South Korea ramps up regulatory campaign, AML crackdown on crypto sector

South Korea is reconsidering its approach to digital asset governance after a series of high-profile data hacks and compliance breaches in its rapidly growing crypto market.

Authorities suspect the North Korea-linked hacking group Lazarus is behind the $32 million theft on South Korea’s largest crypto exchange, Upbit, on November 28. It’s the second time the group has hacked Upbit, making off with approximately $41 million in 2019.

The hack comes as regulators from the Financial Services Commission (FSC) prepare for the most aggressive anti-money laundering (AML) reforms since 2008. Korean officials have been warning that criminals are exploiting loopholes faster than regulars can close them. The overarching concern is that crypto is being used to evade taxes, launder funds, and move money beyond regulatory visibility.

“President Lee Jae Myung’s administration is taking a more aggressive approach to digital asset rules,” said So-Ye Yoon, who is a finance attorney at Dentons Lee law firm in Seoul. “Regulators appear intent on bringing virtual asset providers under tighter control in line with the administration.”

Millions of violations found

South Korea’s AML watchdog is preparing to sanction several major cryptocurrency exchanges after uncovering extensive lapses in AML safeguards. The Korean Financial Intelligence Unit (KoFIU) said it spent 18 months conducting on-site inspections at the country’s largest platforms and found millions of compliance failures.

Dunamu, the operator of Upbit, faces one of the heaviest penalties. On November 7, it was slapped with an unprecedented $25 million fine tied to 8.6 million violations of transaction reporting rules. KoFIU also identified 5.3 million shortcomings in customer due diligence checks, 3.3 million cases in which trading was allowed to continue before verification was complete, and 15 missed reports of suspicious activity.

KoFIU said other large exchanges recorded similar deficiencies and may also face penalties as the regulator moves to tighten oversight of the virtual asset sector.

Inspection gray zone

So-Ye Yoon said recent inspections on VASPs are the first time KoFIU has carried out large-scale onsite inspections.

“These inspections would be routine for traditional financial institutions, but Virtual Asset Service Providers (VASPs) aren’t treated as traditional financial institutions under the current regulatory regime,” said So-Ye.

According to So-Ye Yoon, it could signal a broader attempt to align crypto trading platforms with the governance and risk-control obligations by banks and securities firms.

Travel rule loopholes

South Korea also moved to close what officials described as one of the most exploited gaps in its system. It’s a loophole that has allowed criminals to break up transfers below one million won to avoid identity checks. The government said it would now require identity verification for every crypto transaction, no matter how small, effectively ending the anonymity of micro-transfers.

KoFIU officials will also gain the power to freeze accounts before court approval when they suspect funds are linked to serious crimes. It’s a measure the government argues is needed to curb illicit money from vanishing across borders in seconds.

As part of the overhaul, South Korea plans to block access to what it calls “high-risk” overseas crypto exchanges. On November 28, FSC Chairperson Lee Ok-won said domestic rules have little effect if users can shift assets to platforms operating outside the country’s regulatory reach.

Regulators turn scrutiny on self-custody

Dr Deokyoon Ko, CEO of blockchain startup Nonce Lab, said real name checks, the Travel Rule, and round-the-clock monitoring are raising the bar to entry.

The latest cyberattack adds new pressure on an industry under heightened scrutiny. AML obligations for VASPs have become significantly stricter to the point where compliance costs are squeezing out smaller exchanges, said Dr Ko.

“Rather than avoiding crypto entirely, many Korean users are turning to self custody as a way to retain sovereignty over their assets without being bound by centralized compliance burdens.”

But Korea’s national tax agency is planning to conduct home searches for users suspected of hiding crypto assets offline. Korean authorities are treating offline storage, traditionally seen as “safe”, from seizure as an accessible target in enforcement.

South Korea’s main financial regulator, the FSC, is undertaking an ambitious internal reorganization. It is planning to reshuffle staff and adjust its internal structure to improve operational efficiency, particularly around virtual asset providers.

The FSC is in charge of market stability, advancing South Korea’s financial policy, and directs the Financial Supervisory Service (FSS). In September, it narrowly survived the Lee administration’s push to consolidate the FSC and FSS after criticizing a lack of transparency in Korea’s stock markets.

According to local reports, the FSC said its workload has increased while budget restrictions prevent it from hiring new staff. The review, scheduled for completion in April next year, will redesign its structure and reallocate staff in a bid to do more with less.

More specifically, it plans to streamline operations, shift responsibilities and reorganize departments to improve oversight.

“The FSC has around 342 staff members. It’s relatively small for an agency in charge of policy and they have to deal with all these issues too,” said So-Ye Yoon, finance attorney at Dentons Lee law firm in Seoul.

For Seoul, the message is clear: digital assets are no longer just a financial product, but a matter of national security that the government can no longer leave unguarded.

Sign up to Bybit and start trading with $30,050 in welcome gifts