Regulatory Expansion Pushes Crypto “Borderline Businesses” Into the Spotlight, Fueling Industry Confusion
FIU and FSC warn that referral marketers and trading signal groups may qualify as “unregistered VASPs” — startups say compliance costs are unsustainable
As South Korea accelerates the institutionalization of the crypto-asset market, financial regulators are increasingly directing their enforcement efforts beyond exchanges toward businesses operating in regulatory gray areas.
Services that were long perceived as peripheral — including crypto wallets, staking platforms, and even overseas exchange referral marketers — now face the risk of being classified as Virtual Asset Service Providers (VASPs) under Korea’s regulatory framework.
Industry voices are sharply divided. Some argue that authorities are stretching financial regulation into areas that should be treated as IT infrastructure or marketing services, while others maintain that stricter oversight is unavoidable to protect investors.
“Control of the Key Means Control of the Business”:
The Regulatory Fate of Wallets and Staking Services
In the blockchain ecosystem, control over digital assets has become the decisive criterion for regulatory classification.
Even if a business presents itself as a software provider or fintech platform, regulators take the position that any entity exercising practical control over users’ asset movement or management may qualify as a VASP.
Crypto wallets and staking services are at the center of this shift. Guidance issued by the Korea Financial Intelligence Unit (FIU) makes the regulator’s intent clear:
non-custodial wallets that merely provide software without holding private keys may fall outside the reporting obligation, but any structure allowing the operator to exert control — even indirectly — risks triggering VASP status.
Staking services face similar scrutiny. While some models resemble passive technical facilitation, others involve asset pooling or operational discretion that could be viewed as asset management. As discussions surrounding the forthcoming Crypto Asset Industry Act continue, such services are increasingly likely to be brought under formal regulation.
As a result, companies that once identified as technology infrastructure providers now find themselves confronting full-scale financial compliance requirements.
“Are YouTubers Next?”
Warning Notices Hit Referrals and Trading Signal Groups
The regulatory shockwaves are perhaps strongest in the marketing space.
Individuals and groups promoting overseas exchanges via YouTube, Telegram, or open chat rooms — earning commissions through referral links — as well as so-called “trading signal” or “leading” groups, are now firmly on regulators’ radar.
The Financial Services Commission (FSC) and FIU have recently warned that unregistered crypto-related activities may constitute illegal virtual asset business operations. Practices once dismissed as simple information sharing or affiliate marketing are now being interpreted as intermediation.
Under this interpretation, distributing exchange referral links or actively encouraging specific token purchases may expose operators to liability not only under the Act on Reporting and Using Specified Financial Transaction Information (the “AML Act”), but also under the Capital Markets Act for unlicensed investment advisory or brokerage activity.
Compliance Costs vs. Criminal Liability:
A Survival Dilemma for Startups
For many borderline businesses, compliance is not merely difficult — it may be economically impossible.
To obtain VASP registration under Korean law, companies must secure ISMS certification and establish robust anti-money laundering (AML) systems. Initial implementation alone requires significant capital investment, with annual maintenance costs reaching hundreds of millions of won.
The most formidable hurdle, however, is securing a real-name verified bank account, which remains effectively unattainable for most startups. Commercial banks, wary of AML risks, continue to apply extremely conservative standards.
Yet non-compliance is not an option. Operating without registration may result in criminal penalties of up to five years’ imprisonment or fines of up to KRW 50 million, alongside business suspension and long-term exclusion from financial services — consequences tantamount to forced closure.
As one industry insider put it, “If we try to comply, we run out of money and hit the banking wall. If we do nothing, we become criminals.”
“Business Models Must Be Legally Re-Engineered”
Legal experts caution that the regulatory environment has moved beyond the question of whether a company is technically subject to VASP registration.
Jin Hyeonsu, Managing Partner at Decent Law Firm, explains:
“Recent regulatory trends reflect a more sophisticated approach — one that evaluates the substantive function and legal nature of a business model rather than its formal label.”
He adds:
“For referral marketers, trading signal groups, and infrastructure providers, AML Act issues often overlap with Capital Markets Act risks relating to unregistered investment advice or brokerage. In this transitional regulatory phase, reactive measures are no longer sufficient. Only proactive legal structuring and compliance design can ensure business sustainability.
As the crypto market matures, the line between innovation and illegality continues to blur. Under an increasingly assertive regulatory regime, businesses operating in gray zones now face an unavoidable imperative:
establish clear legal positioning — or risk being pushed out of the market altogether.
