Most breaches involved failures in customer due diligence and identity verification processes.
The action coincides with reports of a potential majority acquisition by Mirae Asset.
The case reinforces stricter regulatory expectations across South Korea’s crypto sector.
South Korea’s year-end move against Korbit marks a decisive moment for the country’s digital asset industry, as regulators signal that gaps in compliance will carry real consequences.
On December 31, the Financial Intelligence Unit closed an on-site investigation into one of the country’s longest-operating exchanges with a significant financial penalty and management-level sanctions.
The action, based on findings from an October inspection, places renewed focus on how exchanges verify users, manage risk, and expand services.
It also lands at a sensitive time for Korbit, underscoring how regulatory discipline is shaping the future of South Korea’s crypto market.
The FIU announced a 2.73 billion won ($1.88 million) fine after identifying nearly 22,000 breaches linked to anti-money laundering and customer verification obligations.
The violations were uncovered during an inspection conducted between October 16 and 29, 2024, with the results later reviewed by the Sanctions Review Committee.
Alongside the fine, the regulator issued an institutional warning and imposed individual accountability measures on senior executives.
Inspection findings
A large share of the violations stemmed from failures in customer due diligence.
The FIU found roughly 12,800 cases where identity checks were not properly conducted.
These included the acceptance of unclear or unverifiable identification documents, incomplete address information, and lapses in mandatory re-verification processes.
In several instances, users were allowed to continue trading even after their risk profiles increased, without additional checks being applied.
Such practices run counter to requirements that higher-risk customers be subject to enhanced scrutiny rather than standard monitoring.
The review also identified about 9,100 cases where customers were permitted to trade before identity verification was fully completed.
South Korean rules restrict transactions by unverified users, making these cases a direct breach of core compliance standards.
Accountability at the top
Beyond operational failures, the enforcement action extended responsibility to leadership.
The FIU issued an institutional warning to Korbit, while the exchange’s chief executive received a caution, and its reporting officer was reprimanded.
This approach reflects a broader regulatory emphasis on governance and internal controls, where accountability does not stop at automated systems or compliance teams.
Instead, senior management is expected to ensure that regulatory requirements are embedded across day-to-day operations and decision-making processes.
Overseas transfers and new services
Regulators also highlighted weaknesses beyond customer onboarding.
Inspectors flagged 19 virtual asset transfers involving three overseas virtual asset service providers that were not properly reported.
South Korean rules require exchanges to disclose dealings with foreign entities and restrict transactions with unregistered providers.
In addition, the FIU identified 655 cases where Korbit failed to carry out mandatory money laundering risk assessments before introducing new transaction types.
These included services linked to non-fungible tokens, an area of rapid growth that remains subject to the same compliance obligations as other digital asset products.
Timing and sector impact
The enforcement action comes just days after reports that Mirae Asset is said to be considering acquiring 92% of Korbit for up to 140 billion won ($97 million).
Korbit currently ranks as the fourth-largest exchange among South Korea’s six incorporated crypto platforms, placing it firmly within the regulator’s line of sight.
The FIU said full details of the sanctions will be disclosed after a minimum 10-day period for opinion submissions.
