To get your foot in the door, you have to navigate the Payment Services Act is the primary legal framework governing crypto-asset exchange service providers (CAESPs) in Japan. Commonly known as the PSA, this law treats cryptocurrencies as legal property and payment mechanisms. If you're planning to offer spot trading for well-known tokens, the PSA is your roadmap. However, if you're dealing with security tokens or derivatives, you'll likely find yourself crossing over into the territory of the Financial Instruments and Exchange Act (FIEA), which has even steeper requirements.
Key Takeaways for Crypto Operators
- Mandatory Registration: You must register as a CAESP with the Financial Services Agency (FSA).
- Strict Corporate Structure: You generally need a Japanese stock company (kabushiki-kaisha).
- Capital Floors: A minimum capital of JPY 10 million and positive net assets are required.
- Asset Security: 95% of user funds must be kept in cold storage.
- Severe Penalties: Unlicensed operation can lead to confinement or fines up to JPY 3 million.
Who Needs to Register and How?
If you are engaging in the purchase and sale of crypto-assets as a business, you fall under Article 63-2 of the Amended PSA. This means you are officially a Crypto Asset Exchange Service Provider. For local startups, this means forming a Kabushiki-kaisha (a joint-stock company).
What about international firms? If you're a foreign exchange wanting to enter the Japanese market, you can't just run your global operation from a laptop in another timezone. You need a physical presence. While the law mentions branches, the Financial Services Agency (FSA) has a track record of only approving subsidiaries. In plain English: you'll need to set up a Japanese company, hire local representatives, and ensure your home country's regulators have already cleared you for operation.
The application process is a marathon, not a sprint. The official review takes about six months, but that's only after you've spent months preparing your documentation. You'll need to provide everything from your trade name and director lists to the exact methods you'll use to segregate user assets from your company's operating cash.
The Financial and Organizational Bar
Japan doesn't want "fly-by-night" operations. To ensure you have the skin in the game, there is a hard floor for your finances. You need at least JPY 10 million in starting capital. But it's not just about the initial deposit; you must maintain positive net assets. If your company starts bleeding money to the point of negative equity, you're in breach of your registration requirements.
Beyond the money, the FSA looks at your "plumbing"-your internal systems. They want to see that you have a professional organizational structure. This includes compliance officers who actually know the law and systems that can track every single transaction to prevent money laundering. If your internal controls look like a disorganized spreadsheet, your application will be rejected.
| Feature | Payment Services Act (PSA) | Financial Instruments & Exchange Act (FIEA) |
|---|---|---|
| Primary Focus | Standard Crypto Assets (e.g., BTC, ETH) | Security Tokens & Derivatives |
| Asset Type | Payment/Property | Investment/Securities |
| Regulatory Bar | High (Stringent) | Very High (Heavy Oversight) |
| Primary Goal | Consumer Protection & Payments | Market Integrity & Investor Protection |
The Golden Rule of Consumer Protection
If there is one thing the Japanese regulators are obsessed with, it's making sure users don't lose their money if the exchange goes bust. Following the lessons of previous global exchange collapses, Japan implemented the strictest segregation rules in the world. You cannot mix user funds with company money. Period.
The security requirements are concrete: at least 95% of customer crypto assets must be stored in offline cold wallets. This drastically reduces the risk of a massive hack wiping out user balances. The remaining 5% can be in hot wallets for liquidity, but that's the limit. If you fail to maintain this ratio, you are inviting an audit and potential sanctions from the FSA.
Marketing is also a minefield. Forget the "get rich quick" slogans or flashy promises of 100x gains. The PSA prohibits deceptive advertising. Your communications must be transparent, factual, and devoid of "fuzzy" promises. If your marketing looks like a casino ad, the regulators will shut you down.
Who Actually Runs the Show?
While the FSA is the big boss, they don't work alone. They leverage self-regulatory organizations to handle the finer details. The Japan Virtual Currency Exchange Association (JVCEA) is the main body for standard exchanges. They set the rules for which tokens can be listed and how those tokens should be handled. If you want to list a new coin, you often have to go through the JVCEA's screening process first.
For those dealing with the more complex side of tokens, there is the Japan Security Token Offering Association (JSTOA). They focus specifically on token sales and crowdsourcing. This dual-layered approach-government oversight paired with industry self-regulation-creates a predictable environment, provided you're willing to do the paperwork.
Common Pitfalls and Practical Realities
Many founders mistake the six-month application window for the total time to market. In reality, building the compliance infrastructure-the software for asset segregation, the AML/KYC pipelines, and the legal entity setup-can take a year or more. Don't underestimate the "pre-work."
Another trap is the definition of a crypto-asset. Under the PSA, assets denominated in fiat currency (like prepaid e-money cards or bank-issued stablecoins guaranteed to a specific yen value) are not considered crypto-assets. If your product falls into this category, you're looking at different banking laws, not the PSA.
Lastly, remember that registration is not a "one-and-done" event. The FSA maintains ongoing supervision. They can and will order regulatory actions if they find your internal systems are slipping. This means your compliance team needs to be a permanent part of your budget, not a temporary consulting project.
What happens if I run an exchange in Japan without PSA registration?
It is a criminal offense. Under Article 107 of the Amended PSA, you can face fines up to JPY 3 million. Additionally, as of June 1, 2025, penalties have shifted toward "confinement punishment (koukin-kei)" instead of traditional imprisonment, but the legal consequences remain severe.
Can a foreign company open a branch instead of a subsidiary?
While the law allows for branches, the FSA has historically not approved any registrations in branch form. To successfully register, foreign entities almost always need to establish a Japanese subsidiary (kabushiki-kaisha).
What is the specific requirement for cold storage in Japan?
Registered CAESPs must keep at least 95% of all user crypto assets in offline cold wallets to prevent theft and hacking. Only a small fraction can be held in hot wallets for daily operational needs.
Is JPY 10 million enough capital to start?
It is the legal minimum required for registration, but it's rarely enough in practice. Between hiring compliance experts, setting up secure infrastructure, and maintaining positive net assets during the first year of operation, you will likely need significantly more financial runway.
Does the PSA cover all types of digital tokens?
No. The PSA covers standard "Crypto Assets." If a token has investment-like features (security tokens), it falls under the Financial Instruments and Exchange Act (FIEA). Also, fiat-denominated assets like some stablecoins or e-money are excluded from the PSA's definition of crypto-assets.
Next Steps for Prospective Operators
If you're just starting, don't apply immediately. Start by mapping your token list against the JVCEA guidelines to see if your assets are even listable in Japan. Then, consult with a local legal firm to incorporate your kabushiki-kaisha. Finally, build your asset segregation system first-if you can't prove you can keep user funds separate from your own, the FSA won't even look at the rest of your application.
3 Comments
The regulatory moat here is absolutely massive. Between the PSA and FIEA, Japan has essentially built a fortress around their retail investor base. Cold storage requirements at 95% are pretty industry-leading for systemic risk mitigation, though it definitely puts a damper on the UX for high-frequency traders. The JVCEA layer adds another level of bureaucracy, but it's basically the only way to ensure liquidity doesn't just vanish overnight. It's a high-barrier entry, but the resulting legitimacy is a huge alpha for any firm that actually manages to clear the hurdle.
The emphasis on a Japanese stock company isn't just a formality, it's a way to ensure there's actual accountability on the ground. If you're a foreign founder, don't even think about trying to shortcut this with a branch office. The FSA wants skin in the game and local leadership who can be held responsible when things go south. It's about protecting the end user, and if you can't commit to that structure, you shouldn't be in the market.
Absolutely ludicrous.