Anti-money Laundering Related to VASP — Major Cases of Illegal and Unfair Acts (September 2022)

The Korean Financial Intelligence Unit (hereinafter “KoFIU”) conducts inspections on whether virtual asset business operators (hereinafter “VASP”), registered pursuant to the Act on Reporting and Using Specified Financial Transaction Information (hereinafter “the Act”), fulfill their anti-money laundering obligations.

As a result of the inspection, some VASPs were deemed insufficient in fulfilling their anti-money laundering obligations, such as the duty to confirm customers and report suspicious transactions. VASPs’ lack of understanding of the Act or the operator’s incomplete anti-money laundering system may be the reason for insufficient fulfillment of their duties.

Major Cases of Illegal and Unfair Act

1. Know Your Customer (KYC)
   
   
   • Inadequate verification of personal customer information
     
     
     1. The VASP shall check whether customer identification information is correctly entered into the system and, if necessary, request for supplementation to the customer.* Simply having a copy of the customer’s real name verification certificate (resident registration card, etc.) does not mean that the verification of customer information has been sufficiently performed.
        
        
     2. For high-risk customers deemed to be highly likely to be involved in money laundering, VASPs shall directly check the customer’s source of funds and the purpose of the transaction as much as possible. The VASPs shall closely monitor the customer’s transaction behavior, and if it is deemed suspicious, they shall report it to the KoFIU immediately.
        
        
   • Inadequate verification of the actual owner of the corporate customer
     
     
     1. VASPs shall comply with the actual owner verification procedure stipulated in the Act. They shall carefully identify the actual owner and check whether the actual owner is a person of interest or not.
        
        
2. Suspicious Transaction Report
   • Insufficient standards for monitoring suspicious transactions
     
     
     1. VASPs shall periodically check whether the suspicious transaction monitoring system is effective and if it does not operate normally, they shall implement effective monitoring by changing the suspicious transaction extraction criteria, etc.
        
        
     2. Since a customer who is reported to the KoFIU for a suspicious transaction is also highly likely to be involved in money laundering, VASPs shall monitor the customer’s transaction behavior more closely. If necessary, they shall request and collect additional evidence for the customer’s source of funds and transaction purpose to verify customer information.
        
        
3. Internal Control System
   
   
   • Non-execution of money laundering risk assessment prior to the listing of a new virtual assets
     
     
     1. VASPs shall conduct a money laundering risk assessment of a new virtual asset before proceeding with transaction support for the virtual asset.
        
        
     2. VASPs are required to document and keep evidence of conducting a money laundering risk assessment, such as evaluation date and method, evaluator, and approver.
        
        
     3. VASPs shall suspend transaction support for virtual assets that are deemed to have a high risk of money laundering.
        
        
   • Insufficient restrictions on handling virtual assets issued by specially related persons
     
     
     1. 1. VASPs shall establish and implement standards to restrict the transaction or brokering, of virtual assets issued by specially related persons pursuant to the Commercial Act.
           
           
        2. VASPs shall check whether the issuing foundation and key executives and employees are related to the virtual asset before supporting its transaction.
           
           
        3. Accordingly, VASPs shall identify in advance who their specially related persons are and who are the key executives and employees of the virtual asset issuance foundation.* In accordance with the Enforcement Decree of the Commercial Act, individuals who exercise de facto influence over a VASP and the specially related persons of those individuals are also classified as specially related persons of the VASP.