Stricter VASP Entry and AML Rules

FSC Korea News

Published March 30th, 2026

Detected April 1st, 2026

Summary

The Financial Services Commission of Korea proposed amendments to the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information to strengthen VASP registration requirements and AML duties. Key changes include expanded major shareholder scrutiny, new financial soundness requirements (200% debt ratio cap), and extension of the travel rule to transactions below KRW 1,000,000. The FSC seeks public comment on these proposals.

View original document View source feed page

What changed

The FSC proposes comprehensive amendments to VASP entry and AML regulations. For registration, the scope of major shareholders subject to scrutiny expands to include largest shareholders, CEOs, controlling shareholders, and corporate entity representatives. VASPs and their major shareholders must maintain a debt ratio of 200 percent or below, demonstrate no default history over three years, and meet corporate governance qualifications. Additionally, VASPs must maintain organizational, personnel (including compliance officers), computer systems, and internal controls for AML and user protection.

The travel rule for domestic VASP-to-VASP transfers expands to cover amounts below KRW 1,000,000, addressing the approximately 60 percent of transfers currently below this threshold. Beneficiaries must now secure originator information. Cross-border transfers to overseas VASPs and digital wallet providers are permitted under specified conditions (low-risk VASPs, same-entity transfers, prohibited high-risk transactions), with KRW 10 million or more transfers requiring reporting. The FSC invites public comments on these proposals.

What to do next

Review current VASP registration materials to assess compliance with new major shareholder scrutiny requirements
Evaluate organizational AML capacity including compliance officer staffing and computer systems
Assess debt ratios against the new 200 percent cap for the VASP entity and major shareholders
Prepare for extended travel rule application to smaller transactions
Monitor for final rule publication and compliance deadlines

Source document (simplified)

Press Releases

Rules Change Proposed on VASPs to Strengthen Registration and Anti-money Laundering Requirements Mar 30, 2026
-
-
The Financial Services Commission proposed a set of rules change intended to strengthen the registration requirement and the anti-money laundering (AML) duty of virtual asset service providers (VASPs) on March 30. The revision proposal for the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information and its subordinate regulations address details regarding the entry rules of VASPs and the notification of sanctions imposed on retired employees. Moreover, the proposed rules change also deal with the strengthened AML duty (travel rule) of VASPs in their handling of virtual asset transfers.

Key Revision Details

a) Enhanced entry rules and registration requirements

First, the scope of major shareholders falling under the scrutiny for VASP’s entry registration will be expanded to include largest shareholder, CEO, controlling shareholder, and the CEO and company representative if the largest shareholder is a corporate entity.

Second, VASPs need to meet the following financial soundness and social credibility requirements for registration.

VASPs (a) should maintain a debt ratio of 200 percent or below as shown in the most recent quarter-end financial statements, (b) should not have been in default in the past three years, and (c) should not have been identified as an insolvent financial institution or have had its business license revoked in the past.

The (chief) executive officers of VASPs need to meet specific qualifications prescribed under the Act on Corporate Governance of Financial Companies.

The largest shareholders of VASPs (a) should demonstrate a debt ratio of 200 percent or below as shown in the most recent quarter-end financial statements, (b) should not have been a largest shareholder or a specially associated entity to an insolvent financial institution or a financial institution that has had its business license revoked previously, and (c) should meet specific qualifications prescribed under the Act on Corporate Governance of Financial Companies.

Third, VASPs should have the organizational, personnel (compliance officer), computer system, and internal control mechanisms required to ensure the maintenance of effective AML and user protection capacities.

b) Notification of sanctions on retired employees

Notifications for certain types of sanctions imposed on the retired employees of VASPs will be communicated via the Financial Supervisory Service.

c) AML duty on virtual asset transfers

The travel rule currently in place for virtual asset transfers taking place between domestic VASPs in the amount of KRW1,000,000 or more will be expanded to the transactions involving lesser amounts than KRW1,000,000. In this regard, the beneficiary (recipient) is also made subject to the duty to secure the information provided by the originator (sender). Since about 60 percent of virtual asset transfers taking place between domestic VASPs amount to less than KRW1,000,000 (as of H2 2025), an expanded application of the travel rule will help to close regulatory loophole and more effectively prevent money laundering.

Virtual asset transfers taking place between a domestic VASP and an overseas VASP and/or digital wallet service provider will be allowed on certain conditions (e.g. (a) virtual asset transfers to low-risk overseas VASPs, (b) when the sender and the recipient are the same entity, and (c) high-risk transactions prohibited). Additionally, virtual asset transfers of KRW10 million or more to an overseas VASP and/or digital wallet service provider should be reported to the KoFIU regardless of the level of risk involved in transactions to reassure the prevention of money laundering activities via overseas VASPs or digital wallet service providers.

d) Other regulatory upgrades

Under the revised rules, the customer due diligence (CDD) duty of VASPs will extend to the duty of verification of information accuracy beyond simply checking and identifying customer’s personal identification information.

In addition, a more rigorous form of CDD will be required on high-risk individuals or for the use of high-risk products or services.

Further Plan

The proposed rules change will enter a comment period from March 30 to May 11, 2026. The revised rules will then go through a successive legislative review and approval process before taking effect from August 20, 2026.