BitGo Korea Secures VASP Registration Ahead of Stricter Entry Rules
BitGo Korea received its virtual asset service provider registration from the Korea Financial Intelligence Unit on 19 August 2026, a Tuesday, two days before South Korea's revised and considerably stricter VASP entry requirements took effect. The registration authorises the locally incorporated entity to provide digital asset custody and transfer services to institutional and enterprise clients operating in Korea, and it marks a significant moment for the country's regulated digital asset infrastructure.
What Happened and When
BitGo announced on Thursday, 21 August 2026, that the Korea FIU had accepted the registration of its South Korean subsidiary. The company was clear that it built the entity from scratch rather than acquiring an existing registered VASP, a path that several other international operators have taken to accelerate market entry.
The timing relative to the rule change
According to Yonhap News Agency, the FIU accepted the registration on Tuesday, 19 August. South Korea's updated VASP entry requirements came into force on Thursday, 21 August. The two-day gap is not incidental: any entity whose registration was not accepted before that deadline would have had to satisfy the new, more demanding criteria from the outset. By completing the process under the prior framework, BitGo Korea's registration reflects the standards that were in place at the point of submission and acceptance, though the entity will now operate within the ongoing regulatory environment that the revised rules define.
What BitGo Korea says it built
The company stated that it constructed security, anti-money laundering, internal control, and operational frameworks specifically tailored to South Korean regulatory requirements. That framing matters for institutional clients conducting due diligence: it signals that the Korean entity is not simply a rebranded global product but a locally designed compliance infrastructure, at least in the company's own characterisation. Independent verification through the standard counterparty due diligence process remains essential.
South Korea's Tighter VASP Entry Requirements
The Financial Services Commission is the body responsible for the broader regulatory framework within which VASP registrations sit. According to the FSC, the updated rules that took effect on 21 August expand the scrutiny applied to an applicant's shareholders and require applicants to satisfy standards across four distinct areas.
The four new threshold criteria
The FSC's updated framework requires applicants to demonstrate:
- Financial soundness: the entity must meet defined capital and financial health thresholds.
- Cybersecurity: systems and controls must satisfy prescribed technical standards for protecting digital assets and client data.
- Internal controls: governance structures, risk management processes, and operational procedures must be documentable and auditable.
- AML compliance: anti-money laundering programmes must align with Korean requirements, which themselves reflect Financial Action Task Force standards for virtual asset service providers.
The expanded shareholder scrutiny is a notable addition. Regulators can now examine beneficial ownership more deeply, reducing the risk that entities with problematic ultimate owners obtain a registration by interposing layers of corporate structure. For accounting firms and CFOs, this is a direct parallel to the beneficial ownership verification requirements that underpin FATF Recommendation 24 and Korea's own Act on Reporting and Using Specified Financial Transaction Information.
For a detailed breakdown of how Korea's revised VASP registration manual reshapes due diligence obligations, see our earlier analysis: Korea's revised VASP registration manual and what it means for accounting firms.
Why Institutional Custody Registration Matters for Accounting Firms and CFOs
A VASP registration is not an optional badge. Under Korea's Special Financial Information Act, any entity providing virtual asset custody or transfer services to clients in Korea must hold a valid registration with the FIU. Operating without one exposes the provider and, potentially, its institutional clients to regulatory and legal risk. When a CFO or treasury team selects a custodian for Korean digital asset holdings, confirming that the custodian holds a current, unrestricted VASP registration is a basic governance step, not a box-ticking exercise.
Counterparty risk and audit trail considerations
For accounting firms advising clients who hold digital assets in Korean-registered custodial arrangements, the custodian's regulatory status directly affects how those assets are characterised and disclosed. A custodian operating legally under a valid VASP registration provides a cleaner audit trail and a more defensible basis for the accounting treatment of custody arrangements. Where a custodian's registration is uncertain or conditional, the accounting firm faces additional work to establish the nature of the arrangement and any contingent liabilities.
From a crypto compliance reporting perspective, the existence of a registered custodian in Korea also affects how firms structure their reporting chains. Registered VASPs are required to file suspicious transaction reports and implement customer due diligence, which means the data flows that support an institution's own AML obligations should be more structured and auditable than those available through an unregistered counterparty.
Digital asset accounting software and the custody layer
Firms using crypto accounting software to record institutional digital asset positions need to reflect the custodial layer accurately. When a custodian holds assets on behalf of a client, the accounting treatment depends on whether the arrangement constitutes a bailment, a trust, or something else under the applicable framework. A VASP-registered custodian operating under Korean law provides a more defined legal structure, which in turn supports a more confident accounting classification. Firms relying on digital asset accounting software to automate reconciliations should ensure their systems can ingest custody reports from Korean-registered entities and that the legal basis for the custody relationship is clearly documented.
AML and KYC Implications for Institutions Engaging Korean VASPs
South Korea's VASP registration regime is built on AML and KYC obligations that align closely with FATF's Recommendation 15, which treats virtual asset service providers as obliged entities subject to the same core requirements as banks and other financial institutions. For any institution engaging a Korean-registered VASP as a counterparty, the AML due diligence process should cover several specific areas.
What the counterparty due diligence checklist should include
Accounting firms and compliance teams should confirm at a minimum:
- The VASP's registration number and current status on the Korea FIU's public register.
- The scope of the registration, specifically whether it covers the services the institution intends to use (in BitGo Korea's case, custody and transfer).
- The VASP's AML programme, including its approach to transaction monitoring, suspicious transaction reporting, and travel rule compliance under Korea's implementation of the FATF standard.
- The VASP's beneficial ownership structure, given the expanded shareholder scrutiny now embedded in Korea's registration criteria.
- Any conditions or restrictions attached to the registration.
Our wider guide on VASP onboarding and the AML due diligence framework financial institutions need sets out the full framework for assessing any registered VASP as a counterparty, not just those in Korea.
Travel rule obligations in Korea
Korea has implemented the FATF Travel Rule, requiring VASPs to share originator and beneficiary information on transfers above a specified threshold. BitGo Korea, as a registered VASP providing transfer services, will be subject to these obligations. Institutional clients transferring digital assets to or from BitGo Korea's custody accounts need to ensure their own systems and processes can satisfy the information-sharing requirements on their side of the transaction. Failure to do so creates both a compliance gap and a potential audit finding.
Practical Steps for Firms and CFOs
The BitGo Korea registration is one data point in a rapidly formalising Korean digital asset market. The combination of a major institutional custodian securing a clean-start VASP registration and the simultaneous tightening of entry requirements signals that the Korean market is consolidating around a smaller set of well-capitalised, compliant providers.
What to do now
For accounting firms and CFOs with existing or planned Korean digital asset exposure, the immediate action items are practical and discrete. First, verify the registration status of any existing Korean custodian or VASP counterparty against the FIU's register, particularly given that the new entry requirements took effect on 21 August 2026 and any provider operating under a conditional or grandfathered arrangement may face additional scrutiny. Second, update counterparty due diligence files to reflect the new shareholder scrutiny standard, since the FSC's expanded beneficial ownership criteria represent a material change to what a thorough due diligence file should contain. Third, review custody agreements to confirm they accurately describe the legal basis of the arrangement under Korean law, since this affects both accounting classification and AML obligations. Finally, confirm that your crypto bookkeeping software or digital asset accounting software workflows can handle custody reports from Korean-registered entities and that the travel rule data fields are captured correctly on any inter-VASP transfers.
The formalisation of Korea's VASP regime is part of a broader regional pattern. The APAC digital asset infrastructure is maturing, and the compliance requirements attached to it are becoming more precise, not less. Firms that build rigorous counterparty assessment processes now will be better positioned as the region's regulatory standards continue to converge toward FATF baselines.
Frequently Asked Questions
What is a VASP registration in South Korea and who grants it?
A VASP registration is the authorisation required under Korea's Special Financial Information Act for any entity providing virtual asset services, including custody, transfer, exchange, and brokerage. The Korea Financial Intelligence Unit, operating under the Financial Services Commission's framework, is the body that accepts or rejects registration applications. Without a valid registration, an entity cannot legally provide covered services to clients in Korea.
Does the timing of BitGo Korea's registration matter legally?
The registration was accepted two days before South Korea's revised and stricter VASP entry requirements took effect on 21 August 2026. The acceptance under the prior framework means the registration itself reflects the standards applicable at the time of acceptance. The entity will, however, need to comply with all ongoing obligations under the updated regime, including any enhanced requirements that apply to existing registrants going forward.
What should an accounting firm check before treating a Korean-registered VASP as a compliant counterparty?
At a minimum, the firm should verify the VASP's current registration status on the FIU's public register, confirm the scope of the registration covers the relevant services, review the VASP's AML programme and travel rule compliance approach, examine its beneficial ownership structure in light of the FSC's expanded shareholder scrutiny rules, and check for any conditions or restrictions on the registration.
How does a custodian's VASP registration affect the accounting treatment of digital assets held in custody?
The legal structure of a custodial arrangement directly influences how the underlying assets are classified and disclosed. A VASP-registered custodian operating under a defined legal framework provides a clearer basis for determining whether the arrangement constitutes a bailment, a trust, or another structure, which affects whether the assets appear on the client's balance sheet and how they are measured. An unregistered or unclear custodial arrangement introduces uncertainty that auditors will need to address and that can complicate financial statement preparation.
What is the FATF Travel Rule and how does it apply to Korean VASPs?
The FATF Travel Rule requires virtual asset service providers to collect and transmit identifying information about the originator and beneficiary of a virtual asset transfer above a defined threshold. Korea has implemented this requirement, meaning registered Korean VASPs, including those providing transfer services, must share this information with counterparty VASPs on qualifying transactions. Institutional clients need to ensure their own systems can provide and receive the required data fields on any transfer involving a Korean-registered VASP.
Source: Cointelegraph