Summary:

• South Korea's National Assembly has passed a major overhaul of its crypto licensing regime.
• New rules expand background checks to include major shareholders, executives, finances, internal controls and criminal histories.
• The Financial Intelligence Unit (FIU) gains wider discretion over who can operate in the market.
• Conditional licenses will be possible, helping regulators manage money-laundering and user-protection risks.
• A loophole involving former financial industry employees has been closed, strengthening AML oversight.

South Korea is tightening the rules governing crypto exchanges and other virtual asset service providers (VASPs), reflecting growing concern from lawmakers and regulators that the rapid expansion of digital finance needs more robust safeguards. On Thursday, the National Assembly approved an amendment to the Act on Reporting and Using Specified Financial Transaction Information, a central piece of the country's anti-money-laundering framework for digital assets. The revised law was passed at a plenary session and is expected to take effect about six months after it is formally enacted. 

Under the new regime, companies applying for crypto licenses will face much deeper background checks than before. Regulators will review not only the firm's executives and management team - as was standard practice - but also controlling shareholders and other significant stakeholders. The goal is to ensure that people with influence over the business have clean professional and legal histories. Previously, South Korea's licensing requirements focused heavily on basic compliance and AML controls but left gaps when it came to the personal histories of investors and affiliated individuals. Those gaps raised concerns that bad actors or people with questionable records could still gain indirect influence over regulated crypto businesses.

The expanded list of "red flags" now includes not just traditional financial crimes but also serious economic offenses such as tax evasion, drug trafficking and breaches of the country's digital asset user protection law. These changes reflect a broader understanding that risk comes in many forms, and a firm's credibility depends on the integrity of everyone tied to it, not just its board of directors. This shift also gives South Korea's Financial Intelligence Unit more authority to decide who merits a license. The FIU's review will look beyond narrow checklists of documentation to a more holistic assessment of a company's finances, internal controls, legal track record and credibility in the marketplace. That could include, for example, scrutiny of accounting practices, compliance systems, risk-management frameworks and overall governance.

The legislative change signals that regulators want to take a more proactive view of which firms should be allowed to operate in the country's growing digital asset ecosystem with the power to deny, delay or condition approvals based on a wider range of factors.

Conditional licenses and tighter employee oversight

Another notable change introduced by the amendment is the ability for regulators to issue conditional licenses. Under the new framework, the FIU can grant a provisional operating permit while imposing specific requirements to address money-laundering risks or shortcomings in user protection measures. In practical terms, this flexibility could allow a qualified firm to begin operations while correcting gaps in its compliance systems under regulatory supervision. It's a sign that the government is trying to balance market access with safety: controlled access that encourages innovation - but not at the expense of oversight.

A third important provision deals with former financial industry employees. In the past, sanctions against individuals for breaking AML rules did not automatically require notification to their current or prospective employers. That loophole could let someone with a history of serious violations slip into a new role without a regulator-to-employer warning. Under the updated rules, the FIU must notify a business's chief executive when a former employee has been sanctioned for violating AML requirements. Companies are then obliged to relay the notice to the individual and retain documentation related to the case. This change aims to prevent sanctioned individuals from moving from one financial role to another without proper disclosure.

Together, these reforms represent a tightening of the entire licensing and oversight regime for crypto businesses in South Korea. 

Closing Thoughts 

They come at a time when the country's policymakers have been signaling greater openness to institutional participation in digital assets, including discussions about corporate crypto accounts and possible bitcoin spot exchange-traded funds. At the same time, lawmakers are emphasizing that access to the market must come with strong protections against illicit activity and safeguards for users.

For investors and operators inside and outside South Korea, these changes make clear that the country is striving for a more mature and stable digital asset market - one where innovation and regulation grow in tandem rather than in conflict.

READ MORE: 149M Stolen Logins Exposed: Binance and Crypto Users Caught in Massive Infostealer Data Leak