South Korea Crypto Travel Rule Expansion: The 2027 Start

Video transcript

From February 19, 2027, South Korea's travel rule covers crypto transfers of any amount between registered VASPs.

The amended decree was promulgated on August 18, 2026. Registration rules started August 20, and the travel rule changes follow six months later.

Today the rule starts at one million won. Once that line goes, split transfers and even small test sends need a travel rule message.

Receiving VASPs will have to secure sender data. Hold each inbound deposit, match the recipient name, request anything missing, then refuse or return on a timer.

Transfers abroad carry conditions. In Hwawoo's summary, low-risk overseas VASPs are allowed, others and personal wallets only for same-person transfers, and high-risk counterparties never.

Transfers of ten million won or more to overseas VASPs or wallet providers must be reported to the Korea Financial Intelligence Unit. The start date is not yet confirmed.

Registration rules already apply, with a technical condition. VASPs need computing systems and security facilities, backup that keeps running through a power cut or fire, and ISMS certification documents.

Before February, remove the threshold trigger, classify counterparties by risk, prove the customer owns the destination, block high-risk counterparties at the withdrawal API, and pentest the endpoints.

Guardian pentests the APIs these rules lean on and maps each provision to controls and evidence. Read the full article, or talk to Guardian before 2027.

On August 11, 2026, Korea’s cabinet approved amendments to the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information.

That decree carries Korea’s anti-money laundering rules for virtual asset service providers (VASPs). It was promulgated on August 18, and its new registration rules took effect on August 20, 2026.

The decree’s addendum starts the travel rule and cross-border changes six months after promulgation. Korea’s National Law Information Center dates them February 19, 2027.

This article explains the technical and security side of the amended Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information. It is not legal advice; confirm how it applies to you with counsel.

What the Decree Changes

The Financial Services Commission (FSC) set out the package on August 11. Here is each change and its start date.

A Travel Rule for Every Transfer

Today, Article 10-10 of the decree applies the travel rule when a VASP sends virtual assets worth KRW 1 million or more to another VASP.

The sending VASP must pass on:

• the names of the sending and receiving customers;
• both customers’ virtual asset addresses; and
• on request, the sender’s registration or passport number, within three business days.

Names and addresses travel with the transfer. Requests can come from the Korea Financial Intelligence Unit (KoFIU) or the receiving VASP.

The amendment removes the KRW 1 million line. The FSC says the rule will apply to transfers of any amount between registered VASPs.

Two things follow:

• Splitting a transfer below KRW 1 million no longer takes it outside the rule.
• Every VASP-to-VASP withdrawal needs a travel rule message, including small test sends.

New Duties for Receiving VASPs

Until now the duty sat mainly with the sender. The FSC says beneficiaries will newly be required to secure the information the originator provides.

Law firm summaries fill in the mechanics. Hwawoo says the approved decree makes a receiving VASP request missing data and refuse the transaction.

BKL’s reading of the March draft set the order: request first, then reject if the data still does not arrive. Confirm the final wording with counsel.

For engineers, an inbound transfer from another VASP now needs a hold state between arrival and credit.

• Hold the deposit until sender data arrives.
• Match the recipient name to the account holder.
• Send a data request automatically when it is missing.
• Refuse or return on a timer, and log each step.

Transfers Abroad and the KRW 10 Million Report

The decree also governs transfers between a Korean VASP and an overseas VASP or digital wallet service provider. The FSC lists three conditions.

• Transfers only to low-risk overseas VASPs.
• Transfers where the sender and recipient are the same entity.
• No high-risk transactions.

Hwawoo’s summary of the approved text sorts counterparties this way.

In BKL’s reading of the draft, low risk meant a licensed VASP in a jurisdiction that follows FATF standards. It must also apply checks, reporting and travel rule controls similar to Korea’s.

Then the report. Transfers of KRW 10 million or more to an overseas VASP or digital wallet provider must be reported to KoFIU “regardless of the level of risk involved,” the FSC says.

The release gives no separate date for this report. BKL’s reading of the March draft put the threshold in KoFIU’s supervisory regulation, from August 20, 2027.

That date comes from a draft. We found no final supervisory regulation text, so treat it as pending and confirm it before you schedule the build.

Registration Rules From August 20

The registration changes are already in force. KoFIU can now refuse a VASP’s registration on grounds including:

• Financial soundness: a debt ratio above 200%, a default in three years, or a revoked license.
• Executives: not qualified under the Act on Corporate Governance of Financial Companies.
• Largest shareholders: failing similar soundness and qualification tests.
• Operations: inadequate expertise, or weak internal controls for AML and user protection.
• Criminal record: a fine or heavier penalty for AML or financial law violations.

One condition is technical. A VASP needs “the computing system and the physical infrastructure needed to ensure the maintenance of cybersecurity,” and must handle security breaches properly.

Article 10-12(7) of the decree lists the facilities a VASP must have:

• computing equipment and communications for the business;
• security facilities that protect that equipment; and
• backup facilities that keep it running through a power cut or fire.

KoFIU sets the detailed criteria by notice.

The filing list (Article 10-11) asks for information security management system (ISMS) certification documents, plus records of staff, computing equipment and internal controls.

Hwawoo expects KoFIU’s supervisory regulation to give existing VASPs one year on the debt ratio, staffing, computing equipment and internal control requirements.

Engineering Checklist

Before February 19, 2027:

1. Remove the KRW 1 million trigger. Send travel rule data on every VASP transfer.
2. Add a hold state for inbound VASP transfers until sender data arrives.
3. Request missing data automatically, with a timer that ends in refusal.
4. Classify every counterparty VASP by risk, and keep the evidence.
5. Prove the customer owns the destination before any same-person transfer.
6. Block high-risk counterparties at the withdrawal API, not only in the app.
7. Value each cross-border transfer in KRW and flag KRW 10 million or more.
8. Encrypt travel rule data, limit who can read it, and log every read.
9. Pentest the messaging endpoints and the withdrawal API.

The FSC also said in April that exchanges will be required to reconcile ledger to wallet every five minutes. See our post on Korea’s real-time reconciliation rule.

For the international view of transfers that leave the travel rule’s reach, see our summary of the FATF report on stablecoins and unhosted wallets.

How Guardian Helps

Guardian’s regulatory and compliance assessments list each provision with the control that meets it, the evidence that proves it and any gap.

Guardian’s API pentests test key scoping, per-object authorization and replay protection. Travel rule endpoints carry names and ID numbers, so those controls carry real weight.

For another market’s approach, see our guide to the UAE travel rule for crypto.

Frequently Asked Questions

When does Korea's travel rule apply to transfers of any amount?

From February 19, 2027. The FSC said the change takes effect six months after promulgation, and the amended decree was promulgated on August 18, 2026. Until then, the KRW 1 million threshold applies.

Can Korean VASPs send crypto to personal wallets?

Under conditions. Hwawoo’s summary of the approved decree says transfers to personal wallets are allowed only when the sender and recipient are the same person, and high-risk counterparties are prohibited.

What must Korean VASPs report to KoFIU?

Transfers of KRW 10 million or more to an overseas VASP or digital wallet provider, regardless of risk level, the FSC says. A law firm reading of the draft gives August 20, 2027; that date is not yet confirmed.

Which changes are already in force?

The registration rules and sanction notices for retired staff, from August 20, 2026. Registration now weighs financial soundness, executives, largest shareholders, criminal records and the computing systems needed to maintain cybersecurity.

Sources

• FSC: Rules Change Approved to Strengthen Registration and Anti-Money Laundering Requirements of VASPs (August 11, 2026)
• National Law Information Center: Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information, in Korean (accessed November 6, 2026)
• Hwawoo via Law Times: Cabinet approves amended Enforcement Decree of the Specified Financial Transaction Information Act, in Korean (August 13, 2026)
• BKL: Key points of the draft Enforcement Decree and Supervisory Regulation amendments, in Korean (April 2, 2026)
• Guardian: Korea’s Real-Time Reconciliation Rule for Crypto Exchanges
• Guardian: FATF Stablecoins and Unhosted Wallets: Freeze and Screening