A virtual asset service provider preparing to accept Korean Won deposits – or to settle client withdrawals through a fiat rail – faces a question that stops many builds before they start: which banking or payment account can legally hold those funds, and under what regime is that account provider supervised? South Korea's answer is specific, and the consequences of getting it wrong extend well beyond a single frozen account.
EMI onboarding for VASPs in South Korea sits at the intersection of the country's Special Act on Reporting and Using Specified Financial Transaction Information (commonly called the SFIA – the framework governing virtual asset service providers, or VASPs, and their mandatory banking relationships) and the broader Payment Services regime. Under the SFIA, a registered VASP must hold a real-name verified account (RNVA) at a single licensed Korean bank. An electronic money institution (EMI), meaning a regulated non-bank payment provider licensed under Korea's Electronic Financial Transactions Act (EFTA), occupies an adjacent but distinct role: it can hold fiat on behalf of a VASP for settlement purposes, but it does not substitute for the RNVA requirement. Understanding that distinction is the first structural decision a VASP must make.
This page maps the regulatory basis for both relationships, the practical onboarding process, the cross-border considerations that apply to foreign-operated VASPs seeking Korean fiat rails, and the decision point between a Korean banking structure and an EMI-led settlement model.
What Is the Legal Basis for VASP Banking in South Korea?
The Special Act on Reporting and Using Specified Financial Transaction Information (SFIA) is the primary instrument governing VASPs in South Korea. Under the SFIA, any entity conducting exchange, transfer, custody, issuance or brokerage of virtual assets for Korean users must register as a VASP with the Korea Financial Intelligence Unit (KOFIU). That registration is not optional, and operating without it constitutes a criminal offence under Korean law.
The RNVA condition is the sharpest compliance edge. A registered VASP must maintain its fiat settlement account at a single Korean bank that has completed an independent review of the VASP's AML/CFT controls. The bank issues the RNVA, which links each customer's crypto account to a verified identity. This arrangement means the bank acts as a de facto gatekeeper: if a VASP loses its RNVA provider, its ability to offer KRW deposit and withdrawal services ends immediately.
The Electronic Financial Transactions Act (EFTA) governs electronic payment processors, pre-paid instruments and electronic money holders. A Korean EMI licensed under the EFTA can hold float, process payments and issue stored-value instruments. For a VASP, engaging a Korean EMI is relevant for internal treasury management, cross-border settlement legs and certain B2B payment flows – but the EFTA-licensed EMI does not replace the RNVA requirement. KOFIU has been explicit on this point in its supervisory guidance.
In our cross-border practice, we regularly advise VASPs that approach these two regimes as alternatives. They are not. The RNVA is a condition of VASP registration; the EMI relationship is a payment-layer tool. Both are necessary for a full-stack Korean fiat operation.
CTA #1 — First-time assessment: If you are mapping your South Korea market entry and need to understand the banking and registration conditions before you commit capital, contact OBOLUS at info@oboluslaw.com. The licence, banking and payment stack look different depending on where your entity sits and who your users are.
Who Must Register as a VASP in South Korea?
Any business – domestic or foreign – that provides virtual asset services to users in South Korea must register with KOFIU under the SFIA. The activity triggers, not the domicile of the entity, determine whether registration is required. An exchange operated from Singapore, the BVI or the EU that actively markets to Korean retail users falls within the SFIA's scope.
The four activity categories that trigger registration are: exchange services (spot trading); transfer services (sending and receiving virtual assets); custody and administration; and issuance. A business providing only OTC brokerage or wallet infrastructure may also fall within scope depending on the nature of the service.
Foreign-operated platforms face a compounding difficulty: the RNVA condition requires a relationship with a Korean bank, and Korean banks will, as a matter of practice, require the VASP to have a Korean legal presence – typically a domestically incorporated company or a registered branch. A purely offshore entity cannot, in practice, obtain an RNVA. That structural reality means any serious Korean market entry requires local incorporation before the banking conversation begins.
The SFIA also imposes Information Security Management System (ISMS) certification as a condition of registration for VASPs meeting certain scale thresholds. ISMS certification, issued by the Korea Internet and Security Agency (KISA), takes several months and involves a technical audit. It must be in place before KOFIU will accept a registration filing from platforms above the relevant threshold.
How Does a VASP Obtain a Real-Name Verified Account?
The RNVA onboarding process is bank-led, not regulator-led – a distinction that shapes every practical step. A VASP secures an RNVA by passing the due-diligence review of a Korean bank that has agreed to provide these accounts. The bank sets its own criteria; KOFIU does not prescribe the review methodology beyond baseline AML expectations.
In practice, only a small number of Korea's licensed commercial banks actively provide RNVAs to VASPs. The pool has contracted since the SFIA tightened enforcement. A VASP approaching this process should expect the bank to conduct: a review of the VASP's AML/KYC programme, including its Travel Rule compliance setup; a financial crime risk assessment; a review of the VASP's beneficial ownership structure; and an assessment of the VASP's ISMS certification status.
The bank's review timeline varies. Based on our cross-border practice observations, the process from initial engagement to account opening typically runs over a matter of months rather than weeks – and that timeline assumes a well-prepared applicant. Gaps in AML documentation, opaque ownership structures or an incomplete ISMS filing are the most common causes of delay or refusal.
The Travel Rule – the obligation under FATF Recommendation 15 to pass originator and beneficiary information with each virtual asset transfer – is a material factor in bank review. Korean VASPs must comply with the Travel Rule as implemented under the SFIA. Banks assess whether the VASP has a technically compliant Travel Rule solution in place. VASPs using an internationally recognised Travel Rule protocol are better positioned in this review.
What Role Does an EMI Play in a Korean VASP's Payment Stack?
An EMI licensed under the EFTA functions as a regulated payment layer, distinct from the RNVA relationship. For a VASP with an existing RNVA at a Korean bank, an EMI can provide complementary services: faster internal settlement between trading and custody ledgers, cross-border payment processing for institutional clients and, in some structures, pre-paid instruments for loyalty or reward mechanics.
For a VASP operating internationally – for example, a platform licensed under MiCA in the EU or under the Payment Services Act in Singapore that also serves Korean users – the EMI relationship is the mechanism by which fiat flows are managed across the border. The Korean leg of the settlement is handled through the RNVA; the cross-border leg, including conversion between KRW and other currencies, may be structured through an EMI operating under a separate licensing regime in a third jurisdiction.
We have seen operators attempt to shortcut the RNVA requirement by routing all Korean fiat through a foreign EMI. This does not work. Korean banks will not accept settlement instructions from an unlicensed or foreign-only payment provider for purposes of RNVA compliance. The SFIA is explicit that the RNVA must be at a Korean licensed bank, and KOFIU's position is that the EMI layer is supplementary, not substitutive.
A micro-matter from our recent practice illustrates the risk. In a recent cross-border matter, a European VASP operating under a MiCA-transitional authorisation sought to enter the Korean market using only its EU EMI partner for KRW settlement. The structure worked for the first several months of low-volume operation. When transaction volumes crossed the reporting threshold, KOFIU's supervisory function flagged the absence of an RNVA. The VASP faced a forced suspension of Korean fiat services while it undertook local incorporation, bank review and ISMS preparation. The recovery took the better part of a year. Earlier structural advice would have identified the gap before market entry.
How Does AML and the Travel Rule Apply to Korean VASPs?
KOFIU supervises AML/CFT compliance for registered VASPs as part of its mandate under the SFIA. The obligations align closely with FATF Recommendation 15 and include customer due diligence, transaction monitoring, suspicious transaction reporting and the Travel Rule.
South Korea implemented a domestic Travel Rule framework through the SFIA and associated guidance. Under this framework, VASPs must transmit originator and beneficiary data when transferring virtual assets above a prescribed threshold. The precise data-field requirements and the threshold are set by KOFIU guidance; operators should consult current KOFIU publications rather than relying on any fixed figure.
The cross-border dimension of Travel Rule compliance is significant. When a Korean VASP transfers assets to or from a foreign VASP, it must confirm that the counterpart VASP is registered or licensed in its home jurisdiction and capable of receiving and processing the Travel Rule data package. Korean banks conducting their RNVA review will expect a VASP to demonstrate that its Travel Rule solution covers not just domestic transfers but also outbound flows to the major international hubs.
For a VASP with users in multiple jurisdictions – common among the operators we advise – aligning Travel Rule compliance across the Korean regime, MiCA requirements in the EU and the Payment Services Act framework in Singapore requires a technical and legal architecture that addresses each jurisdiction's data format and threshold rules. A single-solution approach is rarely sufficient at scale.
What Cross-Border Considerations Apply to the Korean Fiat Stack?
A foreign VASP entering South Korea confronts layered structural decisions. The first is entity form: Korean banking relationships and KOFIU registration require a domestic legal presence, so the question is whether to incorporate a subsidiary, register a branch or establish a joint-venture structure with a Korean partner. Each form carries different tax treatment under Korea's corporate income tax regime and different liability exposure.
The second is the interaction between the RNVA bank and the VASP's existing banking in other jurisdictions. Korean banks conducting RNVA due diligence will review the VASP's global banking relationships. A VASP that holds accounts in higher-risk jurisdictions or that relies solely on EMI-type accounts in the EU without a licensed bank relationship may face more intensive scrutiny. Demonstrating a well-structured global banking stack – with at least one relationship at a regulated bank in a FATF-compliant jurisdiction – strengthens the Korean bank review.
The third is tax. Korea imposes withholding tax on certain cross-border payments. Whether a Korean subsidiary's fiat flows to a foreign parent or to an EU EMI trigger withholding depends on the nature of the payment, the treaty position between South Korea and the counterpart jurisdiction, and the contractual characterisation of the service. We map this interaction as part of the pre-entry structuring work we carry out for operators considering the Korean market.
The fourth is the interaction with the MiCA regime. An EU-authorised CASP (crypto-asset service provider) passporting across the EU/EEA cannot rely on that passporting to operate in South Korea. The SFIA is a standalone Korean regime. EU authorisation assists in demonstrating regulatory credibility to a Korean bank during the RNVA review, but it does not replace KOFIU registration. Operators building a multi-hub structure across the EU and East Asia must maintain parallel compliance programmes.
CTA #2 — Structural review: If your Korean market entry has stalled – whether at the RNVA stage, the ISMS certification process or the bank's AML review – a second read of the structure often surfaces the specific gap. Write to OBOLUS at info@oboluslaw.com to request a scoped structural review.
Which Operator Profile Fits Which Korean Entry Structure?
The right Korean entry structure depends on the operator's profile, not a universal template. The following outlines the three main patterns we see in practice.
Profile A – Established international exchange entering Korea for retail trading: This operator needs full KOFIU registration, domestic incorporation, ISMS certification and an RNVA at a Korean commercial bank. The process is sequential and timeline-intensive. A realistic build-out from first legal instruction to live KRW deposits runs to a year or more, depending on ISMS audit completion and bank review. The key risk is underestimating the bank's AML threshold; operators in this profile should enter the banking conversation with a fully documented AML programme and an operational Travel Rule solution already in place.
Profile B – Institutional B2B operator providing OTC or custody services to Korean financial institutions: Registration requirements depend on whether the activity falls within the SFIA's defined categories. An OTC desk serving only Korean institutional counterparties under a principal-to-principal model may structure around the retail RNVA requirement, but must still assess whether KOFIU registration applies. An EMI relationship – whether Korean or cross-border – handles the settlement layer. The key risk is misclassifying the activity as outside the SFIA's scope.
Profile C – Foreign VASP serving Korean users through an offshore entity: This is the highest-risk profile. The SFIA's activity trigger applies regardless of entity domicile. An offshore operator without Korean registration faces enforcement action, potential criminal liability for key individuals and the loss of any payment processor willing to handle Korean fiat flows. The path to compliance requires local incorporation and full KOFIU registration. Operators in this profile should engage counsel before any further Korean user acquisition.
What Are the Most Common Mistakes in Korean VASP Banking Onboarding?
The mistakes we see most frequently in Korean VASP onboarding are structural, not procedural. They arise from assumptions formed in other jurisdictions that do not translate to the Korean regime.
The first is conflating EMI access with RNVA compliance. As discussed, an EMI licensed under the EFTA is a useful payment tool but does not satisfy the SFIA's requirement for a real-name verified bank account. Operators that build their Korean payment stack around an EMI without securing an RNVA will find their KRW operations unsupported the moment KOFIU scrutiny begins.
The second is delaying ISMS certification. The ISMS audit is a pre-condition for KOFIU registration at scale, not a post-registration formality. Operators that begin bank conversations before ISMS certification is in progress will find that the bank either declines to proceed or conditions its RNVA offer on ISMS completion. Sequencing matters: ISMS preparation, local incorporation and bank pre-engagement should run in parallel, not in series.
The third is a common assumption we encounter in practice – the belief that a strong international compliance programme transfers automatically to Korean requirements. Korean banks and KOFIU have specific documentation expectations. An AML policy written for EU or Singapore purposes may not address the Korean regime's reporting structure, domestic transaction monitoring thresholds or Korean-language submission requirements. Localisation of compliance documentation is a practical necessity, not a regulatory nicety.
Related at OBOLUS
- Banking, Payments and EMI Onboarding for Digital-Asset Businesses – the full practice overview covering EMI access and fiat-rail strategy across jurisdictions.
- EMI Onboarding for VASPs from a Cross-Border Perspective – how multi-hub VASPs structure payment access across conflicting regulatory regimes.
- Smart Contract Legal Status: A Legal Guide for Digital-Asset Businesses – the enforceability of on-chain obligations and what that means for settlement architecture.
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily because the AML/CFT risk profile of the VASP does not meet the bank's internal threshold, or because the VASP cannot demonstrate a compliant Travel Rule solution. In South Korea, the RNVA arrangement places an additional condition on the bank: it is responsible to KOFIU for the adequacy of the AML review it conducted before opening the account. Banks that lose confidence in a VASP's ongoing compliance posture will close the RNVA to manage their own regulatory exposure.
How can a VASP onboard with an EMI?
A VASP onboards with an EMI by demonstrating that it is a registered or licensed entity in at least one supervised jurisdiction, that its AML/KYC controls meet the EMI's risk appetite, and that its transaction volumes and fiat-flow patterns are consistent with the EMI's licence scope. In South Korea specifically, a Korean-licensed EMI will expect to see KOFIU registration or evidence of a registration application in progress. For cross-border settlement structures, allied counsel in the relevant jurisdiction can assist with local documentation requirements.
What does client-money safeguarding require?
Client-money safeguarding requires a VASP or EMI to hold customer fiat funds in a segregated account at a licensed credit institution, separate from the firm's own operating funds. In South Korea, the SFIA and the EFTA each carry safeguarding expectations for the entities they regulate. The precise mechanics – including the form of segregation, the eligible account types and the insolvency treatment – differ between the RNVA structure for VASPs and the float-holding rules for EMIs. Operators should document the safeguarding basis clearly in their client agreements and AML programme.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions – including South Korea, the EU, Singapore and the UAE – on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Victor Olsen, Regulatory and Compliance Analyst – specialising in VASP registration, AML compliance architecture and cross-border banking access for digital-asset businesses entering regulated markets in Asia and Europe.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.