AML Internal Control Standards for Currency Exchange Businesses in Korea — 2026

1. Why AML Compliance Is Critical

Currency exchange businesses in Korea are classified as financial transaction reporting institutions under the Act on Reporting and Use of Specific Financial Transaction Information. Failing to take the required AML measures can result in administrative fines of up to KRW 100 million, corrective orders, and a request by KoFIU to suspend all or part of the business for up to six months; filing a false report or disclosing a report to the customer is a criminal offense.

2. Three Core AML Obligations

• Customer Due Diligence (CDD/EDD): Verify customer identity when an account is opened or for a one-off transaction at or above the threshold (USD 10,000 or equivalent for foreign exchange transactions denominated in foreign currency), and regardless of amount where money laundering is suspected — in that case also verify the transaction purpose and source of funds
• Suspicious Transaction Reports (STR): Report suspected money laundering to the Financial Intelligence Unit (FIU) without delay
• Currency Transaction Reports (CTR): Report cash transactions of KRW 10 million or more per day per customer within 30 days

3. Internal Control Policy Document

Required AML policy document must include: risk assessment methodology, CDD procedures, STR/CTR reporting workflow, record-keeping rules (5-year minimum), employee training schedule, and compliance officer designation.

4. Transaction Monitoring Systems

• Daily CTR threshold alerts
• Pattern detection for structuring (splitting transactions to avoid CTR)
• PEP (Politically Exposed Person) screening
• Sanctions list checking (UN, OFAC, etc.)

5. Staff Training Requirements

Currency exchange businesses must provide AML training and education to their officers and employees.

6. Regulatory Inspections

KoFIU supervises AML compliance, and inspection of registered currency exchange businesses is entrusted to the Korea Customs Service. Common findings: inadequate CDD records, missing CTR filings, outdated AML policy documents.