Korea VASP registration rules will become materially stricter on August 20, 2026. The amended Act on Reporting and Using Specified Financial Transaction Information (the “Specified Financial Information Act”) expands the Korea Financial Intelligence Unit’s review beyond the applicant and its management. Major shareholders, financial soundness, social credibility, anti-money laundering capacity, and internal controls will now form part of the registration gate.

For foreign exchanges, custodians, wallet providers, investors, and Korean joint-venture partners, this is more than a filing update. Ownership changes and governance decisions may need to be planned around regulatory review before they can take effect.

Why the August 20 Amendment Matters

Korea has regulated virtual asset service providers (“VASPs”) through a reporting system administered by the KoFIU since 2021. In practice, the filing functions as a market-entry review. A business cannot lawfully carry on regulated VASP activity in Korea merely because it has made a filing; the filing must be accepted.

The amendment, promulgated on February 19, 2026 and effective August 20, 2026, strengthens that review. The Financial Services Commission’s March 2026 notice explains that the reform is intended to examine the soundness of the operator and its controlling persons at the entry stage. The KoFIU and Financial Supervisory Service held an industry briefing on August 13 for registered VASPs and prospective applicants. They plan to publish the revised filing manual and briefing materials in connection with the effective date.

The enhanced standards will be relevant to new applications, renewals, and reportable changes. Existing VASPs should also review whether transition filings are required.

Major Shareholders Enter the Fitness-and-Propriety Review

Criminal-record and eligibility reviews were previously focused principally on the VASP’s representative and officers. The amended regime extends scrutiny to major shareholders. Under the implementing framework announced by the FSC, the relevant group includes not only the largest shareholder but also a shareholder that appoints the representative director or a majority of directors. Where the largest shareholder is a corporation, review may reach that corporation’s largest shareholder and representative.

The range of disqualifying laws also broadens to include additional economic-crime legislation, including competition law. Foreign groups should therefore map the full ownership chain early and obtain the necessary corporate, financial, and criminal-record documents from each relevant jurisdiction. A Korean subsidiary’s immediate shareholder may not be the end of the inquiry.

This will affect acquisition structures as well as first-time registrations. A transaction that changes control of a registered Korean VASP may create both due-diligence and filing issues for the buyer, seller, and target.

Financial Soundness and Operational Substance Will Be Tested

The new review is not limited to the personal eligibility of shareholders and management. Regulators will examine whether the VASP has a sound financial condition and sufficient social credibility. The FSC’s implementing proposal used a debt-to-equity ratio of no more than 200% based on the most recent quarterly financial statements, excluding protected customer deposits from total liabilities. It also addressed recent defaults, impaired credit, and links to insolvent or previously de-licensed financial institutions.

Applicants must also demonstrate an operating organization capable of performing AML and user-protection duties. Review areas include qualified AML and compliance personnel, computer systems, facilities, internal controls, and a compliance officer and reporting officer who meet the applicable requirements.

According to coverage of the August 13 briefing, the revised manual is expected to require evidence of real operating capacity rather than paper appointments. Reported review points include an AML team of at least four people and domestic servers or cloud infrastructure capable of supporting regulatory access and on-site inspection. These practical details should be checked against the final manual when it is released on or around August 20.

Some Changes Will Require Filing 30 Days in Advance

The change-reporting procedure is also becoming more consequential. Changes involving major shareholders or the VASP’s legal-compliance framework were previously reportable within 14 days after the change. Under the new approach described at the briefing, they must be filed at least 30 days before the proposed change.

A VASP should not assume that giving notice is enough. If a disqualifying issue is found, the filing may be rejected and an existing registration may be revoked. Implementing a change before the advance filing has been accepted may also expose responsible persons and the company to criminal or administrative sanctions.

For M&A and investment transactions, closing conditions should therefore address KoFIU acceptance, document delivery, regulatory cooperation, and the consequences of delay or rejection. A conventional “sign now, notify later” timetable may no longer work for a Korean VASP.

Non-Custodial Wallets: Control of the Private Key Is Central

The revised guidance also clarifies the boundary for non-custodial wallets. A person conducting virtual-asset custody or management as a business is generally required to register as a VASP. A wallet provider may, however, fall outside the reporting perimeter where it does not have exclusive control over the user’s private key.

The label “non-custodial” is not decisive by itself. Regulators are likely to look at the technical and contractual reality: who can initiate or block a transfer, whether recovery credentials exist, how multi-signature arrangements work, whether the provider can unilaterally alter access, and what happens if the user loses credentials. Foreign wallet and infrastructure providers should document those facts before launching or marketing a service to Korean users.

What Existing and Foreign Operators Should Do Now

Briefing coverage indicates that existing VASPs will be expected to make a transition filing by November 20, 2026, with preliminary materials requested by October 29 and substantive review beginning from November 23. Because the KoFIU’s final manual and forms were not yet public as of August 13, operators should confirm these dates and the scope of any grace period against the official materials once released.

A practical readiness review should cover the following:

• Identify every person or entity that may fall within the expanded major-shareholder definition.
• Collect criminal-record, regulatory-history, credit, and corporate documents across all relevant jurisdictions.
• Test the operator’s debt ratio and other financial-soundness criteria using the prescribed accounting basis.
• Confirm that AML, compliance, IT, and internal-control functions are staffed and operating in substance.
• Review shareholder agreements, investment documents, and board appointment rights for advance-filing triggers.
• For wallet products, prepare a technical memorandum explaining private-key control and transaction authority.
• Build regulatory acceptance into transaction timetables and closing conditions.

Foreign businesses should also revisit the threshold question: whether direct registration is commercially realistic or whether a properly structured partnership with an existing Korean VASP is preferable. See our guide to Korea’s VASP partnership model, our practical guide for foreign crypto companies, and our Korea crypto law hub.

Sources and further reading: FSC notice on the 2026 implementing amendments; amended Specified Financial Information Act; and August 13 KoFIU–FSS briefing coverage.

Cha & Kwon Law Offices advises virtual asset businesses, fintech companies, and foreign investors on Korean regulatory compliance. For consultation, contact us at contact@chakwon.com or visit chakwon.com.

This article provides general legal information and does not constitute legal advice for your specific situation. Please consult qualified Korean legal counsel regarding your particular circumstances.

The post Korea’s New VASP Registration Rules: What Changes on August 20, 2026 appeared first on Korea Crypto & Blockchain Law Blog.