South Korea Moves to Make Crypto Firms Report Security Breaches Immediately

South Korea's Financial Services Commission said on Nov. 5 it will draft guidance forcing virtual asset service providers to alert the Financial Supervisory Service and the Financial Security Institute the moment they become aware of a security incident. Right now, those firms only have to tell the Korea Internet & Security Agency. The new plan stacks two financial regulators onto that existing reporting line.

The logic is speed. Authorities argue that looping in the financial watchdogs early will speed up investigations and information sharing, and shore up consumer protection as digital-asset firms and mainstream financial businesses grow more intertwined.

The bigger package is a law. Officials want to finish drafting and submit a bill for a proposed Digital Financial Security Act by the first quarter of 2027. Under it, virtual asset providers — along with insurance agencies and money-lending businesses — would face security requirements comparable to those set out in the Electronic Financial Transactions Act.

Those three sectors were singled out for a reason: they hold piles of customer data or carry the risk of large-scale asset losses if something goes wrong.

The reporting overhaul lands alongside a security review of roughly 580 financial companies, virtual asset businesses included. If the bill clears the National Assembly on schedule, crypto firms in South Korea will be answering to a wider set of eyes than ever before.