Japan FSA unveils 11 new rules for crypto exchange anti-fraud crackdown

• New FSA mandates enforce withdrawal cooldowns, address whitelisting, and tougher cyber incident protocols for crypto exchanges.
• Exchanges must comply with all 11 reforms by March 2027; public can comment on rules until September 7, 2026.

On August 7, 2026, Cryptopolitan reported that Japan’s Financial Services Agency (FSA) mandated 11 new protections for crypto exchanges in a sweeping overhaul targeting scams and cyberattacks. The FSA’s rules, effective immediately, require all exchanges to implement mandatory cooldown periods on withdrawals from accounts flagged as suspicious. Users must pre-register withdrawal addresses, with waiting periods imposed before transferring funds to new destinations.

To further block fraud, the new regulations introduce stricter withdrawal limits based on each individual’s holdings and risk profile. Multi-factor authentication and name-matching for bank deposit confirmation are now compulsory, especially where phishing or impersonation risk is detected. Exchanges face a standardized, enhanced protocol for reporting any cyber incident, which includes accelerated account freezes and improved data sharing with law enforcement when fraudulent activity is identified.

The FSA also established a dedicated Crypto Assets and Stablecoins Division to support integration of digital assets into Japan’s mainstream financial system. A law passed in July now classifies crypto assets as financial products and reduces the top capital gains tax rate on crypto profits to a 20% flat rate, taking effect January 2028.

All 11 measures are designed to limit the outflow of illicit funds, boost consumer protection, and give exchanges more flexibility to tailor operations based on risk. The FSA’s deadline for full compliance is March 2027. Public comments on these expanded supervisory guidelines are open until September 7, 2026.