South Korea's Financial Services Commission (FSC) outlined emergency cybersecurity measures for virtual asset providers and decided to issue no action letters allowing precautionary suspensions of deposits and withdrawals when hacking is suspected. The package follows broader financial sector security measures outlined on Nov. 5 and specifies safeguards for providers outside the Electronic Financial Transactions Act's security regime. A planned Digital Asset Act would impose IT security duties and liability for damages comparable with those of financial institutions.
Providers are expected to maintain continuous monitoring and incident response. Those unable to do so should process deposits and withdrawals only during adequately monitored hours, with advance notice to users. Firms should minimize online hot wallet balances and maximize offline cold storage. The existing regulatory minimum for cold storage is 80%, while the sector's share is already at least 95%. Insurance coverage and reserves should be sufficient to compensate users for losses. Providers should also assess and remedy system vulnerabilities and promptly report incidents or indications of possible intrusion to financial authorities.
The planned no action letters address uncertainty under the Virtual Asset User Protection Act over whether providers may suspend transfers before a hack is confirmed. Security support through the Financial Security Institute will also be expanded beyond the five exchanges offering trading in South Korean won that currently hold membership among 28 providers. Members will receive threat information, vulnerability checks and training, with support also available to firms unable to join. Revised exchange inspection standards addressing transaction verification and wallet access controls are due by the end of 2026.