Address
5F, 526 Nonhyeon-ro,
Gangnam-gu, Seoul, Korea
When the Korean Financial Intelligence Unit (FIU) first completed its initial round of Virtual Asset Service Provider (VASP) screening in December 2021, 29 companies passed. Four years later, as of January 8, 2026, the number of active registered VASPs sits at 27. The market has not grown — it has contracted. For foreign crypto businesses considering Korea, this number tells a clear story: direct VASP registration is no longer a realistic path for most new entrants. A different model is emerging instead, and it is one that more foreign operators are quietly adopting.
This post looks at the current state of VASP Korea registration, why the numbers have moved in this direction, and how a partnership-based structure with a domestic VASP can give foreign businesses lawful access to the Korean market without going through the registration process directly.
The Numbers: From 29 to 27, Not Up
The trajectory of VASP registrations in Korea is striking when laid out by year. In December 2021, after the first FIU review of 42 applications, 29 providers were approved (24 trading businesses and 5 custody operators). By January 2024, the registered count remained roughly in that range. As of March 2025, it had narrowed to 28. By August 2025, the FIU confirmed 27 registered providers. The figure published on January 8, 2026 shows the same count — 27.
This stagnation is not a sign of stability. In 2024, only four new VASPs cleared the FIU review (DSRV, INEX, BDACS, and Dolphin). In 2025, only two were approved — Happy Block and BloSafe. Average review time also lengthened: from about 11 months in 2024 to roughly 16 months in 2025, with one applicant waiting more than 600 days for a decision. Several companies that submitted ISMS pre-certification, an essential prerequisite, have not converted that into a final VASP registration. Of 21 ISMS pre-certifications issued between 2023 and 2024, only 9 led to completed VASP registrations. The remaining 12 either let their certification expire or withdrew from the market.
So while the headline number — 27 — looks stable, what it actually reflects is a closed door. New entrants are not arriving fast enough to replace withdrawals, and existing license holders face increasing pressure during renewal review.
Why Direct Entry Has Become So Difficult
The Virtual Asset User Protection Act (가상자산이용자보호법, “VAUPA”), which took effect on July 19, 2024, has reshaped what VASP registration actually means. Under the previous Specified Financial Information Act (특정금융정보법, “SFIA”) framework, registration was primarily an anti-money laundering gatekeeping mechanism. Under VAUPA, registration has become an ongoing supervisory relationship more comparable to that imposed on traditional financial institutions.
Several practical barriers stack up for any new applicant:
First, the substantive requirements have multiplied. A VASP applicant must obtain ISMS certification, secure real-name banking accounts with a Korean bank, build out a fully operational AML compliance system, and pass fitness and propriety review of executives and major shareholders. The FIU manual revised in 2024 added new categories of required disclosure, including detailed business plans, criminal record certificates from the home jurisdiction of foreign executives, and shareholding structure documentation.
Second, real-name banking accounts remain the hardest gate. Korean banks have been highly selective about issuing real-name accounts to crypto exchanges. Without one, a trading business cannot operate KRW markets at all, which strips most foreign exchange operators of their core value proposition.
Third, regulatory tone has shifted from the FIU to the Financial Supervisory Service (FSS), which now leads day-to-day supervision under VAUPA. The FSS approaches VASPs with a financial-institution mindset, focusing on internal controls, conflict of interest management, and customer asset segregation. For a foreign business that is used to lighter-touch regulators, the volume of documentation and the ongoing examination cycle can be difficult to justify against expected Korean revenue.
The result is a market in which foreign crypto businesses have largely stopped trying to register directly. Some have exited Korea entirely. Others have found a different way in.
The Partnership Model: How It Actually Works
The pragmatic alternative is to partner with an existing Korean VASP rather than become one. This is not a workaround or a regulatory loophole — it is a recognized commercial structure, and it has become noticeably more common as direct entry has narrowed.
The basic logic is straightforward. A registered Korean VASP holds the regulatory license, the real-name banking relationship, the AML infrastructure, and the customer-facing trading or custody operation. The foreign business contributes what the Korean partner typically lacks: liquidity, technology, token listings, market-making capacity, custody technology, or institutional relationships. The two parties allocate revenue and responsibilities through a commercial agreement, while the regulated activity stays on the Korean partner’s books.
Several configurations are common in practice. A foreign exchange may provide liquidity and order book depth to a Korean trading platform, with the Korean platform handling all customer onboarding, KYC, and KRW settlement. A foreign custody provider may license its technology to a Korean custodian, who runs the regulated custody service for Korean clients. A foreign issuer or market maker may engage a Korean VASP for market-making services rather than registering its own trading entity. A foreign over-the-counter desk may route Korean-side execution through a partner with the relevant license.
Done correctly, the structure lets the foreign business reach Korean users without taking on the regulatory burden of a Korean VASP registration. Done carelessly, it can collapse into one of two failure modes: either the foreign business is found to be conducting regulated activity in Korea without registration (which carries criminal liability — up to five years’ imprisonment or KRW 50 million in fines under SFIA Article 17(1)), or the Korean partner is found to be a mere conduit, which can put the partner’s own license at risk.
Where the Legal Lines Sit
The key analytical question is whether the foreign business is “engaged in virtual asset business activities” within Korea. SFIA defines VASP activity broadly — sale, purchase, exchange, transfer, custody, and brokerage of virtual assets carried out as a business. If the foreign business directly contracts with Korean users, takes custody of their assets, or provides them with a trading interface, registration is likely required regardless of where the foreign business is incorporated. The FIU has been clear that targeting Korean residents from offshore is itself a triggering activity.
Under a properly structured partnership, however, the foreign business contracts with the Korean VASP — not with Korean end users. The Korean VASP is the counterparty to Korean retail and institutional clients. The foreign business provides services or products to the VASP, much as a foreign technology vendor or liquidity provider would. In this configuration, the foreign business is generally not engaged in Korean VASP activity.
That said, the line is not always clean. Marketing activity that targets Korean users, white-label arrangements that disguise the true operator, and revenue-sharing structures that look like joint operation rather than vendor services have all attracted regulatory scrutiny. The substance of the relationship matters more than its label, and the FSC has not been shy about looking through arrangements it considers structured to evade registration.
What Foreign Operators Should Consider Before Choosing the Partnership Route
For foreign businesses evaluating this approach, the practical due diligence checklist runs through a few core questions. Which licensed activities does the partner actually perform — trading, custody, transfer, or some combination? Is the partner’s VASP registration current, and how close is the next renewal cycle? What is the partner’s track record on FIU and FSS examinations? How is the commercial allocation structured, and does it withstand a substance-over-form challenge? Who controls user-facing communications, branding, and product decisions? What contractual protections exist if the partner’s license is suspended or revoked?
The answers shape both whether the partnership is legally defensible and whether it is commercially viable. A partner with a fragile license is not a partner at all.
At Cha & Kwon Law Offices, we advise foreign virtual asset businesses on Korean market entry decisions, structure partnerships with domestic VASPs, and conduct regulatory due diligence on potential Korean counterparties. We also work with Korean VASPs on the foreign-counterparty side — drafting service agreements, allocating regulatory responsibility, and designing structures that hold up to FSS scrutiny.
Related reading: Korea Crypto Law: Comprehensive Guide — our overview of Korea’s crypto regulatory framework and how the major statutes fit together.
Related reading: Korea’s Crypto Referral Programs and the VASP Line — when partnership structures cross into unregistered VASP activity, and how Korean enforcement views referral arrangements.
Related reading: Opening a Corporate Account at a Korean Crypto Exchange — practical guide for foreign companies on POA, KYC, apostille, and UBO requirements when accessing Korean exchanges directly.
Related guide for foreign operators: Foreign Companies Entering Korea’s Crypto Market — Practical Legal Guide
Cha & Kwon Law Offices advises virtual asset businesses, fintech companies, and foreign investors on Korean regulatory compliance. For consultation, contact us at contact@chakwon.com or visit chakwon.com.
This article provides general legal information and does not constitute legal advice for your specific situation. Please consult qualified Korean legal counsel regarding your particular circumstances.
