The Bank of Korea began its first comprehensive review of financial institutions’ exposure to the virtual asset market on Oct. 23, sending questionnaires to 18 banks and 13 securities firms, covering 31 institutions in total. Responses are due this Wednesday.
The exercise marks the first time the central bank has tried to systematically map crypto exposure across the country’s financial system. The questionnaire asks institutions to disclose detailed information, including staffing and budgets tied to crypto-related work, the business lines they are running, why they entered the market, and how much money they have put into crypto companies in South Korea and overseas.
The central bank is not only asking whether financial firms have touched crypto. It is asking how deeply they are involved, how many people they have assigned, and how much capital they have committed.
One of the most closely watched parts of the questionnaire is its scenario analysis. One question asks what impact institutions would face if South Korea’s largest crypto exchange by market share suspended operations because of a major hack or a similar incident. Another asks about the consequences of a sharp drop in token prices followed by a prolonged slump in trading volume. A third asks how spillover effects would spread if another financial institution suffered heavy losses tied to a crypto-related event.
Taken together, the three questions line up with operational disruption, market risk, and contagion risk. In practice, the survey reads like a scaled-down crypto stress test.
The survey started shortly before last week’s $6.3 billion Binance theft came to light, but the case fits the kind of risk prototype the Bank of Korea appears to be examining. U.S. authorities have attributed the attack to North Korean hackers, prompting regulators in South Korea and elsewhere to revisit exchange concentration risk and cybersecurity gaps.
Stablecoin pilots and tighter cybersecurity rules are moving in parallel
Even as the survey is underway, South Korea’s financial sector is still pushing ahead with stablecoin-related services. KB Financial Group completed a pilot for a won-denominated stablecoin in May. In September, Kakao Pay and KakaoBank partnered with Fireblocks to explore digital asset infrastructure.
The Bank of Korea has consistently argued that stablecoins should be issued under a bank-led model. Still, disagreement over which institutions should qualify to issue them has continued to slow the legislative process for the Digital Asset Basic Act. A Bank of Korea official said financial institutions are continuing to prepare on their own even though virtual asset legislation is moving more slowly than the market expected.
Regulators are also tightening cybersecurity requirements. In October, the Financial Services Commission proposed stricter cybersecurity rules after inspections of 555 financial companies found deficiencies at 130 of them. Another 16 companies had experienced cybersecurity incidents, including crypto exchanges. The direction of the new rules includes more frequent vulnerability scans and stronger accountability for senior executives.
The survey points to a broader risk framework shift
The timing of the Bank of Korea’s move is not accidental, according to the report. Retail participation in crypto has long been high in South Korea, and exchange concentration is also higher than in many other markets. If a dominant platform runs into trouble, the shock could pass directly into banks’ lending exposure and wealth management positions.
By using a questionnaire to identify the shape of that exposure first, the central bank is effectively laying groundwork for possible next steps such as capital charges, exposure caps, or liquidity requirements. The report links that logic to Fitch’s warnings this year that banks holding too much Bitcoin could face rating downgrades. The common thread is that crypto assets are being pulled into the traditional financial risk framework rather than being watched from outside it.
The survey is framed around whether institutions could be dragged down by crypto-related events, not whether they should participate in the sector. That makes it look more like preparatory work ahead of a formal stress-testing regime. The report also notes that Taiwan’s financial regulator still handles banks’ crypto business on a case-by-case approval basis, mainly focused on custody and custody-linked services, while South Korea has put banks and brokerages into the same questionnaire, giving the review a wider scope.
Two issues now stand out. One is whether the survey results will be turned into concrete exposure limits or cybersecurity thresholds. The other is whether the stalled Digital Asset Basic Act can produce consensus on issuance authority before the next election cycle. If legislation remains stuck, financial institutions may stay in the pilot stage, and the Bank of Korea may still have limited tools available even if it gains a clearer picture of the risks.
