Withdrawing virtual assets from an exchange to a personal wallet may become subject to foreign exchange reporting.
On October 7, the Ministry of Finance and Economy (MOFE) issued a legislative notice of a draft amendment to the Enforcement Decree of the Foreign Exchange Transactions Act containing this change. The draft is not final yet. The government will take comments until October 26 and plans to put it into effect from December 3.
Here is the key point first. When a virtual asset service provider (VASP, "service provider" below) such as an exchange sends virtual assets to or receives them from a foreign service provider or a personal wallet, it must notify the Bank of Korea's foreign exchange data network of the details. The government plans to use the data collected this way together with the National Tax Service, the Korea Customs Service, the Financial Supervisory Service and the Korea Financial Intelligence Unit (KoFIU, the agency that analyzes transactions suspected of money laundering). The purpose the government gave is to build a system for watching cross-border movements of virtual assets in one place.
This article goes through what changes, why personal wallets were included and what has not been decided yet, and then looks at what records a service provider should keep on its side when assets are withdrawn.
The Government Saw Assets Moved to Personal Wallets as Hard to Trace
The underlying Foreign Exchange Transactions Act was already amended on June 2. Service providers that want to do business sending virtual assets abroad and receiving them from abroad must register in advance, and the Act takes effect on December 3. The new draft decree adds transfers to and from personal wallets to this.
The government set out its reasons in the regulatory impact analysis released with the legislative notice. With virtual assets, "the concept of physical borders is ambiguous," and assets that have moved out to personal wallets are hard to follow afterward, so the government saw such transfers as having substantially the same effect as sending assets abroad.
Instead of the word "personal wallet," the provision says "a virtual asset address that does not go through a virtual asset service provider." This means a wallet address that does not go through a service provider such as an exchange. The provision has no wording that separates whether that wallet is in Korea or abroad.
The government also considered covering only transfers between service providers. It noted that including personal wallets would increase the transactions service providers must report, but chose to include them, saying that leaving them out could create a gap for getting around regulation through personal wallets. The analysis also includes figures from the Korea Customs Service. Of the KRW 14.5 trillion in foreign exchange crimes detected from 2021 to 2025, KRW 11.4 trillion, or 79%, was related to virtual assets.
Registered Service Providers Will Report Their Virtual Asset Transfers to the Bank of Korea
A service provider that wants to do this business must complete its filing under the Act on Reporting and Using Specified Financial Transaction Information (the law that sets anti-money laundering obligations; "Specified Financial Transaction Information Act" below), have computer facilities and professional staff in place, and register with the Minister of Finance and Economy. Doing this business without registration is subject to criminal punishment.
When a registered service provider sends virtual assets to or receives them from a foreign service provider or a personal wallet, it will notify the Bank of Korea's foreign exchange data network of the details. The government plans to share this data with the National Tax Service, the Korea Customs Service, the Financial Supervisory Service and KoFIU.
However, what must be reported, from what amount, and by when is not written in the Act or the draft decree. These are parts to be set later in lower-level standards. The government explained that what is to be reported will be set "within the scope of data that can be collected" by service providers in the course of their business.
Anti-Money Laundering Rules Also Change in February 2027
Separately from foreign exchange reporting, the rules for preventing money laundering are also changing. Under the Enforcement Decree of the Specified Financial Transaction Information Act, amended on August 18, two things related to this article change from February 19, 2027.
- The rule for passing customer information along when service providers send virtual assets to each other (commonly called the "travel rule") currently applies only to transfers of KRW 1 million or more. From then on, it will apply to all transfers regardless of amount.
- When a service provider transacts with a counterparty that uses a wallet address over which the service provider does not hold management authority on its own (the provision says "a virtual asset address over which it does not have exclusive management authority"), it must follow standards set by the head of KoFIU. At or above the amount set in the notice (to be set within a range of KRW 10 million or more), it must also have its own monitoring system for suspicious transactions.
The two rules describe personal wallets in slightly different words. The foreign exchange side says an address that does not go through a service provider, and the anti-money laundering side says an address over which the service provider does not hold management authority on its own. Whether the two expressions point to the same wallets still needs to be confirmed.
Withdrawals to Personal Wallets Are Also Treated as the Service Provider's Transactions
Since there is no service provider on the receiving end, it is easy to think the exchange has no records of its own to keep. But both rules treat this withdrawal as a transaction taking place on the service provider's side. This means reporting and monitoring start with the service provider making the withdrawal.
Both rules also divide what they cover by what kind of address the receiving address is. So a service provider can be seen as needing to classify and record, every time it sends virtual assets, whether the receiving address belongs to a domestic service provider, a foreign service provider or a personal wallet, in order to report properly. The law does not make this classification a separate obligation, but it is something that becomes necessary first in order to report.
This change is tied to what records are left when virtual assets move in and out of wallets. PARAMETA's ParaSta provides the core functions of digital asset services, from issuance to wallets, identity verification and orchestration, on a single platform. Middleware that connects banking networks and blockchains is also an area PARAMETA works on.
The Schedule Runs From the October 26 Comment Deadline to February 2027
- October 26: comment period on the draft decree closes
- After that: regulatory review, review by the Ministry of Government Legislation, and the vice-ministerial meeting and the Cabinet meeting
- December 3: the amended Foreign Exchange Transactions Act takes effect, and the decree is planned to take effect the same day
- February 19, 2027: the expanded travel rule and the measures for transactions with personal wallet counterparties under the Enforcement Decree of the Specified Financial Transaction Information Act take effect
There are two things to watch. The first is the lower-level standards that will set what must be reported to the Bank of Korea. If they require the type of receiving address to be recorded as well, some service providers may need to rework how they record withdrawals before the rules take effect. The second is the wording of the two rules. If they are settled as covering the same scope, an address can be classified once and used for both rules. If they are settled differently, the same withdrawal will have to be assessed separately under two standards.
Comments on the draft amendment to the Enforcement Decree of the Foreign Exchange Transactions Act can be submitted until October 26.