Japan's Crypto FIEA Amendment: Security and Custody Rules

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. It keeps the cold wallet rule and adds three duties: oversee outsourcees, use only notified custody system providers, and hold a reserve to compensate customers after unauthorized outflows. It starts on a Cabinet Order date, by July 2027.

Watch: Japan's Crypto FIEA Amendment: Security and Custody Rules 1:47

Video transcript

Japan is moving crypto into the Financial Instruments and Exchange Act. Exchanges keep the cold wallet rule, but gain duties over vendors, reserves and disclosures.

The Act passed on July 15, 2026. Crypto provisions start by Cabinet Order within a year, with detailed rules still unpublished.

Exchanges become crypto asset trading businesses, regulated like Type One firms. Unregistered business will face up to ten years in prison, up from three.

Beyond cold wallets, operators must oversee outsourcees, use only notified custody system providers, and fund a hack compensation reserve whose planned rate weighs balances and security level.

DMM Bitcoin shows the risk. In May 2024 it lost 4,502.9 bitcoin. Officials said North Korean actors compromised a Japan-based wallet software company.

The FSA notes whitepapers often differ from the actual code. False disclosures carry liability, and supply, mint rights, admin keys and upgradeability are checkable onchain.

A new insider trading rule covers issuer, exchange and large trader insiders, with up to five years in prison. Listing decisions become inside information.

Before the start date, map every custody vendor and confirm each will notify. Document your cold wallets, check disclosures against deployed code, and test signing flows end to end.

Guardian's regulatory assessments map each provision to a control, its evidence and any gap. Read the full article, or talk to Guardian at guardian.security.

Japan’s Diet enacted the Act Partially Amending the Financial Instruments and Exchange Act and the Payment Services Act on July 15, 2026.

It moves crypto asset trading out of the Payment Services Act and into the Financial Instruments and Exchange Act (FIEA). Crypto becomes a financial instrument distinct from securities.

The crypto provisions start on a date set by Cabinet Order, within one year of promulgation. Most details are left to Cabinet Office Orders that have not been published.

This article explains the technical and security side of the Act Partially Amending the Financial Instruments and Exchange Act and the Payment Services Act. It is not legal advice; confirm how it applies to you with counsel.

What Passed and When

Step	Date
Bill submitted to the 221st Diet	April 10, 2026
Enacted	July 15, 2026
Promulgated	July 23, 2026
Higher penalties for unregistered FIEA business	August 12, 2026
Crypto provisions	Pending: Cabinet Order date, within one year

The promulgation date comes from Nagashima Ohno & Tsunematsu. It fits the FSA’s August 12 start for provisions due 20 days after promulgation.

We found no draft Cabinet Office Order for the crypto provisions in the FSA’s news releases as of November 6, 2026. Article numbers below follow the FSA’s outline of the bill.

From Exchange to Trading Business

Crypto asset exchange service providers are renamed crypto asset trading business operators. The FSA says they get regulation equivalent to Type I financial instruments business.

An existing Type I firm that adds crypto trading needs a change of registration. New business rules include:

a business management system to run the business properly (Article 35-3);
a ban on handling crypto assets that fail protection standards (Article 43-7);
a capital adequacy ratio (Article 46-6); and
borrowing crypto from users, brought inside the regulated business.

For Article 43-7, the FSA plans standards on liquidity, compliance and transfer record management.

Once crypto moves into the FIEA, the maximum prison term for unregistered crypto business rises from three years to ten.

Custody: Cold Wallets, Vendors and Reserves

Cold wallets carry over

The current safety rules, with assets managed in principle in cold wallets, get an equivalent in the FIEA.

The FSA defines a cold wallet as private keys kept on devices not constantly connected to the internet.

Outsourcees

An operator that outsources part of its business must guide the outsourcee and ensure the work is done properly and reliably (Article 43-13). The FSA’s material calls this guidance and quality control.

Custody system providers

This part is new. Firms that continuously provide the information systems used to manage customers’ crypto assets must file a prior notification (Chapter 3-6).

They owe a duty of care, must keep a business management system and can face supervisory orders. The FSA’s material adds a duty to keep the systems safe.

Operators may not take these services from a provider that has not notified, and must oversee the ones they use (Article 43-12).

Nagashima Ohno & Tsunematsu reads the regime as covering three activities: providing custody systems, maintaining them on commission, and performing certain custody functions on commission.

The liability reserve

Operators must build a reserve to compensate customers after an unauthorized outflow (Article 46-5).

Nagashima Ohno & Tsunematsu notes it applies to assets held in cold wallets too.

The FSA plans to set the rate by Cabinet Office Order, based on the balance of crypto held and taking security levels into account. How security level will be measured is not yet set.

The vendor lesson

DMM Bitcoin shows the risk. In May 2024 it lost 4,502.9 BTC, then worth $308 million.

US and Japanese officials said North Korean actors first compromised a Japan-based wallet software company, The Record reported.

They then likely manipulated a legitimate transaction request by a DMM employee.

The FSA’s supervisory response sits in its April 2026 policy, covered in our post on the FSA’s crypto exchange cybersecurity policy.

Disclosure: Whitepapers vs Code

The FSA’s material cites a common complaint: whitepapers are often unclear, or differ from the actual code. The Act answers with disclosure rules:

Issuers of specified crypto assets, such as IEO tokens, publish information before an offering (Article 27-39).
They then publish annual and event-driven updates (Articles 27-50 and 27-51).
Offerings without a financial audit get investor caps (Article 27-59).
For other assets, such as bitcoin, the trading operator publishes (Article 27-60).

Content includes the asset’s nature, functions, supply and underlying technology. False statements bring civil liability, surcharges and criminal penalties.

Much of that can be checked onchain. Supply, mint rights, admin keys and upgradeability are facts in deployed code.

A disclosure that misstates them becomes a legal exposure.

Insider Trading and Enforcement

The FIEA already banned fraud and market manipulation in crypto. It had no direct insider trading rule.

Articles 171-7 to 171-10 add one, modeled on listed securities. Three kinds of insider may not trade before material facts are published:

issuer insiders, on facts such as the issuer’s dissolution;
exchange insiders, on facts such as starting or stopping trading in an asset; and
insiders of large traders, with a 20% threshold planned by Cabinet Order.

Tipping and recommending trades are banned too. Penalties reach five years’ imprisonment, a 5 million yen fine, or both.

Paid promoters must disclose that they are paid (Article 171-12).

By Cabinet Office Order, the FSA also plans anti-fraud measures, such as a cooling-off period before a new account can send to an unhosted wallet.

For engineers, listing decisions become inside information. Who can see the listing pipeline, and the logs that prove it, now matter.

Readiness Checklist

Before the Cabinet Order date:

List every vendor that runs or maintains your custody and wallet systems.
Confirm each vendor will notify; plan an exit for any that will not.
Add audit rights and incident notice to those contracts.
Document the cold wallet setup: devices, key ceremonies and offline signing.
Gather evidence of your security level for the reserve rate.
Check each listed token’s disclosures against its deployed contracts.
Restrict and log access to listing decisions.
Test withdrawal and signing flows end to end, including vendor paths.

For how exchanges lose funds in the first place, see our guide to crypto exchange security.

How Guardian Helps

Guardian’s regulatory and compliance assessments list each provision with the control that meets it, the evidence and any gap.

Their custody review covers key generation and storage, signing thresholds, cold storage ratios and recovery.

A Guardian OpSec audit maps every path to your funds and reviews what a signer actually sees before approving.

Frequently Asked Questions

When does Japan's crypto FIEA amendment take effect?

On a date set by Cabinet Order, within one year of its promulgation on July 23, 2026. The detailed rules will come in Cabinet Office Orders, which we have not yet seen in draft.

Does the amendment keep Japan's cold wallet rule?

Yes. The FSA's explanatory material says the current safety rules, mainly management in cold wallets, get an equivalent in the FIEA. New duties cover outsourcees, custody system providers and a liability reserve.

What is a custody system provider under the amended FIEA?

A firm that continuously provides the information systems operators use to manage customers' crypto assets. It must file a prior notification and owes a duty of care. Operators may not use providers that have not notified.

Does Japan now ban crypto insider trading?

Yes, once the provisions take effect. Articles 171-7 to 171-10 bar issuer, exchange and large-trader insiders from trading on undisclosed material facts. Penalties reach five years' imprisonment, a 5 million yen fine, or both.

Sources

Get ready for the amended FIEA

Guardian maps the new custody, vendor and reserve duties to your controls and the evidence behind them.

Talk to Guardian Explore regulatory compliance