Crypto and VASP rules in South Korea for foreign companies

The Korean crypto market

Korean retail investors trade crypto in volumes that rival the domestic stock market on busy days, and Korean-won prices have repeatedly traded at a premium to global prices — the kimchi premium (김치 프리미엄, gimchi peurimieom) — because capital controls and the closed exchange system make arbitrage difficult. Trading is concentrated on a handful of domestic exchanges with won markets, led by Upbit, and the government’s semi-annual survey counted 27 reported virtual asset service providers at the end of 2025: 18 exchanges and 9 custody or wallet providers.

That closed market is a policy choice. After the 2017–18 boom, Korea built a regime that ties exchanges to banks, requires real-name accounts and treats serving Korean users from abroad without a report as a criminal offence. It has since added investor-protection rules and is working on a second phase covering stablecoins and token issuance. For a foreign company the questions are whether it is a service provider at all, whether it serves Korean users, and what it can do in Korea without crossing the line.

How Korea got here

The regime is a series of reactions. In September 2017, at the height of the first boom, the government announced that initial coin offerings would be banned — a policy statement enforced through the financial authorities rather than a statute — and in January 2018 it ended anonymous trading accounts, requiring exchanges to use real-name bank accounts. Hacks of Korean exchanges and the losses of retail investors kept pressure on, and the 2020 amendment to the Specified Financial Information Act, aligned with the FATF standards for virtual asset service providers, turned the bank-account practice into a reporting regime that forced dozens of smaller exchanges to close or stop won trading in September 2021.

The collapse of Terra and Luna in May 2022 — a project founded by Koreans, with heavy Korean retail losses — and the delisting of tokens such as WEMIX by the domestic exchanges’ alliance pushed lawmakers to the User Protection Act, passed in 2023 and in force in 2024. Each layer has made the Korean market safer for domestic users and harder for foreign platforms to enter, and the pattern is likely to continue: the second phase is designed to bring stablecoins and token issuance inside the same perimeter, not to open it.

Who is a virtual asset service provider

The Act on Reporting and Using Specified Financial Transaction Information — the Specified Financial Information Act — defines a virtual asset service provider (가상자산사업자, gasang jasan saeopja) as a person who, as a business, buys or sells virtual assets, exchanges them, transfers them, keeps or manages them, or intermediates or brokers such transactions. Exchanges, brokers, custody providers and wallet services that control customers’ keys are inside the definition. Pure software providers, node operators, analytics firms and non-custodial wallet developers that never control customer assets are usually outside it, though the line between infrastructure and service is examined case by case.

Since March 2021, with a grace period to September 2021, every VASP must report to the Korea Financial Intelligence Unit (금융정보분석원, geumyung jeongbo bunseogwon) (KoFIU) before doing business. The report requires an ISMS certification (정보보호 관리체계 인증, jeongbo boho gwalli chegye injeung) from the Korea Internet & Security Agency — a process of about six months, valid for three years with annual audits — and, for providers handling Korean won, a real-name verified deposit and withdrawal account (실명확인 입출금계정, silmyeong hwagin ipchulgeum gyejeong) with a Korean bank. The report can be refused if officers have been convicted of financial crimes within five years; foreign documents must be translated and notarised. Reports are renewed periodically. From 20 August 2026 an amendment extends suitability screening to major shareholders — their criminal record, finances and creditworthiness — and requires disclosure of shareholders’ identity, nationality and stake.

A crypto-only exchange can report without a bank account but cannot offer won markets.

Foreign exchanges and Korean users

The Act applies to conduct abroad that affects Korea, and KoFIU treats a foreign exchange as serving Korean users if it runs a Korean-language website, promotes itself to Koreans or lets them buy crypto with Korean credit cards. In 2022 KoFIU referred 16 offshore exchanges — including KuCoin, MEXC, Poloniex, Phemex and others — to investigators and asked for their sites to be blocked. In 2025 Google Play removed 17 unreported exchange apps from the Korean store from 25 March, and Apple removed 14 from 11 April. Operating as an unreported VASP is punishable by up to five years’ imprisonment or a KRW 50 million fine, and further measures are planned: blocking high-risk offshore exchanges, giving KoFIU power to freeze accounts during investigations, and barring people with drug or tax-crime records from major shareholdings.

The safe options for an offshore exchange are therefore to report — in practice, to acquire or partner with a reported Korean exchange — or to keep out: geo-block Korea, remove Korean-language content and promotions, and refuse Korean payment methods. Binance’s route is instructive: it bought a 67% stake in the reported exchange Gopax in February 2023 and waited more than two years, until October 2025, for KoFIU to approve the change of executives.

The Virtual Asset User Protection Act

The Virtual Asset User Protection Act, in force since 19 July 2024, added the first layer of conduct regulation. Customers’ cash must be segregated and held by a bank, which invests it only in safe assets such as government bonds and pays a usage fee that goes to customers. At least 80% of customers’ virtual assets must be held in cold storage, and VASPs must carry insurance or reserves covering at least 5% of the assets in hot wallets, with a floor of KRW 3 billion for won exchanges and KRW 500 million for others. The Financial Services Commission and Financial Supervisory Service supervise compliance and can suspend operations.

Unfair trading — use of undisclosed material information, market manipulation, fraudulent trading and self-dealing by VASPs — is punishable by at least one year’s imprisonment or a fine of three to five times the gain, rising to at least three years where the gain is KRW 500 million to 5 billion and five years to life above that, plus administrative surcharges of up to twice the gain. VASPs must monitor for abnormal trading and report it. Token issuers, market makers and project teams are within the unfair-trading rules even though they are not VASPs, which matters for listings on Korean exchanges, where Korean exchanges’ joint listing standards add their own disclosure and lock-up expectations.

The travel rule and AML

Korean VASPs must exchange originator and beneficiary information for transfers of KRW 1 million or more to and from other VASPs, and in practice Korean exchanges restrict withdrawals to foreign exchanges that are not connected to their travel-rule solutions, and to unverified private wallets. A decree amendment approved in August 2026 extends the travel rule to all transfers, effective six months after promulgation. Separately, a June 2026 revision of the Foreign Exchange Transactions Act will require businesses transferring virtual assets across borders to register and report transfers to the Bank of Korea’s foreign exchange information system, including transfers to overseas businesses and private wallets, with the data shared with the tax, customs and financial authorities; the decree was under consultation in October 2026. For a foreign exchange that wants Korean customers to be able to move assets in, travel-rule interoperability with Korean exchanges is a precondition.

Phase two: stablecoins, security tokens, corporate accounts

The second legislative phase is in progress. The Digital Asset Basic Act (디지털자산 기본법, dijiteol jasan gibonbeop), introduced in June 2025, would create a licensing framework for digital asset businesses and rules for won-denominated stablecoins; it has been held up by disagreement over whether banks must control stablecoin issuers, with the Bank of Korea pressing for bank-led consortia. The ruling party promised passage in the second half of 2026, and reports in October expected a November vote, but it had not passed when this guide was written. An earlier draft would have let foreign stablecoins be offered in Korea only through issuers licensed in Korea with a local branch or subsidiary.

Security tokens have moved faster: amendments to the Electronic Securities Act and the Financial Investment Services and Capital Markets Act passed in January 2026 and take effect around early 2027, allowing tokenised securities to be issued and traded within the securities framework. Corporate access to crypto is being opened in stages under a February 2025 roadmap — law-enforcement agencies and exchanges could sell in 2025, non-profits and universities could open accounts, and a pilot for listed companies and professional investors was planned, with draft guidelines capping investment at 5% of equity in top-20 coins through the main domestic exchanges. Spot crypto ETFs require a change to the Capital Markets Act and have no date. None of these openings applies to foreign corporates yet.

Tax

Korea has repeatedly deferred taxing individuals’ crypto gains. Under the law as amended in December 2024, gains from transferring or lending virtual assets are taxed as other income at 22% including local income tax on annual gains above KRW 2.5 million, from 1 January 2027, with the cost of assets held before then taken as the higher of actual cost and the market value at 31 December 2026; the first returns are due in May 2028. The government’s 2026 tax reform proposals did not defer it again, though an opposition bill proposes 2030. Companies are taxed on crypto gains as ordinary corporate income at corporate tax rates. VASPs will have reporting duties to support the individual tax. Foreign VASPs serving Korean residents, if reported, will be expected to provide the same transaction data. See income tax for foreigners and corporate tax rates.

What a foreign crypto company can do in Korea

• Build technology with a Korean team. A Korean subsidiary doing software development, research, security or analytics for a foreign group is an ordinary company — provided it does not hold customer assets or provide exchange or custody services. Banks may still be cautious about opening accounts for crypto-adjacent companies; see corporate bank accounts.
• Partner with or invest in a reported Korean VASP. This is the realistic route to Korean users. Acquisitions require KoFIU approval of changes of executives, and from August 2026 major-shareholder screening.
• Provide services to Korean VASPs. Liquidity, custody technology, travel-rule solutions and compliance tooling for Korean exchanges are open to foreign firms, subject to the exchange’s own vendor and security requirements.
• List a token on a Korean exchange. Listings follow the exchanges’ joint standards and the unfair-trading rules; Korean-language disclosures and a Korean point of contact are expected.
• Run Web3 games carefully. Play-to-earn games cannot be rated for Korea, so tradeable token rewards are switched off for Korean users; see publishing a game in Korea.

Banks, foreign exchange and money in and out

Korean banks are the gatekeepers. Real-name accounts for won exchanges are granted at the bank’s discretion after its own risk assessment, and the market has organised itself around one bank per exchange — a matter of practice rather than law. Under the corporate-access roadmap, banks also check the purpose and source of funds for corporate accounts used to trade. Foreign investment into a Korean crypto business is reported under the foreign exchange rules like any other, and the new cross-border virtual asset reporting adds a layer for businesses moving crypto across the border; see foreign exchange rules for foreign-owned companies.

Data, marketing and consumer law

Crypto businesses that are allowed to serve Koreans face the same consumer and data rules as other online businesses, applied strictly. Korean users’ identity data collected for KYC is personal information under the Personal Information Protection Act, and transferring it to a foreign group company or KYC vendor is a cross-border transfer requiring disclosure and a lawful basis; see PIPA for foreign companies. Advertising that promises returns, uses celebrities without disclosing payment or targets minors draws attention from the Fair Trade Commission and the financial authorities, and influencer promotion of unreported platforms is itself evidence of targeting Koreans.

A worked example

A Singapore-based derivatives exchange has a Korean-language interface, Korean social media accounts and a growing number of Korean users, and is considering a Korean subsidiary for customer support. Its advisers tell it that the Korean interface and promotions already bring it within KoFIU’s view of serving Korean users, that it cannot report as a VASP without ISMS and a full Korean compliance framework, and that derivatives on crypto are not something a Korean VASP is allowed to offer domestically in any case.

The exchange removes the Korean interface, stops Korean promotions and card payments, geo-blocks Korean IP addresses and offboards Korean residents identified through KYC. It drops the support subsidiary and instead opens a small Korean development company that builds risk-engine software for the group, with no customer contact and no custody. Two years later, when the Digital Asset Basic Act creates a licensing route, it can reconsider Korea from a clean record rather than a referral to prosecutors.

Mistakes we see

1. A Korean-language site and Korean promotions without a KoFIU report.
2. Assuming offshore incorporation puts Korean users out of reach of the Act.
3. A Korean marketing or support subsidiary for an unreported platform.
4. Underestimating ISMS — six months and annual audits, not a form.
5. Planning on a won market without a bank willing to give a real-name account.
6. Ignoring unfair-trading rules for issuers and market makers in Korean listings.
7. Treating play-to-earn as a game feature rather than a rating blocker.

Korean terms you will meet

Questions readers ask

About the author

Alexander Baranov

Founder of the BCA Group · cross-border corporate and tax adviser since 2008

Alexander advises foreign founders and groups on company formation, tax structuring and corporate law in more than 40 jurisdictions across Europe, the Gulf, Asia and Latin America. He is the author of nine books on international business and tax and writes regularly for professional finance and tax journals. He works in English, German, Spanish and Russian.

This guide is based on the Korean statutes cited in the text and on our own filings. It is reviewed when the law or official rates change.

Ask Alexander on WhatsAppContact