South Korea’s Financial Intelligence Unit is tightening its review of registered virtual asset service providers by moving beyond document checks and examining whether key controls are functioning in day-to-day operations. The agency has introduced a 2026 addendum filing form containing 44 review items that existing VASPs must submit by November 20.

The revised process broadens scrutiny across organizational structure, staffing, computer systems, internal controls, compliance arrangements, financial condition, social credibility, and the eligibility of major shareholders. Existing operators will be reviewed again under these stricter standards.

Shift from formal paperwork to operational reality

According to the FIU, the review will no longer focus only on whether a company has policies, departments, or compliance rules on paper. It plans to check whether those arrangements are actually working within real business processes.

To do that, the agency may compare reported operating conditions with supporting materials such as system screenshots, internal rules, and contracts with outside vendors. If needed, it may also carry out on-site inspections to verify what firms have reported.

What the 44-item addendum covers

The new filing form is divided into 44 items. Seventeen of them deal with organization, personnel, computer systems, and internal controls, while the remaining 27 concern compliance frameworks.

Within those 27 compliance-related items, 15 are tied to anti-money laundering requirements, eight relate to the Virtual Asset User Protection Act, and four cover other user protection measures. Firms are required to submit their operating status, supporting documents, and information identifying both the preparer and the reviewer of the filing.

Broader review of ownership and governance

The FIU said the revised filing standards also extend to areas including financial condition, social credibility, and major shareholder eligibility. That means the review is not limited to technical compliance systems alone.

The agency will look at governance-related details such as ownership stakes, when and why shares were acquired, the roles major shareholders hold within the company, and upper-tier control relationships. The stated aim is to assess whether governance and control structures meet the required standards in substance as well as in form.

No separate ratings, but a renewed adequacy check

The FIU does not plan to assign separate grades or ratings to VASPs through this process. Instead, registered operators will resubmit materials under the revised requirements and undergo another assessment.

That reassessment will focus on whether each firm’s compliance framework is adequate and whether it is operating effectively in practice. The next confirmed step is the November 20 deadline for existing operators to complete the 2026 addendum before the FIU conducts its stricter review.

Source: en.bloomingbit.io