South Korea

Crypto Licensing

The proposed share-exchange merger between Naver Financial and Dunamu, Korea's largest cryptocurrency exchange operator, has been delayed again according to a 6 July 2026 press report. Shareholder meetings, originally set for 18 August 2026, have been moved to 19 November 2026, and the share-exchange date, originally 30 September 2026, has been re-targeted to 31 December 2026.

This development is sourced to a single Korean business-press outlet (Hankyung). No DART corporate filing, FSC notice, or Korea Fair Trade Commission filing has been located to corroborate the re-timing, so it is treated as a press-reported data point on the transaction's progress rather than a regulator-confirmed milestone. The underlying reasons for the repeated delay are not established by the available sourcing.

The transaction is material to Korea's crypto-licensing landscape because Dunamu operates Korea's largest cryptocurrency exchange, and a completed share exchange would bring that exchange under the same corporate structure as a major payments and financial-services platform, with implications for how exchange licensing and corporate ownership interact going forward.

Outlook

The newly stated 19 November 2026 shareholder-meeting date and 31 December 2026 share-exchange date are the next milestones to track for this transaction. Given that this is already a second reported delay, uncorroborated by any primary regulatory or corporate filing, confirmation through a DART disclosure or FSC/KFTC filing would materially strengthen confidence in the transaction timeline.

Token Classification

The Financial Services Commission has opened formal pre-announcement (입법예고) of subordinate-regulation amendments under the Electronic Securities Act and the Capital Markets Act concerning token securities. The notice period runs from 2 October to 11 November 2026, and the amending Acts themselves are scheduled to take effect on 4 February 2027. This confirmed development corrects an earlier, unverified placement of the pre-announcement in late September 2026.

The approach works through Korea's existing securities-law architecture rather than creating a standalone digital-asset classification regime: token securities are being addressed through subordinate regulations beneath the Electronic Securities Act and the Capital Markets Act, which will set out how token-form securities are registered, issued and traded within the established capital-markets framework. This signals that Korea is extending its existing securities perimeter to capture token securities specifically, rather than classifying tokens generally through a separate crypto-asset statute.

As the amendments are presently at the pre-announcement/comment stage, the precise classification boundaries, including which token structures fall within the token-securities definition being targeted by the subordinate rules, are not yet settled. The six-week comment period to 11 November 2026 is the formal opportunity for stakeholders to respond before the rules are finalised ahead of the 4 February 2027 commencement date.

Outlook

Two dates anchor the near-term classification picture: the close of the comment period on 11 November 2026 and the scheduled commencement of the amending Acts on 4 February 2027. The content of the finalized subordinate regulations, once published after the comment period closes, will be the next material development to establish the actual classification boundary for token securities under Korean law.

Stablecoin Regime

South Korea's stablecoin regime sits in an unresolved legislative gap. The Act on the Protection of Virtual Asset Users (VAUPA) does not directly regulate the structure of stablecoin issuance; comprehensive second-phase legislation intended to govern the issuance and distribution of stablecoins, including reserve-asset requirements, remains under discussion between the Financial Services Commission and the National Assembly, with no confirmed timeline for submission or passage as of 5 October 2026. In the absence of a dedicated statutory framework, the Financial Services Commission has instead relied on supervisory advisory tools: on 16 October 2026 it issued user advisories warning against perpetual futures products carrying leverage of ten to two hundred times, tied to virtual assets and stocks and offered through overseas platforms. This advisory activity illustrates the regulator's current posture toward unregistered or offshore high-leverage digital-asset products in a period where the underlying legislative framework for stablecoins and comparable instruments has not yet been settled. The gap between the in-force VASP/VAUPA user-protection baseline and the still-pending Phase-2 stablecoin-specific legislation means that stablecoin issuers, reserve requirements and issuer-eligibility criteria remain unsettled matters for market participants operating in or targeting the Korean market.

Outlook

The stablecoin regime's near-term trajectory is tied entirely to the progress of the Phase-2 Digital Asset Basic Act through the National Assembly; without confirmed submission and passage, reserve-asset and issuer-eligibility requirements for stablecoins will remain unsettled. In the interim, the Financial Services Commission's advisory-based approach to perimeter-policing high-leverage derivative products suggests continued reliance on supervisory warnings rather than binding rules for stablecoin-adjacent product categories until the legislative gap closes.

Consumer Protection

Korea's consumer-protection framework for virtual-asset users rests on the Virtual Asset User Protection Act's (VAUPA) requirements for custody segregation and information-security standards, which VASPs must maintain alongside their KoFIU registration. This cycle's signal in this module is an escalating enforcement trajectory: the Financial Intelligence Unit found KYC and custody-adjacent compliance failures at three of Korea's largest exchanges during 2025-2026, resulting in fines and partial-suspension sanctions at each. Bithumb was fined approximately $24 million with a six-month partial suspension, disclosed 16 March 2026, following an on-site inspection; this is the most recent and highest-profile of the three actions, and it is Probable-confidence given its Tier-3 sourcing.

A structurally significant absence in Korea's current consumer-protection framework is the lack of a dedicated market-abuse or market-integrity regime comparable to MiCA's Title VI. Market-abuse-type provisions for digital assets are expected only via the pending Digital Asset Basic Act; under current law, no equivalent framework is in force. This is treated as a negative finding with Uncertain confidence, since the absence is inferred from commentary discussing DABA's prospective scope rather than confirmed against a specific statute that defines the current gap. The custody-segregation and information-security obligations that are in force represent baseline user protection; the market-abuse and broader conduct-of-business rules that would typically accompany those baseline protections in a comprehensive regime remain pending.

The pattern across Upbit, Bithumb and Korbit — repeated KYC and custody-adjacent findings resulting in sanctions across a roughly twelve-month period — indicates that Korea's existing consumer-protection enforcement machinery is active and is identifying real compliance gaps at scale, even while the more comprehensive market-conduct framework contemplated under DABA remains unenacted.

Outlook

Continued enforcement activity against Korea's major exchanges is likely to persist under the existing VAUPA framework regardless of DABA's legislative timeline, since custody-segregation and KYC obligations are already in force and already being actively supervised. The market-abuse gap, by contrast, will persist until DABA or an equivalent instrument is enacted; no interim market-abuse measure under current law was identified this cycle.

Cross-Border Transfer

Korea's cross-border virtual-asset transfer regime is tightening structurally under an Enforcement Decree amendment to the Act on Reporting and Using Specified Financial Transaction Information. The amendment establishes a risk-tiered framework for transfers from domestic VASPs to overseas counterparties: transfers to overseas VASPs classified as low-risk are permitted without further restriction; transfers to other overseas VASPs, or to self-hosted wallets, are permitted only where the sender and recipient are confirmed to be the same person; and transfers to high-risk counterparties are prohibited outright. This risk-tiered structure commences alongside the zero-threshold domestic Travel Rule change, approximately six months after the decree's promulgation on 18 August 2026, placing the effective date around 19-20 February 2027.

A related provision requires domestic VASPs to apply internal suspicious-transaction monitoring for cross-border transfers of KRW 10 million or more to overseas VASPs or self-hosted wallets. Notably, an earlier draft of this provision reportedly contained a mandatory suspicious-transaction-report trigger at this threshold, but the final decree softened this to a provider-operated monitoring-system requirement rather than an automatic reporting obligation. This softening is a meaningful detail: it indicates the final rule gives VASPs more operational discretion in how they structure their cross-border monitoring systems than the mandatory-STR approach initially contemplated.

Confidence in both the risk-tiered structure and the monitoring threshold is Probable, since no direct primary fsc.go.kr or kofiu.go.kr notice for the Enforcement Decree amendment was retrieved this cycle; coverage instead relies on multiple Tier-3 crypto-compliance trade-press sources that corroborate each other on the substance of the change.

Outlook

The period to February 2027 is the implementation window for VASPs to build the risk-tiering and KRW 10 million monitoring-threshold systems this regime requires. The same-person-confirmation requirement for self-hosted-wallet transfers in particular represents an operationally demanding compliance burden, since it requires VASPs to verify counterparty identity for an entire category of transfers that previously required no such verification under the de minimis exemption.