PANews reported on December 4th that, according to a report by South Korean media outlet Decenter, a report from the Korea Internet Security Agency (KISA) shows that a large number of South Korean cryptocurrency exchanges have not yet obtained ISMS-P certification, which is considered the minimum standard for personal information protection, and their security investment is also considered insufficient.

Of the six non-Korean won (coin market) exchanges that newly registered or renewed their Virtual Asset Service Provider (VASP) certifications with the Financial Intelligence Unit (FIU) of the Korean Financial Services Commission this year, five only hold basic ISMS certification. ISMS certification does not include personal information protection requirements. Among the major exchanges supporting Korean won trading, GOPAX has also not obtained ISMS-P certification.

Large exchanges also face problems with insufficient security investment and dedicated personnel. The three largest exchanges—Upbit, Bithumb, and GOPAX—that have disclosed their security status to the Korea Information Security Agency (KISA) only allocate about 10% of their total IT investment to security. In South Korea, Upbit, Bithumb, and GOPAX have only 9%, 10.2%, and 12.5% of their personnel dedicated to security, respectively. Coinone and Korbit, the third and fourth largest exchanges in South Korea, haven't even proactively disclosed their security measures.