South Korea

Virtual Asset User Protection Act (VAUPA), effective July 2024. The VAUPA is Korea's comprehensive crypto-regulatory statute, covering: customer-asset segregation; insurance / capital requirements; market-manipulation and insider-trading prohibitions; suspicious-transaction reporting; ongoing FSC supervision of licensed VASPs. The Act applies to all virtual-asset business operators (VABOs) serving Korean customers.

Phased implementation. VAUPA is the second phase of Korean crypto regulation; the first phase was the 2020 amendment to the Reporting and Use of Specific Financial Transaction Information Act, which created the initial VABO registration regime with real-name account requirements. The 2024 VAUPA materially expanded the substantive content of obligations on VABOs.

FSC + FIU supervision. The Financial Services Commission handles substantive regulation and licensing; the Financial Intelligence Unit (within the FSC) handles AML / suspicious-transaction reporting. The FSC has been notably active in enforcement actions against both licensed VABOs (for compliance violations) and unlicensed operators targeting Korean users.

Real-name account framework. Korean banks must verify customer identities when providing KRW-deposit / KRW-withdrawal services to VABOs; the requirement effectively limits VABO market participation to those that have secured Korean bank partnerships (currently a small group — Upbit, Bithumb, Korbit, Coinone, Gopax, and a few others). The framework is a significant market-structure intervention.

VABO registration. Virtual-asset business operators serving Korean customers must register with the FIU under the 2020 framework, meeting requirements for: information-security management system certification (ISMS); real-name account arrangements with a Korean bank; AML / KYC programmes; suspicious-transaction reporting capability; customer-asset safeguarding standards. Registration requires substantial pre-engagement and typically takes 12-24 months.

Bank partnership constraint. Securing a Korean bank partnership for real-name account services is the primary practical barrier to VABO operation. Korean banks have been cautious about extending these partnerships due to AML reputational risk; the small set of partnered VABOs reflects this constraint.

Customer-asset segregation (VAUPA). Under VAUPA, VABOs must: hold 80%+ of customer crypto in cold storage; maintain insurance / capital reserves equivalent to 5%+ of customer balances to cover potential breaches; segregate customer assets from VABO general assets; provide quarterly reconciliations; meet specific cybersecurity certification (ISMS).

Limited Korean stablecoin issuance. No KRW-denominated stablecoin has obtained meaningful regulatory approval as of mid-2026. Korean authorities have been cautious about private KRW-pegged stablecoins, similar to Thailand's posture. USD-denominated stablecoins (USDT, USDC) are traded on licensed Korean exchanges as virtual assets but face additional scrutiny.

Post-Terra response. Do Kwon (founder of Terraform Labs and the UST/LUNA ecosystem) is Korean-domiciled. Korean prosecutors brought significant charges following the May 2022 collapse; the case substantially shaped Korean regulatory posture on algorithmic stablecoins. Algorithmic-stablecoin offerings face structural obstacles to Korean licensing.

CBDC research. The Bank of Korea has been active in CBDC research; a retail-CBDC pilot is in technical-testing phase as of mid-2026 with no commercial launch date announced.

Capital gains tax deferred to 2027. Korea has enacted a 20% capital-gains tax on crypto profits above ₩2.5 million annually for individual investors, with effect originally scheduled for 2022 but deferred multiple times. The current scheduled effective date is January 1, 2027; further deferral remains politically possible.

No current personal CGT. As of mid-2026, individual Korean residents are not subject to capital-gains tax on personal crypto-investment profits. This is a temporary state pending the deferred VAT framework's effective date.

Corporate tax. Korean corporations are subject to standard corporate tax on crypto-trading profits at the prevailing corporate tax rate.

Mining and other categories. Mining and staking rewards constitute taxable income at fair-market value on receipt under standard income-tax rules.

This is general background, not tax advice. The 2027 implementation date is subject to political revision. Consult a Korea-qualified tax adviser for personal matters.

Reporting Use of Specific Financial Transaction Information Act (Specific Financial Information Act). Korea's AML framework extends to VABOs as 'specific financial-information reporting entities.' Customer due diligence, transaction monitoring, suspicious-transaction reporting, and recordkeeping are mandatory.

Travel Rule. Korea implemented the FATF Travel Rule in 2022 with effective date March 2022. Originator and beneficiary information accompanies crypto transfers of ₩1 million+ between VABOs. The Korean Travel Rule implementation was one of the earlier major implementations globally and notably strict in its scope.

Sanctions framework. Korea implements UN-mandated sanctions plus targeted national-level measures, with particular attention to North Korea (given geographic proximity and the documented use of crypto by Lazarus Group and other DPRK-aligned actors). VABOs implement substantial DPRK-related screening.

Market-manipulation prohibitions. VAUPA's most distinctive feature is the explicit prohibition of market manipulation and insider trading in crypto, with criminal penalties including unlimited fines and up to life imprisonment for substantial violations. This is among the strictest market-conduct frameworks for crypto in any jurisdiction.

Information disclosure. VABOs must disclose conflicts of interest, related-party transactions, and material events that affect customer assets. The FSC has issued enforcement guidance interpreting the disclosure requirements expansively.

Customer-asset insurance. VABOs must maintain insurance arrangements covering hot-wallet exposure and potential breach events. The insurance requirement is calibrated based on the VABO's customer-asset balance and is among the more prescriptive in any jurisdiction.

Real-name account safeguards. The bank-partner real-name account arrangement provides a layer of customer-identity verification at the on/off-ramp, materially complicating money-laundering attempts compared to anonymous-account markets.

FSC supervisory reporting. Licensed VABOs submit regular returns to the FSC covering transaction volumes, customer counts, customer-asset balances, AML statistics, and incident reporting. The granularity is among the more detailed in any jurisdiction.

FIU surveillance. The FIU conducts active monitoring of suspicious-transaction patterns including market manipulation indicators, wash-trading, and known sanction-evasion patterns. Cross-VABO data analysis is supported.

OECD CARF. Korea has committed to OECD CARF implementation on the standard 2027-2028 timeline. Domestic data infrastructure is already substantial; CARF implementation primarily adds cross-border data exchange.