Japan's Financial Services Agency and the National Police Agency have jointly called on the Japan Virtual and Crypto Assets Exchange Association to adopt a set of new anti-fraud safeguards, including delaying crypto withdrawals for a set period after customers deposit fiat currency or purchase digital assets.
The regulators also want exchanges to require users to pre-register withdrawal addresses, with a waiting period before newly added addresses become usable, and to impose customer-specific withdrawal limits based on individual risk profiles. The request further calls for phishing-resistant multifactor authentication, stronger monitoring of transactions and access environments, and checks confirming that bank remitter names match crypto account holder names.
The scale of the fraud problem
The FSA said the measures respond to "increasingly sophisticated scams involving digital assets" and rising losses among exchange users, noting that funds obtained through fraudulent schemes are increasingly being routed into exchange accounts before disappearing. The request follows Japan's worst year on record for fraud broadly: total losses from so-called special fraud and social-media-based investment and romance scams reached 324.1 billion yen, or roughly $2.1 billion, in 2025, with special fraud cases climbing 31.9% year-over-year to 27,758.
Social-media-based investment fraud alone accounted for 9,538 cases and 127.4 billion yen (about $821 million) of that total, with fake forex or crypto exchange platforms a recurring tactic — often allowing small initial withdrawals to build victims' trust before refusing larger ones. Separate reporting has found that nearly half of proceeds stolen through online bank fraud in Japan, roughly 8.73 billion yen in one reported period, was ultimately funneled into crypto exchange accounts, underscoring why regulators are targeting the withdrawal pipeline specifically rather than account opening alone.
Related: Japan Presses US Government Again Over Pokémon, Mario Meme Use
Guidance, not a mandate
Despite the scope of the request, the FSA was explicit that the measures are "not binding rules," leaving exchanges discretion over implementation based on their own operations and fraud exposure. That soft-touch approach contrasts with the agency's harder enforcement elsewhere this year, including a record four VASP license revocations over KYC non-compliance — a reminder that Tokyo still has more forceful tools available if voluntary adoption of the new safeguards falls short.
