Korea Rewrote the VASP Entry Exam, and It Now Reads Your Cap Table
ium Research — Helen, Head of Research — August 24, 2026 Canonical: https://iumlabs.io/blog/korea-vasp-reporting-manual-2026-major-shareholder-screening
Key Takeaways
- Korea's amended Act on Reporting and Using Specified Financial Transaction Information took effect on August 20, 2026, and the Financial Intelligence Unit rewrote the VASP reporting manual to match: criminal-record and soundness screening now reaches past the company and its executives to its major shareholders
- "Major shareholder" is defined upward and sideways — the largest shareholder, any holder of 10% or more of voting stock, shareholders in a special relationship with the largest shareholder, and where the largest shareholder is a corporation, that corporation's own largest shareholder and representative
- Changes to major shareholders or the compliance framework move from post-notification within 14 days to pre-notification 30 days ahead, and acting before acceptance is now criminal and administrative exposure
- The compute rule landed softer than the draft: only systems processing unique identifiers or personal credit information must sit in Korea, and a cloud region inside Korea counts as inside Korea
Most regulatory news in Korea arrives as a promise. This one arrived as a manual.
On August 13 the Financial Intelligence Unit and the Financial Supervisory Service held a briefing for the industry and published a completely revised VASP reporting manual, keyed to the amended Specified Financial Transaction Information Act that took effect one week later on August 20. There is no draft, no comment period, no "as soon as possible." The bar for registering as a virtual asset service provider in Korea changed on a date that has already passed.
We have written before about the framework act that keeps not passing and about Japan overtaking Korea on statute. This is the counterweight. While the headline law sits in subcommittee, the binding constraints on market entry are being written through the AML statute — and they are more specific, more personal, and more immediately enforceable than anything in the bills.
[Figure: Source: Financial Services Commission, "가상자산사업자 신고제 강화에 맞춰 신고매뉴얼을 전면 개정합니다 - FIU·금감원, 개정 신고매뉴얼에 대한 「찾아가는 설명회」 개최," August 13, 2026. Filed under 보도자료, which is where Korean policy actually lives.]
1. What Took Effect on August 20
The amended act moves three things from "documents you submit" to "conditions you must satisfy": the soundness of the operator's major shareholders, the operator's financial position and social credit, and its organisation, personnel and computing facilities.
The distinction matters more than it reads. Under the previous regime, the compliance framework — organisation, staffing, systems, internal controls — was verified through submitted paperwork. Under the amended act it is a ground for rejecting a filing outright, so the FIU will assess whether it is adequate and whether it actually operates, with on-site inspection where necessary.
The FIU is explicit that this is not a local idea. The release places the amendment alongside FATF's recommendation of strict entry regulation for operators and major shareholders, the EU's MiCA, and the CLARITY Act discussion in the United States. Korea is not inventing a bar here; it is arriving at one.
2. The Screen Now Reads Your Cap Table
This is the change that will surprise foreign teams.
Criminal-history screening used to cover the operator, its representative and its executives. It now covers major shareholders as well, and the list of qualifying offences has been widened to include economic crimes under laws such as the Monopoly Regulation and Fair Trade Act.
"Major shareholder" is not a single line on a share register. Under the amended act it means:
| Category | Definition as filed |
|---|---|
| Largest shareholder | The person whose holdings, combined with those of specially related persons, are the largest on a voting-stock basis |
| Principal shareholder | 10% or more of voting stock; or the power alone or jointly to appoint a majority of directors or the representative director; or dominant influence over major decisions such as strategy and organisational change |
| Related holders | Shareholders in a special relationship with the largest shareholder |
| Upstream | Where the largest shareholder is a corporation, that corporation's own largest shareholder and representative |
10% — Voting-stock threshold at which a shareholder becomes a principal shareholder and enters the criminal-record and social-credit screen (Source: FIU/FSS, revised VASP reporting manual, August 13, 2026)
The filing must name every one of them, with real name, nationality and shareholding, and it must be supported by the share registers of the operator and of any corporate largest shareholder. The FIU says the quiet part in the release itself: where control is layered across several corporate entities, or where a major shareholder sits offshore, assembling those documents can take considerable time and needs preparation well in advance.
"최근의 가상자산 시장은 국민의 경제생활과 금융시장에 폭넓은 영향을 미치는 시장으로 성장한 만큼 가상자산 신고제를 막 도입했던 2021년과는 상황이 달라졌다... 가상자산시장에 대한 신뢰를 유지하기 위해서는 사업자 및 대주주의 건전성을 진입 단계에서부터 철저히 점검·심사할 필요가 있다" ("The virtual asset market has grown into one that broadly affects citizens' economic life and the financial market, so the situation differs from 2021, when the reporting regime had only just been introduced... To maintain trust in the virtual asset market, the soundness of operators and major shareholders must be thoroughly checked and screened from the entry stage." Translated from the Korean original.) Ha Ju-sik, Director General for Institutional Operations Planning, Korea Financial Intelligence Unit, opening remarks at the FIU/FSS industry briefing, August 13, 2026
For a token project this reads as an accounting detail until you map it onto a real structure. A foundation in Singapore or Switzerland holding the Korean entity, a founder holding the foundation, an early fund above 10% — under the amended act those are not background. They are filing content, subject to criminal screening, in a jurisdiction whose regulator has just told the industry it intends to examine them at the entry stage.
3. Soundness, Defined in Numbers
The manual replaces adjectives with tests, and two of them are worth reading closely.
Financial position. Debt ratio is now calculated with user deposits and similar balances subtracted from total liabilities, and the filing carries that adjusted total as a separate line. This is the correct treatment — customer money held on behalf of customers is not leverage — and it materially changes how an exchange-shaped balance sheet screens.
Social credit. Checked separately for the operator, the major shareholders, and the executives and representative, against default history, designation as an insolvent financial institution, records of bank-transaction suspension, bankruptcy or rehabilitation following default, and the time elapsed since any business-suspension order.
On staffing, the manual sets AML headcount at four or more, and requires the compliance officer to demonstrate expertise through completed specialist training, AML work history, or a relevant qualification. Concurrent appointment is permitted where business type, organisational scale and staffing conditions justify it — a small, sensible allowance that keeps the rule from excluding every entrant that is not already an exchange.
4. Where Your Servers Live
The draft that went out for public comment required computing facilities to be located in Korea regardless of what data they handled. That would have been an expensive rule for anyone running a global stack.
The final version is narrower on scope and clearer on cloud. Only computing facilities that process unique identifying information or personal credit information must be located in Korea, and where a cloud service is used, a server in a Korean region counts as being located in Korea.
If you are planning a Korean entity, this is the paragraph to hand your infrastructure lead. It converts a potential re-architecture into a region selection and a data-classification exercise.
5. Thirty Days Before, Not Fourteen Days After
The change-notification regime inverts for two categories. Changes to major shareholders and to the compliance framework move from notification within 14 days after the fact to notification 30 days before it.
Both are now grounds for rejecting a filing and for cancelling a registration on the regulator's own initiative. And implementing a change subject to pre-notification before the acceptance notice arrives can expose the operator to criminal penalty and administrative sanction.
Read as a calendar, this is the sharpest operational edge in the whole revision. A funding round that moves someone across 10%, a change of compliance officer, a restructuring of the internal control framework — each now carries a 30-day clock that must run before the change happens, not after. Any Korea entry plan with a financing event in it needs that clock drawn on the same timeline as the listing and the launch. Our GTM Index work has consistently found that Korean entries fail on sequencing rather than budget; this adds a new dependency to sequence around.
6. The Wallet Test Nobody Asked For, and Everybody Needed
Whether a wallet provider is a VASP has been the most-argued question in Korean crypto compliance for four years. The old manual answered it with one clause: a provider that merely supplies a program to store private keys, without independent control, falls outside.
The revised manual replaces that with a four-factor assessment of exclusive control:
- Whether the operator can transfer the virtual asset unilaterally
- Whether the operator can arbitrarily generate, recognise or decrypt private keys
- Whether an individual private key and address wallet is generated for each user
- Whether the user is the substantive and direct signer with the private key
The FIU says the criteria were derived from overseas regulatory precedent, domestic business structures and relevant legal doctrine. It is a real test, and it will produce real answers — including some that wallet teams currently telling themselves they are non-custodial will not enjoy.
7. The Market These Rules Were Written Into
The release opens with two series that explain the tightening better than any policy argument.
| Item | Value |
|---|---|
| 2021 users | 5.58 |
| 2025 users | 11.13 |
Tradeable users across Korean exchanges, millions, duplicates across exchanges not removed (Source: FIU/FSS, August 13, 2026)
| Item | Value |
|---|---|
| 2021 | 55.2 |
| 2024 | 107.7 |
| 2025 | 87.2 |
Korean virtual asset market capitalisation at year end, KRW trillions (Source: FIU/FSS, August 13, 2026)
Users doubled. Market value peaked in 2024 and gave back roughly a fifth of itself in 2025. That is the shape of a market that has become systemically relevant while getting less profitable to serve — which is precisely when a regulator stops asking who is trading and starts asking who owns the venue. Our trading drought piece measured the 2026 continuation of that second line.
8. What Breaks It
Three things could make this analysis wrong.
The manual is guidance, not statute. It interprets the amended act and its subordinate decrees. Where an interpretation proves unworkable in practice, the FIU has invited the industry to say so, and manuals get revised faster than laws.
The framework act could overtake it. If a Digital Asset Basic Act passes with its own major-shareholder provisions, some of this becomes a transitional regime. The bills carry equity-holding restrictions for VASPs as one of their live disputes; a statute could set a different line than the manual's 10%.
Enforcement intensity is unknown. A rule that permits on-site inspection is not the same as a rule that produces on-site inspections. The first six months of filings under the amended act will tell you which of these this is, and nobody has that data yet.
How to Use This
If Korea is on your roadmap, four things are now due earlier than they were:
Map the cap table upward before anything else. Identify every entity and person who would qualify as a major shareholder under the definitions above, including one level above a corporate largest shareholder. If any of them sit offshore, start document collection now — the FIU has said in writing that this is where filings stall.
Put the 30-day pre-notification clock on the same chart as your listing calendar. Any change of major shareholder or compliance framework has to complete its notification before it happens. A round that closes the week of a listing is now two clocks colliding.
Classify your data before you pick a region. Only unique identifiers and personal credit information force domestic hosting. Knowing which of your systems touch those decides whether this costs you a region setting or an architecture.
Answer the four wallet questions in writing. If the honest answer to any of them puts control with you, you are looking at a registration question, not a product question.
None of this is a reason to deprioritise Korea. It is a reason to start the compliance track earlier in the sequence than most teams do — which, if you have read our listing playbook, is the same lesson the exchange track keeps teaching. If you want that mapped against your own structure, our compliance desk does exactly this work.
The framework act will arrive when it arrives. The entry exam is already in force.
Sources
- Financial Services Commission / Korea Financial Intelligence Unit / Financial Supervisory Service, "가상자산사업자 신고제 강화에 맞춰 신고매뉴얼을 전면 개정합니다 - FIU·금감원, 개정 신고매뉴얼에 대한 「찾아가는 설명회」 개최," August 13, 2026. fsc.go.kr
- Act on Reporting and Using Specified Financial Transaction Information, as amended January 2026, in force August 20, 2026, together with its Enforcement Decree and Supervisory Regulation, as described in the release above
- Revised VASP reporting manual and briefing materials, attached to the August 13, 2026 release