South Korea new rule: virtual asset service providers must i
On November 5, the South Korean Financial Services Commission announced that it will formulate new guidelines requiring virtual asset service providers to immediately notify the Financial Supervisory Service and the Financial Security Institute upon discovering a security incident, changing the current situation in which they only report to the Korea Internet & Security Agency. The authorities also plan to enact the Digital Financial Security Act, with legislation intended to be completed and a bill submitted in the first quarter of 2027.
Event Timeline
- [11-05 00:53] South Korea requires virtual asset service providers to immediately report security incidents to financial regulators (PANews)
- [11-05 00:53] South Korea plans to require virtual asset service providers to immediately report security incidents to financial regulators (Odaily Planet Daily)
Background and Impact
On November 5, 2026, the South Korean Financial Services Commission announced that it will formulate new guidelines requiring virtual asset service providers to immediately notify the Financial Supervisory Service and the Financial Security Institute upon discovering a security incident. According to reports from PANews and Odaily Planet Daily citing Digital Asset, such companies currently only need to report to the Korea Internet & Security Agency. The reason given by the financial authorities is that, as the connection between virtual assets and the financial industry becomes increasingly close, accident information needs to be quickly communicated to financial regulators so that investigations can be carried out, information shared, and consumers protected.
This new guideline is the first step in a broader regulatory framework. The financial authorities also plan to enact the Digital Financial Security Act, applying security regulations comparable to those in the current Electronic Financial Transactions Act to industries such as virtual asset service providers, insurance agencies, and the lending business that hold large amounts of customer information or may cause significant asset losses, and plan to complete legislation and submit a bill in the first quarter of 2027. The law's scope is not limited to the virtual asset industry but also covers traditional financial and quasi-financial businesses that likewise hold large amounts of customer information. The regulatory approach is to bring virtual asset service providers into the same system of security obligations as traditional electronic financial businesses. In addition to the legislative arrangements, South Korea will also conduct comprehensive security inspections of about 580 financial companies, including virtual asset service providers; this point is mentioned by Source 1, while the report from Source 2 does not include this figure.
From the timeline, the new guidelines will be implemented first, legislation will follow, and security inspections will proceed in parallel. For virtual asset service providers, the most direct change is that the recipients of incident reports will expand from a single technical security agency to financial regulators, and the pace of accident information disclosure and reporting channels will accordingly adjust. For users, whether incident information can enter the financial regulatory view more quickly affects the efficiency of subsequent investigations and consumer protection. For users who enter the market through channels such as Huobi HTX registration and APP download, Zhima Gate.io registration and APP download, Bitget registration and APP download, Binance registration and APP download, and OKX registration and APP download, and who follow compliance disclosures of overseas platforms, the scope of application and implementation details of such reporting obligations deserve continued attention. It should be noted that the two sources are consistent in their statements on the guidelines, the legislative plan, and the legislative timetable for the first quarter of 2027. The only difference is that Source 1 adds information about security inspections of about 580 financial companies. The available materials do not disclose the specific effective date of the new guidelines or details of the reporting deadlines.
Frequently Asked Questions
### How long does the new guideline require exchanges to report?
The available materials only mention "immediately notify upon discovering a security incident" and do not disclose specific time limits, reporting templates, or penalties. These details must wait for the South Korean Financial Services Commission to publish the guideline text later.
### When will the Digital Financial Security Act take effect?
The South Korean financial authorities plan to complete legislation and submit a bill in the first quarter of 2027. After submission, it will still need to go through the legislative process. The materials do not provide a final effective date.
### Which institutions will be affected?
According to the materials, the new guidelines target virtual asset service providers; the proposed legislation covers industries such as virtual asset service providers, insurance agencies, and the lending business that hold large amounts of customer information or may cause significant asset losses, and the security inspections involve about 580 financial companies.