FIU Tightens VASP Filing Reviews to Verify Compliance Systems Work in Practice

South Korea’s Financial Intelligence Unit, or FIU, will begin checking whether registered virtual asset service providers are actually operating their organizations, staffing, computer systems, internal controls and compliance frameworks in practice.

The FIU has drawn up a “2026 Addendum Filing Implementation Status Form” containing 44 key review items that registered VASPs must submit, Etoday reported on September 7. The step follows revisions to the Act on Reporting and Use of Certain Financial Transaction Information that took effect on August 20, strengthening VASP filing requirements for existing operators.

Existing VASPs must complete the addendum filing by November 20 and undergo review under the stricter standards. Filing requirements have been expanded to cover financial condition, social credibility, and major shareholder eligibility, along with organization, personnel, computer systems, internal controls and compliance frameworks.

The status form contains 44 review items in total: 17 related to organization, personnel, computer systems and internal controls, and 27 tied to compliance frameworks. Within the compliance section, the FIU will examine 15 anti-money laundering items, eight related to the Virtual Asset User Protection Act and four covering other user protection measures. Companies must submit their operating status for each item, supporting documents that prove it, and information on both the preparer and reviewer.

In particular, the FIU plans to go beyond checking whether firms have formally established relevant rules or organizations. It will also verify whether those arrangements are functioning properly in actual business processes. The agency will compare supporting materials, including system screenshots, internal rules and contracts with outside vendors, against the reported operating status, and may carry out on-site inspections if necessary.

The review will also cover major shareholder eligibility and governance. The FIU will examine not only the largest shareholder, major shareholders and related parties of the largest shareholder, but also, when the largest shareholder is a corporation, other legally defined review targets tied to that entity, including its largest shareholder and representative. Firms were also asked to submit ownership stakes, the timing and reasons for share acquisitions, roles within the company and upper-tier control relationships.

The process will not assign separate ratings to VASPs. Instead, existing registered operators will resubmit relevant materials under the revised requirements, and the FIU will again check whether their compliance frameworks are adequate and operating in substance.