-
BlogsCrypto Transfers to Self-Hosted Wallets: What Changes Under Korea’s Travel Rule in 2027?
Transfers from a Korean crypto exchange to a self-hosted wallet (personal wallet) such as MetaMask are not currently treated in the same way as Travel Rule transfers between virtual asset service providers (VASPs). However, following the August 2026 amendment to the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information, Korea will strengthen its AML requirements for virtual asset transfers. From February 19, 2027, the KRW 1 million threshold for the Travel Rule will be removed, and transactions involving overseas VASPs and self-hosted wallets will also become subject to separate risk-based AML requirements. For self-hosted wallet transactions, factors such as who actually owns or controls the wallet, whether the sender and recipient are the same person, the purpose of the transaction, and the flow of funds will become increasingly important. Does the Travel Rule Apply to Transfers to Self-Hosted Wallets? A transfer to a self-hosted wallet is not currently treated in the same way as a Travel Rule transfer between VASPs. Under Korea’s current Travel Rule framework, when a VASP transfers virtual assets worth KRW 1 million or more to another VASP, specified information regarding the sender and recipient must be provided. A self-hosted wallet such as MetaMask, however, is controlled directly by the user and is not itself a Korean VASP. Accordingly, withdrawals to self-hosted wallets should be reviewed not only from a Travel Rule perspective but also in light of the exchange’s AML obligations and wallet verification policies. Depending on the exchange, users may already be required to register a wallet address or verify ownership before making a withdrawal. Official Legislation Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information What Will Change for Self-Hosted Wallet Transactions in 2027? From February 19, 2027, virtual asset transfers involving self-hosted wallets will become subject to enhanced risk-based AML controls. The amended Enforcement Decree expands the obligations imposed on VASPs in connection with virtual asset transfers. The Financial Services Commission (FSC) has outlined the following regulatory approach. 🔹 Self-Hosted Wallet and Overseas VASP Transactions from 2027 Transaction Type Expected Regulatory Approach Low-risk overseas VASP Virtual asset transfers generally permitted Other overseas VASPs Generally permitted where the sender and recipient are the same person Self-hosted wallet Generally permitted where the sender and recipient are the same person High-risk transaction Transfer may be restricted or prohibited Transactions of KRW 10 million or more involving overseas VASPs or self-hosted wallets A separate suspicious transaction monitoring framework must be established and operated Accordingly, a withdrawal to a wallet controlled by the customer may be treated differently from a direct withdrawal to a wallet controlled by a third party. However, the detailed risk-assessment standards and implementation methods will need to be reviewed together with the relevant KoFIU regulations and the policies of individual exchanges. Official Source Financial Services Commission – August 11, 2026 What About Deposits from a Self-Hosted Wallet to a Korean Exchange? Deposits from a self-hosted wallet to a Korean exchange may also be subject to review. The amended framework covers transactions in which a VASP transfers virtual assets to, or receives virtual assets from, a self-hosted wallet. Accordingly, when virtual assets are deposited from a self-hosted wallet into a Korean exchange, factors such as the actual wallet owner, the source of funds, and the purpose of the transaction may become important. Where assets are repeatedly deposited from multiple wallets, it is advisable to retain transaction records showing the source and movement of the assets. Can the Travel Rule Be Avoided by Splitting Transfers Below KRW 1 Million? No. Splitting transfers into amounts below KRW 1 million does not place the transactions outside AML scrutiny. The current Travel Rule threshold for VASP-to-VASP transfers is KRW 1 million. From February 19, 2027, this threshold will be removed and the Travel Rule will apply regardless of the transfer amount. Even under the current framework, transactions below KRW 1 million are not automatically excluded from AML monitoring. The FSC has cited a case involving approximately KRW 200 million in virtual assets that was withdrawn through 216 separate transactions below KRW 1 million as an example of activity potentially intended to circumvent regulatory controls. Accordingly, factors such as repeated split transfers, wallet ownership, the source and movement of funds, and the purpose of the transaction may also be reviewed. Frequently Asked Questions (FAQ) Q1. Does the Travel Rule apply when I withdraw crypto to MetaMask? Not in the same manner as a transfer between two registered Korean VASPs under the current framework. However, exchange-specific wallet verification and AML requirements may still apply. From February 19, 2027, self-hosted wallet transactions will also become subject to enhanced risk-based AML controls. Q2. Can I withdraw less than KRW 1 million to a self-hosted wallet without restrictions? A transaction below KRW 1 million is not automatically excluded from AML monitoring. Repeated small withdrawals or transactions involving multiple wallets may still be reviewed based on the overall transaction pattern. In addition, the KRW 1 million Travel Rule threshold between VASPs will be removed from February 19, 2027. Q3. Will transfers to another person’s self-hosted wallet be prohibited? Not necessarily. A blanket prohibition on all transfers to third-party wallets has not been established. However, the Financial Services Commission has indicated that transactions involving self-hosted wallets will generally be permitted where the sender and recipient are the same person. The detailed scope of permitted transactions and exceptions will depend on implementing regulations and individual exchange policies. Q4. Will deposits from a self-hosted wallet to a Korean exchange also be subject to enhanced controls? Yes. The new framework applies not only to withdrawals but also to situations where a VASP receives virtual assets from a self-hosted wallet. The exchange may therefore review wallet ownership, transaction history, source of funds, and the purpose of the transfer. Q5. Does a transaction of KRW 10 million or more automatically trigger a Suspicious Transaction Report (STR)? No. A transaction does not automatically become reportable solely because it exceeds KRW 10 million. The announced framework requires VASPs to establish and operate a separate monitoring system for transactions of KRW 10 million or more involving overseas exchanges or self-hosted wallets. Whether an STR is ultimately required depends on the specific circumstances, including the source of funds, transaction purpose, transaction pattern, and counterparty. Prepare for the New Self-Hosted Wallet Rules Before February 2027 From February 19, 2027, Korea’s Travel Rule will apply to all transfers between VASPs regardless of amount, while risk-based AML controls for transactions involving self-hosted wallets and overseas VASPs will also be strengthened. For self-hosted wallet transactions, actual wallet ownership and control, whether the sender and recipient are the same person, the purpose of the transaction, and the flow of funds may become increasingly important. Businesses that use self-hosted wallets or overseas exchanges for recurring payments, transfers, or settlement should review their transaction structures and applicable regulatory requirements before the new rules take effect. Decent Law Firm advises clients on Korean virtual asset regulations, self-hosted wallet and overseas VASP transactions, Travel Rule compliance, and AML obligations under the Act on Reporting and Using Specified Financial Transaction Information.
2026-08-28 -
Blogs
Crypto Market Making in Korea: Legal Risks for Token Projects and Market Makers
Crypto market making is not automatically considered market manipulation under Korean law. However, the legal analysis does not stop at whether an agreement is labeled as a “market making” or “liquidity provision” arrangement. The key issue is how the trading strategy is actually structured and executed—particularly whether it is designed to artificially create trading volume, influence prices, or induce other investors to trade. For foreign token projects, foundations, and market makers engaging with Korean exchanges or Korean users, this means that the Market Making Agreement, trading instructions, API logic, token lending structure, and fee arrangements should be reviewed together. What Is Crypto Market Making? Crypto market making generally refers to the continuous placement of buy and sell orders in order to provide liquidity to a trading market. For newly listed or relatively illiquid virtual assets, limited order-book depth may result in wide bid-ask spreads and significant price movements even from relatively small orders. To address this, a token project may provide tokens or capital to a professional market maker, which then places buy and sell orders on one or more exchanges. A typical market making arrangement may include provisions concerning: Target exchanges and trading pairs Bid-ask spreads Liquidity or volume requirements Token lending and return arrangements Trading capital Service fees and performance-based compensation API or algorithmic trading systems The important point is that entering into a Market Making Agreement does not determine the legal characterization of the actual trading activity. What matters is how those contractual terms are implemented in the market. Is Crypto Market Making Legal in Korea? Crypto market making is not unlawful merely because liquidity is being provided to the market. However, actual trading activity may fall within Korea’s prohibition on unfair trading if it is intended to induce other investors to trade or to artificially influence trading volume or prices. Article 10 of Korea’s Act on the Protection of Virtual Asset Users prohibits, among other conduct: Matched orders Wash trades Transactions designed to create a false appearance of active trading Transactions intended to artificially move or stabilize the price of a virtual asset Other fraudulent or deceptive trading practices Accordingly, describing a trading arrangement as “liquidity provision” is not sufficient. The actual analysis may require reviewing: Who determines the trading strategy Whether specific price or volume targets are imposed Whether the token project participates in or directs trading decisions Whether the market maker’s compensation is linked to price or volume performance How orders, cancellations, and executions actually occur The distinction between legitimate liquidity provision and unlawful market manipulation therefore depends heavily on the purpose and structure of the actual trading activity. Act on the Protection of Virtual Asset Users – Article 10 What Market Making Structures May Create Higher Regulatory Risk? Market manipulation risk may increase where a market making arrangement goes beyond providing ordinary liquidity and instead seeks to artificially create a particular level of trading activity or price. 🔹Key Market Making Terms to Review Structure Key Legal Issue Minimum trading volume Whether volume is being artificially generated regardless of genuine market demand Target price Whether trading is intended to push the token toward a specified price Price floor or price band Whether the strategy constitutes ordinary liquidity provision or artificial price stabilization Repeated high-priced purchases Whether orders are intended to induce additional buying by other investors Multiple trading accounts Whether economically identical parties are trading against each other API trading How orders, cancellations, and re-orders are triggered Token lending How the market maker may use or dispose of the tokens and how they must be returned Performance fees Whether compensation is directly tied to price appreciation or increased trading volume A contractual requirement to maintain liquidity or a certain spread does not, by itself, establish unlawful conduct. The analysis may change, however, where the actual strategy involves repeated trades unrelated to genuine market demand, artificial volume generation, or continuous buying designed to defend a specific token price. The contractual KPI and the actual trading strategy should therefore be reviewed together. Can API or Algorithmic Market Making Create Market Manipulation Risk? The use of APIs or automated trading systems does not itself constitute market manipulation. Automated order placement is commonly used in market making because market makers must respond quickly to changing order-book conditions. The legal issue is what type of trading strategy has been automated. Additional review may be required where an automated strategy involves, for example: Repeated high-priced purchases Large orders followed by rapid cancellations Multiple accounts placing coordinated orders Repeated trades designed primarily to generate volume Orders designed to influence prices across multiple exchanges In July 2026, the Korean Financial Services Commission disclosed enforcement cases involving virtual asset market manipulation using high-frequency API trading, high-priced purchases, and manipulative order strategies. The significance of these cases is not that API trading itself is prohibited, but that the purpose, order pattern, and resulting market impact of the trading activity are subject to scrutiny. FSC – Key Results of Virtual Asset Unfair Trading Investigations What Should Be Reviewed in a Market Making Agreement? A Market Making Agreement should be reviewed not only for commercial terms, but also for how those terms may influence actual trading behavior. Trading Volume Requirements Where daily or weekly trading volume targets are imposed, the key issue is not simply the existence of a target. The review should determine how the market maker is expected to achieve the required volume and whether the strategy may result in transactions unrelated to genuine market demand. Price-Related Conditions Terms such as “maintain the price above a certain level,” “defend against price declines,” or “reach a target price” require particular attention. Ordinary spread management and trading intended to artificially maintain or influence a specific market price should not be treated as the same activity. Token Lending and Return Where a project provides a significant number of tokens to the market maker, the agreement should clearly address: Permitted use of the tokens Disposal authority Return obligations Settlement mechanics Allocation of trading profits and losses Performance Fees and Trading Authority Performance-based compensation should also be examined, particularly where fees are linked directly to token price appreciation or trading volume. In addition, even where the written agreement gives the market maker independent trading authority, actual instructions sent through Telegram, Slack, email, or other channels may become relevant if the project is directing specific price or volume outcomes. Is Reviewing the Market Making Agreement Alone Sufficient? No. The agreement and the actual operating structure should be reviewed together. A contract may simply refer to “liquidity enhancement,” “spread maintenance,” or “market making services.” Actual communications or trading instructions, however, may contain materially different expectations concerning price support or volume generation. For this reason, a legal review may need to cover not only the agreement itself but also: Market Making Agreement and side letters Internal operating guidelines and KPIs Exchange order and execution records API logic and trading parameters Trading-account structure Token and fund transfers Telegram, Slack, email, and other trading instructions Fee and performance compensation arrangements The key issue is not only what the contract says, but how the contractual terms are implemented through actual orders and executions. Do Korean Rules Apply to an Offshore Market Maker? Using an offshore market maker does not automatically exclude the application of Korean law. Article 3 of the Act on the Protection of Virtual Asset Users provides for extraterritorial application where conduct outside Korea produces effects within Korea. Accordingly, Korean regulatory exposure should be considered where, for example: Market making is performed on a Korean exchange A token is listed on both Korean and overseas exchanges Trading on an offshore exchange is used to influence the Korean market A Korean project directs an offshore market maker regarding price or volume Korean regulators have also investigated cases involving virtual assets listed simultaneously on Korean and foreign exchanges where trading activity across markets was allegedly used to influence Korean investors. Depending on the exact scope of services, it may also be necessary to consider whether the market maker’s activities raise separate issues under Korea’s virtual asset service provider regulatory framework. Act on the Protection of Virtual Asset Users What Should Be Reviewed Before Entering into a Market Making Arrangement? Before entering into a Market Making Agreement, the project and market maker should align the contractual terms with the anticipated trading structure. 1. Roles and Trading Authority Determine who establishes the trading strategy and who has authority to execute orders. 2. Price and Volume KPIs Review whether spread, liquidity, volume, or price-related KPIs may require problematic trading behavior in practice. 3. Token and Fund Flows Map how tokens and trading capital move from the project to the market maker and ultimately to exchange accounts. 4. Trading Method Determine whether trading will be manual, API-based, or algorithmic, and whether multiple accounts or exchanges will be used. 5. Compensation Structure Assess whether compensation is simply payment for liquidity services or is directly tied to price appreciation or increased trading volume. The relevant contracts, order logs, API records, internal instructions, and token transfer records should also be retained appropriately. These materials may become important if the trading activity is later reviewed by an exchange, regulator, or investigative authority. What Are the Consequences of Market Manipulation in Korea? Market manipulation involving virtual assets may lead to administrative sanctions, criminal liability, and civil damages. The Act on the Protection of Virtual Asset Users provides for monetary penalties in relation to unfair trading conduct and criminal penalties for violations of Article 10. The severity of sanctions may vary depending on factors including the amount of unlawful profit or avoided loss. The Financial Services Commission announced in July 2026 that, during the first two years following implementation of the Act, Korean authorities had completed approximately 40 unfair-trading investigations and referred or reported more than 30 cases to investigative authorities. Accordingly, market making structures should not be reviewed only after an enforcement issue arises. Potential unfair-trading exposure should be assessed at the contract and trading-structure stage. FSC – Key Results and Future Plans for Virtual Asset Unfair Trading Investigations Frequently Asked Questions (FAQ) Q1. Is using a crypto market maker illegal in Korea? No. The use of a market maker does not itself establish market manipulation. The actual trading strategy, purpose, project involvement, and price or volume conditions must be reviewed. Q2. Can a Market Making Agreement require a minimum trading volume? A minimum volume requirement is not automatically unlawful. However, if the target is achieved through transactions intended to create an artificial appearance of active trading, the arrangement may raise unfair-trading concerns. Q3. Can a project ask a market maker to maintain a minimum token price? Price-support or price-floor arrangements require particular caution. Korean law prohibits certain transactions conducted for the purpose of inducing other investors to trade by artificially moving or stabilizing the market price. Q4. Is API-based market making considered market manipulation? No. The use of an API itself is not prohibited. The relevant issue is whether the automated strategy is designed to artificially generate volume, influence prices, or induce other investors to trade. Q5. Does Korean law apply to foreign market makers? It may. Where offshore trading produces effects in Korea, including through Korean exchange markets or Korean investors, the potential application of Korean virtual asset regulations should be reviewed. Market Making in Korea Requires More Than Contract Review The central legal issue in crypto market making is not whether a contract describes the activity as “liquidity provision.” The key questions are how orders are actually generated, what objectives the project gives to the market maker, and what price and trading volume are ultimately created by the strategy. Where price targets, volume KPIs, API trading, token lending, and performance compensation are combined, the legal analysis should cover both the written agreement and the actual operating structure.
2026-08-27 -
Blogs
Voice Phishing Cash Collection Agent Penalties in Korea: What If You Thought It Was Just a Part-Time Job?
In voice phishing cases involving cash collection agents, criminal liability is not determined solely by the fact that the person received and delivered cash. The key issue is whether the person knew that their actions were being used as part of a criminal scheme—in other words, whether criminal intent and participation in the scheme can be established. Even if a person started the job after being told through a recruitment website that it involved debt collection or document delivery, criminal liability may arise depending on the recruitment process, communication methods, actual job duties, and the manner in which cash was collected and transferred. 1．What Is a Voice Phishing Cash Collection Agent? A cash collection agent generally refers to a person who receives cash from a voice phishing victim and delivers it to the criminal organization. Under the current Act on Special Cases Concerning the Prevention of Damage from Telecommunications-Based Financial Fraud and Refund for Damage, Article 2, telecommunications-based financial fraud includes not only schemes in which victims are induced to transfer money to an account, but also schemes in which funds are collected directly from victims. Accordingly, even if a person did not personally make fraudulent calls or send deceptive messages to the victim, criminal liability may still arise if that person participated in collecting and transferring the victim’s cash. Relevant Law Act on Special Cases Concerning the Prevention of Damage from Telecommunications-Based Financial Fraud and Refund for Damage, Article 2 2．Can You Be Punished Even If You Only Collected and Delivered Cash? Yes. If criminal intent and participation in the voice phishing scheme are established, a cash collection agent may be held criminally liable even if they did not personally deceive the victim. The Supreme Court of Korea has held that a cash collection agent does not need to know the entire method of the fraud or the full structure of the criminal organization. Criminal intent and participation may still be established if the person at least recognized that they were collecting victims’ cash as part of a coordinated criminal scheme. Conversely, if the person genuinely did not know that their conduct was being used for criminal activity, criminal intent may not be established. Therefore, investigators and courts do not rely solely on a statement such as “I did not know.” They examine the objective circumstances surrounding the work Relevant Case Supreme Court of Korea, December 12, 2024, Case No. 2024Do10141 3．How Do Courts Assess a Claim That “I Thought It Was Just a Part-Time Job”? Courts consider the recruitment process, actual job duties, and other surrounding circumstances to determine whether the person was aware that the work was connected to criminal activity. 🔹Key Factors in Determining Criminal Intent Factor What May Be Examined Recruitment process Whether there was a normal interview or identity verification process Contractual relationship Whether an employment or service agreement was properly executed Communication method Whether instructions were given only through anonymous services such as Telegram Actual duties Whether the person was instructed to collect large amounts of cash from strangers Interaction with victims Whether the person was instructed to impersonate an employee of a financial institution or another company Transfer method Whether the collected cash was divided and transferred through multiple transactions Frequency and amount Whether large amounts of cash were collected repeatedly Compensation Whether the payment was unusually high compared with the nature of the work Personal circumstances Whether age, work experience, and social experience made it possible to recognize that the work was unusual No single factor automatically establishes criminal intent. The Supreme Court considers multiple circumstances together, including the content and method of communications with the organization, how the person was recruited, how the cash was collected, what was said or done to the victim, the number and amount of collections, the transfer method, compensation, and the individual’s personal and professional background. 4．What Are the Penalties for a Voice Phishing Cash Collection Agent? A person found to have participated in voice phishing as a cash collection agent may face criminal penalties. Under Article 15-2 of the Act on Special Cases Concerning the Prevention of Damage from Telecommunications-Based Financial Fraud and Refund for Damage, a person who commits telecommunications-based financial fraud may be punished by imprisonment for at least one year or a fine equivalent to three to five times the criminal proceeds, or both imprisonment and a fine. However, the same charge or sentence does not apply automatically to every cash collection agent. The applicable offense and actual sentence may differ depending on when the conduct occurred, the person’s degree of participation, the number and amount of collections, their actual role, whether the victim was compensated or a settlement was reached, and the person’s criminal record. The Sentencing Guidelines for Fraud Offenses issued by the Sentencing Commission of the Supreme Court of Korea also take into account factors such as minor or passive participation, substantial recovery of damages, and prior criminal history. Relevant Law Act on Special Cases Concerning the Prevention of Damage from Telecommunications-Based Financial Fraud and Refund for Damage, Article 15-2 5．What Should You Prepare If You Are Under Police Investigation as a Cash Collection Agent? Before the first police interview, it is important to organize the circumstances of your involvement and preserve objective evidence showing what you understood the job to be. If the key issue is whether you knew the work was connected to voice phishing, the following materials should be reviewed: Recruitment advertisements, text messages, and other recruitment and hiring records KakaoTalk, Telegram, text messages, and other communications containing work instructions Records showing when and where cash was received and how it was transferred, including cash collection and transfer records Compensation records and company-search history showing why you believed the work was legitimate Do not delete relevant chat records or transaction records after an investigation has begun. Decent Law Firm reviews the circumstances of the client’s involvement and the likelihood that criminal intent may be found, and assists with the response strategy from the police investigation stage. 6. Frequently Asked Questions (FAQ) Q1. If I am a first-time offender, can a cash collection agent case end with only a fine? A first offense does not guarantee that the case will result only in a fine. The actual sentence depends on factors such as the degree of participation, amount of loss, number of offenses, recovery of damages, and prior criminal history. Q2. Can I be punished if I collected or delivered cash only once? Yes. Even a single act may result in criminal liability if criminal intent and participation in the scheme are established. However, the number and amount of collections are only some of the factors considered. The circumstances under which the person accepted the job and what they understood at the time must also be reviewed. Q3. Can I be treated as an accomplice even if I never met anyone from the voice phishing organization? Yes. The fact that you never personally met an organizer does not, by itself, exclude criminal participation. The Supreme Court has held that a coordinated criminal relationship may be established even without an express meeting or detailed agreement, including where the participants’ intentions were connected sequentially or implicitly. Q4. If I settle with the victim, will I avoid punishment? A settlement does not automatically terminate the criminal case. However, substantial recovery of damages or the victim’s request for leniency may be considered favorably during sentencing. Q5. Can I simply tell the police that I did not know it was voice phishing? Simply stating that you did not know may not be sufficient. The investigation may examine objective circumstances such as the recruitment process, communications, cash collection method, transfer method, compensation, and frequency of the transactions. 7. Summary and Key Considerations The central issue in a voice phishing cash collection case is whether the person knew that their conduct was being used as part of a criminal scheme. Even without detailed knowledge of the entire organization or fraud method, criminal liability may arise if implied awareness and participation are established. If you are facing a police investigation, the circumstances of the case and available evidence should be reviewed from the outset to determine whether criminal intent may be established and how the investigation should be handled. ※ The applicable law and potential criminal liability may vary depending on the date of the conduct and the specific facts of each case.
2026-08-27 -
Blogs
Crypto Market Manipulation in Korea: Penalties and Legal Standards for Spoofing and High-Priced Buy Orders
A sharp increase in a cryptocurrency’s price or a large volume of trades by a single trader does not, by itself, constitute market manipulation under Korean law. The key issue is whether the trader intentionally created artificial trading volume or price movements in order to induce other investors to trade. Korea’s Act on the Protection of Virtual Asset Users prohibits matched orders and wash trades, as well as transactions intended to make the market appear more active than it actually is or to artificially move or stabilize the price of a virtual asset. Accordingly, even where high-priced buy orders, spoofing, multiple accounts, or API-based automated orders are identified, the legal analysis should not focus on a single type of order alone. The overall trading pattern—including the purpose of the trades, order and execution history, pre-existing holdings, and subsequent sales—must be reviewed as a whole. Legal Standards for Crypto Market Manipulation in Korea Article 10 of the Act on the Protection of Virtual Asset Users prohibits transactions such as matched orders and wash trades when conducted for the purpose of misleading others into believing that trading is more active than it actually is or otherwise causing investors to make incorrect judgments. The Act also prohibits transactions intended to induce others to trade by creating the appearance of active trading or by artificially moving or fixing the price of a virtual asset. Act on the Protection of Virtual Asset Users, Article 10 Therefore, the focus is not simply on whether trading volume was large or whether the price moved significantly. What matters is why the orders were placed, whether there was a genuine intention to execute them, and whether multiple orders formed part of a coordinated trading strategy. How Are Spoofing and High-Priced Buy Orders Assessed? The presence of high-priced buy orders or spoofing does not automatically establish market manipulation. However, market manipulation may become an issue where such trading patterns are repeated and are accompanied by the disposal of previously accumulated holdings after the price rises. Type of Trading Key Points to Review High-priced buy orders Whether repeated buy orders were used to push the market price upward Spoofing Whether large orders were repeatedly placed and cancelled without a genuine intention to execute Matched orders Whether the parties agreed in advance on the price, quantity, or timing of the trades Wash trades Whether trading volume was created without any meaningful transfer of economic ownership Multiple-account trading Whether multiple accounts traded in coordinated or repetitive patterns API-based trading Whether automated orders were used to artificially create trading volume or price movements In particular, if the trading structure follows a pattern such as accumulation → price formation → disposal of holdings → realization of profits, authorities may review the entire series of transactions rather than treating each order in isolation. What Is the Difference Between Ordinary Trading and Market Manipulation? Buying cryptocurrency before a price increase and selling it later at a profit does not, by itself, amount to market manipulation. When determining whether trading crossed the line into unlawful market manipulation, the following factors may be considered: whether a large position was accumulated before the price increase; whether high-priced or unusually large orders were repeatedly placed; whether orders were repeatedly cancelled after being submitted; whether multiple accounts or API-based systems traded in a coordinated manner; whether substantial holdings were sold immediately after the price increased; and whether communications with other traders or the underlying trading strategy were connected to the actual order pattern. Ultimately, the key question is whether the trader intended to induce other investors to trade by artificially influencing the market price or trading volume, and whether the trading records support that conclusion. What Are the Penalties for Crypto Market Manipulation in Korea? Under Article 19 of the Act on the Protection of Virtual Asset Users, a person who engages in prohibited market manipulation may be subject, in principle, to imprisonment for at least one year or a fine equal to three to five times the profit gained or loss avoided through the violation. 🔹Penalties Based on the Amount of Profit or Loss Avoided Profit Gained or Loss Avoided Statutory Penalty Less than KRW 500 million In principle, imprisonment for at least one year or a fine equal to 3–5 times the profit gained or loss avoided KRW 500 million or more but less than KRW 5 billion Imprisonment for at least 3 years KRW 5 billion or more Life imprisonment or imprisonment for at least 5 years Where imprisonment is imposed, the court may also impose disqualification for up to ten years and a fine. Act on the Protection of Virtual Asset Users, Article 19 In addition to criminal penalties, market manipulation may also result in administrative monetary penalties under Article 17 of the Act. Assets obtained through the unlawful conduct may also be subject to confiscation or collection of equivalent value. Act on the Protection of Virtual Asset Users, Article 17 What Should You Do If You Are Investigated for Market Manipulation? If you are contacted by Korean financial regulators or investigative authorities, it is important to review the entire trading structure during the relevant period, rather than attempting to explain only the particular orders identified by the authorities. Key materials may include: complete buy and sell records for each exchange; order placement, cancellation, and execution history; virtual asset holdings before and after the relevant period; exchanges and accounts used for trading; API logs and automated trading program records; use of accounts or API keys belonging to other persons; communications with other traders; and the source of trading funds and the ultimate recipient of any profits. In market manipulation investigations, objective trading records such as order and execution data can become central evidence. Before responding to investigators, it is therefore important to confirm whether your explanation is consistent with the actual trading records and to prepare a clear, evidence-based explanation of why the orders were placed and what the underlying trading strategy was. Frequently Asked Questions (FAQ) Q1. Can a Single High-Priced Buy Order Constitute Market Manipulation? Not necessarily. A single high-priced buy order does not automatically amount to market manipulation. The purpose of the order, whether similar orders were repeated, market conditions at the time, the size of the trade, and any subsequent sale of the trader’s holdings may all be relevant. Q2. Can I Be Punished Even If I Did Not Make a Profit? Yes. The law prohibits the market manipulation itself, so the absence of actual profit does not necessarily eliminate criminal or regulatory liability. Q3. Is API-Based or Automated Crypto Trading Illegal in Korea? No. The use of APIs or automated trading systems is not illegal in itself. However, if such systems are used to repeatedly place artificial orders, engage in matched trading, or create misleading trading volume or price movements, the conduct may be investigated as market manipulation. Q4. Can Investors Who Suffered Losses Claim Damages? Potentially, yes. However, the existence and scope of civil liability will depend on issues such as causation between the manipulative conduct and the investor’s loss, as well as the timing and price of the relevant transactions. Market Manipulation Investigations Require a Trading-Record-Based Response A sharp increase in a crypto asset’s price or a large trading volume does not automatically establish market manipulation. The central issue is whether trading volume or price movements were artificially created for the purpose of inducing other investors to trade. If you have been contacted by Korean financial regulators, police, or prosecutors, you should first organize your order and execution history, API records, account relationships, and fund flows, and prepare to explain the purpose of the trades based on objective evidence. Decent Law Firm can review your trading records and develop a tailored strategy for responding to a crypto market manipulation investigation in Korea.
2026-08-24 -
Blogs
Foreign Trade Act Violations: When Rerouting Used Car Exports to Russia Becomes a Legal Problem, and How to Respond
1. Why Does Exporting Used Cars to Russia Raise Legal Issues? Not all used-car exports bound for Russia are uniformly prohibited, but a significant number of vehicles currently fall under situational licensing requirements, so item-by-item verification is necessary. Under Article 19-3 of the Foreign Trade Act, even goods that are not strategic items must obtain a situational license if there are certain grounds to believe they may be used or diverted for the manufacture, development, use, or storage of weapons of mass destruction and their delivery systems. Here, "strategic items" refers to goods and technologies separately designated as subject to export controls for the sake of international peace and national security. The law also identifies circumstances that must be checked in connection with situational licensing, such as when the price or payment terms fall outside the normal range, when the transport route is abnormal, or when it is unclear whether the goods will be used in the importing country or re-exported. [Foreign Trade Act Article 19-3 – Situational Licensing] This situational licensing system is also significant for export controls on Russia and Belarus, because a separate list of items subject to situational licensing currently applies specifically to those two countries. In February 2024, the criteria for situational licensing on automobiles exported to Russia were tightened, bringing passenger vehicles with an engine displacement over 2,000cc, among others, within scope. The current list of covered items includes a wide range of vehicles depending on their power source and HS code. The Korea Customs Service has likewise identified illegal exports of vehicles over 2,000cc to Russia as a key enforcement target. Korea's Trade Security Management Agency has also advised that exports of items subject to situational licensing for Russia and Belarus are prohibited in principle, and that a license is granted only after review in limited exceptional cases. Therefore, in an actual export transaction, the HS code, engine displacement, vehicle type, and detailed specifications of each vehicle must be individually checked against the notice that was in effect at the time of that export. 2. Does Exporting to Kyrgyzstan Avoid a Foreign Trade Act Violation? The mere fact that a vehicle was exported to Kyrgyzstan or Kazakhstan does not, by itself, constitute a violation of the Foreign Trade Act. Conversely, simply changing the destination stated on the export declaration to a third country does not allow an exporter to avoid Russia-related export controls, either. If a local Kyrgyz company genuinely purchased the vehicle for use within that country, this legitimate transaction must be distinguished from a circumvention export to Russia. However, the conclusion may differ if the actual Russian buyer was already determined from the outset of the deal, or if the exporter knew that the vehicle was to be moved on to Russia through a third-country intermediary. In March 2026, the Korea Customs Service disclosed, as a major type of detected violation, cases in which exporters declared vehicles as being exported to countries neighboring Russia such as Kazakhstan and Kyrgyzstan, but then actually brought the vehicles into Russia. The Customs Service also stated that, in addition to this method, it detected cases where vehicles over 2,000cc were falsely declared as being 2,000cc or under, and cases where new vehicles intended for the domestic market were disguised as used cars and declared as being exported to a third country. Accordingly, in an actual investigation, the key issue may not be limited to the destination country stated on the export declaration; the vehicle's actual final destination, judged from the transaction as a whole, can become the central point of contention. Key Points to Check When Assessing a Possible Circumvention Export to Russia Item to Check Key Points for Review Destination on the export declaration Whether the declared country matches the actual final destination Overseas buyer Whether the third-country company was the real buyer or merely an intermediary End user Who was actually intended to use the vehicle Contract, invoice, and B/L Whether the transaction structure on paper matches the actual transaction Vehicle's transport route Whether the vehicle moved on to Russia after arriving in the third country Transaction-related communications Whether there were communications about shipment to Russia or a Russian buyer Flow of funds Whether the contractual buyer matches the party that actually paid Ultimately, the mere fact that a transaction passed through a third country cannot, on its own, determine whether it was unlawful. It must be specifically determined whether the deal was a genuine third-country transaction or a structure designed to evade Russia-related export controls. 3. How Do Investigative Authorities Determine Whether a Circumvention Export Occurred? Customs and investigative authorities do not rely on a single export declaration alone. They may also review a range of other materials that can reveal the vehicle's actual movement and the structure of the transaction. The Korea Customs Service has stated that it currently uses AI and big data, based on export declaration records and cargo information, to identify companies at high risk of illegally exporting vehicles to Russia, and that it is strengthening cooperation between its dedicated trade-security investigation unit and other relevant agencies such as the Ministry of Trade, Industry and Energy. Therefore, once an investigation begins, the authorities can confirm the actual transaction structure and final destination through materials such as the following. Export declaration certificates for each vehicle Sales contracts and invoices Bills of lading and other shipping documents Emails and messenger records exchanged with overseas buyers Records of the vehicle's shipment and movement Records relating to the overseas buyer and final consignee Domestic and international remittance and payment records Transaction data stored on mobile phones and work computers In particular, even if the export declaration listed the transaction as being with Kyrgyzstan or Kazakhstan, if other materials show that the price was negotiated directly with a Russian buyer, or that shipment and transport were discussed on the premise of arrival in Russia, the investigative authorities may challenge the actual transaction structure. Conversely, if the vehicle was genuinely sold to an independent third-country company and the exporter was not aware, at the time of export, that it would be re-exported to Russia, it is necessary to organize the contractual relationships and transaction records that support this. In actual legal determinations as well, specific transactional circumstances — such as the transport route, price and payment terms, and whether the goods were used in or re-exported from the importing country — play an important role. Therefore, rather than simply explaining during an investigation that "I didn't know it was going to Russia," it is necessary first to examine what the contracts, communications, and flow of funds from that time actually show about the transaction. 4. What Penalties Can Apply If a Foreign Trade Act Violation Is Detected? Exporting or filing an export declaration for an item subject to situational licensing without obtaining that license can be subject to criminal punishment. Under the current Foreign Trade Act, Article 53(2) provides that a person who exports or files an export declaration for an item subject to situational licensing under Article 19-3 without obtaining that license shall be punished by imprisonment for up to five years or a fine of up to three times the value of the exported goods. [Foreign Trade Act Article 53 – Penalty Provisions] In addition, if a person exports an unlicensed item subject to situational licensing with the intent to promote the international proliferation of strategic items, imprisonment for up to seven years or a fine of up to five times the value of the goods may apply under Article 53(1) of the same Act. However, the seven-year imprisonment provision does not automatically apply to every Foreign Trade Act violation case. It must be separately confirmed whether the requirements of that specific provision are met, such as whether there was intent to promote international proliferation. Furthermore, if a person files an export declaration and actually exports goods without having obtained the required situational license, the offense of unlawful export under the Customs Act may be at issue together with the Foreign Trade Act violation. Article 270(3) of the Customs Act punishes exporting goods without satisfying the licensing or other conditions required by law, or satisfying those conditions through fraudulent means. [Customs Act Article 270] Therefore, when assessing the possibility of punishment, it is necessary to look not only at the export value, but also at whether the vehicle was subject to situational licensing at the time of export, who the actual buyer was and what the final destination was, and how the exporting company perceived these facts. 5. What Should You Do If You Have Already Exported, or Have Been Contacted by Customs or the Police? If an investigation has already begun, the first step is to identify the vehicles at issue and organize, vehicle by vehicle, the regulations that applied at the time of each transaction along with the actual transaction structure. It is advisable to organize the materials in the following order. ① First, identify the vehicles at issue Based on the export declaration certificate, organize information such as the vehicle registration number, vehicle type, engine displacement, HS code, export date, and destination country. Even vehicles exported by the same company cannot automatically be assumed to be subject to the same regulations, so each vehicle needs to be reviewed individually. ② Confirm the situational licensing rules that applied at the time of export The list of items subject to Russia-related situational licensing has been expanded several times. Current standards should therefore not be applied retroactively to past exports; whether an item is covered must instead be checked against the Public Notice on the Export and Import of Strategic Items that was in effect on the actual export date of each vehicle. ③ Organize the actual transactional relationship with the third-country buyer You should confirm who the buyer was under the contract, who actually paid for the vehicle, and whether the third-country company is a genuinely operating business. In particular, if the issue is whether the overseas counterparty merely served as a paper consignee, it is necessary to secure materials that can demonstrate the actual transaction. ④ Review communications and shipping records from the time of the transaction Rather than arbitrarily deleting or altering KakaoTalk, Telegram, WhatsApp, or email records, it is important to preserve them so that the circumstances of the transaction at the time can be verified. Invoices, bills of lading, and shipping records should also be organized together. ⑤ Organize the facts for each vehicle before questioning When multiple transactions are at issue, giving statements without distinguishing the transaction history of each individual vehicle can result in explanations that differ from what actually happened. Therefore, before questioning, you should at least separately organize, for each vehicle, whether it was subject to regulation, the buyer, the party who paid, the destination country, its subsequent travel route, and related communications. If you have already received a summons from customs or the police, or a search and seizure has taken place, you should not merely prepare an explanation that you "exported normally to Kyrgyzstan." Instead, you should first review which aspects are likely to become contested issues between the materials the investigative authorities have obtained and the actual transaction structure. 6. Frequently Asked Questions (FAQ) Q1. If a vehicle exported to Kyrgyzstan later ends up in Russia, will I automatically be punished? Not necessarily. A case in which the vehicle was genuinely sold to a Kyrgyz company that later resold it to Russia on its own initiative must be distinguished from a case in which the transaction was routed through Kyrgyzstan from the outset on the premise that it would be sold to Russia. Both the exporter's understanding of the final destination and the actual transaction structure must be examined together. Q2. Customs hasn't contacted me yet — can I review my past transactions in advance? Yes, you can. In particular, if you are continuing to export used cars to countries neighboring Russia, it is advisable to check in advance which vehicles in your past transactions were subject to situational licensing, and whether your end-user verification and transaction documentation are sufficient. For transactions currently in progress, it is necessary to confirm the item classification and whether a situational license is required before export. Q3. After a search and seizure, what should I do first? You should first check the alleged offenses and items listed in the warrant, as well as the materials actually seized. After that, you need to identify the vehicles and transactions at issue and compare the materials obtained by the investigative authorities with what actually happened, in order to organize your approach to giving statements before questioning. 7. Summary and Key Takeaways The mere fact that a vehicle was exported to a country neighboring Russia does not, by itself, establish a violation of the Foreign Trade Act. However, if a third country was used from the outset merely as a nominal destination on the premise that the goods would ultimately go to Russia, the investigation may extend beyond the contents of the export declaration to cover the actual buyer, the final destination, the flow of funds, and the entire transaction process. In these cases, it is important to review, vehicle by vehicle, both the regulations that applied at the time of export and the actual transaction structure. In particular, if you are facing an upcoming customs or police investigation, you should first organize how your contracts, invoices, shipping records, payment records, and messenger communications connect to the actual transaction. Decent Law Firm reviews all of these factors together — whether the vehicles at issue were subject to situational licensing, the actual transaction structure, the exporter's awareness of the final destination, and the materials obtained by the investigative authorities — to promptly work out a response strategy. If you have already received a summons to appear or a search and seizure has taken place, we recommend seeking professional assistance before your first round of questioning to organize the specific facts and prepare your response.
2026-08-20 -
Blogs
Domestic Agent Requirements for Overseas Businesses under Korea’s PIPA
If your company is headquartered outside Korea and provides SaaS, platform, e-commerce, AI, or other online services to users in Korea, Korea’s Personal Information Protection Act (PIPA) may apply to your processing of personal information. Certain overseas businesses are required to appoint a domestic agent in Korea. Since October 2, 2025, the rules have become more stringent. If an overseas business has a qualifying Korean corporation that it established or over which it exercises dominant influence, it must appoint its domestic agent from among those Korean corporations. The overseas headquarters is also required to manage and supervise the domestic agent. 1. Can Korea’s PIPA Apply to an Overseas Business? Yes. An overseas business may be subject to Korea’s PIPA when it provides goods or services to data subjects in Korea or when its processing of personal information affects data subjects in Korea. The fact that a company does not have a Korean subsidiary, or that its servers and data-processing infrastructure are located outside Korea, does not by itself place the company outside the scope of Korean privacy regulation. Overseas SaaS providers, online platforms, AI services, gaming companies, content providers, and e-commerce businesses that process account information, payment information, access data, or other personal information of users in Korea should assess whether PIPA applies to their operations. The Personal Information Protection Commission (PIPC), Korea’s data protection authority, has also issued guidance specifically for foreign businesses on compliance with PIPA, including privacy policies, data breach notification, data subject rights, cross-border transfers, and the appointment of a domestic agent. PIPC – Guidelines on Applying the Personal Information Protection Act to Foreign Business Operators 2. Which Overseas Businesses Must Appoint a Domestic Agent? Not every overseas business is required to appoint a domestic agent. Under Article 31-2 of the Personal Information Protection Act and Article 32-3 of the Enforcement Decree of the Personal Information Protection Act, a personal information controller without an address or place of business in Korea must appoint a domestic agent if it falls within any of the following categories. 🔹 When Is a Domestic Agent Required? Category Threshold Annual revenue Total revenue for the previous year of KRW 1 trillion or more Number of data subjects in Korea Personal information of an average of at least 1 million data subjects in Korea per day was stored or managed during the three months immediately preceding the end of the previous year PIPC determination The business has received a request to submit materials and the PIPC determines, through deliberation and resolution, that appointment of a domestic agent is necessary The revenue threshold is based on the business’s total worldwide revenue for the previous year, not only revenue generated in Korea. Foreign-currency revenue is converted into Korean won using the average exchange rate for the previous year. Accordingly, a global business should not assume that it is exempt simply because its Korean revenue is relatively small. Its worldwide revenue and the scale of personal information it processes in Korea should both be reviewed. Article 31-2 of the Personal Information Protection Act – Appointment of Domestic Agent Article 32-3 of the Enforcement Decree – Scope of Businesses Required to Appoint a Domestic Agent 3. If an Overseas Business Has a Korean Corporation, Must It Appoint That Corporation as Its Domestic Agent? If the overseas business is required to appoint a domestic agent and has a Korean corporation that meets the statutory requirements, the domestic agent must be appointed from among those qualifying Korean corporations. Since October 2, 2025, Article 31-2 of PIPA requires an overseas business to appoint its domestic agent from among Korean corporations that it has established or over which it exercises dominant influence. The relevant Korean corporations include: a Korean corporation established by the overseas business; a Korean corporation whose representative director may be appointed or removed by the overseas business; a Korean corporation in which the overseas business appoints, or has the authority to appoint, at least 50% of the officers; or a Korean corporation in which the overseas business holds at least 30% of the total issued shares or total capital contributions. The latter criteria are further defined in Article 32-3 of the Enforcement Decree. Accordingly, where an overseas business subject to the domestic-agent requirement has one or more subsidiaries or affiliated companies in Korea, it should review its ownership structure, governance rights, and appointment authority before determining which entity should serve as the domestic agent. A six-month transitional period was provided for businesses that had already appointed a domestic agent when the amended law took effect. That transitional period has now expired. Article 31-2 of the Personal Information Protection Act – Appointment of Domestic Agent Article 32-3 of the Enforcement Decree – Qualifying Korean Corporations and Supervision Requirements Supplementary Provision, Article 2 – Transitional Measure for Appointment of Domestic Agents 4. What Does a Domestic Agent Do? A domestic agent is not merely a local contact point. It must perform specific functions required under PIPA. A domestic agent is responsible for handling matters including: complaints and remedies relating to the processing of personal information; notification and reporting of personal information breaches; and responding to requests from the PIPC for the submission of documents, records, and other materials. The overseas business must also disclose specified information about its domestic agent in its privacy policy, including the agent’s name or corporate name, representative, address, telephone number, and email address. If the domestic agent violates PIPA while performing these statutory functions, the violation is treated as an act of the overseas personal information controller itself. For this reason, businesses should not treat the appointment as a documentation exercise. The domestic agent should be capable of responding in practice to requests from users in Korea, data breach incidents, and regulatory inquiries from the PIPC. Article 31-2 of the Personal Information Protection Act – Appointment and Duties of Domestic Agent 5. Must the Overseas Headquarters Manage and Supervise the Domestic Agent? Yes. An overseas business that appoints a domestic agent is also required to manage and supervise the agent’s performance of its duties. The Enforcement Decree requires the overseas personal information controller to take measures including: providing relevant training to the domestic agent at least once a year; checking whether the domestic agent has established a work plan; reviewing whether that work plan has been properly implemented; and confirming that any issues identified during the review have been corrected. This means that the compliance obligation does not end once a domestic agent has been formally appointed. The overseas headquarters should establish practical procedures for handling privacy-related inquiries, responding to personal information breaches, communicating with the PIPC, and obtaining the documents and information needed for regulatory responses in Korea. Article 32-3 of the Enforcement Decree – Management and Supervision of Domestic Agents 6. What Are the Consequences of Failing to Comply with the Domestic Agent Requirements? Administrative fines may be imposed if an overseas business fails to appoint a domestic agent or fails to comply with the statutory appointment, disclosure, or supervision requirements. The current administrative fine schedule includes the following. 🔹 Key Administrative Fines Violation Administrative Fine Failure to appoint a required domestic agent KRW 20 million Failure to appoint a domestic agent from among the qualifying Korean corporations KRW 20 million Failure to properly manage and supervise the domestic agent KRW 20 million Failure to disclose required domestic-agent information in the privacy policy Amount varies depending on the number of violations For failure to disclose the required domestic-agent information in the privacy policy, the current Enforcement Decree provides for fines of KRW 2 million for a first violation, KRW 4 million for a second violation, and KRW 8 million for a third or subsequent violation. In addition, appointing a Korean corporation or an external service provider as a domestic agent does not transfer the overseas headquarters’ liability under PIPA to that agent. Article 75 of the Personal Information Protection Act – Administrative Fines Enforcement Decree, Appendix 2 – Standards for Administrative Fines 7. What Should an Overseas Business Review Before Appointing a Domestic Agent? The first step is not simply choosing a domestic agent. The business should determine whether the appointment requirement applies to its operations and corporate structure in Korea. Key points to review include: whether the business processes personal information of data subjects in Korea; whether the overseas headquarters can be regarded as having an address or place of business in Korea; whether its total worldwide revenue meets the statutory threshold; the scale of personal information relating to data subjects in Korea that it stores or manages; whether it has established, or exercises dominant influence over, a Korean corporation; whether its current domestic agent can actually perform the duties required under PIPA; whether the required domestic-agent information is accurately reflected in the privacy policy; and whether appropriate training, monitoring, and reporting procedures are in place between the overseas headquarters and the domestic agent. For global groups with multiple Korean affiliates, the analysis should go beyond shareholding percentages. Rights relating to the appointment of the representative director and other officers may also affect which Korean corporation must be appointed. 8. Frequently Asked Questions (FAQ) Q1. If our revenue in Korea is below KRW 1 trillion, are we exempt from appointing a domestic agent? Not necessarily. The KRW 1 trillion threshold refers to total revenue, not only Korean revenue. In addition, a business may still be required to appoint a domestic agent if it stores or manages personal information of an average of at least 1 million data subjects in Korea per day during the relevant three-month period, or if the PIPC determines that a domestic agent is necessary after requesting the submission of materials. Q2. If we have a subsidiary in Korea, do we automatically have to appoint a domestic agent? No. The business must first determine whether it falls within the scope of businesses required to appoint a domestic agent under PIPA. If the requirement applies and the business has a Korean corporation that falls within the statutory categories, the domestic agent must then be appointed from among those qualifying Korean corporations. Q3. Can we appoint an external professional service provider as our domestic agent? Potentially, if the business does not have a Korean corporation that is required by law to serve as its domestic agent. If the overseas business has established a qualifying Korean corporation or exercises the level of dominant influence specified under PIPA and its Enforcement Decree, however, the agent must be selected from among those Korean corporations. Q4. Do we need to file a separate government registration after appointing a domestic agent? PIPA requires the domestic agent to be appointed in writing and requires specified information about the agent to be included in the business’s privacy policy. Accordingly, businesses should focus not only on preparing the appointment document but also on updating the privacy policy and establishing an operational framework that allows the domestic agent to perform its statutory duties. 9. Key Considerations for Overseas Businesses Appointing a Domestic Agent in Korea Appointing a domestic agent should not be treated as simply designating a local contact person in Korea. An overseas business should first determine whether it is subject to the domestic-agent requirement. If it has Korean subsidiaries or affiliated companies, it should also assess which entity must be appointed based on the statutory requirements. Once appointed, the domestic agent must be able to respond effectively to privacy complaints, personal information breaches, PIPC investigations, and requests for documents. The overseas headquarters must also maintain an appropriate management and supervision framework. Since the strengthened rules on appointing qualifying Korean corporations and supervising domestic agents took effect on October 2, 2025, businesses that appointed a domestic agent under the previous regime should also review whether their current appointment and operating structure remains compliant with the amended PIPA.
2026-08-19
