Starting a Bitcoin Treasury Company in South Korea: A Comprehensive Guide

South Korea is known for its tech-savvy market and evolving regulatory landscape for cryptocurrencies. Launching a Bitcoin treasury company – a business that holds or manages Bitcoin as a corporate asset – requires careful planning. This guide covers business models, legal requirements, incorporation steps, banking and accounting, tax considerations, risk management, and governance best practices, all tailored to South Korea’s context in 2025.

1. Business Models and Company Types for a Bitcoin Treasury

Bitcoin treasury companies can take various forms. Some may simply hold Bitcoin on their balance sheet as a reserve asset, while others provide crypto-related financial services. It’s important to choose a business model that aligns with your goals and to understand the regulatory implications of each. Below is an overview of potential business models and their characteristics:

Business Model	Description	Regulatory Considerations
Corporate Treasury (Investment Holding)	A non-financial company that allocates part of its corporate treasury to Bitcoin as a long-term investment or hedge. Often, the core business is something else (e.g. tech, media), but the firm holds BTC as a reserve asset. Example: K Wave Media (a Korean entertainment firm) announced plans to raise $500M to build a Bitcoin treasury reserve .	Not a regulated financial service. Holding Bitcoin for the company’s own treasury does not require a special license in Korea. Bitcoin is treated as an intangible asset on the balance sheet (not as legal currency), so standard corporate laws apply (e.g. accounting and tax), but no Virtual Asset Service Provider (VASP) registration is needed if you are not providing services to others. Transparency in financial reporting is still important (disclose holdings in statements), and any gains will be subject to corporate tax (see Tax section).
Crypto Advisory Services	A firm that provides consulting or advisory services on cryptocurrency investments, strategy, or treasury management to other companies or investors. This could include advising on how to buy, store, or account for Bitcoin in corporate treasuries.	If purely advisory (no handling of client assets or execution of trades), this model is generally not formally regulated under financial laws, since cryptocurrencies are not yet classified as financial investment products . No specific license is required just to give advice. However, the company should still follow general business registration laws and fair business practices. Note: If advice extends to managing client funds or if it overlaps with investment advice on tokenized securities, additional licensing (as an investment advisor under the Capital Markets Act) might be required. Always ensure compliance with advertising and consumer protection laws.
Crypto Payment Services	A company that enables payments or remittances in Bitcoin or other cryptocurrencies. For example, facilitating merchant payments, international remittances using crypto, or issuing a crypto payment app or stablecoin. Example: PayProtocol’s Paycoin (PCI) was a payment token used at retailers like Pizza Hut, 7-Eleven, and others .	Payment-focused businesses are regulated as they involve handling crypto transactions for users. In Korea, any service that transfers or exchanges crypto on behalf of others is considered a VASP and must register with authorities . If the service involves conversion to/from Korean won, a real-name bank partnership is mandatory (per Korean law, crypto-fiat services must link to bank accounts with identity verification) . For instance, Paycoin’s operator was required to register as a crypto exchange (VASP) and secure a bank partner, or cease operations . Expect strict AML/KYC requirements and possibly compliance with the Electronic Financial Transactions Act for payment processing.
Custodial or Wallet Service	A business that safekeeps cryptocurrency for clients – for example, a digital asset custody provider or a secure wallet service for institutions. This includes offering secure storage (cold wallets, multisig) and account management for client assets.	Custody services are explicitly classified as virtual asset service providers (storing or managing virtual assets for others) and must register as VASPs . They are subject to heavy regulatory scrutiny to ensure asset security. Requirements include obtaining ISMS (information security) certification and adhering to strict custody rules (e.g. maintaining a large portion of assets in cold storage ). Many Korean banks and fintech firms have entered this space via joint ventures – e.g. Korea Digital Asset (KODA), established by KB Bank and partners, is a leading custodial service registered with the FIU and held ~80% of Korea’s crypto custody market share as of mid-2023 . Custodians must implement robust cybersecurity and insurance measures (see Risk Management section).
Cryptocurrency Exchange or Brokerage	A platform for buying, selling, or trading cryptocurrencies (including Bitcoin) – either as a traditional exchange or an OTC brokerage for institutional clients. This is a full-fledged financial service model.	Crypto exchanges/brokerages are highly regulated in South Korea. They must register as VASPs and meet all regulatory prerequisites: FSC licensing and reporting to KoFIU, ISMS certification, use of real-name bank accounts for customer deposits/withdrawals, and strict AML/KYC compliance . Only a handful of exchanges (Upbit, Bithumb, etc.) cleared these hurdles post-2021. New entrants face significant barriers, including capital requirements and the upcoming Virtual Asset User Protection Act enforcement which mandates user asset segregation, insurance reserves, and prohibits unfair trading . This model is regulatory-intensive but can be pursued if you have substantial resources and compliance capabilities.
Token Issuance (ICO/STO)	Creating and selling a new cryptocurrency or token (for fundraising or as part of your business model). An ICO (Initial Coin Offering) or similar token sale to investors would fall here.	Not currently allowed in South Korea. Domestic ICOs are banned since 2017 due to concerns over fraud and speculation . While security token offerings (STOs, tokenized securities) are being explored under the Capital Markets Act (with plans to legalize them under proper regulation) , , any unregistered token sale can result in regulatory action. In short, raising capital via a new token in Korea is off the table unless laws change. Companies should seek traditional funding or conduct token sales in jurisdictions where it’s legal (and even then, be mindful of Korean investor restrictions).
Mining or Staking Operations (Infrastructure)	A company focused on cryptocurrency mining (e.g. Bitcoin mining farms) or running blockchain infrastructure (staking nodes for certain protocols). The goal is to earn crypto rewards which then form part of the treasury.	Cryptocurrency mining is not prohibited at the national level in Korea , but it’s relatively uncommon due to high electricity costs and local regulations (some local governments restrict industrial-scale mining due to energy usage or fire safety). Mining operations don’t require a VASP license if you are mining for yourself and not handling others’ assets. They would be treated like any manufacturing or IT hardware business. However, any service for others (like operating a mining pool or staking service on behalf of clients) might be seen as a financial product or investment contract, which is a gray area – proceed with caution and legal advice. Mining revenue is taxable as corporate income.

Note: The choice of company structure (e.g. a stock corporation “Chusik Hoesa” vs. a limited liability company “Yuhan Hoesa”) will depend on factors like funding needs, liability, and governance preferences. Most crypto-financial ventures incorporate as standard commercial companies in South Korea. Ensure the company’s purpose (as stated in the Articles of Incorporation) is broad enough to cover cryptocurrency-related activities (e.g. “digital asset investment and consulting”) to avoid issues with registration or banking later.

2. Legal and Regulatory Framework in South Korea for Cryptocurrency

Operating a crypto-related business in South Korea means navigating a complex but increasingly well-defined legal framework. The government’s approach is “balanced” – encouraging blockchain innovation while enforcing strict rules to protect investors and prevent illicit activities . Below we outline the key laws and regulatory bodies you need to know:

2.1 Key Cryptocurrency-Related Laws and Regulations

• Act on Reporting and Use of Specific Financial Transaction Information (often called the Specific Financial Information Act, amended 2020): This law first brought cryptocurrencies into a legal framework. It legally recognized “virtual assets” and imposed AML (anti-money laundering) obligations on crypto businesses. Since March 2021, all crypto exchanges and similar businesses are required to register with the government and comply with security standards under this act . In practice, this meant exchanges had to implement KYC (no more anonymous trading) and obtain an ISMS security certification. This law is the basis for the VASP (Virtual Asset Service Provider) registration regime overseen by KoFIU (see Section 3).
• Act on the Protection of Virtual Asset Users (2023, effective July 2024): A comprehensive new law aimed at strengthening consumer protection and market integrity in the crypto industry . It fills gaps not covered by the AML-focused law above. This Act defines what counts as a “virtual asset” and imposes requirements on VASPs to safely manage customer assets, segregate customer funds, maintain reserves/insurance, and uphold fair trading standards . It introduces statutory penalties (including criminal charges) for unfair trade practices like insider trading, market manipulation, or fraudulent orders using virtual assets . In essence, it brings crypto markets more in line with the safeguards of traditional financial markets. Companies in the crypto space will need to comply with detailed rules on custody (e.g. keeping ≥80% of client coins in cold storage) and disclosures once this law is in force .
• Financial Investment Services and Capital Markets Act (FSCMA): While this is the main law governing securities and financial investments, it currently does not classify standard cryptocurrencies (like Bitcoin) as “securities.” However, security tokens or certain crypto assets that have profit rights or resemble stocks may be regulated under this act. In fact, Korean regulators have indicated plans to allow Security Token Offerings (STOs) and integrate them into the capital markets framework . Additionally, the new Virtual Asset User Protection Act borrows concepts from the FSCMA for defining and penalizing unfair trading – for example, determining when information is “public” for insider trading rules (it sets specific time frames for information disclosed on exchanges or issuers’ websites) . If your business deals with tokenized equities or any crypto that might be deemed a security, be prepared to follow securities law and licensing.
• Electronic Financial Transactions Act (EFTA): This law governs electronic payment services, prepaid instruments, remittances, etc. Cryptocurrencies are not recognized as legal currency or electronic money under Korean law, so the EFTA doesn’t directly apply to pure crypto transactions. However, if your business model involves storing customers’ fiat funds (KRW) for facilitating crypto trades or payments, or integrating with payment networks, you may need to comply with relevant EFTA provisions (e.g. obtaining a prepaid payment business license or small-sum remittance license). For instance, crypto payment services that handle fiat conversion must also follow traditional e-money regulations in addition to crypto-specific laws.
• Tax Laws: There is currently no separate cryptocurrency tax law for corporations – corporate-held crypto is treated under normal corporate tax rules (see Section 6 on Taxation). For individuals, note that Korea planned a 20% tax on crypto capital gains (above KRW 2.5 million annual threshold) which has been delayed until 2028 . This delay reflects ongoing debate about market readiness for taxation. Companies should still anticipate that any realized gains from crypto will be taxed as part of corporate income.
• Other Relevant Rules: South Korea adheres to FATF guidelines on crypto. Notably, the “Travel Rule” has been implemented – VASPs are required to collect and share originator/beneficiary information for large crypto transfers to combat money laundering . Also, Initial Coin Offerings (ICOs) are banned domestically (as noted above) . Cryptocurrency derivatives (futures, options) cannot be offered by financial institutions to the public as they are considered high risk – since 2017 regulators prohibited local financial firms from dealing in crypto derivatives . Overall, Korean authorities actively update regulations, so staying informed through official channels (FSC press releases, etc.) is crucial.

2.2 Regulatory Bodies and Authorities

Several government bodies oversee different aspects of the crypto sector in South Korea :

• Financial Services Commission (FSC) – Primary regulator and policymaker. The FSC is the top financial regulator that formulates cryptocurrency policy and regulations at the national level. It has the authority to license and approve financial businesses. Since crypto is not fully integrated into existing financial licensing, the FSC’s role has been to enact new laws (like the ones above) and require registrations. Under the 2023 Act, the FSC can supervise and inspect VASPs and impose penalties for violations . Any high-level decisions (e.g. allowing new types of crypto products, institutional adoption, etc.) are likely driven by the FSC. When you register a crypto business, the application/report goes through the FSC (via KoFIU).
• Financial Supervisory Service (FSS) – Enforcement and oversight. The FSS is the executive arm that conducts audits, examinations, and day-to-day supervision of financial institutions. It ensures compliance with laws and regulations set by the FSC . In crypto context, once your business is registered, the FSS may conduct inspections to check your AML procedures, security measures, books and records, etc. The FSS has also been involved in studying crypto markets and preparing for potential integration (for example, discussing Bitcoin ETFs and institutional trading guidelines). Essentially, expect the FSS to treat a crypto company much like any financial institution when it comes to oversight.
• Korea Financial Intelligence Unit (KoFIU) – Anti-money laundering regulator. KoFIU is Korea’s primary AML authority, operating under the FSC’s umbrella. It handles the registration of VASPs and serves as the intermediary between crypto businesses and law enforcement for AML matters . All VASPs must file a report with KoFIU before starting operations . KoFIU sets guidelines for KYC (Know-Your-Customer), transaction monitoring, and suspicious transaction reporting. It receives Suspicious Transaction Reports (STRs) from institutions and can investigate or forward them to prosecutors . KoFIU is also active in enforcement: it has ordered blockages of unregistered foreign crypto exchanges (16 overseas exchanges were cut off for serving Koreans without license) . When starting a crypto company, engaging with KoFIU for registration and compliance is one of the first major steps.
• Korea Internet & Security Agency (KISA) – Cybersecurity and Certification. While not a financial regulator, KISA plays a pivotal role by administering the Information Security Management System (ISMS) certification. ISMS certification is mandatory for any crypto asset business in Korea as a proof of robust cybersecurity . KISA audits and certifies that a company meets standards in data protection, access control, network security, etc. Without an ISMS certificate from KISA, KoFIU will reject a VASP registration . In practice, achieving ISMS is a major pre-launch project for crypto startups, often requiring several months of preparation and improvements to IT governance. (Note: Large exchanges in 2021 had to obtain ISMS by law, which weeded out many smaller players.)
• Ministry of Economy and Finance / National Tax Service (NTS) – Tax authorities. The Finance Ministry sets tax policy (e.g. deciding when to implement the crypto capital gains tax), and the NTS enforces tax laws. They will treat corporate crypto holdings under existing tax frameworks. The NTS has also investigated individuals for crypto tax evasion and could audit companies if crypto transactions are involved. Ensure proper tax reporting to avoid issues.
• Other bodies: The Korea Financial Industry Association or Blockchain associations are industry groups rather than regulators; however, being involved with them can give insights into regulatory trends and best practices. Additionally, the Bank of Korea (central bank) is monitoring crypto (especially regarding any impact on capital flows and considering a CBDC), though it doesn’t directly regulate crypto businesses (aside from overseeing foreign exchange rules in remittance cases).

South Korea’s regulatory environment is evolving. In 2024-2025, we see opening of institutional access (allowing corporate crypto accounts, discussed in Section 5) and efforts to integrate crypto with traditional finance. Always stay updated with FSC press releases and be prepared to adapt your compliance as rules tighten or new opportunities (like security tokens or Bitcoin ETFs) emerge.

3. Licensing and Registration Requirements for Crypto Holdings and Services

Depending on your business model, you may need to obtain specific licenses or registrations to operate legally:

• If your company is only holding or investing its own funds in Bitcoin (treasury investment): There is no special license required just to hold crypto on your balance sheet. Holding Bitcoin as a corporate asset is treated similarly to holding any other investment asset. Ensure you follow standard company laws, accounting rules, and disclosure requirements, but you generally do not need to register as a crypto service provider if you are not offering services to others. (Example: A regular corporation like a game developer that buys Bitcoin with surplus cash faces no licensing, only reporting the asset on financial statements.)
• If your company will provide cryptocurrency-related services (to customers or clients): You will very likely fall under the definition of a Virtual Asset Service Provider (VASP) and must register with the government. Korea’s law defines a VASP as any business that conducts buying, selling, exchanging, transferring, safekeeping, brokering of virtual assets on behalf of others . This covers exchanges, brokers, payment facilitators, custody providers, dealers, etc. In short, any business involving handling crypto that isn’t solely your own assets is a regulated activity. The only notable exception might be if you’re purely developing software or providing technology (without touching customers’ crypto or money) – but even crypto ATM operators or P2P transaction brokers would be VASPs.

Key requirements for VASP registration (licensing) in South Korea:

• Local Entity & Basic Registration: You must establish a local Korean company (refer to Section 4 for incorporation steps) and then file a VASP registration (Report) with KoFIU before starting operations . The registration involves submitting details of the company, its representatives, business address, and a description of services . Foreign companies cannot operate in Korea without either setting up a domestic subsidiary/branch and registering, or they will be deemed illegal (and the government actively blocks unregistered foreign platforms ).
• Information Security Management System (ISMS) Certification: This is a pre-requisite for registration . You must obtain ISMS certification from KISA, demonstrating that your company meets strict standards for protecting user information and asset security. In practice, this means having robust IT security policies, access controls, encryption, audit logs, etc. If you fail to get ISMS, KoFIU will not register your business . Most crypto startups hire security consultants to prepare for ISMS audits. (This step can take months, so plan accordingly.)
• Banking Partnership (Real-Name Accounts): If your business will deal with Korean won (fiat) transactions – for example, a crypto exchange enabling KRW deposits/withdrawals – you must secure a partnership with a local bank to provide real-name verified accounts . This rule, introduced in 2021, is one of the toughest hurdles. Banks perform their own due diligence and will typically only partner with exchanges that have strong compliance and a certain scale. Without a bank contract, a VASP cannot legally facilitate any KRW-to-crypto exchange for the public. (If your service is crypto-only, e.g. a crypto-to-crypto exchange or a custody service, you might not need this, but then you must explicitly not touch fiat.) The case of Paycoin highlighted this: regulators demanded the service obtain a bank partner to continue operating its crypto payment network .
• Fit and Proper Management: The law bars registration if certain bad actors are involved. For instance, if the CEO or major shareholder has a criminal record for financial crimes in the last 5 years, the application will be denied . Ensure your key personnel can pass background checks. You will also need to designate compliance officers, including a Money Laundering Reporting Officer (MLRO) to oversee AML compliance .
• AML/KYC Compliance Program: As a VASP, you are obligated to implement a full AML program in line with KoFIU’s guidelines . This includes:
  
  • Customer Due Diligence (Know Your Customer checks on all clients; enhanced checks for large or suspicious accounts).
  • Record-keeping of all transaction records for 15 years (yes, fifteen years – a requirement to enable audit and tracing).
  • Appointing an MLRO and training staff on AML duties.
  • Ongoing transaction monitoring and automated systems to detect suspicious patterns.
  • Suspicious Transaction Reporting (STR): promptly report any transactions that raise red flags (large, unusual, or related to high-risk entities) to KoFIU.
  • Travel Rule compliance: for transfers above a certain threshold, share required sender/recipient information to the beneficiary institution .
  • Sanctions screening: ensure no dealings with sanctioned individuals or countries.
• 
  These requirements mean you need internal controls and possibly third-party compliance solutions (there are companies offering Travel Rule systems, etc.). Non-compliance can lead to heavy fines or license revocation.
• User Protection Measures: Under the new 2024 regime, VASPs must implement specific user protection steps: for example, segregating customer assets (both fiat and crypto) from your own company assets , maintaining a certain ratio (e.g. 80%) of customer coins in cold storage , and having insurance or reserve funds to cover potential losses (such as hacks) . These will be formal licensing conditions once the Act is effective. Even prior to that, demonstrating such measures can strengthen your case when dealing with regulators or banks.
• Capital Requirements: Korea historically did not set a fixed minimum capital for VASPs in law, aside from the insurance/reserve requirements (which effectively mean you need a buffer). However, in practice, any crypto business will need adequate capitalization to get a bank partnership and to gain trust. The new rules mandate minimum reserve amounts (for example, exchanges with KRW markets must have at least KRW 3 billion in reserve or insurance for contingencies, and other VASPs at least KRW 500 million) . This isn’t “paid-in capital” per se, but you must have access to those funds to set aside. Essentially, be prepared with a strong balance sheet.
• Ongoing Reporting and Audits: After registration, VASPs must regularly report certain information (like if there’s a change in ownership, or periodic business reports). They also fall under the audit authority of FSS/KoFIU. Ensure continuous compliance. KoFIU conducts surveys and inspections (recent surveys of VASPs check for compliance status) . Additionally, any security breaches or service changes might need notification to authorities.
• Penalties for Non-Compliance: Operating without registering is a criminal offense. In recent years, Korean authorities have not hesitated to shut down and even prosecute operators of unregistered exchanges. For serious violations (like money-laundering or fraud), company officials can face imprisonment. The new law sets minimum prison terms of 1 year for unfair trading violations by VASPs and fines 3–5 times the amount of unjust profits . In short, take the licensing and compliance obligations seriously. Engage legal counsel early to navigate the process.
• Other Licenses: If your crypto business overlaps with traditional financial services, you may need additional licensing. For example, a crypto remittance service (sending money abroad via crypto) might require a small-scale money transfer license under the Foreign Exchange Transactions Act. Similarly, if you plan to offer custody for institutional investors, you might voluntarily register as a certain type of financial business (some Korean custody providers registered as “trust companies” or were bank-affiliated). Consult a lawyer to see if your model triggers any non-crypto licenses.

In summary, for any customer-facing crypto business, registration as a VASP is mandatory. The process involves substantial preparation (security, banking, compliance). The South Korean government’s stance is that only serious, well-prepared players should operate – as evidenced by the tough requirements that saw dozens of smaller exchanges shut down in 2021. Plan for a timeline that includes incorporation, ISMS certification, and then KoFIU registration before launch. Early dialogue with a potential banking partner and compliance experts can improve your chances of a smooth launch.

4. Steps for Incorporating a Crypto-Focused Business in South Korea

Setting up a legal business entity is the first concrete step. South Korea allows both locals and foreigners to establish companies, but the process and requirements must be followed precisely. Below is a step-by-step checklist to incorporate your company and prepare it for crypto-related operations:

1. Define the Business Scope and Structure – Begin by deciding the type of legal entity. In Korea, common entity types are a Stock Company (Jusik Hoesa) – similar to a C-Corp, suitable if you plan to raise capital – or a Limited Liability Company (Yuhan Hoesa), which is simpler and often used for smaller businesses. Ensure your intended activities (e.g. “virtual asset trading and consulting”) are included in the Articles of Incorporation as the business purpose. It’s advisable at this stage to consult with a lawyer to avoid any restricted activities and to pick the structure that fits your capital and governance needs. (Note: If you are a foreign entrepreneur, consider the Foreign Investment Promotion Act requirements – an investment of ≥ KRW 100 million is needed to be officially recognized as a foreign-invested company with certain benefits , but you can still incorporate with less, just via a slightly different notification process.)
2. Secure a Company Name and Registered Address – Choose a unique company name (English and Korean) that isn’t already in use. You can check name availability through the Corporate Registration Office or portals. You will also need a local registered office address in South Korea. This can be a physical office or shared office space, as long as you have a legal lease or permission to use it for registration. Having a local address is mandatory for incorporation and for tax registration. If you don’t have a presence yet, there are law firms and incubators that provide virtual office addresses for foreign startups.
3. Prepare Incorporation Documents – Draft the Articles of Incorporation (bylaws) which detail the company name, purpose, capital, directors, etc. Arrange for directors and auditors as required (a stock company typically needs at least one director; if capital is large or if you’ll be public, other rules apply, but small startups can have a single director who can be the founder). If you’re incorporating a stock company, you’ll also draft a founders’ meeting report and board resolutions to appoint the initial representatives. All documents for filing must be in Korean (with notarized translations if using foreign documents). If you are a foreigner, you might need to provide extra authenticated documents (like passport, and an Apostille for any overseas certificates).
4. Inject Capital and Obtain a Bank Capital Certificate – Decide on the initial paid-in capital and have it ready to deposit. There is technically no minimum capital requirement for a Korean company (you could even start with 100 won), except if you seek certain statuses (e.g. foreign-invested company status, as mentioned, effectively requires ~100 million won to qualify as FDI ). However, you should invest enough to cover initial expenses and to present a credible image (many start with at least KRW 10–50 million for a small startup). Open a temporary corporate bank account in formation (most banks have a process for this). Deposit the capital into this account. The bank will then issue a Certificate of Deposit or a letter verifying the paid-in capital, which you will submit to the registrar. (If you’re a foreign investor, you must first notify your investment to a bank or KOTRA (Invest Korea) – you’ll get a certificate of FDI notification – then you remit the funds from abroad into a special account. The bank’s certificate of deposit will also note it’s an FDI remittance.)
5. Register the Corporation – With all documents in hand (articles, director consents, bank capital certificate, etc.), file for corporate registration at the local court’s Commercial Registry. This is the formal incorporation step where your company becomes a legal entity. Upon approval, you will receive a Certificate of Incorporation (registration certificate) and a business registration number. The process is usually quick (a few days) if paperwork is in order. At this point, your company (e.g. “XYZ Crypto Co., Ltd.”) legally exists.
6. Register with Tax Authorities – After incorporation, you must also register your business with the tax office (National Tax Service) to obtain a Business Registration Certificate (this is often done simultaneously or immediately after incorporation – in practice, a one-stop process issues both the company registration and tax registration). This registration is needed to conduct any business, issue invoices, etc. You’ll get a 10-digit business number (and if applicable, a separate VAT number). Ensure to register for VAT if you will be selling any services that are not VAT-exempt. Note that buying/selling cryptocurrency itself is treated as trading assets (currently not subject to VAT), but if you provide services (consulting, etc.), those may fall under normal taxation rules.
7. (If Foreign-Invested) File for FDI Registration – If you went the route of investing ≥ KRW 100 million as a foreigner, you should file for registration as a Foreign Invested Company with the Ministry of Commerce (through KOTRA or a bank). This step gets you a Foreign Investment Registration Certificate and potentially some benefits (like easier visa for the representative, and tax incentives in certain cases ). This involves submitting the incorporation certificate and evidences of investment to KOTRA. They will list your company in the foreign investment registry. (Skip this if the company is fully Korean-owned or if foreign investment was below the threshold.)
8. Open Corporate Bank Accounts – Now that you have all the company docs and business registration, open a permanent corporate bank account for your operations. This will be used for everyday finances (paying bills, salaries, etc.) and is separate from the temporary capital account (the capital can be transferred in). Having a stable banking relationship is crucial, especially in crypto – some banks have been known to scrutinize accounts linked to crypto activities. At this stage, it’s helpful to be transparent with your bank about your business (to the extent required) and ensure compliance with their policies. As of 2025, Korean banks are gradually warming to crypto-related firms, especially if registered and regulated, but you may still face careful review.
9. Obtain Required Licenses & Certifications – With the company legally in place, you need to pursue your crypto-specific registrations:
   
   • Information Security Management (ISMS) Certification: Begin the ISMS certification process with KISA as soon as possible . This involves a comprehensive audit of your IT and security practices. You might hire a consulting firm to help you meet all 12 areas of the ISMS standard. Achieving ISMS is mandatory for VASP registration – you will need to submit proof of ISMS certification as part of your KoFIU report.
   • Virtual Asset Service Provider (VASP) Registration: Prepare your VASP registration (report) to KoFIU . This includes documentation of your business plan, organizational structure, AML/KYC internal rules, ISMS certificate, information on directors/shareholders, and your bank partnership (if applicable). You will file this report with the KoFIU (usually via the Financial Intelligence Unit’s online system or via FSC). If everything is in order, KoFIU will issue a registration certificate/confirmation. Only after this step are you legally allowed to launch crypto asset services. (Tip: maintain close communication with KoFIU officials during the process; respond promptly to any requests for additional information.)
   • Other Licenses/Permits: Depending on your business, get any additional approvals. For example, if doing a fintech payment service, you might register in the financial innovation sandbox program (to get temporary permission to pilot an innovative service). Or if doing a money transfer, apply for a remittance license from the FSC. Also ensure compliance with personal data protection (PIPA) by perhaps registering a data protection officer if handling customer personal info.
11. Set Up Operations and Internal Controls – With licensing in progress or achieved, set up the practical aspects: deploy or rent the necessary IT infrastructure (servers, custody systems), implement internal controls (dual sign-offs for transactions, employee background checks, etc.), and hire key staff. Critical hires typically include a Chief Technology Officer/Security Officer (to manage wallet security, systems, etc.) and a Compliance Officer/MLRO (to enforce AML policies and liaise with KoFIU) . Provide training to all employees on security protocols and code of conduct (especially important in crypto to prevent internal fraud or leaks). Additionally, draft clear Policies & Procedures for your operations – e.g., how private keys are managed, how often audits are done, how to handle customer onboarding – as these might be reviewed by regulators or partners.
12. Engage Banking and Partnerships – If not already done as part of licensing, finalize your bank partnership for real-name account services (this only applies if your business model needs KRW accounts for users). This can be the hardest step; essentially, you must convince a bank to issue deposit accounts to your users (they will integrate with your exchange’s systems). Banks in Korea will check that you are fully licensed (KoFIU registered), have ISMS, and have solid risk management. As of 2025, major banks like Shinhan, Kookmin, and KakaoBank have shown interest in partnering with crypto firms as the institutional market opens . Start discussions early and expect to undergo a thorough risk assessment by the bank. Apart from banks, consider other partnerships – e.g., cybersecurity firms (for audits or insurance), accounting firms (for crypto accounting guidance), or established crypto companies for liquidity or technology. Forming alliances can strengthen your position and credibility.
13. Testing and Launch – Before a full public launch, conduct internal testing of all systems (perhaps even a closed beta if possible). Ensure compliance checks are working (for instance, test your AML monitoring by simulating suspicious activities and see if alerts trigger). Also, ensure you have a contingency plan (what if a wallet is compromised? what if prices crash? etc.). Once everything is in place and you have the necessary approvals, you can launch your services to customers. Remember to prominently display your certifications (ISMS logo, etc.) and legal disclosures on your website – this builds trust and shows compliance.

Each of these steps can be intricate, but South Korea does provide resources. InvestKorea (KOTRA) offers support for foreign businesses setting up , and local law firms are experienced in crypto ventures. Tip: Keep a binder of all your compliance documents and licenses; you will need to update and reference them often. Incorporating and licensing a crypto business in Korea is a marathon, not a sprint – but with diligence, it is achievable, as evidenced by the successful exchanges and crypto firms operating in the country.

5. Banking and Accounting Considerations for Bitcoin Treasury Management

Running a Bitcoin-centric company involves interfacing with both the traditional financial system (banks, accounting standards) and the crypto world. This section covers how to handle banking relationships and how to account for Bitcoin on your books.

5.1 Banking Relationships and Financial Services

Banking is critical in South Korea’s crypto ecosystem – not just for exchanges, but for any company that needs to convert between fiat and crypto or simply manage its finances. Key considerations include:

• Difficulty in Obtaining Banking Services (Historically): Korean banks have been conservative with crypto businesses due to regulatory risk. Up until recently, corporate entities were barred from having accounts on crypto exchanges directly . Only individual real-name accounts were allowed. This meant companies had no straightforward way to trade crypto on domestic exchanges. Many firms resorted to using overseas platforms or OTC brokers, which carried legal and security risks. Good news: as of 2024-2025, this is changing. The FSC announced a phased plan in 2024 to allow corporate entities to open exchange accounts, starting with certain institutions and expanding to general corporations . By early 2025, major exchanges like Upbit and Bithumb have begun accepting corporate account applications (they set up dedicated onboarding for businesses) . This means your company will likely be able to legally trade and manage crypto through Korean exchanges in the near future, if not already.
• Choosing a Banking Partner: For day-to-day operations, you’ll use normal corporate bank accounts. Any major commercial bank (Kookmin, Shinhan, Hana, Woori, etc.) can provide checking accounts, foreign exchange, and other services. However, if your business deals in crypto transactions, expect close scrutiny of large fund movements. It’s wise to work with a bank that is relatively crypto-friendly. Notably, Shinhan Bank has partnered with Korbit exchange for corporate crypto services , and KakaoBank with Coinone . These partnerships indicate those banks’ openness to the sector. When pitching to a bank, emphasize your regulatory compliance (show them your VASP registration, AML policies, etc.) to give comfort that you won’t pose a money-laundering risk. Also, discuss solutions like segregated accounts or escrow arrangements if needed to add security.
• Real-Name Account System: If you run an exchange or service where users deposit KRW to trade crypto, you must operate under the real-name account system. Practically, this means the bank creates a virtual sub-account for each user, linked to their verified identity, and no anonymous or shared accounts are allowed. The bank will continuously monitor inflows/outflows and share data with you for AML compliance. There will be a contract outlining each party’s responsibilities (for example, the exchange monitors transactions, the bank reports any suspicious fiat transfers, etc.). Banks usually also require the crypto company to hold a certain amount of deposit with the bank as risk security and to have an ISMS cert (which you will). This setup was famously difficult to secure in 2021; only a few exchanges got it. By 2025, with corporate accounts being allowed, banks appear more willing to extend these services to more players under government guidance , but it’s still a high bar.
• Managing Fiat <> Crypto Conversion: If your treasury company’s goal is to accumulate Bitcoin, you’ll need a strategy to convert funds. Options include:
  
  • Using a domestic exchange (once your corporate account is approved) for straightforward buying on the market. Liquidity on Korean exchanges is high for major coins like BTC.
  • Using an OTC desk or broker, which might be helpful for large purchases to avoid slippage. Some Korean securities firms or fintech companies are entering crypto brokerage for institutions.
  • Utilizing foreign exchanges – note that servicing Koreans without a license is illegal for foreign exchanges, and KoFIU has blocked many (Binance has a geoblock for KR IPs, etc.). However, a Korean company could still legally use a foreign exchange for its own trading (the law targets unregistered exchanges serving the public, not a company’s private asset management abroad). If you do this, ensure thorough records and be mindful of foreign exchange reporting (transferring large sums of KRW out to buy crypto may trigger BoK foreign transaction reports).
• 
  Whichever route, establish clear bank processes: e.g., if you send $1 million overseas to buy Bitcoin OTC, inform your bank of the purpose (they may ask for supporting docs) to avoid the transfer being flagged. Korea monitors capital flows strictly.
• Custody of Crypto Assets: Decide how you will hold the company’s Bitcoin. You can self-custody (manage your own wallets) or use third-party custodians. Many corporates opt for trusted custodians to mitigate risk. In Korea, as mentioned, KODA and a few other licensed custody providers (some run by banks or fintech firms) offer services to hold crypto on behalf of institutions, providing insurance coverage and auditing. KODA’s rapid growth (KRW 8 trillion assets under custody by 2023) shows that many organizations trust such services . If your priority is security and compliance over the slight cost, using a custodian might be wise – it also reassures auditors that a reputable third party attests to your Bitcoin holdings. The downside is you rely on that custodian’s solvency and security, so choose one with a good track record.
• Insurance and Asset Protection: Traditional banks insure deposits via KDIC (up to certain limits), but crypto isn’t covered by such schemes. However, you can purchase commercial insurance for crypto theft or custodial loss. Also, some Korean exchanges are part of a mutual aid fund or carry insurance as required by the new law . As a company, if you hold significant Bitcoin, consider an insurance policy that covers hacking or key loss (some global insurers provide this, though premiums can be high). From a banking perspective, having insurance might also make you a more acceptable client.
• Payment and Settlement: If your company will pay suppliers or employees, you need to decide whether to use crypto or convert to fiat. Crypto is not legal tender, so most vendors in Korea won’t accept it directly (with a few exceptions in the tech scene). Plan for conversion to KRW for operational expenses. Conversely, if you accept payments in Bitcoin (say you have a side business selling software for BTC), you’ll need an accounting process to record the KRW equivalent at receipt. Keep an eye on regulations: the government does not restrict crypto payments among private parties, but any large crypto receipt by your company might attract questions under AML laws. Always document the economic purpose of any crypto inflows/outflows to satisfy potential bank or regulator inquiries.
• Relationship Management: Maintaining a good standing with banks involves transparency and compliance. Expect periodic reviews of your account by the bank’s compliance team. They may ask for updated business plans, AML reports, or even on-site visits if you’re a large client. Treat the bank as a partner in compliance: notify them if you have an unusual transaction (e.g., receiving a large crypto revenue from abroad that will be cashed out) before it happens. This proactive approach can prevent account freezes. Also, abide by any conditions they set (some banks might limit daily transfer amounts, etc., until trust is built).

In summary, banking for a crypto company in Korea is becoming easier than it was, but it still requires clear communication and robust compliance. The trends are positive – corporate crypto accounts are being rolled out in 2025 – aligning with the government’s strategy to integrate digital assets into the mainstream financial system. Ensure you leverage these developments (for example, get in the queue for a corporate exchange account if relevant) and maintain traditional banking for stability.

5.2 Accounting and Reporting for Bitcoin Holdings

Accounting for Bitcoin in a corporate setting must align with Korean accounting standards (which are based on IFRS – International Financial Reporting Standards). As Bitcoin and other cryptocurrencies are a newer asset class, standards are still evolving. The FSC has provided guidance to ensure transparency in crypto accounting . Here’s what to consider:

• Classification of Crypto Assets: Under current guidelines, cryptocurrencies held by a company are generally classified as intangible assets or inventory on the balance sheet, depending on their purpose .
  
  • If you are holding Bitcoin as a long-term investment or treasury reserve, it is treated as an intangible asset (like intellectual property or goodwill). Intangible assets are recorded at cost when purchased. They are not depreciated, but they can be impaired.
  • If your business is actively trading crypto or holding it for sale in the ordinary course of business (for example, a crypto dealer or exchange holding inventory to facilitate trades), then the holdings might be classified as inventory. Inventory can be valued at the lower of cost or net realizable value under accounting rules.
  • What crypto is not under IFRS: it’s not cash or a cash equivalent, and it’s not a financial instrument (since it doesn’t represent a claim on another entity) . Hence the default to intangible/inventory classification.
• Impairment and Valuation: A key implication of treating Bitcoin as an intangible asset is impairment accounting. This means:
  
  • You initially record the Bitcoin at purchase cost on your books.
  • In each reporting period, if the market price falls below the carrying cost, you must write down (impair) the value to the new lower market value. That impairment loss hits your P&L (profit and loss statement).
  • However, if the price rises, you do not write it up on the balance sheet under IFRS rules (intangible assets cannot be revalued upward to market unless using a revaluation model, which is uncommon for crypto; most use cost model). So the asset stays at cost (or impaired lower value) on the balance sheet even if market value is higher.
  • This can create a disconnect: in bull markets your books may understate the value of your Bitcoin. Disclosure is crucial (see next point).
  • If you later sell the Bitcoin, any difference between sale price and book value goes through P&L as a gain or loss. (So after a prior impairment, selling in a rebound can create a large reported gain.)
• Mandatory Disclosures: Aware of the above issue, Korean regulators now require enhanced disclosures for virtual assets . Companies holding crypto must disclose in the notes to financial statements:
  
  • The accounting policy used for crypto assets.
  • The book value of each significant crypto asset holding (the value on the balance sheet).
  • The market value of those holdings at the reporting date .
  • If crypto is held as inventory, disclosure of that fact and the method (e.g. lower of cost or market).
  • Any valuation techniques used (if you hold tokens that don’t have active market prices, for instance).
  • Additionally, if you self-issue tokens (not likely in a Bitcoin treasury context), there are guidelines: funds raised by token issuance should be treated as liabilities until you fulfill any obligations to token holders (only then recognized as equity or revenue) .
• 
  The aim is to give readers of financial statements a clear view of the economic value of your crypto, even if accounting rules don’t capture fair value gains. This transparency is mandated by the FSC’s 2023 guidance .
• Audit and External Verification: If your company meets certain size thresholds, you’ll need annual external audits. Auditors in Korea will scrutinize crypto holdings carefully. They will likely request to observe the existence of your Bitcoin – this could mean anything from checking your wallet balances, reviewing custodial account statements, or even asking you to move a small amount from a wallet to prove control (a common audit procedure for crypto). Be prepared to provide evidence of ownership (wallet addresses, transaction history) and to explain your valuation. Given that crypto is a new area, choose an audit firm that has experience or specialists in digital assets to avoid protracted audits. All Big Four firms in Korea have crypto accounting knowledge centers now.
• Revenue Recognition: If your business earns revenue in crypto (for example, you get consulting fees paid in BTC), you should record that revenue in KRW at the time of the transaction using a fair market exchange rate. The crypto then goes on the books as an asset. Any subsequent change in value of that crypto before you convert it to cash will be an unrealized gain/loss (which, as discussed, might not be recognized unless impaired). Essentially, treat crypto like non-cash consideration for goods/services – convert to KRW equivalent for accounting purposes at receipt.
• Tax and Accounting Alignment: The tax authorities generally follow book accounting for recognizing profits, with some adjustments. In the absence of specific crypto tax rules for companies, expect that:
  
  • If you record a gain on selling Bitcoin, it will be taxed as part of taxable income.
  • If you record an impairment loss (write-down) on Bitcoin, you can likely deduct that as an expense, since it’s a real loss in value. (One caveat: if crypto values recover, the tax authority may watch for companies selling and re-buying to realize losses; normal anti-tax avoidance rules apply.)
  • Since crypto is not a depreciable asset, there’s no depreciation schedule – it’s either on the books at cost or impaired.
  • Ensure to keep clear records of every crypto purchase and sale (date, amount, price) to support your accounting entries. The tax office can request these if they audit your corporate tax filing.
• Alignment with IFRS Developments: Global accounting bodies are discussing changes (for instance, the FASB in the U.S. is moving to allow fair value accounting for crypto). The FSC indicated a preference to follow international standards and issued its own guidance in absence of IASB action . Keep an eye on any changes in K-IFRS relating to digital assets. If rules loosen to allow fair value gains to be recognized, it could significantly impact how you report profits (and thus taxes). As of 2025, Korean standards require the conservative approach (cost less impairment) but with full disclosure of fair value .
• Internal Accounting Practices: From an internal management perspective, you may want to track the market value of your Bitcoin treasury continuously, even though your official books don’t. This helps in decision-making and risk management. You could maintain a memorandum record or use software that marks to market daily for internal reports. Just be clear in external reports what is official GAAP versus additional info.
• Consolidation and Foreign Currency: If your company has subsidiaries abroad or conducts crypto trades in foreign currency (e.g., using USD on an international exchange), normal rules of currency translation apply. Crypto itself is not “currency,” but the value you measure it in (KRW) will involve forex if you bought it with USD. You might have forex gains/losses separate from crypto price effects (for instance, if you hold Bitcoin on a US exchange in USD terms, when consolidating, you have to translate USD to KRW – any change in KRW/USD rate will affect the KRW value independently of Bitcoin’s USD price). This is an extra layer of complexity to be mindful of.
• Record Retention: As noted under compliance, keep all accounting records of crypto transactions for at least 15 years . This is unusually long (normal accounting records retention is 5-7 years in many cases), but given the regulatory requirement and the possibility of long investigative look-back periods, invest in proper record-keeping. This includes transaction logs, wallet addresses, exchange receipts, etc. Many companies use specialized crypto accounting software to help reconcile blockchain transactions with accounting entries – consider using these tools as your volume grows.

In short, treat Bitcoin in your treasury with the same rigor as you would cash or financial investments in terms of accounting accuracy and disclosure. South Korea’s regulators expect more transparency due to crypto’s volatile nature . A well-kept set of books and clear disclosures will not only keep you compliant but also build trust with investors, auditors, and banks.

6. Tax Implications for Holding Bitcoin in a Company Treasury

Understanding the tax treatment is essential to avoid surprises. Taxation in South Korea of cryptocurrency, especially when held by companies, currently follows general principles since there are not many crypto-specific tax codes for corporates. Here are the main points:

• Corporate Income Tax on Crypto Gains: If your company holds Bitcoin and later sells it at a profit, that profit is subject to corporate income tax, just like profit from selling any investment. South Korea’s corporate tax rates are progressive; as of recent reforms, they range roughly from 9% to 24% (formerly up to 25%, reduced slightly under Yoon’s tax reform) depending on income brackets . All profits of a domestic corporation – regardless of source – are taxable . There is no special lower rate or exemption for crypto-derived income. So, if in one fiscal year you realized a large gain from Bitcoin, expect it to boost your taxable income for that year.
• Tax Deduction on Losses: Conversely, if you sell Bitcoin at a loss, that can typically be deducted against other income, reducing your taxable profit. Korea allows loss carryforwards in general, so if crypto investments cause a net operating loss, you may carry that forward to offset future profits (subject to limitations). Additionally, impairment losses recorded on your books for Bitcoin (as discussed in accounting) should be tax-deductible expenses, since they reflect a loss in asset value. The National Tax Service would likely scrutinize big write-downs if they think you might reverse them later, but currently there’s no rule disallowing crypto impairment for tax – it’s treated like an asset impairment.
• VAT (Value Added Tax): In Korea, the trading of cryptocurrency itself is exempt from VAT – because crypto is not considered a good or service, and also not legal tender, it falls in a sort of intangible asset category which is not subject to VAT on the transfer. This means if your company simply buys and sells Bitcoin (proprietary trading), you don’t add VAT. Likewise, if you’re an exchange charging fees on trades, those fees have been interpreted as VAT-exempt financial services (though this could be revisited by tax authorities). However, be careful: if you sell something for cryptocurrency (say you accept BTC as payment for consulting services), the transaction is treated as a barter: your service is subject to VAT and you must calculate the KRW value of the crypto received to remit the VAT. In summary, holding or trading crypto doesn’t incur VAT, but using crypto in lieu of cash for goods/services does not avoid VAT.
• Withholding Taxes: If you pay any overseas entity or individual with cryptocurrency (for instance, hiring a foreign contractor and paying in BTC), Korean tax law might view it as an offshore payment, and withholding tax rules could apply (usually on royalties, etc., which likely won’t apply to a straightforward payment for services). But if applicable, you’d have to gross-up or handle that in fiat. This is an edge case; typically, you’d handle cross-border payments in fiat to keep it simple and comply with foreign exchange regs.
• 20% Crypto Gains Tax (Individuals): You may hear about Korea’s plan to tax personal crypto gains above 2.5 million KRW at 20%. This does not apply to companies, as companies are already taxed on all gains (no threshold). It’s aimed at individual investors. As of April 2025, this tax on individuals is postponed until 2028 . The policy environment around individual crypto tax has been contentious, but for your corporate treasury, the key takeaway is that your shareholders or executives might face tax if extracting profits as dividends or if they personally hold crypto, but the company itself just follows corporate tax norms.
• Foreign Asset Reporting: South Korea has strict reporting for foreign financial accounts (FBAR) for individuals if above certain thresholds, and for corporates in some cases. It’s not entirely clear if holding crypto on a foreign exchange or wallet constitutes a “foreign financial account” under current law. To err on the safe side, if your company holds a significant amount of crypto in a wallet hosted abroad or with a foreign custodian, consult tax advisors if that needs to be reported to the tax authority under the Foreign Exchange Transactions Act or tax laws. While crypto isn’t currency, the NTS might treat, for example, a foreign exchange account holding fiat from crypto sales as reportable.
• Transfer Pricing: If your Korean entity interacts with overseas affiliates for crypto transactions (say your parent company abroad sends Bitcoin to the Korean entity), be mindful of transfer pricing rules. The tax authority will want such transfers to be at arm’s length market values. Document any intercompany crypto transfers with valuations at the date of transfer to show no evasion of tax.
• Employee Compensation in Crypto: Should you decide to pay employees or contractors in Bitcoin, note that this is still considered compensation in kind. You must still withhold income taxes as if it were cash (calculate the KRW value at payment time). Generally, most companies avoid this due to the complexity; they pay in KRW, and employees can then invest in crypto on their own.
• Tax Incentives: Crypto-specific incentives are nonexistent (the government is not in the business of encouraging crypto hoarding via tax breaks). However, your company might qualify for general incentives. For example, SMEs in Korea enjoy lower corporate tax rates on the first KRW 200 million of income, etc. Also, foreign-invested companies in certain high-tech sectors sometimes get tax reductions for a few years (though crypto trading might not qualify as high-tech manufacturing or R&D, unless your business is more on the blockchain tech side). Check the Restriction of Special Taxation Act for any such benefits and see if any could apply (likely limited for a pure financial/trading oriented business).
• Book-Tax Differences: Keep an eye on differences between accounting and tax treatment. For instance, if your Bitcoin is treated as intangible and not revalued upward on books, there’s no unrealized gain to tax. Korea taxes on realized gains, not market-to-market (except certain securities or derivatives in specialized cases). So you won’t pay tax just because Bitcoin’s market value rose during the year – only if you sold or exchanged it (realization principle). This is favorable, as it defers tax on appreciation. On the flip side, any impairments you take reduce accounting profit; the tax authority will likely accept those if they reflect genuine losses, but they might question frequent write-down and up if a company tries to time the market (though under accounting rules you can’t write up, so it’s straightforward).
• Future Tax Changes: Be prepared for potential new rules. The government’s deferral of the individual crypto tax to 2028 suggests they want a comprehensive plan, possibly including how companies handle crypto. By the time that tax is enforced, they might refine corporate tax rules for crypto as well (for example, introducing a separate schedule or requiring more reporting on crypto holdings). Additionally, if global minimum tax or other international rules come into play for digital assets, Korea will adapt. For now, staying within the standard corporate tax framework and diligently reporting any crypto-related income or loss is the way to go.

Action items: Use a qualified tax advisor or CPA firm familiar with crypto to review your tax filings. Given the large amounts potentially at play with Bitcoin, a bit of advice can save a lot of trouble. Keep clear records of every transaction (including KRW values and dates) – this will support your tax positions in case of an audit. And finally, set aside cash for tax if you realize big crypto gains – remember that if you make, say, KRW 1 billion profit from Bitcoin sales, roughly a quarter of that might belong to NTS at year-end. Don’t get caught illiquid (having all wealth in Bitcoin but a tax bill in KRW). A good practice is to periodically convert a portion of crypto gains to fiat to cover anticipated taxes and expenses.

7. Risk Management and Cybersecurity Practices for Secure Crypto Asset Management

Holding and managing Bitcoin introduces unique risks that traditional companies don’t face – notably, the irreversible nature of crypto transactions and the high value that could be moved with a single private key. South Korea’s regulations underscore the importance of robust security (requiring ISMS, cold storage, etc.), and any company in this space must make risk management a top priority. Here are best practices:

• Cold Storage of Assets: Follow the golden rule of crypto security: store the majority of crypto assets in “cold” wallets, which are kept offline. Korean regulators mandate VASPs to keep at least 80% of customer assets in cold storage , and your company should apply a similar (or higher) percentage for its own treasury holdings. Cold storage options include hardware wallets (like Ledger or Trezor devices), air-gapped computers with wallet files, or even physical paper wallets stored securely. The idea is to isolate private keys from any internet-connected device, eliminating remote hacking risks. Accessing cold storage for a transfer should require a deliberate, multi-step process (preferably involving multiple people and secure environments).
• Multi-Signature and Key Management: Use multi-signature (multisig) wallets for added security. Multisig means you set up your Bitcoin wallet such that, for example, 2 out of 3 or 3 out of 5 keys are required to authorize a transaction. Distribute these keys among trusted executives or devices. This prevents a single point of failure – no single person or compromised device can move funds. It also provides internal checks (e.g., one key held by CFO, one by CEO, one by an external custodian in escrow). Define clear policies on key usage, and maintain secure backups of keys (in encrypted form) in separate secure locations (like bank safe deposit boxes). Never have all keys in one place. Multisig is a proven way to significantly reduce risk of theft.
• Information Security Standards (ISMS): Adhering to the ISMS is not just for licensing – it’s genuinely good practice. ISMS certification will ensure you have a broad range of controls: access control (only authorized personnel can access sensitive systems), encryption of sensitive data, secure software development practices, physical security of servers, incident response plans, etc. Ensure your servers and wallet systems are hardened (up-to-date patches, firewall rules, intrusion detection in place). Conduct regular penetration tests and vulnerability assessments on your infrastructure to catch weaknesses. Consider obtaining ISO/IEC 27001 certification (international standard for information security) as well, which many global crypto companies pursue – it aligns well with ISMS and further signals your commitment to cybersecurity.
• Insurance and Reserves for Hacks: Despite best efforts, breaches can happen. The new Korean regulations require VASPs to carry insurance or reserve funds equal to at least 5% of customer assets in hot wallets (with minimum thresholds of KRW 3 billion or KRW 500 million depending on the exchange type) . For a company holding its own Bitcoin, it’s wise to similarly insure part of your holdings. Look for a crypto insurance policy that covers theft, hacking, or even losses due to insider theft. These policies are emerging – often provided by Lloyd’s syndicates or specialized insurers. They may require certain security protocols in place (which you should have anyway). Additionally, maintain a contingency reserve in fiat or highly liquid assets as a buffer for emergencies (for instance, if a portion of crypto gets locked or lost, the reserve helps your business continue operating).
• Segregation of Duties: Implement internal controls such that no single individual has end-to-end control over your crypto assets. For instance, the person who can initiate a transaction on a wallet should not be the person who alone can approve it. Use role-based access control in any software: e.g., a trading officer can propose a transfer from treasury, but a senior officer and one other must approve via multisig. Similarly, system admins who manage servers should ideally not have the keys to wallets – separate technical access from financial access. Regularly review these controls and update signers if personnel change (to avoid ex-employees retaining any control).
• Monitoring and Anomaly Detection: Just as banks monitor accounts for unusual activity, your company should continuously monitor crypto transactions and systems for any anomalies. For example, use whitelisting for addresses (your cold wallet software can often restrict outgoing transactions only to pre-approved addresses – enable that if possible). Set up alerts: you should get instant notifications for any movement of funds or any access to secure systems. The Act on Protection of Virtual Asset Users also effectively expects companies to monitor transactions for abnormal activity and report incidents . If you detect any unauthorized attempt or irregular pattern (say, someone trying a large transfer at 3AM that doesn’t fit your procedures), trigger your incident response plan immediately.
• Incident Response and Business Continuity: Have a detailed incident response plan for worst-case scenarios. This plan should cover: what to do if a hack is suspected, who to inform (regulators, law enforcement, insurance, customers if applicable), how to contain the breach (e.g., moving remaining funds to new wallets), and how to investigate. Also prepare for non-hack incidents: what if a key holder is incapacitated? Ensure you have backup keys and a process to replace key signers (this might involve legal arrangements if a key is held by an individual). Create disaster recovery plans for your IT systems – backups of all critical data (with an offline copy stored safely) so you can rebuild systems if needed. Regularly drill these plans, like a fire drill, so your team isn’t scrambling for the first time during an actual crisis.
• Employee Training and Vetting: People are often the weakest link. Conduct thorough background checks on any employees or contractors who will have access to sensitive systems or keys (especially for criminal records or financial troubles that might make them vulnerable to malfeasance). Impose strict security policies: for example, forbid staff from installing unauthorized software, enforce 2-Factor Authentication (2FA) on all accounts, and use hardware security keys for administrative access. Provide ongoing training about phishing and social engineering, as crypto companies are prime targets. Make sure everyone knows: never share passwords or private keys, and how to verify communications (e.g., if an executive sends an email requesting a transfer, there should be an out-of-band confirmation – this prevents phishing scams). In Korea, emphasize to employees that any mishandling of customer assets or involvement in unfair trading is now punishable by law (per new regulations) – this underscores the seriousness.
• Third-Party Security: Extend your security diligence to any third-party services you use. If you use a cloud provider for servers, ensure you configure it securely (misconfigured cloud storage has led to leaks). If you use APIs (e.g., to exchanges or blockchain analytics), restrict keys and permissions. For any vendor handling your sensitive data or assets (such as a custody provider or payment processor), review their security certifications and compliance. It’s common to request SOC 2 or ISO27001 reports from such vendors. Include clauses in contracts about breach notification and liability.
• Continuous Auditing and Improvement: Cyber threats evolve quickly. Conduct regular audits of your security – both internally (self-audits) and by hiring external experts. South Korea’s KoFIU may also conduct audits; be prepared to demonstrate your security measures to them. Stay updated on the latest threats (for instance, new malware targeting crypto wallets, or any vulnerabilities in hardware wallets) and update your defenses accordingly. Participating in information-sharing communities (like ISACs for financial services or blockchain security forums) can give early warning of sector-specific risks.
• Compliance Risk: Risk management isn’t only about hackers – it’s also about complying with laws to avoid legal risk. As part of risk management, keep a close eye on compliance calendars (e.g., filing required reports to KoFIU on time, updating any license renewals, etc.). Non-compliance can result in penalties or business suspension, which is a risk to continuity. Given the rapid regulatory changes, consider assigning a compliance officer to monitor new rules and ensure your policies are always up to date.

Implementing these practices will not only protect your assets but also serve as a business advantage. Clients, partners, and regulators will have greater confidence in a company that clearly prioritizes security. In the crypto space, reputation is fragile – one breach can destroy trust. By following standards even stricter than those required (like using 80+% cold storage even for your own funds, multi-sig approvals for any move, etc.), you create a robust defense. Remember the adage: “Not your keys, not your coins.” If you hold the keys, protect them like the crown jewels; if you entrust them to someone (even an employee or a service), ensure stringent oversight.

South Korea’s approach, as codified in law, is essentially pushing crypto businesses to adopt bank-grade security and controls . Embrace that mentality from day one. It not only keeps you compliant but genuinely reduces the chance of catastrophic loss.

8. Corporate Governance and Transparency in Managing Crypto Treasuries

Strong corporate governance and transparency are essential, especially when managing such a volatile and sometimes controversial asset as Bitcoin. Both regulators and stakeholders (investors, customers, the public) need assurance that a company’s crypto activities are being managed responsibly and ethically. Here are best practices to implement:

• Governance Framework and Oversight: Establish clear governance structures for crypto-related decisions. This might include forming a Digital Assets Committee at the board level or as a management committee. The committee’s role would be to set policies (e.g. what percentage of treasury to allocate to Bitcoin, risk limits, when to rebalance, etc.) and to approve major transactions. If you have a Board of Directors, ensure they are informed and have oversight of the crypto strategy – this can be via periodic reports or requiring board approval for large investments. Document all major decisions in meeting minutes. Essentially, treat crypto investments with the same rigor as you would major capital expenditures or acquisitions.
• Internal Controls and Dual Approval: We touched on this in risk management – no single individual should be able to move corporate crypto assets unilaterally. From a governance perspective, formalize this as policy: e.g., “All transfers above KRW X or all Bitcoin transfers require approval by at least two officers.” The approval process should be logged and reviewable. This policy not only prevents internal misuse but also provides a clear audit trail if something goes wrong. Regularly audit compliance with this policy internally.
• Transparency and Disclosure: Being transparent about your crypto holdings and activities will build trust. Financial disclosures are part of this (as discussed in accounting, disclosing amounts and fair value of crypto holdings in statements) . If your company is publicly listed, any material changes in your Bitcoin position might require timely disclosure to the market (in the U.S., companies like MicroStrategy file an 8-K for significant buys; in Korea, while not explicitly required yet, similar principles of materiality apply). Even if not required, consider voluntarily disclosing significant treasury moves to investors/shareholders. For example, publish a note if you decide to allocate an additional 10% of assets to Bitcoin, explaining the rationale. Investor relations communications should address your crypto strategy openly to prevent speculation or misinformation.
• Audit and Assurance: Engage external auditors not just for financial audits but also for security audits or proof-of-reserves audits. For instance, some crypto companies have started publishing Proof of Reserves – cryptographic proof (often by an auditor) that they hold the assets they claim. While originally a concept for exchanges to reassure customers, a corporate could also use it to show shareholders that “Yes, we really have X BTC in our wallets.” This could be as simple as having an auditor verify the wallet balances at year-end. Additionally, get your financial statements audited by reputable firms; if you hold significant Bitcoin, request that the auditors opine on the existence of those assets specifically. This extra mile in assurance can set you apart.
• Compliance with Fair Trade Rules: The new law prohibits unfair trade practices like insider trading and market manipulation in crypto markets . Even if your company is just managing its own treasury, you should have an ethical code of conduct to ensure no one in the company abuses insider information. For example, if your company plans a big Bitcoin buy that could affect markets, obviously employees shouldn’t front-run that for personal gain. Or if you’re privy to market-moving info (maybe through industry connections), ensure it’s not misused. Train your team on these expectations. Violations can lead to legal penalties and reputational damage – Korean authorities have signaled a crackdown on such behavior, akin to the scrutiny seen in stock markets .
• Segregation of Corporate and Client Assets: If your company also handles others’ funds (e.g., you run a service with customer deposits), governance must ensure strict segregation of client assets from company assets . This is both a legal requirement and a trust issue. Have procedures to reconcile client asset ledgers daily, and perhaps even an external custodian or trust account for client funds. Never dip into customer assets for company purposes. Appoint an internal or external auditor to periodically verify that client asset balances match liabilities. Transparency here can be a market differentiator – some Korean exchanges, for instance, publish cold wallet addresses for users to see funds are intact.
• Record-Keeping and Audit Trails: We cannot stress enough the importance of thorough record-keeping. Maintain an audit trail for every significant crypto transaction: who initiated it, who approved, which addresses were involved, what the purpose was, etc. Given the requirement to keep records for 15 years , set up a robust archiving system (with backups). These records not only help in compliance and potential regulatory inquiries but also allow internal audits to trace and review past decisions, which is vital for continuous improvement in governance.
• Stakeholder Communication: If you have shareholders or investors, keep them informed about the performance and risks of your Bitcoin holdings. This could be through quarterly reports or dedicated sections in your annual report about digital assets. Discuss both the upside and the risks (volatility, regulatory changes) – demonstrating a balanced view. If Bitcoin materially impacts your financial results (positive or negative), provide an explanation. Transparent communication will pre-empt questions and build credibility that you are managing the treasury prudently.
• Adapting to Regulatory Changes: Assign someone (chief compliance officer or legal counsel) to monitor regulatory changes continuously. Governance should include regularly updating policies to comply with new laws. For example, if authorities tighten rules on foreign crypto exchanges or introduce new tax reporting, your company’s internal guidelines should quickly reflect that. Show proactiveness: it’s better that your governance manual is ahead of the curve rather than catching up after an incident. In board meetings or management meetings, include a brief on any new relevant regulatory developments (Korea is very active in legislating crypto, as seen with the 2023 Act and upcoming plans ).
• Ethical and Social Responsibility: As a crypto company, consider joining industry associations or initiatives for self-regulation and best practices. In Korea, organizations like the Korea Blockchain Association have guidelines for exchanges on market making, disclosure, etc. Adhering to high ethical standards – for instance, not partaking in pump-and-dump schemes of tokens, or not listing dubious coins if you ever get into that – is part of governance. Since your focus is Bitcoin treasury, this may be less of an issue (you likely deal with BTC only), but it’s worth noting if you diversify into other digital assets or businesses (e.g., if one day you consider launching a token or NFT, apply strict diligence).
• Independent Oversight: If possible, involve independent directors or advisors in oversight of your crypto activities. Their external perspective can catch issues management might miss. For example, an independent audit committee member could ask tough questions about risk management of the Bitcoin holdings or ensure that financial reporting of crypto is clear. This aligns with general corporate governance principles and will reassure investors and regulators that you have checks and balances.

By implementing these governance and transparency measures, you not only comply with Korean expectations but also elevate your company’s professionalism. Remember that trust is the currency of any corporate finance operation – and in the crypto world, trust has to be earned through impeccable behavior since skepticism is high. South Korea’s regulators have emphasized protecting users and preventing malfeasance , so aligning your governance with those goals is wise.

Conclusion: Starting a Bitcoin treasury company in South Korea is an ambitious endeavor that sits at the intersection of innovative finance and strict regulation. By carefully selecting a viable business model, obtaining the necessary licenses (and understanding when they are not needed), and following through with meticulous incorporation and compliance steps, you can establish a solid foundation. From there, success will depend on prudent management – securing banking relationships as the landscape opens up, rigorously safeguarding your crypto assets, and maintaining transparent and accountable operations.

South Korea’s regulatory environment in 2025 is both supportive and demanding: supportive in that institutions are being gradually welcomed into the crypto market (e.g., corporate accounts on exchanges, potential for ETFs and security tokens), but demanding in that compliance and user protection are non-negotiable. In this guide, we covered how to navigate the Financial Services Commission (FSC) and KoFIU requirements, how to align with accounting standards and tax laws, and how to implement best practices gleaned from both global norms and Korean-specific rules.

By prioritizing robust risk management (as evidenced by cold storage, ISMS, etc.) and strong corporate governance, your company can not only avoid pitfalls but also build a reputation as a trustworthy pioneer in the Korean crypto industry. Keep updated with regulatory changes (the landscape can shift with new laws or guidelines – for instance, guidelines for institutional crypto trading are anticipated by late 2025 ) and be ready to adapt quickly. Consider this guide a starting point – ongoing due diligence and expert consultations will be your allies going forward.

Finally, embrace the spirit behind the regulations: protect your stakeholders and act with integrity. If you manage your Bitcoin treasury with the same care as a traditional treasurer manages cash – plus the extra precautions unique to crypto – you’ll position your company for long-term credibility and success in South Korea’s dynamic market.