كوريا الجنوبية KYC, KYB & AML compliance checklist
قائمة عملية وموثقة بالمصادر لتنفيذ متطلبات KYC وKYB وAML في كوريا الجنوبية.
- تاريخ آخر مراجعة
- تاريخ آخر مراجعة:
- الإصدار
- الإصدار 1.2
دليل تنفيذ قابل للتنزيل
الحصول على ملف PDF
11 مجالات رقابية · 44 فحوص تنفيذ
تاريخ آخر مراجعة: 25 September 2026 · الإصدار 1.2
تنزيل قائمة التحققإجابة مباشرة
ما الذي تغطيه قائمة الامتثال الخاصة بـ كوريا الجنوبية؟
تحوّل قائمة كوريا الجنوبية قواعد KYC وKYB وAML الأساسية إلى 11 مجالات رقابية و44 فحوص تنفيذ، وتشمل الجهات المختصة وواجبات الإبلاغ والأدلة الواجب الاحتفاظ بها.
حقائق تنظيمية أساسية
- FIU
- Korea Financial Intelligence Unit (KoFIU)
- Primary AML law
- Act on Reporting and Using Specified Financial Transaction Information (FTRA), as in force
- STR timing
- Without delay after reasonable grounds for suspicion arise
- Cash threshold report
- KRW 10 million or more paid or received in cash, aggregated separately per trading day and same real name, subject to statutory exclusions
- AML retention
- Five years from termination of the relevant financial-transaction relationship, using the statutory termination event
- AML beneficial owner
- 25% voting ownership first, then largest holder or other control, then the representative as fallback
- Privacy authority
- Personal Information Protection Commission (PIPC)
- FATF public lists
- Not listed at 19 June 2026
تفاصيل التنفيذ
متطلبات وإجراءات الامتثال في كوريا الجنوبية
افتح كل مجال لمراجعة المتطلب وإجراء التنفيذ المقترح والأدلة الواجب الاحتفاظ بها والمصدر الأساسي.
01Scope, authorities, and licensingMap the exact regulated activity and supervisor before applying this financial-sector checklist.4 عناصر+
Determine whether the entity is a financial company or other reporting entity within the FTRA.
- إجراء التنفيذ
- Map each banking, securities, insurance, cooperative, casino, electronic-finance, remittance and virtual-asset activity against the current FTRA and Enforcement Decree; document exclusions and the responsible sector supervisor.
- الأدلة الواجب الاحتفاظ بها
- Legal-entity chart, product and funds-flow inventory, perimeter memo, licence register and counsel confirmation.
- المصدر الأساسي
- FTRA Articles 2 and 15; FTRA Enforcement Decree Articles 2 and 15
Do not apply the financial-sector AML perimeter as a universal business rule.
- إجراء التنفيذ
- For lawyers, accountants, real-estate businesses, dealers and other professionals, identify any separate sector duty and avoid describing them as FTRA reporting entities without a current legal basis.
- الأدلة الواجب الاحتفاظ بها
- Sector-by-sector applicability matrix, statutory sources and approved customer-scope decision.
- المصدر الأساسي
- FTRA Article 2; FATF Korea Follow-Up Report 2024, Recommendations 22, 23 and 28
Obtain each required payments or electronic-finance permission or registration before service.
- إجراء التنفيذ
- Classify electronic currency, electronic funds transfer, debit, prepaid and payment-gateway services under the Electronic Financial Transactions Act and complete Financial Services Commission permission or registration unless a documented exemption applies.
- الأدلة الواجب الاحتفاظ بها
- Service classification, application, approval or registration, exemption analysis, conditions and change log.
- المصدر الأساسي
- Electronic Financial Transactions Act Articles 2 and 28
Register a covered virtual asset service provider with KoFIU.
- إجراء التنفيذ
- File and maintain the FTRA registration, satisfy current information-security, real-name account where applicable, governance, systems, staffing, internal-control and fit-and-proper conditions, and track renewal and modification deadlines.
- الأدلة الواجب الاحتفاظ بها
- Perimeter analysis, registration acceptance, ISMS evidence, account evidence, governance pack, renewal calendar and change filings.
- المصدر الأساسي
- FTRA Articles 6-8; FTRA Enforcement Decree Articles 10-11 to 10-20, as amended effective 20 August 2026
02Governance and ML/TF risk managementCovered entities need accountable reporting, risk-based controls, training and independent evaluation.4 عناصر+
Appoint the responsible reporting officer and maintain an internal reporting system.
- إجراء التنفيذ
- Document appointment and dismissal, authority, escalation routes and access to KoFIU reporting channels; notify KoFIU where required.
- الأدلة الواجب الاحتفاظ بها
- Appointment record, notification, role description, delegation matrix and tested escalation workflow.
- المصدر الأساسي
- FTRA Article 5(1); FTRA Enforcement Decree Article 9
Maintain risk-based AML/CFT procedures and work guidelines.
- إجراء التنفيذ
- Assess customer, product, channel, geography, transaction, new-technology and group risks and translate the results into proportionate CDD, monitoring, reporting and sanctions controls.
- الأدلة الواجب الاحتفاظ بها
- Risk methodology, current assessment, approved procedures, model inventory, change assessments and residual-risk decisions.
- المصدر الأساسي
- FTRA Article 5(1)-(4); FTRA Enforcement Decree Articles 4 and 9
Provide role-appropriate AML/CFT training and supervision.
- إجراء التنفيذ
- Train relevant officers and employees at onboarding and periodically, test understanding, and supervise compliance with work guidelines.
- الأدلة الواجب الاحتفاظ بها
- Training content, attendance, assessment results, supervision reports and remediation records.
- المصدر الأساسي
- FTRA Article 5(1)3 and (4)
Independently evaluate the adequacy and effectiveness of the AML program.
- إجراء التنفيذ
- Use a function independent from AML operations, set a risk-based scope and frequency, report findings to accountable management and verify closure.
- الأدلة الواجب الاحتفاظ بها
- Independence assessment, review plan, workpapers, report, management response and closure testing.
- المصدر الأساسي
- FTRA Article 5(3)2
03Natural-person identificationReal-name verification and FTRA CDD apply at relationship opening, scoped occasional-transaction thresholds and risk triggers.4 عناصر+
Complete CDD when opening a new account or business relationship.
- إجراء التنفيذ
- Identify and verify the customer's real name, address and contact information using reliable evidence before or at onboarding, subject only to a documented rule that permits later completion without delay.
- الأدلة الواجب الاحتفاظ بها
- Identity attributes, evidence source, verification result, timestamps, exception basis and completion record.
- المصدر الأساسي
- FTRA Article 5-2; FTRA Enforcement Decree Articles 10-2, 10-4 and 10-6; Act on Real Name Financial Transactions and Guarantee of Secrecy
Apply the correct occasional-transaction CDD threshold.
- إجراء التنفيذ
- Trigger CDD at KRW 3 million for casino transactions, KRW 1 million equivalent for virtual-asset transactions, KRW 1 million equivalent for wire transfers, USD 10,000 equivalent for foreign-currency transactions, or KRW 10 million for other occasional financial transactions; do not treat one amount as universal.
- الأدلة الواجب الاحتفاظ بها
- Transaction classifier, aggregation logic where applicable, exchange-rate source, CDD trigger log and test cases.
- المصدر الأساسي
- FTRA Article 5-2(1)1; FTRA Enforcement Decree Article 10-3
Identify persons acting for a customer and verify their authority.
- إجراء التنفيذ
- Collect the representative's identity, verify the mandate or corporate authority and link the person to the customer before accepting instructions.
- الأدلة الواجب الاحتفاظ بها
- Representative KYC, power of attorney or board authority, verification result and transaction audit trail.
- المصدر الأساسي
- FTRA Article 5-2; Financial Transaction Reports and Supervisory Regulation Article 38; KoFIU CDD guidance
Reject or terminate where required CDD cannot be completed.
- إجراء التنفيذ
- Do not open the account or perform the new transaction when identity cannot be verified; terminate an existing relationship where the statutory condition applies and review whether an STR is required.
- الأدلة الواجب الاحتفاظ بها
- Information requests, refusal or termination decision, legal basis, customer communication and STR assessment.
- المصدر الأساسي
- FTRA Article 5-2(4)-(5)
04KYB, registries, and beneficial ownershipVerify legal existence, representatives and the natural persons who ultimately own or control the customer.4 عناصر+
Verify legal-person or organization identity and existence.
- إجراء التنفيذ
- Collect the real name, business type or establishment purpose, head-office and business locations, contact details and representative information; corroborate them with a current court commercial-register extract and other reliable documents.
- الأدلة الواجب الاحتفاظ بها
- Commercial-register extract, business registration, constitutional documents, representative verification and discrepancy log.
- المصدر الأساسي
- FTRA Enforcement Decree Article 10-4; Financial Transaction Reports and Supervisory Regulation Article 38; Commercial Act Article 34
Apply the statutory AML beneficial-owner cascade.
- إجراء التنفيذ
- Identify the natural person holding at least 25% of issued voting shares or investment; if none can be identified, test the largest holder, appointment of a majority of management and other substantial control; if still none, identify the representative.
- الأدلة الواجب الاحتفاظ بها
- Layered ownership chart, voting and investment calculations, control analysis, identity verification and fallback rationale.
- المصدر الأساسي
- FTRA Article 5-2(1)1(b); FTRA Enforcement Decree Article 10-5(2)-(4)
Trace corporate owners to natural persons and resolve nominees or indirect control.
- إجراء التنفيذ
- Look through each corporate layer, corroborate ownership and control independently, and escalate opaque or foreign structures rather than accepting the immediate shareholder as the beneficial owner.
- الأدلة الواجب الاحتفاظ بها
- Full chain, source extracts, shareholder registers, agreements, nominee analysis and enhanced review.
- المصدر الأساسي
- FTRA Enforcement Decree Article 10-5(3)-(4); KoFIU CDD guidance
Keep commercial-registration evidence separate from the AML beneficial-owner conclusion.
- إجراء التنفيذ
- Use court registration and the company's shareholder register as KYB evidence, but perform the FTRA ownership-and-control test independently because basic or legal ownership evidence may not reveal ultimate control.
- الأدلة الواجب الاحتفاظ بها
- Registry extract, Commercial Act shareholder register, reconciliation and signed beneficial-owner determination.
- المصدر الأساسي
- Commercial Act Articles 34 and 352; FTRA Enforcement Decree Article 10-5; FATF Korea Mutual Evaluation 2020
05PEPs, enhanced due diligence, and remote onboardingHigher-risk customers require additional information and controls; Korea's PEP framework retains FATF-identified limitations.4 عناصر+
Identify foreign PEP exposure and apply the required enhanced measures.
- إجراء التنفيذ
- Screen the customer and beneficial owner for foreign PEP, family-member and close-associate status; obtain required senior approval, establish source of wealth and source of funds, and increase monitoring under the current KoFIU regulation.
- الأدلة الواجب الاحتفاظ بها
- Screening result, relationship map, approval, source corroboration and monitoring plan.
- المصدر الأساسي
- Financial Transaction Reports and Supervisory Regulation; FATF Korea Follow-Up Report 2024, Recommendation 12
Treat domestic and international-organization PEP coverage as a controlled legal gap.
- إجراء التنفيذ
- Apply risk-based screening and enhanced review as an internal control where not expressly required, and confirm sector-specific rules; do not state that Korean law fully implements every FATF PEP category.
- الأدلة الواجب الاحتفاظ بها
- Legal-gap memo, approved risk policy, screening scope and exception decisions.
- المصدر الأساسي
- FATF Korea Follow-Up Report 2024, Recommendation 12
Perform enhanced CDD where ML/TF risk is high or actual ownership is doubtful.
- إجراء التنفيذ
- Obtain and verify additional information including transaction purpose and source of funds, investigate inconsistencies and impose risk-appropriate approval and monitoring.
- الأدلة الواجب الاحتفاظ بها
- Risk trigger, enhanced questionnaire, source evidence, approval and review schedule.
- المصدر الأساسي
- FTRA Article 5-2(1)2; KoFIU CDD guidance
Control non-face-to-face identity and biometric processing.
- إجراء التنفيذ
- Layer document, device, liveness and fraud controls. Where biometrics uniquely identify a person, establish a valid PIPA basis, obtain separate consent when relied upon, give required notices and apply enhanced security and deletion controls.
- الأدلة الواجب الاحتفاظ بها
- Method assessment, fraud tests, PIPA basis, consent and notice records, security review, retention schedule and vendor diligence.
- المصدر الأساسي
- PIPA Articles 15, 23, 29 and 30; Enforcement Decree of PIPA Article 18; PIPC Biometric Information Protection Guideline
06Monitoring and suspicious transaction reportingOngoing CDD and transaction monitoring must support prompt, confidential reporting to KoFIU.4 عناصر+
Conduct ongoing, risk-based CDD and transaction monitoring.
- إجراء التنفيذ
- Review transactions against customer activity, business, risk and source-of-funds information; set refresh cycles by risk and reverify when information is inconsistent, doubtful or materially changed.
- الأدلة الواجب الاحتفاظ بها
- Scenario inventory, alerts, case decisions, periodic reviews, refreshed CDD and quality testing.
- المصدر الأساسي
- FTRA Article 5; FTRA Enforcement Decree Article 10-6; KoFIU CDD guidance
File an STR with KoFIU without delay when the statutory suspicion test is met.
- إجراء التنفيذ
- Record when reasonable grounds arose, state the grounds clearly and submit using the current KoFIU-prescribed form and channel without waiting for proof or a monetary threshold.
- الأدلة الواجب الاحتفاظ بها
- Alert chronology, information reviewed, suspicion decision, STR, submission receipt and timeliness test.
- المصدر الأساسي
- FTRA Article 4(1) and (3); FTRA Enforcement Decree Article 7; KoFIU STR guidance
Consider an STR after failed CDD, rejection or termination.
- إجراء التنفيذ
- Route every statutory CDD refusal or relationship termination to the reporting officer for a documented suspicion assessment and preserve the decision.
- الأدلة الواجب الاحتفاظ بها
- Failed-CDD case, escalation, STR decision, filing receipt if applicable and closure approval.
- المصدر الأساسي
- FTRA Article 5-2(4)-(5); KoFIU CDD guidance
Protect STR information and prevent tipping off.
- إجراء التنفيذ
- Restrict knowledge of an intended or filed STR to authorized internal use and any express legal exception; block customer-facing notes or disclosures that reveal the report.
- الأدلة الواجب الاحتفاظ بها
- Access controls, disclosure log, communication review, training and incident response.
- المصدر الأساسي
- FTRA Article 4(6)
07Cash reports, wires, and virtual-asset transfersCash aggregation, wire fields and virtual-asset travel rules use different scopes and thresholds.4 عناصر+
Report covered large cash transactions.
- إجراء التنفيذ
- Report to KoFIU within 30 days when KRW 10 million or more in cash is paid or received, aggregating payments and receipts separately over one trading day under the same real name at the same institution and applying only the statutory exclusions.
- الأدلة الواجب الاحتفاظ بها
- Cash ledger, same-name aggregation, exclusion logic, CTR, submission receipt and reconciliation.
- المصدر الأساسي
- FTRA Article 4-2; FTRA Enforcement Decree Articles 8-2 to 8-7; KoFIU CTR guidance
Detect structuring intended to avoid cash reporting.
- إجراء التنفيذ
- Monitor linked and split transactions, investigate evasion indicators and file the required report or STR when the relevant statutory test is met.
- الأدلة الواجب الاحتفاظ بها
- Aggregation scenarios, linked-party logic, alert case, disposition and filing receipt.
- المصدر الأساسي
- FTRA Article 4-2(2); FTRA Enforcement Decree Article 8
Transmit prescribed originator and beneficiary information for covered wires.
- إجراء التنفيذ
- For transfers above KRW 1 million domestically or USD 1,000 equivalent cross-border, populate the statutory originator and beneficiary fields, retain them and answer permitted domestic information requests within three business days.
- الأدلة الواجب الاحتفاظ بها
- Field mapping, message samples, threshold tests, request log, response timestamp and exception queue.
- المصدر الأساسي
- FTRA Article 5-3; FTRA Enforcement Decree Article 10-8
Apply the current virtual-asset travel rule and track the deferred expansion.
- إجراء التنفيذ
- Until the 2026 amendment's later effective date, transmit the prescribed customer names and virtual-asset addresses for domestic VASP-to-VASP transfers of at least KRW 1 million and provide additional originator identifiers within three business days on a valid request. Prepare for all-size domestic coverage and the new overseas-transfer rules that take effect six months after promulgation.
- الأدلة الواجب الاحتفاظ بها
- Rule-version register, transfer controls, messages, request responses, transition plan and release testing.
- المصدر الأساسي
- FTRA Article 6(3); FTRA Enforcement Decree Article 10-10; FSC release of 11 August 2026
08Targeted financial sanctions and CPFKorean restricted-person measures require pre-transaction blocking, permission controls and prompt reporting.4 عناصر+
Screen current FSC and incorporated UN restricted-person designations.
- إجراء التنفيذ
- Screen customers, beneficial owners, controllers, representatives and transactions at onboarding, periodically and on list updates; assess entities owned or controlled under the applicable rules, not only exact names.
- الأدلة الواجب الاحتفاظ بها
- List source and timestamp, configuration, ownership-control analysis, match decisions and quality tests.
- المصدر الأساسي
- PFOPIA Article 4(1); PFOPIA Enforcement Decree; KoFIU CFT regime and current designation notices
Do not transact with or dispose of property for a restricted person without prior FSC approval.
- إجراء التنفيذ
- Block the transaction or disposal before execution, preserve the property and case evidence, and seek FSC permission only through the statutory process.
- الأدلة الواجب الاحتفاظ بها
- Block timestamp, asset record, legal assessment, permission application and decision.
- المصدر الأساسي
- PFOPIA Article 4(4); KoFIU CFT regime
Report known terrorist- or proliferation-financing property without delay.
- إجراء التنفيذ
- When an employee knows that transaction assets are TF/PF funds or that the counterparty is conducting a restricted transaction without permission, report without delay to the competent investigative authority and make the related KoFIU report.
- الأدلة الواجب الاحتفاظ بها
- Knowledge and escalation chronology, authority report, KoFIU filing, receipts and controlled communications.
- المصدر الأساسي
- PFOPIA Article 5(2); FTRA Article 4(1)3; KoFIU designated-person guidance
Test sanctions controls against Korea's FATF-identified TFS limitations.
- إجراء التنفيذ
- Document how UN designations, domestic notices, ownership or control and update timing reach screening and blocking systems; treat known TF/PF TFS gaps as heightened control risk.
- الأدلة الواجب الاحتفاظ بها
- Gap assessment, list-update SLA, sample testing, remediation and senior risk acceptance.
- المصدر الأساسي
- FATF Korea Follow-Up Report 2024, Recommendations 6 and 7
09Records and regulator accessRetain reconstructable AML evidence for the statutory period and make it retrievable.3 عناصر+
Retain AML reporting, CDD and transfer information for five years.
- إجراء التنفيذ
- Start the five-year clock from the statutory termination of the financial-transaction relationship, including settlement of all claims and obligations for virtual-asset relationships, and preserve each required data category.
- الأدلة الواجب الاحتفاظ بها
- Record inventory, trigger-date logic, retention schedule, legal holds and sampled retrieval.
- المصدر الأساسي
- FTRA Article 5-4(1)-(2); FTRA Enforcement Decree Article 10-9
Preserve STR files separately and securely.
- إجراء التنفيذ
- Keep the STR and supporting identification, transaction and suspicion-ground data segregated from ordinary transaction records with tightly limited access and auditable retrieval.
- الأدلة الواجب الاحتفاظ بها
- Repository configuration, access log, retention metadata, backup test and destruction approval.
- المصدر الأساسي
- FTRA Article 5-4; FTRA Enforcement Decree Article 10-9(1)-(3)
Support lawful KoFIU and supervisory access.
- إجراء التنفيذ
- Maintain records in a form and location that permits timely production, with integrity, lineage, Korean-language context and confidentiality preserved.
- الأدلة الواجب الاحتفاظ بها
- Regulator-response procedure, data dictionary, immutable export, translation control and production log.
- المصدر الأساسي
- FTRA Articles 13 and 15; FTRA Enforcement Decree Article 10-9
10Privacy, biometrics, breaches, and transfersKYC data is also regulated personal information; AML retention does not displace PIPA controls outside its legal scope.6 عناصر+
Implement the PIPA governance duties effective 11 September 2026.
- إجراء التنفيذ
- Designate a personal information protection officer (CPO) unless the controller qualifies for the small-business exemption; where that exemption is used, document that the business owner or representative is deemed to be the CPO under PIPA Article 31(2). Give the CPO independent authority, access to specialist personnel and budget, and reporting access to the business owner or representative and board. If the controller meets the thresholds in Enforcement Decree Article 32(3), obtain board approval for each CPO designation, change or removal and submit the prescribed notice to PIPC within six months after the relevant event. For a qualifying controller whose CPO was already designated when the amended decree commenced, submit the notice within six months after 11 September 2026. A PIPC-approved extension may be available for unavoidable circumstances, within the decree's one-year limit. Track the separate ISMS-P mandate as a 1 July 2027 transition, not a current requirement.
- الأدلة الواجب الاحتفاظ بها
- CPO appointment and role charter, exemption or threshold analysis, deemed-CPO record where applicable, board minutes, six-month deadline calculation, PIPC filing and receipt, any extension decision, budget and staffing record, independence safeguards, reporting calendar and 1 July 2027 transition plan.
- المصدر الأساسي
- PIPA Article 31; PIPA Enforcement Decree Article 32 and supplementary provisions, as in force 11 September 2026; PIPC release of 10 September 2026
Establish and document a PIPA basis for each KYC processing purpose.
- إجراء التنفيذ
- Map collection, use, sharing, outsourcing and retention to consent, statutory duty, contract necessity or another available basis; provide the required notices and collect only necessary data.
- الأدلة الواجب الاحتفاظ بها
- Processing register, legal-basis matrix, privacy notices, consent records, minimization review and retention schedule.
- المصدر الأساسي
- PIPA Articles 15, 17, 18, 21, 26 and 30
Protect resident registration numbers and sensitive biometric information.
- إجراء التنفيذ
- Process resident registration numbers only under a specific statutory or other permitted condition, encrypt as required, and use separate consent or another express basis plus enhanced safeguards for biometric identifiers treated as sensitive information.
- الأدلة الواجب الاحتفاظ بها
- Authority mapping, separate consent where used, encryption proof, key controls, access review and deletion evidence.
- المصدر الأساسي
- PIPA Articles 23, 24, 24-2 and 29; Enforcement Decree of PIPA Article 18
Control cross-border personal-information transfers.
- إجراء التنفيذ
- Use a permitted Article 28-8 route, give or disclose the prescribed transfer details, bind recipients to protective measures and monitor onward transfer and PIPC suspension risk.
- الأدلة الواجب الاحتفاظ بها
- Transfer map, Article 28-8 basis, notice or consent, recipient contract, security diligence and onward-transfer register.
- المصدر الأساسي
- PIPA Articles 28-8 and 28-9; Enforcement Decree of PIPA Articles 29-7 to 29-11
Operate separate 72-hour workflows for actual breaches, regulator reports and specified possible breaches.
- إجراء التنفيذ
- When actual loss, theft, leakage, forgery, alteration or damage is known, notify affected persons within 72 hours, subject to the limited statutory exceptions, and provide follow-up details as they are confirmed. Report to PIPC or KISA within 72 hours only when the current decree criteria apply, including a breach involving at least 1,000 data subjects, sensitive or unique-identification information, or unlawful external access, subject to the decree's limited exception. Also notify affected persons within 72 hours when either possible-breach scenario in Enforcement Decree Article 39-2 is identified, and follow up if an actual breach is confirmed or ruled out.
- الأدلة الواجب الاحتفاظ بها
- Incident chronology, affected-person analysis, Article 39-2 possible-breach assessment, notification copies and timestamps, Article 40 regulator-reporting analysis, PIPC/KISA receipt where required, exception rationale and follow-up notices.
- المصدر الأساسي
- PIPA Article 34; PIPA Enforcement Decree Articles 39, 39-2, 39-3 and 40, as in force 11 September 2026
Scope privacy impact assessment correctly.
- إجراء التنفيذ
- For public institutions establishing or changing a covered personal-information file, complete the statutory impact assessment before operation; for private high-risk biometric KYC, use an impact assessment as a documented risk control without mislabeling it universally mandatory.
- الأدلة الواجب الاحتفاظ بها
- Applicability decision, assessment, mitigations, approval and residual-risk register.
- المصدر الأساسي
- PIPA Article 33; operational control for non-statutory cases
11Practical evidence packsAssemble evidence that reconstructs legal scope, customer decisions, reporting and privacy compliance.3 عناصر+
Maintain a complete onboarding and beneficial-ownership pack.
- إجراء التنفيذ
- Link identity and legal-existence evidence, authority, ownership chain, 25% and control analysis, risk rating, PEP and sanctions results and approval.
- الأدلة الواجب الاحتفاظ بها
- One sampled file showing source provenance, timestamps, reviewer and unresolved issues.
- المصدر الأساسي
- Operational control supporting FTRA Article 5-2 and Enforcement Decree Articles 10-4 and 10-5
Maintain a reconstructable reporting and sanctions pack.
- إجراء التنفيذ
- Link monitoring alert, suspicion or designation analysis, decision time, CTR or STR or authority report, submission receipt, confidentiality and blocked-property actions.
- الأدلة الواجب الاحتفاظ بها
- One sampled case with full chronology, filings, access record and management review.
- المصدر الأساسي
- Operational control supporting FTRA Articles 4 and 4-2 and PFOPIA Articles 4 and 5
Maintain a current regulatory-change pack.
- إجراء التنفيذ
- Track the Korean controlling text, English translation lag, KoFIU notices, VASP deferred effective dates, FATF statements and PIPA amendments; assign owners and test changes before effective dates.
- الأدلة الواجب الاحتفاظ بها
- Source register, legal update log, impact assessment, approved implementation plan and post-change test.
- المصدر الأساسي
- Operational control supporting the FTRA, PFOPIA and PIPA frameworks
سجل المصادر الأساسية
26 مصدرًا مستخدمًا في هذه القائمة
استخدم هذه الروابط للتحقق من التشريعات وإرشادات الجهات الرقابية وإجراءات الإبلاغ والبيانات الدولية.
- Financial Transaction Reports Act - current Korean textKorea Ministry of Government Legislation · Primary legislation
- FTRA - English statutory translationKorea Legislation Research Institute · Authoritative legal translation
- FTRA Enforcement Decree - current Korean textKorea Ministry of Government Legislation · Primary subordinate legislation
- KoFIU AML/CFT statutes and regulationsKorea Financial Intelligence Unit · Official legal index
- KoFIU AML/CFT regime and CDD guidanceKorea Financial Intelligence Unit · Official FIU guidance
- KoFIU customer due diligence guidanceKorea Financial Intelligence Unit · Official FIU guidance
- KoFIU suspicious transaction reporting guidanceKorea Financial Intelligence Unit · Official FIU guidance
- KoFIU currency transaction reporting guidanceKorea Financial Intelligence Unit · Official FIU guidance
- Approved 2026 VASP registration and AML rule changesFinancial Services Commission · Official regulatory release
- PFOPIA - English statutory textKorea Legislation Research Institute · Authoritative legal translation
- KoFIU counter-terrorist and proliferation-financing regimeKorea Financial Intelligence Unit · Official sanctions guidance
- KoFIU designated-person reporting guidanceKorea Financial Intelligence Unit · Official sanctions guidance
- KoFIU current notices and subordinate rulesKorea Financial Intelligence Unit · Official notice register
- Electronic Financial Transactions ActKorea Legislation Research Institute · Authoritative legal translation
- Commercial Act - registration and shareholder recordsKorea Legislation Research Institute · Authoritative legal translation
- Supreme Court registration servicesSupreme Court of Korea · Official registry guidance
- Personal Information Protection Act - current text and versionsKorea Legislation Research Institute · Authoritative legal translation
- PIPC laws and regulationsPersonal Information Protection Commission · Official privacy law index
- PIPC biometric information protection guidelinePersonal Information Protection Commission · Official privacy guidance
- PIPC personal-information breach reportingPersonal Information Protection Commission · Official incident guidance
- PIPA governance and breach amendments effective 11 September 2026Personal Information Protection Commission · Official amendment guidance
- FATF Korea follow-up report 2024FATF · Authoritative current assessment
- FATF Korea mutual evaluation 2020FATF · Authoritative mutual evaluation
- FATF jurisdictions under increased monitoring - 19 June 2026FATF · Authoritative current public list
- FATF high-risk jurisdictions subject to a call for action - 19 June 2026FATF · Authoritative current public list
- Official Taegeukgi design and constructionMinistry of the Interior and Safety · Official national-symbol guidance
إجابات مباشرة
أسئلة KYC وKYB وAML في كوريا الجنوبية
Who receives suspicious transaction reports?+
KoFIU, the Korea Financial Intelligence Unit, using the current prescribed reporting form and channel.
When must an STR be filed?+
Without delay after the reporting entity has reasonable grounds to suspect that received assets are illegal or that the counterparty is engaged in money laundering or terrorist financing. There is no minimum STR amount.
What cash activity is threshold-reportable?+
KRW 10 million or more paid or received in cash, with payments and receipts aggregated separately over one trading day under the same real name at the same financial institution, subject to statutory exclusions, is reportable within 30 days.
Is there one universal occasional-transaction CDD threshold?+
No. Current thresholds differ: KRW 3 million for casino transactions, KRW 1 million equivalent for virtual-asset transactions and wire transfers, USD 10,000 equivalent for foreign-currency transactions, and KRW 10 million for other occasional financial transactions.
How is an AML beneficial owner identified?+
Start with a natural person holding at least 25% of issued voting shares or investment. If none is identified, apply the largest-holder and other-control tests; if those fail, identify the representative. Trace corporate ownership through to natural persons.
How long are AML records kept?+
Five years from the statutory termination of the relevant financial-transaction relationship. The termination event depends on the transaction type; for a VASP relationship, it is when all claims and obligations from virtual-asset transactions are settled.
Must a VASP register?+
A covered VASP must register with KoFIU and satisfy the current acceptance and renewal conditions. Registration and travel-rule transition details changed in 2026, so operators must verify the current Korean text and KoFIU notices before launch.
What happens on a Korean restricted-person match?+
Do not execute a covered financial transaction or dispose of relevant property without prior FSC approval. Escalate and block the activity, and make the without-delay investigative-authority and KoFIU reports when the statutory knowledge tests are met.
What are PIPA's 72-hour breach duties?+
Known actual breaches generally require notice to affected persons within 72 hours, subject to limited exceptions. PIPC or KISA reporting within 72 hours applies only when the current decree criteria are met, including at least 1,000 affected data subjects, sensitive or unique-identification information, or unlawful external access. Separate notice applies to the specified possible-breach scenarios introduced in 2026.
Is South Korea on a FATF public list?+
No. The Republic of Korea was absent from both FATF public lists dated 19 June 2026. It remains subject to FATF mutual-evaluation follow-up, and absence from a list is not a low-risk finding.
منهجية البحث والمراجعة
تحدد VOVE ID Compliance Research النطاق التنظيمي، وتحول الالتزامات إلى ضوابط تشغيلية، وتربط الادعاءات الجوهرية بالمصادر، وتسجل تاريخ وإصدار كل مراجعة.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 25 September 2026. Confirm the entity-specific FTRA perimeter, current KoFIU regulations and forms, sector licence, VASP transition dates, sanctions notices, privacy basis and any Korean-language source text with the competent authority and qualified Korean counsel before launch.