CONTENTS
- 1. Virtual Assets | Changes in the Legal Environment
- - Key Terms in the Virtual Asset Field
- 2. Virtual Assets | Key Provisions of the Act on the Protection of Virtual Asset Users
- - Asset Protection Obligations of Virtual Asset Service Providers
- - Regulation of Market Manipulation and Unfair Trading
- - Supervisory Authority and Regulation of Virtual Asset Exchanges
- 3. Virtual Assets | Virtual Asset Risk Review Manual
- - Review of Compliance Risks Related to Virtual Asset Laws and Regulations
- - Risk of Protecting User (Customer) Assets
- - Risk of Unfair Trading and Market Surveillance
- - Anti-Money Laundering (AML) and Know Your Customer (KYC) Risk
- - Cybersecurity and Personal Information Protection Risk
- - Contract and Dispute Risk
- - Internal Control and Compliance Risk
- 4. Virtual Assets | Points for Companies to Note
1. Virtual Assets | Changes in the Legal Environment
Virtual assets are a representative product of the era of the Fourth Industrial Revolution, and they have developed and spread within a short period as they rapidly became digitalized.
They have now established themselves as one form of corporate asset, and transactions are being conducted actively not only between individuals but also between companies.
As the Act on the Protection of Virtual Asset Users, enacted in 2023, came into full effect on July 19, 2024, the protection of users' assets, the regulation of unfair trading, and the supervisory authority of financial regulators over virtual asset service providers (VASPs) were significantly strengthened.
Accordingly, corporate clients must also understand and comply with this legal framework when pursuing transactions, payment settlement, NFTs, or digital asset platform businesses that use virtual assets.
Key Terms in the Virtual Asset Field
1. Virtual Asset
However, the following are excluded from virtual assets.
Electronic tokens that cannot be exchanged for currency, goods, or services and whose place and purpose of use are restricted by the issuer
Tangible or intangible results obtained through the use of game products under the Game Industry Promotion Act
Prepaid electronic payment instruments and electronic currency under the Electronic Financial Transactions Act
Statutory electronic securities such as electronically registered shares, electronic bills, and electronic bills of lading
Electronic currency issued by the Bank of Korea and related services
Other cases based on transaction forms and characteristics prescribed by Presidential Decree
2. Virtual Asset Service Provider (VASP)
Sale and purchase of virtual assets (trading)
Exchange between virtual assets
Acts of transferring virtual assets as prescribed by Presidential Decree
Custody and management of virtual assets
Brokerage, arrangement, or agency of the above acts
3. User
In other words, this includes both exchange customers and virtual asset wallet users.
4. Virtual Asset Market
A representative example falling within this category is a virtual asset exchange.
2. Virtual Assets | Key Provisions of the Act on the Protection of Virtual Asset Users
The key provisions of the Act on the Protection of Virtual Asset Users that companies should note are as follows.
Asset Protection Obligations of Virtual Asset Service Providers
A virtual asset service provider must keep customer deposits and virtual assets strictly separate, must deposit the deposits with a credible management institution such as a bank, and must keep at least 80% of customer virtual assets in a cold wallet (a storage device isolated from the internet).
In addition, an obligation to take out insurance or to set aside reserves in preparation for hacking or computer-system failures has been newly established.
▶Content of the Obligations
Keeping at least 80% of user virtual assets in a cold wallet
Taking out insurance or mutual aid, or setting aside reserves of at least 3 billion won
Keeping a user register at all times, managing deposit and withdrawal records, and monitoring abnormal transactions
Regulation of Market Manipulation and Unfair Trading
Similar to the Financial Investment Services and Capital Markets Act, market manipulation, false representation, insider trading, and fraudulent trading are regulated.
Exchanges have a duty to continuously monitor abnormal transactions and to report signs of unfair trading to the financial authorities, and a violation results in severe criminal punishment and penalty surcharges.
▶Main Penalty Levels
Unjust gains of KRW 500 million to 5 billion: imprisonment of at least three years
Unjust gains exceeding KRW 5 billion: imprisonment of at least five years to life imprisonment
Penalty surcharge: twice the unjust gains (up to KRW 4 billion if calculation is difficult)
Companies operating NFT projects, P2E (Play to Earn), virtual asset investment associations, and the like are subject to the same punishment if they are involved in leaking insider information, participating in market manipulation, or false promotion.
Supervisory Authority and Regulation of Virtual Asset Exchanges
The Financial Supervisory Service directly inspects exchanges for their compliance with user protection duties, insurance enrollment, cold wallet storage ratios, and abnormal transaction monitoring systems, and if violations are found, it may impose business suspension, corrective orders, and penalty surcharges.
▶Concurrent Self-Regulation
3. Virtual Assets | Virtual Asset Risk Review Manual
The following is a virtual asset risk review manual designed to help companies systematically review and manage risks related to virtual assets within their organization.
Review of Compliance Risks Related to Virtual Asset Laws and Regulations
When a company handles or operates virtual assets or engages in a related business, it must review whether it complies with the laws and regulations that apply.
▶Checking applicable laws: becoming familiar with the latest laws and guidelines, such as the Virtual Asset User Protection Act, the Act on Reporting and Use of Specific Financial Transaction Information, anti-money laundering (AML) regulations, and the guidelines of the Financial Services Commission and the Financial Supervisory Service
▶Whether business reporting and registration are completed: reviewing compliance with the virtual asset service provider reporting system and the registration status of providers subject to reporting
▶Establishing internal policies: whether internal guidelines and procedures for virtual asset trading and management have been established
▶Verification of exchanges and partners: reviewing the reporting or licensing status and reliability of virtual asset exchanges and affiliated partners
▶Response measures: conducting regular legal reviews and the latest regulatory training in cooperation with the legal team, and strengthening the compliance monitoring system
Risk of Protecting User (Customer) Assets
This reviews the legal and financial risks that may arise from failing to perform duties related to protecting virtual asset user assets.
▶Whether the duty of separate custody is performed: confirming whether the company's virtual assets and users' virtual assets are kept separately
▶Review of the deposit management system: the safe management of user deposits and the status of entrustment to a trusted management institution (a bank)
▶Insurance enrollment and reserve accumulation: whether insurance has been taken out and sufficient reserves accumulated to prepare for hacking and system failure incidents
▶Protection of user information: whether a user register is prepared and managed and personal information protection regulations are complied with
▶Response measures: strengthening the deposit management and separate custody system, regularly checking the insurance enrollment status, and cooperating with the chief privacy officer (CPO)
Risk of Unfair Trading and Market Surveillance
It is necessary to review the legal liability and reputational risk arising from unfair trading practices that may occur in the virtual asset market, such as market manipulation, insider trading, and fictitious trading.
▶Building a market surveillance system: whether an abnormal transaction monitoring system is operated and whether the financial authorities' guidelines are complied with
▶Procedures for reporting suspected unfair trading: whether an internal reporting system and measures to protect reporters are in place
▶Preserving transaction records and ensuring transparency: whether all transaction records are preserved and can be submitted to the financial authorities when necessary
▶Preparing for investigations by the financial authorities: establishing a system to respond to unfair trading investigations and sanctions
▶Response measures: strengthening internal controls, responding and reporting immediately when an abnormal transaction occurs, and reinforcing employee training
Anti-Money Laundering (AML) and Know Your Customer (KYC) Risk
This reviews the risk of failing to comply with customer due diligence duties for the prevention of money laundering and terrorist financing.
▶Whether KYC procedures are performed: whether a customer identity verification and risk assessment system is operated
▶Suspicious transaction reporting system: reviewing the procedures and system for reporting to the Korea Financial Intelligence Unit (FIU) when a suspicious transaction occurs
▶Employee training and internal controls: whether regular training on anti-money laundering and internal audits are conducted
▶Coordination with cooperating institutions: establishing a cooperation system with the financial authorities and investigative agencies
▶Response measures: designating an AML team or officer, and strengthening the introduction of related systems and training
Cybersecurity and Personal Information Protection Risk
Given the nature of virtual assets, it is necessary to manage the risk of legal and financial losses arising from hacking, cyberattacks, and personal information leaks.
▶Review of the security system status: the cold wallet (offline wallet) storage ratio and whether a security infrastructure is operated to prepare for hacking
▶Internal security policy: whether security controls such as access right management, password policies, and multi-factor authentication are implemented
▶Compliance with the Personal Information Protection Act: reviewing the personal information processing policy, the guarantee of data subjects' rights, and the level of data encryption
▶Preparing an incident response manual: establishing a system of response and reporting procedures when a security incident occurs
▶Response measures: introducing the latest security technology, conducting periodic mock hacking and security audits, and designating a personal information protection officer
Contract and Dispute Risk
This reviews the legal risks arising from the drafting of contracts related to virtual assets and from the occurrence of disputes.
▶Review of terms of service and contracts: ensuring the legal adequacy of contracts and terms related to virtual asset trading and custody
▶Establishing dispute resolution procedures: clarifying the procedures for conciliation, arbitration, and litigation when a dispute occurs
▶Review of provisions related to unfair trading and consumer protection: strengthening user protection and clarifying where responsibility lies
▶System for responding to changes in relevant laws: regularly reviewing contracts and terms following amendments to statutes
▶Response measures: using professional legal advice, adopting standard terms, and conducting dispute prevention training
Internal Control and Compliance Risk
It is also necessary to review the internal control system that manages and supervises whether the company's overall virtual asset operations conform to laws and regulations.
▶Operating a compliance organization: whether a dedicated team is established and its role clarified
▶Regular review and reporting system: whether internal audits, risk assessments, and reporting to management are conducted
▶Reflecting updates to laws and policies: a system for revising and supplementing internal policies in line with the latest regulatory and legal changes
▶Training and raising awareness: regular training for officers and employees and reinforcing risk awareness
▶Response measures: building a systematic internal control system, cooperating with outside experts, and spreading a company-wide risk management culture
4. Virtual Assets | Points for Companies to Note
Companies that promote or invest in virtual assets and related services such as NFTs, P2E, digital asset commerce, and cryptocurrency payment businesses must comprehensively review the Virtual Asset User Protection Act, the Act on Reporting and Use of Specific Financial Transaction Information, the Financial Investment Services and Capital Markets Act, AML regulations, and the Monopoly Regulation and Fair Trade Act, redesign their business structures, and put in place a legal risk management system that minimizes risk factors.
They should also clearly distinguish between ‘areas the law permits and acts it prohibits’ and build a compliance manual in preparation for supervision and inspection by the financial authorities.
Now that the legal risk of virtual assets has risen to the same level as under the Financial Investment Services and Capital Markets Act, a company that takes it lightly is very likely to face large-scale criminal punishment, penalty surcharges, and business suspension.
If necessary, we recommend seeking the assistance of an attorney experienced in corporate matters to obtain legal advice on conducting a virtual asset business.
Related News
