The inclusion of cross-border virtual asset transfers in foreign exchange reporting and the remaining lower-level standards

The amended Foreign Exchange Transactions Act (Act No. 21714), promulgated on June 2, 2026, takes effect on December 3. A draft amendment to the Act's Enforcement Decree, containing the details the Act delegates to it, was put out for legislative notice (a procedure that announces a draft law in advance and invites comments) on October 7. This article is based on that draft and on government materials made public up to October 12. After receiving comments until October 26, the government plans to put the decree through regulatory review by the Office for Government Policy Coordination, review by the Ministry of Government Legislation, and the vice-ministerial meeting and the Cabinet meeting, so that the decree also takes effect on the Act's effective date.

The key point is that virtual asset service providers (VASPs) moving virtual assets across borders, or sending them to and receiving them from personal wallets, come within the Foreign Exchange Transactions Act as "virtual asset transfer business." The details of this business are gathered at the foreign exchange information aggregation agency.

Virtual asset transfers entering the foreign exchange information aggregation agency

A channel for foreign exchange reporting already exists. Under Article 39 of the current Enforcement Decree, foreign exchange agencies and others notify the foreign exchange information aggregation agency of the details when they handle foreign exchange transactions, payments or receipts. Foreign exchange agencies are financial companies that have registered, or been exempted from registration, in order to conduct foreign exchange business, and the foreign exchange information aggregation agency is the body that relays and collects foreign exchange data. The government press release described this aggregation agency as the foreign exchange data network of the Bank of Korea (BOK), Korea's central bank.

The amended Act brought virtual assets into this channel. It added virtual asset transfers to the data the aggregation agency collects and to the data it passes on to relevant agencies, and added the Financial Services Commission (FSC), Korea's financial regulator, to the agencies that receive the data (Articles 25 and 21). The draft amendment to the Enforcement Decree added virtual asset transfer business operators to those under the notification obligation. The structure adds words to the existing text instead of setting up a separate reporting provision, so that records of virtual asset transfers also flow through the channel that foreign exchange agencies and others have been using.

The government plans to share the collected data with the National Tax Service (NTS), the Korea Customs Service, the Financial Supervisory Service (FSS) and the Korea Financial Intelligence Unit (KoFIU, the agency that analyzes transactions suspected of money laundering), and to make use of it. The purpose stated in the reasons for amending the Act is likewise to build a monitoring system for virtual assets.

The two-part definition of virtual asset transfer business

Article 3 of the amended Act defined virtual asset transfer business in two parts. The first is a VASP moving virtual assets between the Republic of Korea and a foreign country through sales, purchases, exchanges or other acts prescribed by the Enforcement Decree. The draft amendment to the Decree listed, as such other acts, business activities such as safekeeping and management, brokering and arranging sales or exchanges, and acting on behalf of others.

The second is a transfer that produces "substantially the same effect" as the first, and the Act left its scope to the Enforcement Decree. The draft amendment set this as transfers between a VASP and "a virtual asset address that does not go through a virtual asset service provider." The provision does not contain the term "personal wallet." The government's public notice described this part as transfers between domestic VASPs and personal wallets. The provision does not distinguish whether such a personal wallet is in Korea or abroad.

The meanings of "virtual asset" and "virtual asset service provider" used in both parts are the same as the definitions in the Act on the Protection of Virtual Asset Users.

The rationale for including personal wallet transfers

The reason the government chose this scope is set out in the regulatory impact analysis. This is a document in which the government weighs the need for, and the alternatives to, a new or changed regulation, and it was attached to this legislative notice. In it, the government placed two options side by side. The option of covering only transfers between service providers carries the drawback that monitoring gaps, such as regulatory circumvention through personal wallets, could arise. The option of also covering transfers to personal wallets reduces regulatory gaps, but carries the drawback that the range of transactions service providers must report becomes wider.

The government chose the option that includes personal wallets. It took the view that in virtual asset transactions "the concept of physical borders is ambiguous," and that assets that have moved out to personal wallets are difficult to trace afterward. It therefore regarded such transfers as also having substantially the same effect as cross-border transfers, and concluded that including them in monitoring is appropriate for the effectiveness of regulation.

According to the regulatory overview in the same document, the Korea Customs Service counted KRW 11.4 trillion, or 79% of the amount of foreign exchange crimes detected from 2021 to 2025, as related to virtual assets. The total amount detected over the same period is KRW 14.5 trillion.

Registrants and registration requirements

Under Article 8-2 of the Act, a VASP that intends to conduct virtual asset transfer business must register in advance with the Minister of Finance and Economy. There are three requirements.

• Having completed the filing required under the Act on Reporting and Using Specified Financial Transaction Information (the law that sets anti-money laundering obligations)
• Having its computer network connected to the agency that relays and collects foreign exchange data
• Having the facilities, professional staff and other resources prescribed by the Enforcement Decree

The draft amendment to the Decree requires computer systems that allow the business and follow-up management to run smoothly. For professional staff, at least two people who have two or more years of experience in foreign exchange business, or who have completed training set by the Minister of Finance and Economy, must be placed at each business office. In line with existing foreign exchange business registration, the items entered in the application cover the name and location, business details, capital and facilities, professional staff, and matters concerning executives. A change of name or head office location, or discontinuation of the business, must be reported at least seven days beforehand.

The registration requirements, however, were set differently. The regulatory impact analysis explains that the requirements were set at the minimum needed for the purpose of the legislation, leaving out the capital requirements and other conditions required for foreign exchange business registration. The draft amendment to the Decree assigned inspections to the FSS, and the notification of data to relevant agencies and sanctioning powers to the FSC. Under Article 27-2 of the Act, conducting this business without registration is subject to imprisonment of up to three years or a fine of up to KRW 300 million. If three times the value of the subject matter of the violation exceeds KRW 300 million, the upper limit of the fine is that threefold amount.

Stablecoins, mentioned outside the provisions

The word "stablecoin" does not appear in the provisions of the amended Act or of the draft amendment to the Decree. Among the materials for this amendment, the regulatory impact analysis is the only one that mentions stablecoins separately. In its background section, the analysis stated that "virtual assets (including stablecoins)" are increasingly likely to be used as a means of cross-border payment, while the Foreign Exchange Transactions Act has no framework to govern them.

December and February 2027, the timelines of two regulations

On the anti-money laundering side, the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information (Presidential Decree No. 36592) was amended on August 18, 2026. This decree sets the scope of the information-provision obligation (commonly called the travel rule), under which information is passed along when virtual assets are transferred. For now, before the amended provision takes effect, it applies only when a service provider sends virtual assets worth KRW 1 million or more to another service provider. The amended decree extended this obligation to all transfers between service providers regardless of amount, and this provision takes effect on February 19, 2027.

The same amendment also created measures that a service provider must follow when it carries out transfers with a counterparty that uses "a virtual asset address over which it does not have exclusive management authority." Such transactions must follow standards set out in a notice by the head of KoFIU. For transactions at or above an amount to be set in that notice at KRW 10 million or more, the service provider must have its own suspicious transaction monitoring system (an internal system that picks out transactions suspected of money laundering). This provision also takes effect on February 19, 2027. The wording for addresses used here is not the same as the wording in the draft amendment to the foreign exchange Enforcement Decree.

Four matters to be settled together in the lower-level standards

The provisions go as far as setting who registers and which transfers are to be notified. Four questions remain below that level.

First, the items to be notified, the amount threshold and the deadline. The draft amendment to the Decree states only that the details of the transfer business are to be notified, and the analysis explained that what is to be reported will be set within the data that service providers are able to collect. The question is which items are to be passed on, from transfers of what amount, and by when.

Second, how the two laws describe personal wallets. The foreign exchange side refers to addresses that do not go through a service provider, and the anti-money laundering side to addresses over which the service provider does not have exclusive management authority. Neither the foreign exchange legislative notice materials nor the reasons for amending the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information explain whether the two expressions are to be read as covering the same scope.

Third, the method for classifying counterparty addresses. The second part of the definition turns on whether the counterparty to a transfer is an address that does not go through a service provider. What matters is how that distinction is made, and whether each service provider sets its own method or the industry aligns on a common one.

Fourth, transfers outside the registered entities. If entities that are not VASPs come to make cross-border payments with stablecoins, how those transfers are to be treated within this framework is an issue to be examined separately.

These four questions are points on which industry views need to come together in the process of setting the lower-level standards. Organizations and individuals alike can submit written comments on the draft amendment to the Enforcement Decree by October 26.