South Korea blocks 27 unregistered exchanges, KuCoin and MEXC are on the list

South Korea's financial supervisor blocked access to 27 websites on October 13, 2026, through which unregistered foreign exchanges were serving customers in the country. KuCoin, MEXC and BingX are on the list, along with Phemex, XT.com, Bitrue, CoinW, BTCC, BitMart and DigiFinex. For investors in Germany the case is no distant administrative matter: several of those venues hold no workable licence in the European Union either, and in Germany the grandfathering for legacy providers lapsed back on December 31, 2025.

The block does not affect crypto trading in the country, but access to providers that never completed South Korean registration. Anyone holding a balance on one of the affected platforms has to reckon with the route to their account becoming harder. That is precisely the point that turns the case into a question to check here too.

What South Korea's financial supervisor ordered on October 13

Responsibility lies with the Financial Intelligence Unit, the anti-money-laundering reporting office of the South Korean supervisor FSC. It did not enforce the blocks itself but applied for them at the Korea Communications Standards Commission, which approved them after reviews on October 6 and 7, 2026. The financial service FinanceFeeds reports this, citing the authority.

The technical route depends on where a site sits. For offerings hosted abroad, access from South Korea is blocked. For sites with servers or operators in the country, it amounts to shutting the service down. The direction is new: in future the FIU intends to apply for blocks as soon as it establishes unregistered activity, without waiting for a court ruling or documented harm to users. In total the authority says it has handed 44 unregistered operators to the investigating authorities.

A precursor dates back two and a half years. In March 2025 Google Play restricted 17 platforms for the South Korean market, KuCoin and MEXC among them. The browser route stayed open then. This step closes it.

These venues are on the block list

Ten names are publicly documented: KuCoin, MEXC, BingX, Phemex, XT.com, Bitrue, CoinW, BTCC, BitMart and DigiFinex. The authority did not list the remaining addresses of the 27 individually, which also has to do with individual providers running several domains.

Three of those exchanges are familiar to German readers from events of their own. KuCoin pulled 25 tokens from trading at the start of October and set its customers a withdrawal deadline for them. At MEXC an attack through an API key was the theme in September, in which the exchange reimbursed $340,000. Both are separate matters from registration, but they show that the platforms have customers here.

The registration duty in South Korea: ISMS certificate and notification to the FIU

A virtual asset service provider in South Korea is a provider that exchanges, transfers or holds crypto assets for third parties. Serving customers in the country in that role takes two things: an ISMS certificate, the state-audited proof of an information security management system, and registration with the FIU. The two together are the entry ticket, and the blocked providers lack both.

The numbers show how narrow the bottleneck is. In the first half of 2026, 26 providers were registered, of which 17 were exchange operators and nine custody or wallet services. A market with South Korea's trading volume therefore runs through a double-digit number of licensed houses, while alongside them dozens of foreign platforms were taking on customers without registration.

What happens to a balance on a blocked exchange

An access block deletes no account. The authority itself points out that users may run into difficulties managing their account, closing positions or withdrawing existing balances. Existing accounts are left untouched by the decision, and there is no general withdrawal deadline. For the wind-down the FIU intends to provide guidance together with the industry body DAXA and the operators.

In practice that means the platform keeps working but is no longer reachable from the blocked network without detours. Holding open leveraged positions carries the greater risk here, because a margin call takes no account of whether the customer can currently reach their account. The authority has also announced that it will pursue replacement sites should blocked providers resurface under new addresses.

The German framework: since January 1, 2026 the CASP licence counts

The European crypto regulation MiCA requires authorisation as a crypto-asset service provider, CASP for short, for crypto-asset services. Article 143 of the regulation allowed member states to give legacy providers a transition period of up to 18 months, that is until July 1, 2026. Germany did not use that period in full.

The shorter variant sits in the Crypto Markets Supervision Act, KMAG for short. Section 50 paragraph 2 number 3 KMAG provides that the permission deemed to continue lapses "at the latest at the end of December 31, 2025". What matters is who that rule applied to at all: only companies that already held a German permission on December 29, 2024, for instance under the Banking Act or the Securities Institutions Act. A foreign exchange without such a legacy permission could never invoke it. For them the position since the regulation took effect is simply this: no business with German customers without a CASP licence or a notification under Article 60.

The six-month offset between the German and the European deadline explains why the situation differs from country to country. Which duties a licence triggers in concrete terms, from own-funds requirements to the segregation of client money, is set out in our overview of the MiCA duties for crypto companies.

KuCoin holds an EU licence and still may not start

Here lies the part of the case that is missing from the reports on the South Korean block. KuCoin is not simply unlicensed in Europe; the position is more complicated, and less favourable for customers, than a plain yes or no would capture.

The Austrian Financial Market Authority FMA granted KuCoin EU Exchange GmbH authorisation as a crypto-asset service provider on November 27, 2025. On February 19, 2026 it prohibited the company from taking on new business, because key functions for anti-money-laundering and sanctions were unfilled. The authority lifted that ban on May 18, 2026, after the posts had been filled. The decisive sentence comes next: commencement of business operations remains impermissible under a separate order of February 18, 2026, because requirements on governance and further key functions in the management body are outstanding. The FMA states this on its own site.

For a customer in Germany the distinction means more than a formality. A granted licence shows up in registers and in marketing claims; an order prohibiting the commencement of operations does not necessarily show up beside it. Rely on the entry alone and you see half the picture. At MEXC the matter is more straightforward: the South Korean FIU lists the exchange among the unregistered providers, and by the company's own account it has not applied for a licence in the EU.

How to check your exchange's licence yourself

A provider's status is public and looked up in a few minutes. Three places are enough.

The first is the MiCA register of the European securities supervisor ESMA. Under Article 109 of the regulation it brings together all CASP authorisations in the European Economic Area, including those refused and withdrawn. It shows whether a provider is licensed at all and which national authority supervises it. The second is BaFin's company database for the German market. The third is the site of the supervisory authority that the register names as responsible: only there do measures such as new-business bans or conditions appear, and those are exactly what the register lacks.

A look at the provider's terms and conditions is worth adding. They say which group company the contracting party is. It happens that a European subsidiary is licensed while the customer contracts with a company outside the EU; the consumer protection of that company then applies, not the European one. Which houses can show a licence in the European Economic Area and how their fees differ is shown by the comparison of regulated crypto exchanges.

Moving to your own wallet: what happens for tax

A transfer from an exchange to an address you control yourself is not a sale. No disposal gain arises, and the one-year holding period under section 23 of the German Income Tax Act keeps running; it does not start afresh. It is different if you sell holdings on the old exchange and buy again at a new one: those are two separate events for tax, and a sale within a year of acquisition is taxable insofar as the year's total gains exceed the exemption threshold.

The order therefore matters. Set up the destination address first and test it with a small amount, then transfer the rest. Sell out of haste instead, and you may pay tax merely because a website was blocked. For the records the rule is: document every withdrawal with its transaction ID and timestamp, because obtaining acquisition data from a blocked customer account later is laborious. The usual tax tools and portfolio trackers help with that, assigning deposits and withdrawals automatically.

Our assessment: why supervisors now hit access rather than users

From the newsroom's point of view, the South Korean step marks a change of method. Until now, proceedings against unregistered exchanges ran through investigations and criminal complaints, in 44 cases in South Korea. That takes years and never reaches the user. An access block works immediately, costs the authority almost nothing and shifts the consequences onto the platform's customers.

The evidence that this will not stay a one-off is on the table: the FIU has announced that it will apply for blocks in future without a court ruling and without proven harm, and it intends to track replacement addresses. Against that stands the fact that a block is technically easy to circumvent and changes nothing about the offering itself; the exchanges stay online, just out of reach. For the EU this does not mean network blocks are coming. The European route runs through the licence: a provider without one may not advertise, may not broker and may not offer a service. The lever sits with the provider, not with the access provider.

What both routes share is the consequence for the investor. A balance held at a provider without a usable licence hangs on a decision they have no influence over. That is the real reason to know the status, rather than looking it up only once the page stops loading. A total loss is possible at any time with crypto assets, independently of supervision; a missing licence lays an operational risk on top.

Exchange block in South Korea: the register decides, not the app

Three steps put your own position in order, and in this sequence:

1. Establish the status. Look in the ESMA register for whether your provider holds a CASP licence, and on the site of the responsible supervisor for whether conditions or prohibitions stand against it. A selection of houses with a licence in the European Economic Area is in the comparison of the best crypto exchanges.
2. Set up the destination address. Before the first withdrawal, create custody you control yourself and transfer a test amount first. Which devices come into question and what they cost is in the hardware wallet comparison.
3. Secure the records. Export the trading and withdrawal history before you empty an account, and keep the acquisition data for the holding period. The tax tools and portfolio trackers read those exports in and track the deadlines per position.

The next mark in the calendar is not a deadline for users but one for providers: a company that has not obtained a licence by the end of the European transition period on July 1, 2026 may not conduct new business in the EU. Which houses have managed it keeps changing, and in Germany the cut-off date of December 31, 2025 already counts.

(As of October 13, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)