--- title: "South Korea (KR) — Financial-Integrity Intelligence · Sentinel" canonical: https://sentinel.gi/jurisdictions/south-korea/ source_html: /jurisdictions/south-korea/index.html description: "Financial integrity intelligence for South Korea (KR): sanctions, beneficial ownership, enabler jurisdictions, conflict finance, digital assets and compliance technology — with sourced findings." generated_at: 2026-11-08T04:46:02Z content_sha256: 5e1adcaff1a38e932c9580f6a2dc8540f5debf29c21ad253c2d9cd25d9af3bee generator: "fe-fleet/md-twin@1.0" --- # South Korea (KR) — Financial-Integrity Intelligence · Sentinel Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. Financial Integrity Monitor # South Korea KR Domains covered 8 of 8 Sources 215 Role actions 8 Horizon <90d 1 Jurisdiction profile FATF status: Largely Compliant Tier: A Risk direction: Increasing Enablement vs enforcement: Mixed AML/CFT governed by the Act on Reporting and Use of Certain Financial Transaction Information (amended 2021 to cover VASPs) and the 2023 Virtual Asset User Protection Act, with KoFIU as FIU and FSC/FSS as prudential and VASP supervisors. More A won-backed stablecoin framework (Digital Asset Basic Act) is stalled amid FSC-Bank of Korea disagreement over bank-only vs. tech-firm issuance, leaving a regulatory gap in a market larger than domestic equities trading. Key deficiencies - Beneficial ownership, PEP and correspondent-banking measures remain unresolved since the original mutual evaluation - Low level of sanctions actually applied by supervisory authorities for AML/CFT breaches despite adequate legal powers - No centralized public beneficial ownership registry; UBO identification remains CDD/FI-held rather than centrally verifiable - Repeated internal-control failures at licensed VASPs (unreported counterparty transactions, CDD/STR lapses, operational error at scale) - Stablecoin and non-bank digital-asset issuance left in regulatory limbo pending stalled legislation Recent developments (18m) - FSC suspended Dunamu/Upbit new-customer virtual-asset transfers for three months (Mar-Jun 2025) over unreported-VASP transactions, CDD and STR violations - FATF October 2024/2025 follow-up re-rated Korea's Recommendation 8 to largely compliant, leaving 13 compliant / 20 largely compliant / 7 partially compliant - Upbit suffered a ~$30-36m Solana-based exploit (Nov 27, 2025), one day after unveiling Naver's $10.3bn acquisition of parent Dunamu - Bithumb erroneously transferred ~$40bn in 'ghost bitcoin' to 695 users (Feb 2026), triggering an FSC industry-wide task force - US, Japan and South Korea issued a joint statement (Aug 2025) pledging intensified action against DPRK overseas IT-worker networks - FSC/FIU proposed bulk cross-border VASP transaction reporting (transactions >KRW 10m) to close cross-border intelligence gaps (Mar 2025 proposal) - Digital Asset Basic Act (won-stablecoin bill) stalled in the National Assembly into 2026 amid FSC-BOK dispute over issuer eligibility - Bank of Korea publicly urged limiting stablecoin issuance to licensed banks, citing money-laundering and stability risk (Feb 2026) Brief ## Lead signal #### Lead Signal South Korea is converging its anti-money-laundering and foreign-exchange oversight on digital assets, with two developments this cycle pointing in the same direction. The Bank of Korea, speaking at an October 22 parliamentary audit, confirmed it is coordinating with the government on an amendment to the Foreign Exchange Transactions Act, planned within 2026, that would classify stablecoins as payment instruments for cross-border transfers and build monitoring through the existing foreign-exchange information network. The stated motivation is laundering risk associated with mixers and unhosted wallets, illustrated by officials with reference to an alleged case involving roughly 107 million dollars. Separately, on October 13, 2026, the Financial Services Commission ordered domestic access restriction or service termination for 27 websites operated by unregistered crypto businesses, acting on review by the Korea Communications Standards Commission and at the request of the Financial Intelligence Unit. Read full brief #### Lead Signal South Korea is converging its anti-money-laundering and foreign-exchange oversight on digital assets, with two developments this cycle pointing in the same direction. The Bank of Korea, speaking at an October 22 parliamentary audit, confirmed it is coordinating with the government on an amendment to the Foreign Exchange Transactions Act, planned within 2026, that would classify stablecoins as payment instruments for cross-border transfers and build monitoring through the existing foreign-exchange information network. The stated motivation is laundering risk associated with mixers and unhosted wallets, illustrated by officials with reference to an alleged case involving roughly 107 million dollars. Separately, on October 13, 2026, the Financial Services Commission ordered domestic access restriction or service termination for 27 websites operated by unregistered crypto businesses, acting on review by the Korea Communications Standards Commission and at the request of the Financial Intelligence Unit. Taken together, these are best read as architecture rather than incident. Neither item is an enforcement action against a licensed, registered platform; both are perimeter-control moves aimed at unregistered or foreign-facing activity that currently sits outside the reporting net built around the Korea Financial Intelligence Unit. The foreign-exchange amendment in particular would be a structural extension: it does not create a new crypto-specific statute but repurposes the existing foreign-exchange reporting architecture to capture stablecoin flows, which is a materially different design choice from adding a bespoke virtual-asset reporting obligation. The planned amendment is not yet enacted; it remains at a pre-legislative, consultation-adjacent stage, and no primary Bank of Korea or government text was available this cycle to confirm drafting specifics beyond what officials stated at the audit. #### Other Developments Site-blocking as a volume-of-enforcement signal. The blocking of 27 unregistered-crypto websites is a relatively high count for a single action and suggests the authorities are treating unregistered offshore-facing platforms as a distinct enforcement lane from the licensed-exchange AML supervision that has otherwise dominated Korean crypto regulatory activity. The underlying notice from the Financial Services Commission or the Korea Communications Standards Commission was not reached this cycle, so the specific legal basis cited for each blocked site, and whether any of the 27 were previously the subject of KoFIU warnings, cannot yet be stated with confidence. Stablecoin classification choice carries downstream consequences. Classifying stablecoins as payment instruments under the Foreign Exchange Transactions Act, rather than treating them purely as virtual assets under the existing Act on the Protection of Virtual Asset Users or the Act on Reporting and Using Specified Financial Transaction Information, would route stablecoin cross-border flows through foreign-exchange reporting channels rather than (or alongside) the standard suspicious-transaction-report pathway supervised by KoFIU. This is a design question still open: the plan as stated this cycle does not resolve how the two reporting architectures would interact for a single stablecoin transfer that is both a virtual-asset transaction and a cross-border foreign-exchange transaction. #### Cross-Monitor Connections The foreign-exchange-led approach to stablecoin oversight has a natural read-across to monitors tracking crypto and digital-asset infrastructure more broadly, since a reporting architecture built around currency-exchange data networks rather than virtual-asset-specific registries changes what data trail international counterparties would need to produce. The cited mixer and unhosted-wallet laundering risk also connects to broader conflict-finance and sanctions-evasion typology work elsewhere in the fleet, insofar as mixer use and unhosted-wallet transfers are a recurring feature in cross-border illicit-finance typologies tracked outside this jurisdiction; no KR-specific sanctions-nexus claim was established this cycle, so this connection is noted as a structural parallel only, not as a finding about Korea. #### Outlook The amendment to the Foreign Exchange Transactions Act is targeted for action within 2026, but as at this cycle it had not been enacted and no primary legislative text was available, so the practical shape of the reporting obligation, the firms it will bind, and its effective date all remain open. Watch for a Bank of Korea or Ministry of Economy and Finance primary release that would move this claim from a two-source, officials-stated plan to a documented legislative instrument. The site-blocking action on unregistered platforms is likely to continue as a recurring enforcement lane independent of the stablecoin amendment, since it draws on existing authority rather than new legislation; further rounds of blocking orders would reinforce the reading that Korea is prioritizing perimeter control of unregistered and offshore-facing crypto activity ahead of, or in parallel with, formal legislative change. Earlier periodic briefs (8) 4 Nov 2026 · fim-2026-11-01 #### Lead Signal South Korea is converging its anti-money-laundering and foreign-exchange oversight on digital assets, with two developments pointing in the same direction. The Bank of Korea, speaking at an October 22 parliamentary audit, confirmed it is coordinating with the government on an amendment to the Foreign Exchange Transactions Act, planned within 2026, that would classify stablecoins as payment instruments for cross-border transfers and build monitoring through the existing foreign-exchange information network. The stated motivation is laundering risk associated with mixers and unhosted wallets, illustrated by officials with reference to an alleged case involving roughly 107 million dollars. Separately, on October 13, 2026, the Financial Services Commission ordered domestic access restriction or service termination for 27 websites operated by unregistered crypto businesses, acting on review by the Korea Communications Standards Commission and at the request of the Financial Intelligence Unit. Taken together, these are best read as architecture rather than incident. Neither item is an enforcement action against a licensed, registered platform; both are perimeter-control moves aimed at unregistered or foreign-facing activity that currently sits outside the reporting net built around the Korea Financial Intelligence Unit. The foreign-exchange amendment in particular would be a structural extension: it does not create a new crypto-specific statute but repurposes the existing foreign-exchange reporting architecture to capture stablecoin flows, which is a materially different design choice from adding a bespoke virtual-asset reporting obligation. The planned amendment is not yet enacted; it remains at a pre-legislative, consultation-adjacent stage, and no primary Bank of Korea or government text was available to confirm drafting specifics beyond what officials stated at the audit. #### Other Developments Site-blocking as a volume-of-enforcement signal. The blocking of 27 unregistered-crypto websites is a relatively high count for a single action and suggests the authorities are treating unregistered offshore-facing platforms as a distinct enforcement lane from the licensed-exchange AML supervision that has otherwise dominated Korean crypto regulatory activity. The underlying notice from the Financial Services Commission or the Korea Communications Standards Commission was not reached, so the specific legal basis cited for each blocked site, and whether any of the 27 were previously the subject of KoFIU warnings, cannot yet be stated with confidence. Stablecoin classification choice carries downstream consequences. Classifying stablecoins as payment instruments under the Foreign Exchange Transactions Act, rather than treating them purely as virtual assets under the existing Act on the Protection of Virtual Asset Users or the Act on Reporting and Using Specified Financial Transaction Information, would route stablecoin cross-border flows through foreign-exchange reporting channels rather than (or alongside) the standard suspicious-transaction-report pathway supervised by KoFIU. This is a design question still open: the plan as stated does not resolve how the two reporting architectures would interact for a single stablecoin transfer that is both a virtual-asset transaction and a cross-border foreign-exchange transaction. #### Cross-Monitor Connections The foreign-exchange-led approach to stablecoin oversight has a natural read-across to monitors tracking crypto and digital-asset infrastructure more broadly, since a reporting architecture built around currency-exchange data networks rather than virtual-asset-specific registries changes what data trail international counterparties would need to produce. The cited mixer and unhosted-wallet laundering risk also connects to broader conflict-finance and sanctions-evasion typology work elsewhere in the fleet, insofar as mixer use and unhosted-wallet transfers are a recurring feature in cross-border illicit-finance typologies tracked outside this jurisdiction; no KR-specific sanctions-nexus claim was established, so this connection is noted as a structural parallel only, not as a finding about Korea. #### Outlook The amendment to the Foreign Exchange Transactions Act is targeted for action within 2026, but as it had not been enacted and no primary legislative text was available, so the practical shape of the reporting obligation, the firms it will bind, and its effective date all remain open. Watch for a Bank of Korea or Ministry of Economy and Finance primary release that would move this claim from a two-source, officials-stated plan to a documented legislative instrument. The site-blocking action on unregistered platforms is likely to continue as a recurring enforcement lane independent of the stablecoin amendment, since it draws on existing authority rather than new legislation; further rounds of blocking orders would reinforce the reading that Korea is prioritizing perimeter control of unregistered and offshore-facing crypto activity ahead of, or in parallel with, formal legislative change. 3 Nov 2026 · fim-2026-11-03 #### Lead Signal South Korea has moved to close a structural gap between its foreign exchange control framework and the realities of stablecoin-denominated cross-border transfer. The government and the Bank of Korea told an October 22, 2026 parliamentary audit that they intend to amend the Foreign Exchange Transactions Act within 2026 so that stablecoins are classified as payment instruments for cross-border monitoring purposes. The stated driver is not technological convenience but sanctions-evasion and anti-money-laundering risk: officials pointed to an alleged $107 million crypto-linked laundering case and to continuing exposure through mixers and unhosted wallets as the practical justification for extending the foreign-exchange information network to stablecoin flows. This is a probable-confidence development, resting on two Tier 3 sources rather than a primary Bank of Korea or Financial Services Commission text, and the amendment itself has not yet been drafted. What is significant architecturally is the direction of travel: a currency-control statute is being repurposed as an anti-money-laundering instrument for digital assets, which signals that Korean authorities see the cross-border transfer channel, not the domestic exchange perimeter, as the current point of exposure. The amendment plan did not arrive in isolation. It follows a visible enforcement action in the same month, discussed below, that targeted the unregistered edge of the market the new monitoring regime would also need to reach. #### Other Developments Unregistered-platform access restrictions. On October 13, 2026, the Financial Services Commission announced domestic access restrictions or service termination for 27 websites operated by unregistered crypto businesses, acting at the request of the Korea Financial Intelligence Unit following a review by the Korea Communications Standards Commission on October 6 and 7. This is an enabler-jurisdiction finding rather than a licensing story: the websites in question sat outside the registration perimeter altogether, and the lever used against them was access-blocking rather than a financial penalty. Confidence on this item is held at the uncertain tier because it rests on a single Tier 3 account and the underlying regulator notice has not itself been reached. The read-across is nonetheless useful: it indicates that registration-evasion through offshore or unregistered platforms remains a live channel into the Korean market, and that the response of first resort is domestic access denial rather than cross-border enforcement coordination. Travel rule threshold expansion under discussion. Separately, Korean authorities have signalled an intention to expand the so-called travel rule, domestically described as the coin real-name system, beyond its current threshold as part of the Financial Intelligence Unit's broader 2026 anti-money-laundering work plan targeting digital-asset risk. This sits alongside, rather than inside, the foreign-exchange amendment: it is a tightening of the existing transaction-monitoring architecture rather than a new instrument, and it reinforces the same underlying concern about traceability of value as it crosses into or out of the regulated perimeter. #### Cross-Monitor Connections The foreign-exchange amendment plan has a direct bearing on how digital-asset firms experience cross-border payment rules, since reclassifying stablecoins as payment instruments would route stablecoin transfers through the same foreign-exchange information network used for conventional payment flows. It also bears on how such firms are licensed and supervised domestically, since the enforcement action against unregistered platforms and the anti-money-laundering work-plan expansion of the real-name transaction system both target the same population of digital-asset intermediaries that any revised foreign-exchange treatment would apply to. Conflict-finance and extractive-industry monitoring is not implicated; the sanctions-evasion concern raised by officials is framed in general terms around mixers and unhosted wallets rather than tied to a named conflict-finance typology. #### Outlook The Foreign Exchange Transactions Act amendment is targeted for completion within 2026, meaning it was framed as current-year business at the time it was described and should be read as a near-term legislative project rather than a settled rule; whether it is enacted by year-end or carries into early 2027 cannot be determined from the sourcing available. Separately, the broader Digital Asset Basic Act Phase 2 legislation remains under inter-party negotiation and was reported as targeted for National Assembly review in November 2026. Both tracks point toward the same underlying trajectory: Korean authorities tightening the perimeter around stablecoins and cross-border digital-asset flows on sanctions-evasion and money-laundering grounds, with the foreign-exchange route moving faster than the broader licensing framework. A primary-source confirmation from the Bank of Korea or the Financial Services Commission would be the natural marker that this moves from probable to confirmed; until then the finding stands on secondary reporting of a parliamentary audit statement. 25 Oct 2026 · fim-2026-10-25 #### Lead Signal South Korean authorities dismantled a record illegal-gambling supply network run by the Chungnam Provincial Police Agency, apprehending 77 suspects connected to a scheme valued at roughly KRW23 trillion (about USD17.3 billion). The operation relied on live-casino video feeds streamed from legally operating overseas gaming companies, with the network's operational bases sitting across Vietnam and Cambodia rather than inside South Korea itself. Police froze KRW9.6 billion in assets and issued 12 Interpol Red Notices. The structural point is less the single enforcement action than what it confirms about the pattern: a domestic illicit-finance scheme in South Korea was able to scale to this size precisely because its operational infrastructure sat offshore, outside the reach of South Korean supervision, in jurisdictions where gambling licensing and oversight is lighter or less consistently enforced. That offshore-basing pattern is the throughline. It is not a South Korean regulatory gap being probed; it is a South Korean enforcement success that incidentally illuminates how enabler jurisdictions elsewhere in the region continue to carry the operational weight of schemes whose victims and targets sit in better-regulated markets. #### Other Developments Cambodia's own house-cleaning continues under renewed pressure. Cambodia suspended casino live-dealer proxy-betting streaming from October 2026 and introduced new licence-renewal standards for its casino sector, a move reported as tightening oversight of an industry long associated with cross-border scam operations. Cambodia's central-bank governor has separately warned that the country's earlier removal from the Financial Action Task Force grey list in 2023 does not amount to a permanent exemption, given continuing scrutiny of scam-compound and casino-linked activity. No formal FATF plenary action has been confirmed, but the warning itself is notable coming from the country's own monetary authority. Laos remains a structurally anchored hub, unchanged. A regional report on cyber-scam hubs and human trafficking names the Golden Triangle Special Economic Zone in Laos as one of the pattern's flagship locations, alongside sites in Cambodia, illustrating how the scam-compound economy continues to root itself in zones of weak state authority. No new Laos-specific enforcement action was identified; the finding is a continuation of a known structural condition rather than a fresh development. Mexico faces escalating external pressure on its banking sector. The US Ambassador to Mexico publicly warned Mexican commercial banks of the risk of financial isolation should they continue facilitating cartel-linked money flows. Reporting citing Mexico's financial intelligence unit indicates roughly 24,622 accounts, worth an estimated USD481.67 million, were frozen between October 2024 and August 2026, though this figure rests on a single lower-tier source and has not been independently verified. #### Cross-Monitor Connections The same Southeast Asian scam-compound architecture that explains the offshore basing of the South Korean gambling network also sits at the centre of findings tracked elsewhere: a stablecoin-rail dimension, where a US financial-intelligence alert on fuel-smuggling and tax-evasion schemes flags stablecoin payments as an increasingly used channel for cartel-linked money movement, and a sanctions dimension, where European Union designations earlier in the year targeted individuals and entities connected to cryptocurrency-linked investment fraud operating out of compounds in Myanmar and Cambodia. Read together, the enabler-jurisdiction pattern in Southeast Asia is not confined to gambling; it is a shared infrastructure of permissive oversight, scam-compound operations, and crypto-rail settlement that recurs across gambling, investment-fraud, and trafficking typologies alike. Digital-asset monitoring interests should note that the geography doing the enabling work for the South Korean gambling case overlaps closely with the geography named in crypto-fraud sanctions and alerts tracked separately. #### Outlook The South Korean enforcement action is best read as episodic rather than structural: a single, large, successful case rather than evidence of a changed South Korean AML/CTF posture. The more durable story is in the enabler jurisdictions themselves. Cambodia's licensing tightening and its central bank governor's own warning suggest the government is aware that continuing scam-compound scrutiny could translate into renewed grey-list pressure, even though no FATF plenary decision has been confirmed. Watch for whether Cambodia's casino and proxy-betting restrictions, introduced from October 2026, produce any measurable reduction in the kind of offshore live-casino infrastructure that fed the South Korean case, or whether enforcement simply displaces to neighbouring jurisdictions, including Laos, where the Golden Triangle zone remains structurally anchored and unaddressed. Mexico's trajectory bears separate watching: escalating US rhetoric about bank-level financial isolation, if it translates into actual correspondent-banking consequences, would mark a shift from warning to structural pressure on Mexican financial institutions. 18 Oct 2026 · fim-2026-10-18 #### Lead Signal South Korea's dominant financial-integrity signal this cycle is operational and compliance-technology in character rather than classic anti-money-laundering activity. An AI-assisted intrusion wave struck major Korean banks, including Shinhan Bank and KB Kookmin Bank, prompting the Financial Services Commission to order sector-wide security reviews for banks and credit-card issuers on 13 October 2026. The Commission confirmed on 14 October 2026 that 16 financial firms had been breached since the start of the month, with roughly 100,000 records exposed. The response has now moved toward structural reform of the inspection cadence itself: the FSC is moving to mandate twice-yearly vulnerability checks for larger financial institutions, including crypto exchanges, after a review found security gaps at 130 companies. #### Other Developments Perimeter-policing of high-leverage crypto products. The Financial Services Commission issued user advisories on 16 October 2026 warning against perpetual futures products carrying leverage of ten to two hundred times on virtual assets and stocks, offered through overseas platforms. This advisory activity sits alongside the FSC's operational-resilience response as a second, parallel line of regulatory attention toward the crypto-adjacent sector this cycle. Standing AML/CTF architecture unchanged. Korea's Financial Intelligence Unit, KoFIU, remains the designated reporting authority under the Act on Reporting and Using Specified Financial Transaction Information (FTRA). Virtual asset service providers register with KoFIU, subject to ISMS certification, real-name bank-account requirements, and AML and travel-rule duties. The Act on the Protection of Virtual Asset Users, in force since 19 July 2024, adds a market-conduct and user-asset-protection layer enforced by the Financial Services Commission and Financial Supervisory Service, including a fast-track prosecutorial referral channel and a priority-repayment provision for users on VASP insolvency. None of this standing architecture changed this cycle. Sanctions and beneficial-ownership posture stable. Korea does not appear on the FATF blacklist, which currently names Iran, North Korea and Myanmar, nor on the 22-jurisdiction grey list as confirmed at the 19 June 2026 plenary. Korea continues to have no centralised public beneficial-ownership register; verification relies instead on self-maintained corporate records, foreign direct investment notification filings, and bank-level know-your-customer processes. #### Cross-Monitor Connections The banking-breach wave driving this cycle's compliance-technology signal is the same underlying incident set tracked separately by world-payments under its operational-resilience domain, where the FSC's sector-wide security order and planned biannual vulnerability-audit regime are read as a structural tightening of operational-resilience supervision. The same incidents also fall under the Personal Information Protection Commission's data-breach jurisdiction, a thread tracked by the data-protection monitor rather than here. Readers tracking the crypto-sector dimension of the FSC's perpetual-futures advisory and planned audit extension to crypto exchanges should also consult the crypto monitor's stablecoin-regime coverage for this jurisdiction. #### Outlook Whether the FSC's planned twice-yearly vulnerability-audit mandate is formalised into a binding instrument, and whether any of the 16 confirmed breaches results in a Financial Services Commission or Financial Supervisory Service enforcement action against a named institution, will be the clearest signals of how this cycle's compliance-technology escalation translates into durable supervisory change. The extension of the planned audit cadence explicitly to crypto exchanges also bears watching as a potential bridge between Korea's banking-sector operational-resilience response and its separate, still-unsettled digital-asset legislative track. 12 Oct 2026 · fim-2026-10-12 #### Lead Signal South Korea's financial-crime architecture moved on two fronts this cycle: a structural tightening of the crypto Travel Rule and a continuing wave of AML enforcement against the country's largest virtual-asset service providers. The Cabinet approved removal of the roughly KRW 1,000,000 Travel Rule de minimis exemption on 11 August 2026, with the Enforcement Decree promulgated on 18 August 2026; VASP-registration provisions became effective on 20 August 2026, and the transfer-rule provisions enabling originator/beneficiary information-sharing on every domestic VASP-to-VASP transfer, regardless of value, are scheduled to commence around 19-20 February 2027, six months after promulgation. This is an architecture-level finding: Korea is closing a smurfing vector the Korea Financial Intelligence Unit (KoFIU) itself has recognised, by eliminating the threshold below which transfers could pass without originator information. Confidence on the precise mechanics is Probable rather than Confirmed, since no direct fsc.go.kr or kofiu.go.kr primary notice was retrieved this cycle and the finding is corroborated instead across multiple trade-press sources. Alongside the structural change, enforcement activity against Korea's major exchanges continued. KoFIU's fines against Dunamu (Upbit), Bithumb and Korbit for KYC-verification and suspicious-transaction-reporting failures illustrate that the de minimis removal is not occurring against a clean compliance backdrop, but against a sector where know-your-customer gaps have already produced material regulatory penalties. #### Other Developments DNFBP coverage gap under active review. KoFIU's AML/CFT policy advisory committee, announced 5 February 2026, is preparing an AML/CDD/STR obligations package for lawyers, certified public accountants and tax accountants, together with a new suspicious-account suspension power. The Financial Services Commission's own press release states Korea is one of only two FATF members that have not yet extended CDD and STR obligations to these professional categories, which places this as a designated non-financial-business-and-profession (DNFBP) enabler-jurisdiction gap being addressed ahead of Korea's FATF mutual evaluation scheduled for 2028. This remains at consultation stage. FATF compliance trajectory improving. Korea's 2024 FATF Follow-Up Report re-rates Recommendation 8 (non-profit organisations) from partially compliant to largely compliant, leaving Korea compliant or largely compliant on 33 of 40 Recommendations ahead of the March 2028 mutual evaluation. This is a Confirmed finding, sourced directly from FATF's own published report. Exchange enforcement wave continues. Dunamu was fined and given a three-month new-customer transfer suspension (24 November 2025) over approximately 700,000 KYC verification violations and 15 unreported suspicious transactions; a Korean court partially overturned the suspension in April 2026. Bithumb was fined approximately US$24 million with a six-month partial suspension (16 March 2026) following an on-site inspection that found approximately 6.65 million KYC and transaction-restriction violations. Korbit was fined approximately US$1.9 million (31 December 2025) for AML and customer-verification breaches, disclosed amid talks to sell a stake to Mirae Asset. Confidence on each individual fine is Probable, since these are sourced from quality trade journalism rather than a primary KoFIU notice. Traditional finance deepens crypto exposure. Hana Bank disclosed a reported acquisition of an approximately US$670 million stake in Dunamu, the operator of Upbit; this figure is press-reported rather than confirmed via a company filing, and confidence is accordingly Uncertain. Separately, MoonPay Korea named BTQ Technologies as security partner for its won-denominated stablecoin infrastructure, with Woori Bank announced as the inaugural member of MoonPay Korea's KRW Stablecoin Consortium, as of 9 October 2026. #### Cross-Monitor Connections The Travel Rule tightening and the DNFBP consultation both carry direct relevance to crypto-sector oversight more broadly, where the same Enforcement Decree amendment governs VASP registration and transfer-monitoring obligations. The commercial consolidation signal — bank entry into exchange ownership and stablecoin-infrastructure partnerships — intersects with questions of institutional concentration risk in the payments space, where traditional banks are becoming direct counterparties to virtual-asset operators rather than merely their correspondent bankers. The enforcement wave against Upbit, Bithumb and Korbit also bears on broader questions of commercial-activity due diligence, given that acquirers and investors are entering a sector carrying recent and material AML sanctions history. #### Outlook The period between now and February 2027 will show whether Korean VASPs can operationalise zero-threshold Travel Rule compliance without the kind of KYC failures that generated the Dunamu, Bithumb and Korbit fines. The DNFBP consultation, if it proceeds toward enactment, would close a gap FATF itself has flagged and materially strengthen Korea's position ahead of the March 2028 mutual evaluation; its current status remains consultation rather than enacted law, and the timeline to finalisation is not yet confirmed. The continuing entry of banks into crypto-exchange ownership and stablecoin infrastructure is, on present evidence, a commercial trend rather than a supervisory one, but it increases the stakes attached to how cleanly the Travel Rule transition and the enforcement wave are resolved. 4 Oct 2026 · fim-2026-10-04 #### Lead Signal South Korea's Financial Intelligence Unit has completed its largest-ever sequential AML enforcement wave against domestic virtual-asset service providers, imposing three separate large fines on Upbit, Korbit and Bithumb between November 2025 and March 2026. Bithumb was fined KRW 36.8 billion, approximately $24.5 million, and given a six-month partial suspension of external transfers for new customers, over approximately 6.65 million AML violations including failed customer identification and 45,772 transfers to 18 unregistered overseas virtual-asset service providers. Dunamu, operator of Upbit, was fined approximately KRW 35.2 billion, around $25 million, for accepting photocopied identification documents, permitting 3.3 million transactions by unverified customers, and failing to report 15 suspicious transactions. Korbit was fined KRW 2.73 billion with an institutional warning for inadequate customer identification, unauthorized transactions with overseas operators, and skipped AML risk assessments on new services including NFTs. The pattern across all three actions is structurally consistent: domestic exchanges operating under Korea's registration regime under the Act on Reporting and Using Specified Financial Transaction Information nonetheless routed transactions to unregistered overseas virtual-asset service providers, a leakage point at the cross-border counterparty interface that the domestic registration perimeter alone did not close. #### Other Developments A DPRK IT-worker crypto-laundering network was sanctioned by OFAC in March 2026, with cross-cutting relevance to Korean VASP counterparty screening. Six individuals and two entities were designated for laundering approximately $800 million generated through fraudulent DPRK overseas IT-worker employment schemes, funding weapons-of-mass-destruction and ballistic-missile programs. DPRK-backed teams used fraudulent documentation, stolen identities and fabricated personas to gain employment, including at companies in the United States and allied countries. This designation is global in scope but bears directly on the counterparty-screening exposure of any Korean virtual-asset operator transacting with overseas counterparties, given the demonstrated pattern of DPRK actors obscuring their identity within ordinary-looking employment and payment relationships. The Financial Services Commission is separately hardening technical AML and operational controls following a February 2026 Bithumb payout error. Exchanges are being required to shift from delayed, up to 24-hour, balance checks to real-time reconciliation every five minutes, alongside proposed automated kill-switch and semi-annual inspection requirements. This technical-control reform runs on a parallel track to the AML fines, addressing operational-resilience gaps rather than customer-identification failures directly, though both tracks originate from the same underlying supervisory concern about exchange-level control adequacy. #### Cross-Monitor Connections The crypto monitor's tracking of South Korea's parallel VASP-licensing and cross-border-transfer legislative tightening, including the Foreign Exchange Transactions Act amendment bringing virtual-asset cross-border remittance businesses under a registration duty with criminal penalties, is directly relevant context for the enabler-jurisdiction leakage pattern identified here: a new registration-and-penalty architecture for cross-border virtual-asset transfers is the kind of instrument that could close the exact overseas-VASP leakage this cycle's enforcement wave exposed, once its Presidential Decree detail is finalised. The world-payments monitor's tracking of Korean payment-gateway fund-safeguarding requirements is architecturally adjacent but distinct: that regime addresses merchant-settlement fund protection rather than counterparty AML screening, and the two should not be conflated. #### Outlook Whether the FSC's technical-control reforms, once finalised, measurably reduce the kind of balance-reconciliation and customer-identification failures underlying the Bithumb, Upbit and Korbit fines is the principal item to track. Separately, whether Korea's new cross-border virtual-asset transfer registration duty, once its Presidential Decree is published, functions to close the overseas-unregistered-VASP leakage this cycle's enforcement pattern exposed, or whether that leakage persists despite a nominally tightened domestic perimeter, will determine whether this cycle's enforcement wave represents a point-in-time correction or a structural fix. 28 Sep 2026 · fim-2026-09-28 #### Lead Signal South Korea's financial-integrity posture this cycle is dominated by escalating AML enforcement against the country's two largest virtual-asset service providers, running alongside a structural policy agenda aimed at closing recognised gaps ahead of the country's next FATF mutual evaluation. Korea's financial intelligence unit fined Bithumb KRW36.8 billion (US$24.6 million) and ordered a six-month partial suspension for approximately 6.65 million violations of the Act on Reporting and Using Specified Financial Transaction Information, including KYC failures and transactions with unregistered overseas virtual-asset service providers. The Seoul Administrative Court subsequently stayed the suspension, leaving unclear whether the fine itself is also on hold pending a full verdict. Separately, the Financial Supervisory Service opened a formal sanction process against Dunamu, the operator of Upbit, sending an inspection report in July 2026 tied to a November 2025 theft of approximately US$30 million. South Korean authorities have suspected North Korea's Lazarus Group of involvement, though neither Upbit nor regulators have publicly confirmed attribution. Both actions land against a backdrop of a formally announced 2026 AML/CFT policy agenda from Korea's financial intelligence unit, which commits to a centralised beneficial-ownership database sourced from existing suspicious-transaction-report data, removal of the current travel-rule reporting threshold, and extension of AML obligations to lawyers, certified public accountants and tax accountants -- an area where Korea has remained a FATF-member outlier. #### Other Developments A joint task force is forming ahead of the March 2028 mutual evaluation. Korea's financial intelligence unit plans to establish and operate a joint response team with officials from related government ministries to prepare for its AML/CFT mutual evaluation with the Financial Action Task Force, scheduled for March 2028. Korea has been a full FATF member since completing its mutual evaluation in November 2008, having obtained observer status in August 2006, and carries no grey-list exposure. Beneficial-ownership verification remains institution-internal rather than public. No public, centrally searchable beneficial-ownership register exists in Korea; verification of the natural person who ultimately owns or controls a legal entity currently occurs only within regulated institutions' own customer-due-diligence files, enforced by the Financial Services Commission and the financial intelligence unit. The planned centralised database sourced from suspicious-transaction-report data is an incremental step toward improved traceability, but it falls short of a public register. #### Cross-Monitor Connections The Bithumb and Dunamu/Upbit enforcement actions sit at the intersection of financial-integrity's AML architecture reading and world-payments' and crypto's own regulatory tracking of the same virtual-asset service providers: the underlying entities and enforcement events are the same facts viewed through different lenses. The suspected, unconfirmed Lazarus Group attribution in the Dunamu matter is also a potential sanctions-evasion signal worth flagging for cross-monitor awareness, though it remains unconfirmed and is not treated here as an established sanctions-nexus finding. #### Outlook The travel-rule threshold removal, targeted for February 2027, and the DNFBP AML-coverage extension to lawyers, accountants and tax professionals, targeted for early 2027, are the two structural reforms most likely to shape Korea's AML/CFT architecture ahead of its March 2028 FATF mutual evaluation. The outcome of the Bithumb litigation -- specifically whether the Seoul Administrative Court's stay of the suspension extends to the underlying fine -- will be a useful signal of how durable KoFIU's enforcement actions against major VASPs prove to be under judicial review. 21 Sep 2026 · fim-2026-08-21 #### Lead Signal South Korea's cycle is dominated by a two-front crisis at Bithumb that has become the clearest illustration yet of a persistent AML/KYC and operational-control gap across the country's largest virtual-asset service providers. Regulators found approximately 6.65 million alleged AML violations at the exchange, comprising 3.55 million identity-verification failures and 3.04 million transaction-blocking failures, and imposed a six-month partial business suspension that a Korean court subsequently overturned on appeal, leaving the status of an associated $24.6 million fine unresolved. Separately, a $40 billion 'ghost bitcoin' mis-crediting incident in February 2026 prompted the Financial Supervisory Service to commit to deploying AI-based real-time trading-surveillance tools, introducing punitive fines for IT incidents, and increasing executive security accountability. Read together, these two episodes point to a structural rather than episodic weakness: Korea's largest exchanges have now been sanctioned within an eighteen-month window, evidencing systemic gaps in KYC and transaction-monitoring controls rather than isolated compliance failures, even as the court's reversal of the Bithumb suspension introduces genuine near-term uncertainty about how enforcement outcomes will actually resolve. #### Other Developments Sanctions-adjacent domestic mechanism strengthens. The amended Terrorist Financing Act, effective 22 January 2026, criminalises transacting with persons on the Financial Services Commission's prohibited list without prior approval, exposing violators to up to three years' imprisonment or a KRW30 million fine. This functions as a domestic targeted-financial-sanctions-adjacent mechanism sitting alongside Korea's core AML architecture, tightening the designation-enforcement toolkit available to authorities. Governance reform leaves beneficial-ownership gap unresolved. The 2026 Commercial Act amendments, promulgated 6 March 2026, represent the most consequential overhaul of Korean corporate governance since the post-Asian-financial-crisis reforms of 1998-1999, introducing a 3% voting cap and mandatory treasury-share cancellation. The reform, however, leaves entirely unaddressed the absence of any disclosure obligation regarding the ultimate beneficial owner of publicly traded companies, a gap that persists despite the otherwise material strengthening of governance disclosure. Pattern across Korea's largest exchanges. Dunamu, operator of Upbit, received a three-month partial suspension and a KRW35.2 billion fine in 2025 for compliance gaps, a sanction that now reads as part of an escalating pattern of FIU enforcement against Korea's largest virtual-asset platforms rather than a standalone event, reinforcing the assessment that Bithumb's violations reflect a sector-wide rather than firm-specific control deficiency. #### Cross-Monitor Connections The Bithumb operational-control failure surfaces directly in World Payments Monitor's operational-resilience tracking, where the same ghost-bitcoin incident is read as an asset-matching and account-segregation control weakness in payment-adjacent digital-asset infrastructure. The amended Terrorist Financing Act's criminalisation of unauthorised dealing with FSC-prohibited persons is a shared data point with the Advennt gambling monitor, where the same statute is read as tightening payment-flow due diligence for gambling-adjacent intermediaries — the same primary legislation, two different operator-facing lenses. On the digital-asset side, the unresolved Bank of Korea/Financial Services Commission dispute over stablecoin-issuer ownership, tracked in depth by the crypto monitor, is the structural constraint delaying the Digital Asset Basic Act that would otherwise establish a comprehensive licensing perimeter for the crypto-asset activity generating this cycle's AML findings. #### Outlook The Digital Asset Basic Act remains the single most consequential item on Korea's financial-integrity horizon, targeted for the second half of 2026 but contingent on resolving the stablecoin-issuer ownership dispute between the Bank of Korea and the Financial Services Commission that remained unresolved as of April 2026; its passage would establish a licensing and AML perimeter for crypto-asset issuance, custody, and stablecoin issuance not currently codified in a single statute. Watch also whether the Bithumb fine is ultimately upheld following the suspension reversal, and whether the FSS's committed AI-monitoring and punitive IT-incident-fine regime materialises in a form that measurably reduces the recurrence of exchange-level control failures. Domain intelligence (D1–D8) #### Sanctions Architecture and Evasion The defining sanctions-architecture signal this cycle is OFAC's 12 March 2026 designation of six individuals and two entities tied to a DPRK IT-worker crypto-fraud network that generated approximately 800 million dollars in 2024 to fund North Korea's weapons programs. Read architecturally rather than as an isolated incident, the case describes a distributed enabler model: IT-worker placement schemes spanning multiple jurisdictions, generating illicit revenue at a scale that a single designation action cannot fully interdict. Corroboration from Chainalysis strengthens the finding to High confidence, and the case illustrates a persistent structural feature of DPRK sanctions evasion: designation follows revenue generation with a lag, meaning the sanctioned network's operational model likely survives any single enforcement action by adapting its jurisdictional footprint. Continue reading #### Outlook The key structural question for this domain is whether designation cadence can keep pace with the scale of DPRK-linked crypto-fraud revenue generation. This cycle's evidence base is limited to a single, well-corroborated designation action; broader assessment of the sanctions-evasion architecture's resilience will require observing whether follow-on designations target the same enabler network across its Vietnam, Laos and Spain footprint. Judgment: No material KR-specific sanctions-architecture or evasion finding this cycle. Uncertain #### Beneficial Ownership and Corporate Transparency Korea sits outside the EU AML Package's direct supervisory perimeter, so the directly relevant beneficial-ownership development this cycle is domestic: an amendment to the Financial Transaction Reports Act, committee-passed 3 December 2025, which requires VASP registrants to disclose major shareholders and authorises the regulator to deny registration on criminal-history or governance-adequacy grounds. This closes a documented gap in VASP-sector fit-and-proper and beneficial-ownership screening, and it sits within the same taskforce agenda, driven by preparation for Korea's 2028 FATF mutual evaluation, that is also expanding travel-rule thresholds and account-suspension powers. The finding rests on a single Tier-3 law-firm source with no Tier-1 or Tier-2 corroboration located this cycle. Continue reading Globally, the EU AML Package sets the structural direction for beneficial-ownership and corporate-transparency supervision. The package comprises three distinct instruments: the directly applicable AML Regulation (Regulation (EU) 2024/1624), the sixth AML Directive requiring Member State transposition, and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the Anti-Money Laundering Authority. AMLA's direct and indirect supervision perimeter is shifting oversight of cross-border obliged entities from purely national authorities toward a hybrid EU-level regime. This is standing structural backdrop rather than a Korea-specific development; no AMLA horizon anchor was carried in this cycle's interpreter output for Korea specifically, so this paragraph is stated from standing context rather than from a fresh finding. #### Outlook Whether Korea's VASP beneficial-ownership amendment reaches enactment beyond committee passage, and whether the broader FATF-evaluation-driven taskforce agenda produces further beneficial-ownership measures, are the markers to track. Signal for this domain was limited this cycle to a single Korea-specific claim plus standing EU architecture context. Judgment: No beneficial-ownership development surfaced for KR this cycle. Uncertain #### Enabler Jurisdictions The defining signal this cycle is structural rather than incidental: a record-scale South Korean illegal-gambling operation, valued at roughly KRW23 trillion (about USD17.3 billion), was dismantled by the Chungnam Provincial Police Agency, but its operational core sat outside South Korea entirely, across Vietnam and Cambodia, using live-casino video feeds streamed from legally operating overseas gaming companies. Seventy-seven suspects were apprehended, KRW9.6 billion was frozen, and 12 Interpol Red Notices were issued. The case is a textbook illustration of the enabler-jurisdiction dynamic this domain tracks: a scheme targeting one jurisdiction's population and financial system is architecturally dependent on the licensing and oversight posture of a different jurisdiction entirely, one where gambling supply, live-streaming infrastructure, or corporate registration carries fewer effective constraints. Continue reading Cambodia sits at the centre of that dependency, and its own regulatory posture shifted materially this cycle. Cambodia suspended casino live-dealer proxy-betting streaming from October 2026 and introduced new licence-renewal standards for its casino sector. This is a government acting on its own industry, not an externally imposed sanction, and it follows a now-familiar pattern of Cambodia tightening casino-sector rules in response to mounting international scrutiny of scam-compound and casino-linked illicit finance. Significantly, Cambodia's own central-bank governor warned that the country's 2023 removal from the Financial Action Task Force grey list does not constitute a permanent exemption, an unusually candid acknowledgment from a domestic monetary authority that the structural conditions behind the original listing have not been fully resolved. No formal FATF plenary action was confirmed this cycle, so this is a warning rather than a re-listing, but it is a warning worth weighting carefully given it originates from inside Cambodia's own institutions rather than from an external critic. Laos presents the other half of the regional enabler picture, and here the finding is one of continuity rather than change. A regional report on cyber-scam hubs and human trafficking names the Golden Triangle Special Economic Zone in Laos as one of the pattern's flagship locations, describing a structural anchoring of the scam-compound economy in zones where state authority is comparatively weak. No new Laos-specific enforcement action was identified this cycle. The absence of enforcement here is itself a data point: it indicates the structural conditions that make the Golden Triangle zone attractive to illicit operators remain unaddressed, even as neighbouring Cambodia moves to tighten its own casino rules. If Cambodia's restrictions succeed in displacing proxy-betting and live-casino infrastructure, the Golden Triangle zone in Laos is a plausible landing point given its already-established role in the regional pattern. Mexico's inclusion this cycle reflects a different flavour of enabler dynamic: not weak licensing of gambling or gaming infrastructure, but a banking sector under escalating external pressure over facilitation of cartel-linked financial flows. The US Ambassador to Mexico publicly warned Mexican commercial banks of the risk of financial isolation for continuing to facilitate cartel money movement. Separately, reporting citing Mexico's financial intelligence unit indicates approximately 24,622 accounts, worth an estimated USD481.67 million, were frozen between October 2024 and August 2026. That freezing figure rests on a single lower-tier source and was not independently corroborated this cycle, so it is presented with appropriate caution, but even allowing for that caveat, the scale of the figure and the fact of an ambassadorial warning both point toward escalating, rather than stabilising, pressure on the Mexican banking sector's exposure to cartel finance. Taken together, the throughline across all three jurisdictions in this domain is that enabler status is not a fixed condition but an evolving one, shaped by a mix of domestic political will, international pressure, and the adaptability of illicit operators who will relocate to wherever oversight is thinnest. South Korea's enforcement success did not change South Korea's own enabler status, since South Korea is the target jurisdiction in that case rather than the enabler, but it confirms the robustness of the Vietnam-Cambodia supply architecture that illicit gambling networks have been able to exploit. #### Outlook The most consequential open question is whether Cambodia's October 2026 casino and proxy-betting restrictions produce a genuine reduction in offshore gambling-supply infrastructure or simply displace it to Laos's Golden Triangle zone or elsewhere in the region. Given the Golden Triangle zone's already-established role as a flagship scam hub, displacement rather than elimination looks like the more likely near-term outcome absent coordinated regional action. Cambodia's central-bank governor's own warning about FATF re-listing risk should be watched for whether it is followed by a formal FATF statement in a forthcoming plenary cycle; a self-initiated warning from inside the government is a notably different signal than an externally imposed grey-list return, and the distinction will matter for how the market reads Cambodia's trajectory. On Mexico, the critical signal to watch is whether the US Ambassador's warning about financial isolation is followed by any concrete correspondent-banking consequence for a named Mexican institution; rhetoric alone, however pointed, is a different category of risk than an actual de-risking action by a US correspondent bank, and the gap between the two will define whether this is escalating pressure or a stable deterrent posture. Judgment: No enabler-jurisdiction development surfaced for KR this cycle. Uncertain Judgment: No conflict-finance development surfaced for KR this cycle. Uncertain #### Crypto / Digital Assets / Financial Innovation South Korea's digital-asset oversight this cycle shows two concurrent moves toward tighter perimeter control, both read through the lens of financial-innovation regulation rather than conventional banking AML supervision. The Bank of Korea, addressing a parliamentary audit on October 22, 2026, confirmed it is working with the government on an amendment to the Foreign Exchange Transactions Act, planned within 2026, that would classify stablecoins as payment instruments for cross-border transfers and extend monitoring through the existing foreign-exchange information network. Officials cited laundering risk tied to mixers and unhosted wallets, illustrated by reference to an alleged case involving roughly 107 million dollars, as the motivating concern. This is a probable-confidence claim, corroborated by two independent sources, though no primary Bank of Korea or government text was available this cycle to confirm the amendment's drafting specifics; the plan remains at a pre-enactment, consultation-adjacent stage. Continue reading The design choice matters for how the innovation sector should read this. Rather than building a bespoke stablecoin-specific statute or extending the Act on the Protection of Virtual Asset Users, the stated approach channels stablecoin cross-border flows through the foreign-exchange reporting architecture that already governs currency transactions. That is a materially different compliance surface than a virtual-asset-specific reporting regime: it implies stablecoin issuers and transferors engaged in cross-border activity would be brought into a reporting pathway built for currency-exchange oversight, which may carry different recordkeeping, licensing, or threshold logic than the suspicious-transaction-report architecture that virtual-asset service providers currently navigate under the Act on Reporting and Using Specified Financial Transaction Information. How the two architectures would interact for a single cross-border stablecoin transfer, which is simultaneously a virtual-asset transaction and a foreign-exchange transaction, is not resolved in what is available this cycle, and firms building compliance roadmaps around either framework alone risk missing the other. Alongside this, the Financial Services Commission ordered, on October 13, 2026, domestic access restriction or service termination for 27 websites operated by unregistered crypto businesses, acting on Korea Communications Standards Commission review and at the Financial Intelligence Unit's request. This is a lower-confidence claim resting on a single source this cycle, with the underlying regulatory notice not yet reached, so the precise legal basis invoked for the blockings and whether any of the 27 sites had prior KoFIU warning history cannot be confirmed. What can be said is that the scale of the action, 27 sites in one round, suggests Korean authorities are running a distinct enforcement lane against unregistered or offshore-facing platforms, separate from the registration and anti-money-laundering supervision applied to licensed exchanges operating under KoFIU's VASP registration gateway. For firms operating in or servicing the Korean market, this reinforces that unregistered status carries an increasingly live risk of access-level disruption, independent of whether any transaction-level violation has yet been alleged against a given platform. #### Outlook The foreign-exchange amendment's trajectory depends on enactment steps not yet visible in available material: as at this cycle it had not passed into law, and the firms, thresholds, and effective date it would bind remain undefined pending a primary legislative or Bank of Korea release. Firms with stablecoin or cross-border crypto-payment exposure to the Korean market should treat the foreign-exchange classification approach as a probable but not yet binding direction of travel, distinct from the virtual-asset reporting obligations already in force under existing registration requirements. The site-blocking enforcement lane is likely to recur, drawing as it does on existing regulatory authority rather than pending legislation, and further rounds would reinforce the reading that perimeter control of unregistered platforms is proceeding ahead of, or in parallel with, the broader foreign-exchange legislative change. Judgment: KR is converging AML/forex policy around digital assets: a planned Foreign Exchange Transactions Act amendment classifying stablecoins as payment instruments, cited mixer/unhosted-wallet laundering risk illustrated by an alleged $107M case, and FSC blocking of 27 unregistered-crypto sites on 2026-10-13, together represent a material tightening this cycle. Probable #### Compliance Technology and Active Defence The Bithumb $40 billion 'ghost bitcoin' mis-crediting incident in February 2026 is this cycle's defining compliance-technology signal. In direct response, the Financial Supervisory Service committed to investigating high-risk practices, deploying AI tools to detect suspicious trading in real time, introducing punitive fines for IT incidents, and increasing executive security accountability. This is a high-confidence, cross-pillar finding that marks a shift toward proactive, technology-driven supervisory expectations directly triggered by a documented control failure rather than a pre-planned policy rollout — the incident itself is the origin of the reform commitment, not an independent regulatory initiative. Continue reading #### Outlook The domain's key open question is implementation: whether the FSS's AI real-time monitoring commitment and punitive IT-incident-fine framework are formalised into binding rules, and on what timeline, following what is currently a post-incident commitment rather than an enacted regime. Watch for the FSS's own account of high-risk-practice findings from its planned investigation, which would be the first concrete test of whether the committed active-defence measures translate into enforcement capability. Judgment: No RegTech/compliance-technology development surfaced for KR this cycle. Uncertain #### AML/CTF Regime South Korea's core AML instrument is the Act on Reporting and Using Specified Financial Transaction Information, administered by the country's financial intelligence unit, an affiliate of the Financial Services Commission. Korea is a full FATF member, having obtained observer status in August 2006 and completed its mutual evaluation -- the essential process for FATF membership -- in November 2008. Korea carries no grey-list exposure and its next mutual evaluation is scheduled for March 2028. Continue reading Ahead of that evaluation, Korea's financial intelligence unit plans to establish and operate a joint response team with officials from related government ministries to thoroughly prepare. The unit's 2026 AML/CFT policy agenda targets several recognised gaps directly: it proposes extending AML, customer-due-diligence and suspicious-transaction-reporting obligations to lawyers, certified public accountants and tax accountants for the first time -- an area where Korea remains an outlier among FATF member states, corresponding to FATF Recommendations 22 and 23 on designated non-financial businesses and professions. The agenda also commits to removing the current travel-rule reporting threshold and building a centralised beneficial-ownership database from existing suspicious-transaction-report data. This is a coherent, self-diagnosed reform agenda: Korea's financial intelligence unit has itself identified the DNFBP coverage gap as a FATF-outlier issue and proposed a specific remedy, rather than the gap being surfaced only by external assessment. The joint task force's formation is itself a structural preparatory step, distinct from any of the substantive reforms it will oversee. #### Outlook The DNFBP AML-coverage extension and the travel-rule threshold removal are both targeted for early 2027, giving roughly a year's runway before the March 2028 mutual evaluation to demonstrate implementation. Whether the joint task force's preparatory work translates into a favourable technical-compliance rating at the 2028 evaluation is the structural question this agenda is ultimately answering. Judgment: Standing AML/CTF record (KoFIU registration under the Act on Reporting and Using Specified Financial Transaction Information; dual VAUPA/AML registration architecture) is unchanged by this cycle's FX-focused developments. Uncertain #### Commercial Activity Traditional Korean financial institutions continued moving into direct ownership and infrastructure positions within the country's crypto sector this cycle. Hana Bank disclosed what is reported as an acquisition of an approximately US$670 million stake in Dunamu, the operator of the Upbit exchange; the amount is press-reported rather than confirmed through a company filing, and confidence in the figure is accordingly Uncertain. Separately, MoonPay Korea named BTQ Technologies as the security partner for its won-denominated stablecoin infrastructure, employing post-quantum cryptography, with Woori Bank announced on 9 October 2026 as the inaugural member of MoonPay Korea's KRW Stablecoin Consortium. Confidence in the BTQ/MoonPay/Woori Bank development is Probable, sourced from a press release reported via a trade outlet rather than a primary company filing. Continue reading Read together, these two developments indicate that Korean banks are pursuing crypto-sector exposure through two distinct channels: direct equity stakes in established exchanges, and infrastructure partnerships supporting new won-denominated stablecoin products. This is commercially significant in its own right, but it is also structurally relevant to financial-integrity supervision, because it means regulated deposit-taking institutions are now counterparties, investors and infrastructure partners to virtual-asset operators that have, in the same period, been subject to substantial AML enforcement action. Dunamu itself — the subject of the Hana Bank stake disclosure — was fined and handed a transfer suspension in November 2025 over KYC and suspicious-transaction-reporting failures, meaning Hana Bank's reported investment is occurring in an entity with a recent and material compliance-enforcement history. #### Outlook The continuing entry of Korean banks into crypto-exchange ownership and stablecoin infrastructure will increase the degree to which traditional-finance AML and counterparty-due-diligence frameworks intersect with the crypto-specific AML regime KoFIU is simultaneously tightening. Confirmation of the Hana Bank/Dunamu stake terms through a company filing, rather than press reporting alone, would materially raise confidence in the scale and nature of that exposure. Judgment: No material commercial-activity event among integrity-infrastructure firms surfaced for KR this cycle. Uncertain Regulatory horizon Consultation 2026-Q4 · ±half_year ### Digital Asset Basic Act (DABA) Would establish a licensing/AML perimeter for crypto-asset issuance, custody and stablecoin issuance not currently codified in a single statute. [National Assembly of Korea / FSC Source](https://www.techtimes.com/articles/320704/20260716/south-korea-folds-crypto-national-asset-law-japan-passes-its-own-reform.htm) In Force Pending 19 Feb 2027 · ±quarter ### KR crypto Travel Rule zero-threshold transfer provisions take effect Travel Rule information-sharing applies to every VASP-to-VASP transfer regardless of value; risk-tiered cross-border transfer regime also commences. [Korea Financial Intelligence Unit (KoFIU) Source](https://www.verifyvasp.com/en/news/south-korea-scraps-travel-rule-de-minimis-threshold/) Adopted 20 Feb 2027 · ±quarter ### Travel Rule threshold elimination Every domestic VASP-to-VASP transfer, regardless of amount, becomes subject to the Travel Rule from 2027-02-20. [Ministry of Economy and Finance / Cabinet Source](https://www.tftc.io/south-korea-travel-rule-threshold-eliminated-vasp-self-custody) Adopted 20 Feb 2027 · ±quarter ### New cross-border/self-custody SAR monitoring duty VASPs must monitor and build systems for transfers of KRW 10m or more to/from a foreign exchange or self-hosted wallet. [Ministry of Economy and Finance / Cabinet Source](https://www.gncrypto.news/news/south-korea-removes-1m-won-threshold-crypto-travel-rule/) Proposed 2027-Q1 · ±year ### AML/CDD/STR obligations extended to lawyers, CPAs and tax accountants Legal and accounting professionals would become obliged entities under Korea's AML/CFT regime for the first time. [KoFIU Source](https://www.grcreport.com/post/koreas-financial-intelligence-unit-sets-2026-anti-money-laundering-priorities) 5 dated · 3 pending date · baseline financial-integrity-2026-07-05 Role action cards MLRO ### Korea is routing planned stablecoin oversight through foreign-exchange reporting rather than a dedicated virtual-asset channel, while separately disrupting unregistered platforms at the access layer. A probable but not yet enacted amendment would classify stablecoins as payment instruments under the Foreign Exchange Transactions Act, citing mixer and unhosted-wallet laundering risk. This creates potential dual-channel reporting exposure for cross-border stablecoin activity that intersects both foreign-exchange and virtual-asset reporting logic, a design question not yet resolved in available material. 2 evidence refs Compliance ### Two concurrent Korean measures narrow the space available to unregistered or loosely-classified crypto activity. The planned Foreign Exchange Transactions Act amendment and the October 13 blocking of 27 unregistered-crypto sites both tighten the perimeter around activity that sits outside, or ambiguous to, existing registration frameworks. Compliance programs with Korean exposure face an open design question over how a cross-border stablecoin transfer would be classified once any amendment takes effect. 2 evidence refs Legal ### No enacted instrument yet; the stablecoin classification plan remains pre-legislative. The Foreign Exchange Transactions Act amendment was described by officials at an October 22 audit but had not been enacted as at this cycle, and no primary legislative text was available. Liability and licensing-exposure assessments premised on the amendment should be treated as provisional pending an enacted instrument. 1 evidence refs Board ### Korea is tightening its digital-asset perimeter through two separate regulatory channels this cycle. A foreign-exchange law amendment targeting stablecoins and a site-blocking enforcement action against 27 unregistered platforms both signal increasing regulatory attention to digital-asset flows in Korea, relevant to any institution with Korean market exposure or stablecoin cross-border activity. 2 evidence refs CTO ### A foreign-exchange-based reporting architecture for stablecoins would require different data and monitoring infrastructure than virtual-asset-specific reporting. If enacted, routing stablecoin cross-border flows through the foreign-exchange information network rather than virtual-asset reporting channels implies different technical integration points for monitoring and reporting systems serving the Korean market. The interaction between the two reporting pathways for a single transaction is not yet defined. 1 evidence refs Risk ### Mixer and unhosted-wallet laundering risk is cited as the explicit motivation for Korea's planned stablecoin reporting expansion. Officials referenced an alleged case of roughly 107 million dollars as illustrative of the risk driving the proposed Foreign Exchange Transactions Act amendment. This typology exposure (mixer/unhosted-wallet laundering via stablecoin cross-border transfer) is a concentration point worth tracking as the amendment develops. 1 evidence refs Operations ### Unregistered-platform access restriction is an active and recurring enforcement lane in Korea, separate from transaction-level AML supervision. The October 13 blocking of 27 unregistered-crypto websites, acting on Korea Communications Standards Commission review at the Financial Intelligence Unit's request, demonstrates an access-disruption enforcement channel distinct from standard KoFIU-supervised reporting. Screening and onboarding workflows touching Korean counterparties should account for this parallel enforcement track. 1 evidence refs Audit ### Underlying regulatory notices for the site-blocking action were not available this cycle, limiting evidentiary depth on the enforcement basis. The claim describing the 27-site blocking rests on a single secondary source; the originating Financial Services Commission or Korea Communications Standards Commission notice was not reached. Any audit trail reconstructing this action's legal basis should expect to source the primary regulatory notice separately. 1 evidence refs Standing trackers (T1–T6) Tracker Status Note T1 · Russian Sanctions-Evasion Architecture no_change T2 · EU AML Package / AMLA no_change T3 · FATF Grey List no_change T4 · Beneficial-Ownership Register Status no_change T5 · Crypto & Digital-Asset Integrity material_change KR FETA stablecoin-as-payment-instrument amendment plan, travel-rule threshold expansion, and FSC site-blocking enforcement. T6 · Sanctions Regime Divergence no_change Registers ### Enforcement actions - 1 Jun 2026 - 28 Jun 2026 - 25 Jul 2025 - 1 Feb 2026 - 1 Jan 2025 - 1 Jan 2025 - 16 Mar 2026 - 24 Nov 2025 - 31 Dec 2025 - 1 Jan 2026 - 1 Mar 2026 - - 4 Sep 2023 - FSC suspended new-customer virtual asset transfers at Dunamu for three months after finding the firm transacted with unreported virtual asset operators and violated customer verification and suspicious-transaction-report obligations. 25 Feb 2025 - The three governments issued a joint statement pledging to intensify disruption of North Korea's use of overseas IT workers who obscure their identities to win contracts and funnel earnings to weapons programs. 28 Aug 2025 - FSC and KoFIU proposed amendments requiring all regulated VASPs to report cross-border transactions over KRW 10 million involving overseas counterparties, moving beyond suspicion-based SAR filing to bulk cross-border transaction reporting. 1 Mar 2025 - FSC formed an industry-wide task force after Bithumb erroneously credited 620,000 Bitcoin (~$40bn) to 695 users during a promotional payout, mistakenly inputting Bitcoin instead of won, triggering a brief sell-off and parliamentary hearings. 9 Feb 2026 ### Sanctions changes - 12 Mar 2026 - 19 Dec 2024 - 30 Jul 2026 - OFAC designated Russian national Vitaliy Andreyev, DPRK official Kim Ung Sun, and entities Shenyang Geumpungri Network Technology and Korea Sinjin Trading Corporation for funneling DPRK IT-worker revenue tied to Chinyong, an entity originally co-designated by OFAC and South Korea's MOFA in May 2023. 27 Aug 2025 - OFAC designated six individuals and two entities, including Amnokgang Technology Development Company and a Vietnam-based facilitator, and listed 21 cryptocurrency addresses across multiple blockchains tied to DPRK IT-worker schemes generating nearly $800m in 2024. 12 Mar 2026 - The European Commission added Russia to its high-risk third-country list under Delegated Regulation (EU) 2026/46 (4 December 2025), requiring enhanced vigilance by EU obliged entities on Russia-linked transactions. 4 Dec 2025 ### Regulatory horizon (register) - Digital Asset Basic Act (DABA) - Digital Asset Basic Act (DABA) - Korea travel-rule threshold removal (zero-threshold transparency) - AML/CDD/STR obligations extended to lawyers, CPAs and tax accountants - KoFIU casino chip-buy-in AML threshold proposal - KoFIU AML/CFT regulatory-improvement taskforce roadmap ahead of 2028 FATF MER - KR Digital Asset Basic Act (Phase 2 crypto legislation) - KR AML DNFBP extension (lawyers, CPAs, tax accountants) and suspicious-account suspension power - KR crypto Travel Rule zero-threshold transfer provisions take effect - AMLA Work Programme / build-out - Travel Rule threshold elimination - New cross-border/self-custody SAR monitoring duty - Korea VASP entry-rule tightening (Act No.21358) - Digital Asset Basic Act (won-stablecoin framework) passage - Bulk cross-border VASP transaction reporting rule effective - Korea's next FATF mutual evaluation (5th round) - Basel Committee crypto-exposure prudential rule reassessment ### Active schemes - [CRITICAL] DPRK IT-worker crypto revenue-to-WMD pipeline - [CRITICAL] Lazarus Group hack-to-launder pipeline via Korean exchanges - Won-stablecoin regulatory vacuum ahead of Digital Asset Basic Act - Semiconductor trans-shipment risk in Russia-evasion supply chains Sources - [The Korea Herald](https://www.koreaherald.com/article/10790553) - [Sigma World](https://sigma.world/news/south-koreas-gambling-crackdown-wipes-out-a-third-of-demand/) - [Financial Services Commission (Korea)](https://www.fsc.go.kr/eng/pr010101/85955) - [CryptoSlate](https://cryptoslate.com/crypto-laws/south-korea-vasp-aml-registration-regime/) - [CoinDesk](https://www.coindesk.com/policy/2025/12/30/south-korea-s-long-awaited-crypto-law-stalls-over-who-can-issue-stablecoins) - [AGB (Asia Gaming Brief)](https://agbrief.com/news/27/01/2026/cambodia-aims-to-avoid-fatf-grey-listing/) - [FATF](https://www.fatf-gafi.org/en/countries/black-and-grey-lists.html) - [UK Government (Home Office)](https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud-introduced-by-eccta) - [FinCEN](https://www.fincen.gov/system/files/2026-04/Program-NPRM-FactSheet.pdf) - [OCC](https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html) - [https://practiceguides.chambers.com/practice-guides/gaming-law-2025/south-korea](https://practiceguides.chambers.com/practice-guides/gaming-law-2025/south-korea) - [https://www.coindesk.com/policy/2026/05/01/bithumb-scores-a-legal-win-in-south-korea-as-six-month-suspension-is-lifted-by-local-judge](https://www.coindesk.com/policy/2026/05/01/bithumb-scores-a-legal-win-in-south-korea-as-six-month-suspension-is-lifted-by-local-judge) - [https://www.coindesk.com/policy/2026/02/09/usd44b-bitcoin-blunder-puts-south-korea-regulators-on-alert-over-local-crypto-exchanges](https://www.coindesk.com/policy/2026/02/09/usd44b-bitcoin-blunder-puts-south-korea-regulators-on-alert-over-local-crypto-exchanges) - [https://www.knowyourcountry.com/south-korea/](https://www.knowyourcountry.com/south-korea/) - [https://globallawexperts.com/corporate-governance-reform-south-korea/](https://globallawexperts.com/corporate-governance-reform-south-korea/) - [https://practiceguides.chambers.com/practice-guides/corporate-tax-2026/south-korea](https://practiceguides.chambers.com/practice-guides/corporate-tax-2026/south-korea) - [https://www.fsc.go.kr/eng/pr010101/86222](https://www.fsc.go.kr/eng/pr010101/86222) - [https://www.grcreport.com/post/koreas-financial-intelligence-unit-sets-2026-anti-money-laundering-priorities](https://www.grcreport.com/post/koreas-financial-intelligence-unit-sets-2026-anti-money-laundering-priorities) - [https://www.fatf-gafi.org/en/countries/detail/Korea.html](https://www.fatf-gafi.org/en/countries/detail/Korea.html) - [https://www.kofiu.go.kr/eng/cooperation/multilateral.do](https://www.kofiu.go.kr/eng/cooperation/multilateral.do) - [https://www.coindesk.com/business/2026/03/16/south-korea-fines-bithumb-usd24-million-orders-6-month-partial-suspension-over-aml-violations](https://www.coindesk.com/business/2026/03/16/south-korea-fines-bithumb-usd24-million-orders-6-month-partial-suspension-over-aml-violations) - [https://www.theblock.co/news/business/2026-07-19-upbit-parent-dunamu-faces-sanction-process-nearly-eight-months-after-30-million-hack-report-408848](https://www.theblock.co/news/business/2026-07-19-upbit-parent-dunamu-faces-sanction-process-nearly-eight-months-after-30-million-hack-report-408848) - [https://www.startcompanykorea.com/posts/korea-beneficial-ownership-aml-foreign-investors-2026/](https://www.startcompanykorea.com/posts/korea-beneficial-ownership-aml-foreign-investors-2026/) - [https://zavia.ai/companies/country/south-korea/](https://zavia.ai/companies/country/south-korea/) - [https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026](https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026) - [https://www.fsc.go.kr/eng/pr010101/85955](https://www.fsc.go.kr/eng/pr010101/85955) - [https://www.lexology.com/library/detail.aspx?g=2719c035-2822-415f-a63e-33663232c4cc](https://www.lexology.com/library/detail.aspx?g=2719c035-2822-415f-a63e-33663232c4cc) - [https://www.tftc.io/south-korea-travel-rule-threshold-eliminated-vasp-self-custody](https://www.tftc.io/south-korea-travel-rule-threshold-eliminated-vasp-self-custody) - [https://www.ggrasia.com/many-players-at-s-korea-casinos-may-lose-anonymity-under-proposed-aml-rule-changes-industry-sources](https://www.ggrasia.com/many-players-at-s-korea-casinos-may-lose-anonymity-under-proposed-aml-rule-changes-industry-sources) - [https://sanctionsnews.bakermckenzie.com/south-korea-imposes-new-sanctions-on-russian-entities-for-military-cooperation-with-north-korea/](https://sanctionsnews.bakermckenzie.com/south-korea-imposes-new-sanctions-on-russian-entities-for-military-cooperation-with-north-korea/) - [https://www.bitbase.com/news/south-korea-crypto-trading-drops-20-in-a-week](https://www.bitbase.com/news/south-korea-crypto-trading-drops-20-in-a-week) - [https://amluae.com/fatf-grey-list-countries-update-19th-june-2026/](https://amluae.com/fatf-grey-list-countries-update-19th-june-2026/) - [cryptonews.net](https://cryptonews.net/news/market/32561881/) - [Washington Centre](https://washingtoncentre.org/south-korea-fines-crypto-exchange-korbit-for-aml-violations/) - [CoinDesk](https://www.coindesk.com/policy/2025/11/25/upbit-considering-appeal-of-usd25m-fine-by-south-korea-regulator) - [CoinDesk](https://www.coindesk.com/business/2026/03/13/u-s-sanctions-6-people-2-companies-that-laundered-usd800-million-in-crypto-for-north-korea) - [Sanction Scanner](https://www.sanctionscanner.com/blog/fatf-plenary-june-2026-grey-list-changes-and-key-outcomes-1391) - [BitcoinKE](https://bitcoinke.io/2026/04/south-korea-tightens-crypto-exchange-controls/) - [https://www.fatf-gafi.org/en/publications/Mutualevaluations/Korea-fur-2024.html](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Korea-fur-2024.html) - [https://www.verifyvasp.com/en/news/south-korea-scraps-travel-rule-de-minimis-threshold/](https://www.verifyvasp.com/en/news/south-korea-scraps-travel-rule-de-minimis-threshold/) - [https://www.coindesk.com/policy/2025/11/25/upbit-considering-appeal-of-usd25m-fine-by-south-korea-regulator](https://www.coindesk.com/policy/2025/11/25/upbit-considering-appeal-of-usd25m-fine-by-south-korea-regulator) - [https://www.coindesk.com/policy/2025/12/31/korbit-fined-usd1-9-million-for-anti-money-laundering-customer-verification-breaches](https://www.coindesk.com/policy/2025/12/31/korbit-fined-usd1-9-million-for-anti-money-laundering-customer-verification-breaches) - [https://basisdesk.news/news/btq-technologies-moonpay-korea-quantum-stablecoin-security](https://basisdesk.news/news/btq-technologies-moonpay-korea-quantum-stablecoin-security) - [https://www.theblock.co/post/406470/kiwoom-securities-bithumb](https://www.theblock.co/post/406470/kiwoom-securities-bithumb) - [https://cryptobriefing.com/south-korea-dunamu-upbit-sanctions-process/](https://cryptobriefing.com/south-korea-dunamu-upbit-sanctions-process/) - [https://www.koreatimes.co.kr/foreignaffairs/20260918/kofiu-tajikistani-counterpart-agree-on-anti-money-laundering-cooperation](https://www.koreatimes.co.kr/foreignaffairs/20260918/kofiu-tajikistani-counterpart-agree-on-anti-money-laundering-cooperation) - [https://fintech.global/2026/10/13/koreas-fsc-orders-bank-wide-checks-after-ai-cyberattacks/](https://fintech.global/2026/10/13/koreas-fsc-orders-bank-wide-checks-after-ai-cyberattacks/) - [https://startupfortune.com/south-korean-regulators-confirm-ai-agent-breached-16-banks-and-lenders/](https://startupfortune.com/south-korean-regulators-confirm-ai-agent-breached-16-banks-and-lenders/) - [https://alpha-maven.com/story/crypto/fsc-warns-of-200x-crypto-perpetual-futures-vows-crackdown-in-south-korea-chosunbiz-chosunbiz](https://alpha-maven.com/story/crypto/fsc-warns-of-200x-crypto-perpetual-futures-vows-crackdown-in-south-korea-chosunbiz-chosunbiz) - [https://www.spendnode.io/blog/south-korea-fsc-crypto-exchange-security-checks-october-2026/](https://www.spendnode.io/blog/south-korea-fsc-crypto-exchange-security-checks-october-2026/) - [https://www.fatf-gafi.org/en/countries/black-and-grey-lists.html](https://www.fatf-gafi.org/en/countries/black-and-grey-lists.html) - [https://asiaverify.com/resources/guides/how-to-verify-a-company-in-south-korea/](https://asiaverify.com/resources/guides/how-to-verify-a-company-in-south-korea/) - [https://practiceguides.chambers.com/practice-guides/fintech-2026/south-korea/trends-and-developments](https://practiceguides.chambers.com/practice-guides/fintech-2026/south-korea/trends-and-developments) - [https://www.licentium.io/hub/south-korea](https://www.licentium.io/hub/south-korea) - [AGBrief](https://agbrief.com/news/south-korea/19/10/2026/korea-busts-record-17-3b-illegal-gambling-network-spanning-vietnam-and-cambodia/) - [ACAMS](https://www.acams.org/en/news/illegal-gaming-licensed-casinos-enabling-southeast-asias-criminal-networks) - [Library of Congress](https://www.loc.gov/item/global-legal-monitor/2024-07-18/south-korea-act-to-regulate-cryptocurrency-markets-goes-into-effect/) - [CryptoSlate](https://cryptoslate.com/crypto-laws/south-korea-vasp-aml-registration-regime/) - [Private Law Wiki](https://wiki.private.law/en/japan-korea-fintech-licenses) - [Financial Services Commission](https://www.fsc.go.kr/eng/pr010101/85955) - [Tech Times](https://www.techtimes.com/articles/323887/20260811/south-korea-scraps-crypto-travel-rule-floor-pushes-fatf-force-global-zero.htm) - [GRC Report](https://www.grcreport.com/post/south-korea-launches-aml-taskforce-ahead-of-2028-fatf-review) - [BigGo Finance](https://finance.biggo.com/news/eBS1lZ4BrX5PFN7B8lm5) - [FATF](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Korea-fur-2024.html) - [Bitcoin Magazine](https://bitcoinmagazine.com/news/south-korea-fines-bithumb-over-aml) - [CoinCentral](https://coincentral.com/south-korea-fiu-drastically-cuts-vasp-approvals-only-two-in-2025/) - [Korea Financial Intelligence Unit (KoFIU)](https://www.kofiu.go.kr/eng/regime/amlRegime.do) - [Korea Financial Intelligence Unit (KoFIU)](https://www.kofiu.go.kr/eng/policy/guide04.do) - [Persona](https://withpersona.com/blog/understanding-kyc-and-kyb-requirements-in-south-korea) - [The Asia Business Daily](https://www.asiae.co.kr/en/article/2026101310063346932) - [CoinJournal](https://coinjournal.net/news/south-korea-sees-record-surge-in-suspicious-crypto-transactions-in-2025/) - [FATF / Asia-Pacific Group on Money Laundering](https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/MER%20Korea.pdf.coredownload.pdf) - [World Bank / StAR Initiative](https://star.worldbank.org/sites/star/files/g20_bo_country_guide_korea.pdf) - [Kyunghyang Shinmun](https://www.khan.co.kr/article/202309040931001) - [CoinInsider](https://www.coininsider.org/news/south-korea-removes-travel-rule-threshold/) - [TFTC](https://www.tftc.io/south-korea-travel-rule-threshold-eliminated-vasp-self-custody) - [GN Crypto News](https://www.gncrypto.news/news/south-korea-removes-1m-won-threshold-crypto-travel-rule/) - [Global Investigations Review](https://globalinvestigationsreview.com/review/the-asia-pacific-investigations-review/2026/article/south-korea-latest-developments-in-evolving-sanctions-and-export-control-framework) - [Chambers](https://practiceguides.chambers.com/practice-guides/sanctions-2025/south-korea) - [Securus Strategic Trade Solutions](https://www.securustrade.com/rok-anti-terrorist-finance-act-enforcement-decree-amendments-in-effect-jan-2026) - [Korea Legislation Research Institute (KLRI)](https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=39571&type=part&key=23) - [Korea Financial Intelligence Unit (KoFIU)](https://kofiu.go.kr/eng/law/law.do) - [Lexology](https://www.lexology.com/library/detail.aspx?g=2719c035-2822-415f-a63e-33663232c4cc) - [Financial Supervisory Service (FSS)](https://www.fss.or.kr/eng/main/contents.do?menuNo=400070) - [Financial Services Commission (FSC)](https://www.fsc.go.kr/eng/pr010101/85417) - [Lexology](https://www.lexology.com/library/detail.aspx?g=1828def2-9889-48d4-a116-04b65fb4b228) - [Kim & Chang](https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=30288) - [World Bank / StAR Initiative (Korea self-assessment)](https://star.worldbank.org/sites/star/files/foreign_bribery_frameworks_self-assessment_south-korea.pdf) - [World Law Group](https://www.theworldlawgroup.com/membership/news/south-korea-anti-corruption-guide-2022) - [Lawyer Help Free (blog)](https://lawyerhelpfree.blogspot.com/2026/05/anti-corruption-compliance-for-foreign.html) - [Seoul Law Group](https://seoullawgroup.com/what-to-do-after-phished-korea/) - [The Herald Business](https://mbiz.heraldcorp.com/article/10915780) - [FATF](https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/Mutual-Evaluation-Report-Korea-2020.pdf.coredownload.inline.pdf) - [Korea Legislation Research Institute (KLRI)](https://elaw.klri.re.kr/eng_service/lawViewContent.do?hseq=26856) - [Korea Legislation Research Institute (KLRI)](https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=60111&type=part&key=23) - [Sanction Scanner](https://www.sanctionscanner.com/blog/new-crypto-regulations-in-south-korea-445) - [CoinInsider](https://www.coininsider.org/news/south-korea-aml-rules-crypto-reports-85x/) - [The Block](https://www.theblock.co/news/regulation/2026-10-23-south-korea-stablecoins-payment-instruments-424028) - [CryptoTimes](https://www.cryptotimes.io/2026/10/23/south-korea-plans-foreign-exchange-transactions-act-amendment-for-stablecoins/) - [Assessments](https://www.fatf-gafi.org/en/calendars/assessments.html) - [Korea](https://www.fatf-gafi.org/en/countries/detail/Korea.html) - [Mutual Evaluation of Korea](https://www.fatf-gafi.org/en/documents/mutualevaluationofkorea.html) - [Mutual Evaluations](https://www.fatf-gafi.org/en/publications/Mutualevaluations.html) - [The FATF Recommendations](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html) - [Consolidated assessment ratings](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Assessment-ratings.html) - [Democratic People's Republic of Korea](https://www.fatf-gafi.org/en/countries/detail/DPRK.html) - [Asia/Pacific Group on Money Laundering (APG)](https://www.fatf-gafi.org/en/countries/global-network/asia-pacific-group-on-money-laundering--apg-.html) - [High-Risk Jurisdictions subject to a Call for Action - 24 October 2025](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/Call-for-action-october-2025.html) - [Korea's progress in strengthening measures to tackle money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Korea-fur-2024.html) - [OFAC Targets DPRK IT Workers Using Crypto](https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/) - [North Korea IT Workers: Inside the DPRK’s Crypto Laundering Network](https://www.chainalysis.com/blog/dprk-it-workers-north-korea-crypto-laundering-networks/) - [Global Crypto Policy Review Outlook 2025/26 Report | TRM Labs](https://www.trmlabs.com/reports-and-whitepapers/global-crypto-policy-review-outlook-2025-26) - [Blog - Chainalysis](https://www.chainalysis.com/blog/) - [Report Describes Crypto’s $350 Billion Shadow War | OCCRP](https://www.occrp.org/en/news/report-describes-cryptos-350-billion-shadow-war) - [OFAC lists 53 crypto addresses of sanctioned North Korean Cheil Credit Bank](https://www.elliptic.co/blog/ofac-lists-53-crypto-addresses-of-sanctioned-north-korean-cheil-credit-bank) - [2025 Crypto Theft Reaches $3.4 Billion](https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/) - [Crypto Sanctions: 2026 Crypto Crime Report](https://www.chainalysis.com/blog/crypto-sanctions-2026/) - [Crypto Regulatory Affairs: OFAC sanctions North Korea’s crypto laundering networks](https://www.elliptic.co/blog/analysis/crypto-regulatory-affairs-ofac-sanctions-north-korea-s-crypto-laundering-networks) - [U.S. and South Korea Sanction North Korean Cybercrime Bureaus | OCCRP](https://www.occrp.org/en/news/us-and-south-korea-sanction-north-korean-cybercrime-bureaus) - [Korean Regulator Halts Some Services of Upbit Parent Dunamu Over Rule Violations - Bloomberg](https://www.bloomberg.com/news/articles/2025-02-25/korean-regulator-halts-some-dunamu-services-over-rule-violations) - [Crypto regulatory affairs: HKMA’s tokenization pilot program begins](https://www.elliptic.co/blog/crypto-regulatory-affairs-hkma-tokenization-pilot-program-begins) - [Sanctions Programs and Country Information | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-programs-and-country-information) - [South Korea Country Guide | Elliptic](https://www.elliptic.co/country-guides/south-korea) - [2025 Crypto Regulatory Round-Up](https://www.chainalysis.com/blog/2025-crypto-regulatory-round-up/) - [FATF urges stronger global action to address Illicit Finance Risks in Virtual Assets](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-update-virtual-assets-vasps-2025.html) - [Crypto Reg Affairs: South Korea Passes Crypto Legislation Focusing on Investor Protection | Elliptic](https://www.elliptic.co/blog/analysis/crypto-regulatory-affairs-south-korea-approves-omnibus-legislation-focusing-on-investor-protection) - [How crypto regulation changed in 2025: a global review](https://www.elliptic.co/blog/how-crypto-regulation-changed-in-2025) - [Crypto Exchange Upbit Hit by Exploit After $10 Billion Deal - Bloomberg](https://www.bloomberg.com/news/articles/2025-11-27/crypto-exchange-upbit-hit-by-exploit-after-10-3-billion-deal) - [Crypto regulatory affairs: From China to Russia to South Korea to the EU - Stablecoin and digital payments work accelerates following US GENIUS Act](https://www.elliptic.co/blog/crypto-regulatory-affairs-stablecoin-and-digital-payments-work-accelerates-following-us-genius-act) - [Bank of Korea Urges Limiting Stablecoin Issuers on Money Laundering Risks - Bloomberg](https://www.bloomberg.com/news/articles/2026-02-23/bok-urges-limiting-stablecoin-issuers-on-money-laundering-risks) - [Crypto regulatory affairs: Hong Kong progresses cryptoasset regulatory activities](https://www.elliptic.co/blog/crypto-regulatory-affairs-hong-kong-progresses-cryptoasset-regulatory-activities) - [Crypto regulatory affairs: Hong Kong doubles down on innovation push with new policy statement on digital assets, and launch of consultation on dealers and custodians](https://www.elliptic.co/blog/crypto-regulatory-affairs-hong-kong-doubles-down-on-innovation-push-with-new-policy-statement-on-digital-assets) - [Wall Street-Backed Crypto Exchange Targets Asia FX Market Using Won Stablecoin - Bloomberg](https://www.bloomberg.com/news/articles/2026-03-23/wall-street-backed-crypto-exchange-targets-asia-fx-market-using-won-stablecoin) - [South Korea Unveils Measures to Stem Won Slide, Curb Speculation](https://www.bloomberg.com/news/articles/2026-06-07/south-korea-unveils-measures-to-stem-won-slide-curb-speculation) - [OFAC Sanction Entities Associated with North Korean Hacking](https://www.chainalysis.com/blog/ofac-north-korea-sanctions-may-2023/) - [OFAC sanctions individuals, entities, and crypto wallets associated with North Korean cyber activities | TRM Labs](https://www.trmlabs.com/resources/blog/ofac-sanctions-individuals-entities-and-crypto-wallets-associated-with-north-korean-cyber-activities) - [North Korea Sanctions | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-programs-and-country-information/north-korea-sanctions) - [Guidance on the Democratic People's Republic of Korea ...](https://ofac.treasury.gov/media/923126/download?inline=) - [South Korea Sanctions North Korean-Sponsored Cybercrime Group “Kimsuky” | OCCRP](https://www.occrp.org/en/news/south-korea-sanctions-north-korean-sponsored-cybercrime-group-kimsuky) - [US Sanctions Target North Korean Fake-Tech-Worker Scheme - Bloomberg](https://www.bloomberg.com/news/articles/2025-07-08/us-sanctions-target-north-korean-fake-tech-worker-scheme) - [OFAC sanctions a fraud network for assisting the North Korean (DPRK) regime](https://www.elliptic.co/blog/ofac-sanctions-a-fraud-network-for-assisting-the-north-korean-dprk-regime) - [North Korean Hacking Group, Kimsuky, Sanctioned](https://blog.chainalysis.com/reports/kimsuky-south-korea-sanctions-june-2023//) - [Guidance on Transparency and Beneficial Ownership](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Transparency-and-beneficial-ownership.html) - [Mutual Evaluation of Korea: 8th Follow-up Report](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Follow-up-report-korea-2014.html) - [Beneficial Ownership](https://www.fatf-gafi.org/en/topics/beneficial-ownership.html) - [FATF guidance TRANSPARENCY AND BENEFICIAL OWNERSHIP October 2014](https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Guidance-transparency-beneficial-ownership.pdf) - [Mutual Evaluation of Korea](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Mutualevaluationofkorea.html) - [Guidance on Beneficial Ownership and Transparency of Legal Arrangements](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-Beneficial-Ownership-Transparency-Legal-Arrangements.html) - [Korea Probes Crypto Exchange Over $40 Billion in ‘Ghost Bitcoin’](https://www.bloomberg.com/news/articles/2026-02-09/bithumb-accidentally-gifts-620-000-bitcoin-btc-to-clients-in-fat-finger-error) - [Lawmakers Grill Crypto Exchange Over $40 Billion ‘Ghost Bitcoin’](https://www.bloomberg.com/news/articles/2026-02-11/lawmakers-grill-crypto-exchange-over-40-billion-ghost-bitcoin) - [Lawmakers Grill Crypto Exchange Over $40 Billion ‘Ghost Bitcoin’ - Bloomberg](https://www.bloomberg.com/news/articles/2026-02-11/lawmakers-grill-crypto-exchange-over-40-billion-ghost-bitcoin?srnd=homepage-europe) - [Crypto Exchange to Reimburse Some Users After $40 Billion Error - Bloomberg](https://www.bloomberg.com/news/articles/2026-02-07/crypto-exchange-to-reimburse-some-users-after-40-billion-error) - [The 2026 Crypto Crime Report - Chainalysis](https://www.chainalysis.com/reports/crypto-crime-2026/) - [2026 Crypto Crime Report: Scams](https://www.chainalysis.com/blog/crypto-scams-2026/) - [Amid a scam crackdown, crypto giants keep fueling bitcoin ATMs - ICIJ](https://www.icij.org/investigations/coin-laundry/amid-a-scam-crackdown-crypto-giants-keep-fueling-bitcoin-atms/) - [The Landscape of Seizable Crypto Assets in 2025 - Chainalysis](https://www.chainalysis.com/blog/landscape-of-seizable-crypto-assets-2025/) - [Elliptic software follows the money from the Bithumb hack](https://www.elliptic.co/blog/following-money-from-bithumb-hack) - [2025 Crypto Crime Mid-Year Update - Chainalysis](https://www.chainalysis.com/blog/2025-crypto-crime-mid-year-update/) - [Anti-money laundering and countering the financing of terrorism at international level - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-international-level_en) - [European Commission updates list of high-risk countries to strengthen international fight against financial crime - Finance](https://finance.ec.europa.eu/news/european-commission-updates-list-high-risk-countries-strengthen-international-fight-against-2025-12-04_en) - [High risk third countries and the international context content of anti-money laundering and countering the financing of terrorism - European Commission](https://finance.ec.europa.eu/financial-crime/high-risk-third-countries-and-international-context-content-anti-money-laundering-and-countering_en) - [EU methodology for the identification of high-risk third countries - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-international-level/eu-methodology-identification-high-risk-third-countries_en) - [Commission adds Russia to list of high-risk jurisdictions to strengthen international fight against financial crime](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2910) - [Money Laundering Advisory Notice: June 2026 - GOV.UK](https://www.gov.uk/government/publications/money-laundering-advisory-notice-high-risk-third-countries--2/money-laundering-advisory-notice-high-risk-third-countries--2) - [Commission updates list of high-risk countries to strengthen international fight against financial crime - Finance](https://finance.ec.europa.eu/news/commission-updates-list-high-risk-countries-strengthen-international-fight-against-financial-crime-2025-06-10_en) - [Anti-Money Laundering and Terrorist Financing Directive 4 - Finance](https://finance.ec.europa.eu/regulation-and-supervision/financial-services-legislation/implementing-and-delegated-acts/anti-money-laundering-and-terrorist-financing-directive-4_en) - [High-risk and other monitored jurisdictions](https://www.fatf-gafi.org/en/topics/high-risk-and-other-monitored-jurisdictions.html) - [Protecting the EU’s financial system - Finance - European Commission](https://finance.ec.europa.eu/news/protecting-eus-financial-system-2025-07-16_en) - [Countering Russian sanctions evasion - guidance for businesses - GOV.UK](https://www.gov.uk/government/publications/countering-russian-sanctions-evasion-and-circumvention/countering-russian-sanctions-evasion-guidance-for-exporters) - [1 Preventing Russian Export Control and Sanctions Evasion:](https://finance.ec.europa.eu/document/download/ae2e63e2-4c4d-4f77-9757-c408ddbcede1_en?filename=240924-preventing-russian-export-control-sanctions-evasion+.pdf) - [Impact of Sanctions and Export Controls on Russia's ...](https://ofac.treasury.gov/media/928856/download?inline=) - [1 EXPORT-RELATED RESTRICTIONS FOR DUAL-USE GOODS AND ADVANCED TECHNOLOGIES](https://finance.ec.europa.eu/document/download/586f9b62-50c3-46e3-9940-de73ae96a24b_en?filename=faqs-sanctions-russia-export-related-restrictions-russia_en.pdf) - [Sanctions vis a vis Russia: Commission publishes G7 Industry Guidance on preventing sanctions evasion - Finance](https://finance.ec.europa.eu/news/sanctions-vis-vis-russia-commission-publishes-g7-industry-guidance-preventing-sanctions-evasion-2024-09-24_en) - [NTE 2025/03: update to countering Russian sanctions evasion and circumvention guidance - GOV.UK](https://www.gov.uk/government/publications/notice-to-exporters-202503-update-to-countering-russian-sanctions-evasion-and-circumvention-guidance/nte-202503-update-to-countering-russian-sanctions-evasion-and-circumvention-guidance) - [Europa](https://finance.ec.europa.eu/system/files/2023-01/faqs-sanctions-russia-export-related-restrictions-russia_en.pdf) - [South Korea Chip Exports to China Plunge as US Controls Tighten - Bloomberg](https://www.bloomberg.com/news/articles/2025-03-17/south-korea-s-chip-exports-to-china-sink-as-us-controls-tighten) - [South Korea Targets Multi-Country Talks for Chip Export Controls - Bloomberg](https://www.bloomberg.com/news/articles/2024-03-22/south-korea-targets-multi-country-talks-for-chip-export-controls) - [FATF updates Standards on Recommendation 16 on Payment Transparency](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/update-Recommendation-16-payment-transparency-june-2025.html) - [Crypto regulatory affairs: CLARITY Act advances from Senate Banking Committee](https://www.elliptic.co/blog/crypto-regulatory-affairs-clarity-act-passes-senate-banking-committee) - [Targeted Update on Implementation of the FATF Standards on Virtual Assets and](https://www.fatf-gafi.org/content/dam/fatf-gafi/recommendations/2025-Targeted-Upate-VA-VASPs.pdf.coredownload.pdf) - [Targeted Update on Implementation of FATF’s Standards on VAs and VASPs](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Targeted-update-virtual-assets-vasps.html) - [Virtual Assets: Targeted Update on Implementation of the FATF Standards on VAs and VASPs](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-update-virtual-assets-vasps-2023.html) - [Best Practices Travel Rule Supervision June 2025](https://www.fatf-gafi.org/content/dam/fatf-gafi/recommendations/Best-Practices-Travel-Rule-Supervision.pdf) - [Virtual Assets](https://www.fatf-gafi.org/en/topics/virtual-assets.html) - [KOREA](https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/MER%20Korea.pdf.coredownload.pdf) - [Quick guide on assessing the Money Laundering risks of virtual assets (VA) and virtual asset service providers (VASP)](https://www.fatf-gafi.org/en/publications/Methodsandtrends/quick-guide-on-assessing-ML-risks-of-VA-and-VASPs.html) - [Pdf](https://scsanctions.un.org/en/?keywords=dprk) - [South Korea’s Ministry of Foreign Affairs Sanctions North Korea Hacking Group Kimsuky, Identifies Related Crypto Addresses - Chainalysis](https://blog.chainalysis.com/reports/kimsuky-south-korea-sanctions-june-2023/) - [[Type text] Page 1 NORTH KOREA SANCTIONS PROGRAM](https://ofac.treasury.gov/media/9221/download) - [EU restrictive measures against North Korea - Consilium](https://www.consilium.europa.eu/en/policies/sanctions/history-north-korea/) - [North Korea Designations; Non-Proliferation Designations; Russia-related Designations | Office of Foreign Assets Control](https://ofac.treasury.gov/recent-actions/20241216) - [OFAC Sanctions Tracker: How Sanctions Impact Crypto Crime - Chainalysis](https://www.chainalysis.com/blog/ofac-sanctions/) - [Naver to Acquire Crypto Exchange Upbit’s Parent Dunamu](https://www.bloomberg.com/news/articles/2025-11-26/naver-to-acquire-crypto-exchange-upbit-s-parent-dunamu) - [Hana Buys $670 Million Stake in Crypto Exchange Operator Dunamu - Bloomberg](https://www.bloomberg.com/news/articles/2026-05-15/hana-buys-670-million-stake-in-crypto-exchange-operator-dunamu) - [SOUTH KOREA Financial institutions are obliged to identify ...](https://www.unodc.org/documents/corruption/G20-Anti-Corruption-Resources/G20-Step-by-step-guides-on-nternational-cooperation-and-asset-recovery/Asset-Tracing-Country-Profiles/Korea.pdf) - [Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Countering the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov](https://www.fincen.gov/news/news-releases/financial-action-task-force-identifies-jurisdictions-anti-money-laundering-3) - [South Korea Sanctions North Korean-Sponsored Cybercrime Group “Kimsuky”](https://www.occrp.org/en/daily/17721-south-korea-sanctions-north-korean-sponsored-cybercrime-group-kimsuky) - [U.S. Treasury Sanctions North Korean Cyber Intrusion Group Kimsuky | TRM Labs](https://www.trmlabs.com/post/us-treasury-sanctions-north-korean-cyber-intrusion-group-kimsuky) - [OFAC Sanction Entities Associated with North Korean Hacking](https://blog.chainalysis.com/reports/ofac-north-korea-sanctions-may-2023/) - [OFAC Sanctions Fraud Network Funding DPRK Weapons Programs](https://www.chainalysis.com/blog/ofac-sanctions-fraud-network-funding-dprk-weapons-program/) - [US, Allies Step Up Fight Against North Korean Cyber Activities - Bloomberg](https://www.bloomberg.com/news/articles/2025-08-28/us-allies-step-up-fight-against-north-korean-cyber-activities) - [Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov](https://www.fincen.gov/news/news-releases/financial-action-task-force-identifies-jurisdictions-anti-money-laundering-4) - [FATF](https://www.fatf-gafi.org/en/countries/detail/Korea.html) - [FATF/APG](https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/MER%20Korea.pdf.coredownload.pdf) - [FATF](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Korea-fur-2024.html) - [US Department of the Treasury (OFAC)](https://ofac.treasury.gov/sanctions-programs-and-country-information/north-korea-sanctions) - [European Commission (DG FISMA)](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-international-level_en) - [Bloomberg](https://www.bloomberg.com/news/articles/2025-02-25/korean-regulator-halts-some-dunamu-services-over-rule-violations) - [Bloomberg](https://www.bloomberg.com/news/articles/2026-02-09/bithumb-accidentally-gifts-620-000-bitcoin-btc-to-clients-in-fat-finger-error) - [Bloomberg](https://www.bloomberg.com/news/articles/2026-02-23/bok-urges-limiting-stablecoin-issuers-on-money-laundering-risks) - [Chainalysis](https://www.chainalysis.com/blog/ofac-sanctions-fraud-network-funding-dprk-weapons-program/) - [Elliptic](https://www.elliptic.co/blog/crypto-regulatory-affairs-hong-kong-progresses-cryptoasset-regulatory-activities) - [Bloomberg](https://www.bloomberg.com/news/articles/2025-08-28/us-allies-step-up-fight-against-north-korean-cyber-activities) - [Elliptic](https://www.elliptic.co/blog/crypto-regulatory-affairs-clarity-act-passes-senate-banking-committee) - [UNODC](https://www.unodc.org/documents/corruption/G20-Anti-Corruption-Resources/G20-Step-by-step-guides-on-nternational-cooperation-and-asset-recovery/Asset-Tracing-Country-Profiles/Korea.pdf) Coverage gaps fim-int-2026-07-13-G001: No dedicated Russia/Yemen sanctions… fim-int-2026-07-13-G001: No dedicated Russia/Yemen sanctions-corridor search was run this cycle, limiting T1 tracker refresh. [resolved] fim-int-2026-07-13-G002: No AMLR/6AMLD/AMLA transposition de… fim-int-2026-07-13-G002: No AMLR/6AMLD/AMLA transposition developments were searched this cycle, limiting T2 tracker refresh. [resolved] fim-int-2026-07-13-G003: Laos, Mexico and Colombia Tier-D ch… fim-int-2026-07-13-G003: Laos, Mexico and Colombia Tier-D checks yielded no material this cycle; logged as coverage gaps rather than asserted null findings. [resolved] fim-int-2026-07-13-G004: No direct National Bank of Cambodia… fim-int-2026-07-13-G004: No direct National Bank of Cambodia or FATF primary statement was located to corroborate Cambodia's re-listing risk beyond Tier-4 trade press. [resolved] fim-int-2026-08-05-G001: No Tier-1 FSS press release located… fim-int-2026-08-05-G001: No Tier-1 FSS press release located for the six-firm PG enforcement action; reliance on multi-source Tier-3 trade press. [resolved] fim-int-2026-08-05-G002: No Tier-1/2 corroboration located f… fim-int-2026-08-05-G002: No Tier-1/2 corroboration located for the Seoul police bribery arrest beyond a single Tier-4 repost. [resolved] fim-int-2026-08-05-G003: No material Russia sanctions-evasio… fim-int-2026-08-05-G003: No material Russia sanctions-evasion or EU AML Package/AMLA development located this cycle. [resolved] fim-int-2026-08-05-G004: No translation-provenance record ex… fim-int-2026-08-05-G004: No translation-provenance record exists for any Korean-language primary source; all Korean-context findings rely on English-language secondary/tertiary reporting. [resolved] fim-int-2026-08-05-G005: No Tier-D tier_D_check finding loca… fim-int-2026-08-05-G005: No Tier-D tier_D_check finding located for Laos or Colombia this cycle. [resolved] fim-int-2026-08-21-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-08-21-G001 ({'scheme': 'financial_integrity', 'value': 'D7'}): T1 FATF MER document for Korea's 2024 follow-up evaluation was not directly fetched this cycle; relied on a secondary aggregator. [resolved] fim-int-2026-08-21-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-08-21-G002 ({'scheme': 'financial_integrity', 'value': 'D4'}): D4 conflict-finance domain had no evidenced development this cycle and was not actively searched. [resolved] fim-int-2026-08-21-G003: Tier D jurisdictions (KH, LA, MX, C… fim-int-2026-08-21-G003: Tier D jurisdictions (KH, LA, MX, CO) were not actively searched this cycle; pooled budget prioritised the KR union dispatch. [resolved] fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D3'}): No KR-specific enabler-jurisdiction (D3) material surfaced this cycle; coverage is thin for this domain. [resolved] fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D4'}): No KR-specific conflict-finance (D4) material surfaced this cycle; coverage is thin for this domain. [resolved] fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', 'value': 'D6'}): No KR-specific compliance-technology (D6) material surfaced this cycle beyond standing KYC/AML-vendor commentary already captured under D5. [resolved] fim-int-2026-09-28-G004: Tier D jurisdictions (KH/LA/MX/CO) … fim-int-2026-09-28-G004: Tier D jurisdictions (KH/LA/MX/CO) were not actively queried this cycle; pooled web-search budget was concentrated on the bound jurisdiction KR. [resolved] fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): No T1 FSC/KoFIU primary press release or decision document was retrieved this cycle for any of the three VASP enforcement actions (Bithumb, Upbit, Korbit); all enforcement claims rest on T3 press corroboration. [resolved] fim-int-2026-10-04-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-04-G002 ({'scheme': 'financial_integrity', 'value': 'D2'}): D2 (beneficial ownership), D3 (enabler jurisdictions) and D4 (conflict finance) returned no KR-specific findings this cycle; this is a coverage gap, not a negative finding. [resolved] fim-int-2026-10-04-G003: Tier D jurisdictions (KH, LA, MX, C… fim-int-2026-10-04-G003: Tier D jurisdictions (KH, LA, MX, CO) were not actively searched this cycle under the KR-bound search budget allocation. [resolved] fim-int-2026-10-12-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-12-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): No primary fsc.go.kr or kofiu.go.kr notice for the Travel Rule Enforcement Decree amendment was retrieved this cycle; confidence capped at Probable pending direct verification. [resolved] fim-int-2026-10-12-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-12-G002 ({'scheme': 'financial_integrity', 'value': 'D2'}): KR beneficial-ownership registry status (D2) and conflict-finance nexus (D4) were not sourced this cycle. [resolved] fim-int-2026-10-12-G003: Tier D jurisdictions (KH, LA, MX, C… fim-int-2026-10-12-G003: Tier D jurisdictions (KH, LA, MX, CO) were not actively searched this cycle given the pooled budget allocated to KR. [resolved] fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D6'}): No direct fsc.go.kr primary press release located for the Oct 13/16 bank-security and crypto-audit directives; relying on T3 secondary trade-press reporting. [resolved] fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', 'value': 'D1'}): Houthi/Yemen sanctions-evasion collection channels (T1) were not actively re-checked this cycle; absence should be treated as a coverage gap, not a confirmed null, next cycle. [resolved] fim-int-2026-10-18-G003: Tier D watch jurisdictions (KH, LA,… fim-int-2026-10-18-G003: Tier D watch jurisdictions (KH, LA, MX, CO) were not actively searched this cycle due to search-budget concentration on KR. [resolved] fim-int-2026-10-25-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-25-G001 ({'scheme': 'financial_integrity', 'value': 'D7'}): No KR-specific AML/CTF article-level citation located for the Act on Reporting and Using Specified Financial Transaction Information this cycle. [resolved] fim-int-2026-10-25-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-25-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): No dated primary instrument confirming AMLA Level 2/3 technical-standards finalisation status this cycle. [resolved] fim-int-2026-10-25-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-10-25-G003 ({'scheme': 'financial_integrity', 'value': 'D4'}): No KR-specific D4 Conflict Finance finding located this cycle. [resolved] fim-int-2026-11-02-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-11-02-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): FTRA Art 17 CDD-violation fine figure disputed: a commentary source states KRW 100m while KoFIU's own regulator page implies KRW 10m for the same obligation; not reconciled within this cycle's research. [open] fim-int-2026-11-02-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-11-02-G003 ({'scheme': 'financial_integrity', 'value': 'D7'}): Korean-language NRA priority-threat document not directly retrieved; FATF FUR 2024 and KoFIU 2026 policy agenda used as substitutes. [open] fim-int-2026-11-02-G004 ({'scheme': 'financial_integrity', '… fim-int-2026-11-02-G004 ({'scheme': 'financial_integrity', 'value': 'D2'}): Low-tier commentary only found on beneficial-ownership register reform, sanctions-enforcement changes and corporate-crime bills; none met the sourcing bar within budget. [open] fim-int-2026-11-02-G005 ({'scheme': 'financial_integrity', '… fim-int-2026-11-02-G005 ({'scheme': 'financial_integrity', 'value': 'D8'}): No official frozen/confiscated-asset total located within budget for commercial layer. [open] fim-int-2026-11-02-G006 ({'scheme': 'financial_integrity', '… fim-int-2026-11-02-G006 ({'scheme': 'financial_integrity', 'value': 'D7'}): DNFBP supervision of lawyers, accountants and third-party-reliance obligations not reached within budget. [open] fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): No T1 Bank of Korea/government primary text reached this cycle for the planned FETA stablecoin amendment; only two T3 sources available. [open] fim-int-2026-11-01-G002: No Tier D jurisdiction (KH/LA/MX/CO… fim-int-2026-11-01-G002: No Tier D jurisdiction (KH/LA/MX/CO) search was performed this cycle; pooled union web-search budget directed to KR across all five consumers. [open] FIM-GAP-001 (D2): Korea operates without a centralized publi… FIM-GAP-001 (D2): Korea operates without a centralized public beneficial ownership registry; UBO identification remains dependent on financial-institution CDD records rather than a verifiable central register, and FATF continues to flag PEP and correspondent-banking measures as unresolved since the original mutual evaluation. FIM-GAP-002 (D5): Repeated internal-control failures at lice… FIM-GAP-002 (D5): Repeated internal-control failures at licensed VASPs -- Dunamu/Upbit's unreported-counterparty and CDD/STR violations (2025) and Bithumb's $40bn erroneous bulk transfer (2026) -- show that licensing under the Virtual Asset User Protection Act has not yet translated into robust operational-risk and AML control maturity. FIM-GAP-003 (D5): Legislative deadlock between the FSC and B… FIM-GAP-003 (D5): Legislative deadlock between the FSC and Bank of Korea over bank-only versus non-bank stablecoin issuance has stalled the Digital Asset Basic Act, leaving won-backed stablecoin pilots (KRW1, cross-border remittance projects) to advance without a finalized statutory AML/CFT and reserve framework. FIM-GAP-004 (D2): Publicly available English-language report… FIM-GAP-004 (D2): Publicly available English-language reporting on Korea's current operational beneficial-ownership data quality (as opposed to legal framework) is thin outside of FATF's own generic synopsis; no recent ICIJ/OCCRP-style forensic BO investigation specific to Korea was located within the 18-month window. ## Evidence #### Confidence-tiered claims KRW 36.8 billion fine (approx. $24.5m) and six-month partial external-transfer suspension for new customers, for approximately 6.65 million AML violations including failed customer identification and 45,772 transfers to 18 unregistered overseas VASPs. [[Source 1]](#sec-sources) Probable · 1 source KRW 35.2 billion (~$25m) fine for accepting photocopied ID documents, permitting 3.3 million transactions by unverified customers, and failing to report 15 suspicious transactions. [[Source 1]](#sec-sources) Probable · 1 source KRW 2.73 billion fine with institutional warning for inadequate customer identification, unauthorized transactions with overseas operators, and skipped AML risk assessments on new services including NFTs. [[Source 1]](#sec-sources) Probable · 1 source Six individuals and two entities designated for laundering approximately $800 million generated via fraudulent DPRK overseas IT-worker employment schemes, funding WMD/ballistic-missile programs. [[Source 1]](#sec-sources) Probable · 1 source At the June 2026 plenary the Call-for-Action blacklist remained unchanged (Iran, North Korea, Myanmar); grey list added Iraq and Bosnia & Herzegovina, removed Algeria and Namibia. No bearing on South Korea, which is not FATF-listed. [[Source 1]](#sec-sources) Probable · 1 source Cabinet approved removal of the ~KRW 1,000,000 Travel Rule exemption on 11 August 2026; decree promulgated 18 August 2026; VASP-registration provisions effective 20 August 2026; transfer-rule provisions effective ~19-20 February 2027 (six months after promulgation). [[Source 1]](#sec-sources) Probable · 1 source KoFIU's AML/CFT policy advisory committee (announced 5 Feb 2026) is preparing AML/CDD/STR obligations for lawyers, accountants and tax accountants plus a suspicious-account suspension power, ahead of KR's FATF mutual evaluation scheduled for March 2028; KR is stated to be one of only two FATF members not yet covering these DNFBPs. [[Source 1]](#sec-sources) Probable · 1 source KoFIU/FIU fined Dunamu KRW 35.2bn (~US$25m) with a 3-month new-customer transfer suspension (24 Nov 2025) over ~700,000 KYC verification violations and 15 unreported suspicious transactions; the suspension was partially overturned by a KR court in April 2026. [[Source 1]](#sec-sources) Probable · 1 source KoFIU fined Bithumb approximately US$24m with a 6-month partial suspension over approximately 6.65 million KYC/transaction-restriction violations found in a 2024-2025 on-site inspection (16 March 2026). [[Source 1]](#sec-sources) Probable · 1 source KoFIU fined Korbit KRW 2.73bn (~US$1.9m) for AML/customer-verification breaches, disclosed amid talks to sell a majority Korbit stake to Mirae Asset (31 Dec 2025). [[Source 1]](#sec-sources) Probable · 1 source KR's 2024 Follow-Up Report re-rates Recommendation 8 from partially compliant to largely compliant; KR is compliant or largely compliant on 33 of 40 Recommendations ahead of its March 2028 mutual evaluation. [[Source 1]](#sec-sources) Probable · 1 source Hana Bank disclosed a reported acquisition of a ~$670 million stake in Dunamu (Upbit operator). [[Source 1]](#sec-sources) Uncertain · 1 source BTQ Technologies named security partner for MoonPay Korea's won-stablecoin infrastructure (post-quantum cryptography); Woori Bank is the inaugural member of MoonPay Korea's KRW Stablecoin Consortium, announced 9 October 2026. [[Source 1]](#sec-sources) Probable · 1 source Sector-wide bank/credit-card-issuer security reviews ordered Oct 13, 2026, following AI-assisted breaches at Shinhan and KB Kookmin banks [[Source 1]](#sec-sources) Probable · 1 source 16 financial firms confirmed breached since start of October 2026, ~100,000 records exposed [[Source 1]](#sec-sources) Probable · 1 source User advisory warning against 10x-200x leverage overseas perpetual-futures products on virtual assets/stocks, Oct 16, 2026 [[Source 1]](#sec-sources) Probable · 1 source Mandatory twice-yearly vulnerability checks for larger financial institutions including crypto exchanges, after review found gaps at 130 firms [[Source 1]](#sec-sources) Probable · 1 source KoFIU is the designated FIU under the FTRA; VASPs register with KoFIU (ISMS certification, real-name bank accounts, AML/travel-rule duties); VAUPA (in force 19 July 2024) adds market-conduct and user-asset-protection duties enforced by FSC/FSS with fast-track prosecutorial referral [[Source 1]](#sec-sources) Probable · 1 source Korea does not appear on FATF's blacklist (Iran, DPRK, Myanmar) or on the 22-jurisdiction grey list as of the 19 June 2026 plenary [[Source 1]](#sec-sources) Probable · 1 source No centralised public UBO register exists; verification relies on self-maintained records, FDI notification filings and bank-level KYC [[Source 1]](#sec-sources) Probable · 1 source 77 suspects apprehended over a KRW23tn ($17.3bn) illegal-gambling supply network run via Vietnam/Cambodia using live-casino feeds from legally operating overseas gaming companies; KRW9.6bn frozen, 12 Interpol Red Notices issued. [[Source 1]](#sec-sources) Probable · 1 source Cambodia suspended casino live-dealer proxy-betting streaming from October 2026, introduced new casino-licence renewal standards, and its central-bank governor warned of renewed FATF re-listing risk. [[Source 1]](#sec-sources) Probable · 1 source On 30 July 2026 the EU designated 7 individuals and 3 entities linked to crypto-related investment fraud and trafficking at suspected compounds in Myanmar and Cambodia, including figures tied to Prince Holding Group and Jin Bei Group. [[Source 1]](#sec-sources) Probable · 1 source APG's Cyber Scam Hubs and Human Trafficking Report 2026 identifies Laos's Golden Triangle SEZ as a flagship location where the scam-compound economy is structurally anchored in zones of weak state authority; no new Laos-specific enforcement this cycle. [[Source 1]](#sec-sources) Probable · 1 source US Ambassador Ronald Johnson warned Mexican commercial banks of financial-isolation risk for facilitating cartel money flows; Mexico's UIF reportedly froze ~24,622 accounts (~US$481.67m) between October 2024 and August 2026. [[Source 1]](#sec-sources) Uncertain · 1 source Colombia remains off the FATF list of jurisdictions with strategic AML deficiencies; its 2023 follow-up evaluation rated it Compliant/Largely Compliant on 30 of 40 Recommendations. [[Source 1]](#sec-sources) Probable · 1 source FinCEN's 30 June 2026 supplemental alert flags stablecoin payments as an increasingly used rail for cartel-linked money movement in fuel-smuggling and tax-evasion schemes. [[Source 1]](#sec-sources) Probable · 1 source VASPs must keep at least 80% of customer assets in cold storage [[Source 1]](#sec-sources) Probable · 1 source VASPs, including intending operators, must report company identity and business details to KoFIU before operating [[Source 1]](#sec-sources) Probable · 1 source FSC proposed on 29 July 2026 merging roughly ten pending digital asset and stablecoin bills into a single Digital Asset Basic Act [[Source 1]](#sec-sources) Uncertain · 1 source Zero-threshold Travel Rule for all domestic VASP-to-VASP transfers, in force 2027-02-20 [[Source 1]](#sec-sources) Probable · 1 source Taskforce launched 29 December 2025 to overhaul the Specified Financial Information Act's AML/CFT inspection and sanctions system [[Source 1]](#sec-sources) Probable · 1 source KRW 36.8 billion fine and 6-month partial suspension for AML violations [[Source 1]](#sec-sources) Probable · 1 source 28 [[Source 1]](#sec-sources) Probable · 1 source Approximately KRW 1.047 billion fine, institutional caution and executive warning for EDD/CTR failures [[Source 1]](#sec-sources) Probable · 1 source threshold removed entirely, effective 2027-02-20 [[Source 1]](#sec-sources) Probable · 1 source KRW 10,000,000 threshold, effective 2027-02-20 [[Source 1]](#sec-sources) Probable · 1 source no formal de-listing/objection procedure [[Source 1]](#sec-sources) Probable · 1 source 50% aggregated ownership/contribution threshold [[Source 1]](#sec-sources) Probable · 1 source 5-year retention period [[Source 1]](#sec-sources) Probable · 1 source KRW 100m / KRW 30m administrative fines [[Source 1]](#sec-sources) Probable · 1 source disputed: KRW 100m vs KRW 10m [[Source 1]](#sec-sources) Disputed · 1 source casinos sole covered DNFBP [[Source 1]](#sec-sources) Probable · 1 source effective 2025-10-01 [[Source 1]](#sec-sources) Probable · 1 source Plan to amend the Foreign Exchange Transactions Act within 2026 to classify stablecoins as payment instruments for cross-border transfers, with reporting via the FX information network. [[Source 1]](#sec-sources) Probable · 1 source Domestic access restriction or service termination ordered for 27 websites operated by unregistered crypto businesses, 2026-10-13. [[Source 1]](#sec-sources) Uncertain · 1 source