Japan Crypto Exchange Cybersecurity: The FSA's 2026 Policy
Quick answer. On April 3, 2026, Japan’s FSA said cold wallets alone are not enough. It will request a cybersecurity self-assessment (CSSA) from every exchange from Program Year 2026, run TLPT on several in 2026 and plans stricter supervisory guidelines.
Video transcript
On April 3, 2026, Japan's FSA said cold wallets alone cannot ensure the safe management of crypto assets.
The FSA says recent outflows are not necessarily from stolen signing keys. It cites social engineering, outsourcee intrusion, poisoned supply chains and patient attackers.
In May 2024, DMM Bitcoin lost bitcoin then worth 308 million dollars. The FBI attributed it to North Korean hackers posing as a recruiter.
They likely manipulated a legitimate transaction request. Cold storage cannot stop that, so the policy targets everything around the key.
From Program Year 2026, the FSA will request a cybersecurity self-assessment, or CSSA, from every exchange. It will also weigh guideline revisions on cyber staffing, external validation of key management, and outsourcees.
The FSA will ask the JVCEA to strengthen its Security Committee, encourage joining JPCrypto-ISAC, and aim for every exchange in its Delta Wall exercise within three years.
In a 2026 pilot, the FSA will run threat-led penetration tests on several exchanges' actual operational environments, covering people and processes, not only technology.
External validation is not yet defined. FSA contractor research, not an official view, says multisig and hardware wallets are not enough alone, and maps what to check.
Guardian custody reviews and OpSec audits check key storage, signing thresholds and what signers actually see. Read the full article, or talk to Guardian.
Japan’s Financial Services Agency (FSA) published its Policy Approaches to Strengthen Cybersecurity for Cryptoasset Exchange Services on April 3, 2026, after public comment. An English version followed on July 23.
Its starting point is blunt: “the safe management of cryptoassets cannot be ensured only by the use of cold wallets.”
It is a supervisory policy, not a rule. Most of it says what the FSA will request, encourage or deliberate on.
This article explains the technical and security side of the FSA’s Policy Approaches to Strengthen Cybersecurity for Cryptoasset Exchange Services. It is not legal advice; confirm how it applies to you with counsel.
Why Cold Wallets Are Not Enough
The FSA says recent outflows “are not necessarily caused by the theft of signing keys.” It lists tactics that have become prominent:
- Social engineering: forged email, calls or spoofing to obtain credentials or access.
- Outsourcee intrusion: entering through a firm that operates or develops your systems.
- Supply chain: poisoned open source libraries, as in a September 2025 JavaScript case.
- Patience: attackers preparing the intrusion for a long time, unnoticed.
It also cites suspected state attackers seeking foreign currency.
One Japanese case
The policy names no incident, but DMM Bitcoin shows several of these tactics.
In May 2024, DMM Bitcoin lost 4,502.9 BTC, worth $308 million at the time. The FBI attributed the theft to TraderTraitor, a North Korean group.
Per the FBI, an attacker posing as a LinkedIn recruiter sent a pre-employment test to an employee of Ginco, a Japanese wallet software company. It contained malicious Python code.
The attackers later used session cookie information to impersonate that employee. In late May, they likely manipulated “a legitimate transaction request by a DMM employee.”
DMM Bitcoin later announced it would shut down and move accounts and assets to SBI VC Trade, The Block reported.
A cold wallet protects the key, not the request it signs. The policy targets everything around the key.
Self-Help: CSSA and Guidelines
“Self-help” is what each exchange does for itself. The FSA says management “must not consider cybersecurity measures merely as cost.”
Matching the level required of existing financial institutions is “naturally important,” it says, across people and processes as well as technology.
CSSA from Program Year 2026
From Program Year 2026 (July 2026 to June 2027), the FSA will request all crypto exchanges to complete a cybersecurity self-assessment (CSSA), or will otherwise hold dialogues with them as required.
Other financial firms already do it. The questions follow the FSA’s Guidelines on Cybersecurity for the Financial Sector, and each firm learns where it stands in the industry.
Guideline revisions
The FSA says it will endeavor to raise the cybersecurity level it expects by revising its Guidelines for Supervision. Points it will deliberate on include:
- Personnel: expertise, staffing and authority for cybersecurity staff.
- External audits: external validation of system risk management and signing key management.
- Outsourcees: cybersecurity requirements that suppliers must satisfy.
We found no published draft of the revisions as of November 5, 2026. The FSA’s Strategic Priorities of September 15, 2026 say it will develop supervisory guidelines for the amended FIEA.
Mutual and Public Assistance
JVCEA
The FSA will ask the Japan Virtual and Crypto Assets Exchange Association (JVCEA), the self-regulatory body, to strengthen its Security Committee with expert staff.
It will follow up on whether JVCEA can monitor members’ cybersecurity effectively, onsite and offsite.
JPCrypto-ISAC
The FSA will encourage exchanges to join information sharing organizations such as JPCrypto-ISAC.
It also wants collaboration to reach outsourcees, affiliates and foreign organizations.
Delta Wall
Delta Wall is the FSA’s annual industry-wide cybersecurity exercise. A scenario for crypto exchanges was added in Program Year 2025.
The FSA will keep requesting regular participation, “aiming to achieve the participation of all service providers within three years.”
To prepare, see our crypto exchange incident response plan.
The 2026 TLPT pilot
Threat-led penetration testing (TLPT), also called red team testing, analyzes your specific risks first, then simulates real attackers’ tactics.
In a demonstration project within 2026, the FSA will run TLPT on several exchanges’ actual operational environments. Each gets its results; the industry gets the common issues.
The FSA wants exchanges to find weak points “including human resources and processes,” not only technology.
What the Amended FIEA Adds
The policy sits beside new law. An Act amending the Financial Instruments and Exchange Act (FIEA) and the Payment Services Act was enacted on July 15, 2026.
It moves crypto exchange regulation into the FIEA, effective within one year of promulgation. The FSA’s explanatory material lists these changes:
- existing safety rules, mainly cold wallet custody, carried into the FIEA;
- a duty to guide and quality-control outsourcees;
- prior notification and a system safety duty for providers of important crypto-asset management systems;
- a liability reserve to compensate customers after an unauthorized outflow.
The FSA plans to set the reserve rate by Cabinet Office Order, based on assets held and taking security levels into account.
What a Key Management Review Covers
The FSA has not yet defined “external validation” of signing key management. The policy says its guideline revisions will draw on its Program Year 2025 research.
That research is out: a June 30, 2026 paper by Deloitte Tohmatsu, the FSA’s contractor. The paper says its contents do not represent the FSA’s official views.
Its message: multisig and hardware wallets are not enough on their own.
| Area | What the paper suggests checking |
|---|---|
| Pre-signing checks | Decoded data, simulation, clear signing, independent verification |
| Approval rules | Extra approvals for size, new addresses, unknown contracts |
| Damage limits | Per-address and withdrawal limits, delays, automatic suspension |
| Signing terminals | Dedicated devices, EDR, no external file execution |
| Build and KMS | No direct path from CI/CD or developer machines to signing |
| Suppliers | Audit rights, just-in-time access, short-lived credentials |
| Assurance gaps | What a prior audit or certification did not cover |
The paper warns that the mere fact an assessment was done “should not be treated as evidence of security.” Ask what it left out.
Checklist for Japanese Exchanges
- Name the cybersecurity lead, the team’s size and its authority to halt withdrawals.
- Prepare CSSA answers you can back with configurations and logs.
- Map every supplier that touches wallets or signing, and add audit rights.
- Show signers decoded transactions, verified outside the system that built them.
- Cap per-wallet balances and withdrawals, and test automatic suspension.
- Cut CI/CD, developer and supplier access off from signing and KMS.
- Train staff, and supplier staff, against fake recruiters and coding tests.
- Join JPCrypto-ISAC and plan for Delta Wall.
- Get signing and withdrawal flows independently reviewed and threat-led tested.
Our insider threat program template covers vendor staff access and vetting.
How Guardian Helps
Guardian’s regulatory and compliance assessments list each provision with the control that meets it, the evidence and any gap. Custody reviews cover key storage, signing thresholds and recovery.
A Guardian OpSec audit maps every path to your funds and reviews what a signer actually sees before approving.
Guardian pentests cover infrastructure, APIs and offchain automation such as threshold signers, each closed out with a retest. See how Guardian tests exchanges.
For Korea’s response to its own incident, see its real-time reconciliation rule.
Frequently Asked Questions
Is the FSA policy binding on crypto exchanges?
It is a policy document, not rule text. The FSA says it presents “a direction” and expects exchanges to act on it autonomously. Revised Guidelines for Supervision are still to come; we found no draft as of November 5, 2026.
What is CSSA?
A cybersecurity self-assessment built on the FSA’s Guidelines on Cybersecurity for the Financial Sector. It shows each firm where it stands in the industry. The FSA will request it from all crypto exchanges from Program Year 2026.
Which exchanges will get TLPT in 2026?
The policy says several service providers and does not name them. The FSA will test their actual operational environments within 2026, give each its own results and share common issues with the industry.
Does the amended FIEA replace the cold wallet rule?
No. Per the FSA’s explanatory material, the existing safety rules, mainly cold wallet custody, carry over into the FIEA. New duties cover outsourcees, providers of important crypto-asset management systems and a reserve for compensating customers.
Sources
- FSA: Policy Approaches to Strengthen Cybersecurity for Cryptoasset Exchange Services (April 3, 2026; English version July 23, 2026)
- FSA: Public comment results on the draft Policy Approaches, in Japanese (April 3, 2026)
- FSA: 2026 Program Year Financial Administration Policy (Strategic Priorities), in Japanese (September 15, 2026)
- FSA: Strategic Priorities, July 2026 to June 2027, Executive Summary (September 15, 2026)
- FSA: Bills submitted to the 221st Diet session, in Japanese (2026)
- FSA: Explanatory material, bill amending the FIEA and Payment Services Act, in Japanese (2026)
- Deloitte Tohmatsu for the FSA: Cybersecurity Issues and Countermeasures in Crypto-Asset-Related Businesses (June 30, 2026; published by the FSA July 23, 2026)
- BleepingComputer: FBI links North Korean hackers to $308 million crypto heist (December 24, 2024)
- The Record: FBI attributes largest crypto hack of 2024 to North Korea’s TraderTraitor (December 25, 2024)
- The Block: Japanese exchange DMM Bitcoin to shut down, transfer assets to SBI Group unit (December 1, 2024)
- Guardian: Crypto Exchange Incident Response Plan: The First Hour
- Guardian: Insider Threat Programs for Crypto Exchanges: A Template
Prepare for external key management reviews
Guardian reviews signing and withdrawal controls and maps the evidence to the provisions that apply to you.