Korea AML Specialist (TPAC) cheat sheet

Core statute is the Act on Reporting and Using Specified Financial Transaction Information (특정금융정보법, often abbreviated FIU Act); it mandates STR/CTR filing, CDD, and tipping-off prohibitions for financial institutions.

Four-pillar structure: (1) FIU Act, (2) Act on Regulation and Punishment of Criminal Proceeds Concealment, (3) Act on Prohibition of Financing for Offenses of Public Intimidation (terrorism financing), plus sectoral laws (Banking Act, Capital Markets Act, Insurance Business Act, Specific Credit Finance Business Act).

The Korea Financial Intelligence Unit (KoFIU, 금융정보분석원) sits inside the Financial Services Commission; it receives reports, issues AML supervision standards, and can impose sanctions.

Reporting duty runs to KoFIU; supervisory examination is shared with FSS (Financial Supervisory Service) and, for some sectors, with the Bank of Korea and relevant ministries.

Criminal predicate scope is broad and includes bribery, embezzlement, tax evasion, drug offenses, fraud, and organized crime; laundering itself is punished under the Concealment Act.

Administrative penalty types include corrective orders, business suspension, fines (과태료), and referral; criminal exposure applies to willful failure to report suspicious transactions.

Financial institutions must designate an AML compliance officer (자금세탁방지담당자) and report the designation to KoFIU; the officer must be independent of revenue functions.

Recordkeeping: CDD and transaction records generally retained 5 years after the transaction or account closure; STR filing records retained 5 years from filing.

Sectoral coverage extends beyond banks to securities, insurance, credit finance, e-money, virtual asset service providers (VASPs), casinos, and certain non-financial designated businesses.

Korea is a member of FATF and of APG (Asia/Pacific Group on Money Laundering); mutual evaluation findings drive domestic rule changes.

FATF 40 Recommendations are grouped: A (AML/CFT policies and coordination), B (ML and confiscation), C (TF and proliferation financing), D (preventive measures), E (transparency and beneficial ownership), F (powers and responsibilities), G (international cooperation).

Risk-based approach is the governing principle (Recommendation 1): higher-risk customers and products receive enhanced measures; lower risk may allow simplified measures, never zero measures.

Recommendation 16 (wire transfers) requires originator and beneficiary information to travel with the payment; the Korean travel-rule threshold for VASPs is KRW 1 million.

Recommendation 15 requires VASPs to be licensed/registered and subject to AML/CFT supervision; Korea implemented this via the Specific Financial Information Act (특금법) amendment effective March 2021.

UN Security Council resolutions are implemented through the Act on Prohibition of Financing for Offenses of Public Intimidation; asset freeze obligations apply without prior notice to the listed person.

Mutual legal assistance and FIU-to-FIU information exchange run through KoFIU; Egmont Group membership supports spontaneous and requested exchange.

FATF-style regional reviews assess effectiveness (immediate outcomes) alongside technical compliance; Korea's 2020 mutual evaluation report is a public reference point.

CDD triggers: establishing a business relationship, occasional transactions above the threshold (KRW 10 million for non-financial and certain sectors; KRW 1 million for VASPs), suspected ML/TF, or doubts about previously obtained data.

Minimum CDD elements: identify the customer and verify identity, identify the beneficial owner, understand purpose and intended nature of the relationship, and conduct ongoing monitoring.

Identity verification for individuals uses resident registration number, passport, or driver's license; for legal entities, corporate registration extract plus confirmation of authorized representative.

Non-face-to-face onboarding requires equivalent-strength verification (e.g., real-name account verification, certified digital certificate, or video identification) and enhanced monitoring for the first period.

EDD triggers include PEP status, high-risk jurisdiction nexus, complex ownership structures, unusual transaction patterns, correspondent relationships, and products favoring anonymity.

EDD measures: source of funds and source of wealth documentation, senior management approval, more frequent and deeper monitoring, and if risk cannot be mitigated, refusal or termination.

Simplified due diligence is permitted only for demonstrably lower-risk cases (e.g., listed companies subject to disclosure); it never permits skipping identification of the customer.

Reliance on third parties is limited; the financial institution remains responsible for the CDD outcome and must obtain records without delay.

Ongoing CDD requires updating customer information at a defined cycle (risk-based, commonly 1-3 years) and on trigger events such as ownership change or large unusual activity.

Beneficial owner definition: the natural person who ultimately owns or controls the customer, or on whose behalf a transaction is conducted; includes those exercising ultimate effective control by other means.

Ownership threshold used in Korea: 25% or more of shares or voting rights (a lower threshold may apply for higher-risk categories); control can also arise through nominee arrangements or shareholder agreements.

For trusts, the beneficial owner includes settlor, trustee, protector (if any), beneficiaries or class of beneficiaries, and any other natural person with ultimate control.

If no natural person can be identified after all reasonable efforts, senior management must be informed and enhanced measures applied; a nominal legal-entity owner is not acceptable.

Risk assessment operates at three levels: institutional (enterprise-wide), customer, and transaction/product/channel; the institutional assessment must be documented and updated periodically.

Customer risk scoring typically combines customer attributes, country/geography, product/service, channel, and transaction behavior; weights must be documented and consistently applied.

High-risk indicators include cash-intensive businesses, offshore shell structures, complex multi-jurisdiction chains, PEPs, sanctioned-country nexus, and adverse media.

Low-risk treatment requires justification and periodic re-review; risk ratings must be refreshed on trigger events and at defined intervals.

Records of the risk assessment methodology and individual ratings must be retained and made available to supervisors on request.

STR duty: a financial institution must report to KoFIU without delay when it knows or suspects that funds are criminal proceeds or linked to terrorism financing, regardless of amount.

No de minimis threshold exists for STRs; even attempted or aborted transactions must be reported if suspicion exists.

Tipping-off is prohibited: the institution must not disclose to the customer or third parties that a report was or will be filed; disclosure is criminally punishable.

Internal workflow: detection (monitoring rules or employee referral) → investigation → AML officer decision → approval → electronic filing to KoFIU → record retention.

Deadline practice: report without delay; KoFIU guidance expects filing promptly after the decision, and delayed internal handling is a supervisory finding.

STR content must include customer identity, account details, transaction description, and the specific grounds for suspicion; vague narratives are a common deficiency.

Follow-up obligations: respond to KoFIU requests for additional information and provide transaction records on request; KoFIU may forward reports to prosecutors.

Confidentiality: STR data is protected; sharing outside authorized channels (including within a group without legal basis) can breach the FIU Act.

Metrics for program effectiveness include alert-to-case conversion, STR volume and quality, decision turnaround time, and post-filing feedback tracking.

CTR (고액현금거래보고) threshold: a single transaction or aggregated transactions of KRW 10 million or more in cash within one business day must be reported to KoFIU.

Aggregation rule: multiple cash transactions by the same person at the same institution in one business day are summed; structuring to stay below the threshold is itself a red flag requiring an STR.

CTR must be filed within the prescribed period after the transaction date (generally within 30 days under the FIU Act framework); late filing is a supervisory violation.

Cash is defined to include domestic and foreign currency notes and certain cash-equivalent instruments; checks and wire transfers are generally outside the CTR definition but may still trigger STRs.

CTR and STR are separate obligations: filing a CTR does not satisfy the STR duty, and a suspicious transaction below the CTR threshold still requires an STR.

Exemptions and adjustments may apply to specified low-risk categories; the exemption must be documented and approved, not assumed by branch staff.

VASPs and e-money providers have separate thresholds (KRW 1 million for virtual asset transfers) reflecting FATF travel-rule expectations.

Data quality in CTR filings (name, ID number, account, amount, date) is examined; systematic errors are treated as reporting failures.

Automated CTR generation from core systems with exception handling is the expected control; manual-only processes are a supervisory weakness.

Targeted financial sanctions (TFS) require freezing without delay and without prior notice, and prohibiting making funds available to designated persons.

Korean implementation: UN sanctions lists are incorporated through the Act on Prohibition of Financing for Offenses of Public Intimidation; separate unilateral designations may be issued by the Ministry of Foreign Affairs or FSC.

Screening must cover customers, beneficial owners, authorized signatories, counterparties, and payment message fields; fuzzy-name matching requires documented disposition rules.

PEP definition: individuals entrusted with prominent public functions (domestic or foreign), their family members, and close associates; risk continues for at least 12 months after leaving office, longer if risk persists.

PEP measures: senior management approval, source of wealth and source of funds verification, enhanced ongoing monitoring; family and close associates receive the same treatment.

Freeze obligations override customer confidentiality and contract terms; a frozen account may only receive permitted credits (e.g., interest, legally required payments) under the applicable authorization regime.

False positives must be resolved with documented rationale; unresolved matches must be escalated and, if confirmed, frozen and reported to the competent authority.

Sanctions screening lists must be updated promptly when new designations are published; stale list data is a common examination finding.

Reporting of frozen assets to the competent authority (and KoFIU where relevant) is mandatory, with periodic confirmation of continued holdings.

Four program pillars: internal policies and procedures, designated AML compliance officer, ongoing employee training, and independent testing/audit.

Board and senior management accountability: the board approves the AML policy and risk appetite, receives periodic reporting, and ensures the compliance officer has authority and resources.

Three lines of defense: business units own customer risk, compliance designs and monitors controls, internal audit provides independent assurance.

Training must be role-based and risk-based: front-line staff on CDD and red flags, compliance on STR quality and sanctions, management on governance responsibilities; frequency at least annual plus on regulatory change.

Independent testing must be performed by a function independent of AML operations, with scope covering CDD sampling, STR quality, sanctions screening effectiveness, and CTR accuracy.

Testing outputs require a written report to the board or audit committee, tracked remediation with owners and deadlines, and validation of completed fixes.

Group-wide programs must apply to overseas branches and subsidiaries, with escalation where local law conflicts with Korean or group requirements.

Key risk indicators and management information (alert volumes, backlog, overdue CDD reviews, training completion, testing findings) should be reviewed at least quarterly.

Recordkeeping and documentation of governance decisions (approvals, exceptions, risk acceptances) are examined as evidence of an effective program.

VASPs must register with KoFIU under the Specific Financial Information Act, obtain ISMS certification, and verify real-name accounts through a bank before operating in Korea.

Travel rule for virtual assets: transfers of KRW 1 million or more require transmission of originator and beneficiary information between VASPs; missing information must be handled under a documented policy.

Virtual asset risk typologies include mixing/tumbling, chain-hopping across assets, anonymity-enhanced currencies, unhosted wallets, and cross-border arbitrage of weak regimes.

Unhosted wallet transfers require enhanced measures such as ownership verification, source of funds checks, and risk-based restrictions.

Fintech and e-money risks: onboarding speed reduces verification depth, API-driven aggregation obscures the originator, and agent networks dilute control consistency.

New payment methods (prepaid cards, mobile wallets, P2P transfers, BNPL) raise layering risk where limits are high and identity verification is light.

Stablecoins and DeFi protocols raise questions about who is the obliged entity; institutions should assess exposure and document the control gap.

Institutional risk assessment must be refreshed when launching new products, channels, or technologies; new product approval should include an AML risk sign-off.

Transaction monitoring for virtual assets should incorporate blockchain analytics alongside traditional rules, with alert triage documented.

KoFIU and FSS conduct VASP inspections focusing on real-name account compliance, travel-rule implementation, and STR volume relative to transaction volume.

Suspicious virtual asset activity must be reported as an STR even when below the KRW 1 million travel-rule threshold.

VASPs must maintain customer identification records and transaction logs for the statutory retention period and produce them on supervisory request.

Cross-border VASP transfers require counterparty due diligence on the receiving VASP's licensing status and AML regime.

Custody and exchange activities carry different risk profiles; the institutional risk assessment should distinguish them.

NFT and tokenized-asset treatment depends on legal characterization; institutions should document the classification basis rather than assume exclusion.

Third-party blockchain analytics vendors require due diligence on data coverage and methodology.

FSS examinations assess the four pillars plus sector-specific requirements; findings are graded and remediation deadlines are set.

Sanctions for AML failures can include institution-wide business suspension, fines, and individual referral; severity scales with duration and management involvement.

KoFIU publishes AML supervision guidance and typology reports that institutions should track for rule changes.

Self-reported deficiencies with prompt remediation are generally treated more favorably than deficiencies discovered by examiners.

Institutions must respond to KoFIU information requests within the stated deadline; failure to respond is itself a violation.

A defensible STR narrative answers who, what, when, how much, why suspicious, and what the institution did (including account restrictions).

Escalation timelines should be documented (e.g., investigation opened within X days, decision within Y days) and monitored for backlog.

Repeat STRs on the same customer should reference prior filings and cumulative activity.

Post-filing, institutions should track law-enforcement or KoFIU feedback where available and feed it into rule tuning.

Monitoring rule changes require documented rationale, testing, and approval; undocumented tuning is an audit finding.

Correspondent banking requires EDD on the respondent institution: ownership, AML program quality, supervisory regime, and purpose of the relationship.

Payable-through accounts require the correspondent to verify the underlying customers of the respondent.

Wire transfers must include originator name, account number, and address or national ID; missing fields require documented follow-up.

Batch transfers must contain the required originator information for each underlying transfer.

Jurisdictions identified as high-risk or subject to FATF call-for-action require enhanced measures or restrictions.

If identity cannot be verified, do not open the account or execute the transaction; document the refusal.

If beneficial ownership cannot be determined, escalate to senior management and apply EDD or decline.

If a customer refuses to provide required CDD information, file an STR where suspicion arises and consider exit.

Periodic review overdue beyond the internal limit should trigger account restriction until completed.

CDD refresh is mandatory on change of beneficial ownership, change of control, or a significant change in transaction pattern.

Exact match: freeze immediately, do not notify the customer, and report to the competent authority.

Partial/fuzzy match: block pending investigation, document the comparison (name, DOB, nationality, ID), and resolve within a defined SLA.

If a match cannot be cleared, treat as confirmed and escalate.

Screening must occur at onboarding, on list updates (retrospective screening), and at payment initiation.

Sanctions risk assessment should cover customer base, products, geography, and channel, and be refreshed periodically.

Independent testing scope should be risk-based, covering the highest-risk business lines each cycle.

Sample sizes for CDD and STR testing should be statistically defensible and documented.

Training completion rates below target are a reportable governance metric.

Testing findings should be graded by severity with defined remediation timelines and validation.

Board reporting should include open findings, overdue items, and trend analysis across cycles.

Acceptable evidence includes corporate registry extracts, shareholder registers, and certified ownership charts; self-declaration alone is insufficient for high-risk customers.

Ownership chains spanning multiple jurisdictions require verification at each layer where feasible.

Nominee and trust arrangements require identification of the natural person behind the arrangement.

Control-based beneficial ownership must be documented with the basis (e.g., voting agreements, management authority).

Beneficial ownership data must be updated on trigger events and retained for the statutory period.

Foreign currency cash is converted to KRW equivalent for threshold determination.

Cash deposits by multiple individuals into one account may be aggregated where they appear coordinated.

Cashier's checks and similar instruments may fall within cash-equivalent definitions depending on the applicable rule.

Structuring indicators include repeated near-threshold deposits and multiple branches on the same day.

CTR data feeds should be reconciled against core system cash transaction totals periodically.