Financial Integrity Monitor

South Korea KR

Sources

Jurisdiction profile

Largely CompliantTier ARisk: IncreasingMixed

AML/CFT governed by the Act on Reporting and Use of Certain Financial Transaction Information (amended 2021 to cover VASPs) and the 2023 Virtual Asset User Protection Act, with KoFIU as FIU and FSC/FSS as prudential and VASP supervisors.

A won-backed stablecoin framework (Digital Asset Basic Act) is stalled amid FSC-Bank of Korea disagreement over bank-only vs. tech-firm issuance, leaving a regulatory gap in a market larger than domestic equities trading.

Key deficiencies

Beneficial ownership, PEP and correspondent-banking measures remain unresolved since the original mutual evaluation
Low level of sanctions actually applied by supervisory authorities for AML/CFT breaches despite adequate legal powers
No centralized public beneficial ownership registry; UBO identification remains CDD/FI-held rather than centrally verifiable
Repeated internal-control failures at licensed VASPs (unreported counterparty transactions, CDD/STR lapses, operational error at scale)
Stablecoin and non-bank digital-asset issuance left in regulatory limbo pending stalled legislation

Recent developments (18m)

FSC suspended Dunamu/Upbit new-customer virtual-asset transfers for three months (Mar-Jun 2025) over unreported-VASP transactions, CDD and STR violations
FATF October 2024/2025 follow-up re-rated Korea's Recommendation 8 to largely compliant, leaving 13 compliant / 20 largely compliant / 7 partially compliant
Upbit suffered a ~$30-36m Solana-based exploit (Nov 27, 2025), one day after unveiling Naver's $10.3bn acquisition of parent Dunamu
Bithumb erroneously transferred ~$40bn in 'ghost bitcoin' to 695 users (Feb 2026), triggering an FSC industry-wide task force
US, Japan and South Korea issued a joint statement (Aug 2025) pledging intensified action against DPRK overseas IT-worker networks
FSC/FIU proposed bulk cross-border VASP transaction reporting (transactions >KRW 10m) to close cross-border intelligence gaps (Mar 2025 proposal)
Digital Asset Basic Act (won-stablecoin bill) stalled in the National Assembly into 2026 amid FSC-BOK dispute over issuer eligibility
Bank of Korea publicly urged limiting stablecoin issuance to licensed banks, citing money-laundering and stability risk (Feb 2026)

Domain intelligence (D1–D6)

D1 Sanctions

Not covered

Sanctions is not yet covered for this jurisdiction in this report.

D2 Beneficial Ownership

Not covered

Beneficial Ownership is not yet covered for this jurisdiction in this report.

D3 Enabler Jurisdictions

Not covered

Enabler Jurisdictions is not yet covered for this jurisdiction in this report.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto / Digital Assets / Financial Innovation

Not covered

Crypto / Digital Assets / Financial Innovation is not yet covered for this jurisdiction in this report.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

Regulatory horizon

No dated horizon items this cycle. 4 items tracked without a confirmed date.

4 pending date · baseline financial-integrity-2026-07-05

Standing trackers (T1–T6)

Tracker	Status	Note
T1 · Russian Sanctions-Evasion Architecture	no_change	No dedicated Russia-corridor search run this cycle.
T2 · EU AML Package / AMLA	no_change	No AMLR/6AMLD/AMLA transposition developments found this cycle.
T3 · FATF Grey List	material_change	Kuwait and Papua New Guinea added at the February 2026 plenary (22 jurisdictions total); Cambodia faces renewed re-listing risk.
T4 · Beneficial-Ownership Register Status	no_change	No BO-registry developments found this cycle.
T5 · Crypto & Digital-Asset Integrity	material_change	Korea's DABA remains stalled; VASP entry-rule tightening effective 20 Aug 2026; FIU pushing FATF to lower the Travel Rule threshold.
T6 · Sanctions Regime Divergence	no_change	No EU/US/UK autonomous-listing divergence developments found this cycle.

Registers

Enforcement actions

FSC suspended new-customer virtual asset transfers at Dunamu for three months after finding the firm transacted with unreported virtual asset operators and violated customer verification and suspicious-transaction-report obligations. 25 Feb 2025
The three governments issued a joint statement pledging to intensify disruption of North Korea's use of overseas IT workers who obscure their identities to win contracts and funnel earnings to weapons programs. 28 Aug 2025
FSC and KoFIU proposed amendments requiring all regulated VASPs to report cross-border transactions over KRW 10 million involving overseas counterparties, moving beyond suspicion-based SAR filing to bulk cross-border transaction reporting. 1 Mar 2025
FSC formed an industry-wide task force after Bithumb erroneously credited 620,000 Bitcoin (~$40bn) to 695 users during a promotional payout, mistakenly inputting Bitcoin instead of won, triggering a brief sell-off and parliamentary hearings. 9 Feb 2026

Sanctions changes

OFAC designated Russian national Vitaliy Andreyev, DPRK official Kim Ung Sun, and entities Shenyang Geumpungri Network Technology and Korea Sinjin Trading Corporation for funneling DPRK IT-worker revenue tied to Chinyong, an entity originally co-designated by OFAC and South Korea's MOFA in May 2023. 27 Aug 2025
OFAC designated six individuals and two entities, including Amnokgang Technology Development Company and a Vietnam-based facilitator, and listed 21 cryptocurrency addresses across multiple blockchains tied to DPRK IT-worker schemes generating nearly $800m in 2024. 12 Mar 2026
The European Commission added Russia to its high-risk third-country list under Delegated Regulation (EU) 2026/46 (4 December 2025), requiring enhanced vigilance by EU obliged entities on Russia-linked transactions. 4 Dec 2025

Regulatory horizon (register)

Digital Asset Basic Act (won-stablecoin framework) passage
Bulk cross-border VASP transaction reporting rule effective
Korea's next FATF mutual evaluation (5th round)
Basel Committee crypto-exposure prudential rule reassessment

Active schemes

[CRITICAL] DPRK IT-worker crypto revenue-to-WMD pipeline
[CRITICAL] Lazarus Group hack-to-launder pipeline via Korean exchanges
Won-stablecoin regulatory vacuum ahead of Digital Asset Basic Act
Semiconductor trans-shipment risk in Russia-evasion supply chains

Sources

Coverage gaps

Korea operates without a centralized public beneficial owner…

Korea operates without a centralized public beneficial ownership registry; UBO identification remains dependent on financial-institution CDD records rather than a verifiable central register, and FATF continues to flag PEP and correspondent-banking measures as unresolved since the original mutual evaluation.

Repeated internal-control failures at licensed VASPs -- Duna…

Repeated internal-control failures at licensed VASPs -- Dunamu/Upbit's unreported-counterparty and CDD/STR violations (2025) and Bithumb's $40bn erroneous bulk transfer (2026) -- show that licensing under the Virtual Asset User Protection Act has not yet translated into robust operational-risk and AML control maturity.

Legislative deadlock between the FSC and Bank of Korea over …

Legislative deadlock between the FSC and Bank of Korea over bank-only versus non-bank stablecoin issuance has stalled the Digital Asset Basic Act, leaving won-backed stablecoin pilots (KRW1, cross-border remittance projects) to advance without a finalized statutory AML/CFT and reserve framework.

Publicly available English-language reporting on Korea's cur…

Publicly available English-language reporting on Korea's current operational beneficial-ownership data quality (as opposed to legal framework) is thin outside of FATF's own generic synopsis; no recent ICIJ/OCCRP-style forensic BO investigation specific to Korea was located within the 18-month window.

Evidence

Confidence-tiered claims

No structured claims published for this jurisdiction yet.