Japan's FSA Cracks Down on Crypto Hacks with Custodian Registration Mandate

Japan's Financial Services Agency (FSA) is poised to implement stricter oversight of cryptocurrency management systems, requiring third-party providers to register with authorities before partnering with exchanges. The move, discussed by a working group under the Financial System Council on November 7, aims to close regulatory gaps and enhance security following high-profile hacks, including the 2024 DMM Bitcoin breach that saw $312 million in Bitcoin stolen, as noted in a Cryptopolitan report.

The FSA's proposed prior notification system would mandate that crypto exchanges use only registered custodians and service providers for critical operations such as custody and trading systems, according to a The Crypto Basic report. Currently, while exchanges are required to store user assets in cold wallets, external firms handling these functions face no such oversight. This regulatory asymmetry has left the sector vulnerable to theft and operational failures, as highlighted by the DMM incident, where the breach originated from Tokyo-based software firm Ginco, according to a Blockonomi report.

The FSA's initiative aligns with broader efforts to modernize Japan's financial infrastructure. In October 2025, the agency approved JPYC, the country's first yen-pegged stablecoin, and recently announced support for a pilot project involving Japan's three largest banks—Mizuho, MUFG, and SMBC—to test stablecoin-based payments, according to a Coinpedia report. The pilot, part of the FSA's Payment Innovation Project (PIP), seeks to streamline corporate transactions and improve efficiency in the digital asset ecosystem. Mitsubishi Corporation and other firms are collaborating on the initiative, which is expected to launch in November 2025, as reported by CryptoNews.

The regulatory push has garnered broad support within the Financial System Council, with most members endorsing the proposed framework. The FSA plans to compile a formal report and submit amendments to the Financial Instruments and Exchange Act during the 2026 Diet session, ensuring the rules become law, as noted in the Cryptopolitan report. This timeline reflects a balance between fostering innovation and safeguarding investors, a priority for Japan's financial regulators.

For everyday crypto users, the changes mean exchanges will no longer be able to outsource critical functions to unverified third parties. All custodians and service providers will require government approval, adding a layer of oversight to protect user assets, according to the Coinpedia report. The FSA's dual focus on crypto security and stablecoin development underscores Japan's ambition to lead in digital finance while mitigating risks associated with unregulated practices.