Global interest in combating illicit uses of virtual assets continues to grow, and South Korea is setting a global precedent with sweeping regulations on its virtual asset industry. Although in line with anti-money laundering and counterterrorism financing recommendations from the Financial Action Task Force (FATF), these regulations failed to provide most Virtual Asset Service Providers (VASPs) with ample registration time, which will likely result in a monopolization of the South Korean virtual asset industry under a select number of VASPs.
Following coordination with the FAFT, the South Korean National Assembly amended the “Act on the Reporting and Use of Specific Financial Transaction Information” to require all VASPs to receive Information Security Management System (ISMS) certifications and partner with Korean banks to create “real-name” verified bank accounts for customers. Under the amendment, all VASPs, including foreign VASPs operating in South Korea such as Binance, are required to register with the Korea Financial Intelligence Unit (KoFIU) for license approval within six months, a period that ended on September 24. After the registration deadline, VASP operators who continue conducting business without the license will be subject to criminal and fiscal penalties, including prison sentences up to five years and/or fines up to roughly $42,000. However, the new government requirements involve more than just receiving a proper license as registered VASPs are required to follow anti-money laundering guidelines, including verifying customer identity and filing reports on suspicious and/or large currency transactions.
To date, only four out of 63 recognized South Korean VASPs – UpBit, Bithumb, Korbit, Coinone – have successfully registered with the KoFIU and only Upbit has received an official license.
Seoul’s push for VASP regulations has raised concerns from smaller VASPs with fewer capabilities to register with the KoFIU and partner with Korean banks. To address these concerns, the KoFIU clarified that ISMS-certified VASPs without bank partnerships can still conduct virtual asset-to-virtual asset transactions. However, they are not allowed to facilitate transactions between virtual assets and Korean currency until they provide real-name bank account services. This fails to address issues regarding the difficulties in securing bank partnerships for smaller and less known VASPs.
According to the Financial Service Commissions (FSC), only 25 out of 63 Korean VASPs are ISMS-certified and the remaining VASPs without ISMS certifications must close after the September 24 deadline. Some experts claim that the six-month registration deadline failed to provide most VASPs with enough time to successfully complete the ISMS certification and bank partnership process. The ISMS certification process alone often takes three to six months and Korean banks are typically hesitant to engage with VASPs, especially small and less known providers, which can delay or prevent the partnership process.
Despite calls for an additional grace period, the FSC decided to maintain its original September 24 deadline. In addition to shutting down Korean VASPs that failed to register, the FSC announced its plans to block internet access for foreign VASPs operating in South Korea without the license. These strict regulatory measures are alarming to both VASP operators and customers. Given that Upbit is currently the only officially licensed VASP, other providers are concerned that this will lead to the monopolization of the South Korean virtual asset industry. To address consumer concerns regarding potential impacts on their finances, the FSC and the KoFIU urged VASPs that failed to register with the committee to notify users of their closure by September 17 to allow a 30-day window for withdrawing deposits and cryptocurrencies from their VASP-associated accounts. While this has likely allowed customers to withdraw funds from closing VASPs, reports indicate that they still hold fiscal worth up to $170 million.
Although South Korea currently leads government efforts to incorporate international standards on anti-money laundering and counterterrorism into virtual asset regulations, the impractical deadline for ISMS certification and bank partnerships will likely create unfair advantages within the Korean virtual asset industry. According to the South Korean opposition party, UpBit alone accounts for at least more than half of the roughly $5.1 billion in total deposits within South Korean VASPs. While these measures were an important step to addressing potential financial avenues for illicit activity, this hastened decision will likely create skewed market competition within the Korean virtual asset industry.