South Korea's Financial Services Commission (FSC) held a digital asset industry security meeting on the 12th, presided over by Vice Chairman Shin Jin-chang, to discuss maximizing cold wallet storage ratios for virtual asset service providers (VASPs) including exchanges. The meeting was convened in response to recent information leaks and security incidents in the digital asset industry. Vice Chairman Shin emphasized that VASPs must adopt financial-institution-level security systems, noting that some operators' security awareness remains at pre-regulatory levels despite market growth and industry expectations.
FSC Announces Three-Pillar Security Framework for VASPs
The FSC outlined three core security measures at the meeting. First, VASPs must establish continuous monitoring and response systems tailored to market characteristics. Operators must deploy dedicated personnel at all times and immediately implement necessary control measures when abnormal large-scale transactions or suspected incidents occur. VASPs unable to maintain continuous monitoring systems may only process deposits and withdrawals during hours when systems operate normally, with prior notice to users and sufficient staffing to respond promptly to requests.
Second, the FSC mandated maximizing cold wallet storage ratios for user assets and expanding insurance coverage limits and reserve fund allocations. Current supervisory regulations require VASPs to store 80% of assets in cold wallets, but the industry average already exceeds 95%. Despite this, operators must maintain only the minimum quantity necessary for transaction support in hot wallets and consider distributing assets across multiple hot wallets. VASPs must also secure sufficient insurance coverage limits and reserve fund allocations to address user losses from hacking incidents.
Third, the FSC presented measures to ensure IT safety obligations and incident response aligned with the Electronic Financial Transactions Act, which applies to financial institutions. Through the Digital Asset Act, digital asset operators will be required to meet financial-institution-level safety standards and damage compensation liability. Even before the Act takes effect, the FSC plans to implement guidelines requiring VASPs to perform safety obligations equivalent to financial institutions covered by the Electronic Financial Transactions Act. Operators must establish safety standards covering information technology and information protection matters for electronic transmission and processing of digital asset transactions, implement technical, administrative, and physical measures to ensure transaction safety, analyze and assess vulnerabilities in information processing systems and networks, and perform remedial measures based on results. VASPs must also report incidents or potential breaches to financial authorities and maintain incident reporting systems similar to financial institutions.
FSC Issues Non-Action Letters for Preemptive Deposit Blocking
The FSC decided to issue non-action letters allowing VASPs to preemptively block deposits and withdrawals when hacking or security incidents are suspected. A non-action letter is a document in which financial authorities (such as the Financial Supervisory Service) respond to a company's inquiry about whether a new business activity or product violates relevant laws, stating that "no sanctions or measures will be taken in the future." The FSC discussed allowing preemptive deposit and withdrawal blocking by operators under certain conditions when hacking is suspected, to prevent the spread of user damage in response to increasing security threats. Current Virtual Asset User Protection Act prohibits operators from blocking deposits and withdrawals without justifiable reasons, permitting blocking only when hacking incidents are clearly confirmed. The FSC issued non-action letters based on the rationale that rapid blocking measures can be decisive in minimizing user damage.
FSC Expands VASP Membership in Financial Security Institute
The FSC will pursue additional membership enrollment to allow VASPs other than KRW-market exchanges to join the Financial Security Institute (FSI) as members. Member VASPs will receive security services including threat intelligence sharing, security vulnerability inspections, and professional financial security training. The FSI will conduct security inspections for VASP member institutions and provide "digital asset exchange-specific security inspection standards" to enable operators unable to perform direct inspections to conduct assessments independently or through information protection specialist firms. To address the latest security threats, the FSC plans to improve existing security inspection standards within the year, reflecting enhanced transaction verification and wallet access control measures.
FAQ
What is the current cold wallet storage requirement for South Korean crypto exchanges?
Current supervisory regulations require VASPs to store 80% of user assets in cold wallets, but the industry average already exceeds 95%. The FSC emphasized that operators must maintain only the minimum quantity necessary for transaction support in hot wallets and consider distributing assets across multiple hot wallets.
What is the FSC's non-action letter policy for suspected hacking incidents?
The FSC will issue non-action letters allowing VASPs to preemptively block deposits and withdrawals under certain conditions when hacking is suspected. Current law prohibits blocking without justifiable reasons and permits blocking only when hacking is clearly confirmed, but the FSC determined that rapid blocking measures can be decisive in minimizing user damage.
