South Korea Tightens Crypto AML Enforcement: What Firms Must Know

The Korean Financial Intelligence Unit (KoFIU), operating under the Financial Services Commission (FSC), has taken formal enforcement action against five domestic crypto exchange operators following onsite inspections that uncovered serious gaps in anti-money laundering and counter-financing of terrorism (AML/CFT) controls. The move signals a clear shift toward stricter regulatory scrutiny of digital asset businesses in South Korea, and any firm with exposure to the Korean market, whether domestic or foreign, needs to pay close attention. Robust crypto accounting software and compliance infrastructure are no longer optional in this environment.

What the KoFIU Found During Its Inspections

The inspections were carried out during the second half of 2022, and KoFIU published its findings alongside the enforcement actions on 30 March 2023. While the regulator did not name the five exchanges subject to sanctions, it provided illustrative examples of the conduct that triggered the actions.

Transaction patterns that drew regulatory attention

The KoFIU described several transaction patterns that it considered indicative of possible money laundering. In one case, a single customer received cryptoassets worth approximately 27.8 billion Korean won from overseas on 1,074 separate occasions over nine months, with almost no corresponding purchases, and subsequently sold those assets in 12,267 transactions before withdrawing 28.2 billion won in cash across 712 withdrawals. The one-directional flow, the sheer volume of transactions, and the ultimate off-ramp to cash are classic indicators of layering.

A second pattern involved a customer receiving 32 different types of cryptoassets across 2,243 transactions (totalling 16.4 billion won) from 313 unidentified addresses, then sending an equivalent amount outbound to overseas addresses in a matching number of transactions. The near-perfect symmetry between inflows and outflows, combined with the number of unknown counterparties, raises immediate red flags under any standard transaction monitoring framework.

The third example involved elderly customers, aged between 73 and 95, who were found to be actively trading a wide range of cryptoassets late at night or in the early hours of the morning, all originating from the same overseas IP address. This pattern suggests nominee account usage, where a third party controls accounts held in the names of individuals unlikely to be the genuine beneficial owners.

Finally, the KoFIU identified instances of exchange executives and employees trading cryptoassets on their own employer's platform using accounts registered in the names of their spouses, a direct conflict of interest and a breach of internal controls.

Systemic compliance failures identified

Beyond the specific transaction examples, KoFIU's inspection findings highlighted broader structural weaknesses across the five firms. These included ineffective transaction monitoring systems, inadequate know-your-customer (KYC) verification processes, non-compliance with Travel Rule requirements, and poor customer risk assessment practices. Together, these failings left the exchanges exposed as potential conduits for smurfing, uneconomic off-ramping, and the use of nominee arrangements, all well-documented money laundering typologies.

Sanctions Imposed and the Escalation Warning

The enforcement actions taken under the Act on Reporting and Using Specified Financial Transaction Information (commonly referred to as the AML Act) ranged from warnings and formal reprimands directed at individual employees and executives through to financial penalties levied against the companies themselves. KoFIU was explicit that if similar violations arise in future inspections, the consequences will be more severe. This is not boilerplate regulatory language. The FSC has a track record of following through on escalation warnings in the financial sector.

The regulator also announced that it intends to expand its inspection programme to cover other categories of digital asset business, including wallet operators, with a specific focus on areas identified as carrying high money laundering risk. Thematic inspections, rather than one-off reviews, are now the stated approach.

Broader Enforcement Context in South Korea

Actions against foreign exchanges and individuals

The March 2023 actions did not emerge in isolation. In August 2022, KoFIU blocked 16 foreign crypto exchanges from operating in South Korea on the grounds that they were targeting domestic investors without completing the required registration process. In the same month, authorities charged 16 individuals in connection with illegal foreign exchange transactions involving cryptoassets. The willingness to pursue entities based outside the country is a meaningful signal for any overseas firm with Korean user bases.

Legislative development running in parallel

Enforcement is not the whole picture. The FSC and the National Assembly announced in October 2022 that they would collaborate on legislation designed to balance blockchain development with investor protection. Seventeen separate crypto-related legislative proposals are under active consideration, with a consolidated framework, the Digital Asset Basic Act, expected to emerge from the process. In February 2023, guidelines were also issued on the treatment of tokenised cryptoassets as securities under existing capital market rules, bringing more asset types within the regulatory perimeter.

Separately, the Ministry of Justice announced in January 2023 plans to deploy a virtual currency tracking system enabling law enforcement agencies to identify money laundering activity and assist in recovering cryptoassets linked to crime. This builds on a partnership formed in October 2022 between the Korean National Police Agency and the five largest domestic exchanges to investigate and prevent crypto-related crime.

The overall picture is of a government that sees a place for the crypto industry but intends to regulate it to the same standard expected of traditional financial services, with real consequences for firms that fall short.

Accounting and Compliance Implications for B2B Firms

Record-keeping and auditability requirements

For accounting firms, auditors, and CFOs advising businesses with Korean operations or Korean customer bases, the KoFIU findings carry direct implications for how client records are structured and maintained. The transaction patterns described, particularly the high-frequency, high-volume flows involving multiple asset types and unidentified counterparties, require transaction-level data to be captured in a format that supports both real-time monitoring and retrospective audit trails.

Effective crypto bookkeeping software must be capable of tagging transactions by counterparty category, flagging threshold breaches automatically, and producing reports that satisfy a regulator's request within a short timeframe. Manual reconciliation across dozens of wallet addresses and exchange accounts is simply not viable at the scale the KoFIU examples describe.

Auditors reviewing the financial statements of Korean virtual asset service providers (VASPs) should now factor KoFIU inspection risk into their risk assessment procedures. Where a client's transaction monitoring systems cannot demonstrate that the patterns above would have been detected and reported, that represents a material control weakness that needs to be communicated clearly.

Travel Rule compliance as a priority gap

KoFIU specifically called out non-compliance with Travel Rule requirements as one of the failings it observed. South Korea implemented the Travel Rule for crypto transactions in March 2022. Any firm using digital asset accounting software that does not integrate Travel Rule data, originator and beneficiary information for transfers above the applicable threshold, is operating with an incomplete compliance picture. This is not a theoretical risk; it was one of the named deficiencies that led to the sanctions announced in March 2023.

For firms advising Korean VASPs, a gap analysis of Travel Rule implementation should be near the top of any compliance review agenda. The question is not just whether the rule is technically in place but whether the data being captured is accurate, complete, and actually being reviewed.

Internal controls over related-party transactions

The finding that executives and employees were trading on their employer's exchange through accounts registered to family members points to a specific internal controls failure that accountants will recognise immediately: inadequate related-party transaction monitoring. For any VASP, the accounts of employees, their immediate family members, and beneficial owners should be identified, flagged, and subject to enhanced scrutiny as a baseline control. This is a standard requirement in traditional financial services and the KoFIU is clearly applying the same expectation to crypto businesses.

What Firms Should Do Now

For domestic Korean VASPs and their advisers

The KoFIU's announcement of expanded thematic inspections means that the question for domestic operators is not whether an inspection will happen but when. Firms should conduct an internal gap analysis against the specific deficiencies identified: transaction monitoring effectiveness, KYC verification quality, Travel Rule data completeness, customer risk rating methodology, and related-party account controls. Any firm that cannot demonstrate adequate controls in these areas before an inspector arrives is in a weak position.

Documentation matters as much as the controls themselves. A well-designed monitoring system that lacks written policies, decision logs, and escalation records will not satisfy a regulator looking for evidence of a genuine compliance culture rather than a compliance checkbox.

For foreign firms with Korean exposure

The blocking of 16 foreign exchanges in August 2022 established that KoFIU is prepared to take action against overseas entities. Any platform that has Korean users, accepts Korean won, or markets services to Korean residents without completing the required registration process is exposed. The fact that enforcement against foreign entities is logistically more complex does not make it safe to assume it will not happen. As the legislative framework matures through the Digital Asset Basic Act process, the registration and compliance obligations for foreign operators are likely to become more explicit, not less.

For firms providing audit or advisory services to clients in this position, the appropriate step is to ensure that Korean regulatory exposure is documented, that clients understand the registration requirements, and that any decision not to register is made consciously and with full awareness of the risk rather than by default.

Our earlier analysis of how blockchain analytics is reshaping AML investigations provides useful context on the investigative tools regulators are deploying: Bitcoin crime investigation and blockchain analytics in AML. Firms navigating multi-jurisdictional licensing questions may also find relevant parallels in our coverage of Hong Kong's next wave of virtual asset licensing requirements.

Frequently Asked Questions

Which South Korean law governs the AML obligations of crypto exchanges?

The primary legislation is the Act on Reporting and Using Specified Financial Transaction Information, generally referred to as the AML Act. Virtual asset service providers registered in South Korea are required to implement AML/CFT controls including KYC, CDD, transaction monitoring, and Travel Rule compliance under this framework, overseen by KoFIU within the Financial Services Commission.

What is the Travel Rule requirement in South Korea and when did it take effect?

South Korea's Travel Rule for crypto transfers came into force in March 2022. It requires VASPs to collect and transmit originator and beneficiary information when transferring virtual assets above a specified threshold. KoFIU's March 2023 enforcement findings identified non-compliance with this rule as one of the named deficiencies at the five exchanges reviewed.

What is the Digital Asset Basic Act and how does it affect crypto businesses?

The Digital Asset Basic Act is a comprehensive legislative framework being developed through South Korea's National Assembly, consolidating seventeen separate crypto-related legislative proposals. It is intended to provide a unified regulatory structure for digital assets, covering areas including investor protection and business conduct standards. The FSC and the National Assembly announced their collaboration on this framework in October 2022. The final shape of the legislation will determine licensing obligations, permitted activities, and compliance requirements for both domestic operators and foreign firms serving Korean users.

Can foreign crypto exchanges be sanctioned by South Korean authorities?

Yes. In August 2022, KoFIU blocked 16 foreign crypto exchanges from operating in South Korea because they were targeting domestic investors without completing the required registration process. While enforcement action against overseas entities presents practical challenges, KoFIU has made clear its intention to pursue non-compliant firms regardless of where they are incorporated or headquartered.

What specific transaction monitoring gaps led to the March 2023 enforcement actions?

KoFIU's inspection findings identified four main control failures: ineffective transaction monitoring systems that failed to detect high-risk patterns, inadequate KYC and customer due diligence processes, non-compliance with Travel Rule requirements for cross-border transfers, and weak customer risk assessment methodologies. The regulator also found that nominee account usage and related-party trading by staff members had not been identified or reported by the affected exchanges.

Source: Elliptic