Most crypto rules written since 2022 have been about conduct: what an exchange must disclose, how it must segregate customer assets, which transfers it must trace. South Korea already has one of those regimes, the Virtual Asset User Protection Act, live since July 2024. What takes effect on 20 August 2026 is a different kind of rule. It is not about how an exchange behaves. It is about who is allowed to own one, and whether the operator’s balance sheet can carry the business at all.
The instrument is an amendment to the Act on Reporting and Use of Certain Financial Transaction Information, the law most people shorten to the Specified Financial Information Act. Act No. 21358 was promulgated on 19 February 2026 and its registration provisions switch on 20 August. It converts what used to be a light-touch reporting step into a prudential entry gate, the kind of screen a banking regulator runs before it hands out a deposit license.
From a report to a license
Under the old regime, a would-be exchange filed a report with the Korea Financial Intelligence Unit and cleared an anti-money-laundering check. The bar was real but narrow. The new bar reaches the operator’s ownership, its finances, and its record.
The amendment writes a statutory definition of a major shareholder into the law and then screens them. Disqualification checks that previously applied only to executives now extend to those major shareholders, and regulators will weigh financial condition, social credibility, staffing, IT systems, and internal controls. The KoFIU can attach conditions when it accepts a registration rather than simply accepting or rejecting it. The criminal-record review widens from officers to owners and now captures economic-crime statutes such as the Fair Trade Act.
The most consequential piece is how deep the ownership test reaches. It no longer stops at the largest shareholder. When that shareholder is itself a company, the review climbs one level higher, to that company’s own largest shareholder and its de facto controllers. Anyone who installed a majority of a firm’s directors or its chief executive falls inside the perimeter. For a market where the dominant venues sit under sprawling corporate parents, that is the difference between screening a holding company and screening the people who actually run it.
Seoul also closed the timing gap on ownership changes. A provider must now notify the FIU at least 30 days before a share transfer, replacing a system that let firms file 14 days after the fact, and control cannot change hands before the regulator accepts the filing. Ownership of an exchange is now something the state clears in advance, not something it learns about later.
The number that bites: 200%
The provision with the hardest edge is the leverage cap. A new exchange operator must hold a debt-to-equity ratio at or below 200%. It must show no credit-order default in the prior three years and no license cancellation under financial law in the past five. Existing operators get a one-year grace period on the debt-ratio test; new entrants have to clear it at the door.
A 200% debt ratio is not aggressive by the standards of a leveraged company. It is aggressive as a statement about crypto exchanges, because it says the state now treats an exchange operator as an institution whose solvency it cares about, not a software company that happens to match trades. The cap does not touch customer-asset segregation, which the User Protection Act already governs. It touches the operator itself, the corporate entity that would fail if the business failed. That is a prudential instinct borrowed from banking and pointed at a sector that spent a decade insisting it was something else.
The exception written for one deal
The same reform that hardens the gate also cut a door through it. On 11 August 2026 the Cabinet approved a revised enforcement decree that exempts a major shareholder from disqualification when the underlying violation was minor or when the penalty was imposed under joint penal provisions, the clauses that punish a company for an employee’s act.
The timing is not coincidental. Naver is pursuing a merger between its financial arm and Dunamu, the operator of Upbit, Korea’s largest exchange. Naver carried a Fair Trade Act fine of 200 million won, about 141,000 dollars, from September 2025. Under the new owner-screening rules that penalty could have contaminated the major-shareholder review of the combined entity. The exception clause makes it likely the fine will be set aside. Seoul built a stricter gate and, in the same motion, wrote the language that lets its most important domestic deal walk through it.
That is worth stating plainly rather than cynically. A regulator that wants a consolidated, well-capitalized exchange sector has an interest in not letting a small antitrust fine block the pairing of the country’s largest internet platform with its largest exchange. The exception is narrow on paper and precisely shaped in practice. The merger still faces a separate business-combination review at the Korea Fair Trade Commission, so the decree removes one obstacle rather than clearing the field.
What it means before September
Read the entry gate as the first clause of a sentence Seoul is still writing. The Travel Rule expansion and the overseas-transfer restrictions from the same law do not arrive until February 2027, six months after promulgation. A separate stablecoin bill is expected in September. The sequencing tells you the order of operations: decide who is solid enough to hold the license, then decide what they are allowed to move, then decide whether they can issue a won-pegged token.
For operators, the immediate work is capital structure. An exchange that runs hot on debt has until roughly this time next year to fix its balance sheet or lose the ability to register. For the shareholders sitting above them, the reach-through test means the identity and record of the ultimate controller is now a licensing fact, not a private arrangement. For everyone watching from outside Korea, the template is the notable part. This is a G20 economy treating a crypto exchange the way it treats a regulated financial institution: screened at the top, capitalized at the base, and cleared before control changes hands. The conduct rules were the easy part. This is the harder one.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.