Japan's FSA Proposes Mandatory Registration for Crypto Custodians Following Major Hack

Japan's Financial Services Agency (FSA) is advancing plans to impose new registration requirements for cryptocurrency custodians and trading service providers, aiming to bolster the security of the country's digital asset infrastructure.

The proposal, discussed by a working group under the Financial System Council on November 7, 2025, comes in response to the 2024 DMM Bitcoin hack, which resulted in the theft of 48.2 billion yen ($312 million) worth of Bitcoin. The breach was traced to Ginco, a Tokyo-based software firm that managed DMM's trading systems, exposing weaknesses in outsourced service oversight.

Under the new rules, all third-party custody and trading management firms would need to register with regulators before providing services to crypto exchanges. In turn, exchanges would be required to use only systems developed by registered entities. This addresses a current regulatory gap where exchanges must meet strict asset safeguarding rules, such as cold wallet storage, but no similar regulations apply to external providers.

Most members of the council's working group supported the registration system, emphasizing the need for clearer regulation. The FSA intends to compile a formal report and submit proposed amendments to the Financial Instruments and Exchange Act during the 2026 ordinary Diet session.

This initiative is part of Japan's broader effort to balance innovation and investor protection. Recently, the FSA approved the country's first yen-backed stablecoin, JPYC, and confirmed a joint stablecoin pilot project with Japan's three largest banks—Mizuho, MUFG, and SMBC—under the Payment Innovation Project (PIP). The pilot, expected to begin in November 2025, involves developing a shared framework for yen-backed stablecoin issuance and may later introduce a dollar-pegged version to compete with global stablecoins like USDT and USDC.