South Korea's FSC Orders 24/7 Monitoring, Suspicion-Based Freeze Powers for Exchanges

South Korea's Financial Services Commission (FSC) has issued emergency guidelines requiring every virtual asset service provider (VASP) in the country to maintain round-the-clock system monitoring, with staff specifically assigned to detect suspicious activity, including unusually large transactions. The rules, which function as a bridge to the forthcoming Digital Asset Act, also grant exchanges a no-action letter mechanism allowing them to freeze deposits and withdrawals on suspicion of a breach, without waiting for a confirmed hack.

A no-action letter is, in effect, a regulatory assurance that a firm will not face penalties for a specific action. That design choice matters. It lowers the legal risk for exchanges that act quickly, but it also shifts the burden of judgment onto the exchanges themselves. The FSC has not specified, at least in the material released so far, what evidentiary threshold constitutes sufficient "suspicion" before funds are locked. In plain words: exchanges can now pull the emergency brake first and justify it later.

What the guidelines actually require?

The obligations fall into three areas:

• Continuous monitoring. Each VASP must deploy dedicated staff watching for anomalies on a 24/7 basis, with immediate response protocols ready for suspicious activity such as unusual large transactions.
• Suspicion-based freezing. The no-action letter mechanism permits halting deposits and withdrawals based on suspected rather than confirmed security breaches.
• Cold storage maximization. Exchanges are directed to maximize the share of user assets held in offline cold wallets disconnected from the internet.

The monitoring requirement is the operational headline. Running a genuine 24/7 security desk means staffing three shifts, not one. For smaller VASPs, that is a recurring cost that scales poorly — a point the guidelines do not address.

Do exchanges already meet the cold storage bar?

Mostly, yes. The legal minimum under South Korea's Virtual Asset User Protection Act is 80 percent cold wallet storage. Industry figures from late 2026 put the average well above that floor, at over 95 percent.

The dispersion among major platforms is nonetheless real:

• Upbit reports cold wallet holdings above 99 percent.
• Bithumb sits at approximately 94–95 percent.
• Coinone holds around 85 percent.

Coinone clears the legal threshold with room to spare, yet it trails its two larger rivals by roughly ten to fourteen percentage points. Whether that gap reflects operational caution, liquidity needs, or hot wallet demand is not explained in the disclosed figures. The takeaway: the cold storage mandate will bind hardest on laggards, not the market leaders.

What changes under the Digital Asset Act?

The emergency guidelines are explicitly transitional. The Digital Asset Act, still in draft, would impose bank-level IT safety standards on VASPs and attach liability for damages — meaning exchanges could be held financially responsible when users lose money due to security failures.

That liability provision is the part with teeth, and it is also the part not yet written in final form. How courts interpret "security failure," and whether liability is capped, will determine whether the Act functions as genuine risk transfer to exchanges or as a litigation magnet. The FSC's stated aim is to pull crypto platforms closer to the operational standards of traditional financial institutions while reinforcing South Korea's position as a major trading hub — an implicit acknowledgment that fraud and theft incidents in the sector have continued to accumulate.

What are the consequences for users?

For users, the changes cut both ways. Continuous monitoring and faster freeze powers should, in principle, shrink the window an attacker has to drain funds. High cold storage ratios mean that even a successful hot wallet breach would expose only a small slice of total assets — at Upbit's reported ratio, less than one percent of holdings sit in internet-connected wallets.

The tradeoff is friction. Freeze powers triggered by suspicion alone mean users may occasionally find deposits and withdrawals temporarily locked over a false alarm. The FSC has not detailed a compensating mechanism or service-level standard for how quickly a mistaken freeze must be lifted.

Three variables will define the outcome: the final text of the Digital Asset Act's liability provisions, the frequency with which exchanges actually invoke the freeze mechanism, and whether Coinone closes its cold storage gap. Until the Act's final language lands, the emergency guidelines remain the operative rule set — enforceable now, but provisional by design.