Japan crypto market entry for an overseas exchange or wallet provider

The group plans spot exchange, hosted wallets and optional staking for Japanese users. Identify any licensed Thai operator, holding company and technology supplier within the group. Their permissions and responsibilities need separate treatment.

The Japanese principal is the entity holding the relevant Japanese registration, whether independently owned or acquired by the group. It would contract for the proposed exchange and custody services. A service intermediary would mediate transactions under that principal's delegation. A technology supplier would provide the agreed systems and support.

Map each screen and operational permission to those entities. Identify who approves onboarding, sets transaction terms, handles orders, controls signing keys, decides withdrawals and answers complaints. Shared branding must not obscure the provider. Japanese rules expressly address online customer confusion about the contracting business. (Cabinet Office Ordinance No. 7 of 2017 (CAESP Ordinance), art. 23(1)(iii).)

As of 5 November 2026, ordinary cryptoasset spot exchange and custody remain regulated under the Payment Services Act (PSA). Securities and crypto derivatives already engage the Financial Instruments and Exchange Act (FIEA) where their statutory definitions apply. (PSA, arts. 2(14)–(15), 63-2; FIEA, arts. 2(1)–(3), 2(8), 2(24)(iii-2), 29.)

The 2026 reform is enacted. Act No. 64 of 2026 was promulgated on 23 July, and separate penalty provisions commenced on 12 August. As of 5 November 2026, its main transfer of cryptoactivity into the FIEA framework has not commenced. The main commencement must be appointed by Cabinet Order within one year of promulgation; no fixed migration date should be inferred from that outer limit. (Act No. 64 of 2026, Supplementary Provisions, art. 1.)

When the relevant provisions commence, the reform will also add cryptoasset borrowing to the regulated business definition and introduce notification and conduct duties for defined custody-related technology services. Covered technology providers will need an office in Japan; foreign corporations will also need a representative or agent in Japan. Check the implementing scope and transition provisions before finalising the staking or technology-only model. (Act No. 64, art. 2, inserting FIEA arts. 2(8)(xxv), 2(54) and 66-94–66-99; Supplementary Provisions, art. 21.)

Existing providers face conditional transition arrangements. These include a two-week notification requirement and a six-month registration or change-registration window after main commencement. A timely application can permit continuation pending determination, subject to statutory conditions and an outer limit two years after main commencement. Corresponding provisions address existing crypto service intermediaries. Assign an owner to these notices and applications; registration under the existing regime is not permanent grandfathering. (Act No. 64, Supplementary Provisions, arts. 8–10 and 18–20.)

The earlier service-intermediary reform is already effective. Its commencement was 1 June 2026, as confirmed by the Financial Services Agency (FSA) in its final implementation notice of 22 May 2026, section 3.

Spot buying, selling and crypto-to-crypto exchange are regulated exchange activities. Brokerage, mediation, intermediation and agency are also within the PSA definition. Handling no customer assets does not, by itself, remove the registration requirement. (PSA, art. 2(15)(i)–(iii).)

Custody includes managing cryptoassets for another. The FSA examines whether the provider can transfer assets independently of the customer, including control exercised together with related companies. Splitting keys across affiliates does not necessarily avoid custody. Software that leaves control entirely with the customer can fall outside custody, while exchange or mediation features remain separately assessable. (PSA, art. 2(15)(iv); FSA Administrative Guidelines, Part III, 16, I-1-2-2(3).)

Transfers need their own analysis. Moving assets from a hosted wallet engages its custody controls. An undertaking to execute a money remittance may also constitute funds-transfer business even where cryptoassets perform the transfer. Pure transfer software is assessed by its actual function. (PSA, arts. 2(2), 37; FSA Guidelines 16, I-1-2-2(4).)

Staking requires a description of the actual rights. Establish who controls withdrawals, whether assets are lent or remain in custody, how rewards arise, and who bears slashing or validator failure. Pooled business participation with distribution rights can engage collective-investment rules. A transferable staking receipt needs its own classification. These are conditions for a product decision, not a universal Japanese staking prohibition. (PSA, art. 2(15)(iv); FIEA, arts. 2(2)(v)–(vi), 2-2.)

Where a registered provider borrows cryptoassets in connection with its exchange business, required disclosures distinguish borrowed assets from segregated custody and statutory priority protection. Repayment controls also apply. Calling an arrangement a loan does not settle its substance. (CAESP Ordinance, art. 23(1)(viii); FSA Guidelines 16, I-1-2-2(3).)

Stablecoins are classified by denomination, redemption rights and statutory criteria. Those qualifying as electronic payment instruments have a separate trading and custody regime. Cryptoasset registration alone does not cover it. Security tokens and derivatives require their applicable FIEA permissions. Keep these products outside the initial asset list unless separately cleared. (PSA, arts. 2(5), 2(10), 62-3; FIEA, arts. 2, 28–29.)

Use the cross-jurisdiction token-classification analysis to organise the rights assessment before choosing the Japanese permission.

The territorial question concerns persons in Japan, rather than citizenship alone. The planned Japanese onboarding and local acquisition cannot rely on the Thai entity's foreign status. An applicant initiating contact does not establish a general exemption for the wider business. (PSA, arts. 63-2, 63-22; FSA Guidelines 16, II-5-1.)

The FSA generally treats online advertising as solicitation. Its exclusion approach requires reasonable measures that actually prevent Japan-facing transactions, including clear exclusion language and effective transaction controls. A disclaimer alongside Japanese acquisition campaigns does not satisfy that model. (FSA Guidelines 16, II-5-2.)

Before Japanese permission is available, either keep the offshore service genuinely outside that market or route the permitted activity through the registered principal. The latter still requires classification of everything the group itself does.

1. Own the registered operation

Choose this route if the group wants its entity to contract for exchange and custody and control those services. A Japanese stock company can apply. A qualifying foreign corporation providing cryptoasset exchange services can also apply with a Japanese office and a representative domiciled in Japan. Both require Japanese registration and adequate financial, operational and compliance arrangements. (PSA, arts. 63-2–63-5.)

Buying shares in a registered company preserves that company as the regulated operator. Its registration does not become the parent's permission. Major-shareholder changes require the applicable notification, and the FSA reassesses operational suitability. Business transfers into an unregistered recipient require that recipient's registration. (PSA, art. 63-6; CAESP Ordinance, arts. 5(iii), 12; FSA Guidelines 16, III-1-8.)

Make the transaction conditional on the actual regulatory requirements and operating changes. Separately screen the investor, transaction and target activities under Japan's foreign-investment rules. Prior notification and standstill depend on those facts and applicable exemptions. (Foreign Exchange and Foreign Trade Act, arts. 26–28-2.)

2. Cooperate with a registered principal

This is the initial route to test where the group accepts that another entity will provide the regulated spot and custody services. The principal must retain effective oversight and fulfil its customer-protection duties. A partnership agreement cannot authorise the group's own regulated acts. (PSA, arts. 63-7–63-11; CAESP Ordinance, art. 16.)

If the group wants to solicit transactions or explain products to secure contracts, assess the registered service-intermediary route. It requires a separate registration and delegation from the principal. The intermediary must disclose its principal and lack of agency authority. It cannot use this category to receive customer money or cryptoassets, execute an independent exchange business or provide custody. The principal must belong to the certified association. (PSA, arts. 2(18)(ii), 63-22-2, 63-22-5(1)(i), 63-22-8–63-22-9, 63-22-13.)

A foreign corporate intermediary must appoint a representative domiciled in Japan. Unlike the full-provider route, this category expressly accommodates applicants without a Japanese office. (PSA, art. 63-22-5(1)(ii); Service-Intermediary Ordinance No. 50 of 2026, art. 8.)

A narrower referral arrangement can remain outside mediation. The FSA gives examples involving unchanged principal-provided content and clearly identified counterparties, without the referrer's added recommendations, inducements or negotiations. These conditions must match the entire user journey. A conversion team explaining and promoting transactions needs a different analysis from a neutral link. (FSA Guidelines 18, I-2, items 5–7.)

3. Supply technology

A supplier can provide software and operational support within a defined outsourcing arrangement. Limit its permissions to that role. If it can independently move customer assets, mediate contracts or control execution, reassess its own registration perimeter. (PSA, art. 2(15); FSA Guidelines 16, I-1-2-2.)

The contract should reserve regulated decisions to the principal and provide audit and regulatory access, incident escalation, subcontractor controls, continuity and exit arrangements. Offshore outsourcing remains subject to supervision, and the principal retains responsibility. Document who can access production systems and change transaction or withdrawal settings. (CAESP Ordinance, art. 16; FSA Guidelines 16, II-2-3-3.)

Technology supply is therefore a narrower commercial role. It supports the principal's Japanese service; it does not establish the group's own Japanese exchange.

Start with the exact legal entity and Japanese registration number. Match the FSA register, corporate records, contract and customer-facing identity. Before appointment and launch, check the register, restrictions, enforcement history and material remediation.

Obtain evidence of the principal's actual services, tokens, custody arrangements, outsourcing and intended delegation. Its registration must fit the proposed operation. The crypto partner permission-checking service addresses this entity, permission and operating-scope review.

Token admission has separate statutory and self-regulatory steps. The provider must assess each asset and make applicable notifications for changes to tokens or business methods. Members of the Japan Virtual and Crypto assets Exchange Association (JVCEA) must also follow the association's rules, including applicable advance review, exceptions and conditions. Listing on another exchange is insufficient evidence for this provider's launch. (PSA, arts. 63-3(1)(vii)–(viii), 63-6; JVCEA Rules on Handling Cryptoassets, arts. 2–5.)

Full-provider registration allows an alternative to association membership where equivalent internal rules and adequate compliance arrangements satisfy the statute. The service-intermediary route has the distinct principal-membership condition described above. Do not treat the two routes as interchangeable. (PSA, arts. 63-5(1)(vi), 63-22-5(1)(i).)

The principal's asset controls must cover customer-money trust arrangements, segregation of customer cryptoassets, security, reconciliation and independent audits. The exception permitting necessary operational amounts outside the prescribed secure management method is capped at 5% of managed customer cryptoassets by yen value. It also brings corresponding performance-guarantee asset requirements. It is not permission to deploy customer assets into staking. (PSA, arts. 63-11–63-11-2; CAESP Ordinance, arts. 26–28.)

Japanese onboarding must implement Japanese identification, beneficial-owner, recordkeeping and suspicious-transaction requirements. A Thai KYC file can be an input, but cannot establish compliance by itself. Record responsibility for investigations, reporting and transfer-counterparty checks. Apply the Japanese Travel Rule to its defined transfers and destinations. (Act on Prevention of Transfer of Criminal Proceeds, arts. 4, 6–8, 10-4–10-5.)

For this Japanese-language audience, prepare Japanese terms and explanations identifying the provider, transaction role, fees, custody method, withdrawal conditions and material risks. Provide complaint contacts and the applicable dispute-resolution arrangements. A translated Thai agreement needs review against these duties and Japanese consumer rules. (PSA, art. 63-12; CAESP Ordinance, arts. 21–22; Consumer Contract Act, arts. 8–10.)

The principal should retain a direct complaints channel, even where Thai staff supply support. The service agreement should define escalation, evidence retention and responsibility for customer responses. (FSA Guidelines 16, II-2-2-7 and II-2-3-3-2.)

Map offshore data access separately. Thai support staff accessing customer information on Japanese servers can still engage Japan's overseas-transfer requirements. Identify the applicable informed-consent or qualifying equivalent-protection route, alongside security, contractor supervision and continuing safeguards. Server location alone does not settle the question. (Act on the Protection of Personal Information, arts. 23, 25–26, 28; PPC Rules, arts. 16–18; PPC FAQ Q10-24.)

Identify the entity supplying capital, staff, technology or customer referrals. Where the Thai licensed operator conducts an additional business, the other-business rules of Thailand's Securities and Exchange Commission (SEC) require permission and the prescribed business relationship, conflict controls and risk controls. A separate affiliate's role must be assessed on its own facts. (Thai SEC Notification กธ. 19/2561, cls. 6–6/1.)

Customer assets cannot fund the Japanese expansion. The Thai operator must keep them separate and use them only within the governing customer-asset rules. Confirm capital ownership, intercompany payments and bank remittance documents before funding the operation. (Emergency Decree on Digital Asset Businesses B.E. 2561, s. 31; Notification กธ. 19/2561, cl. 16/11.)

Thai foreign-exchange rules distinguish overseas equity investment from payments to acquire digital assets. A permitted corporate investment does not establish permission for every subsequent token purchase or funding flow. Treasury should document the transaction's purpose and applicable remittance basis. Licensed exchanges, brokers, dealers and digital-asset fund managers must obtain an SEC allocation for the covered customer-service foreign-exchange transactions and check the available limit before transacting. (Competent Officer Notification on Exchange Control Operations, cl. 16, substituted by Amendment No. 34; SEC Notification กธ. 30/2564, cls. 1–2.)

Optional staking creates a further restriction where the Thai licensed operator participates. Thai conduct rules restrict custody-yield activity and supporting another person's such services, subject to specified exceptions. The consensus-network exception requires the operator itself to be the blockchain developer. Do not treat ordinary third-party validator participation as automatically qualifying. (Notification กธ. 19/2561, cl. 16/15.)

Thai custodial-wallet rules also prohibit a licensed custodial wallet provider from outsourcing its custody function. Moving that function to the Japanese company is therefore not a general solution. Distinguish permitted technology assistance from delegation of custody itself. (Notification กธ. 35/2563, cl. 6/1.)

Group advertising must preserve the distinction between the Thai licensed operator and its affiliates. Relevant Thai rules also restrict promotion of third-party custody-yield services. If the Japanese business solicits persons in Thailand, assess Thailand's foreign-provider targeting rules as a separate market-entry issue. (Notification กธ. 19/2561, cls. 34/7, 34/10; Emergency Decree, s. 26/1.)

Thai data processing and onward transfers need their own privacy basis. Japan's compliance arrangements do not displace applicable Thai controller, processor or cross-border duties. (Thai Personal Data Protection Act B.E. 2562, ss. 5, 28–29, 40.)

Any Thai licensed operator already has customer and beneficial-owner checks and ongoing monitoring duties. Branches or affiliates within the defined group require group controls and lawful information sharing. Foreign branches or defined foreign affiliates must follow the stricter Thai or host-country AML measures. If they cannot follow Thai measures, the Thai operator must add controls and notify the Anti-Money Laundering Office (AMLO). (Emergency Decree, s. 7; CDD Ministerial Regulation B.E. 2563, cls. 17, 48, 51–52; AMLO Notification on Group Business Scope, 14 January 2021, cl. 2.)

Build transfer-system changes into the plan: Thailand's SEC Travel Rule has been adopted and applies from 27 February 2027. Its commencement differs from that of Japan's obligations, which are already in force. (SEC Office Notification สธ. 9/2569, cl. 1.)

Give each deliverable a named owner:

• Legal and compliance: an entity-and-activity map, token classifications, registration evidence and any required filings or approvals.
• The Japanese principal: customer terms, asset-control records, onboarding and transfer procedures, complaint arrangements and approved marketing.
• Product and security: a tested user journey, signing and production-access matrix, withdrawal controls and incident procedures.
• Group operations: signed delegation or outsourcing agreements, service standards, audit access, subcontractor and exit schedules.
• Thai compliance, treasury and privacy leads: other-business analysis, permitted funding, custody and staking boundaries, and documented data flows.
• The launch owner: written confirmation that every applicable gate is satisfied, with staking disabled until its separate decision is complete.

The recommendation changes if the group insists on controlling customer contracts, execution or keys: pursue its own registered operation. If it wants active distribution without those functions, assess intermediary registration. If the product introduces pooled returns, security tokens, stablecoins or a remittance undertaking, reopen the affected permission analysis before adding the feature.

Use the Japan licensing hub for the wider set of Japanese permissions. The Singapore and Hong Kong entry comparison provides related reading on allocating regulated roles across an overseas group.