PSA Registration Requirements for Crypto Exchanges in Japan

If you're thinking about running a cryptocurrency exchange in Japan, you need to know one thing upfront: PSA registration isn't just a formality. It's the only legal path forward. Without it, you're breaking the law - and the penalties are serious.

Japan doesn't treat crypto like a wild west. Since 2017, the Payment Services Act (PSA) is a Japanese law that requires all cryptocurrency exchange service providers to register with the Financial Services Agency (FSA) has forced every crypto business operating in Japan to get registered. This isn't a suggestion. It's a legal requirement. And since June 1, 2025, the punishment for skipping this step changed: instead of jail time, operators now face confinement punishment - a form of detention without imprisonment - along with fines up to JPY 3 million.

Who Needs PSA Registration?

Any company that buys or sells crypto as a business must register. That includes exchanges, OTC desks, and platforms that let users trade Bitcoin, Ethereum, or any other digital asset for fiat money or other crypto. It doesn't matter if you're based in Tokyo or Toronto - if you serve Japanese customers, you need to register with Japan's Financial Services Agency (FSA) Japan's primary financial regulator responsible for overseeing cryptocurrency exchange operations under the Payment Services Act.

Foreign companies can't just apply from overseas. You must set up a legal entity in Japan. So far, every single approved foreign crypto exchange has created a kabushiki-kaisha a Japanese stock company, the only corporate structure accepted for PSA registration by the FSA - a local subsidiary. Branches? They’ve been rejected. No exceptions. You need a registered office, a local representative, and full compliance with Japanese corporate law before you even submit your application.

The Financial Hurdles

Money talks - and in Japan, it has to be a lot of it. The FSA requires applicants to have at least JPY 10 million (about $65,000 USD) in capital. But that’s just the floor. You also need to prove you have positive net assets. This isn’t about startup dreams. It’s about stability. The FSA wants to make sure you can survive a market crash, cover operational costs, and refund users if something goes wrong.

And it’s not just about cash on hand. You need to show you can maintain that capital over time. The FSA will audit your books regularly. If your net assets drop below zero, your registration could be revoked. No second chances.

Operational Requirements

Registration isn’t just about paperwork. You need systems - real, working, auditable systems.

• Asset segregation: Every user’s crypto must be kept completely separate from your company’s assets. No commingling. Ever.
• Cold storage: At least 95% of user funds must be stored offline in cold wallets. Hot wallets? Only for small, daily trading needs - and they’re heavily monitored.
• Internal controls: You need a compliance officer, an audit team, and documented procedures for handling security breaches, customer disputes, and suspicious transactions.
• Outsourcing: If you use third parties for KYC, customer support, or infrastructure, you must prove they meet FSA standards. The FSA holds YOU responsible for their actions.

These aren’t best practices. They’re mandatory. The FSA has published detailed guidelines on how to structure these systems. Ignoring them means automatic rejection.

Documentation You Can’t Skip

The application packet is massive. You’ll need to submit:

• Company name, registered address, and business purpose
• Full list of directors and major shareholders
• Exact list of crypto assets you plan to trade (e.g., BTC, ETH, XRP - no vague descriptions)
• Step-by-step explanation of how trades are executed, settled, and recorded
• Proof of insurance or financial safeguards for asset loss
• Details of all third-party vendors and their compliance status
• Written policies for AML, KYC, and data protection

Missing one document? Your application gets returned. No feedback. No second try until you resubmit everything.

The Timeline - It’s Not Fast

Don’t expect a quick approval. The FSA’s review process takes up to six months. That’s after you’ve spent months preparing everything. Most companies spend 8-12 months total before they even hit submit.

Why so long? The FSA checks everything. They interview your team. They audit your systems. They even test your incident response plan. If you say you can freeze a wallet in under 10 minutes - they’ll simulate a hack and time you.

There’s no shortcut. No fast-track. No paying extra to jump the line. It’s a marathon, not a sprint.

What About Security Tokens?

Not all crypto is treated the same. If your platform trades tokens that act like investments - think dividends, profit-sharing, or equity-like rights - you’re no longer under the PSA. You’re under the Financial Instruments and Exchange Act (FIEA) Japan’s securities law that applies to investment-like crypto tokens and requires stricter licensing than the PSA.

FIEA licensing is harder. Higher capital. More audits. More oversight. If you’re unsure whether your token is a security, consult a Japanese legal expert. The FSA doesn’t give second chances for misclassification.

Advertising Rules - No Hype Allowed

You can’t say "Get rich quick with Bitcoin!" or "10x returns guaranteed." The FSA bans any marketing that implies guaranteed profits, uses emotional language, or hides risks.

Ads must be factual. Clear. No misleading visuals. No influencers promising moonshots. You must disclose fees, risks, and limitations in plain language. Violations lead to fines, public warnings, or suspension of trading.

Why Japan’s System Is So Strict

Japan was the first country to recognize Bitcoin as legal property. It also saw the 2018 Coincheck hack - $530 million stolen - and decided never again.

Their goal isn’t to stop innovation. It’s to protect users. By forcing exchanges to be well-funded, well-run, and transparent, Japan created one of the safest crypto markets in the world. Registered exchanges have near-zero theft rates. Customer disputes are rare. And users know their assets are safe.

This is why big players like BitFlyer, Coincheck (now under Moneytree), and Zaif operate here - they passed the test. Smaller operators? Most can’t afford the cost or complexity. That’s intentional. Japan’s system filters out fly-by-night operators. It’s not perfect, but it works.

What Happens After Registration?

Getting approved isn’t the end. It’s the beginning. The FSA conducts annual audits. They can show up unannounced. They can demand internal logs, server access, or transaction records. If you fail an audit, you get a warning - then a suspension - then revocation.

You also need to join one of Japan’s two self-regulatory bodies: the Japan Virtual Currency Exchange Association (JVCEA) a self-regulatory organization for cryptocurrency exchanges in Japan that works with the FSA to enforce PSA compliance or the Japan Security Token Offering Association (JSTOA) a self-regulatory body focused on security token offerings and compliance under the Financial Instruments and Exchange Act. Membership is mandatory. They enforce rules beyond the law - like ethics standards, dispute resolution, and training.

And yes - you pay fees. Annual fees. Membership dues. Audit costs. It’s expensive. But compared to the risk of being shut down or fined, it’s worth it.

The Bottom Line

PSA registration is the price of doing business in Japan’s crypto market. It’s not easy. It’s not cheap. But it’s the only way to operate legally - and safely.

If you’re a startup with limited funds, don’t waste time. Japan isn’t the place for bootstrapped exchanges. If you’re a well-funded company with a strong compliance team, this is your chance to build trust in one of the world’s most sophisticated crypto markets.

One last thing: don’t assume your US or EU license transfers here. Japan doesn’t recognize foreign registrations. You start from scratch. Every time.