AMENDMENTS TO ENFORCEMENT DECREE OF FINANCIAL TRANSACTION REPORTS ACT AND IMPLEMENTATION OF VASP REGISTRATION MANUAL

– KEY PROVISIONS AND IMPLICATIONS

I.    BACKGROUND

Amendments to the Enforcement Decree of the Financial Transaction Reports Act (the Enforcement Decree so amended and restated, the “Amended Enforcement Decree”) intended to strengthen the registration regime for virtual asset service providers (“VASPs”) and enhance anti-money laundering (“AML”) requirements applicable to virtual-asset transfers, entered into force on August 20, 2026.1

The Amended Enforcement Decree prescribes matters delegated under the recent amendments to the Financial Transaction Reports Act, including (i) the grounds for not accepting registration and the scope of persons subject to review, and (ii) the delegation of authority to notify sanctions in respect of former officers and employees. It also clarifies (iii) the imposition of AML obligations in connection with virtual-asset transfers and (iv) the methods and scope of customer due diligence. Items (i) and (ii) took effect on August 20, 2026, while the remaining provisions will take effect six months after promulgation, on February 19, 2027.

Meanwhile, the financial authorities published a revised VASP Registration Manual (the “Revised Registration Manual”) reflecting the foregoing amendments to the laws and regulations. The Revised Registration Manual was also implemented on August 20, 2026.

II.    KEY PROVISIONS OF THE AMENDED ENFORCEMENT DECREE

1.    VASP Registration

(1)    Major Shareholders Subject to Registration Review

Under the amended Financial Transaction Reports Act, major shareholders of VASPs are now subject to review as part of the VASP registration process, and the Amended Enforcement Decree specifies the scope of major shareholders subject to such review.

In principle, major shareholders are divided into (i) the largest shareholder (i.e., the person that holds the largest number of shares when the shares held by that person and specially related persons2 are aggregated) and (ii) a significant shareholder (i.e., a shareholder or equity holder owning 10% or more of the total ownership interest, or a shareholder or equity holder that exercises de facto influence over management in material respects as prescribed by the Enforcement Decree). For this purpose, the phrase “a shareholder or equity holder that exercises de facto influence over management in material respects as prescribed by the Enforcement Decree” under the definition of significant shareholder includes a shareholder who, individually or pursuant to an agreement or contract with other shareholders (including equity holders), appoints the representative director or a majority of the directors, or a shareholder who exercises de facto influence.

Meanwhile, the scope of major shareholders subject to VASP registration review includes not only (a) the major shareholders described above, but also (b) shareholders who are specially related persons of the largest shareholder3, and (c) where the largest shareholder is a corporation, the largest shareholder4 of that corporate entity and its representative. Accordingly, it should be noted that the scope of persons subject to review in connection with the largest shareholder has been substantially expanded.

(2)    Grounds for Not Accepting Registration

A.    History of Violations of Law

A VASP, its representative, officers and major shareholders must not have been subject to criminal penalties of a fine or more severe punishment for violations of AML, financial or other relevant laws. Failure to satisfy this requirement constitutes grounds for not accepting registration (the “Criminal History Disqualification Grounds”).

The amended Financial Transaction Reports Act significantly expands the scope of the Criminal History Disqualification Grounds. In addition to financial laws, the laws covered now include the Monopoly Regulation and Fair Trade Act, the Punishment of Tax Evaders Act, the Act on the Aggravated Punishment of Specific Economic Crimes, the Foreign Exchange Transactions Act, and the Act on Protection of Virtual Asset Users, among others. Unlike other statutes, however, the amended Financial Transaction Reports Act does not provide for any exceptions in respect of criminal history, which was expected to create operational difficulties.

During the regulatory review of the Enforcement Decree, the Regulatory Rationalization Committee recommended that exceptions be provided to the Criminal History Disqualification Grounds applicable to major shareholders. Consistent with that recommendation, the Amended Enforcement Decree provides that a major shareholder will not be disqualified where (i) the major shareholder was punished under a joint penal provision of a statute, or (ii) the Commissioner of the Korea Financial Intelligence Unit (“KoFIU”) determines that the violation was minor.

B.    Financial Soundness and Social Credibility Requirements

A VASP, its representative, officers and major shareholders must satisfy the applicable financial soundness and social credibility requirements, and failure to do so may constitute grounds for not accepting registration.

Specifically, a “VASP” must (a) have a ratio of total liabilities to equity capital or total capital contributions of 200% or less5, (b) have no record during the preceding three years of having harmed the soundness of the credit system through a default or similar event, and (c) not have been classified as a financially distressed financial institution6 during the preceding five years or have had its business license, authorization or registration revoked under financial laws7.

The debt-to-equity ratio requirement is particularly important. Previously, there were no specific financial soundness standards applicable to VASPs and, accordingly, no legal basis for taking measures against a VASP with impaired capital. Going forward, however, an application or amendment filing may not be accepted where a VASP or major shareholder fails to comply with the statutory debt-to-equity ratio. Recognizing the potential difficulty of meeting this requirement, existing VASPs have been granted a one-year grace period to comply with the debt-to-equity ratio requirement. Existing VASPs that currently do not meet the ratio must therefore reduce it to 200% or less during the one-year grace period, for example through a capital increase or debt repayment.

The “representative and officers” of a corporate VASP must satisfy the eligibility requirements8 under Article 5(1) of the Act on Corporate Governance of Financial Companies. Because a VASP’s “major shareholders” are now subject to review as part of the VASP registration process, eligibility requirements for major shareholders have also been established. Major shareholders are broadly classified as financial institutions, domestic corporations, Korean individuals, foreign corporations, institutional-only private equity funds, or special purpose companies,9 and each category must satisfy different financial soundness and social credibility requirements. The specific requirements are summarized below:

Among the social credibility requirements, the requirement in Appendix 1, Item (a)(3) of the Amended Enforcement Decree—that the person must have no responsibility in connection with a financially distressed financial institution and no history of harming the soundness of the credit system10 —applies to all categories of major shareholders.

By contrast, in the case of the largest shareholder of a corporate largest shareholder and its representative, who do not directly fall within the definition of a major shareholder but are nevertheless subject to major-shareholder review, the requirements are relaxed: the financial soundness requirements do not apply, and only the social credibility requirements apply.

C.    Personnel, Facilities, and Internal Control System Requirements

A VASP must (i) maintain personnel having appropriate expertise and fitness in virtual-asset transactions, as well as the IT personnel and organizational structure necessary to conduct its business (the “Personnel Requirements”); (ii) maintain the physical facilities necessary for virtual-asset transaction business, including IT equipment, office equipment, security equipment, and contingency facilities to prepare for possible incidents (the “Facilities Requirements”); and (iii) establish an internal control system, including procedures and methods for virtual-asset transaction business and user protection (the “Internal Control System Requirements”).

Previously, there were no express standards specifying the personnel, facilities or internal control system that VASPs were required to maintain. Under Article 27(9) and Appendix 3 of the proposed amendments to the Supervisory Regulations under the Financial Transaction Reports Act, however, detailed personnel, facilities and internal control system requirements have been established. These include maintaining a minimum of four personnel engaged in AML functions, including a compliance officer and a reporting officer (who may hold concurrent roles), and, where unique identification information or personal credit information is processed, locating the relevant IT equipment in Korea and securing sufficient rights to use such equipment, among other requirements.

These requirements will substantially increase the regulatory costs borne by VASPs, and a one-year grace period has been provided to give existing VASPs time to achieve compliance. Existing VASPs must therefore take the measures necessary to satisfy the Personnel Requirements, Facilities Requirements and Internal Control System Requirements during the one-year period. New VASPs registered on or after August 20, 2026, however, must satisfy all of these requirements from the outset.

(3)    Transitional Provisions

Under the supplementary provisions of the amended Financial Transaction Reports Act, the provisions relating to VASP registration, in principle, took full effect on August 20, 2026, and all registered VASPs must resubmit their registration applications to meet the amended registration requirements by November 20, 2026, within three months after the Act’s effective date.

However, Article 4 of the supplementary provisions to the amended Financial Transaction Reports Act provides an exception for VASPs that had already filed a registration before August 20, 2026. Where a circumstance giving rise to a Criminal History Disqualification Ground or a failure to satisfy the financial soundness or social credibility requirements arose before August 20, 2026 in respect of the VASP’s representative, officer or major shareholder,11 the previous requirements will continue to apply until the relevant person is replaced. Accordingly, an existing representative, officer or major shareholder will not be treated as disqualified on the basis of a circumstance that arose before August 20, 2026.

Article 5 of the supplementary provisions to the amended Act contains transitional provisions for registered VASPs similar to those in Article 4. Accordingly, a registered VASP will likewise not be treated as disqualified if a circumstance relating to the Criminal History Disqualification Grounds or the financial soundness and social credibility requirements arose before the Act took effect.

Meanwhile, under the supplementary provisions of the Amended Enforcement Decree, the provisions requiring VASPs to prepare for large cash transaction reporting, customer due diligence, the Travel Rule, and VASP obligations in connection with virtual-asset transfers involving overseas exchanges or private (unhosted) wallets will take effect on February 19, 2027, following a six-month preparation period.

2.    Notification of Sanctions Relating to Former Officers and Employees

The amended Financial Transaction Reports Act introduces provisions governing the notification of sanctions in respect of former officers and employees, and the Amended Enforcement Decree delegates certain notification authority to other institutions. Specifically, under the Amended Enforcement Decree, KoFIU’s authority to issue certain sanction notifications in respect of officers and employees of financial companies and other entities who leave their positions after committing a violation of the Financial Transaction Reports Act but before sanctions are imposed is delegated to the Financial Supervisory Service and other entrusted inspection institutions. The delegated authority covers (i) reprimand warnings, cautionary warnings and cautions for officers, and (ii) all sanctions applicable to employees.

Under the supplementary provisions of the amended Financial Transaction Reports Act, the foregoing notification provisions also apply to officers who leave office or employees who leave employment after the Act takes effect, where the underlying violation occurred before the Act took effect. Accordingly, all officers and employees subject to sanctions who leave their positions on or after August 20, 2026 will fall within the scope of these provisions.

3.    Imposition of AML Obligations on Virtual-Asset Transfers

(1)    Abolition of the Travel Rule Threshold and Imposition of Obligations on Receiving VASPs

The information-provision obligation applicable to virtual-asset transfers between registered VASPs (the “Travel Rule”) currently applies only to transactions of KRW 1 million or more but will be expanded to cover all transactions. Receiving VASPs will also be required to obtain the relevant information. This is intended to prevent regulatory evasion and potential misuse for money laundering12 through so-called structuring (splitting transfers to evade thresholds). If information is missing, the receiving VASP must take measures such as requesting that the information be provided or rejecting the transaction.

(2)    Enhanced Regulation of Transfers Involving Overseas VASPs or Private (Unhosted) Wallets

Where a registered VASP transfers virtual assets to or from an overseas VASP or private (unhosted) wallet, the scope of permitted transactions will vary depending on the level of risk, and the VASP will be required to establish and maintain its own framework for managing suspicious transactions for transactions of KRW 10 million or more. Specifically, a registered VASP must (i) permit virtual-asset transfers to low-risk overseas exchanges; (ii) permit transfers involving other overseas exchanges or private (unhosted) wallets only where the sender and recipient are the same person; and (iii) prohibit transactions assessed as high-risk.

This is intended to enhance the transparency of virtual-asset transfers through AML obligations in response to an increase in suspicious transactions exploiting gaps in the AML framework13,14  governing transfers involving overseas VASPs and private (unhosted) wallets.

4.    Clarification of Customer Due Diligence Requirements

The Amended Enforcement Decree clarifies that, when conducting customer due diligence under Article 5-2 of the Financial Transaction Reports Act, a VASP must properly verify the required customer information. It also clarifies that, in determining whether a customer is subject to enhanced due diligence under Article 5-2(1)(2) due to money-laundering concerns, the VASP must consider the risks associated with the customer’s characteristics, transaction patterns, and the products and services used by the customer.

III.    IMPLICATIONS

The Amended Enforcement Decree is the final version of the amendment proposal that was subject to a pre-announcement of legislation on March 30, 2026, following review by the Regulatory Rationalization Committee and the Ministry of Government Legislation. The Amended Enforcement Decree is significant in that it provides detailed standards delegated under the Act in two principal areas: strengthening entry requirements for VASPs and enhancing the transparency of virtual-asset transfers. In particular, the introduction of exceptions to the Criminal History Disqualification Grounds applicable to major shareholders, reflecting the recommendation of the Regulatory Rationalization Committee, is a noteworthy change from the originally pre-announced proposal.

With the amended Financial Transaction Reports Act and its subordinate regulations now in force, the registration requirements that VASPs must satisfy have been substantially strengthened. Existing VASPs must therefore resubmit applications prepared in accordance with the amended provisions by November 20, 2026, and should begin preparing their submissions now. As explained above, however, where an existing VASP or its representative, officer or major shareholder had a disqualifying circumstance that arose before the Act took effect, that circumstance will not be treated as grounds for not accepting registration even if it is disclosed in the application. Where it is unclear whether the relevant disqualifying circumstance falls within the exception under the supplementary provisions, we recommend seeking specific legal advice.

Existing VASPs that plan to change their representatives, officers or major shareholders should note that the grounds for not accepting registration under the amended laws and regulations will apply in full to any new representative, officer or major shareholder. Accordingly, when considering a share transfer with a prospective counterparty, an existing VASP should confirm in advance whether the counterparty is subject to any of the newly introduced disqualification grounds. Even where no such disqualifying circumstance exists, in practice, documents evidencing the absence of Criminal History Disqualification Grounds for at least the preceding five years must be obtained from both the jurisdiction of nationality and the jurisdiction of employment of each person subject to review. Because obtaining these documents may require considerable time, sufficient time should be allocated to prepare the relevant supporting materials.

Although the expanded Travel Rule and regulations governing transfers involving overseas exchanges and private (unhosted) wallets are scheduled to take effect on February 19, 2027, they will require system upgrades. In light of the time needed to establish a risk-assessment framework for overseas counterparties, enhance transaction monitoring, integrate STR systems, and undertake related work, VASPs should begin preparations well in advance.

Bae, Kim & Lee LLC has extensive experience advising on VASP registrations, including the recently accepted registration of a global virtual-asset custody provider. If you require assistance in connection with this newsletter, please do not hesitate to contact us. We remain committed to providing our clients with the highest level of expertise and support.

*    *    *

For any inquiry or questions regarding the content of this newsletter, please contact us.

[Korean Version]

Author: Juho Yoon Partner, Jungmyung (Chloe) Lee Partner, Hyobong Kim Partner, Hee Kyung Choi Advisor, Heesug Chung Senior Foreign Attorney (New York)

1. For the legislative developments to date in this regard, please refer to our firm’s newsletters dated April 2, 2026 (“Key Provisions and Implications of the Proposed Amendments to the Enforcement Decree and Supervisory Regulations of the Act on Reporting and Using Specified Financial Transaction Information”) and December 5, 2025 (“Key Provisions and Implications of the Proposed Partial Amendment to the Act on Reporting and Using Specified Financial Transaction Information”).

2. Refers to a person who stands in any of the relationships with the person concerned set out in the subparagraphs of Article 3(1) of the Enforcement Decree of the Act on Corporate Governance of Financial Companies (Article 4(1) of the Amended Enforcement Decree).

3. Article 7(1), subparagraph 1-2 of the Financial Transaction Reports Act.

4. Where the person exercising de facto control over material management affairs of the corporate largest shareholder is not the same as that corporation's largest shareholder, such controlling person is also included (Article 10-11(2), subparagraph 1 of the Amended Enforcement Decree).

5. However, in calculating the ratio, user deposits held under Article 6 of the Act on Protection of Virtual Asset Users and unsettled balances of prepaid electronic payment means management business operators under the Electronic Financial Transactions Act are deducted from total liabilities.

6. Refers to a financially distressed financial institution as defined in Article 2, subparagraph 2 of the Act on the Structural Improvement of the Financial Industry.

7. Refers to the statutes listed in the subparagraphs of Article 5 of the Enforcement Decree of the Act on Corporate Governance of Financial Companies.

8. Accordingly, such persons must not be minors or persons under adult (limited) guardianship, persons who have been declared bankrupt and not yet reinstated, or persons for whom five years have not elapsed since being sentenced to imprisonment without labor or a heavier punishment, among others.

9. Where a major shareholder does not fall precisely within one of the five categories above, the standards for the most similar category will apply, and the VASP must assert and demonstrate such similarity to the relevant financial regulator.

10. More specifically, the person must not be a major shareholder, or a specially related person of a major shareholder, of a financially distressed financial institution or of a financial institution whose permission, authorization or registration has been revoked under financial laws; must not have been subject to a suspension of banking transactions due to a default or similar event during the preceding five years; and must not, during the preceding five years, have been a company subject to bankruptcy proceedings or debtor rehabilitation proceedings, or have been directly or indirectly involved in such proceedings as the largest shareholder or a significant shareholder of such company. Certain exceptions are recognized.

11. There are various interpretations under other statutes as to the specific meaning and standards of circumstances arising before the entry into force of the Act, and this is an area that will require further review and monitoring.

12. KoFIU has cited, as a suspected case of regulatory evasion through structuring, an instance in which approximately KRW 200 million was deposited with a virtual-asset exchange over roughly three months to purchase virtual assets (USDT), which were then withdrawn approximately 216 times in amounts of less than KRW 1 million each. KoFIU explains that, considering that (i) only one-way transactions were conducted, involving deposits of Korean won and withdrawals of virtual assets, and (ii) the entire holding was transferred in amounts of less than KRW 1 million (which is inefficient in terms of fees and time), the transfers are suspected to constitute structuring intended to evade money-laundering detection and thereby circumvent regulation.

13. KoFIU has cited, as a suspected money-laundering case involving private wallets, an instance in which a customer purchased virtual assets at a virtual-asset exchange, withdrew them in amounts of less than KRW 1 million each to numerous private wallets of unidentified origin, and then consolidated those holdings into a single private wallet, repeating this pattern over three months. KoFIU explains that money laundering is suspected given that the assets were split and withdrawn over several months to numerous private wallets of unidentified origin before being consolidated into one private wallet.

14. KoFIU has cited, as a suspected money-laundering case involving transactions with overseas exchanges, an instance in which a member of a criminal organization used criminal proceeds to purchase virtual assets at a virtual-asset exchange and then transferred them to a high-risk overseas virtual-asset exchange presenting money-laundering concerns. KoFIU explains that the transfer of funds presumed to be the proceeds of voice-phishing or similar crimes to a high-risk overseas virtual-asset exchange with inadequate AML controls is suspected to constitute an attempt to launder criminal proceeds.