Japan was the first major economy to create a statutory licensing regime for cryptocurrency exchanges, doing so in the wake of the 2014 Mt. Gox collapse. Today, the Financial Services Agency (FSA) and its self-regulatory partner, the Japan Virtual and Crypto-asset Exchange Association (JVCEA), run one of the most scrutinized digital-asset licensing regimes in the world. For an inbound operator, that history carries a direct legal consequence: Japan does not extend tolerance to unlicensed activity, and the FSA's enforcement posture has only sharpened since successive high-profile exchange breaches tested the regime in its early years.
Any business that solicits Japanese residents for crypto-asset exchange services (CAES) – a defined term under the applicable provisions of the Payment Services Act – must hold a domestic registration before it accepts a single yen. Operating without that registration exposes the business to criminal liability, forced cessation, and the near-certain loss of Japanese banking relationships. This page maps the regime, the process, the cross-border complications, and the strategic considerations a general counsel needs before committing to a Japanese market-entry plan.
The Regulator and the Self-Regulatory Layer
The FSA is the primary licensing authority for digital-asset businesses in Japan. It sets the substantive rules, issues and revokes registrations, and conducts supervisory inspections. But Japan's regime has a structural feature that distinguishes it from most other leading hubs: the JVCEA, a designated self-regulatory organization, sits between the FSA and the licensed firms. Membership of the JVCEA is, in practice, a condition of operating as a registered crypto-asset exchange service provider in Japan.
The JVCEA issues its own rulebooks – covering token listing standards, cybersecurity, custody segregation and AML procedures – and conducts its own inspections. Compliance with JVCEA rules is not optional for registered firms. For an inbound operator, this means the compliance burden is effectively doubled: the business must satisfy both the FSA's statutory requirements and the JVCEA's self-regulatory standards. We see this two-layer architecture create the most friction for applicants who enter the process treating it as a single-authority registration.
Who Needs a Japanese Crypto Licence?
The Payment Services Act triggers registration requirements for any person who carries on a crypto-asset exchange service as a business in Japan, which includes: buying and selling crypto assets for one's own account against customers, exchanging crypto assets for fiat or other crypto assets, managing crypto assets on behalf of customers, and acting as an intermediary for any of those activities. The geographic test is extraterritorial in application – it reaches foreign businesses that solicit or serve Japanese residents, not just those with a domestic entity.
Token issuers must separately assess whether their instrument constitutes a security or a collective investment scheme under the Financial Instruments and Exchange Act (FIEA). Where that threshold is crossed, the issuer enters a materially different – and more demanding – regulatory track. The FSA has consistently applied a substance-over-label approach to token classification; the marketing description of the token carries no weight in the analysis.
Custodians that hold crypto assets on behalf of third parties without conducting exchange activity may engage a distinct regulatory analysis, but in practice most custody propositions are bundled with exchange-adjacent services and fall squarely within the CAES perimeter. We advise clients to map every activity layer before assuming that a custody-only model avoids the registration obligation.
The Registration Process: What Applicants Face
Obtaining a crypto-asset exchange service registration in Japan is a multi-stage process that demands substantial organizational and documentary preparation before the FSA file is even opened. The FSA's pre-consultation system means that an applicant is expected to engage informally with the regulator before submitting a formal application – a step that has no fixed timetable and that can extend the overall process considerably.
At the core of the application is a detailed operational review: governance structure, officer and major-shareholder fitness and propriety, system security (the FSA runs detailed technical audits of exchange infrastructure), AML/KYC program, internal audit function, and a token listing framework aligned with JVCEA standards. The FSA's cybersecurity expectations are among the most granular in the world, a direct legacy of the Coincheck and Bitpoint incidents that led to regulatory tightening in successive amendments to the regime.
Capital requirements are set by the applicable provisions of the Payment Services Act and vary by the scope of activity. Specific figures are subject to verification against current FSA guidance, but the regime imposes both a minimum net-asset threshold and requirements around the segregation and management of customer crypto assets and fiat. Cold-wallet storage requirements – another JVCEA-driven standard – add an operational layer that exchanges with primarily hot-wallet architectures must address structurally before applying.
The overall timeline from serious preparation to registration grant is typically measured in multiple quarters rather than weeks. Pre-consultation, document preparation, formal submission, FSA review and JVCEA membership processing each consume calendar time that applicants consistently underestimate. In our experience, businesses that arrive at this process without Japan-qualified counsel and a completed compliance program add significant delay at every stage.
AML, the Travel Rule, and JVCEA Standards
Japan was among the first jurisdictions to implement the Travel Rule – the FATF obligation requiring originator and beneficiary information to accompany crypto-asset transfers – and the JVCEA operates the technical infrastructure through which member firms exchange Travel Rule data. Compliance with the Travel Rule under the JVCEA's technical standards is a condition of membership and, therefore, of maintaining registration.
The AML/CFT obligations that apply to registered crypto-asset exchange service providers are substantive. They include customer due diligence, enhanced due diligence for higher-risk relationships, transaction monitoring, suspicious transaction reporting, and record-keeping to FSA-specified standards. The FSA has used its inspection authority aggressively in this area: business improvement orders directed at AML deficiencies have been a recurring feature of the supervisory landscape since 2018.
For a foreign business entering Japan, the AML dimension has a cross-border wrinkle. Where the Japanese entity interacts with an affiliated entity in another jurisdiction – a common structure for global exchange groups – the FSA will scrutinize the group-wide AML program, not just the domestic subsidiary's procedures. Operators we advise routinely underestimate the documentation burden around inter-affiliate flows and the evidentiary standard the FSA applies to group compliance assessments.
Cross-Border Angle: Japan Versus the Global Licence Stack
A Japanese registration does not passport into any other jurisdiction. Japan operates a closed, territorial regime: the registration authorises activity within Japan only, and a Japanese-registered entity serving users outside Japan must comply with the applicable requirements of those other jurisdictions independently.
For exchange groups building a multi-market presence, Japan typically sits alongside – not instead of – licences in other hubs. An operator might hold a MAS licence in Singapore for Southeast Asian users, a MiCA CASP authorisation (accessed through an EU member state) for European users, and a Japanese FSA registration for domestic Japanese users. Each layer carries its own capital, compliance and operational requirements. The banking interaction is equally fragmented: Japanese banks remain cautious counterparties for crypto businesses, and access to JPY settlement rails is a material operational constraint that is distinct from the licensing analysis.
For businesses considering Japan as a primary hub rather than a market-access licence, the cost-benefit is substantial. The regime is rigorous and the compliance overhead is high. The commercial payoff is access to one of the deepest retail crypto markets in the world, a sophisticated institutional base, and a regulatory credential that carries weight with banking counterparties globally. We have seen Japan registrations used as a reputational signal in banking due diligence in jurisdictions that have no direct recognition arrangement with the FSA.
If you are building the licence, banking and compliance stack for a Japan market-entry, the analysis needs to start well before the application file. The entity structure, the group AML program, the cold-wallet architecture and the token listing framework all need to be resolved upstream of the pre-consultation phase. To map your options before you commit, contact OBOLUS at info@oboluslaw.com.
Token Listing and the JVCEA Review Process
One of the most operationally consequential features of the Japanese regime is the JVCEA's role in token listing. New tokens may not be listed on a Japanese exchange without completing the JVCEA's review process, which assesses the token for AML risk, technical characteristics and investor-protection considerations.
The review timeline for a new token listing is not fixed and can extend to several months for tokens without an established track record in other major regulated markets. This is a material commercial constraint for exchange operators whose business model depends on rapid listing of newly issued tokens. Operators entering Japan with a broad token portfolio need to plan the listing pipeline as a distinct workstream from the licensing process itself.
Tokens that have already been reviewed and approved by JVCEA for listing on one member exchange benefit from a faster path to listing on additional exchanges, but the process still requires the receiving exchange to complete its own internal assessment against JVCEA standards. There is no automatic portability of a listing decision between firms.
How Japan Compares for an Inbound Operator
Japan sits at the demanding end of the global licensing spectrum. It offers legal certainty, regulatory legitimacy and market access, but it demands organizational readiness that exceeds what most other leading hubs require at the point of initial application.
Compared to a Singapore MAS licence under the Payment Services Act, the Japanese regime imposes more prescriptive technical requirements – particularly around cold-wallet ratios and cybersecurity audits – and the JVCEA self-regulatory layer adds a compliance obligation with no direct MAS equivalent. The MAS process is itself demanding, but the FSA's inspection culture is among the most interventionist in the world.
Compared to a MiCA CASP authorisation accessed through a lighter-touch EU member state, Japan offers a more concentrated single-market payoff but without the passporting benefit that a MiCA authorisation provides across the EU/EEA. For a business whose core user base is Japanese, the single-market depth justifies the additional burden. For a business using Japan as one of several regional licences, the resource cost of maintaining FSA compliance on an ongoing basis deserves careful modelling.
Compared to offshore registration regimes in the BVI or the Cayman Islands, Japan is not substitutable. An offshore registration from either of those jurisdictions does not authorise the business to serve Japanese users and provides no protection against FSA enforcement action directed at unlicensed activity targeting Japanese residents. A common mistake we see – and that represents real enforcement risk – is an operator assuming that a BVI VASP registration or a Cayman exemption satisfies the Japanese licensing obligation. It does not.
A Practical Scenario
In a recent licensing matter, a group operating a crypto-asset exchange with significant Japanese retail traffic had been relying on a registration obtained in a well-regarded offshore jurisdiction. When the group sought to formalise its Japanese banking relationship, the correspondent bank's compliance team identified the absence of an FSA registration and placed the account under review. We advised on the restructuring of the group's entity architecture, coordinated the pre-consultation engagement with the FSA, and worked with the group to bring its cold-wallet segregation and AML program to the standard required for a formal application. The process was measured in quarters, not weeks, but the group entered the formal application phase with a materially stronger file than its initial structure would have supported.
If a prior application stalled or a banking relationship was placed under review on licensing grounds, a structural review of the entity, the compliance program and the application file can surface the root cause. Contact OBOLUS at info@oboluslaw.com for a scoped assessment.
Self-Assessment: Are You Ready to Apply?
Before engaging the FSA pre-consultation process, an applicant should be able to answer affirmatively to each of the following. A negative answer at any point identifies a workstream that needs resolution before – not during – the formal application.
- The applicant has a Japanese legal entity with a compliant corporate structure and a resident representative director acceptable to the FSA.
- The entity's capital position meets or exceeds the applicable minimum under the Payment Services Act (verified against current FSA guidance, not a third-party estimate).
- The exchange's technical infrastructure has been audited against FSA cybersecurity standards and cold-wallet segregation requirements.
- An AML/KYC program aligned with FSA and JVCEA standards is documented, tested and operational.
- A Travel Rule solution compatible with JVCEA's designated infrastructure is implemented or contractually committed.
- The token listing framework is documented and calibrated to JVCEA review standards.
- All officers and major shareholders have completed the fitness and propriety review and have no disqualifying regulatory or criminal history in any jurisdiction.
- The group-wide compliance program (if part of a larger group) has been reviewed for consistency with FSA expectations on inter-affiliate AML.
Operators we advise who complete this checklist honestly typically identify two or three items that require material work before the pre-consultation phase can begin productively.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we map and execute the full licence stack across operating, custody and payment layers.
- Digital-Asset Licensing in Bermuda – a jurisdiction-by-jurisdiction comparison for operators choosing an Atlantic holding or operating hub.
- Regulator and AML Audit Defence in South Africa – managing regulatory inspection and AML enforcement across emerging-market hubs.
FAQ
How long does a crypto licence take to obtain?
In Japan, the full process – from serious preparation through pre-consultation, formal application and FSA review to registration grant – is typically measured in multiple quarters. The FSA's pre-consultation phase alone has no fixed timetable. Other jurisdictions vary widely: some offshore regimes move faster, but they do not authorise activity in Japan or other regulated markets. Timeline depends on the applicant's organizational readiness at the point of engagement.
Which jurisdiction is best for licensing my crypto business?
There is no single correct answer. The right jurisdiction depends on where your users are, what activities you conduct, what banking access you need and what compliance overhead your business can sustain. Japan offers deep market access and regulatory credibility but demands significant organizational investment. A business serving global users typically needs a stack of licences rather than a single registration. OBOLUS maps that stack before you commit capital to a structure.
Do I need a separate custody licence?
In Japan, custody of crypto assets on behalf of third parties is assessed as part of the crypto-asset exchange service analysis. Pure custody without exchange activity may engage a distinct analysis, but most custody propositions in practice include exchange-adjacent services that trigger the registration obligation. The JVCEA's cold-wallet and segregation standards apply regardless of whether the business characterises itself as a pure custodian. Obtain qualified analysis before assuming custody sits outside the perimeter.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before clients commit – the discipline that prevents the structural mistakes that stall applications and close banking relationships. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in FSA/JVCEA registration processes and multi-hub licence stack design for exchange and custody operators entering Asia-Pacific regulated markets.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.