South Korea to Require Virtual Asset Service Providers to Report Security Incidents Immediately to Financial Regulators

Nov. 5: According to Digital Asset, South Korea's Financial Services Commission announced on Nov. 5 that it will draw up new guidelines requiring virtual asset service providers to notify the Financial Supervisory Service and the Financial Security Institute immediately after discovering a security incident. Currently such companies only need to report to the Korea Internet & Security Agency. Financial authorities believe that, as virtual assets become increasingly intertwined with the financial industry, incident information must be conveyed quickly to financial regulators to enable investigation, information sharing and consumer protection.

The financial authorities also plan to enact a "Digital Financial Security Act" that would apply security rules comparable to those of the current Electronic Financial Transactions Act to industries that hold large amounts of customer information or could cause major asset losses, such as virtual asset service providers, insurance agencies and lending businesses, and intend to complete the legislation and submit the bill in the first quarter of 2027. In addition, South Korea will conduct comprehensive security inspections of about 580 financial companies, including virtual asset service providers.