South Korea's FSC requires 24/7 monitoring from crypto exchanges

South Korea's Financial Services Commission announced emergency security guidelines on November 12, 2026 requiring virtual asset service providers to monitor their systems continuously, with dedicated personnel assigned to the round-the-clock watch. The rules also push exchanges toward maximum cold storage for customer assets and lay groundwork for bank-level IT standards under the forthcoming Digital Asset Act.

The timing is deliberate. The guidelines follow a significant security incident involving a hack at Binance, and they target the operational weakness such an event exposes: the hours when nobody is watching. South Korea's stated goal is to strengthen the country's position as a major crypto trading hub while raising consumer protections, as fraud and theft incidents keep piling up.

What does the FSC actually require?

• Continuous monitoring: every VASP needs staff specifically tasked with watching for trouble around the clock.
• Immediate response protocols for suspicious activity, including unusual large transactions.
• A no-action letter mechanism, which lets exchanges freeze deposits and withdrawals on suspicion of a breach rather than confirmed compromise; the letter supplies regulatory reassurance that the firm will not be penalized for that action.
• Cold storage maximization: exchanges should keep the largest share of user assets possible in cold wallets, offline systems disconnected from the internet.

The no-action letter is the sharpest instrument in the package, and also the most contestable. A freeze triggered by suspicion alone can lock legitimate withdrawals behind an internal alarm, so the burden shifts to exchanges to document the basis for each action.

What the available reporting does not specify matters as much as what it does. No penalty for non-compliance, minimum staffing level or implementation timetable appears in the material published, which leaves the practical enforcement window undefined. In plain terms, the rules bind on paper faster than they bind in practice, because the regulator has not said what failure to comply costs.

How much of customer money actually sits offline?

The legal minimum for cold wallet storage is 80%, set under South Korea's Virtual Asset User Protection Act, and industry figures from late 2026 put the average above 95%. Upbit reports cold wallet holdings above 99%, Bithumb's ratio runs approximately 94% to 95%, and Coinone sits at around 85%.

Translated for a depositor: at a 95% average, $95 of every $100 in user assets sits offline and about $5 remains exposed to an internet-connected machine. Upbit's ratio leaves under $1 of each $100 reachable; Coinone's leaves roughly $15, which is about $10 more than Bithumb's. Coinone clears the 80% floor comfortably but trails its larger rivals by a noticeable margin.

Two caveats belong here. These ratios describe where assets sit, not how keys are protected or how quickly a compromised hot wallet drains. The figures also arrive as exchange-reported numbers rather than audited disclosures, so a reader should treat them as claims to verify. In plain terms, cold storage is no longer the binding compliance problem in South Korea, which makes the remaining gap a question of key hygiene rather than allocation.

What does the Digital Asset Act change?

The emergency guidelines operate as a bridge to the forthcoming Digital Asset Act, which is set to impose bank-level IT safety standards on VASPs and to attach liability for damages. Under that scheme, an exchange could be on the hook when users lose money because of security failures, converting an operational incident into a financial exposure.

Whether that liability bites depends on wording that does not yet exist. Standards copied wholesale from banks may not map cleanly onto custody of bearer assets, and a damages clause without a clear standard of proof could stay largely decorative. In plain terms, the guidelines tell exchanges what to do this week, while the Act decides who pays when they do it badly.

What should traders and exchanges watch next?

• The final text of the Digital Asset Act, specifically how its liability provisions are drafted.
• How often exchanges invoke the new freeze powers, and whether false alarms lock customer funds.
• Whether Coinone raises its cold wallet ratio toward its rivals.

For users, the near-term arithmetic looks favorable. Round-the-clock monitoring should, in theory, shrink the window attackers have to drain funds, and high cold storage ratios limit what a hot wallet breach can reach. The tradeoff is the freeze power itself, since suspicion without confirmation can halt a legitimate withdrawal. The first real test of the guidelines arrives the next time an exchange invokes that power against a live incident, and the larger one arrives when the Digital Asset Act converts a compliance memo into measurable financial exposure.