Custodial wallet / SaaS in Japan

The FSA (with Local Finance Bureaus) registers and supervises crypto-asset exchange service providers (PSA Art. 63-2) and EPI exchange service providers (Art. 62-3), and drafted Law No. 64 of 2026, which moves crypto-asset trading to the FIEA; that law’s crypto provisions are not yet in force.

JVCEA is the certified association under PSA Art. 87, but membership is not mandatory: an applicant may instead adopt equivalent internal rules (PSA Art. 63-5(1)(vi)). New tokens require prior notification to the JVCEA, which may object (Rule on Handling of Crypto-Assets Art. 5); it also audits and sanctions members.

The Payment Services Act (Act No. 59 of 2009) crypto regime of registration, customer verification and asset segregation took effect in April 2017; a 2019 amendment in force May 2020 made changes to handled crypto-assets subject to prior notice, added advertising rules and required user crypto to be held in cold wallets in principle.

Crypto-asset exchange service providers register under PSA Art. 63-2 with capital of at least ¥10 million and non-negative net assets (CAESP Ordinance Art. 9). Cold storage is mandatory except a 5% hot-wallet cap (Art. 27(2)). JVCEA membership is optional if equivalent internal rules are adopted (PSA Art. 63-5(1)(vi)); new tokens need prior notice to the JVCEA.

Custody of crypto-assets for others (PSA Art. 2(15)(iv)) is crypto-asset exchange business requiring Art. 63-2 registration. User money must be entrusted to a trust company (Art. 63-11(1)); user crypto must be segregated and held by the cold method, with hot-wallet holdings capped at 5% (CAESP Ordinance Art. 27), and segregation is audited by a CPA or audit firm (Art. 63-11(3)).

Crypto-asset exchange business under Payment Services Act Art. 2(15) covers buying, selling or exchanging crypto-assets, intermediating, brokering or acting as agent for these, managing user money in connection with them, and custody of crypto-assets for others; it requires registration with the Prime Minister (Art. 63-2), not a licence.

Crypto-asset exchange service providers must hold users' crypto-assets separately from their own so each user's holding is immediately identifiable (CAESP Ordinance Art. 27(1)), keep them in cold storage except a hot-wallet portion capped at 5%, and hold their own crypto of the same kind and amount against hot-wallet user crypto (PSA Art. 63-11-2).

Robust Security Measures: Strict requirements for cybersecurity, including multi-signature wallets, penetration testing, and internal audits.

Crypto-asset exchange service providers are specified business operators under the Act on Prevention of Transfer of Criminal Proceeds (Act No. 22 of 2007, Art. 2(2)(xxxii)); they must conduct customer verification (Art. 4), file suspicious transaction reports (Art. 8), and notify originator and beneficiary information to the receiving provider on customer crypto transfers to other providers (Art. 10-5).

Evidence fact jp.licensing.core-requirements-for-licensed-exchanges not found (may have been renamed).

Regulator: Financial Services Agency (FSA).

Regulator: National Tax Agency (NTA).