Korea let a crypto exchange pull government records for KYC instead of asking for documents

Dunamu, which runs Upbit, said on 26 August 2026 that the Ministry of the Interior and Safety had designated it an administrative information sharing institution, the first digital asset exchange to get there. The statute behind the designation replaces the document a user uploads. It does not replace the check the exchange performs.

The short version

• Dunamu, operator of Upbit, was designated by Korea's Ministry of the Interior and Safety as an administrative information sharing institution in mid-August 2026, and announced it on 26 August.
• It is the first digital asset exchange in Korea to be designated. The ministry inspected Dunamu on site in May 2026 and reviewed its suitability first.
• The scheme runs under the Electronic Government Act, which says an agency must not separately collect information it can reliably obtain from another agency, and which names licensed banks as eligible sharers.
• Sharing is limited to the scope needed for a specific purpose, and personal information may only be pulled with the data subject's prior consent showing the purpose, the information and the institution's name.
• Dunamu says it plans to use the service for KYC and will complete the related preparations. It does not say the flow is live or which records it will use.

Document-upload KYC asks the customer to fetch proof the state already holds

Know your customer checks in Korea, as in most places, commonly require a person to obtain a certificate or scan a document and upload it, after which the firm verifies the copy. Korea's Electronic Government Act, in the version in force from 28 August 2026, states that an agency must not separately collect information it can reliably obtain from another agency.

The upload model has two costs. The first is friction: the person has to know which document is wanted, obtain it, and photograph it well enough to be read. The second is that what the firm receives is a copy, and a copy can be altered. A firm verifying a scan is verifying that the scan looks right, which is a weaker thing than confirming the record it was copied from.

Korea's answer for government itself is Article 36(1) of the Electronic Government Act. It requires an agency that holds administrative information to share it with other agencies that need it, and prohibits collecting the same information separately when it can be reliably obtained. Article 36(2) extends the sharing beyond government to two groups: banks licensed under Article 8(1) of the Banking Act, and "corporations, organisations or institutions prescribed by Presidential Decree".

Banks are named in the statute. Everyone else, including a crypto exchange, comes in through the second clause, by designation. That is the door Dunamu has now been let through.

Dunamu is the first exchange designated, after a May inspection and before its KYC use is live

Dunamu, the operator of the Upbit exchange, announced on 26 August 2026 that the Ministry of the Interior and Safety had designated it an administrative information sharing institution around the middle of August. The ministry conducted an on-site inspection in May 2026 and reviewed suitability before designating. Dunamu is the first digital asset exchange in Korea to be designated.

The facts here come from Dunamu's own newsroom release, dated 26 August and posted the following day; the ministry's own announcement was not located on its site when this was written, so the account of the designation is the company's. Quotations from the release are our translation from the Korean.

Dunamu describes the service the way the statute does: a scheme the ministry introduced so that users need not submit required documents themselves, under which an institution can confirm and use information held by administrative agencies through the government network. It says it plans to use the service in its KYC work, to minimise users' document burden, and expects faster and more accurate processing as document checking is streamlined.

A company representative is quoted in the release as saying that, as the first exchange designated, Dunamu has laid the groundwork to use public information safely and efficiently in customer identification, and that it "will complete the related preparations" so as to offer a more convenient KYC service. The tense matters. The designation is done; the use of it is planned.

The release also carries a line of analysis Dunamu attributes to observers rather than to itself: that the designation opens a path for digital asset exchanges to reach public data infrastructure in the way traditional financial firms already do. That is a fair description of Article 36(2), which lists banks by name.

The Electronic Government Act sets out who may share, what for, and with whose consent

Article 36(2) of Korea's Electronic Government Act lets agencies share their information with other agencies, with banks licensed under the Banking Act, and with corporations, organisations or institutions prescribed by Presidential Decree. Article 38(4) limits sharing to the scope necessary for a specific purpose. Article 42(1) requires the data subject's prior consent where personal information is involved.

The Act was amended by Act No. 21394 of 27 February 2026, and the version read for this post is the one in force from 28 August 2026. The ministry's own contact list on the statute page assigns Articles 36 to 43 and 44 to its administrative information sharing division. The route from designation to a record arriving on an exchange's screen runs through five of those articles.

a

Be eligible

Article 36(2). Other agencies and licensed banks are eligible by the statute. Anyone else must be a body "prescribed by Presidential Decree", which for a crypto exchange means designation by the ministry, the step Dunamu has now completed.

b

Apply for specific information

Article 39(1). The institution applies to the minister specifying the information and its scope, the purpose and method of use, and the agency that holds it. Sharing goes through the ministry's sharing centre under Article 37(2) unless there is good reason otherwise.

c

Pass the refusal grounds

Article 39(2). The minister may approve with conditions, but must refuse where the information is secret or non-public under law, concerns national security or foreign relations, or is not necessary for the applicant's own business. The holding agency must consent first under 39(3).

d

Clear the privacy regulator

Article 39(4). Where the information is a personal information file under the Personal Information Protection Act, approval requires the deliberation and resolution of the Personal Information Protection Commission.

e

Get the person's consent, each time

Article 42(1). Before sharing personal information the institution must obtain the data subject's prior consent, and the consent must show the purpose, the information and scope, and the name of the institution using it. Article 38(4) confines the use to that purpose.

Two features of that route are worth naming because they are easy to lose in the headline. The first is that designation is not access. It makes an institution eligible to apply; the information it may pull, and for what, is fixed application by application under Article 39. The second is that the person remains in the loop. Article 42 puts the consent in front of every pull, and requires the consent to say which institution is asking and why.

Article 38(3) adds a duty on the holding agency to keep shared information current and accurate, which is the property that makes a pulled record worth more than an uploaded copy in the first place.

The record replaces the document; binding the person to the record is still the exchange's job

A designation under Korea's Electronic Government Act changes where an exchange gets a customer's record. It does not change who decides whether the person in front of it is that customer. Dunamu's announcement of 26 August 2026 describes reduced document burden and faster, more accurate processing, and says its KYC use of the service is still being prepared.

A record pulled from the agency that holds it is authoritative for what it says: that a person with this name, this registration number and this address exists in the register. It says nothing about whether the person holding the phone is that person. That is a separate check, and it stays with the exchange. Korea's banking sector has for some time required a face match for account opening, a point we covered when we mapped nine Asian markets' identity rules, and nothing in this designation relieves an exchange of the equivalent step.

Nor does it touch the exchange's anti-money laundering duties. The Electronic Government Act is about where information comes from. What a virtual asset service provider must establish about a customer, and when, is set elsewhere in Korean law and is unchanged.

The direction is familiar from Europe. The EU's anti-money laundering authority, in its draft standard on customer due diligence, ranks a government-backed electronic identity above a document check. Korea reaches a similar place by a different mechanism: rather than issuing the citizen a credential, it lets an approved institution ask the register directly, with the citizen's consent each time.

That leaves the question the designation raises without settling. The same door that removes a user's upload friction extends a private company's reach into state records. The statute's answer is purpose limitation, per-use consent and review by the privacy commission. Whether that balance, drawn for banks, is the right one for a crypto exchange is a question the Act leaves to the designation process, and the ministry has answered it once, for one firm, after an inspection. What it will require of the next applicant is not published.

Key takeaways

First exchange through the door.

Dunamu, operator of Upbit, was designated in mid-August 2026 after a May on-site inspection, and announced it on 26 August.

Banks are named in the statute; exchanges are designated.

Article 36(2) lists licensed banks and leaves everyone else to a Presidential Decree and the ministry's designation.

Designation is not access.

Each use is applied for and approved under Article 39, with refusal grounds and a privacy commission step for personal data.

The person consents each time.

Article 42(1) requires prior consent showing purpose, scope and the institution's name; Article 38(4) confines use to the purpose.

The KYC use is planned, not live.

Dunamu says it will complete the related preparations. It has not said which records it will pull or when.

Using Didit for the check a government record does not make

A pulled record answers the question "does this person exist in the register". It does not answer "is this the person". That second question is the one an exchange still has to settle, in Korea and everywhere a government pull is not available at all, which is most places.

ID Verification at $0.15 per check is the document route. It remains the way to establish identity in every market without an equivalent of Korea's sharing centre, and the way to read the identifiers that a record is then matched against. Passive Liveness at $0.10 per check establishes that a live person is presenting, which is the step that binds a person to a record and that no register lookup performs. Proof of Address at $0.20 per check covers the address element where no government record can be pulled for it. Phone Verification from $0.03 per check adds a second factor tied to the person rather than the record. Current prices are on the pricing page.

Three limits. Didit is not a designated institution under Korea's Electronic Government Act and cannot pull Korean government records; that access belongs to Dunamu and to whichever firms the ministry designates next. Whether and when Upbit's flow goes live is Dunamu's to announce. And the designation is Korea-specific: it creates no obligation, and no equivalent access, anywhere else.

Frequently asked questions

What did Dunamu announce on 26 August 2026?

That the Ministry of the Interior and Safety had designated it, around the middle of August 2026, as an administrative information sharing institution, the first digital asset exchange in Korea to be designated. The ministry conducted an on-site inspection in May 2026 and reviewed suitability before designating. Dunamu operates the Upbit exchange.

What is administrative information sharing in Korea?

A service run by the Ministry of the Interior and Safety under Articles 36 to 44 of the Electronic Government Act. It lets an approved institution confirm information already held by government agencies through the government network, rather than requiring the person to obtain and submit the document. Article 36(2) extends it beyond agencies to banks licensed under the Banking Act and to bodies prescribed by Presidential Decree.

Does a user's consent still apply?

Yes. Article 42(1) of the Electronic Government Act requires the using institution to obtain the data subject's prior consent when sharing administrative information that contains personal information, and the consent must show the purpose of sharing, the information and scope, and the name of the using institution. Article 38(4) limits sharing to the scope necessary for a specific purpose.

Is Upbit already using government data for KYC?

Not as of the announcement. Dunamu's release says it plans to use the service for KYC to minimise document burden, and that it will complete the related preparations. It does not say the flow is live or which records will be used.

Does this replace identity verification?

It replaces the document a user would otherwise obtain and upload. It does not establish that the person presenting is the person in the record, which remains the exchange's own check, nor does it change the exchange's obligations under Korean anti-money laundering law.

Related reading

• Asia identity verification rules: nine markets — Korea's existing rules, and the face-match requirement the record does not replace.
• AUSTRAC suspends Cryptolink — What happens when an exchange's obligations are not met.

Sources

1. 두나무, 디지털자산 거래소 최초 행정정보 공동이용 대상기관 지정 — Dunamu newsroom · dateline 26 August 2026, posted 27 August 2026 · the designation, the May inspection, the planned KYC use and the representative's quotation, translated by us
2. 전자정부법 (Electronic Government Act) — Korean Law Information Center · Act No. 21394, amended 27 February 2026, in force 28 August 2026 · Articles 36, 37, 38, 39 and 42 as summarised in this post

Who wrote this

Tuan Nguyen — Growth · Didit

Writes about identity verification, fraud and compliance at Didit.

Last reviewed 1 Sep 2026 against the sources above