📌 목차 (Table of Contents)

Table of Contents

Most foreign fintech and virtual asset companies planning a Korean launch start the same way they’d approach any large market: build the product, line up a local team or partner, and treat regulatory registration as a parallel workstream that can catch up once the product is ready. Only once that plan is underway do most companies ask whether they need a Virtual Asset Service Provider registration, an electronic financial business registration, or both — and discover that the answer determines whether the product can legally launch at all, not just how it’s marketed.

Korea regulates fintech and virtual asset activity through two largely separate regimes that happen to converge on the same companies. The Act on Reporting and Using Specified Financial Transaction Information governs virtual asset businesses — exchanges, custodians, wallet providers — through registration with Korea’s Financial Intelligence Unit (KoFIU). The Electronic Financial Transactions Act governs payment and other electronic financial businesses through registration with the Financial Services Commission (FSC). A company that touches both — a crypto platform with an embedded payment feature, a payments company exploring stablecoin settlement — needs to work out which regime applies to which part of the business before either registration can move forward.

Korea Regulates the Activity, Not Just the Token

Two Regulators, Two Statutes, One Company
Whether a virtual asset business or a payment business, offering the service to Korean users without the applicable registration is not a paperwork gap to fix later — it is the underlying violation, regardless of how compliant the product itself might be in every other respect. KoFIU (under the Financial Services Commission) administers virtual asset service provider registration; the FSC separately administers electronic financial business registration for payment and other fintech activities. A single company can need both if its Korean offering spans, for example, custody of digital assets and a payment or remittance feature built on top of it.

Why Foreign Companies Get This Wrong
The trap is assuming that Korean regulators evaluate a foreign-headquartered applicant the same way they’d evaluate a domestic one, just with extra paperwork. In practice, foreign ownership has historically been a real structural obstacle — not because the law formally bars foreign applicants, but because the practical prerequisites (a Korean bank willing to provide a real-name account, in the virtual asset context) were, for years, something Korean banks extended almost exclusively to domestic operators. That started to change only recently, and understanding why is central to planning a realistic entry timeline.

VASP Registration: The Real Bottleneck

What Requires Registration
Any business operating in Korea that provides virtual asset trading services (buying, selling, exchanging, or transferring), asset safekeeping and custody services, or digital wallet services has to register as a Virtual Asset Service Provider (VASP) with KoFIU before commencing operations. Registration requires, among other things, ISMS (Information Security Management System) certification from the Korea Internet and Security Agency, a qualified anti-money-laundering compliance officer meeting KoFIU’s standards, and a clean criminal record covering major shareholders and executives going back five years.

The Real-Name Bank Account Problem
The single largest practical obstacle is the real-name verified bank account requirement — a VASP has to operate through an account structure with a Korean bank that verifies user identity to the bank’s satisfaction. For years, this was where foreign-controlled applicants stalled: Korean banks, exercising their own risk discretion, extended these arrangements almost exclusively to domestic exchanges and custodians, and a foreign or foreign-majority-owned applicant could spend well over a year in the banking-relationship phase alone before registration could even be completed. That began to shift only in 2026, when a foreign-majority-owned custodian secured Korea’s first VASP registration under foreign control — a genuine precedent that the FIU will approve an overseas-controlled structure if the local operation independently meets domestic standards, though the path remains narrow rather than a general opening of the market.

The Virtual Asset User Protection Act: Ongoing Obligations

What Changed With the 2024 Act
Registration is the entry point, not the finish line. The Virtual Asset User Protection Act, in force since mid-2024, layers a second, ongoing set of obligations onto every registered VASP: segregating user assets from the company’s own proprietary holdings, maintaining insurance or reserve funds against operational losses (including hacking and system failures), and an outright prohibition on unfair trading practices and market manipulation on the platform itself.

The Reporting and Travel Rule Requirements
Registered VASPs also have to file quarterly reports on the status of user assets and submit annual audited financial statements, and implement a compliant Travel Rule solution — capturing and transmitting originator and beneficiary information — for virtual asset transfers exceeding KRW 1 million. For a foreign VASP used to a different jurisdiction’s travel-rule threshold or reporting cadence, this is a genuinely separate build, not a configuration change to an existing compliance stack.

Electronic Financial Business Registration for Payment and Fintech Companies

Not All Payment Activity Is Regulated the Same Way
The Electronic Financial Transactions Act separately requires registration for payment-related fintech activity, with different categories carrying different thresholds. A payment gateway (PG) business — settling payments on behalf of merchants — generally needs at least KRW 1 billion in capital, a debt-to-equity ratio no higher than 200%, at least five IT specialists with relevant experience, and backup and information-security infrastructure. A prepaid electronic payment means issuer (covering stored-value products, from transit cards to digital wallets) has its own separate registration trigger, generally required once issuance balances exceed roughly KRW 3 billion outstanding or KRW 50 billion issued annually — smaller-scale prepaid issuers can fall under that threshold and avoid the registration requirement entirely, at least until they scale past it.

Fund Protection Rules Are Tightening
Following a 2025 amendment, PG operators face a materially stricter fund-segregation regime: settlement funds increasingly have to be held with a third-party bank through deposit or trust arrangements, phasing from 60% coverage up to full segregation by December 2028, with the full amendment generally effective from December 2026. Misappropriating settlement or prepaid funds is now a serious criminal exposure — up to ten years’ imprisonment or a KRW 100 million fine — reflecting the same regulatory instinct that drove Korea’s e-commerce settlement-fund reforms after recent platform failures.

Where Crypto and Fintech Regulation Overlap

The Same Product Can Trigger Both Regimes
A crypto platform that lets users pay merchants directly from a custodied balance, or a payments company that adds a stablecoin settlement rail, is a natural candidate for needing both a VASP registration and an electronic financial business registration, depending on exactly how funds move and who is deemed to be providing the payment service versus the custody service. This isn’t a theoretical edge case — it’s close to the default shape of a modern fintech product that touches digital assets at all, which makes early legal structuring of exactly which entity does what, and under which license, a genuine product-design question rather than a back-office one.

The Securities Classification Risk
Separately, a token that carries profit-sharing rights, governance rights tied to economic returns, or other features resembling an investment contract risks being classified as a security under the Capital Markets Act rather than treated purely as a virtual asset under the VASP framework — which brings an entirely different, and generally more demanding, licensing regime into play. Foreign issuers bringing a token model that worked under a different jurisdiction’s framework should not assume Korean regulators will characterize it the same way.

The Stablecoin Legislation Still Taking Shape

A Moving Target Worth Tracking Rather Than Assuming
As of this writing, Korea does not yet have a settled, dedicated stablecoin framework — roughly ten separate digital asset and stablecoin bills remain pending before the National Assembly, and the Financial Services Commission has announced a plan to consolidate them into a single Digital Asset Framework Act, targeting completion by the end of 2026. Two questions remain genuinely unresolved at the policy level: whether Korean won-backed stablecoin issuance should be restricted to a bank-led consortium under a majority (51%) bank-ownership requirement, and whether a uniform ownership cap (in the 15–20% range under discussion) should apply across major domestic virtual asset exchanges.

What This Means for Planning
A foreign company building a product around Korean won stablecoin issuance, or planning an equity structure involving a Korean exchange, should treat the current landscape as unsettled rather than final — the eventual framework could materially change who is even eligible to issue a won stablecoin or hold a meaningful equity stake in a licensed platform. Building a Korea entry plan around today’s draft bills without a mechanism to adjust once the Digital Asset Framework Act actually passes is a real risk for any stablecoin-adjacent business model specifically.

Practical Sequencing for Market Entry

Most of the friction foreign fintech and virtual asset companies hit in Korea comes from treating licensing as a parallel track to product development rather than the thing that determines the product’s shape. A sequence that tends to work:

  1. Classify your actual Korean activity before you do anything else — virtual asset service, electronic financial service, both, or something that could be read as a security — since the answer determines which regulator, which statute, and which timeline governs everything downstream.
  2. If VASP registration is required, start the Korean banking relationship immediately and expect it to be the critical path, not a formality that follows once the rest of the application is ready — this remains the single most time-consuming step, foreign-owned applicants especially.
  3. Build the Virtual Asset User Protection Act’s ongoing obligations — asset segregation, reserves, travel rule — into the product architecture from day one, rather than retrofitting them once registration is granted, since a system built without them is a substantial rebuild later.
  4. If any part of the business touches payments, evaluate the electronic financial business registration requirement in parallel, not after the virtual asset side is settled, since a combined product may need both licenses to launch at all.
  5. Get a considered view on securities classification before finalizing a token’s economic design, since a token that reads as an investment contract needs a fundamentally different regulatory path than a straightforward virtual asset.
  6. Treat any stablecoin-specific strategy as provisional until the Digital Asset Framework Act actually passes, and build the flexibility to adjust ownership structure or issuance plans once the bank-consortium and exchange-ownership questions are resolved.