South Korea's FSC to Let Exchanges Halt Flows on Suspected Hacks

South Korea's Financial Services Commission will issue a no-action letter letting crypto exchanges preemptively block deposits and withdrawals the moment a hack is suspected — a shift from current rules that allow such suspensions only after an incident is clearly confirmed. The regulator announced the measures on Nov. 12 at a virtual-asset industry security meeting chaired by FSC Vice Chairman Shin Jin-chang.

The change is operational, not cosmetic. Under existing law, virtual asset service providers (VASPs) must wait for confirmed evidence of a breach before freezing flows. The new framework lets them act as soon as signs emerge that users could suffer losses, giving compliance teams a legal basis to contain an exploit in its first minutes rather than after forensics conclude. A no-action letter means the step would ordinarily attract sanctions under current rules, but the FSC will temporarily permit it after weighing the circumstances.

What goes into the Digital Asset Basic Act?

The FSC also plans to write new obligations directly into the Digital Asset Basic Act, the legislation that will govern the broader virtual-asset ecosystem. The bill will require service providers to meet stability standards comparable to those imposed on financial companies and to assume liability for customer damages — a meaningful shift that moves exchange operators closer to the legal footing of banks and brokerages.

Because the act has not yet been enacted, the regulator has prepared emergency-response guidelines to apply in the interim. They require providers to:

• Maintain round-the-clock monitoring and response systems, with personnel on duty at all times to reflect crypto's 24-hour trading cycle.
• Raise the share of assets held in cold wallets as much as possible; custody in cold storage is currently subject to an 80% mandatory ratio.
• Expand insurance coverage limits and reserve funds.

Why is Financial Security Institute membership so narrow?

The FSC is also pushing to widen participation in the Financial Security Institute, the state-linked body that provides security support to the financial sector. Only five of the country's 28 virtual asset service providers — all of them exchanges — are currently members, a gap the regulator attributes largely to user-scale thresholds and membership fee burdens.

Authorities plan to encourage the remaining 23 providers to join so they can access security services on par with those available to commercial banks, insurers and brokerages. For operators that struggle to meet membership requirements, the FSC intends to provide support comparable to what smaller financial companies receive, including vulnerability assessments, alert systems and security measures.

The package signals that Seoul's supervisory posture toward crypto infrastructure is converging with traditional finance: continuous monitoring duties, hardened custody requirements, expanded insurance, and liability sitting with the operator rather than the user. Exchanges face near-term compliance costs — staffing, cold-storage reconfiguration, higher reserves — well before the Digital Asset Basic Act reaches the statute book.

Interim guidelines take effect ahead of the legislation, meaning the 24/7 monitoring and custody expectations land on operators first, while the liability and stability-standard provisions follow once lawmakers pass the act.