South Korea Court Sides with Upbit Operator Over FIU in Major AML Enforcement Setback

A Seoul Administrative Court has canceled the Financial Intelligence Unit's (FIU) three-month partial business suspension against Dunamu, the operator of major crypto exchange Upbit, marking the end of a legal dispute that stretched over a year. The ruling represents a significant win for the exchange and a notable constraint on South Korea's regulatory enforcement powers over the crypto sector.

Regulatory Ambiguity Undermines Enforcement

Here's what matters: the court found that while the FIU had established clear rules for transactions above 1 million won (approximately $675), the regulatory framework for smaller transfers lacked sufficient specificity. This gap proved decisive. The Seoul Administrative Court determined that the lack of explicit guidance weakened the FIU's basis for enforcement, essentially saying you can't penalize a company for violating standards that weren't clearly defined in the first place.

This ruling directly constrains the FIU's ability to impose major AML sanctions on crypto exchanges where compliance standards aren't concretely spelled out. For traders and portfolio managers monitoring regulatory risk, this signals that vague compliance expectations won't hold up in court—a meaningful precedent for the broader crypto trading and portfolio landscape.

The Court's Take on Dunamu's Compliance Efforts

The FIU had accused Dunamu of failing to take adequate measures to prevent AML violations. But the court pushed back, arguing that regulators hadn't provided specific guidance on what actions were actually required. Given that ambiguity, the court found that Dunamu had made reasonable compliance attempts. Even if those measures appear insufficient in retrospect, the court ruled it's difficult to conclude the exchange operator failed due to intent or gross negligence—a critical distinction that protects companies operating within unclear regulatory zones.

Timeline: How the Legal Battle Unfolded

The FIU imposed the original sanction on February 25, 2025, following an on-site inspection. The regulator cited two key violations: Dunamu had facilitated transactions with unregistered overseas virtual asset providers (VASPs) and failed to meet customer due diligence requirements. The inspection reportedly uncovered over 600,000 suspected Know Your Customer (KYC) violations during Upbit's exchange business review.

Dunamu responded quickly, filing a lawsuit and requesting an injunction to halt enforcement by late February. On February 28, the company formally submitted its case to overturn the partial suspension order. The court granted the injunction on March 27, allowing Upbit to continue onboarding new users while the full case proceeded—and now that full case has resulted in a complete reversal of the FIU's sanction.