The Virtual Asset User Protection Act (VAUPA) is South Korea's first dedicated statute on the custody, segregation, and market-conduct obligations of virtual-asset service providers (VASPs). Promulgated on 18 July 2023 and effective 19 July 2024, the Act is administered by the FSC (Financial Services Commission) and supervised by the FSS (Financial Supervisory Service) (Library of Congress note on VAUPA effectiveness). VAUPA is "Phase 1": it focuses on user protection and unfair-trading enforcement without resolving the issuance perimeter for stablecoins, securities tokens, or institutional tokenisation products. Phase 2, currently scoped under working drafts of a Digital Asset Basic Act, would address those gaps. For tokenisation operators, VAUPA is the prudential floor for KRW-denominated tokenised activity transacted through a Korean VASP and the architecture into which Phase 2 is being slotted.

Scope

The Act applies to "virtual assets," defined as electronic tokens with economic value that can be traded or transferred electronically. The exclusion list is consequential: electronic tokens regulated under other legislation are excluded, including game money, electronic money, electronic stocks, central bank digital currency, electronic bonds, mobile gift certificates, deposit tokens linked to the CBDC network, and most non-fungible tokens (FSC press release on VAUPA). The exclusion of deposit tokens linked to the CBDC network specifically removes Bank of Korea pilot infrastructure from the VAUPA perimeter.

The regulated population is virtual-asset service providers as defined under the existing Act on Reporting and Use of Specific Financial Transaction Information (the AML statute that brought VASPs into the supervised perimeter from 2021). VAUPA layers user-protection and market-conduct obligations on top of that existing AML registration; it does not create a new licensing regime.

Mechanics

VASPs must segregate customer deposits and customer virtual assets from corporate assets. Customer cash deposits must be held at banks under real-name verified accounts, with VASPs required to pay customers interest at a rate equivalent to a deposit-account interest rate. VASPs must store at least 80 percent of customer virtual assets in cold wallets, with the remaining hot-wallet exposure subject to insurance or reserve-fund requirements (FSC press release on VAUPA).

The unfair-trading provisions prohibit price manipulation, use of material non-public information, and acts that disturb market order. The prohibitions track the Capital Markets Act framework for securities markets, with adjustments for the on-chain context. Penalties include criminal sanctions and disgorgement of unlawful gains, with administrative fines as the secondary tier.

The FSC supervises and inspects business affairs and financial status. The FSS conducts on-the-ground supervisory examinations. Regulatory powers include order issuance, business suspension, and revocation of VASP registration. Real-name banking is the gating control: a VASP cannot offer KRW on-ramp services without a partnership with a Korean bank that runs the real-name account verification.

Status

In force from 19 July 2024. The Enforcement Decree and supporting subordinate regulation were issued in mid-2024. As of late April 2026, the FSC is consulting on the Phase 2 framework, often referred to as the Digital Asset Basic Act (DABA), which would address stablecoin issuance, security-token issuance, institutional access to virtual-asset trading, and the perimeter for tokenised real-world assets. Late December 2025 reporting confirmed that DABA has slipped to 2026 amid an unresolved deadlock between the FSC and the Bank of Korea on stablecoin issuer eligibility, with the BoK reportedly requiring at least 51% bank ownership for permitted issuers and the FSC preferring broader access (Coindesk). Working drafts have circulated through the National Assembly Political Affairs Committee but no consolidated bill has cleared the chamber as of late April 2026. The delay is the structurally consequential APAC stablecoin-regulation pause of the period.

The bank-led won-stablecoin consortia (covered as a separate theme) have organised in anticipation of DABA's eventual enactment, with two parallel consortium structures positioned to cover whichever issuance perimeter the framework eventually permits. Pilot KRW stablecoin issuance was targeted for early 2026 and is currently waiting on the legislative outcome.

The Bank of Korea's CBDC and deposit-token pilot continues to operate outside the VAUPA perimeter under the explicit deposit-token exclusion. Securities tokens fall under the Capital Markets Act, with the FSC's "innovative financial services" sandbox carrying the live security-token pilots through to the Phase 2 framework.

Implications for tokenisation

For a foreign issuer wishing to distribute a tokenised product to Korean retail through a Korean VASP, VAUPA is the architecture they need to clear. The 80 percent cold-storage requirement and the real-name bank-account regime constrain how a foreign issuer can structure on-ramp and off-ramp flows. For institutional access, VAUPA's user-protection focus does not directly address how a Korean institution can hold tokenised assets on its own treasury, which is one of the gaps the Phase 2 framework is expected to close.

For KRW-denominated stablecoins, VAUPA is silent on the issuance perimeter. Any KRW stablecoin issued today operates outside a dedicated regulatory framework, with the FSC and Bank of Korea publicly cautious about non-bank issuance and the practical effect being that no major KRW stablecoin has launched at scale. The Phase 2 framework is the load-bearing piece for stablecoin operators planning a KRW-denominated design; until it lands, the practical perimeter is "do not issue" rather than "issue under prescribed terms."

The exclusion of deposit tokens linked to the CBDC network is the under-appreciated piece for a bank tokenisation strategy. A Korean bank wishing to issue tokenised deposits in connection with the Bank of Korea pilot is not a VASP for VAUPA purposes and faces a different supervisory perimeter than a non-bank stablecoin issuer would.

Open questions

• The substantive shape of the Phase 2 Digital Asset Basic Act, particularly on stablecoin issuance, institutional access, and tokenised real-world asset issuance.
• Whether the FSC will permit a KRW-denominated stablecoin under Phase 2 and whether issuance will be limited to banks or extend to non-bank issuers under a permitted-issuer perimeter.
• Treatment of foreign-issued stablecoins distributed to Korean retail through registered VASPs, where VAUPA does not directly address foreign-issuer comparability.
• The interaction of VAUPA's customer-asset segregation rules with tokenised-fund arrangements where the segregation runs through a fund-trustee structure rather than a VASP custodial structure.