The FSC, KoFIU, and Crypto in 2026: VASP Reporting, User Protection, and What It Means

What it is

The Financial Services Commission (FSC) is South Korea's top financial regulator — an independent commission that sets financial policy and writes the enforcement decrees that turn Korean statutes into operating rules. Day-to-day supervision and inspection sit with its supervisory arm, the Financial Supervisory Service (FSS), and its anti-money-laundering unit, the Korea Financial Intelligence Unit (KoFIU), is the national FIU and the gatekeeper every crypto business must pass. Together they run one of the world's most consequential crypto regimes: South Korea is among the most active retail crypto markets anywhere, with official FIU/FSS surveys of registered exchanges counting more than ten million virtual-asset user accounts through 2025, and its two-statute framework — the Specific Financial Information Act for AML and the Virtual Asset User Protection Act for market conduct — has become a reference point for regulators across Asia.

Crypto framework and stance

Korea's framework rests on two pillars. The first is the Act on Reporting and Using Specified Financial Transaction Information — the Specific Financial Information Act — amended in March 2020 to bring virtual assets into the AML perimeter, effective 25 March 2021. It requires every virtual asset service provider (VASP), domestic or foreign, to register with KoFIU before operating; existing firms had until 24 September 2021 to register or shut down. Registration demands a real-name verified bank account contract with a Korean bank — the single most restrictive operational requirement in global crypto, since customers can only deposit or withdraw won through verified accounts at the exchange's partner bank — plus demonstrated AML/CFT capability. Korea also enforced the FATF travel rule early, from 25 March 2022, requiring originator and beneficiary information for transfers above KRW 1 million. The second pillar is the Virtual Asset User Protection Act (VAUPA), promulgated 18 July 2023 and in force since 19 July 2024. It requires VASPs to segregate customer deposits with banks as custodians, keep the large majority of customer crypto in cold storage, and it prohibits unfair trading — misuse of material nonpublic information, price manipulation and fraudulent trading — with criminal penalties of at least one year's imprisonment or fines of three to five times illicit gains. VAUPA also gives the FSC explicit authority to supervise and inspect VASPs.

Notable actions

Enforcement began almost immediately. The first unfair-trading case under VAUPA was completed by investigators on 1 November 2024 — a trader who allegedly received tokens from an overseas issuer and inflated their price on a domestic exchange using automated fake buy orders — The heaviest blow landed on the market leader: on 25 February 2025, KoFIU ordered a three-month partial business suspension of Upbit — barring new customers from transferring virtual assets to and from other platforms — after an inspection found roughly 45,000 transactions with 19 unregistered overseas VASPs and large-scale customer due diligence failures; a Seoul court granted Dunamu an injunction in March 2025 that stayed the order pending review. In November 2025 KoFIU followed with a 35.2 billion won (about US$24 million) fine tied to some 5.3 million alleged customer due diligence violations and missed suspicious transaction reports — findings Dunamu has disputed and challenged in court, which again suspended enforcement. The registration regime itself reshaped the market: the real-name banking requirement consolidated trading onto a handful of registered exchanges — Upbit, Bithumb, Coinone, Korbit and Gopax — with listing standards coordinated through the exchanges' self-regulatory body DAXA.

Key figures

Chairman Lee Eok-won (also romanized Lee Eog-weon), a former first vice minister of economy and finance, took office in September 2025 as the first FSC chief appointed under President Lee Jae-myung. His stance captures Korea's ambivalence: at his confirmation he drew backlash for saying crypto lacks intrinsic value, yet he supports developing a won-denominated stablecoin market. Vice Chairman Kwon Dae-young has said the government will accelerate the Digital Asset Basic Act, the second-phase legislation centred on won-stablecoin issuance. A government reorganization plan would meanwhile move the FSC's policy functions to the Ministry of Economy and Finance, restructuring the remaining body around supervision.

What it means for users and builders

For users, Korea's regime is protective but constraining: won deposits only flow through real-name verified accounts at a registered exchange's partner bank, customer deposits are held with banks under VAUPA, and market manipulation now carries serious criminal exposure. The Upbit sanctions show the rules bind even the dominant player. For builders, the entry barrier is the bank contract: KoFIU registration is necessary but not sufficient, because without a real-name account agreement from a Korean bank, fiat operations are impossible — a hurdle that has kept the market consolidated around five registered won-market exchanges. Foreign platforms targeting Korean users without KoFIU registration operate illegally. The opening to watch is institutional: the FSC began phasing in corporate access to crypto accounts in 2025, and in July 2026 signalled it would speed up both corporate accounts and the won-stablecoin framework.

Outlook

The second-phase framework is the story of 2026. The Digital Asset Basic Act — covering token issuance and a licensing path for won-denominated stablecoins — is expected to move through the National Assembly in 2026, though a dispute between the FSC and the Bank of Korea over stablecoin issuance rules has slowed it. Spot crypto ETFs remain pending: the government included spot Bitcoin and digital-asset ETFs in its 2026 economic growth strategy and plans to amend the Capital Markets Act in the second half of 2026 to permit them, and the Korea Exchange says it is ready to list and trade them — but no approval had been granted as of mid-2026. Add the possible reorganization of the FSC itself, and Korea enters late 2026 with the strictest-enforced VASP regime in Asia and its biggest liberalizations — ETFs, corporate accounts, won stablecoins — still in flight.

Frequently asked questions

Does the FSC regulate crypto in South Korea?

Yes. The FSC sets crypto policy and, under the 2024 Virtual Asset User Protection Act, has explicit authority to supervise and inspect virtual asset service providers, with the Financial Supervisory Service handling inspections. Its Korea Financial Intelligence Unit (KoFIU) handles VASP registration and AML enforcement under the Specific Financial Information Act.

What is the Virtual Asset User Protection Act?

Korea's first crypto-specific user-protection statute, in force since 19 July 2024. It requires VASPs to segregate customer deposits with banks and keep most customer crypto in cold storage, and it criminalizes unfair trading — manipulation, fraudulent trading and misuse of nonpublic information — with penalties of at least one year in prison or fines of three to five times illicit gains.

What is KoFIU and why does VASP registration matter?

The Korea Financial Intelligence Unit, situated under the FSC, is Korea's financial intelligence unit. Since the amended Specific Financial Information Act took effect on 25 March 2021, every VASP serving Korean users must register with KoFIU — which in practice requires a real-name verified bank account contract with a Korean bank. Operating without registration is illegal, and KoFIU has sanctioned even the largest exchange, Upbit, for compliance failures.