JIPYONG LLC

Jipyong News|KOREA LEGAL INSIGHT

Proposed Amendment to the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information

2021.01.18

The amended Act on Reporting and Using Specified Financial Transaction Information (the “Act”) takes effect on March 25, 2021. In the meantime, on November 3, 2020, the Financial Services Commission (the “FSC”) announced a proposed amendment to the Enforcement Decree of the Act (the “Proposed Amendment”). 
 
The Act provides for reporting and anti-money laundering requirements on virtual asset service providers (“VASPs”), whereas the Enforcement Decree of the Act (the “Enforcement Decree”) specifies detailed requirements. 
 
The Proposed Amendment may still be further amended or supplemented based on opinions gleaned from the market, but the following is an overview and implications of the Proposed Amendment as currently announced.

1. Limited scope of VASPs to be governed by the Act 
 
Interestingly, although the FSC issued a press release on November 2, 2020 (the “FSC Press Release”) stating that the Proposed Amendment would limit the scope of the Act to "Major Virtual Asset Service Providers” (“Major VASPs”), this has not been explicitly reflected in the Proposed Amendment. Accordingly, the scope of VASPs prescribed by the Act and Proposed Amendment remains broad. 
 
The Act defines VASPs as service providers that (i) buy and sell Virtual Assets, (ii) exchange Virtual Assets for other types of Virtual Assets, (iii) transfer Virtual Assets, (iv) provide custodial services (safekeeping and administration) in respect of Virtual Assets, (v) buy and sell Virtual Assets as brokers or intermediaries, or (vi) engage in any other services or activities as may be prescribed by Presidential Decree, and further delegates the stipulation of any such additional services or activities to the Enforcement Decree (Article 2 of the Act). 
 
It should thus be noted that the FSC may subsequently (i) publish additional press releases, manuals, or guidelines regarding the scope of Major VASPs in the near future, or (ii) supplement the Proposed Amendment during or after the process of hearing public opinions. 
 
For now, the following are examples of the types of “Major VASPs” expressed to be envisaged by the FSC.

2. Scope of Virtual Assets 
 
The Act defines “Virtual Assets” as “digital tokens (including any and all related rights) with economic value that can be digitally traded or transferred”, but excludes from this definition any digital tokens that are issued for limited uses and cannot be exchanged for fiat currencies, commodities or services; prepaid electronic payment methods or e-money; electronically registered stocks; electronic notes; and electronic bills of lading (Article 2(3) of the Act). 
 
In addition, the Proposed Amendment now excludes prepaid cards, mobile gift cards and electronic bonds (Article 3(3) of the Proposed Amendment). 
 
Further, even if certain types of virtual assets may be deemed to fall within the scope of the Act’s definition of “Virtual Assets”, VASPs are prohibited from handling any untraceable virtual assets, including ‘dark-coins’ with built-in technologies that make it impossible to identify transfer records (Article 13(5) of the Proposed Amendment). 
 
 
3. Issuance criteria for Verified Real-Name Accounts 
 
In order to prevent Virtual Assets from being abused for money laundering purposes and enhance transparency in transactions, the Act mandates VASPs to handle financial transactions only through verified real-name accounts (i.e. accounts that only permit financial transactions between VASP and customer accounts opened with the same financial institution, “Verified Real-Name Accounts”) (Subparagraph 2 of Article 7(3) of the Act). The Proposed Amendment specifies the criteria and conditions necessary for a VASP to obtain a Verified Real-Name Account from a financial institution (Subparagraph 1, 2 of Article 12(8) of the Proposed Amendment).

The FSC Press Release stated that there are plans to add an exemption provision (through KoFIU’s notice of revision) to exempt certain VASPs that do not conduct any transactions between legal currency and Virtual Assets from the requirement to obtain Verified Real-Name Accounts. Accordingly, VASPs that do not support deposit and withdrawal services can conduct their business without obtaining a Verified Real-Name Account, provided that they satisfy other requirements under the Act (e.g. such as obtaining ISMS certification pursuant to Article 7(3) of the Act). 
 
 
4. VASP obligations in handling Virtual Asset transfers: ‘Travel Rule’ 
 
Article 6(3) of the Act requires VASPs to provide information to virtual asset recipients upon processing Virtual Asset transfers (the "Travel Rule"), and the Proposed Amendment prescribes specific criteria regarding the Travel Rule. 
 
The Proposed Amendment provides that the Travel Rule (i) shall apply to any transfer of Virtual Assets worth KRW 1,000,000 or more (Subparagraph 3(b) of Article 10-3(1) of the Proposed Amendment), (ii) shall not apply to transactions between individuals, and (iii) shall apply to transactions between VASPs and individuals or between VASPs (Article 11 of the Proposed Amendment). Consequently, if a customer transfers a Virtual Asset worth more than KRW 1,000,000, the transmitting VASP is obliged to provide the recipient with the relevant information.

Given the time required to build a common autonomous information transmission and sharing system among VASPs, the Travel Rule will not take effect until March 25, 2022, which is one year after the Act takes effect (Addendum of the Proposed Amendment). Moreover, the Financial Action Task Force (“FATF”) is expected to discuss and announce details of the Travel Rule standards in 2021 and the Proposed Amendment will likely reflect the details of discussion and announcement of the FATF. It is therefore necessary to monitor the development of the Travel Rule standards. 
 
 
5. VASP reporting schedule and method 
 
According to the Proposed Amendment, KoFIU shall be responsible for (i) accepting VASP reports, and (ii) administering the notification process thereof. Accordingly, any business entity that already operates a virtual asset business as a VASP or intends to operate a virtual asset business as a VASP must submit a VASP report to KoFIU (Article 12 of the Proposed Amendment). The Financial Supervisory Service (“FSS”) will be responsible for preparing opinions on the VASP reports, as KoFIU has entrusted the evaluation responsibility to the FSS (Article 12(7) of the Proposed Amendment). The FSS stated in a press release that it will publish and distribute a manual that includes procedures, report forms, and other information related to VASP reports. 
 
Any business entity classified as a VASP under the Act must report to KoFIU by September 25, 2021 (i.e. within six months from the date that the Act takes effect). VASPs who conduct their businesses without filing the VASP reports will be subject to criminal punishment of imprisonment up to five years or fines of up to KRW 50,000,000 (Article 17 of the Act). 
 
 
6. Implications 
 
Considerable time and discussion is expected before an amendment of the Enforcement Decree is finalized. 
 
According to the Act, a VASP must obtain a Verified Real-Name Account before filing a VASP report with KoFIU. However, due to financial institutions’ passive stance in issuing Verified Real-Name Accounts to small and medium-sized cryptocurrency exchanges and VASPs, there has been a considerable number of disputes between VASPs and financial institutions in this regard. The Proposed Amendment is meaningful because it provides the criteria for issuing Verified Real-Name Accounts; however, it does not obligate financial institutions to issue Verified Real-Name Accounts to VASPs. Due to the fact that financial institutions have discretionary power to decide whether to accept or reject the issuance of Verified Real-Name Accounts to VASPs, the decision to issue Verified Real-Name Accounts to VASPs will be dependent on the financial institution’s judgment and evaluation of the money laundering risks. It is thus important to observe and monitor how financial institutions will react and respond to the amendment of the Enforcement Decree. 
 
Moreover, as VASPs are required to obtain ISMS certification, which entails a rigorous compliance review of the ISMS certification standards (including but not limited to evaluations of information management processes, information protection measures, etc.), VASPs are expected to spend a considerable amount of money in external consulting services and adopting new systems for their services. Further, it will be necessary for VASPs to prepare and schedule their reporting process ahead of time to ensure that the VASP reporting process is completed by September 25, 2021, as the review period for ISMS certification normally takes several months. 
 
Furthermore, although the FSC Press Release states that the scope of application of the Act will be limited to Major VASPs, such limited scope will not be strictly binding until it is explicitly reflected in the Act or Enforcement Decree. Accordingly, follow-up measures, including the FSC’s guidelines, need to be rolled out promptly to prevent market confusion. 
 
Jipyong's FinTech Team has accumulated diverse experience, including regulations related to virtual assets such as cryptocurrency, ICO (Initial Coin Offering) consulting, and consulting for innovative financial services using blockchain technology (Financial Regulatory Sandbox). We work closely with our Privacy & Data Team to provide comprehensive legal advice in the areas of personal information protection, IT, and information security regulations. We will continue to monitor and update the changes in regulations related to the virtual asset business.

* Note : An ISMS (Information Security Management System) is a comprehensive security management system that consists of a set of security controls that includes technical, managerial, and physical protection measures to secure the stability and reliability of information and communication networks. On November 2, 2020, the Ministry of Science and ICT (“MSIT”) and the Personal Information Protection Committee (“PIPC”) established the VASP-specialized ISMS certification evaluation system to be adopted for the VASP ISMS certification process. It has been announced that the MSIT, PIPC, and FSC will develop 56 new evaluation items, including for (i) wallet/encryption keys, (ii) computer ledger management, and (iii) unauthorized transfer detection systems. Accordingly, it is expected that a total of 381 items will be evaluated (by adding 56 specialized items to the existing 325 items) in issuing ISMS certification to VASPs.

Back to List

Professionals

SHARE

Disclaimer

Limited Liabilities