PSA Registration Requirements for Crypto in Japan: A Practical Guide

You want to launch a crypto exchange in Japan? Good luck. It’s not just about having a cool app or a strong community. It’s about navigating one of the world’s toughest regulatory mazes. The Payment Services Act (PSA) is the gatekeeper here. If you’re trading crypto as a business, you need to be registered as a Crypto-Asset Exchange Service Provider (CAESP). Miss this step, and you’re looking at up to three years in prison or hefty fines. Yes, actual jail time.

Japan treats crypto seriously. They were the first major economy to recognize Bitcoin as legal property back in 2017, but that freedom comes with strings attached. The Financial Services Agency (FSA) doesn’t play around. They demand strict compliance, massive capital reserves, and bulletproof security systems. This guide breaks down exactly what you need to get your PSA registration approved, why it takes so long, and how to avoid common pitfalls that sink foreign startups.

Who Needs to Register?

First things first: do you actually need a license? Under Article 63-2 of the Amended PSA, if you buy, sell, or exchange crypto-assets for other currencies or goods as a business, you’re in scope. This applies whether you’re a local player or a foreign entity eyeing the Japanese market.

The definition of "crypto-asset" here is specific. It covers digital payment mechanisms not denominated in fiat money. But watch out-prepaid e-money cards or bank-issued coins guaranteed against yen are excluded. Those fall under different rules. If your token has investment-like features, like dividends or profit-sharing, you might fall under the Financial Instruments and Exchange Act (FIEA) instead. That’s a whole different beast with even higher barriers. For standard spot trading of well-known tokens, the PSA route is your path.

Operating without registration isn’t just a slap on the wrist. It’s a criminal offense. Before June 2025, penalties included imprisonment. Now, while the Penal Code amendments replace imprisonment with "confinement punishment," the financial hit remains severe. We’re talking fines up to JPY 3 million. Plus, reputational damage in a market that values trust above all else can kill your business faster than any fine.

Corporate Structure and Capital Demands

You can’t just register as an individual or a loose partnership. The FSA requires a solid corporate backbone. You must be a stock company (kabushiki-kaisha) or a foreign entity with a established office and representative in Japan. Here’s the kicker for foreign firms: while the law technically allows branch registrations, in practice, no foreign CAESP has ever been approved as a branch. Every single successful applicant has set up a subsidiary in Japan. Plan for that extra layer of administrative overhead.

Money matters. Literally. You need a minimum capital of JPY 10 million (roughly USD 67,000 depending on exchange rates). But that’s just the entry fee. Your net assets must remain positive throughout operations. Why? Because the FSA wants to ensure you have enough skin in the game to survive market crashes without running off with user funds. This requirement filters out hobbyists and keeps the market stable for retail investors who remember the Mt. Gox collapse vividly.

The Application Gauntlet: Documentation and Systems

Think of the application process as writing a thesis on your own business model. The FSA reviews everything. Your submission needs to cover trade name, address, capital details, director bios, and a precise list of crypto assets you intend to handle. Vague descriptions get rejected. You need to specify exactly which coins you’ll support and why.

But the real heavy lifting is in the operational systems. You must prove you have robust internal controls. How do you segregate user assets from company funds? What’s your cold storage strategy? How do you handle outsourcing if you use third-party custodians? These aren’t optional checkboxes; they’re core to your survival. The FSA looks for evidence that you won’t mix customer money with your operating cash, a lesson learned painfully from past industry failures.

Expect the review to take up to six months. And that’s just the review time. Preparing the documentation, building the compliance infrastructure, and getting your tech stack audit-ready can take another year. Start early. If you’re rushing to meet a product launch date, you’ll likely miss the window.

Cold Storage and Consumer Protection Rules

Security isn’t just good practice; it’s law. The PSA mandates that at least 95% of user crypto assets must be kept in offline cold wallets. Only 5% can sit in hot wallets for daily transactions. This rule exists to protect users from hacks. When Coincheck was hacked in 2018, losing billions in NEM tokens, regulators tightened these screws further.

Complete segregation of customer funds is non-negotiable. Your users’ coins must be ring-fenced from your company’s assets. If your business goes bankrupt, creditors can’t touch the crypto held for customers. This builds trust. In a market where consumers are wary of exchanges disappearing overnight, this guarantee is your biggest selling point.

Advertising also falls under scrutiny. No glossy promises of quick profits. No fuzzy facts. Your marketing materials must be transparent and accurate. The FSA monitors ads closely to prevent misleading claims that could lure inexperienced investors into risky trades.

Self-Regulatory Organizations: JVCEA and JSTOA

You don’t just answer to the government. You also join a club. Two self-regulatory organizations (SROs) play a huge role: the Japan Virtual Currency Exchange Association (JVCEA) and the Japan Security Token Offering Association (JSTOA).

The JVCEA handles most crypto exchanges. Membership is effectively mandatory for practical operation. They set detailed guidelines on anti-money laundering (AML), know-your-customer (KYC) procedures, and listing criteria for new tokens. If you want to list a new altcoin, the JVCEA often vets it before you can offer it to Japanese users. This adds another layer of delay but ensures quality control.

The JSTOA focuses on security tokens and crowdsourcing activities. If your platform touches these areas, you’ll interact more with them. Both SROs work closely with the FSA, creating a dual-layer supervision system that makes Japan’s market incredibly safe but slow-moving compared to looser jurisdictions.

Common Pitfalls for Foreign Entrants

Many foreign companies underestimate the cultural and bureaucratic nuances. They assume their global compliance framework translates directly. It doesn’t. Japanese regulators prefer conservative, documented approaches over innovative but unproven methods.

• Underestimating Timeline: Six months is optimistic. Factor in preparation, revisions, and potential rejections.
• Ignoring Local Partnerships: Having a local legal counsel and compliance officer familiar with FSA expectations saves months of back-and-forth.
• Token Selection Risks: Listing a token that the JVCEA deems too speculative can stall your approval. Stick to established assets initially.
• Weak Cold Storage Proof: Simply saying "we use hardware wallets" isn’t enough. Show the physical location, access protocols, and insurance coverage.

Also, consider the ongoing costs. Compliance isn’t a one-time fee. You need regular audits, reporting, and updates to your systems as regulations evolve. In 2025, new amendments strengthened the FSA’s power to order specific regulatory actions, meaning continuous vigilance is required.

Is It Worth the Hassle?

Why bother with such a tough regime? Because Japan offers legitimacy. Being a registered CAESP signals to users, banks, and partners that you’re trustworthy. The market is mature, users are educated, and the legal clarity reduces existential risk. Unlike markets where bans can appear overnight, Japan provides a predictable environment. For long-term players, that certainty is worth the upfront pain.