Anti-Money Laundering (AML) Compliance Lawyer
Anti-Money Laundering (AML) Compliance Lawyer | Understanding Your Obligations and Regulatory Exposure
Korea regulates money laundering and terrorist financing risk primarily through the Act on Reporting and Using Specified Financial Transaction Information (특정 금융거래정보의 보고 및 이용 등에 관한 법률) and the Act on Regulation and Punishment of Concealment of Criminal Proceeds (범죄수익은닉의 규제 및 처벌 등에 관한 법률). Reporting entities — banks, securities firms, insurers, and since 2021 virtual asset service providers — must run customer due diligence, monitor transactions, and file suspicious transaction reports with the Korea Financial Intelligence Unit (KoFIU). Failure to maintain adequate internal controls can trigger FSS sanctions, business suspension, or referral for criminal prosecution of individuals involved, even where no underlying predicate crime is proven against the company itself.
Anti-Money Laundering (AML) Compliance | Who is a reporting entity and what must they do
Not every business is directly regulated, but the scope of covered entities is broader than most assume, and obligations attach the moment an entity qualifies.
Who counts as a reporting entity
Reporting entities include banks, mutual savings banks, securities and futures firms, insurers, credit-specialized finance companies, and virtual asset service providers (특정 금융거래정보의 보고 및 이용 등에 관한 법률 제2조). Once an entity falls within this list, it must appoint a reporting officer and build internal AML systems regardless of its actual transaction volume.
Customer due diligence duties
Reporting entities must verify customer identity and, where risk indicators exist, the identity of the beneficial owner before or at the time of establishing a transaction relationship (특정 금융거래정보의 보고 및 이용 등에 관한 법률 제5조의2). The depth of verification should scale with the customer's risk profile — a point regulators frequently flag in on-site inspections.
Enhanced due diligence for high-risk customers
Politically exposed persons, customers from high-risk jurisdictions, and unusually large or complex transactions call for enhanced due diligence, including source-of-funds inquiries. Institutions that apply a uniform, low-intensity check across all customers are the ones most often cited in FSS examinations.
Anti-Money Laundering (AML) Compliance | Suspicious transaction reports and currency transaction reports
The reporting duty is the operational core of Korea's AML system, and it is also where good-faith mistakes most often turn into regulatory findings.
Suspicious Transaction Reports (STR)
Where there is reasonable ground to suspect that assets received in a transaction are criminal proceeds, or that a customer is engaged in money laundering, the entity must report this to KoFIU (특정 금융거래정보의 보고 및 이용 등에 관한 법률 제4조). The threshold is 'reasonable suspicion,' not certainty, so under-reporting out of caution is itself a compliance risk.
Currency Transaction Reports (CTR)
Cash transactions above a set threshold amount must be reported automatically, regardless of suspicion, under the same Act (특정 금융거래정보의 보고 및 이용 등에 관한 법률 제4조의2). CTR is a mechanical trigger, which makes it easier to audit for compliance but also easier to inadvertently miss through system errors.
Tipping-off is prohibited
Disclosing the fact that an STR has been or will be filed to the customer or any third party is itself prohibited (특정 금융거래정보의 보고 및 이용 등에 관한 법률 제4조 제6항). This provision often surprises frontline staff who feel obligated to explain an account freeze to an anxious customer.
Anti-Money Laundering (AML) Compliance | Building and defending an internal AML system
When regulators find a gap, the first question is not just whether a single report was missed, but whether the institution's internal control system was adequate in design and operation.
Required internal control elements
Reporting entities must establish internal control standards covering customer risk assessment, employee training, independent audit of the AML program, and a designated reporting officer with sufficient authority (특정 금융거래정보의 보고 및 이용 등에 관한 법률 제5조). A written policy that is never actually followed in practice offers little protection during an inspection.
FSS on-site and off-site examinations
The Financial Supervisory Service conducts periodic and targeted examinations of AML systems, and can request transaction logs, training records, and STR decision memos going back several years. Preparing a defensible file — showing not just outcomes but the reasoning behind each due diligence decision — is usually more valuable than reacting after a deficiency notice arrives.
Sanctions for institutional failures
Findings of inadequate internal controls or repeated reporting failures can lead to corrective orders, fines, or restrictions on business operations, and in serious cases referral of individual officers for potential criminal liability. Because sanctions can attach to the institution and to specific compliance officers separately, the two exposures need to be assessed and defended distinctly.
Anti-Money Laundering (AML) Compliance | AML obligations for virtual asset service providers
Since the 2021 amendment brought virtual asset service providers into the reporting entity framework, exchanges and related businesses face AML obligations layered on top of separate registration requirements.
Registration as a prerequisite
Virtual asset service providers must first register with KoFIU, which requires (among other things) an information security management certification and, for entities handling KRW transactions, a real-name verification arrangement with a bank (특정 금융거래정보의 보고 및 이용 등에 관한 법률 제7조). Operating without registration is itself a separate offense, independent of any AML failure.
Travel rule and wallet screening
Virtual asset transfers above a certain threshold require the originating and beneficiary VASPs to exchange identifying information about the parties, mirroring the international 'travel rule.' Screening counterparties and wallet addresses against sanctions and risk lists has become a distinct compliance workstream for exchanges.
Anti-Money Laundering (AML) Compliance | From initial diagnosis to ongoing compliance support
We review your business model, customer base, and transaction types to identify whether — and to what extent — AML obligations apply, and flag any immediate red flags such as pending reports or upcoming examinations.
We compare your current customer due diligence procedures, reporting officer structure, and internal audit practices against statutory requirements and recent FSS examination trends.
We help draft or revise internal control standards, STR/CTR decision trees, and training materials so that day-to-day staff decisions are documented and defensible.
Where an FSS examination, KoFIU inquiry, or criminal referral is already underway, we assist with document production, examiner interviews, and drafting responses to deficiency findings.
For institutions that need continuing support, we provide periodic policy updates and on-call advice for edge-case transactions that staff are unsure how to classify.
Anti-Money Laundering (AML) Compliance | How advisory fees are calculated
A flat fee for the initial review of your business structure and a preliminary assessment of applicable obligations, scoped by the complexity of the business and number of jurisdictions or products involved.
Calculated based on the volume of policies and procedures to be reviewed or drafted, and whether on-site interviews with compliance staff are required.
For active FSS examinations or KoFIU inquiries, fees are typically set based on the expected scope of document review and the number of examiner or investigator interactions anticipated.
Ongoing advisory relationships are usually structured as a monthly or quarterly retainer covering a set number of advisory hours, with additional work billed separately.
Separate from professional fees, costs such as translation of foreign-language documents or expert review may be billed at actual cost.
※ Costs vary depending on case complexity and specific circumstances; exact fees will be provided during consultation. No specific outcome is guaranteed.
Anti-Money Laundering (AML) Compliance | Self-Assessment Checklists
1️⃣ Are You a Reporting Entity?
- Does your business fall within one of the statutory categories of financial companies or VASPs under Article 2?
- Have you registered with KoFIU if you handle virtual assets?
- Have you appointed a designated reporting officer with real authority?
- Do you have written internal control standards, or only informal practices?
2️⃣ Customer Due Diligence Health Check
- Do you verify beneficial ownership for corporate customers, not just the account holder?
- Does your due diligence intensity actually change for high-risk customers, or is it a flat checklist for everyone?
- Are politically exposed persons flagged and reviewed separately?
- Is source-of-funds documentation retained and retrievable years later?
3️⃣ Reporting Discipline
- Do frontline staff know the difference between an STR and a CTR trigger?
- Is there a documented decision memo for every case where an STR was considered but not filed?
- Have staff been trained on the tipping-off prohibition?
- Is there a process for escalating ambiguous cases to the reporting officer promptly?
4️⃣ Preparing for an FSS Examination
- Can you produce training records and audit logs for the past several years on short notice?
- Have you conducted an internal mock examination or audit recently?
- Do you know which prior deficiency findings, if any, remain unresolved?
- Is there a clear internal chain of responsibility if an examiner identifies a gap?
