As of July 19, 2024, the Act on the Protection of Virtual Asset Users (the “Act”) which mainly focuses on protecting virtual asset investors (each, a “User”) has become effective. In parallel with the implementation of the Act, the Enforcement Decree of the same Act declared on July 2, 2024 (the “Decree”) and the Supervisory Regulations on the Virtual Asset Industry notified on July 10, 2024 (the “Regulations”) have come into effect as well.
The Act focuses on enhancing the protection of Users by setting forth mainly a) the obligations of virtual asset service providers (“VASP”), b) prohibition on unfair trading practices, and c) the Financial Services Commission’s (“FSC”) authority to supervise and inspect VASPs.
I. MAIN HIGHLIGHTS OF THE ACT
A. Definition of Virtual Asset and Virtual Asset Service Provider
The Act defines "Virtual Asset" as electronic certificates that have economic value and that can be traded or transferred electronically, and stipulates exceptions thereto (Article 2(1) of the Act). While this definition is the same as stipulated under the Act on Reporting and Using Specified Financial Transaction Information (“FTRA”), the Act excludes electronic currency issued by the Bank of Korea and related services. Accordingly, central bank digital currencies will be excluded under the Act. In addition, while there exist some exceptions; Article 2, Subparagraph 4 of the Decree also excludes non-fungible tokens (NFT) that are unique and thus cannot be exchanged with other electronic certificates, including those mainly for collection and those for the sole purpose of validating transactions between parties.
Further, Article 2, Subparagraph 2 of the Act defines "Virtual Asset Service Provider” as an entity engaging in the following activities: (i) selling and purchasing virtual assets (“trading”); (ii) exchanging virtual assets with other virtual assets; (iii) transferring virtual assets as prescribed by a presidential decree; (iv) keeping custody of or managing virtual assets; or (v) acting as a broker, an intermediary, or an agent for the activities described in (i) and (ii).
B. Obligations of a VASP to protect assets of Users
The Act aims to protect Users by requiring VASPs to: (i) deposit and entrust Users’ funds, (ii) hold the same type and quantity of the virtual assets deposited by Users, (iii) enroll in insurance/mutual aid programs or accumulate reserves against accidents such as hacking and computer failure, and (iv) create and retain transaction records.
1) Obligation to deposit and entrust Users’ funds
A VASP must deposit and manage Users’ funds separately from its own account by depositing Users’ funds with, or entrusting them to, a reputable custodian (including banks) prescribed by presidential decrees in accordance with the methods prescribed by presidential decrees (Article 6(1) of the Act). VASPs must not transfer, or offer as collateral, funds deposited or entrusted except as prescribed by presidential decrees. Such funds deposited with a custodian may not be offset or attached (including provisional attachment).
When depositing Users’ funds with, or entrusting them to, a custodian, a VASP must enter into an agreement with the custodian that sets forth certain conditions, including: a) to keep custody of the deposits separately from the custodian’s own account, and b) to manage the deposits in safe assets such as government bonds and pay the profits therefrom to the VASP (Article 8(2) of the Decree).
2) Obligation to safekeep Users’ virtual assets separately and hold the same types and quantities of virtual assets
VASPs must maintain custody of the virtual assets of Users separately from their own virtual assets, and must ensure that they actually hold the same types and quantities of virtual assets entrusted by Users (Article 7(2) of the Act). Furthermore, VASPs must store in a cold wallet (offline) at least 80% of the economic value of Users’ virtual assets, which is calculated as the total amount of each virtual asset type currently held multiplied by the average daily KRW conversion rate over the past year as of the end of the preceding month (Article 7(3) of the Act, Article 11(1) of the Decree, and Article 9(1) of the Regulations).
3) Obligation to enroll in insurance/mutual aid programs or accumulate reserves against accidents such as hacking and computer failures
VASPs must take necessary measures such as enrolling in insurance/mutual aid programs or accumulating reserves to satisfy their liabilities in the event of accidents, such as hacking and computer failures (Article 8 of the Act). The specific scope of accidents to be insured is stipulated in the Article 12 of the Decree, and includes accidents arising from breaking into information and communication networks for virtual asset transactions or electronic devices such as computers and using access media obtained by deception or other fraudulent means. Pursuant to Article 10(2) of the Regulations, depending on their business types, different requirements apply to VASPs regarding the total sum of i) the coverage limit of insurance or mutual aid program, ii) the amount of reserve funds to be accumulated, and iii) the amount of funds to be deposited or entrusted. For “KRW market” exchanges, the sum must be greater than a) 5% of the economic value of Users’ virtual assets in custody (excluding those stored in cold wallets) or b) KRW 3 billion; for other business including “coin market” exchanges, KRW 500 million or more.
4) Obligation to create and retain virtual asset transaction records
VASPs must retain records of transactions for 15 years from the time the relevant transactional relationship is terminated (Article 9(1) of the Act). The types of items to be included in virtual asset transaction records are listed in detail in Article 13 of the Decree, including the User in a virtual asset transaction, the counterparty to the transaction, the date, type, quantity and amount of the transaction.
C. Regulation on Unfair Trading Practices
The Act adopts the prohibitions on the Use of Material Nonpublic Information, Market Price Manipulation, and Unfair Trading similarly to the Financial Investment Services and Capital Markets Act (“FISCMA”) (Article 10 of the Act). Under the Article 17 of the Act, the FSC has the power to impose a penalty surcharge in the amount of KRW 4 billion or up to twice the profit gained from or loss avoided through the violation (Article 17 of the Act). However, it should be noted that the prohibition on Market Disturbances under the FISCMA is not included in the Act.
In addition, VASPs shall not trade or engage in other transactions of virtual assets issued by itself or its specially related persons (Article 10(5) of the Act), and shall not block a User’s deposits or withdrawals of virtual assets without good cause (Article 11(1) of the Act). Article 17 of the Decree specifies the justifiable grounds for blocking such deposits or withdrawals, including when it is impossible to use the virtual assets-related information system in the event of a computer failure or repair and maintenance.
Furthermore, VASPs must continuously monitor abnormal transactions, which include instances of unusual fluctuations in the prices or trading volumes of virtual assets, and take appropriate measures (Article 12(1) of the Act). If VASPs suspect an unfair trading practice, they must notify the FSC and the Financial Supervisory Service (“FSS”) without delay of these suspicions (former part of the Article 12(2) of the Act). However, in cases where the suspected unfair trading practice is sufficiently substantiated, they must report such violation to an investigative agency without delay and subsequently report such fact to the FSC and the Governor of the FSS (latter part of the paragraph above).
D. FSC’s Authority to Supervise and Inspect Virtual Asset Service Providers
Under the Article 13(1) of the Act, the FSC has the authority to supervise and inspect VASPs. The FSC may impose penalties and measures, such as corrective orders, warnings, cautions, or business suspension if it identifies a violation of the Act (Article 15(1) of the Act). Specific matters on the methods and procedures for conducting inspections, and the inspection findings are delegated to the FSC notification (Article 13(5) of the Act), which provides that the Regulation on Audits and Sanctions on Financial Institutions and its Detailed Enforcement Rules shall be applied mutatis mutandis and thereby “financial institutions” are to be interpreted as VASPs (Article 11 of the Regulations).
The power to inspect VASPs is delegated to the Governor of the FSS. However, the Governor of the FSS and the Commissioner of Korea Financial Intelligence Unit may notify each other of their inspection plans under Article 19(1) of the Decree or under Article 15(1) of the FTRA (as the case may be) in order to avoid duplicate inspections into VASPs.
E. Establishment of a Virtual Asset Committee
The FSC may establish and operate a virtual asset committee to provide advice on policies and systems for VASP (Article 5(1) of the Act). The committee shall consist of no more than 15 members, including one chairperson, who shall be the Vice Chairperson of the FSC. Other matters such as the composition and operation of the committee are stipulated in detail in Article 4 of the Decree.
F. Data Submission to the Bank of Korea
The Bank of Korea may request data from VASPs if the Monetary Policy Committee deems it necessary for the implementation of monetary and credit policies, promotion of financial stability and smooth operation of payment and settlement systems in relation to virtual asset transactions (Article 16 of the Act).
II. UPCOMING SCHEDULES AND IMPLICATIONS
The Act is the first law to be enacted in Korea to protect Users and establish the order of the virtual asset market. With the second-phase legislation planned to supplement regulations on virtual asset-related disclosure and business practices, market participants are recommended to continuously monitor the subsequent legislative process.
Please note that under the Act administrative fines, penalties, and fines will be imposed on VASPs for negligence in their obligation to continuously monitor abnormal transactions or violations of the obligations described above to protect the virtual assets of Users. Therefore, it is recommended for market participants to make preparations in advance, such as putting in place internal control systems to prevent unfair trading practices and introducing executive and employee training programs to improve their awareness and implement various obligations to be fulfilled as VASPs.
* * *
Bae, Kim & Lee LLC's Future Financial Strategy Center (“Center”) provides legal advice to clients on new business models, financial techniques, and information and communication technologies in response to rapid changes in the financial markets and advances in technology. In particular, the members of the Center consist of experts from various related organizations, including the FSC, FSS, Ministry of Science and ICT, Ministry of the Interior and Safety, and the Personal Information Protection Commission, and provide comprehensive response strategies ranging from regulatory advice on finance, ICT, data, and AI to alternative models and legislative solutions. As experts referenced herein are also part of the team, please feel free to contact our experts for separate advice on legal issues arising in the field of digital finance.
