Crypto Regulation in Japan: 2026 Update

Crypto regulation in Japan is among the most developed in the world. Japan was one of the first major economies to create a statutory licensing framework for crypto asset service providers, and its rules have grown steadily more detailed since. For international operators, Japan offers a well-defined legal path to market entry - but the compliance burden is substantial, and the Financial Services Agency (FSA) applies its rules rigorously. This guide covers the current legal framework, licensing requirements, ongoing compliance obligations, recent regulatory updates, and the practical considerations that foreign founders and executives must understand before entering the Japanese market.

Japan';s primary statute governing crypto assets is the Payment Services Act (PSA), which was amended to bring crypto exchanges under formal regulation. The PSA defines "crypto assets" (formerly called virtual currencies) and establishes the registration requirement for Crypto Asset Exchange Service Providers (CAESPs). A second pillar is the Financial Instruments and Exchange Act (FIEA), which governs crypto assets that qualify as securities or interests in collective investment schemes. Operators dealing in tokenised securities, security token offerings (STOs), or certain DeFi products must comply with FIEA in addition to, or instead of, the PSA.

The FSA is the central regulatory authority. It supervises CAESPs, issues and revokes registrations, conducts on-site inspections, and issues guidance. The Japan Virtual and Crypto Assets Exchange Association (JVCEA) is a self-regulatory organisation (SRO) recognised by the FSA. Membership in the JVCEA is effectively mandatory for registered exchanges, and the JVCEA issues its own rules on listing standards, custody, and advertising that carry regulatory weight.

A third relevant statute is the Act on Prevention of Transfer of Criminal Proceeds, which imposes anti-money laundering (AML) and know-your-customer (KYC) obligations on CAESPs. Japan is a member of the Financial Action Task Force (FATF), and its AML framework reflects FATF standards, including the Travel Rule for crypto transfers.

Any entity that operates a crypto asset exchange service in Japan must register as a CASP under the PSA. The term "crypto asset exchange service" covers exchange between crypto assets and fiat currency, exchange between different crypto assets, management of crypto assets on behalf of users, and intermediation of those activities. Operating without registration is a criminal offence.

Foreign companies cannot simply passport a licence from another jurisdiction. A foreign operator wishing to serve Japanese residents must either establish a Japanese legal entity and obtain registration, or register as a foreign CASP under a specific provision of the PSA that requires a domestic representative and a Japanese office. In practice, most serious operators establish a Japanese subsidiary - typically a kabushiki kaisha (KK) or a godo kaisha (GK) - and apply for registration in that entity';s name.

The registration process is demanding. The FSA reviews the applicant';s business plan, internal governance, AML/KYC systems, cybersecurity measures, custody arrangements, and the fitness and propriety of directors and major shareholders. Processing times vary but commonly run from several months to over a year, depending on the complexity of the application and the FSA';s current caseload. Applicants should budget for substantial legal and consulting fees during preparation.

A common mistake among foreign founders is underestimating the governance requirements. The FSA expects a functioning compliance function in Japan, not a nominal local director. Applicants without a credible local compliance officer and documented internal control systems regularly face requests for additional information that extend the review period significantly.

Once registered, a CASP faces a dense set of recurring obligations. These fall into several categories.

Custody and asset segregation. The PSA requires CAESPs to segregate customer crypto assets from the company';s own assets. A minimum of 95% of customer crypto assets must be held in cold storage (offline wallets). This rule was tightened following high-profile exchange hacks in Japan and is enforced strictly. Operators must conduct regular reconciliations and report discrepancies to the FSA.

AML and Travel Rule compliance. CAESPs must implement customer due diligence, enhanced due diligence for higher-risk customers, transaction monitoring, and suspicious transaction reporting. The Travel Rule - requiring the transmission of originator and beneficiary information for crypto transfers above a threshold - applies to Japanese CAESPs. Operators must use compliant messaging solutions and maintain records for a prescribed period.

Financial reporting and audits. Registered CAESPs must prepare financial statements in accordance with Japanese accounting standards and submit them to the FSA. Annual audits by a certified public accountant are required. Operators must also maintain minimum net assets as specified by the FSA, and report any material deterioration in their financial position promptly.

Advertising and solicitation rules. The JVCEA';s rules on advertising restrict misleading claims about crypto assets, require risk disclosures, and prohibit certain promotional practices. The FSA has issued guidance on social media promotion and influencer marketing that CAESPs must follow.

Incident reporting. System failures, security incidents, and significant operational disruptions must be reported to the FSA within prescribed timeframes. The FSA expects operators to have documented incident response plans.

In practice, founders should consider that the compliance cost of maintaining a registered CASP in Japan is significant. Annual compliance, audit, and legal costs typically run into the mid-to-high range for even a modest operation. Many underestimate the ongoing resource commitment required after registration.

If you are assessing whether your business model requires registration or falls within an exemption, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

Japan';s crypto regulatory framework has evolved materially in recent years, and the current direction of reform reflects both domestic priorities and international developments.

Stablecoin regulation. Japan enacted dedicated stablecoin legislation that came into force in recent years. The framework distinguishes between stablecoins issued by licensed banks, registered money transfer operators, and trust companies. Foreign stablecoin issuers wishing to distribute their tokens in Japan must work through a licensed Japanese intermediary. This framework is among the most detailed stablecoin regimes globally and has attracted significant attention from international issuers.

Security token framework. The FIEA framework for security tokens has been clarified and expanded. Operators running security token exchanges (STOs and secondary markets) must register as Type I Financial Instruments Business Operators or use a specific STO-focused registration category. The FSA has issued guidance on the treatment of fractional ownership tokens in real estate and other asset classes.

Travel Rule implementation. Japan has implemented the FATF Travel Rule for crypto transfers. CAESPs must transmit originator and beneficiary information for transfers above the applicable threshold. The JVCEA has issued technical standards for Travel Rule compliance, and the FSA has conducted supervisory reviews to assess implementation quality.

FSA supervisory posture. The FSA has increased the frequency and depth of on-site inspections of registered CAESPs. Operators have received business improvement orders for deficiencies in AML systems, cold storage compliance, and governance. The FSA';s published inspection findings provide a useful guide to current supervisory priorities.

International alignment. Japan has engaged actively with international standard-setting bodies, including FATF and the International Organization of Securities Commissions (IOSCO). Recent FSA guidance reflects IOSCO';s recommendations on crypto asset markets, particularly on conflicts of interest, custody, and market integrity. Japan has also monitored the development of the EU';s Markets in Crypto-Assets Regulation (MiCA) as a reference point, though Japan';s own framework predates MiCA and differs in structure.

A non-obvious requirement is that operators must notify the FSA before adding new crypto assets to their platform. The JVCEA maintains a list of assets that have passed its review process. Listing an asset not on the approved list requires a separate review, which can take several months.

Scenario one: a foreign crypto exchange seeking Japanese retail customers. A European exchange with an existing user base wishes to onboard Japanese retail customers. It cannot rely on its home-country licence. It must establish a Japanese subsidiary, apply for CASP registration, build a local compliance function, and implement Japanese AML, custody, and advertising requirements. The timeline from incorporation to registration approval is typically well over a year. The operator should plan for substantial pre-revenue costs during the registration period.

Scenario two: a stablecoin issuer seeking distribution in Japan. A US-based stablecoin issuer wants its token available on Japanese exchanges. Under the current stablecoin framework, the issuer must either obtain a Japanese licence (available only to banks, trust companies, and registered money transfer operators) or partner with a licensed Japanese intermediary who will handle distribution. The intermediary model is the more common path for foreign issuers. The intermediary takes on regulatory responsibility for the token';s distribution and must conduct its own due diligence on the issuer.

Scenario three: a DeFi protocol with Japanese users. A DeFi protocol with no Japanese legal presence but with Japanese users faces a grey area. The FSA has not issued comprehensive guidance on decentralised protocols, but it has indicated that the economic substance of an activity - not its technical structure - determines whether registration is required. Operators of protocols that function as exchanges or custody providers for Japanese users should seek legal advice before assuming they fall outside the PSA';s scope.

The FSA has broad enforcement powers. It can issue business improvement orders, suspend operations, revoke registrations, and refer cases for criminal prosecution. Operating without registration carries criminal penalties including imprisonment and fines. The FSA has used these powers against both registered operators and unregistered entities.

Business improvement orders are the most common enforcement tool. They require the recipient to identify the root cause of a deficiency, implement corrective measures, and report back to the FSA within a specified period. Repeated or serious deficiencies can lead to business suspension orders, which prohibit the operator from accepting new customers or executing certain transaction types.

The FSA publishes summaries of enforcement actions and inspection findings. These publications are a practical resource for compliance teams seeking to understand current supervisory expectations. A common mistake is treating FSA guidance as aspirational rather than as a statement of minimum requirements.

Registration revocation is reserved for the most serious cases - persistent non-compliance, fraud, or insolvency. Revoked operators must wind down their customer positions in an orderly manner under FSA supervision.

For international operators, the reputational dimension of FSA enforcement is significant. A business improvement order issued to a Japanese subsidiary can affect the parent group';s regulatory standing in other jurisdictions.

To discuss your compliance obligations or a potential market entry strategy, contact info@vlolawfirm.com. We can assist with documents and filings.

What is the biggest practical risk for a foreign operator entering Japan without proper registration?

Operating a crypto asset exchange service in Japan without CASP registration is a criminal offence under the PSA. Penalties include fines and imprisonment for responsible individuals, not only the corporate entity. Beyond criminal liability, an unregistered operator cannot legally hold customer assets or execute trades, meaning any business built without registration is structurally unlawful. The FSA actively monitors for unregistered activity and has taken action against foreign operators serving Japanese users without a licence. Foreign founders sometimes assume that operating from overseas insulates them from Japanese law - this assumption is incorrect where Japanese residents are being actively solicited or served.

How long does CASP registration take, and what does it cost?

The FSA does not publish a fixed processing timeline. In practice, applications for straightforward business models with well-prepared documentation have been processed in several months, while complex applications or those with documentation deficiencies have taken considerably longer - sometimes exceeding a year. Costs include legal fees for preparing the application, consulting fees for compliance system design, incorporation costs for the Japanese entity, and ongoing staffing costs during the waiting period. Professional fees for a well-prepared application typically start from the low tens of thousands of EUR equivalent, and can be substantially higher for complex operations. Applicants should also budget for the cost of building the compliance infrastructure the FSA will scrutinise.

Does Japan';s framework apply to DeFi protocols and NFT platforms?

Japan has not issued comprehensive rules specifically for decentralised finance protocols or non-fungible tokens (NFTs), but the FSA has made clear that it assesses regulatory applicability based on economic substance. A DeFi protocol that functions as an exchange or custody provider for Japanese users may fall within the PSA';s scope regardless of its technical architecture. NFTs are generally not treated as crypto assets under the PSA if they represent unique digital items without payment or investment functions, but NFTs structured as investment products or used as payment instruments may attract regulation under the PSA or FIEA. Operators in these areas should obtain specific legal advice rather than relying on general assumptions about the applicability of the framework.

Japan';s crypto regulatory framework is mature, detailed, and actively enforced. For operators willing to invest in proper registration and compliance infrastructure, Japan offers a credible and well-regulated market. The FSA';s approach rewards operators who engage seriously with its requirements and penalises those who treat compliance as secondary. The recent reforms on stablecoins, security tokens, and the Travel Rule have added further layers of obligation, and the regulatory perimeter continues to expand.

VLO Law Firms advises international clients on crypto regulation in Japan. We can assist with CASP registration, compliance programme design, stablecoin distribution structuring, and ongoing regulatory advisory. To request a consultation, contact: info@vlolawfirm.com