🇰🇷 Crypto licence in South Korea

The regime

VASPs register with the Korea Financial Intelligence Unit under the Specific Financial Information Act — the regime that forced the real-name banking system and consolidated the market around a handful of compliant exchanges. The Virtual Asset User Protection Act (VAUPA) added market-abuse and custody rules from July 2024.

The registration bar (a real-name bank partnership plus ISMS security certification) proved decisive: dozens of exchanges exited in 2021 rather than meet it, leaving won-market trading concentrated on five venues.

Requirements

• VASP registration with KoFIU under the Specific Financial Information Act.
• Real-name banking: a partnership with a Korean bank issuing real-name deposit/withdrawal accounts — required for won-market trading and historically the hardest gate.
• ISMS certification from KISA for information-security management.
• VAUPA (July 2024): segregation of customer deposits with banks, cold-storage ratios (80%), insurance/reserves against hacks, and criminal penalties for market abuse.

Licensed firms

Registered won-market exchanges:

• Upbit (Dunamu) — the dominant venue by volume
• Bithumb — second-largest venue
• Coinone, Korbit, GOPAX — the remaining won-market registrants

Snapshot, not the register: verify current status against KoFIU registered VASP list before relying on it.

Why do only five Korean exchanges offer won trading?

Because won-market registration requires a real-name account agreement with a Korean bank, which banks have granted sparingly. Exchanges without one may only run coin-to-coin markets, which are commercially marginal.

What did the Virtual Asset User Protection Act change?

From July 2024 it added statutory custody protections (deposit segregation, cold-storage ratios, hack reserves) and made market manipulation and insider trading in crypto criminally punishable.