Korea Rewrites Its VASP Registration Manual: What Accounting Firms and CFOs Must Assess Now
South Korea's Financial Intelligence Unit (FIU) and Financial Supervisory Service (FSS) have jointly published a wholesale revision of the virtual asset service provider (VASP) registration manual, the most sweeping update to the document since the country's crypto reporting regime took effect. The revision arrives as the Financial Services Commission (FSC) accelerates its push to harden the VASP registration system, and it sets materially higher expectations for AML governance, operational documentation, and ongoing supervisory cooperation. For accounting firms, auditors, and CFOs whose clients touch the Korean crypto market, the updated manual is not background reading: it directly shapes what compliance evidence will be tested and what gaps could trigger enforcement.
Why Korea Is Revisiting the Manual Now
Korea's VASP reporting regime has been in place since 2021, but the regulatory environment has shifted considerably since then. The FSC has signalled repeatedly that the initial registration wave produced uneven compliance quality, with some operators submitting documentation that met the letter of the rules but lacked operational substance. The FIU, which sits within the FSC and carries primary responsibility for anti-money laundering supervision of virtual asset businesses, concluded that the existing manual no longer reflected the complexity of the market or the expectations of frontline supervisors at the FSS.
The joint FIU-FSS outreach sessions announced alongside the manual revision are telling. Rather than simply publishing the updated text and expecting operators to self-study, the agencies are running on-site explanation meetings described in Korean as a "visiting briefing" format, where supervisors go to the industry rather than the other way around. That approach signals both the urgency the authorities attach to the changes and their awareness that the compliance community needs guided interpretation, not just a document drop.
The Hardened Registration Regime
The manual revision sits within a broader FSC initiative to strengthen the VASP registration system itself. Registration in Korea is not a light-touch notification: VASPs must meet substantive requirements on AML programme design, real-name account linkage with a licensed bank, information security certification, and fit-and-proper assessments of key personnel. The updated manual translates those statutory requirements into detailed procedural expectations, covering how documentation should be structured, what evidence of internal controls is acceptable, and how ongoing reporting obligations must be evidenced at the point of application or renewal.
For firms that advise Korean VASPs or conduct due diligence on them as counterparties, the manual revision effectively raises the minimum standard against which a compliant operator will be judged. An entity that passed registration under the previous manual may now find that its documentation package falls short of what the FSS expects at the next supervisory interaction.
Key Areas Covered by the Revised Manual
While the FSC has not published a granular line-by-line comparison of the old and new versions, the announcement makes clear that the revision is described as a complete overhaul rather than an incremental patch. The areas most likely to carry significant changes, based on the FSC's stated rationale, fall into three broad categories.
AML Programme Documentation
Korean VASPs are required to maintain written AML and counter-terrorism financing (CTF) programmes that cover customer due diligence (CDD), enhanced due diligence (EDD) for higher-risk customers, transaction monitoring, suspicious transaction reporting (STR), and record-keeping. The revised manual is expected to sharpen the evidentiary standard for each of these elements, specifying more precisely what a "written programme" must contain and how VASPs must demonstrate that policies are implemented in practice, not just drafted on paper.
For accounting firms conducting AML audits or advisory work for Korean VASP clients, this has a direct workflow implication: audit programmes and gap-assessment templates will need to be updated to test against the new manual's benchmarks rather than the previous version's.
Governance and Key Personnel Requirements
Korea's VASP framework places weight on the fitness of individuals in control and management positions. The manual revision is understood to refine how VASPs must document governance structures, lines of accountability, and the qualifications or experience of compliance officers. CFOs at Korean VASPs, or at international firms with Korean subsidiaries in the virtual asset space, should expect closer scrutiny of the evidence they submit about governance arrangements.
Operational and Technical Documentation
Information security certification (under Korea's ISMS or equivalent standards) and real-name account linkage remain foundational requirements. The revised manual is likely to address how VASPs document the continuity of these arrangements and how they evidence operational controls, such as wallet management procedures and transaction screening systems, in a way that satisfies supervisory review.
The On-Site Briefing Programme
The decision by the FIU and FSS to hold "visiting explanation sessions" is operationally significant. Supervisors attending industry venues to walk through the revised manual creates opportunities for the compliance community to seek clarification on ambiguous provisions before those provisions are tested in an enforcement context. Accounting firms and legal advisers supporting Korean VASP clients should treat these sessions as high-priority intelligence-gathering events, not just information for their clients to absorb directly.
What Firms Should Extract from the Sessions
The most valuable output from the briefings will be supervisory commentary on how the FSS intends to apply the revised standards in practice: which gaps they consider material, how they will assess documentation submitted before the manual was updated, and whether there is any transitional period for operators to bring existing registration packages into line. These are not details that typically appear in the published manual itself but are often clarified in the question-and-answer portions of official outreach events.
Accounting and Crypto Bookkeeping Software Implications
The manual revision has direct consequences for the data infrastructure that Korean VASPs and their advisers rely on. A more demanding documentation standard means that the underlying transaction records, customer identification data, and risk-assessment trails must be captured with greater precision and retained in a form that can be produced to supervisors on request.
Data Capture and Record-Keeping
Crypto accounting software and digital asset accounting software used by Korean VASPs or their external accountants must be capable of generating audit-ready records that satisfy the revised manual's requirements. This includes transaction-level data with counterparty identification, timestamps, asset types, and amounts, as well as linkage to the CDD records that justify the risk classification applied to each customer. If existing systems produce records in a format that does not map cleanly to what supervisors now expect, firms face a remediation task before the next supervisory interaction.
This is also relevant for international accounting firms that use a single crypto bookkeeping software platform across multiple jurisdictions. Korean regulatory requirements may differ from those in the EU, UK, or US, and a platform configured primarily for one regulatory environment may produce records that satisfy auditors in that jurisdiction but fall short of what the FSS expects. Jurisdiction-specific configuration and output formatting deserve explicit attention.
Travel Rule Alignment
Korea has already moved to remove the threshold on its Travel Rule obligations, a change covered in our earlier analysis of South Korea's removal of the crypto Travel Rule threshold. The revised VASP registration manual sits alongside that change: VASPs that cannot demonstrate compliant Travel Rule implementation as part of their AML programme documentation are unlikely to satisfy the new manual's requirements. For crypto accounting software vendors and in-house teams, the intersection of Travel Rule data capture and registration documentation is a practical workflow point that needs to be addressed as a single integrated challenge, not two separate tasks.
What Changed Since the Last VASP Registration Tightening
The FSC has been progressively hardening its approach to VASP oversight over the past year. Our earlier coverage of FSC Korea's tightened VASP registration requirements set out the statutory changes underpinning the regime. The manual revision is the operational layer on top of those statutory changes: it tells operators and their advisers exactly how the FSS expects the rules to be implemented and documented in practice.
The sequence matters. Statutory tightening followed by a manual overhaul followed by on-site supervisory briefings is a classic regulatory escalation pattern. It signals that the FSS is preparing to assess compliance against the new standard actively, not just publish it and wait for the next registration cycle.
Practical Next Steps for Accounting Firms and CFOs
The combination of a revised manual, on-site supervisory briefings, and an already-toughened registration regime creates a clear action window. The steps below are grounded in the FSC's published announcement and standard AML advisory practice.
Immediate Actions
First, obtain the revised manual directly from the FSC or FIU and map it against any existing compliance frameworks, audit programmes, or documentation templates you use for Korean VASP clients. Do not assume the previous version's structure carries over: this is described as a complete revision. Second, identify which clients are registered Korean VASPs or are in the process of registering, and flag the manual change to them as a priority item requiring documentation review. Third, register for or obtain readouts from the FIU-FSS visiting briefing sessions. Even if attendance is restricted to VASPs, the questions and supervisory responses will filter into the advisory community quickly and are worth capturing.
Medium-Term Actions
Review whether your crypto accounting software and digital asset accounting software platforms produce outputs that satisfy the new manual's record-keeping and documentation standards. If your firm relies on a single platform configured for another jurisdiction's requirements, a Korean-specific configuration review is warranted. Update AML audit programmes and gap-assessment tools to test against the revised manual's benchmarks. If your clients have international counterparties that are Korean VASPs, revisit your counterparty due diligence procedures to ensure they reflect the updated compliance expectations that the Korean market now imposes.
Frequently Asked Questions
Who does the revised VASP registration manual apply to?
The manual applies to any entity required to register as a virtual asset service provider in South Korea under the Act on Reporting and Using Specified Financial Transaction Information. This covers exchanges, custodians, and other businesses that provide virtual asset services to Korean customers, as well as their compliance officers and external advisers.
Is there a deadline for existing VASPs to align with the revised manual?
The FSC announcement does not specify a formal transitional deadline for existing registrants. However, the on-site briefing programme suggests the authorities expect prompt uptake. VASPs should treat the publication date of the revised manual as the effective date from which supervisors may apply the new standards.
How does the manual revision relate to Korea's Travel Rule changes?
Korea has already removed the monetary threshold on its Travel Rule obligations, meaning all virtual asset transfers now require originator and beneficiary information to be passed between VASPs. The revised registration manual's AML programme documentation requirements are expected to encompass Travel Rule compliance as a component, so VASPs must be able to evidence both their Travel Rule procedures and their broader AML programme in a single coherent documentation package.
What should accounting firms prioritise when reviewing Korean VASP clients?
The immediate priority is a gap assessment comparing the client's existing documentation package against the revised manual's requirements. Areas most likely to require updating include written AML policy documents, transaction monitoring evidence, governance and key personnel records, and technical documentation for information security certification and real-name account linkage.
Does this affect non-Korean firms that have Korean VASPs as counterparties?
Yes, indirectly. If a non-Korean firm conducts due diligence on a Korean VASP as a counterparty or correspondent, the revised manual sets the benchmark for what a compliant Korean operator should look like. Due diligence frameworks that were calibrated against the old manual may no longer adequately assess whether a Korean counterparty meets current regulatory expectations.