Questions started arriving in my inbox the week South Korea published Presidential Decree No. 36592. Compliance teams at firms with Korean counterparties wanted to know what the new crypto transfer rules actually require, what they can build now, and what they're still waiting on. The questions sound different depending on who's asking, a payments ops lead has different concerns than a training manager, but the pattern is the same: a fixed deadline, incomplete guidance, and a need to act before all the answers are in.
The Korean decree is a useful case study because it's happening first and because the gaps are visible. The rules take effect February 19, 2027, but the Korea Financial Intelligence Unit hasn't yet published the criteria that define how firms prove compliance. That's not a Korean quirk. It's how regulatory implementation works in most jurisdictions, and it's a scenario your team will face again.
Here's what compliance teams are actually asking, and what you can do with what you know now.
Do We Have to Refuse Transfers, or Can We Just Flag Them?
Refuse. Article 10-20, item 6 of the decree requires virtual asset providers to refuse incoming transfers that arrive without the required originator and beneficiary information. You don't flag it for review. You don't hold it for remediation. You refuse it.
This is different from the risk-based approach many firms use for other transaction monitoring. The decree doesn't give you discretion to accept a transfer and investigate later. If the information isn't there, the transfer doesn't go through.
That changes your exception-handling workflow. You'll need a process that tells the sender what happened, explains what information is missing, and provides a path to resubmit. You'll also need to decide who gets notified internally when a transfer is refused, not as an incident, but as a routine outcome.
Does This Apply to Us If We Don't Have a Korean Entity?
Yes, if you're sending transfers to a Korean provider. The obligation sits with the receiving institution in Seoul, but the practical consequence lands on whoever controls outbound flows at the sending firm, regardless of where that firm is based.
If your firm routes transfers to Korean counterparties, you need to ensure the required information travels with the transfer. The Korean provider can't accept it otherwise, and a refused transfer creates friction for your customer and reputational risk for your firm.
This is worth mapping now: identify every Korean counterparty in your network, including indirect exposure through intermediaries. Don't wait for the February deadline to discover you're routing through a firm that can't accept your transfers.
What Information Do We Actually Need to Send?
Article 10-10 specifies the categories: originator and beneficiary information that identifies the parties to the transfer. The decree eliminates the old value threshold, so the requirement applies regardless of transfer size.
What's not yet defined is the evidentiary standard, what proof satisfies the requirement, and how firms demonstrate they control a receiving address. That's one of the criteria the Korea Financial Intelligence Unit will publish, and it hasn't been issued yet.
But you can build the data-capture layer now. You know which fields are required. You can design the form, update your transfer interface, and train your team on the new workflow. What you can't finalize is the documentation standard for proving control, because that's delegated to guidance that doesn't exist yet.
What About Transfers to Self-Hosted Wallets?
Article 10-20 covers transfers involving addresses the provider doesn't exclusively control, self-hosted wallets. The decree requires measures for these transfers, but the specific measures depend on criteria the FIU hasn't published.
You may have seen English-language coverage stating that Korea now restricts withdrawals to self-custody wallets only when the sender and recipient are the same person. That requirement doesn't appear in Article 10-10 or Article 10-20. It comes from Financial Services Commission press material, which has already been revised once.
This is a reminder to read the instrument itself when you can, or to mark the control as provisional if you're relying on a summary. Press releases describe intent and are written to be quoted. The decree is written to be applied.
How Do We Prepare When the Criteria Aren't Published Yet?
Build to what the decree already specifies, and document which controls are waiting on delegated criteria. You can implement the information fields, the request-then-refuse sequence, and the customer communication workflow. You can identify your Korean counterparties and assess your exposure. You can't finalize the evidentiary standard for address control or any risk tiering of foreign counterparties, because both are delegated to notices that don't exist yet.
The phrase "as determined and published by the Commissioner of the Korea Financial Intelligence Unit" appears six times in Article 10-20 alone. Each instance hands off an operative criterion to guidance that hasn't been issued. Korean firms face a fixed deadline with no published standard to build to.
This is normal. Leaving details to secondary legislation is routine in most jurisdictions, and compliance teams deal with it every year. The Korean case is useful because the deadline is fixed, the gaps are visible, and it's happening first.
Waiting isn't necessary and likely isn't wise. You can build the data layer and the workflow now. What you can't do is finalize the controls that depend on criteria the FIU hasn't published.
Why Does This Matter Outside Korea?
Under Regulation (EU) 2023/1113, the European Commission must report by June 30, 2027, on whether to limit, control, or prohibit transfers involving self-hosted addresses. Korea's rules take effect February 19, 2027, four months before that deadline.
Whatever goes wrong in Seoul in the first quarter of 2027 will be evidence European and U.S. compliance teams can study before their own regulators take up the same question. Refused transfers, failed attestations, criteria published late, all of it becomes a case study for firms preparing for similar rules in other jurisdictions.
If your firm handles digital asset transfers, treat this as a preview. The regulatory approach Korea is testing, requiring complete information, refusing transfers that don't comply, and applying the obligation regardless of entity location, is likely to appear in other markets.
Where to Go for More
Watch for the delegated notices from the Korea Financial Intelligence Unit. In your own jurisdiction, identify which body is responsible for the criteria your regulator has deferred, and monitor their publication schedule.
If you're relying on English-language summaries, verify them against the original text when possible. If that's not feasible, mark the control as provisional until someone has checked the source.
And treat refusal as an expected outcome, not an incident. Decide now who gets notified, what the customer is told, and how the transfer is unwound. You won't have time to design that workflow in February.
