South Korea tightens crypto withdrawal delay rules to curb phishing

South Korea’s regulators, the FSC and FSS, together with the exchange industry group DAXA, have introduced unified crypto withdrawal delay rules to stop voice-phishing groups from exploiting “withdrawal exceptions.” The “Virtual Asset Withdrawal Delay System” was launched in May 2025, but compliance reviews found that each exchange used different exemption criteria. From June to September 2025, 1,490 of 2,526 fraudulent accounts were granted withdrawal-delay exemptions, driving about $124 million (170.5 billion won) in losses—75.5% of all voice-phishing losses in that period. Under the new crypto withdrawal delay rules, exchanges must apply a stricter, common standard. They will assess factors such as transaction frequency, account history/age, and cumulative deposit/withdrawal volumes. Regulators also set conditions where an exception cannot be granted regardless of trading history. FSC simulations suggest the unified rules could cut withdrawal-exception eligibility by more than 99% by end-2025. Exempt users will face tighter monitoring, including mandatory annual verification of fund sources for high-volume traders, plus regular audits and penalties for weak internal controls. The move follows broader enforcement actions after operational-control failures and incidents such as the Bithumb payout error, where the FSC required five-minute reconciliations of internal ledgers versus actual assets.