General information only. CryptoRegHub provides summaries for informational purposes and does not constitute legal or compliance advice. Always verify with official sources and consult qualified legal counsel before making compliance decisions.

← Back to licensing guides|Licensing→South Korea→VASP Registration (KoFIU)
Recently verified:28 July 2026·Source →

VASP Registration (KoFIU)

South KoreaExchange / tradingCustodyLive · effectively near-closed
⚠
General information only — not legal advice

CryptoRegHub provides plain-English summaries of crypto regulations for informational purposes only. This does not constitute legal, compliance, or financial advice. Regulations change frequently — always verify information with official sources and consult qualified legal counsel before making any compliance decisions.

Formally a registration, functionally one of the hardest doors in the world to open. There is no statutory capital number — the barriers are ISMS certification from KISA (six to eight months on its own) and, for fiat services, a real-name verified account with a Korean bank, which conducts its own review and which only a handful of exchanges have ever obtained. Review times stretched from around 11 months in 2024 to around 16 in 2025, with only two approvals that year; most foreign entrants now partner with existing VASPs rather than register directly.

Application process

1
Obtain ISMS certification
KISA's information security certification takes around six to eight months and roughly KRW 100–200M (industry estimate) — it is the mandatory first gate.
2
Secure a real-name bank account (fiat services)
A Korean bank's own AML and soundness review; coin-only exchanges are exempt, but fiat on-ramps without this cannot register. It is the practical bottleneck.
3
File the VASP report with KoFIU
Fit-and-proper review of executives and major shareholders, client asset segregation arrangements and the compliance build.
4
Survive the review
Recent averages run 11–16 months with a shrinking approval rate; renewal follows every three years.

Ongoing obligations

ISMS maintenance — ongoing certification and audits.
Segregation and VAUPA user protections — client asset segregation, reserve and insurance requirements under the user-protection framework.
AML and extraterritoriality — obligations reach services targeting Korean users; unregistered operation carries up to five years' imprisonment or a KRW 50M fine.

Common rejection & delay reasons

The banking gate
The real-name account is granted by banks, not the regulator — and banks have said no far more often than yes.
Pre-certification is not registration
Most ISMS pre-certified applicants never completed registration; budget for the full path or choose the partnership model.

What's changing

Act No. 21358 adds major-shareholder, financial-condition, social-credibility and capacity review factors
20 August 2026· enacted
Digital Asset Basic Act announced — phase-2 framework including stablecoin rules in the legislative process
· proposed

Frequently asked questions

At a glance
JurisdictionSouth Korea
RegulatorFinancial Services Commission / Korea Financial Intelligence Unit (KoFIU), with KISA for ISMS
TypeRegistration (functionally a strict licence)
CapitalNo statutory minimum — barriers are ISMS + banking
Application feeNo application fee cited; the real costs are ISMS certification (roughly KRW 100–200M, industry estimate) and the compliance build.
Ongoing feesRegistration renewal every three years; ongoing ISMS maintenance and audits.
Realistic timelineAverage review around 11 months (2024) stretching to around 16 months (2025), with one applicant exceeding 600 days; of 21 ISMS pre-certifications issued 2023–24, only 9 became registrations.
PassportingNone
Last verified28 Jul 2026
Local presence

Korean entity with fit-and-proper executives and major shareholders; extraterritorial reach applies where services target Korean users.

Primary source
https://www.kofiu.go.kr →
Related
Korea VAUPA / DABA →
Disclaimer

This guide is for general informational purposes only and does not constitute legal advice. Figures change — always verify with the regulator and consult qualified counsel before applying.