South Korea’s FIU Targets Domestic Crypto Exchanges Over AML Failures, Signaling Tighter Oversight

FIU Steps Up Enforcement Against Korean Crypto Platforms

South Korea’s Financial Intelligence Unit (FIU), the agency that enforces the country’s anti-money-laundering laws and monitors financial crimes, has signaled an intensifying crackdown on local cryptocurrency exchanges after uncovering widespread AML and know-your-customer (KYC) lapses across the industry.

The move follows a record ₩35.2 billion ($25 million) fine against Dunamu Inc., the operator of Upbit, South Korea’s largest exchange and one often compared with the best crypto exchange platforms globally. The FIU is now preparing additional sanctions against several other licensed virtual asset service providers (VASPs), a regulatory term for crypto platforms authorized to handle trading and custody, including Bithumb, Korbit, Coinone, and GOPAX.

According to officials briefed on the matter, the FIU’s inspections revealed systemic control failures and persistent negligence in core AML procedures such as user verification, transaction monitoring, and suspicious-activity reporting. The probe marks the first coordinated on-site inspection of South Korea’s five largest exchanges since the implementation of the Virtual Asset User Protection Act in July 2024, a law that granted regulators sweeping powers to discipline crypto operators that fall short of compliance standards.

Industry analysts say the enforcement drive reflects the government’s growing view of crypto exchanges as fully fledged financial institutions rather than experimental tech ventures.

Upbit Fine Sets the Stage for Wider Crackdown

Anti-Money Laundering (AML) Framework. (Source: KoFIU Official Website)

The turning point came earlier this month when the FIU levied a ₩35.2 billion fine against Upbit after identifying 8.6 million AML violations, including 5.3 million failures in customer identification and 3.3 million cases where transactions were processed for users who had not completed KYC checks. The regulator also cited multiple failures to report suspicious transactions linked to offshore entities.

The decision followed a months-long investigation that began in August 2024, when FIU inspectors conducted on-site reviews of Upbit’s systems, records, and customer documentation. According to filings reviewed by Business Korea, the agency concluded that the exchange had approved accounts using photocopied ID documents and allowed deposits and withdrawals from users whose verification status was incomplete.

As part of its enforcement order, the FIU imposed a three-month restriction on new-user deposits and withdrawals—an unprecedented move for a licensed crypto exchange in South Korea.

Inspections Extend to Bithumb, Korbit, and GOPAX

The FIU’s next wave of enforcement is expected to follow the same inspection sequence it began last year. Bithumb, Korbit, Coinone, and GOPAX have each undergone on-site audits under the same regulatory criteria used in Upbit’s case. The remaining four exchanges are likely to face “comparable deficiencies” in their AML programs, including weak transaction monitoring and inconsistent reporting of high-risk activity.

Korbit, which was the second platform inspected after Upbit, is reportedly first in line to receive formal sanctions. Sources cited by Yonhap News suggested that final penalty decisions could arrive before the end of Q1 2026. Based on prior enforcement precedents, fines across all four exchanges could total hundreds of billions of won combined.

In parallel, the FIU is coordinating with the Financial Supervisory Service (FSS) and the Ministry of Justice to expand its data-sharing framework for crypto-related financial crimes. Officials said the agencies will meet bimonthly to cross-analyze suspicious transaction patterns linked to money laundering, illegal gambling, and fraudulent token listings.

Offshore Platforms Face Parallel Pressure

The crackdown on domestic firms coincides with broader efforts to shut out unregistered foreign exchanges that have been operating in South Korea without regulatory approval. Earlier this year, the FIU ordered telecom operators and app stores to block access to 14 offshore platforms, including KuCoin, MEXC, Phemex, and Bitget, citing violations of the country’s registration requirements under the AML Act.

Authorities said the blocked exchanges lacked basic KYC safeguards and risked exposing Korean investors to financial crime. The move underscores a coordinated effort to ensure that all trading platforms serving Korean users—domestic or foreign—operate under consistent compliance frameworks.

The FIU’s updated risk assessment also found that several offshore exchanges were facilitating transactions with unregistered entities or processing payments through unverified virtual accounts. Such findings have intensified scrutiny on the cross-border dimension of South Korea’s crypto market, long seen as a hotspot for high-frequency retail trading.

As investors look for safer withdrawal options during regulatory turbulence, services like off ramp crypto to fiat have gained popularity for providing compliant pathways to convert holdings.

Industry Reaction and Market Impact

The regulatory escalation has rattled the domestic crypto sector, but many industry participants view it as an inevitable evolution. Exchanges have begun ramping up compliance spending, hiring AML specialists, and integrating new monitoring tools that can detect suspicious flows in real time. Bithumb and Coinone have both announced plans to overhaul their internal compliance divisions, while GOPAX has initiated a partnership with a global AML technology provider to automate its risk-scoring process.

For users, the near-term impact is largely operational: stricter onboarding processes, slower withdrawals, and enhanced verification steps. Yet analysts note that greater oversight could ultimately bolster market confidence by curbing fraud and ensuring that Korean exchanges meet international standards.

As tighter regulations reshape the local market, more users are exploring globally regulated fintech ecosystems with transparent custody, similar to what’s offered by a crypto bank model emphasizing compliance and secure fund management.

Policy Context and Motivations

Regulators argue that the crackdown is not intended to stifle growth but to bring the crypto industry in line with the country’s broader financial compliance framework. Since 2021, South Korea has required all crypto platforms to register with the FIU, maintain partnerships with licensed banks, and implement verified real-name accounts. The Virtual Asset User Protection Act expanded those obligations. introducing penalties for negligent reporting and expanding liability for management teams.

The FSC has also directed the FIU to review fee structures and investor disclosures across domestic exchanges to improve pricing transparency. Meanwhile, the government temporarily suspended crypto lending services earlier this year amid concerns over unregulated yield products that could pose systemic risks to retail investors.

What Happens Next

The FIU is expected to conclude its enforcement cycle in the first half of 2026, with final sanctions for Bithumb, Korbit, Coinone, and GOPAX likely to be announced sequentially. Officials say the severity of penalties will depend on each exchange’s cooperation level and remedial progress. Analysts expect total fines across the sector could exceed ₩150 billion (roughly $110 million).

Beyond financial penalties, the FIU is considering new compliance reporting obligations that would require exchanges to conduct quarterly audits of their AML systems and share results with both the regulator and partnering banks. The agency also plans to expand its oversight to include stablecoin issuers and crypto custodians operating within the Korean market.

Conclusion

South Korea’s FIU appears determined to transform its crypto market from a loosely supervised trading hub into a fully compliant financial ecosystem. The record fine against Upbit has set a precedent that others in the industry cannot ignore, and forthcoming penalties against its peers will likely reinforce that message.

While the short-term turbulence may unsettle traders and platforms alike, regulators believe the long-term benefits, greater transparency, institutional participation, and alignment with global AML norms outweigh the costs. As documented repeatedly in global AML norms, compliance is no longer optional for financial institutions.

As South Korea’s enforcement drive unfolds, the broader lesson for global exchanges is clear: compliance is no longer a competitive advantage; it’s the price of survival.