Bank of Korea Probes Financial Firms on Crypto Risk Exposure

South Korea's central bank has launched what appears to be its first formal review of how banks and brokerages would hold up under severe crypto market stress. The Bank of Korea began surveying 31 financial institutions on 23 October 2026, asking them to model the impact of three specific adverse scenarios: a major exchange hack leading to a temporary shutdown, a sharp and sustained cryptocurrency price crash, and heavy losses at a peer institution from a crypto-related incident. For accounting teams, auditors, and CFOs with any exposure to Korean financial counterparties or domestic digital asset infrastructure, this review signals a notable shift in how systemic crypto risk is being quantified at the supervisory level.

Scope and Structure of the Review

The Bank of Korea sent its questionnaire to 18 banks and 13 brokerages, covering a broad cross-section of the domestic financial sector. This is reportedly the central bank's first dedicated review of financial institutions' participation in the virtual asset market.

What the survey asks

The questions span several dimensions of institutional crypto activity. Firms are being asked to disclose their crypto-related staffing levels and budget allocations, their specific business activities in the digital asset space, the strategic rationale for entering the market, and the amounts they have invested in both domestic and overseas crypto companies. That breadth is significant: this is not a narrow liquidity stress test but a wide-angle scan of operational, strategic, and financial exposure.

The three stress scenarios

The survey frames three concrete adverse scenarios that institutions must respond to. The first asks what would happen if South Korea's largest crypto exchange by market share temporarily suspended operations following a major hack or a comparable incident. The second examines the knock-on effects of a steep price decline followed by a prolonged trading slump. The third looks at potential contagion: how would a firm be affected if a peer financial institution suffered significant losses from a crypto-related event?

Taken together, the scenarios mirror the kind of interconnectedness stress-testing that regulators have applied to traditional asset classes for years, now adapted specifically to digital assets. The survey began before the widely reported large-scale hack of a major global exchange in late October 2026, but that incident directly illustrates the type of risk the central bank is probing.

Regulatory Context: Why Now?

The timing of this review is not coincidental. Several regulatory and market-level developments have converged to push the Bank of Korea toward a more active supervisory posture on crypto.

Legislative delays and market-led growth

South Korea's proposed Digital Asset Basic Act has moved more slowly than market participants anticipated. Disagreements over which types of institutions should be permitted to issue stablecoins have been a particular sticking point, and the broader legislative framework has not kept pace with the speed at which financial firms have been building out digital asset operations. A Bank of Korea official, speaking to The Korea Herald, noted that "financial institutions are making their own preparations even as virtual asset legislation is moving more slowly than the market expected." The survey appears to be the central bank's way of understanding the gap between what firms are already doing and what formal rules currently govern.

FSC cybersecurity proposals

Separately, in October 2026, the Financial Services Commission put forward new cybersecurity proposals after finding deficiencies at 130 of 555 financial companies it reviewed. The proposals include more frequent vulnerability assessments and greater accountability at the executive level, prompted in part by security incidents involving 16 companies, with crypto exchanges among them. That regulatory trajectory, from the FSC on the cybersecurity side and the Bank of Korea on the systemic risk side, points to a coordinated tightening of oversight over digital asset activities across the Korean financial sector.

This connects directly to prior enforcement action: earlier in 2026, South Korea's Financial Intelligence Unit referred unregistered crypto operators to police and sought site blocks, underscoring that South Korea's FIU enforcement action against unregistered crypto operators is part of a sustained regulatory push rather than isolated incidents.

Accounting and Financial Reporting Implications

For finance teams at Korean banks, brokerages, and their counterparties, the Bank of Korea's survey creates both immediate disclosure considerations and longer-term accounting framework questions.

Identifying and classifying crypto exposures

The survey's requirement to disclose investment amounts in domestic and overseas crypto companies means institutions need a precise, auditable record of those positions. Under IFRS, crypto assets held as investments are typically classified either as intangible assets under IAS 38 or, for those held for trading, as financial assets at fair value through profit or loss under IFRS 9, depending on their contractual characteristics. Institutions that have not yet formalised this classification will need to do so before they can answer the survey accurately, let alone before an auditor or regulator scrutinises the response.

Impairment and fair value considerations

The crash scenario in the survey, specifically a steep price fall followed by a sustained trading slump, maps directly onto impairment assessment requirements. For assets carried at cost or amortised cost with crypto exposure embedded, a prolonged market downturn could trigger impairment reviews under IAS 36. For those at fair value, the question is whether Level 1 market prices remain observable or whether illiquidity in a downturn forces a reclassification to Level 2 or Level 3 inputs, with corresponding disclosure obligations under IFRS 13. Reliable digital asset accounting software that records contemporaneous pricing with an auditable trail becomes essential in exactly this environment.

Operational risk provisions

The hack scenario asks how a firm would be affected if a major exchange suspended operations. For firms with assets custodied at such an exchange, this is not purely a theoretical exercise. It raises questions about whether contingent liabilities are recognised, whether custodial arrangements are disclosed in the notes to the financial statements, and whether business continuity costs are provisioned. The accounting and compliance implications of a major exchange hack are already well-documented from recent precedent, and Korean institutions will need to apply those lessons to their own balance sheet disclosures.

Contagion and counterparty risk

The third scenario, institutional contagion, introduces counterparty credit risk into the picture. If a peer institution suffers material crypto losses, the question for accounting teams is whether any interbank exposures, credit lines, or settlement obligations connected to that institution require a reassessment of expected credit losses under IFRS 9. This is particularly relevant for the 13 brokerages in the survey cohort, which may have settlement or margin arrangements with entities that themselves carry significant crypto positions.

Practical Steps for Compliance and Finance Teams

The Bank of Korea's review, even as a survey rather than a binding regulatory directive, sets a clear expectation: institutions should be able to quantify and explain their crypto exposures on short notice.

Build a crypto exposure register now

Finance teams that do not already maintain a structured register of all crypto-related positions, including direct holdings, equity investments in crypto companies, custodial balances, and operational budget allocations, should treat the survey as a prompt to build one. The register needs to capture asset classification, the accounting standard applied, the valuation basis, and the location of the asset, whether at a domestic exchange, an overseas platform, or held directly. Crypto bookkeeping software with multi-entity and multi-jurisdiction support is particularly relevant here, given the survey's explicit distinction between domestic and overseas investments.

Stress-test your own disclosures

Walk through each of the Bank of Korea's three scenarios and assess whether your current financial statements would accurately reflect the position. If the largest domestic exchange suspended operations tomorrow, could your balance sheet, notes, and board-level risk disclosures reflect the exposure accurately within 24 to 48 hours? If not, that is a gap to close before the next audit cycle, not after.

Engage with the FSC cybersecurity proposals

The FSC's proposed new cybersecurity requirements, including more frequent vulnerability assessments and executive accountability measures, will likely become binding in some form. Compliance teams should map current controls against the proposed standards now, identify gaps, and begin assigning executive ownership to crypto-related risk items in the governance framework. The Bank of Korea's survey and the FSC's cybersecurity push are two sides of the same regulatory movement.

Review stablecoin exposure separately

Given that stablecoin issuance rights are one of the unresolved questions in the Digital Asset Basic Act, institutions that hold stablecoins, or that have invested in companies developing stablecoin infrastructure, should ensure these positions are clearly identified and classified. The regulatory treatment of stablecoins in Korea remains in flux, and the accounting classification may need to be revisited as the legislation develops.

What This Means for Auditors and Accounting Firms

For accounting practices serving Korean financial institutions, the Bank of Korea's survey raises the bar for what a clean audit of a bank or brokerage with crypto exposure looks like. Auditors should expect clients to face questions about the completeness and accuracy of their crypto disclosures, the robustness of their fair value methodology, and the adequacy of their operational risk provisions in light of the scenarios the central bank is actively asking about.

Engagement letters and audit plans for the 2026 year-end should explicitly address digital asset exposure, even where the amounts appear immaterial in isolation. The regulatory signal from the Bank of Korea is that systemic risk can accumulate across many firms with individually modest exposures, and supervisors are now trying to measure that aggregate. Audit teams that rely on generic financial instrument work programmes without crypto-specific procedures will find themselves out of step with where supervision is heading.

The broader international context matters here too. South Korea's review is part of a pattern in which central banks and prudential regulators globally are moving from passive observation of institutional crypto activity to active, scenario-based quantification of the risks involved. Firms that invest in purpose-built crypto accounting software to maintain audit-ready records of digital asset positions will be better placed to respond to supervisory inquiries, whether from the Bank of Korea, the FSC, or international counterparts.

Frequently Asked Questions

Source: Cointelegraph