South Korea presents a layered legal environment for NFT projects. The country enforces an active Virtual Asset User Protection Act (VAUPA) – the primary statute governing virtual-asset dealings for consumer-facing businesses – and the Financial Services Commission (FSC) has repeatedly signalled that token classification turns on the substance of rights conferred, not a label applied in a whitepaper. Mis-classifying a token in this market can convert a routine product launch into an unregistered securities offering or a regulated payment instrument, triggering enforcement exposure that crosses the Korean border into any jurisdiction where the project markets to users. This guide walks the decision points, the structuring sequence, and the cross-border interaction a project must resolve before going live in – or from – South Korea.
What South Korea actually regulates for NFT projects
South Korea regulates virtual-asset businesses through the VAUPA and through the reporting obligations administered by the Korea Financial Intelligence Unit (KoFIU), the AML supervisor for the sector. The FSC and KoFIU together define a "virtual asset service provider" (VASP) as any entity that, as a business, issues, trades, transfers, stores or manages virtual assets for others. An NFT project that simply mints artwork and sells it peer-to-peer sits at one end of the spectrum. An NFT platform that runs secondary-market trading, custody, or staking rewards sits firmly in VASP territory – and the line between the two is drawn by functional analysis, not by calling the asset a "collectible."
The FSC has published guidance indicating that NFTs with fungibility characteristics, revenue-sharing mechanics, or embedded financial rights may be treated as securities under the Financial Investment Services and Capital Markets Act (FSCMA) – and separately as virtual assets under VAUPA if they also exhibit payment or exchange functions. A project can face both regimes simultaneously. In our cross-border practice, we regularly see founding teams underestimate this dual-layer exposure, particularly when the NFT unlocks DeFi protocol rewards or accumulates yield.
The VAUPA also imposes segregation of user assets, reserve requirements for issuers of certain instruments, and mandatory disclosure obligations. KoFIU registration is a precondition for any entity conducting VASP activities from a Korean establishment or targeting Korean users as a primary market. Failure to register carries criminal exposure for individual founders, not just civil penalties for the entity.
The process above describes the standard regulatory perimeter. Your project's specific mechanics – its minting model, secondary-market rules, wallet architecture, and reward design – change where it lands on the spectrum. For a scoped pre-launch classification assessment, contact OBOLUS at info@oboluslaw.com.
Step 1: Classify the token before you do anything else
Token classification is the gate that determines every downstream decision – entity structure, banking, tax treatment, and disclosure obligations – and it must happen before the smart contract is deployed. The FSC's analytical approach mirrors the substance-over-form principle applied by regulators globally: the legal character of a token is determined by the rights it confers on the holder, not by the marketing description the issuer attaches to it.
The primary axes for Korean classification analysis are: whether the holder has a right to a financial return (interest, yield, profit participation); whether the token is functionally interchangeable with currency or a payment instrument; whether the token carries governance rights that amount to an equity-like stake; and whether secondary-market liquidity is built into the design at launch. An NFT that fails all four tests – a true one-of-one artwork with no yield, no redemption, and no issuer-structured secondary market – sits in the lowest-risk classification bucket. Any positive finding on one or more axes requires legal analysis of the applicable Korean regime and, frequently, parallel analysis of the regime in the founding entity's home jurisdiction.
A common mistake at this step is treating the classification analysis as a one-time exercise. Korean regulators have the authority to reclassify instruments as market conditions and project mechanics evolve. A post-launch staking module or a royalty-pool mechanism can retroactively change the classification of a token that passed its initial analysis. The legal opinion obtained at launch should be reviewed at every material product change.
Step 2: Choose the right entity structure for the project
A Korean entity operating VASP activities must register with KoFIU and meet ISMS (Information Security Management System) certification requirements – a technical and operational standard that takes meaningful time and resource to satisfy. For many inbound NFT projects, establishing a Korean legal entity to conduct regulated activities is not the starting point. The more common architecture involves an offshore holding entity – typically in a common-law jurisdiction with a well-developed digital-asset regulatory environment – that holds the intellectual property, smart contracts, and treasury, while Korean-facing commercial activities are structured to remain below the VASP activity threshold or are conducted through a locally registered subsidiary once the compliance infrastructure is ready.
The offshore entity selection is consequential. Singapore, under the Monetary Authority of Singapore (MAS) and the Payment Services Act, offers a recognizable regulatory wrapper for token issuers with a real nexus to the project. The British Virgin Islands and the Cayman Islands provide lean holding-entity structures that are bank-familiar and well-understood by institutional counterparties. Each jurisdiction introduces its own licensing questions – the point is that the offshore layer must have independent regulatory substance, not just a registered address, if it is to withstand Korean regulatory scrutiny of the overall structure.
For projects with DAO governance elements, a separate analysis applies. A DAO operating without a legal wrapper has no recognized counterparty in Korean commercial law, no ability to open a bank account, sign contracts, or defend itself in enforcement proceedings. We structure DAO-adjacent projects with a companion legal entity – typically a foundation or a limited liability company in a jurisdiction that has provided statutory clarity on DAO structures – that can act as the legal face of the protocol. The governance token, the on-chain voting mechanism, and the commercial entity then need to be aligned so that the legal entity's obligations match the DAO's operational reality.
How does South Korean AML registration affect an NFT platform?
KoFIU registration is the AML gateway for VASP activities in South Korea, and its requirements are among the more demanding in Asia. A VASP must obtain a Real-Name Account service agreement from a Korean banking institution before KoFIU registration can proceed – and Korean banks currently apply heightened scrutiny to virtual-asset businesses, making the banking relationship itself a material constraint on the registration timeline.
The AML obligations that flow from VASP status under the VAUPA and the Act on Reporting and Using Specified Financial Transaction Information (ARUSFTI) include: customer due diligence and enhanced due diligence for higher-risk users; transaction monitoring and suspicious transaction reporting to KoFIU; and, critically, compliance with the Travel Rule (the obligation to pass originator and beneficiary identifying information with virtual-asset transfers above the applicable threshold). South Korea adopted the FATF Travel Rule, and KoFIU has specified the data fields and the technical standards that VASPs must meet for compliance.
For an NFT platform, the practical question is whether the primary market sale, the secondary-market facilitation, or the custody of NFTs in a platform wallet individually trigger Travel Rule data-transmission obligations. The answer depends on whether the transfer constitutes a virtual-asset transfer under the Korean definition – which again turns on the nature of the NFT and the mechanics of the transfer. Projects that attempt to characterize every sale as a peer-to-peer transfer to avoid this obligation face the same substance-over-form analysis applied to token classification.
The cross-border dimension matters here. If the project operates Travel-Rule-compliant infrastructure in Singapore or under MiCA in the EU, that infrastructure may not satisfy the specific technical standards KoFIU has published. Alignment between the Korean AML stack and the offshore VASP compliance posture is an engineering and legal task that needs to run in parallel with entity setup, not after it.
Step 3: Banking and treasury architecture for a Korean NFT project
Banking is the operational bottleneck that most NFT teams discover too late. Korean banks have contractually tightened access to Real-Name Accounts for virtual-asset businesses, and the pool of institutions willing to provide the account relationship required for KoFIU registration is limited. The project needs to demonstrate: a stable legal entity, an ISMS certification or a credible roadmap to it, a clean AML/KYC framework, and – in practice – a business plan that does not rely on high-volume retail speculation as its primary use case.
For the offshore treasury layer, the equivalent constraint is a crypto-friendly banking partner in the entity's home jurisdiction. Singapore-domiciled entities have access to a broader set of digital-asset-friendly financial institutions, though account approval timelines are not short. Cayman and BVI entities typically bank in jurisdictions with established correspondent networks rather than locally. The minting proceeds, the secondary-market royalty flows, and the protocol treasury should be mapped to distinct treasury accounts with clear segregation – both because Korean regulatory expectations require it and because the offshore tax analysis depends on clear attribution of income streams to the correct entity.
Stablecoin treasury management adds a further layer. Projects that hold a significant portion of treasury in USDT or USDC need to understand the counterparty concentration risk inherent in that choice. Tether and Circle hold contractual freeze authority over their issued tokens and generally act on court order or law-enforcement request. A project holding seven figures in stablecoins in a single wallet, without segregation and without legal documentation of the holding structure, carries a risk profile that no entity structure fully insulates.
Step 4: Smart-contract and intellectual property structuring
The smart contract is the operative legal instrument of an NFT project, and its terms govern the rights that determine token classification. Yet most projects deploy contracts that were forked from open-source repositories without a legal review of whether the rights encoded match the rights described in the whitepaper or the marketing materials. The gap between the two is a liability.
In South Korea, as in most civil-law adjacent jurisdictions, the legal treatment of a smart contract as a binding agreement depends on whether the conditions for contract formation under Korean civil law are met: offer, acceptance, and consideration must be identifiable, and the parties must be capable of legal action. An on-chain transaction with an anonymous wallet address creates interpretive risk when a dispute arises. The practical response is a hybrid structure: an on-chain smart contract for execution, and an off-chain terms-of-service agreement that identifies the parties, defines the rights, governs dispute resolution, and specifies the applicable law.
Intellectual property ownership of the underlying artwork – and the scope of rights transferred or licensed to the NFT holder – must be resolved in the smart-contract architecture. Korean copyright law does not automatically transfer copyright when an NFT is sold; the transfer requires an express assignment. A project that implies full ownership rights to NFT buyers while the smart contract licenses only a display right is exposed to consumer-protection enforcement as well as copyright claims. The IP assignment or licence scope should be spelled out in the on-chain metadata and in the off-chain terms, and the two documents must be consistent.
In a recent structuring matter, a content platform preparing an NFT launch had deployed a contract that granted buyers "full ownership" of the asset but contained no copyright assignment and no governing-law clause. We restructured the smart-contract terms, added a bilingual terms document with Korean-law-compliant consumer-protection disclosures, and aligned the IP structure before the public mint. The launch proceeded without incident and the project subsequently satisfied the AML pre-screening required by its primary exchange partner.
How does cross-border tax interact with a Korean NFT project?
South Korea taxes virtual-asset gains. The applicable framework – administered through the National Tax Service (NTS) – treats gains on virtual-asset transfers as "other income" subject to taxation above the applicable annual exemption. The rate and precise scope are subject to legislative revision, so the current position should be confirmed with Korean tax counsel rather than relied upon from static publication. What does not change is the structural principle: the Korean tax obligation attaches to the person or entity that realizes the gain, determined by residence and the location of the taxable event.
For an NFT project with an offshore holding entity, the critical question is whether the offshore entity's income can be attributed back to Korea through a permanent establishment analysis or a controlled foreign corporation (CFC) analysis. Korean tax law includes CFC rules that can attribute undistributed foreign profits to Korean resident shareholders when the offshore entity is in a low-tax jurisdiction and lacks genuine economic substance. A BVI or Cayman holding entity with no employees, no local decision-making, and no physical presence is a high-risk fact pattern for this analysis.
Value-added tax (VAT) treatment of NFT sales is unsettled in Korea, as it is in most jurisdictions. The NTS has not yet issued definitive guidance on whether NFT sales constitute the supply of goods, the supply of services, or a financial instrument transfer – each of which carries different VAT consequences. Projects should not assume VAT neutrality. The offshore entity structure affects the VAT analysis in each jurisdiction where buyers are located, not just in Korea, which compounds the complexity for a project selling to a global user base.
Before committing to an entity and treasury structure, map the income flows and the tax exposure in each material jurisdiction. A structure optimized for Korean tax neutrality may create unexpected exposure in Singapore, Japan, or the EU. To map the full stack before you commit, write to OBOLUS at info@oboluslaw.com.
Common structural mistakes – and how to avoid them
A common assumption is that calling a token a "utility token" in a whitepaper settles the legal classification. It does not. Korean regulators and courts apply substance over form: the rights the token actually confers on the holder – financial return, governance, payment function, liquidity design – determine its legal character, regardless of what the issuer calls it. This has consequences for regulatory classification, securities law, and tax, simultaneously.
The second recurring mistake is launching the project before resolving the banking and KoFIU registration question. A project that has already distributed tokens to thousands of Korean users, generated secondary-market trading volume, and collected primary-sale proceeds is in a materially weaker negotiating position with KoFIU than a project that engages the registration process before launch. The compliance infrastructure – ISMS certification, AML policies, Travel Rule solution, Real-Name Account – takes time to build. The sequence matters.
Third: DAO governance without a legal wrapper. A project that distributes governance tokens to Korean users, gives them voting rights over treasury decisions, and declines to establish a legal entity for the protocol is not insulated from Korean regulatory oversight by the fact of decentralization. The FSC has been explicit that economic substance, not technical architecture, determines regulatory perimeter. A DAO with Korean users, Korean-domiciled founders, and Korean-currency revenue streams is a Korean regulatory problem, whatever its smart contract says.
Fourth: treating the offshore entity as a paperwork exercise rather than an operational reality. A holding entity must have genuine economic substance – a real registered address, directors with real authority, documented decision-making, and financial accounts that reflect actual activity. Korean CFC rules and Korean transfer-pricing rules are applied to structures that lack substance. Regulators in Singapore and the Cayman Islands have also tightened economic-substance requirements, meaning the offshore entity must satisfy both its home-jurisdiction standards and the Korean analysis simultaneously.
Decision matrix: which structure fits your project profile
Profile A – an art-focused NFT project with Korean founders, no yield mechanics, peer-to-peer secondary market only, and a user base primarily outside Korea. This profile can often operate through an offshore holding entity (Singapore or BVI are common choices) with a terms-of-service framework governing Korean-user access. KoFIU registration is not triggered if VASP activity does not occur from a Korean establishment or primarily target Korean users at a regulated-activity level. The principal legal tasks are: IP structuring, smart-contract terms alignment, and a Korean-user terms document with appropriate regulatory disclosures. Timeline: several weeks for the legal layer, once entity setup is in place.
Profile B – a generative-art platform with a built-in secondary market, royalty pooling, and a staking mechanism that returns yield to NFT holders. This profile is almost certainly a VASP under VAUPA and may attract FSCMA securities analysis given the yield component. A Korean subsidiary or a locally registered branch is required for direct Korean-user engagement. The compliance build – ISMS, AML program, Travel Rule infrastructure, Real-Name Account – should be scoped at six to twelve months before public launch. The offshore holding entity for IP and treasury remains structurally sensible, but the Korean operational entity must be genuine and well-resourced.
Profile C – a DAO-governed NFT protocol with token-based governance, a community treasury, and a global user base that includes Korean holders. This is the highest-complexity profile. The DAO legal wrapper, the governance token classification, and the Korean VASP analysis must run in parallel. Allied counsel in Korea, Singapore, and the founding team's home jurisdiction all need to be coordinated from a single legal mandate rather than three disconnected workstreams. The offshore entity – foundation or LLC, depending on the governance design – needs to be operational before the governance token is distributed.
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law practice overview – the full scope of our technical legal practice for digital-asset businesses
- DeFi protocol legal structuring – structuring counsel for protocols, DAOs, and on-chain governance
- AML/CFT policy drafting – Travel Rule compliance and AML program design for VASPs
FAQ
Can a DeFi protocol be regulated?
Yes – and in South Korea, the FSC has made clear that economic function, not technical architecture, determines regulatory perimeter. A DeFi protocol that accepts user funds, executes exchanges, or distributes yield to Korean users can fall within the VAUPA VASP definition and the FSCMA securities framework, regardless of how decentralized its technical layer is. The founders' domicile and the location of the primary user base both factor into the jurisdictional analysis.
What legal wrapper suits a DAO?
No single wrapper suits every DAO, but the most common choices for projects with Korean exposure are a Singapore-law foundation, a Cayman foundation company, or a Marshall Islands DAO LLC – each of which provides legal personality, the ability to hold assets and sign contracts, and a recognizable counterparty for regulators and banks. The choice turns on the governance design, the distribution of token holders, and the tax residence analysis for the founders.
Who is liable when a smart contract fails?
Liability for a smart-contract failure depends on the cause and the contractual framework. Where the off-chain terms of service clearly allocate risk – disclaim guarantees as to code performance and specify dispute resolution – the issuer's exposure is limited by that allocation. Where no terms exist, or where the on-chain mechanics contradict the off-chain terms, Korean consumer-protection law and general civil liability principles can impose obligations on the issuer. Developer liability is a separate question that turns on the engagement terms between the issuing entity and the code authors.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, NFT projects, and DeFi protocols on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance obligations that surround them. Digital assets are the whole of our practice. We assess token classification against the substance of rights conferred – not the marketing label – and we structure licensing, banking, and tax as one mandate rather than three disconnected workstreams. To discuss your project's structure, contact info@oboluslaw.com.
By Roman Levitt, Technology and DeFi Counsel – advising on smart-contract architecture, DAO structuring, and token classification across common-law and civil-law jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.