The Korea Financial Intelligence Unit (KoFIU) announced that a revision of the subordinate regulation under the Act on Reporting and Using Specified Financial Transaction Information will take effect from June 27, 2024. The revised regulation will strengthen the reporting requirements for virtual asset service providers (VASPs).

First, the revised regulation provides a regulatory ground requiring VASPs to report details of their own compliance systems and the status of major shareholders. In this regard, VASPs will be required to report their compliance system, which should include information about the organizational, personnel, computer facilities, and internal control mechanisms intended to ensure compliance with relevant laws. In addition, VASPs will be newly required to report the status of their major shareholders, which will allow the authorities to have a clear understanding about their shareholder status.

Second, under the revised regulation, different reporting periods will be applied for reporting changes in business status, depending on the particular nature of the change being reported. Any change in major shareholders or business location should be reported within 14 days. Any change in the status of certification for their information security management system (ISMS) should be reported within 30 days. Any change concerning the status of executives, nature of service operation, and information about the real-name verified checking account should be reported 30 days prior to the expected change taking place.

Third, under the revised regulation, financial companies issuing real-name verified checking accounts to VASPs will be required to specify their own procedures and methods for assessing risks in their operations manual. This will help to ensure that financial companies are able to more effectively evaluate risks concerning money laundering when issuing real-name verified checking accounts to VASPs. In addition, the revised regulation will newly require financial companies to be equipped with a specific level of IT system to ensure effective management of anti-money laundering (AML) activities.

Fourth, the revised regulation provides a legal ground upon which the authorities are able to suspend the registration review process (either for new business registration or for change in business status) when there is a criminal charge being pursued for related entities or when there is an ongoing investigation or inspection carried out by the financial or investigative authorities. Once suspended, the authorities will consider whether to resume the suspended review process every six months. This will help to increase predictability and remove legal uncertainties for related entities.

With the revised regulation taking effect from June 27, 2024, VASPs filing for new business registration, change in business status, or renewal of registration will be subject to the changed regulation. Meanwhile, VASPs currently in operation will be required to report the status of major shareholders and compliance system within three months from the date of enforcement.

In the future, the financial authorities plan to make available a revision to the manual on the registration and reporting of VASPs, which is expected to be introduced in early July and will reflect the legislative and regulatory changes made so far.

* Please refer to the attached PDF for details.