South Korea’s Virtual-Asset User Protection Law Takes Effect

South Korea’s Act on the Protection of Virtual Asset Users entered force on July 19, 2024, replacing a largely anti-money-laundering-centered regime with statutory rules for customer assets, market surveillance and enforcement against unfair trading.

The law gave the Financial Services Commission and Financial Supervisory Service direct authority to inspect and sanction virtual-asset service providers. It also made exchanges and other covered providers responsible for separating customer property, maintaining custody controls and monitoring suspicious trading. That combination made the effective date more than a compliance deadline: it marked a shift toward treating crypto venues as market institutions with explicit conduct and safekeeping duties.

The act had been enacted on July 18, 2023, after lawmakers combined key provisions from 19 pending bills. Regulators then spent roughly a year preparing an enforcement decree, supervisory rules and implementation testing. Before July 19, 2024, registered providers were already subject to reporting, travel-rule and other anti-money-laundering controls under South Korea’s specified financial-transactions law. The new framework addressed a different gap: protection of users’ assets and policing of manipulation, misuse of material nonpublic information and fraudulent transactions.

Custody rules moved into statute

Covered providers must keep customers’ cash deposits at banks, separate users’ virtual assets from their own and hold the same types and quantities entrusted by customers. Providers must also insure against hacking and network failures or establish reserves for compensation. Under the supervisory framework prepared for implementation, at least 80% of the economic value of users’ virtual assets had to remain in cold wallets.

The 80% figure referred to the economic value of customer virtual assets, not 80% of customer cash or an exchange’s total balance sheet. The Financial Services Commission said providers were expected to calculate and maintain the cold-wallet ratio using prescribed valuation procedures. The controls therefore imposed an operating constraint on exchanges while leaving a portion of assets available for withdrawals and other online functions.

Banks holding user deposits were required to manage those funds separately, and providers were required to pay customers interest on the deposits. In institutional terms, this placed part of the customer-protection chain with regulated banks instead of leaving all cash custody inside a crypto platform.

Surveillance gained an enforcement path

The act prohibited use of undisclosed material information, price manipulation and fraudulent trading. Virtual-asset service providers had to continuously monitor for abnormal transactions and report suspected misconduct to the Financial Supervisory Service. The statute also empowered authorities to inspect providers, order corrections, suspend business and impose administrative sanctions.

The penalty framework was designed to scale with illicit gains. Contemporaneous Financial Services Commission guidance said criminal punishment could include at least one year of imprisonment or a fine exceeding three times and up to five times unfairly obtained profits; cases involving more than 5 billion won in gains could carry a life sentence. Those were statutory exposure thresholds, not evidence that violations had already been proven under the new law on July 19.

A foundation, not a safety guarantee

The immediate significance was regulatory architecture rather than a measurable token-price reaction. No controlled event window establishes that the law’s commencement caused a particular move in bitcoin, ether or Korean-listed assets, so no market-performance claim is warranted.

The Financial Services Commission itself cautioned that the act did not guarantee the safety of virtual assets. Unregistered services and over-the-counter or peer-to-peer trades could sit outside the protections and surveillance applied to registered providers. Implementation also depended on inspections, reporting quality and future enforcement. What changed on July 19, 2024, was the legal baseline: custody, surveillance and market-abuse rules became enforceable obligations rather than gaps left mainly to anti-money-laundering law and industry practice.