AML & KYC in South Korea: 2026 Update

South Korea operates one of Asia';s most rigorous anti-money laundering frameworks. The country';s AML and KYC regime is anchored in the Act on Reporting and Using Specified Financial Transaction Information, commonly called the Financial Transaction Reports Act (FTRA), and the Act on Prevention of Concealment of Criminal Proceeds. Together, these statutes impose comprehensive obligations on financial institutions, virtual asset service providers (VASPs), and a growing range of designated non-financial businesses. This guide explains the current framework, recent regulatory updates, the supervisory architecture, and the practical compliance steps that foreign-owned businesses and international investors operating in South Korea must understand.

South Korea';s AML and KYC framework rests on two primary statutes. The FTRA establishes the obligation to report suspicious transactions and large cash transactions, and it designates the Korea Financial Intelligence Unit (KoFIU) as the central financial intelligence body. The Act on Prevention of Concealment of Criminal Proceeds criminalises the laundering of proceeds from predicate offences and sets out penalties for non-compliance.

The Financial Services Commission (FSC) and the Financial Supervisory Service (FSS) share supervisory responsibility. The FSC sets policy and issues regulations, while the FSS conducts on-site inspections and off-site monitoring of regulated entities. KoFIU sits within the FSC and receives, analyses, and disseminates financial intelligence to law enforcement agencies.

South Korea is a member of the Financial Action Task Force (FATF) and has been subject to mutual evaluation reviews. Recent evaluations have driven significant legislative and regulatory reform, particularly in the areas of beneficial ownership transparency, virtual asset regulation, and the extension of AML obligations to previously unregulated sectors.

The Enforcement Decree of the FTRA provides detailed implementing rules, including thresholds for cash transaction reports, the scope of customer due diligence (CDD), and the categories of obliged entities. Amendments to this decree have progressively tightened requirements, and obliged entities must monitor regulatory updates closely.

The scope of AML and KYC obligations in South Korea is broad and continues to expand. Financial institutions are the primary obliged entities. These include banks, securities firms, insurance companies, credit card companies, mutual savings banks, and foreign exchange dealers.

Beyond traditional finance, the regulatory perimeter now covers:

• Virtual asset service providers registered with KoFIU under the amended FTRA
• Credit finance companies and loan brokers
• Real estate agents handling transactions above prescribed thresholds
• Accountants and tax agents in certain transaction types
• Casinos and other gaming operators

VASPs face particularly detailed obligations. Under the amended FTRA, any VASP operating in South Korea must register with KoFIU, maintain a real-name bank account linked to a domestic bank, and implement a full AML and KYC programme. Failure to register is a criminal offence. In practice, many foreign-operated platforms have had to restructure their Korean operations or appoint a local compliance officer to meet these requirements.

A common mistake made by foreign businesses entering South Korea is assuming that AML obligations apply only to banks. In reality, any entity that falls within the designated non-financial business and profession (DNFBP) categories, or that handles virtual assets, must assess its obligations carefully before commencing operations.

Customer due diligence is the cornerstone of KYC compliance in South Korea. The FTRA and its Enforcement Decree require obliged entities to verify customer identity at account opening, before executing transactions above specified thresholds, and whenever there is suspicion of money laundering or terrorist financing.

Standard CDD requires collecting and verifying:

• Full legal name and date of birth for individuals
• Registration number and registered address for legal entities
• Identity of the beneficial owner where the customer is acting on behalf of another party
• Purpose of the business relationship

Enhanced due diligence (EDD) applies to higher-risk customers and relationships. Politically exposed persons (PEPs), whether domestic or foreign, trigger EDD requirements. Obliged entities must obtain senior management approval before establishing or continuing a relationship with a PEP, and must apply ongoing monitoring at a higher frequency.

Beneficial ownership identification has become a central focus of recent regulatory reform. Obliged entities must identify any individual who ultimately owns or controls more than a prescribed percentage of a legal entity customer. In practice, this means looking through corporate structures to identify the natural person in control. A non-obvious requirement is that beneficial ownership records must be kept for at least five years after the business relationship ends, and must be made available to KoFIU or the FSS on request.

Simplified CDD is available for lower-risk customers, such as listed companies or government entities, but obliged entities must document their risk assessment to justify the simplified approach. Many institutions underestimate the documentation burden associated with simplified CDD and face findings during FSS inspections as a result.

If your organisation is building or reviewing a CDD programme for South Korea operations, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

South Korea operates a dual reporting system. Obliged entities must file suspicious transaction reports (STRs) with KoFIU whenever they have reasonable grounds to suspect that a transaction involves proceeds of crime or is connected to money laundering or terrorist financing. There is no minimum threshold for STR filing. The obligation arises from suspicion, not from transaction size.

Cash transaction reports (CTRs) are mandatory for cash transactions that meet or exceed the prescribed threshold, currently set in the low tens of millions of Korean won per transaction or per day. The threshold applies regardless of whether the transaction appears suspicious. CTRs must be filed within 30 days of the transaction date.

In practice, obliged entities must maintain systems capable of detecting structuring - the practice of breaking large transactions into smaller amounts to avoid reporting thresholds. Structuring is itself a criminal offence under South Korean law, and institutions that fail to detect and report it face regulatory sanction.

KoFIU processes STRs and CTRs and shares relevant intelligence with the Prosecution Service, the National Police Agency, the National Tax Service, and other competent authorities. The quality of STR narratives is subject to increasing scrutiny. KoFIU has issued guidance indicating that generic or formulaic STRs are less useful and may prompt follow-up enquiries to the reporting institution.

Record-keeping obligations accompany the reporting regime. Transaction records and CDD documentation must be retained for at least five years. For certain categories of transaction, including those involving VASPs, longer retention periods may apply under sector-specific regulation.

South Korea has moved decisively to bring virtual assets within the AML and KYC perimeter. The amended FTRA introduced a registration requirement for VASPs and imposed obligations equivalent to those applied to traditional financial institutions. KoFIU maintains a public register of compliant VASPs.

The travel rule is a particularly significant requirement for VASPs. Under rules aligned with FATF Recommendation 16, VASPs must transmit originator and beneficiary information when transferring virtual assets above a prescribed threshold. South Korea implemented the travel rule through a phased approach, and the current framework requires VASPs to use an approved travel rule solution to exchange information with counterpart VASPs.

In practice, the travel rule creates operational complexity for cross-border virtual asset transfers. Where the counterpart VASP is located in a jurisdiction without an equivalent travel rule framework, the Korean VASP must apply enhanced scrutiny and may be required to decline the transfer. Many international operators underestimate the technical infrastructure required to comply with the travel rule and have faced delays in launching Korean services as a result.

The FSC has signalled its intention to continue tightening VASP regulation. Upcoming changes are expected to address the custody of virtual assets, the segregation of customer assets, and the application of AML obligations to decentralised finance platforms. Businesses operating in the virtual asset space should monitor FSC and KoFIU announcements closely.

Non-compliance with AML and KYC obligations in South Korea carries significant consequences. Administrative penalties include fines, business suspension orders, and licence revocation. Criminal liability can attach to individuals, including compliance officers and senior managers, where there is wilful non-compliance or gross negligence.

The FSS has increased the frequency and depth of AML inspections in recent years. Inspection findings are published in summary form, and repeat findings in the same area can escalate to formal enforcement action. Financial institutions that receive a formal warning are required to submit a remediation plan within a prescribed period, typically 30 to 60 days.

Recent enforcement actions have focused on:

• Inadequate beneficial ownership identification
• Failure to apply EDD to PEP relationships
• Deficient STR filing practices, including late filing and poor narrative quality
• Non-compliant VASP operations

South Korea';s FATF membership means that the country';s AML framework is subject to periodic peer review. Recent FATF guidance on virtual assets, beneficial ownership, and the risk-based approach has been incorporated into domestic regulation through amendments to the FTRA and its Enforcement Decree. Obliged entities should treat FATF recommendations as a forward indicator of regulatory direction in South Korea.

A practical scenario: a foreign bank establishing a South Korean branch must implement a full AML programme before commencing operations. This includes appointing a dedicated compliance officer, establishing a risk-based CDD framework, integrating transaction monitoring systems, and registering with KoFIU if the branch handles virtual assets. The FSS will conduct a pre-opening inspection, and deficiencies identified at that stage can delay the branch launch by several weeks.

A second scenario: a multinational company acquiring a South Korean financial institution must conduct thorough AML due diligence on the target. This includes reviewing historical STR filings, assessing the quality of the target';s CDD records, and evaluating any open regulatory findings. Gaps identified post-acquisition can result in the acquirer inheriting enforcement exposure.

For assistance navigating enforcement risk or structuring an AML compliance programme for South Korea, contact info@vlolawfirm.com. We can assist with documents and filings across the full compliance lifecycle.

What is the biggest practical risk for foreign businesses entering South Korea';s financial sector?

The most common risk is underestimating the breadth of the obliged entity perimeter. Foreign businesses often assume that AML obligations apply only to banks, but the FTRA covers a wide range of financial and non-financial businesses. VASPs, real estate agents, accountants, and certain other professionals all have obligations. Failing to identify that your business falls within scope before commencing operations can result in criminal liability for operating without registration, as well as administrative penalties. A thorough regulatory mapping exercise should be conducted before market entry, ideally with local legal advice.

How long does it take to establish a compliant AML programme in South Korea, and what does it cost?

The timeline depends on the complexity of the business and the maturity of the group-level AML framework. A financial institution building a programme from scratch should allow at least three to six months for policy development, system integration, staff training, and regulatory engagement. For a VASP, the KoFIU registration process itself takes several weeks after submission of a complete application. Professional fees for legal and compliance advisory support vary by scope, but mid-market institutions typically budget in the mid-to-high tens of millions of Korean won for initial programme build. Ongoing compliance costs, including transaction monitoring systems and annual training, represent a recurring operational expense.

Can a foreign company use a group-level AML policy for its South Korean operations?

A group-level policy can serve as a foundation, but it must be localised to meet South Korean requirements. The FTRA and its Enforcement Decree contain specific obligations that may differ from the group';s home jurisdiction framework. For example, the CTR threshold, the beneficial ownership percentage trigger, and the travel rule technical requirements are South Korea-specific. The FSS expects obliged entities to maintain a standalone South Korean AML policy that references local law, not merely a translated version of a global document. Inspectors will test whether staff understand the local requirements, so training must also be localised.

South Korea';s AML and KYC framework is comprehensive, actively enforced, and continuing to evolve. The extension of obligations to virtual asset service providers, the tightening of beneficial ownership requirements, and the implementation of the travel rule reflect a sustained regulatory commitment to financial crime prevention. Foreign businesses operating in or entering the South Korean market must treat AML and KYC compliance as a core operational requirement, not an afterthought.

VLO Law Firms advises international clients on AML and KYC matters in South Korea. We can assist with regulatory mapping, compliance programme design, KoFIU registration, STR and CTR procedures, and FSS inspection preparation. To request a consultation, contact: info@vlolawfirm.com