Financial Commission: "Maximize the Proportion of Cold Wallet Storage for Virtual Asset Exchanges"

Financial Commission Logo. Source=Financial Commission

The Financial Commission is pushing to maximize the proportion of cold wallet (offline wallet) storage for virtual asset service providers (VASPs) such as virtual asset exchanges.

On the 12th, the Financial Commission held a security measures meeting for the digital asset industry under the chairmanship of Vice Chairman Shin Jin-chang to discuss this plan. During the meeting, the current status of VASP security breaches and response measures were reviewed, and actions for enhancing security to the highest level and future policy directions were discussed.

Vice Chairman Shin pointed out the recent series of information leaks and breaches in the digital asset industry, stating that the security awareness of some providers remains at a pre-institutional level, contrary to the growth of the digital asset market and expectations for the industry.

In particular, he emphasized that virtual asset providers need to have a security system at the same level as traditional financial companies, as they hold and manage users' assets in custody, urging a fundamental shift in security awareness.

"Continuous Monitoring, Maximizing Cold Wallets, Liability for Damages"

The Financial Commission first discussed measures that providers can take at the current stage to prevent breaches and minimize damage in case of incidents.

They established a continuous monitoring and response system tailored to market characteristics. Providers must deploy responsible personnel continuously and implement necessary control measures immediately if suspicious large-scale transactions occur. Additionally, providers unable to operate a continuous monitoring system should only process deposits and withdrawals during times when the system can operate normally, providing prior notice to users and ensuring sufficient personnel are available to respond to deposit and withdrawal requests in a timely manner.

Next, they discussed maximizing the proportion of user assets stored in cold wallets and expanding insurance compensation limits and reserve accumulation. Currently, the regulatory requirement for the proportion of cold wallet storage is 80%, but the overall proportion among providers significantly exceeds 95%.

Nevertheless, to ensure the safe storage of user assets, providers should maintain the quantity of user entrusted digital assets stored in hot wallets at the minimum necessary for transaction support and consider distributing them across multiple hot wallets. They must also ensure sufficient insurance compensation limits and reserve accumulation in case of user damage due to hacking or other incidents.

Finally, they presented necessary measures to comply with IT security obligations applicable to financial companies under the Electronic Financial Transactions Act and to respond to breaches. Through the Digital Asset Act, digital asset providers will also be required to meet safety standards and liability for damages at the level of financial companies. Even before that, they plan to implement obligations to ensure safety equivalent to those applied to financial companies through guidelines.

Providers must establish safety standards regarding information technology and information security for electronic transmission and processing of digital asset transactions, as well as technical, managerial, and physical measures necessary to ensure the safety of digital asset transactions. They must analyze and evaluate vulnerabilities in their information processing systems and information communication networks and take corrective actions based on the results. Additionally, they are required to report to financial authorities in case of breaches or potential breaches and establish a reporting system for incidents similar to that of financial companies.

"Non-Enforcement Opinion on Blocking Deposits and Withdrawals Related to Hacking"

The Financial Commission also decided to issue a 'non-enforcement opinion' allowing providers to proactively block deposits and withdrawals in cases where hacking or breaches are suspected. A non-enforcement opinion refers to a document in which financial authorities (such as the Financial Supervisory Service) respond that they will not impose sanctions or other measures on a company or financial institution for engaging in new business or developing new products.

On this day, the Financial Commission discussed measures to allow proactive blocking of deposits and withdrawals by providers under certain conditions to prevent the spread of user damage in response to the increasing threat of breaches. The current Virtual Asset User Protection Act prohibits providers from blocking deposits and withdrawals without just cause and only allows blocking in clear cases of hacking incidents. The issuance of the non-enforcement opinion was based on the rationale that prompt blocking measures could be crucial in minimizing user damage.

"Support for Membership in the Financial Security Institute for Providers"

The Financial Commission is promoting additional membership for virtual asset providers, excluding those in the Korean won market, to join the Financial Security Institute as members. For member providers, security services such as sharing information on breach threats, security vulnerability assessments, and specialized financial security training will be provided.

Additionally, the Financial Security Institute plans to conduct security assessments for member institutions of virtual asset providers and provide 'specialized security assessment criteria for digital asset exchanges' to those providers unable to conduct direct assessments, allowing them to conduct assessments through information security companies. To respond to the latest breach threats, they plan to improve existing security assessment criteria within the year by reflecting measures such as strengthening transaction verification and controlling wallet access.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.