How Japan Regulates Crypto: The Old Rules Still Run

• Japan enacted its FIEA reform on 15 July 2026, but the crypto provisions have not commenced, so the Payment Services Act framework from 2017 is still the live rulebook, with the securities-law regime expected to bite around 2027.
• Custody is the strictest part of the current regime and survives the shift: at least 95% of customer crypto in cold storage, the hot wallet capped at 5% with a matching same-type, same-volume reserve, trust-segregated fiat, and an annual external audit.
• Japan splits digital assets three ways, with Bitcoin as a cryptoasset, fiat-backed stablecoins as electronic payment instruments, and security tokens carved out into the FIEA, and the classification decides the entire licensing stack.
• Individual crypto gains are miscellaneous income taxed up to roughly 55% today, and the promised flat 20% regime is real but contingent on the FIEA transition, projected for around January 2028.
• The reform was driven by enforcement. FTX Japan, CoinBest and DMM Bitcoin each map onto a specific piece of the 2026 law.

Japan spent the first half of 2026 running two crypto regulatory regimes at the same time, which is not a drafting accident but the shape of a deliberate handover. On 15 July the Diet enacted the amendment that lifts cryptoasset trading out of the Payment Services Act and moves it under the Financial Instruments and Exchange Act, the statute that governs listed shares and derivatives. That vote took the headlines. The part that gets lost is that the enactment switched nothing on for day-to-day operators, because the crypto provisions do not commence on signing and the FSA still has to write the secondary rules, with most readings of the text putting the effective date at some point in 2027. So the rulebook that binds an exchange in Tokyo today is the same PSA framework that has governed Bitcoin venues since the 2017 registration system, now sitting under a law that has been formally told it is being replaced.

For anyone operating in or around the market, the transition is the whole story, because it means running compliance against a payments-law regime while building for a securities-law one that arrives with heavier disclosure, market-conduct and enforcement machinery. The two frameworks do not contradict each other so much as disagree about what a crypto business is. Under the PSA, an exchange is a money-handling utility whose main job is to guard customer assets. Under the FIEA, it becomes something closer to a broker-dealer inside a capital market, with issuers, disclosure duties and insider-trading controls bolted on. Firms that treat the July vote as a distant event and keep optimising only for the PSA will find themselves rebuilding governance under time pressure once commencement lands.

The future of finance is here. Trade crypto and more

The custody regime is the load-bearing wall

The custody rules reward close reading, because they go further than most jurisdictions and they survive the FIEA shift largely intact. Any firm providing cryptoasset exchange services has to register with the FSA, and the perimeter is drawn wide enough to catch custody-only businesses, so holding other people’s coins for them sits inside the licensed zone rather than off to the side as a lightly supervised add-on. A registrant has to be a Japanese stock company, or a foreign company with a Japanese office and a locally domiciled representative, carry at least JPY 10 million in stated capital, and keep net assets that are non-negative and, for custody businesses, at least equal to the yen value of the reserve coins the firm is required to hold. The gatekeeping is both prudential and about governance, because registration can be refused for a weak financial base, unsound compliance systems, disqualifying histories, or failure to join the recognised self-regulatory body or build equivalent internal rules.

The PSA effectively wires the JVCEA into the licensing test, so membership or an equivalent internal ruleset is part of getting and keeping a registration, which turns Japan’s self-regulatory organisation into a structural piece of the regime rather than a voluntary trade group. Its rules on order management, prevention of unfair trading, solicitation and advertising, and customer-property handling carry real weight because the statute leans on them.

The mechanics of holding customer crypto are where Japan gets genuinely prescriptive. Customer fiat has to be segregated and placed in trust with a trust company, customer coins have to be segregated and identifiable per user in the firm’s own books, and the default management method is offline. At least 95% of customer crypto has to sit in cold storage or an equivalent air-gapped control where the transfer keys live on a device permanently disconnected from the internet, and only the minimum needed to run the business smoothly can live in a hot wallet, capped at 5% of customer holdings by yen value. For that 5% slice, the firm has to hold its own coins of the same type and same volume as a redemption-guarantee reserve, manage them with the same offline discipline, and back them with matching net assets. So the riskier the custody posture, the more capital the model demands, and the segregation gets audited by an outside accountant every year.

Japan built the strictest custody rules in the market because it absorbed the two largest exchange failures in the industry’s history, Mt Gox in 2014 and Coincheck in 2018, and wrote the lessons into subordinate legislation. The daily calculation of required segregation amounts, the balance certificates from trust companies, the printouts evidencing reserve-coin balances, all of it reads as operationally heavy because it is meant to. Custody in Japan is a question of statutory segregation, audited reserves and net-asset sufficiency, and treating it as a cybersecurity checkbox is how firms end up on the wrong side of an FSA order. On the derivatives side the discipline shows up differently, with retail crypto margin trading held to a 50% collateral floor under the FIEA-linked rules that already applied to leveraged products before this year’s reform.

AML, the travel rule and sanctions are localised

The financial-crime perimeter is equally mature and equally Japan-specific, which is the trap for firms that lift a global compliance template and assume it clears. Crypto exchanges are specified business operators under the Act on Prevention of Transfer of Criminal Proceeds, so customer due diligence, transaction monitoring, recordkeeping and suspicious-transaction reporting all apply, and the FSA supervises against AML/CFT guidelines it keeps revising, most recently at the end of March 2026. Japan’s travel rule has been law since June 2023, built on a JVCEA self-regulatory rule from 2022 and an APTCP amendment, and it works the way the FATF standard intends, with the originating exchange notifying the receiving one of identifying information on both the sender and the beneficiary at the time of transfer.

The catch is the jurisdiction list, because the rule bites differently depending on where the counterparty VASP sits, and the FSA keeps widening the covered set, expanding it in 2025 and again in 2026. A platform with global routing logic has to treat the Japan origin and destination rules as a moving target and fold jurisdiction-list changes into a recurring compliance workstream, because a one-time build goes stale the moment the FSA publishes the next notice. Sanctions then sit on top of AML through the Foreign Exchange and Foreign Trade Act, which was amended to pull crypto transactions into Japan’s capital-transaction and asset-freeze controls and to put confirmation duties on exchange providers. For an internationally active firm, that means screening against Japanese measures specifically, and not assuming the home-state sanctions engine already covers it.

Customer-facing conduct is tighter than the light-touch disclosure still common elsewhere. Advertising has to carry the trade name, the registration number and a statement that crypto is not legal currency, false or misleading claims about a token’s characteristics are prohibited, and firms have to explain fees, risks and contract terms up front. On top of that, exchanges owe customers ongoing statements of the money and crypto held on their behalf at intervals no longer than three months, which is a real disclosure discipline rather than a formality, and access to an authorised dispute-resolution channel is part of the framework rather than an optional courtesy. Where a firm offers credit-based or leveraged crypto transactions, it also has to put dedicated customer-protection measures around them, which is the payments-law ancestor of the conduct rules the FIEA is about to make far more demanding.

One taxonomy, three lanes

Japan does not treat every token as the same animal, and the boundary lines are cleaner than in most markets, which is what makes classification a product-design question rather than a lawyer’s afterthought. Bitcoin, Ether and utility-type tokens are cryptoassets. Anything that functions as an investment right or a security-type claim is pushed out of the cryptoasset definition and handled under the FIEA, because the PSA expressly excludes the electronically recorded transferable rights the securities law covers. That single carve-out is the statutory line between a cryptoasset and a security token, and it is one of the sharpest such lines among major jurisdictions.

Fiat-backed stablecoins occupy a third lane. Japan regulates them as electronic payment instruments, a category the 2022 PSA amendment created and the 2023 rules brought into force, with issuance limited in practice to banks, licensed funds transfer providers and trust structures. The concrete proof that the design works arrived in 2025, when JPYC secured a funds transfer licence and launched as the first regulated yen stablecoin, backed one-to-one and legally an EPI rather than a coin in the Bitcoin sense. Selling, exchanging or providing wallet services for those instruments needs its own registration as an electronic payment instruments service provider, with separate custody, conflict and travel-rule obligations attached. So a yen- or dollar-linked token cannot assume it will be regulated the way Bitcoin is, because the fiat peg can move the whole project into a different licensing stack, with bank or trust requirements on the issuance side and PSA registration on the intermediary side. An investment-style token, by contrast, can fall out of both the cryptoasset and stablecoin lanes and into the securities regime.

New Scam Prevention Course. Never make a rushed crypto decision again.

Tax is where the friendly branding breaks

Tax is where Japan’s crypto-friendly reputation runs hardest into its own rules, and the gap is wide. For individuals, gains on crypto are miscellaneous income taxed at progressive rates that top out near 55% once national income tax, the 10% inhabitant tax and the reconstruction surtax stack, which is a different universe from the flat 20% that listed shares enjoy. There is a refinement at the margins, because higher-volume activity backed by proper bookkeeping can shift into business income, but the default for retail-style trading is miscellaneous income, full stop.

That is why the FY2026 tax reform outline reads as significant. It proposes a 20% separate self-assessment regime for gains on certain registered cryptoassets, three-year loss carryforward, and transaction reporting by crypto firms, which would finally put crypto on the same footing as securities for the assets that qualify. The proposal is real, but it is keyed to the FIEA amendments commencing, and the flat rate is currently projected to take effect around January 2028 rather than now. So the honest framing is that Japan has promised retail crypto investors securities-style tax treatment and has not yet delivered it, and the promise rides on the same transition that is still mid-flight. Staking rewards, lending yield and NFTs look set to stay outside the favourable regime and keep facing the higher miscellaneous-income rates even after it lands.

Corporations get treated on business-income principles, with gains and losses recognised on the contract-date basis and actively traded crypto marked to market at year-end. The FY2024 reform narrowed that by pulling certain self-issued and transfer-restricted third-party tokens out of the mark-to-market net, which was the change that made Japan livable again for domestic token issuers and treasury-holding companies that had been taxed on paper gains they could not realise. Transfers of crypto through a domestic exchange stay outside consumption tax, and non-residents selling on Japanese venues generally do not pick up Japanese-source income or withholding on that basis. Layered on top is the OECD Crypto-Asset Reporting Framework, which Japan is implementing, so cross-border users are starting to meet self-certification and tax-residency reporting at onboarding, which ties platform KYC and tax reporting together in a way that did not exist a couple of years ago.

The reform was built by enforcement

The reason Japan is rebuilding the framework at all traces to a run of administrative enforcement rather than any court decision, and the cases are worth naming because each maps onto a piece of the 2026 law. The FTX Japan orders in November 2022 are the origin story. When the parent collapsed, the Kanto Local Finance Bureau suspended the local unit, ordered business improvements, and reached for the FIEA to force the firm to keep assets inside Japan, precisely because the PSA at the time had no equivalent tool to trap spot-crypto assets domestically. That gap fed straight into the 2025 PSA package, which added a domestic asset-retention order so the regulator would not have to borrow the securities law next time.

CoinBest followed in June 2024, when the same bureau suspended its IEO business from June to December and ordered improvements to its listing, internal-audit and anti-money-laundering controls, which is why the initial-exchange-offering channel became a focus of the later disclosure reforms. Then DMM Bitcoin lost 4,502.9 BTC, worth north of $300 million, in a single outflow in May 2024, and the September business-improvement order called out concentrated system authority and the absence of decentralised key management. The FSA pushed a self-inspection request across the sector, JVCEA ran emergency inspections and tightened its security standards, and the exchange wound down and handed its accounts to SBI. Tighter conduct rules, hardened security expectations, issuer disclosure, each strand of the 2026 reform points back at one of these three episodes.

One thing the professional reader should notice by absence is court law. There is no post-2020 Japanese judgment that redefined Bitcoin’s legal nature or redrew the licensing perimeter, and that silence is informative, because the decisive moves have come from the Diet, the FSA and subordinate rulemaking rather than from litigation. The FTX episode carried legal weight for how customer-asset protection interacts with cross-border insolvency, and criminal cases have used VASP transaction data to support confiscation and recovery of proceeds, but the load-bearing law here is administrative and statutory, and anyone waiting for a landmark ruling to clarify the space is watching the wrong branch of government.

What the FIEA shift changes

The FIEA move changes what kind of regulated entity a crypto firm is. The reform repositions cryptoassets as a financial product distinct from securities, brings crypto sale, certain offerings and lending inside the financial-instruments-business framework, imposes information-publication duties on both issuers and the firms handling tokens, and creates insider-trading-style controls for cryptoassets handled by registered firms. It also arms the FSA with stronger tools against unregistered operators soliciting Japanese users, which matters given that the PSA already prohibits solicitation by unregistered foreign exchanges and Japan runs a national registration model with no MiCA-style passport. A foreign firm wanting Japanese customers should assume it needs local authorisation, a Japanese office and a domiciled representative, rather than leaning on home-state status.

The direct target of the disclosure regime is information asymmetry, because the FSA’s 2025 discussion paper had already criticised vague white papers and mismatches between the code a project describes and the code it ships, and had flagged harder questions around staking, decentralised exchanges and MEV that the old payments framing was never built to handle. The under-discussed consequence of the shift is the ETF pathway. Bringing crypto under the FIEA gives spot Bitcoin, Ether and other crypto ETFs a legal chassis they never had under the PSA, and combined with the promised 20% tax rate, that is the part of the reform that changes the investor base rather than just the compliance manual. Stablecoins, worth repeating, stay under the PSA, so Japan is converging on a clean three-way structure, with payment-type instruments under the payments law, investment-type cryptoassets under the securities law, and tokenised securities arriving under the securities law from the other direction.

The FIEA overhaul is also not the only reform stream in flight, which is easy to miss when the securities reclassification takes all the attention. A separate 2025 PSA amendment package moved on its own track, adding the domestic asset-retention order that the FTX episode exposed as missing and carving out a more tailored intermediary business concept so that firms distributing or broking crypto without holding it fall under a fitted set of rules rather than the full exchange perimeter. Cabinet orders fleshing that package out were promulgated in 2026, which means part of the modernisation is landing under the payments law even as the centre of gravity moves toward the securities law. A firm mapping its obligations has to track both streams, because the intermediary concept and the asset-retention tool change the analysis for business models that never touched the old exchange definition cleanly.

Buy bitcoin and stocks. Signup to Coinbase today

The two-speed environment operators are stuck in

For the next stretch, firms live in a two-speed compliance environment, and pretending otherwise is how teams get caught out. The PSA controls on custody, segregation, AML and customer protection are the rules that bind operations today and will keep binding them right up to commencement. At the same time, boards and general counsel should be building for a disclosure-and-market-conduct paradigm that is heavier on the issuer side and far more enforcement-capable, because the FIEA does not treat a listing decision or a token white paper as a private commercial matter the way the payments regime largely did.

Three things are worth doing before commencement rather than after. Treat token classification as a launch gate and revisit it on every material product change, since the line between cryptoasset, stablecoin and security token can move a product into a different regime on a small design tweak. Keep a wallet-architecture file that documents exactly what sits in cold storage, what is in the 5% hot slice and why, and how the reserve coins are calculated each business day, because that is the record the FSA and the annual auditor will ask to see. And stand up a real token due-diligence process ahead of the disclosure rules, covering code review, supply mechanics, transfer restrictions, governance rights and conflicts, because the 2026 law makes that documentation a regulatory expectation rather than good hygiene.

The clean summary for anyone who has to explain Japan to a board is that it currently regulates Bitcoin and similar assets under a strict payments-law framework built around custody and AML, and it has already enacted the shift to a securities-law framework that will pile on disclosure and market-conduct obligations once it commences around 2027. Both halves of that sentence are true at once, and holding them together is the difference between a firm that clears the transition and one that treats the July vote as tomorrow’s problem.