Share
South Korea’s Financial Services Commission wants the country’s crypto exchanges to stop sleeping. Under emergency security guidelines announced on November 12, 2026, virtual asset service providers must now watch their systems 24/7, with dedicated personnel assigned to the job.
The rules also call for exchanges to keep as much of their users’ crypto in cold wallets as possible. They also lay groundwork for bank-level IT standards under the forthcoming Digital Asset Act.
The timing is not subtle. The guidelines follow a significant security incident involving a hack at Binance, a reminder that even the largest platforms can get caught flat-footed.
What the FSC is actually requiring
The core requirement is continuous system monitoring. Every virtual asset service provider, or VASP, needs staff specifically tasked with watching for trouble around the clock.
Monitoring alone is not enough. Exchanges must also have immediate response protocols ready for suspicious activity, including unusual large transactions.
The most notable change involves when exchanges can hit the brakes. The guidelines include a no-action letter mechanism that lets exchanges freeze deposits and withdrawals based on suspicion of a breach, not confirmed hacking. A no-action letter is essentially regulatory reassurance that a firm won’t be penalized for a specific action.
Then there is cold storage. The guidelines push exchanges to maximize the share of user assets kept in cold wallets, which are offline storage systems disconnected from the internet.
The crypto and markets news you actually need—every morning.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
We respect your privacy. Unsubscribe anytime.
Most exchanges already clear the bar
Here the numbers get interesting. The legal minimum for cold wallet storage is 80%, mandated under South Korea’s Virtual Asset User Protection Act. The industry average already sits above 95%, according to figures from late 2026.
The leaders are well past the line. Upbit reports cold wallet holdings above 99%. Bithumb’s ratio is approximately 94-95%.
Coinone sits at around 85%. That clears the legal floor comfortably, but it trails its larger rivals by a noticeable margin.
The bigger regulatory picture
These emergency guidelines are a bridge to something larger. The forthcoming Digital Asset Act is set to impose bank-level IT safety standards on VASPs. It would also attach liability for damages, meaning exchanges could be on the hook when users lose money because of security failures.
The broader direction is clear. South Korea has been steadily pulling crypto exchanges closer to the operational standards applied to traditional financial institutions. The stated goal is to strengthen the country’s position as a major crypto trading hub while raising consumer protections, as fraud and theft incidents in the industry keep piling up.
What this means for exchanges and users
For users, the immediate takeaway is mostly positive. Round-the-clock monitoring and faster freeze powers should, in theory, shrink the window attackers have to drain funds. High cold storage ratios mean that even a successful breach of hot wallets would expose a smaller slice of total assets.
There is a tradeoff, though. The power to freeze deposits and withdrawals on suspicion alone means users could occasionally find their funds temporarily locked over a false alarm.
The key things to watch are the final text of the Digital Asset Act and how its liability provisions are written. It will also be worth tracking how often exchanges actually use the new freeze powers, and whether Coinone moves its cold wallet ratio closer to its rivals.
