Japan operates one of the most structured and consequential digital-asset licensing regimes in the world. For any business seeking to offer crypto-asset exchange services to Japanese users – whether incorporated locally or entering from abroad – the VASP registration (virtual asset service provider registration) under the FSA-administered framework is not optional. Operating without it exposes the business to regulatory enforcement, abrupt banking severance and exclusion from the JVCEA's self-regulatory infrastructure that governs day-to-day conduct across the market. The sections below set out the regulatory basis, the application process, the cross-border interactions a foreign operator must resolve, and the decision point at which external counsel adds the most value.
The Japan Crypto Licensing Regime: What the FSA and JVCEA Actually Require
Japan's crypto-asset exchange service registration is a mandatory authorisation governed by the Financial Services Agency (FSA), with ongoing conduct supervised in part by the Japan Virtual and Crypto assets Exchange Association (JVCEA), the FSA-designated self-regulatory organisation. Any business that operates a crypto-asset exchange service – including spot trading, custody of client assets, or the management of a trading platform – must register with the FSA before commencing activities directed at Japanese users. The JVCEA membership and its rulebook compliance form a parallel layer: registration alone does not discharge self-regulatory obligations, and in practice the two tracks run concurrently through the application period.
The regime sits within Japan's revised Payment Services Act and the Financial Instruments and Exchange Act. Rather than citing specific provisions, what matters operationally is the activity-based trigger: if the service constitutes a "crypto-asset exchange service" under the applicable Japanese definition, registration is required regardless of where the operator is incorporated. This has direct consequences for foreign platforms that accept Japanese accounts without a local entity – a posture that regulators have moved against repeatedly.
The JVCEA maintains two membership categories – a first-class membership for fully registered exchanges and an associate tier for businesses in the application pipeline. Token listing decisions, margin ratios, advertising standards and system-audit requirements are all governed by JVCEA rules, which the FSA effectively endorses. An operator that satisfies the FSA's registration criteria but ignores the JVCEA's rulebook is unlikely to sustain the registration in practice.
Who Needs to Register – and When the Obligation Arises
The registration obligation attaches to the activity, not the entity's address. A non-Japanese company that actively solicits Japanese customers, provides a Japanese-language interface, or settles yen-denominated transactions is operating a crypto-asset exchange service in Japan and must register accordingly. The FSA has made this jurisdictional reach explicit, and enforcement actions against unregistered foreign platforms are a matter of record.
Businesses that fall inside the registration perimeter include spot exchanges, custody providers holding crypto assets on behalf of Japanese clients, and operators of margin or derivative products backed by crypto assets. That last category intersects with the Financial Instruments and Exchange Act, which imposes a separate and more demanding authorisation track – a distinction that catches foreign operators unfamiliar with the split between the two regimes.
Businesses structured purely as software providers, blockchain infrastructure companies, or token issuers without a custody or trading function may fall outside the registration perimeter, but the boundary is fact-specific. In our licensing practice, we see operators regularly mischaracterise their activity and proceed without registration on the basis of an informal internal analysis. That posture creates material enforcement exposure, and the FSA's investigative capacity has grown substantially.
To map whether your activity triggers FSA registration, contact OBOLUS at info@oboluslaw.com. The threshold question is fact-dependent and turns on the precise structure of the service, the user base and the asset types involved. Getting that analysis right before committing to a local incorporation saves significant time and cost.
What Does the FSA Registration Application Involve?
The FSA registration process is document-intensive, sequenced and, for a foreign operator, typically requires a local entity and a resident responsible officer before the application can proceed. There is no single standard timeline – processing varies by the complexity of the business model, the completeness of the filing and the volume of FSA queries – but operators should plan for a process that extends over many months rather than weeks. Pre-application engagement with the FSA, known informally as "jizen soudan" (preliminary consultation), is standard practice and strongly advisable before submitting a formal file.
The core application requires the operator to demonstrate: a compliant AML/CFT programme aligned with FATF standards and Japan's domestic implementing rules; a comprehensive system-security and cyber-resilience framework meeting FSA expectations (post the 2018 exchange hacks, these standards are demanding); segregation of client assets from proprietary assets with appropriate custodial controls; and governance documentation establishing the fitness and propriety of officers and major shareholders.
Foreign operators face a structuring question early: whether to register a local subsidiary or to seek registration of the overseas entity directly. In practice, the FSA expects a substantial local presence – a registered office, a resident compliance officer with decision-making authority, and systems and records accessible within Japan. A thin local shell with all substantive operations offshore will not satisfy FSA expectations and is likely to generate protracted back-and-forth or outright refusal. We advise clients to build the local substance layer in parallel with the application preparation, not after.
JVCEA membership applications run on a parallel track. The JVCEA conducts its own review of token listing proposals, system audits, and advertising compliance. For a new entrant, achieving both FSA registration and first-class JVCEA membership before commercial launch requires careful sequencing of the two workstreams.
Cross-Border Reality: Tax, Banking and the Interaction with Your Home Jurisdiction
Japan's crypto licensing environment does not exist in isolation. For a foreign operator establishing a Japanese subsidiary to hold the registration, the cross-border legal stack introduces complexity that a single-jurisdiction adviser cannot fully resolve.
On the tax side, a Japanese subsidiary will be subject to Japanese corporate tax on profits arising in Japan, and the transfer pricing relationship between the local entity and the offshore parent will attract scrutiny if the local entity is positioned as a low-function cost centre. Japan's National Tax Agency has developed its analytical capacity on digital-asset transactions, and crypto-specific tax guidance addresses the treatment of exchange gains, custody income and token inventory on the balance sheet. The structuring decision – how much operational and economic substance sits in the Japanese entity relative to the group – has direct tax consequences that should be modelled before incorporation rather than remediated later.
Banking is the other pressure point. Japanese banks are cautious counterparties for crypto exchanges. Opening a corporate account for a newly registered exchange requires a credible compliance programme, a clear AML narrative and, in most cases, a track record or a relationship introduction. Operators from jurisdictions outside the FATF grey-list carry a structural advantage. Those from higher-risk originating jurisdictions should anticipate extended due diligence and may need to demonstrate that the Japanese entity has genuine operational independence from a parent in a lower-regarded location.
The Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer) applies in Japan under JVCEA implementing rules consistent with FATF Recommendation 15. Compliance with the Travel Rule requires an approved solution that can exchange the required data with counterpart VASPs – a technical and legal build that foreign operators sometimes underestimate. Selecting and integrating a compliant Travel Rule solution is a condition of operational readiness, not a post-registration task.
AML Standards, Token Listing and Ongoing Conduct Requirements
Japan's AML/CFT framework for crypto-asset exchange services is among the most developed in the Asia-Pacific region. The FSA's expectations are calibrated to the FATF mutual evaluation findings for Japan, which have driven successive tightening of the practical standards applied during registration review and ongoing supervision.
Customer due diligence, transaction monitoring, suspicious transaction reporting and record-keeping obligations apply to all registered operators. The FSA and JVCEA both conduct periodic on-site inspections and document reviews. In our cross-border practice, we consistently see foreign operators underestimate the ongoing compliance burden relative to lighter-touch offshore regimes. Japan is not a jurisdiction where registration opens the door and self-regulatory compliance is aspirational – it is a regime where the inspection cycle is real and deficiencies generate formal remediation orders.
Token listing is a distinctive feature of Japan's regime. Exchanges wishing to list a new crypto asset must complete a JVCEA screening process that assesses the token's technical characteristics, issuer disclosures, legal classification and market risk. The process is substantive, not administrative. Operators building a Japan strategy around a wide listing catalogue should factor token screening timelines into their commercial planning. Certain token categories – including those with privacy-enhancing features – face heightened scrutiny or effective restriction under current JVCEA policy.
In Practice: How a Cross-Border Application Unfolds
In a recent licensing matter, a Southeast Asian crypto exchange sought FSA registration to formalise its position in Japan, where it had been operating under an informal transition period. The client had an existing compliance programme designed for its home jurisdiction – a well-regarded APAC regime – but that programme did not map cleanly onto FSA expectations, particularly on system-security documentation and the organisational separation of compliance and operations. We worked through a gap analysis against the FSA's published standards, restructured the governance documentation, and assisted with the preliminary consultation with the FSA before formal filing. The parallel JVCEA associate membership application was initiated once the FSA preliminary engagement had produced a stable documentation baseline. The client avoided a refusal and the associated reputational consequence of a public rejection on the FSA's registry.
Which Operator Profile Should Pursue Japan Registration
Japan registration is appropriate for a specific set of operator profiles. It is not the right first step for every crypto business with ambitions in Asia.
A large or mid-size spot exchange with an established Japanese user base has no realistic choice: the registration obligation already applies, and delay increases enforcement risk materially. For this profile, the question is not whether to register but how to sequence the local-entity build, the FSA application and the JVCEA membership. Speed and completeness of documentation are the variables that determine outcome.
A custody provider or wallet service seeking to serve Japanese institutional clients faces a similar analysis. If the activity meets the definition of a crypto-asset exchange service as it applies to custody, registration is required. The capital and system-security requirements may be calibrated differently from a full trading venue, but the compliance infrastructure expectations are comparable.
A token issuer with no exchange or custody function directed at Japanese clients sits in a different position. The issuance alone does not ordinarily trigger FSA registration, but secondary market activity, any intermediary role in transfers, or the positioning of the issuer as a service provider to Japanese users may change the analysis. This is the profile most likely to have received incorrect informal advice – and the one where early legal review produces the clearest value.
An offshore fund with passive exposure to Japanese-listed crypto assets through regulated venues generally does not trigger registration in Japan on that basis alone, though Japanese securities law and fund marketing rules apply to distribution activities directed at Japanese investors.
If the right path for your business is unclear, OBOLUS maps the licence stack before you commit. Write to info@oboluslaw.com or message us at t.me/oboluslaw. We have seen operators commit to a Japanese subsidiary structure only to discover that the intended activity falls under a different licence category – a mismatch that costs months and material legal and incorporation expense to unwind.
What Goes Wrong: Common Mistakes in Japan VASP Applications
Several patterns recur across failed or stalled FSA applications. Understanding them in advance is the most direct way to improve an application's odds.
The first is insufficient local substance. Operators that file with a nominee director, a registered-office address and no genuine operations in Japan generate immediate FSA concern. The agency expects a compliance function that can be questioned on-site, systems that are documented and accessible, and a responsible officer who can answer substantive questions about the business.
The second is a system-security gap. Post-2018, the FSA's technical expectations for exchange security are detailed and demanding. Applications that present generic cybersecurity policies rather than exchange-specific architecture documentation, penetration test results and incident-response procedures are routinely returned for supplementation.
The third is a misunderstanding of the JVCEA's role. Some applicants treat JVCEA membership as an administrative add-on. In practice, the JVCEA's own review – particularly of token listings and marketing materials – is a substantive gatekeeping function. Delays in the JVCEA track hold up commercial launch just as surely as FSA delays do.
The fourth is an AML programme designed for a different regime. A programme built for, say, a MiCA CASP or a Singapore MAS licence will not automatically satisfy Japan's requirements. The documentation format, the governance structure, and the specific obligations around suspicious transaction reporting and customer identification differ in ways that require explicit localisation.
A Common Assumption Worth Correcting
A common assumption among businesses entering Japan from offshore is that an existing licence in a well-regarded jurisdiction – a MiCA CASP authorisation, a Singapore DPT licence, or a Dubai VARA licence – reduces or displaces the Japan registration requirement. It does not. Japan does not extend mutual recognition to foreign crypto licences. The FSA registers against Japanese legal standards, and an operator holding a licence elsewhere is subject to exactly the same application process as one that has never been regulated. The foreign licence may support a credibility narrative in parts of the application, but it provides no procedural shortcut.
This is consistent with the broader reality of digital-asset licensing: the assumption that one licence passport to global operation is one of the most consistently incorrect beliefs we encounter in practice. Every major jurisdiction with a real exchange market has its own registration requirement. Japan's is among the most developed, and the consequences of operating without it are among the most certain.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full practice overview across 70+ jurisdictions, from application to ongoing compliance.
- Economic Substance for Licensed VASPs – structuring genuine operational presence to satisfy regulatory and tax expectations.
- Smart Contract Dispute Resolution: Where the Legal Lines Are Drawn – how disputes arising from on-chain activity are resolved across leading forums.
FAQ
How long does a crypto licence take to obtain?
In Japan, the FSA registration process is typically measured in many months rather than weeks. The duration depends on the complexity of the business model, the completeness of the application at filing, and the number of FSA information requests during review. Operators that complete pre-application consultation and submit a well-documented file tend to move through the process faster. Across other major jurisdictions, timelines vary from a matter of weeks in lighter-touch regimes to a year or more in demanding markets like Hong Kong and Japan.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your users and counterparties are, where you can open and maintain banking, the asset types and services you offer, and the tax treatment of the operating entity. Japan is the right answer if your user base is Japanese or if you need access to JPY settlement rails. For global or multi-region operations, a licence-stack approach – combining a primary authorisation with activity-specific registrations in target markets – is typically more appropriate than a single-jurisdiction solution.
Do I need a separate custody licence?
In Japan, custody of client crypto assets is generally encompassed within the crypto-asset exchange service registration rather than requiring a standalone custody authorisation. However, the technical and governance requirements for client-asset segregation and safeguarding within that registration are substantive. If the custody function is carved out to a separate legal entity within a group structure, that entity may require its own registration. In other jurisdictions – including Singapore under the Payment Services Act and certain EU member states under MiCA – custody is a separately defined regulated activity. The answer is always fact-specific.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions – including Japan's FSA/JVCEA regime – on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before clients commit to a structure. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in Asia-Pacific regulatory authorisations and the cross-border structuring of inbound exchange and custody operations.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.