South Korea: technology regulation at a glance

Framework: Virtual Asset User Protection Act (VAUPA, Act No. 19563, in force 19 July 2024) and the Act on Reporting and Use of Specific Financial Transaction Information (SFIA / VASP registration regime), supervised by the Financial Services Commission (FSC), Financial Supervisory Service (FSS) and Korea Financial Intelligence Unit (KoFIU). A second-phase Digital Asset Basic Act covering stablecoins, disclosure and market structure is still in the National Assembly.

Crypto is legal in South Korea and one of the most active markets globally, but the regulatory framework is being built in phases. Phase 1 — VAUPA (user asset protection, market-abuse rules) and the SFIA/KoFIU VASP registration regime — is fully in force, and a Capital Markets Act amendment enabling security-token offerings was passed by the National Assembly on 15 January 2026 (takes effect January 2027). Phase 2 — the comprehensive Digital Asset Basic Act covering stablecoins, ICOs, disclosure and business-conduct rules — has been repeatedly delayed by disputes between the FSC and the Bank of Korea over stablecoin issuance, and is currently expected to move only in late 2026 or 2027.

Framework: Framework Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act / 인공지능 발전과 신뢰 기반 조성 등에 관한 기본법), administered by the Ministry of Science and ICT (MSIT)

South Korea has a comprehensive, horizontal AI law. The AI Basic Act was passed by the National Assembly on 26 December 2024, promulgated 21 January 2025, and took effect 22 January 2026, making South Korea the second jurisdiction after the EU to adopt an economy-wide AI statute. It is innovation-oriented but imposes binding obligations on 'high-impact' and generative AI, establishes national governance bodies, and applies extraterritorially.

Framework: Personal Information Protection Act (PIPA), enforced by the Personal Information Protection Commission (PIPC), South Korea's independent national data protection authority.

South Korea has a comprehensive, GDPR-style data protection regime centered on the Personal Information Protection Act (PIPA), which applies across public and private sectors. It is supervised and enforced by the Personal Information Protection Commission (PIPC), a ministerial-level independent authority re-established in 2020. Major amendments effective September 2023 modernized the law, and the EU granted South Korea an adequacy decision in December 2021, recognizing its protections as essentially equivalent to the GDPR.

Framework: Electronic Financial Transactions Act (EFTA), administered by the Financial Services Commission (FSC) and supervised day-to-day by the Financial Supervisory Service (FSS); payment-system oversight by the Bank of Korea (BOK).

South Korea operates a mature, comprehensive licensing regime for digital payments and fintech. The EFTA (most recently amended effective 15 September 2024) governs electronic financial businesses, with the FSC issuing/registering licenses across consolidated categories (fund transfer, payment service, and payment gateway/PG), while the BOK runs the BOK-Wire+ settlement backbone and the open-banking and MyData rails enable fintech access to bank accounts and customer data.

Framework: F-1-D Workation (Digital Nomad) Visa, Ministry of Justice / Korea Immigration Service (immigration.go.kr), launched 1 January 2024; governed by the Immigration Act of the Republic of Korea

South Korea introduced a dedicated F-1-D Workation (Digital Nomad) visa on 1 January 2024, allowing foreign remote workers employed by non-Korean overseas companies or clients to reside in Korea for up to two years (one year, renewable once in-country). The programme has no announced sunset date, qualifying it as permanent policy. Applicants must earn more than twice Korea's GNI per capita (≈₩88.1 million/year, ≈USD 66,000) and carry private health insurance; local employment is strictly prohibited.

Framework: Multi-instrument regime: Act on Promotion of Information and Communications Network Utilization and Information Protection (Network Act); Telecommunications Business Act (content-moderation duties); Juvenile Protection Act (age/identity verification); enforced by the Korea Communications Commission (KCC) and the Korea Communications Standards Commission (KCSC).

South Korea operates a long-standing, comprehensive and in-force online-content/safety regime combining platform takedown duties, mandatory age/identity verification for minors, and active state blocking of overseas 'illegal/harmful' sites. A January 6, 2026 amendment to the Network Act (effective July 7, 2026) significantly expands obligations on large platforms, illegal-information/disinformation policies, content removal, account suspension, and semi-annual transparency reports, drawing U.S. concerns. The regime is regulatory and rule-of-law based, but includes heavy state filtering (SNI-based blocking) that critics characterize as censorship.

Framework: A patchwork of sector-specific statutes, the Act on Promotion of Information and Communications Network Utilization and Information Protection ('Network Act'), the Act on the Protection of Information and Communications Infrastructure ('PICIA', critical infrastructure), the Personal Information Protection Act ('PIPA'), and the Electronic Financial Transactions Act (finance), overseen by MSIT/KISA, the NIS, the PIPC and the FSC, rather than a single comprehensive cybersecurity law.

South Korea regulates cybersecurity through multiple sector-specific laws rather than one omnibus statute: the Network Act governs information and communications service providers, PICIA protects designated critical information infrastructure, PIPA imposes data-security and breach-notification duties, and financial-sector rules apply to banks and fintech. National strategy is set by the National Cybersecurity Strategy and Basic Plan (revised 2024) and coordinated across MSIT/KISA and the National Intelligence Service. A major PIPA amendment passed in 2026 (effective Sept 11, 2026) tightens breach-notification timing, raises penalties, and phases in mandatory ISMS-P certification.

Framework: Foreign Investment Promotion Act (FIPA) and its Enforcement Decree, administered by the Ministry of Trade, Industry and Energy (MOTIE) and facilitated by KOTRA/InvestKOREA; company formation governed by the Commercial Act.

South Korea broadly permits foreign investment without restrictions: 100% foreign ownership is allowed in the large majority of sectors, and a foreigner forms a company through largely the same process as a Korean plus two extra steps (foreign investment notification and foreign-invested company registration). The process is well-documented, government-facilitated, and typically completes in about two to four weeks, though FDI screening is becoming more security-focused for sensitive sectors.