PSA Registration Requirements for Crypto Exchanges in Japan 2025

If you're thinking about running a cryptocurrency exchange in Japan, you need to understand one thing upfront: PSA registration isn't just paperwork. It's a full-system overhaul. The Payment Services Act (PSA) sets the bar higher than almost any other country in the world. There’s no shortcut. No gray area. If you trade crypto as a business in Japan without being registered, you’re breaking the law - and the penalties are real.

What Exactly Is PSA Registration?

The Payment Services Act (PSA) is Japan’s main law governing crypto exchanges. It doesn’t treat crypto like a speculative asset - it defines it as a legal payment method. That means Bitcoin, Ethereum, and other digital currencies are recognized as property you can legally buy, sell, and use to pay for goods. But if you run a platform where people trade these assets, you must register with the Financial Services Agency (FSA) as a Crypto Asset Exchange Service Provider (CAESP).

This isn’t optional. Since 2017, when the PSA was amended, all crypto exchanges operating in Japan have had to get registered. Unlicensed operators have been shut down. In 2025, the rules got even stricter. The penalty for operating without registration used to include up to three years in prison. Now, under the 2022 Penal Code amendments, that’s replaced with "confinement punishment" - still a criminal record, still serious, still enforced.

Who Can Apply?

You can’t just walk in with a business plan and a laptop. The FSA only accepts applications from two types of entities:

• Japanese stock companies (kabushiki-kaisha)
• Foreign companies that set up a Japanese subsidiary

Foreign companies can’t apply as branches. Even though the law technically allows it, the FSA has never approved a single branch application. Every foreign exchange - including big names like Binance and Kraken - had to create a fully independent Japanese subsidiary to get registered. That means incorporating a new company in Japan, hiring local staff, opening a Japanese bank account, and appointing a local representative.

Minimum Capital Requirements

Money isn’t just nice to have - it’s mandatory. You need at least JPY 10 million (about $65,000 USD) in paid-in capital. But that’s just the floor. The FSA also requires positive net assets. That means your total assets must exceed your liabilities. You can’t register if you’re starting with debt.

Why so strict? Japan’s regulators want to make sure exchanges can survive market crashes, hacking attempts, or sudden withdrawals. They don’t want another Mt. Gox. The capital requirement filters out fly-by-night operations and ensures only serious, well-funded players get in.

Organizational and Compliance Systems

It’s not enough to have money. You need structure. The FSA demands detailed documentation of your internal systems. That includes:

• Clear organizational charts showing who’s responsible for compliance, security, and operations
• Written policies for anti-money laundering (AML) and know-your-customer (KYC) checks
• Internal audit procedures
• Incident response plans for hacks or system failures
• Outsourcing agreements, if you use third parties for anything - even cloud hosting

You’ll need to prove these systems aren’t just on paper. The FSA will ask for logs, training records, and examples of how they’ve been used in real situations. They’re not looking for templates. They’re looking for working processes.

Asset Segregation: Cold Wallets and Customer Protection

One of the toughest rules is asset segregation. Customer crypto must be kept completely separate from your company’s funds. You can’t use customer coins to cover operational costs. You can’t lend them out. You can’t even mix them in the same wallet.

The law requires at least 95% of customer assets to be stored in offline cold wallets. That means no internet connection. No risk of remote hacking. The remaining 5% can be in hot wallets for daily trading, but those are closely monitored.

You also need to prove you have insurance or other financial safeguards in place if assets are lost. Many registered exchanges in Japan carry multi-million dollar insurance policies. The FSA doesn’t require it, but it’s become standard practice.

What You Can’t Advertise

Marketing crypto in Japan is tightly controlled. You can’t say things like:

• "Earn 20% monthly returns!"
• "Bitcoin will hit $1 million next year!"
• "Risk-free investment!"

The FSA bans any language that suggests guaranteed profits, unrealistic price predictions, or downplays risk. Ads must be factual, clear, and include risk warnings. Even social media posts and influencer partnerships are subject to review. The FSA has fined exchanges for YouTube videos that made crypto look like a get-rich-quick scheme.

The Registration Process: Six Months Minimum

The official review period for a PSA application is up to six months. But that’s only the start. Most companies spend 9 to 12 months preparing before they even submit.

Here’s what you need to include in your application:

• Company name, legal address, and registration number
• Names and backgrounds of all directors and major shareholders
• Exact list of crypto assets you plan to trade (e.g., BTC, ETH, XRP)
• Step-by-step description of how users deposit, trade, and withdraw
• Details of your cold wallet infrastructure and security protocols
• Proof of capital and net assets (bank statements, audited reports)
• AML/KYC procedures with sample customer verification records

The FSA doesn’t just read your documents - they test them. They’ll simulate a hack, ask for internal audit logs from the past six months, and interview your compliance team. If anything looks sloppy, they’ll reject you and send you back to fix it.

PSA vs. FIEA: Know the Difference

Not all crypto is treated the same. The PSA covers plain spot trading of digital currencies like Bitcoin and Ethereum. But if your platform offers tokens that act like investments - say, a token that gives holders a share of profits or voting rights - you fall under the Financial Instruments and Exchange Act (FIEA).

FIEA licensing is harder. It’s designed for securities. You’ll need to comply with disclosure rules, investor protection standards, and reporting requirements similar to stock exchanges. Most crypto exchanges stick to PSA because it’s clearer and less restrictive - as long as they avoid anything that smells like a security.

Who’s Already Registered?

As of 2025, only about 20 exchanges are registered under the PSA in Japan. Big names include Bitflyer, Coincheck, and Zaif. Even Coinbase operates through its Japanese subsidiary. The list is small because the bar is high.

The FSA doesn’t publish a live public list, but you can check the official FSA website for the most current registry. If an exchange isn’t on it, they’re not legal in Japan - no matter how big they are elsewhere.

What Happens After You Get Registered?

Getting registered isn’t the finish line. It’s the starting line. Registered exchanges are subject to ongoing supervision. The FSA conducts annual inspections. They can demand internal reports at any time. They can shut you down if you fail to update your systems or if a major security breach occurs.

You also have to join the Japan Virtual Currency Exchange Association (JVCEA), a self-regulatory group that sets industry standards. They do their own audits and can recommend penalties if you violate their rules.

Why Japan’s Rules Matter

Japan isn’t trying to stop crypto. It’s trying to make it safe. The country was one of the first to recognize Bitcoin as legal tender. It’s also one of the first to build a real regulatory framework around it.

The result? Japanese consumers trust their exchanges. When Mt. Gox collapsed in 2014, it shook confidence. The PSA was built to prevent that from ever happening again. Today, Japan has one of the most stable crypto markets in the world - not because it’s the most open, but because it’s the most controlled.

For operators, it’s expensive. For users, it’s secure. And for anyone thinking about entering the market, it’s a warning: if you’re not ready to invest in real compliance, don’t bother.