, continuously review customer information and transaction purposes, and adopt enhanced due diligence for high-risk customers, products, and behaviors. Exchanges, custodians, and transfer service providers must all establish suspicious transaction identification rules and submit relevant information to the KoFIU.

The travel rule requires the sending institution to transmit remitter and payee information to the receiving institution. South Korea has applied this regime to VASP-to-VASP transfers of 1 million Korean won or more since March 2022. The 2026 amendments plan to expand the travel rule between registered VASPs to all amounts and require the receiving party to ensure it obtains the information provided by the sending party.

Overseas VASPs and personal wallets are subject to more detailed condition management. Scenarios such as transfers to low-risk overseas institutions and transfers between the same entity's own accounts may be processed after verification, while high-risk transactions will be restricted. Outbound VASP or digital wallet transfers reaching 10 million Korean won in a single transaction or cumulatively must be reported to the KoFIU, and risk ratings do not exempt this reporting requirement.

For enterprises, cross-border products require simultaneously preserving customer identity, on-chain addresses, counterparty institutions, and fund purposes. If a platform records only wallet addresses, it will struggle to satisfy subsequent investigations; if a bank sees only fiat flows, it cannot complete on-chain risk identification. The two types of data need to correspond through transaction numbers and customer files.

5. The Virtual Asset User Protection Act Governs Customer Money and Coins

The Virtual Asset User Protection Act has been in effect since July 19, 2024. Article 6 requires VASPs to separate customer fiat deposits from their own funds and place them with qualified institutions such as banks. Custodial institutions need to clearly identify that the funds belong to users, and users have arrangements for direct claims for return in cases such as cancellation of VASP registration, dissolution, or bankruptcy. Platforms should also pay customers interest or corresponding fees generated by deposits.

Article 7 requires VASPs to establish user lists recording customer identity, asset types, quantities, and addresses, and to separate user virtual assets from their own assets. The types and quantities of assets actually held by the platform must match customer entitlements. Implementing rules require at least 80% of user virtual assets to be stored in offline cold wallets to reduce concentrated losses from cyberattacks.

Article 8 requires VASPs to purchase insurance, join mutual aid arrangements, or set aside reserves to cover liability arising from hacking attacks and network failures. Regulatory rules use hot wallet assets as the calculation basis and require a minimum level of protection. Cold wallet ratios, hot wallet scale, and insurance reserves need to be continuously adjusted as customer assets change.

Article 9 governs the generation, storage, and destruction of transaction records. While on-chain data may persist for a long time, platforms must still retain customer instructions, account changes, authorizations, and exception handling records. User asset protection ultimately depends on the ability of three sets of records—on-chain balances, internal ledgers, and bank deposits—to reconcile with one another.

6. Market Manipulation and Abnormal Trading Enter Continuous Monitoring

Article 10 of the Virtual Asset User Protection Act prohibits unfair practices such as using material non-public information, manipulating prices, and wash trading, and also restricts VASPs from trading virtual assets issued by themselves or related parties. Violators may face criminal liability, fines, penalties, and civil damages. When the scale of illegal profits is large, penalties increase significantly.

Article 11 restricts VASPs from blocking customer deposits and withdrawals of virtual assets without justifiable grounds. When platforms adopt restrictive measures, they need to explain the reasons and report to the FSC. System maintenance, network congestion, and risk control must all form verifiable operational bases to avoid customer assets remaining in an unwithdrawable state for extended periods.

Article 12 requires VASPs operating virtual asset markets to continuously monitor abnormal prices and trading volumes and to take measures to protect users and maintain trading order. After discovering transactions suspected of violating the law, platforms need to report to the FSS. Monitoring models, manual review, token project materials, and account linkage analysis therefore become routine compliance capabilities for exchanges.

The FSS obtains business, property, and transaction materials through examinations and investigations, the FSC handles administrative sanctions, and cases suspected of crimes also enter prosecutorial and judicial proceedings. Trading platforms carry out front-line monitoring, and regulatory agencies then verify, a division of labor that is gradually approaching the market surveillance structure of the securities market.

7. Securities Tokenization Enters 2027 Along the Capital Markets Act

Figure 5 | South Korea's dual-track regulatory structure for virtual assets and securities tokenization

The accompanying rules published in October 2026 allow stocks, bonds, fund units, and fractional investment products such as non-monetary trust beneficiary certificates and investment contract securities to be issued and circulated in tokenized form. Legal rights continue to be registered in the regulated securities account system, while distributed ledgers become the registration and transfer technology.

The relevant ledgers need to be shared jointly by at least two account management institutions and the Korea Securities Depository. Regulators hope to ensure registration continuity and rights confirmation through multi-party joint maintenance. Use of the ledger cannot directly charge fees to investors, avoiding situations where fee disputes at the basic registration stage affect securities rights.

Issuers may apply to become an "issuer account management institution" and directly manage securities accounts for customers. Applicants must have minimum equity capital of 4 billion Korean won and at least one account management professional, one internal control professional, and two information technology personnel. Issuance, ledger management, and customer accounts thus enter clear organizational and personnel requirements.

The secondary market will add a bond OTC trading license unit, alongside trading venues for non-listed stocks and non-monetary trust beneficiary certificates. To protect retail investors, the annual net purchase cap for each OTC trading venue is set at 100 million Korean won. The public comment period for the rules runs from October 2 to November 11, 2026, with planned effect on February 4, 2027.

The FSC roadmap adopts phased implementation. The first phase prioritizes institutional private money market funds, bonds, non-listed stock trusts, and public fractional investment products, before expanding to other public securities. The long-term plan also considers connecting on-chain payment instruments with securities settlement, with specific timing advancing alongside the stablecoin regime and market readiness.

8. Entering the South Korean Market Requires Mapping the Business Chain First

An exchange or brokerage platform should first confirm whether it conducts Korean won exchange. When Korean won deposits and withdrawals are involved, KoFIU reporting, ISMS certification, and bank real-name accounts must advance in parallel; services conducting only coin-to-coin trading still require VASP registration and an anti-money laundering system, while account requirements are judged based on actual fund functions.

Custody and wallet companies should verify whether they hold customer private keys, whether they can independently initiate transfers, and whether they perform staking or exchange on behalf of customers. When they possess substantive control capability, VASP custody and management rules, user asset segregation, cold wallet ratios, and insurance reserves will enter product design. Splitting signatures into multiple technical modules still requires clarifying who completes the final authorization.

Enterprises issuing tokens should first complete rights classification. When holders receive dividends, interest, asset returns, or shared business results, securities attributes need to be assessed; for ordinary virtual assets, the focus is on trading platform access, information disclosure, and user protection. Marketing to South Korean residents, providing Korean-language interfaces, and connecting to local payment channels will also increase local regulatory attention.

Securities token projects must also determine the issuing entity, account management institution, KSD connection, and trading venue. The choice of distributed ledger is constrained by joint maintenance and rights continuity requirements, and projects cannot complete statutory registration relying solely on smart contracts on public chains. On-chain records, securities accounts, and investor registers need to remain consistent.

South Korea has already formed a clearly layered regulatory framework. VASP registration governs who may enter the market, the user protection act governs customer funds, assets, and trading order, and the Capital Markets Act captures tokens carrying securities rights. The new changes in 2026 continue to tighten operator financial and shareholder conditions while opening regulated issuance and circulation channels for securities tokenization. When enterprises enter South Korea, what must first be resolved remains what the asset is, who controls customer funds, and which law each activity falls under.

This article is intended solely for legal, policy, and industry research and exchange, aiming to provide objective analysis of digital finance, stablecoins, digital assets, and related regulatory developments. It does not constitute any form of investment advice, legal opinion, tax opinion, or other professional advice, nor does it constitute any recommendation, promotion, or solicitation of any financial product, digital asset, or commercial project. The regulatory rules, market data, and institutional information mentioned in the text are mainly derived from public sources and may be adjusted due to changes in laws and regulations, regulatory policies, market conditions, and project progress. Readers should make independent judgments based on the latest public information and comply with the laws and regulations applicable in their country or region. The author and publishing platform assume no responsibility for any investment, trading, or other business decisions made in reliance on the content of this article.