Key findings
- Separate policy eligibility, counterparty acceptance and internal readiness. A corporate account does not establish all three.
- The first stage in 2025 focused on defined asset-conversion activities. It should not be conflated with universal investment or treasury access.
- The repeatable operating unit is an evidence package linking purpose, approval, execution and reconciliation—not an account alone.
Why the first transaction can stall after onboarding
Imagine a nonprofit preparing to accept a crypto donation. It has arranged an account, but has not decided who reviews the donation, which records the exchange needs or who responds if the won proceeds cannot be withdrawn promptly. Can the account alone complete the transaction? This is a hypothetical workflow, not a customer case study. It illustrates the gap between access and execution.
A policy-permitted activity still requires the organization to meet eligibility conditions, the bank and exchange to accept the evidence, and internal owners to approve the purpose and authority. These are connected but separate judgments. Institutional services become useful when they connect the three.
This report examines Korea’s February 2025 roadmap and the first-stage follow-up announcements in May. It is a retrospective analysis of how policy becomes operational conditions, not a comprehensive statement of corporate eligibility in October 2026.
Original CBK analysis. The size and spacing of the stages do not represent market shares or elapsed time.
Read the diagram description
Access covers eligibility and purpose; custody covers keys, providers and recovery; execution covers authority, limits and counterparties; reconciliation connects transactions, balances and evidence. Each stage needs an owner, acceptance evidence and a stopping rule.
01. From policy direction to operating conditions
On 13 February 2025, the FSC outlined first-half access for defined selling activities and a second-half pilot for investment and treasury activities by certain professional-investor corporations. Financial companies were excluded from the latter plan. This was not simultaneous access for every corporate activity. [1]
The 2 May follow-up specified selling guidance for nonprofits and crypto exchanges. For nonprofits, it began with externally audited organizations with at least five years of operating history, advance review of donations and liquidation plans, assets traded on at least three won exchanges, and a principle of prompt conversion after receipt. Exchanges faced a separate operating-expense purpose and limitations. [2]
On 20 May, the authorities announced stronger customer checks ahead of the 1 June start. Source of funds and transaction purpose would be checked at exchange deposits and withdrawals of sale proceeds from bank accounts, with periodic reverification within a maximum one-year interval. Account opening was not the end of the verification process. [3]
Source: FSC releases dated 13 February, 2 May and 20 May 2025, redrawn by CBK. The figure records what those announcements said at the time. [1] [2] [3]
Read the diagram description
The timeline distinguishes the 13 February roadmap, the 2 May selling guidance and the 20 May customer-check announcement. The 1 June date was the selling-access start announced in May, not a universal corporate purchase-permission date.
02. Mapping the cash flow reveals missing evidence
A nonprofit’s conversion route can be separated into the donor, the receiving organization’s account, the sale, the won account and the use of funds. The 20 May FSC material illustrates both transfers between exchanges and donations between accounts at the same exchange. Assuming that every movement has a public blockchain transaction hash would miss internal ledger transfers. [3]
An internal case identifier can connect the donation approval, exchange credit, execution records, fees and final cash balance. Evidence sits across blockchains, exchanges, banks and company systems. Define the rules for identifying one workflow before trying to reconcile it.
Completion also needs a clear definition. A filled sell order is different from cash arriving in the destination account and being posted to the books. Without a shared end state, operations can report success while accounting still carries an unresolved item. Faster blockchain processing alone does not close that gap.
Factual basis: the FSC transaction-flow explanation of 20 May 2025. Case identifiers and reconciliation are CBK analysis. Arrows represent workflow order, not processing time or transaction size. [3]
Read the diagram description
Donor account → nonprofit account → executed sale → real-name bank account → destination account. Exchange deposits and bank withdrawals require their respective checks, while the organization connects the records to internal approval.
03. Custody security and payment approval are separate designs
External custody delegates some key-management work to a specialist. The company must still determine why a transaction is needed, whether the recipient is appropriate and who can instruct it. A functioning custody system can faithfully execute an incorrectly approved instruction. A custody contract and the quality of internal controls should not be scored as the same thing.
Self-managed smart accounts require similar care. Safe documentation describes owners, signature thresholds, modules and guards. Some modules introduce alternative authorization paths; guards can constrain execution. “It uses multiple signatures” is therefore less informative than the actual enabled permissions and change procedures. This is not a recommendation to use a particular product. [4]
In a hypothetical two-of-three approval setup, two approvers relying on the same device or operator may lack meaningful independence. Simply increasing the threshold can instead make one person’s absence halt payments. The objective is accountable authority in ordinary and exceptional conditions, not a larger number in isolation.
CBK operating-design proposal, not a list of statutory requirements or a specific product architecture. Smart-account capabilities are referenced to Safe documentation. [4]
Read the diagram description
The first layer approves purpose, amount and counterparty and records an approval ID. The second executes a custody instruction or wallet signature and records a transaction identifier. A distinct reviewer then reconciles transactions, fees and balances.
04. Evaluate a pilot through exceptions, not volume alone
One successful transaction leaves the weakest operating paths untested. Rehearse an unavailable approver, a mismatch between an incoming asset and its supporting documents, and a delayed bank withdrawal after sale. The valuable result is a clear stop owner and evidence-based restart procedure, not a claim that no failures occurred.
Start with request-to-reconciliation time, waiting at each stage, evidence-resubmission counts, and unresolved exceptions by cause. Separate policy review, external-provider processing and internal approval delays. Combining them into one average conceals where preparation and spending would help.
The following tests are CBK proposals, not incident statistics or measured customer outcomes. Each organization should set stopping conditions within its permitted activity and risk tolerance. Relaxing limits or authority ad hoc merely to make a transaction succeed defeats the purpose of the pilot.
Hypothetical CBK test design. No incident frequency, recovery-time benchmark or statutory completeness is claimed.
Read the diagram description
An unavailable approver calls for preauthorized recovery and evidence. A document mismatch calls for renewed source-and-purpose checks. A delayed withdrawal calls for duplicate-instruction prevention and status verification. Restart follows evidence, not intuition.
05. What changes in institutional business development
The opening page of a proposal can show one concrete institutional workflow: who sends and receives the asset, which services are needed and which internal teams must review them. A buyer can then pass the proposal to an accountable next reviewer. This turns a marketing narrative into something operationally assessable.
Define the supplier’s role precisely. Organizing research and introductions, providing custody, executing transactions and giving legal or accounting judgments are distinct activities. If a proposal blurs them, sales promises and contractual responsibility can diverge. CryptoBridge Korea’s research and partner-development work should preserve these boundaries.
Define progress through artifacts, not simply meetings held. Has the purpose been documented? Have necessary providers been identified? Does each unresolved question have an owner? These measures do not automatically predict revenue or trading volume, but they make the obstacles to progress observable.
| Review question | Evidence to retain | Next decision |
|---|---|---|
| Does the activity fit the applicable scope? | Entity type, purpose and applicable-criteria record | Compliance and external specialist review |
| Who may instruct execution? | Request, approval, execution and exception authorities | Internal owner’s authorization |
| Can the movement of funds be reconstructed? | Linked deposit, execution, fee and bank records | Finance and accounting review |
| Where does processing stop? | Stop reason, owner and restart evidence | Expand the pilot or resolve gaps |
CBK analysis. This does not replace an institution’s policies or a provider’s required documents.
06. When this conclusion should change
For an institution with an established digital-asset operating model, building controls may not be the main bottleneck. Liquidity, execution cost, asset access or counterparty coverage may matter more. Investigate the missing connection instead of proposing that every organization rebuild all four stages.
The reverse sequence is also problematic: sophisticated operational design cannot establish permission for an unclear activity. Access assessment comes first. The four stages are a tool for finding unresolved conditions, not a checklist that makes every activity permissible.
Further research should examine actual account-review processes, provider requirements, stage-level processing times and pilot exceptions. This report does not claim to possess those data. Its conclusions rest on public policy and technical documents; empirical operating evidence could change the ranking and importance of the bottlenecks.
Scope & limitations
Policy analysis is limited to the 13 February roadmap and the 2 and 20 May 2025 first-stage follow-ups. Figures either reconstruct those releases or present CBK operating models; they do not determine current eligibility for every entity, asset or activity. Safe documentation was accessed on 18 October 2026. No customer interviews, account-review timings or pilot results were obtained, so economic effects are not estimated.
CryptoBridge Korea analysis based on public materials. Source facts are distinguished from interpretation and hypothetical calculations. References to organizations or projects do not imply their sponsorship or review of this paper.
Sources & scope
- FSC, Roadmap for Phased Corporate Participation in the Virtual Asset Market ↗Roadmap as announced. Plans are not treated as completed implementation.
- FSC, Virtual Asset Sale Guidelines for Nonprofits and Exchanges ↗First-stage eligible sellers, purposes and internal controls; not universal corporate trading authorization.
- FSC, Enhanced Customer Due Diligence for Corporate Virtual Asset Sales ↗Source-of-funds, purpose and repeated-verification arrangements ahead of 1 June sales access. The flow is redrawn analytically.
- Safe, How do Safe Smart Accounts work? ↗Owners, thresholds, modules and guards; not certification of any individual configuration.