#
Settled statutory/self-regulatory consumer-protection baseline: custody segregation and terms-explanation duties, price-volatility risk disclosure, and JVCEA-supervised advertising/solicitation rules are all in force. FSA is preparing (not yet enacted) a mandatory exchange liability-reserve regime following the 2024 DMM Bitcoin hack, overlapping with the crypto_licensing module's parallel reserve-mandate claim.
The one incremental development this cycle is the FSA's work toward a mandatory liability-reserve regime for exchanges, prompted by the 2024 DMM Bitcoin hack, which would require exchanges to maintain reserves to compensate users for losses arising from hacks or operational failures. This proposal remains at the preparation stage and is not yet enacted; it is the same underlying initiative that surfaces in the crypto_licensing module under the FSA's planned 2026 Diet-session bill, reflecting the initiative's relevance both to exchange conduct obligations and to consumer-facing loss protection. The composed record treats these as two claims describing a shared regulatory initiative from two module perspectives rather than collapsing them into one, consistent with guidance to keep genuinely overlapping claims distinct where their categories and framing differ.
Outlook
Consumer protection is the jurisdiction's most settled module, rated green because its core statutory and self-regulatory obligations are mature, enforced, and unlikely to change materially in the near term. The item to watch is whether the liability-reserve proposal proceeds as a standalone consumer-protection-adjacent measure or is absorbed into the broader FIEA/PSA legislative package that has already reclassified crypto assets -- a resolution that would materially raise the floor of loss protection available to Japanese crypto users following a hack or operational failure.
Consumer Protection
Japan's crypto consumer-protection framework rests on two separate pillars: custody segregation under the Payment Services Act (PSA), and market-abuse protection newly extended through the Financial Instruments and Exchange Act (FIEA) amendment enacted 15 July 2026. On custody, registered Crypto-Asset Exchange Service Providers (CAESPs) must hold at least 95% of customer crypto-assets offline in air-gapped cold storage, segregated from corporate assets; up to 5% may be held in hot wallets, provided the operator maintains an equivalent corporate cold-storage reserve to back that hot-wallet balance. This custody-segregation requirement has been in force since 1 May 2020 and is unchanged this cycle.
Once the FIEA amendment commences, expected around fiscal year 2027, FIEA insider-trading prohibitions will extend to 'specified crypto-assets' for the first time under statute. This will empower the Securities and Exchange Surveillance Commission (SESC) to investigate, recommend surcharges, and make criminal referrals for crypto insider dealing, powers that previously existed only through Japan Virtual and Crypto assets Exchange Association self-regulation rather than through binding law. This is a material expansion of the statutory consumer and market-integrity protection available to crypto-asset holders and traders in Japan, though it remains enacted and not yet effective.
Outlook
The custody-segregation rule is settled, in-force law and is not expected to change. The market-abuse extension depends on FIEA commencement, expected around fiscal year 2027; until then, crypto-specific insider dealing remains addressed primarily through industry self-regulation rather than statutory enforcement power. Whether a crypto-specific custody liability cap exists in Japanese law, comparable to frameworks seen elsewhere, was not established this cycle.
3 earlier distinct update(s)
Consumer Protection
Japan's crypto consumer-protection framework is in an emerging phase, with meaningful protective measures in train but several remaining requests or proposals rather than binding law. On 6 August 2026, the FSA and National Police Agency asked the Japan Virtual and Crypto assets Exchange Association to implement eleven fraud-prevention measures, including withdrawal-timing delays and sender/holder name-matching checks. This is a request, not yet binding law, though such informal FSA/NPA requests have historically been folded into binding self-regulatory rules within approximately thirteen months, giving reasonable grounds to expect eventual formalisation.
Separately, and more structurally significant if enacted, the FSA plans to submit legislation in the 2026 ordinary Diet session mandating dedicated liability reserves for licensed crypto exchanges, sized by trading volume and incident history. This remains a proposed measure, not yet enacted, and whether it will pass in the 2026 ordinary Diet session as planned is unresolved.
The current binding baseline for consumer protection rests primarily on JVCEA self-regulatory rules recognised by the FSA, pending the prospective liability-reserve legislation.
Outlook
Watch for whether the FSA/NPA fraud-prevention requests are formalised into binding JVCEA rules, and whether the liability-reserve legislation is actually introduced and passed in the 2026 ordinary Diet session as currently planned.
Consumer Protection
Japan's crypto consumer-protection framework tightened this cycle, though with an important confidence caveat on the enforcement-scale element. A mandatory Cybersecurity Self-Assessment (CSSA) proposal for crypto-trading operators, first announced in February 2025, is scheduled for enforcement in FY2026 — a probable-confidence, enacted-but-not-yet-effective development that will require operators to formally assess and document their cybersecurity posture rather than relying on informal or voluntary practice.
Separately, six Japanese crypto-asset exchange service providers were reportedly issued FSA Business Improvement Orders amid a broader fraud-prevention supervisory escalation. This finding is held at Uncertain confidence: no FSA primary enforcement-action list was retrieved this cycle to corroborate the specific count of six exchanges, and the claim rests on secondary reporting rather than a primary regulatory source. Readers should treat the six-exchange figure as indicative of an active enforcement escalation rather than as a confirmed, precise count.
Taken together, the CSSA proposal and the reported Business Improvement Orders point in the same directional signal — rising supervisory scrutiny of operational and consumer-facing risk management at Japanese crypto exchanges — even though the two findings carry different confidence levels and different degrees of primary-source corroboration.
Outlook
The CSSA's FY2026 enforcement date is the clearer near-term marker to watch, since it rests on a firmer sourcing basis than the Business Improvement Order count. Independent confirmation from an FSA primary enforcement-action list would materially strengthen confidence in the reported six-exchange Business Improvement Order figure, which remains unconfirmed at Uncertain confidence this cycle.
Consumer Protection
No fresh consumer-protection instrument was identified this cycle, and the existing Payment Services Act custody-segregation and conduct baseline, dating to 2019/2020, is presumed to remain unchanged. The one point of note is contextual rather than regulatory: JPYC's own per-user transaction cap of JPY 1 million per day functions in practice as a de facto exposure limit for users of that particular EPI, though this is an issuer-level operational control rather than a regulator-imposed consumer-protection rule, and no independent regulatory claim supports it as a standing legal requirement this cycle.
Outlook
With no new instrument this cycle, this module should be read as stable rather than newly assessed. Given the scale of change underway in licensing, classification, and stablecoin reserve rules, a consumer-protection instrument addressing how custody and conduct obligations apply once specified crypto assets move to the FIEA track would be a logical next development to watch for.
Sources and findings (4)
- T1 · Financial Services AgencyCrypto-asset exchange service providers — explain terms to users and segregate user assets held by the providerretrieved M5bindingin force
- T1 · Financial Services AgencyJapan Virtual and Crypto assets Exchange Association (JVCEA) — 'Rules on Solicitation and Advertisement, etc. Pertaining to the Crypto-Asset Exchange Services', supervised by the FSAretrieved M4bindingin force
- T1 · FinancialServices AgencyCrypto-asset exchange service providers — crypto-asset prices are not necessarily stable, under advertising/solicitation regulationsretrieved M4bindingin force
- T4 · The BlockFinancial Services Agency (FSA) — liability reserves to compensate users for losses from hacks or operational failures, following the 2024 DMM Bitcoin hackretrieved M3non-bindingproposednew