PSA Registration Requirements for Crypto Exchanges in Japan 2025

If you're thinking about running a cryptocurrency exchange in Japan, you need to know one thing upfront: PSA registration isn't just a formality. It's a full-scale compliance operation that takes months, millions of yen, and airtight systems. There's no shortcut. No gray area. And operating without it? That’s a crime.

What Exactly Is the Payment Services Act (PSA)?

The Payment Services Act (PSA) is Japan’s legal backbone for cryptocurrency exchanges. Passed in 2016 and updated since, it’s the law that says: if you buy or sell crypto as a business, you must register with the Financial Services Agency (FSA). It doesn’t matter if you’re based in Tokyo, New York, or Singapore-anyone offering crypto trading to Japanese users needs this registration.

The PSA defines crypto-assets as digital payment tools not tied to yen or any other fiat currency. That means Bitcoin, Ethereum, Solana-all of them qualify. But prepaid cards backed by yen? Not crypto. Bank-issued digital coins? Also not crypto. The line is clear: if it’s not tied to government money, it’s under the PSA.

Who Needs PSA Registration?

Any company that engages in crypto trading as a business must register. That includes:

• Exchanges that let users trade crypto for fiat (JPY, USD, etc.)
• Platforms that swap one crypto for another
• Wallet services that hold crypto on behalf of users
• Any entity acting as an intermediary in crypto transactions

Even if you’re a foreign company with no physical office in Japan, if you accept Japanese customers, you’re subject to the PSA. There’s no exception for small operators or startups. The law doesn’t care how big you are-it cares whether you’re doing business here.

Registration Requirements: The Hard Facts

Getting registered isn’t about filling out a form. It’s about proving you’re built to last. Here’s what the FSA demands:

• Corporate Structure: You must be a kabushiki-kaisha (Japanese stock company). Foreign firms can’t register as branches-they must set up a wholly owned subsidiary in Japan. No exceptions. Every single registered foreign exchange has done this.
• Minimum Capital: You need at least JPY 10 million (about $65,000 USD) in paid-in capital. But that’s just the floor. The FSA also requires positive net assets, meaning your liabilities can’t exceed your assets.
• Management & Compliance: You need a clear organizational structure. Directors and officers must pass background checks. No history of fraud, money laundering, or financial crimes. You also need a dedicated compliance officer who understands Japanese financial law.
• Operational Systems: You must document every step of your business: how you onboard users, how you verify identities, how you handle deposits and withdrawals, how you monitor transactions for suspicious activity. Every process must be written, tested, and auditable.
• Asset Segregation: This is non-negotiable. Customer crypto must be kept completely separate from your company’s funds. The FSA requires at least 95% of user assets to be stored in cold wallets-offline, air-gapped, and physically secured. The rest can be in hot wallets for liquidity, but you must prove you can cover losses if they happen.
• Outsourcing Rules: If you use third parties for anything-KYC, security, tech support-you must disclose them and prove they meet FSA standards. You can’t outsource your responsibility.

The application package can run over 200 pages. It includes company bylaws, financial statements, IT system diagrams, anti-money laundering policies, customer dispute procedures, and more. The FSA doesn’t just read it-they test it. They simulate hacks. They ask: “What if your server goes down?” “What if a director gets arrested?” “How do you recover user funds if you go bankrupt?”

The Timeline: Six Months Is Just the Start

The FSA says the review process takes about six months. But that’s only the clock starting after you submit. Most companies spend 8 to 12 months preparing. Why? Because building compliant systems takes time.

You can’t just buy software and call it done. You need internal audits, staff training, legal reviews, and multiple rounds of revisions. Many applicants get rejected on their first try-not because they’re dishonest, but because their documentation is sloppy or incomplete. One company spent nine months rewriting their asset segregation plan just to meet FSA expectations.

And once you’re registered? The work doesn’t stop. The FSA does unannounced inspections. They check your logs. They interview your staff. They demand proof that your cold wallets are secure. Miss one requirement, and you could face suspension-or worse.

What Happens If You Don’t Register?

Operating without PSA registration is a criminal offense. Before June 1, 2025, the penalty was up to three years in prison and a fine of up to JPY 3 million. Now, under Japan’s updated Penal Code, imprisonment is replaced with “confinement punishment” (koukin-kei)-a form of detention without incarceration, but still a serious legal consequence.

But the real damage isn’t legal-it’s reputational. Japan’s crypto market is small but highly trusted. Users only use exchanges with the FSA stamp. If you’re unregistered, no Japanese customer will touch you. No bank will open an account for you. No payment processor will work with you. You’re locked out of the market before you even start.

PSA vs. FIEA: When Do You Need More Than Just PSA?

Not all crypto is treated the same. The PSA covers spot trading of tokens like Bitcoin and Ethereum. But if your token acts like a security-offering dividends, profit-sharing, or investment returns-it falls under the Financial Instruments and Exchange Act (FIEA).

FIEA registration is harder. It requires:

• Higher capital requirements
• More complex reporting
• Strict disclosure rules for investors
• Ongoing audits by certified accountants

Most exchanges stick to PSA because it’s predictable. But if you’re launching a tokenized asset, a yield product, or a staking service that pays returns, you’ll need FIEA too. Many companies end up applying for both.

Why Japan’s Rules Are So Strict

Japan was one of the first countries to regulate crypto after the 2014 Mt. Gox collapse. That disaster wiped out hundreds of millions in user funds. Since then, the government has built a system designed to prevent that from ever happening again.

The result? A market where users trust their exchanges. Japan has one of the highest rates of crypto adoption in Asia-not because it’s easy to start a business, but because people know their money is safe.

It’s not about stifling innovation. It’s about making sure innovation doesn’t come at the cost of consumer protection. The FSA doesn’t ban new tokens. It doesn’t cap trading volume. It just says: if you want to operate here, you have to do it right.

Who Can Actually Afford This?

The PSA registration process favors big players. The JPY 10 million minimum is just the start. Factoring in legal fees, tech infrastructure, compliance staff, and ongoing audits, the total cost to launch can easily exceed JPY 50 million ($300,000 USD). That’s why most registered exchanges are either Japanese financial institutions or well-funded global firms like BitFlyer, Coincheck, and Zaif.

Small startups? It’s nearly impossible. You can’t just hire a freelance developer and call it a day. You need lawyers, auditors, cybersecurity experts, and compliance officers-all on payroll. That’s why Japan’s crypto market is dominated by a handful of licensed players. The system isn’t broken-it’s designed that way.

What’s Changing in 2025?

In early 2025, Japan submitted new amendments to the PSA to strengthen enforcement. The changes give the FSA direct power to issue orders-like freezing assets, shutting down services, or mandating system upgrades-without going through court. This isn’t just about punishment anymore. It’s about real-time control.

Also, the FSA is pushing for more transparency. Registered exchanges now must publicly disclose their cold wallet addresses. They must report any security breaches within 24 hours. And they must prove they’ve tested their systems against simulated cyberattacks.

These aren’t suggestions. They’re requirements. And they’re being enforced.

Bottom Line: It’s Not About Getting Licensed. It’s About Being Trustworthy.

PSA registration isn’t a license to trade crypto. It’s a certification that you’re serious about protecting users. The FSA doesn’t care how fancy your website is or how many influencers you pay to promote you. They care about your cold wallets. Your audit trails. Your employee training records. Your backup plans.

If you’re serious about operating in Japan, don’t think of registration as a hurdle. Think of it as your foundation. Build it right, and you earn trust. Build it wrong, and you don’t just lose your license-you lose your future in the market.

Japan’s crypto rules are strict. But they work. And for anyone who wants to play here long-term, that’s the only path that matters.