Asia/KR/Comparables
South Korea
Financial Services Commission / Financial Supervisory Service
User-protection first, issuance second. The Act on the Protection of Virtual Asset Users has been in force since 19 July 2024: bank-held fiat, 80%+ cold storage, market-abuse crimes, FSC/FSS supervision. VASP registration under the AML Act was tightened again in August 2026. A Digital Asset Basic Act with white-paper and issuer-entry rules is the missing issuance chapter — the one that would actually sit next to Rule 103.
VAUPA
19 Jul 2024
Cold storage
≥ 80%
Issuance Act
Forthcoming
Similar regulation
The statute book
Primary instruments, with the RCA job each one actually does. Links open the official text.
- In force
User-asset segregation and market abuse — not an offering exemption
- In force
Entry rules for VASPs — CASP analogue
Translation
Rule 100–500 map
| RCA | Peer | Fit | Desk |
|---|---|---|---|
| Rule 100 | Virtual asset under VAUPA, with statutory exclusions | Partial | Definitional, not a Howey wrapping. |
| Rule 103 | Forthcoming DABA white-paper rules | No analogue | Not yet in force. Do not cite as live disclosure law. |
| Rule 200 / 300 | No live issuer exemption | No analogue | Issuance remains the hole the DABA is meant to fill. |
| Intermediary | Registered VASP + VAUPA duties | Stricter | Bank segregation of KRW, 80% cold, insurance or reserve, unfair-trading crimes. |
Analysis
What the file is
Korea built the exchange-user protections first, after a domestic cycle of failures and market-abuse cases, and left issuance for a second statute. VAUPA (19 July 2024) forces VASPs to park user KRW at banks, to keep at least 80% of user virtual assets in cold wallets, to run surveillance, and to face criminal and administrative sanctions for insider trading and price manipulation. The 11 August 2026 AML Enforcement Decree revision tightens VASP entry (major-shareholder scope, debt-ratio and default screens) and Travel Rule/CDD duties, with pieces effective 20 August 2026.
Research
The record
- Bank-held user deposits with direct payout on VASP bankruptcy is a stronger residual-claim story than RCA’s silence on issuer insolvency.
- ISMS-P information-security certification is a practical entry condition for VASPs, on top of AML registration.
- Unfair-trading provisions are closer to MiCA Title VI / UK SI market-abuse than to the Securities Act antifraud residual RCA keeps.
Ideation
What to file
- Investor-protection comments on Rule 200 (no financials, website 103): Korea’s VAUPA is the exhibit for “we protect the user against the intermediary, and we still have not authorised a public token issuance.” That cuts both ways.
- Do not invent a Korean Rule 400. There isn’t one.
Analysis
What the file is
Korea built the exchange-user protections first, after a domestic cycle of failures and market-abuse cases, and left issuance for a second statute. VAUPA (19 July 2024) forces VASPs to park user KRW at banks, to keep at least 80% of user virtual assets in cold wallets, to run surveillance, and to face criminal and administrative sanctions for insider trading and price manipulation. The 11 August 2026 AML Enforcement Decree revision tightens VASP entry (major-shareholder scope, debt-ratio and default screens) and Travel Rule/CDD duties, with pieces effective 20 August 2026.
Primary sources on file
Act on the Protection of Virtual Asset Users
Financial Services Commission of Korea/19 Jul 2024/RCA review 8 Sept 2026
Primary regulatory
FSC — VASP registration and AML Enforcement Decree revision
Financial Services Commission of Korea/11 Aug 2026/RCA review 8 Sept 2026
Primary regulatory
RCA publishes source-linked intelligence for professionals. Nothing here is a token-buying call, a legal opinion, or an “approved / safe / regulated” badge. Every material claim is dated. Incomplete files stay incomplete.