SAKURA Law Office | Legal Update by Managing Partner Kenshiro Michishita

October 5, 2026

SAKURA Law Office | Kenshiro Michishita, Managing Partner

SAKURA Law Office has published the twenty-first edition of the Legal Update series by Managing Partner Kenshiro Michishita, entitled “Corporate Misconduct Investigations and Third-Party Committees in Japan — Initial Response, Independence, Evidence and Forensics, Whistleblower Protection, Disclosure and Remediation (2026).”

A Japanese corporate investigation is rarely a stand-alone fact-finding exercise. An issue may begin with an internal report, an audit finding, an accounting concern, a complaint from a customer or business partner, press or social-media coverage, a regulatory inquiry, or a problem discovered after an acquisition. From the moment a credible concern emerges, evidence preservation, board governance, employment and privacy issues, exchange disclosure, regulator strategy, contractual notice, insurance, financing and reputation can begin running on different clocks. The quality of the response is often determined in the first hours and days, before the final investigation structure has even been chosen.

The investigation model must fit the governance problem. Some matters can be handled credibly by legal, compliance or internal audit. Others require outside counsel, forensic accountants or technical specialists. Where senior management may be implicated, internal controls or management credibility are seriously in question, financial reporting may be materially affected, or the matter has substantial corporate-value or social consequences, a more independent committee may be required. In Japanese practice, a “third-party committee” is not a statutory corporate organ. Its credibility depends on who commissions it, who controls scope and budget, who can access evidence, and who controls the findings and report.

The legal and governance environment also changed materially in 2026. Japan Exchange Regulation published its Handbook for Strengthening Internal Controls and Preventing Corporate Misconduct in January. The FSA and TSE finalized the 2026 revision of Japan’s Corporate Governance Code on July 21, and the TSE Timely Disclosure Guidebook was updated in July 2026. Separately, the current Whistleblower Protection Act remains in force as of October 5, 2026, while significant amendments and revised guidance are scheduled to take effect on December 1, 2026. These sources do not all have the same legal status: statutes, listing rules, administrative guidance and professional best-practice guidelines must be distinguished rather than blended together.

This Legal Update explains how Japanese companies, Japanese subsidiaries of foreign groups, overseas General Counsel, boards and foreign counsel should design a corporate misconduct response from the first 48 hours through evidence preservation, investigation architecture, interviews, whistleblower protection, regulatory coordination, timely disclosure, reporting, accountability and remediation.

Executive Summary

The integrity of an investigation depends as much on process as on conclusions. In the first hours, the company should prevent loss of email, chat, cloud, accounting, endpoint and access-log evidence, identify conflicts, and establish a decision-making line that excludes potentially implicated persons. Evidence preservation should not wait until the investigative scope is perfect.

A third-party committee is not required for every corporate incident. Japan Exchange Regulation identifies it as a strong option where there are serious doubts about internal controls or management credibility, substantial corporate-value damage, or exceptional complexity or social impact. The Japan Federation of Bar Associations’ Third-Party Committee Guidelines are influential best-practice guidance, not legislation. Outside lawyers do not create independence merely by being outside the company; commissioning authority, conflicts, access to evidence, budget, secretariat arrangements, reporting lines and control of the report all matter.

Digital forensics should be powerful but proportionate. Technical ability to collect a corporate device or mailbox does not create unlimited legal or governance authority to review everything in it. The APPI, PPC guidance, employment rules, privacy expectations, trade secrets and cross-border data restrictions should inform the custodians, date ranges, data sources, search terms and review permissions used in the investigation. Japan also does not provide a blanket U.S.-style attorney-client privilege for every investigation document merely because lawyers are involved.

Whistleblower-originated matters require controlled handling of identity information and protection against retaliation, improper sharing and attempts to identify the reporter. As of October 5, 2026, the current Whistleblower Protection Act and guidance apply, while major amendments and revised guidance will take effect on December 1, 2026. Listed companies must also evaluate timely disclosure throughout the investigation. “Still under investigation” is not itself a universal reason to remain silent; established facts, unresolved issues, present understanding and next steps should be clearly separated.

A credible report should not stop with naming a wrongdoer. It should show why controls failed, why concerns were not escalated, why board or audit functions did not detect the issue, and how incentives, authority, staffing, subsidiary oversight or corporate culture contributed. SAKURA Law Office and Managing Partner Kenshiro Michishita approach corporate investigations as integrated corporate-crisis work connecting liability, board oversight, evidence, employment, regulators, disclosure, contracts, insurance, M&A rights and reputation.

1. The First 48 Hours: Preserve Evidence, Governance and Deadlines Before Reaching Conclusions

The two most damaging early mistakes are premature exoneration and passive delay. Management may be tempted to announce that the matter is isolated before the facts are known. At the opposite extreme, the company may leave normal deletion, device-replacement and account-termination processes in place while waiting for the investigation plan to mature. The first objective should be to create an environment in which evidence survives and decisions are made by people who are not conflicted.

The company should record what information triggered the concern, who received it and when. Automatic deletion of email and messaging data, cloud retention cycles, device resets, deletion of departing employees’ accounts and routine document destruction should be assessed immediately. A legal-hold-style instruction can be an important practical control even though “legal hold” is not a general statutory procedure under Japanese law. Preservation should extend beyond documents that appear to prove the suspected act to approval records, board and committee materials, accounting data, attendance data, access rights, escalation records and internal reports that may reconstruct supervision and knowledge.

Governance should be fixed at the same time. If an executive who may be within scope can decide the investigation mandate, select witnesses, approve experts or control publication of findings, the credibility problem is structural. The board, independent directors, statutory auditors, an audit and supervisory committee, an audit committee or another sufficiently independent body may need to commission outside counsel and receive the findings. Engagement terms should identify who the client is, who can instruct the investigators and who receives interim and final reports.

A serious investigation also requires a parallel deadline map. Regulatory reporting, TSE disclosure, financial reporting and audit timetables, D&O and other insurance notices, financing covenants, material-contract notices, W&I or SPA claim notices and escalation to an overseas parent may continue to run while the facts remain incomplete. The investigation team should not be the only team managing time.

2. Choosing the Investigation Architecture: Internal Review, Outside-Assisted Investigation or Independent Third-Party Committee

The label attached to the process is less important than the governance problem it is intended to solve. A contained incident with no plausible senior-management involvement may be investigated effectively by internal legal, compliance or internal audit, supported by outside specialists where necessary. Greater independence is warranted where the suspected conduct is systemic, senior management is potentially implicated, financial reporting is materially affected, or stakeholders are unlikely to accept management-controlled conclusions.

Japan Exchange Regulation’s Principles for Responding to Corporate Scandals identify a third-party committee as a strong option where there are serious doubts about internal controls or management credibility, significant corporate-value damage, or exceptional complexity or social impact. Those Principles are not statutes. Likewise, the JFBA Third-Party Committee Guidelines are widely influential but are not legislation. A company should therefore avoid treating “JFBA-compliant” as a marketing label unless the actual membership, mandate, independence, evidence access and report process match the substantive expectations of the Guidelines.

Independence is an allocation of decision-making authority, not a professional title. Three prominent outside lawyers do not create an independent process if potentially implicated executives can narrow scope, block access to data, veto witnesses, alter findings or decide which adverse conclusions appear in the public report. The commissioning instrument should deal with scope expansion, document and system access, interview authority, forensic support, budget, secretariat arrangements, interim reporting and the relationship between the full and public reports.

The 2026 revision of Japan’s Corporate Governance Code is not a misconduct-investigation statute, but it forms part of the governance environment in which listed-company boards are expected to exercise effective oversight and focus on sustainable corporate value. In a crisis, the board’s task is not merely to approve the establishment of a committee. It must ensure conflicts are managed, adequate resources are provided, material issues are escalated, and remediation is actually supervised after the report is delivered.

3. Evidence, Digital Forensics and Interviews: Build Findings That Can Be Reconstructed Later

The objective is not to collect the largest possible volume of data. A defensible investigation allows a later reviewer to understand how important findings were derived, what contrary evidence existed and how uncertainties were treated. Scope should be clear enough to guide preservation and interviews but capable of expansion if new facts reveal a broader pattern. Unlimited expansion can itself damage corporate value, so the company should periodically distinguish what is necessary for factual findings from what is necessary for root-cause analysis.

Email, Teams, Slack, mobile devices, laptops, cloud repositories, accounting systems, CRM platforms and access logs can become critical. Forensic imaging, recovery of deleted files, deduplication, keyword searching, metadata analysis and chronology reconstruction may materially improve reliability. But technical accessibility is not the same as unrestricted legal entitlement. Japan’s Act on the Protection of Personal Information, the PPC’s General Guidelines, employment rules, privacy expectations, trade secrets and proportionality should inform custodians, time periods, sources, search criteria and reviewer access. The PPC’s General Guidelines were partially revised in June 2026 and continue to emphasize risk-based security management and appropriate supervision of personnel handling personal data.

Cross-border investigations require a country-by-country data plan. A Japanese parent cannot assume it may freely image devices, export HR files or upload all overseas email into a centralized review platform. Local privacy and employment laws, localization requirements, blocking statutes, bank secrecy or sector-specific restrictions may affect preservation, collection, review and transfer. Japanese and local counsel should design those steps together before the data moves.

Interviews should test evidence, not manufacture confessions. Investigators should, where practicable, review key contemporaneous records before interviewing central witnesses and organize questions around chronology, knowledge, approvals and reporting lines. Where accounts conflict, the inconsistency should be tested against email, calendars, approvals, system logs and accounting data rather than resolved immediately by instinct. A final report should separate established facts, matters not established and material uncertainty, and show the evidentiary path for significant conclusions.

4. Whistleblowers, Authorities and Confidentiality: Treat Information Governance as Part of the Investigation

When the matter originates with a whistleblower, identity management is part of legal compliance, not an administrative detail. The current Whistleblower Protection Act and CAA guidance emphasize appropriate designation of whistleblower-response personnel, independence from senior management, exclusion of conflicted persons, prevention of disadvantageous treatment, prevention of attempts to identify the whistleblower and prevention of unnecessary sharing of identifying information. An investigation can create a second compliance failure if the reporter’s identity is disclosed beyond genuine need.

As of October 5, 2026, the major 2025 amendments to the Whistleblower Protection Act have been enacted but are not yet fully in force; the principal changes and revised guidance are scheduled for December 1, 2026. The revised guidance strengthens expectations regarding prevention of interference with reporting, attempts to identify reporters and retaliatory treatment. A long-running investigation should therefore comply with the law currently in force while also preparing the internal rules, training and information controls that will apply after December 1.

Where regulatory inspection, administrative investigation or criminal process is possible, authority-facing work and the internal investigation should be coordinated. The company still has independent responsibilities to stop ongoing harm, repair controls and exercise board oversight, but poorly sequenced interviews or inconsistent submissions can prejudice the authority response. Outside counsel should coordinate preservation, witness sequencing, document submissions, legal positions and external communications so that one workstream does not undermine another.

Lawyer involvement does not automatically place every investigation document behind a blanket privilege. Japan does not recognize one broad U.S.-style attorney-client privilege that operates identically across all procedures. The JFTC Determination Procedure is a limited regime for qualifying confidential communications with independent counsel concerning specified suspected antitrust conduct. It should not be generalized to all internal investigations. Multinational teams should therefore control report circulation, interview memoranda and legal-analysis documents with both Japanese disclosure risk and foreign privilege law in mind.

5. Listed Companies Should Run the Investigation and Timely Disclosure in Parallel

For a listed company, factual investigation and market disclosure should not be sequenced as if disclosure begins only after the report is final. The TSE Securities Listing Regulations and the July 2026 Timely Disclosure Guidebook may require repeated assessment at several milestones: when the concern becomes credible, when an outside committee is established, when financial or operational effects become material, when a report is received, and when accounting corrections or remediation are decided.

The difficult balance is speed against accuracy. Premature statements that “no violation occurred” or that the matter was “an isolated employee act” can become more damaging than the original incident if later findings contradict them. Prolonged silence can also erode investor, employee and counterparty confidence after material facts are known. Disclosures should therefore distinguish established facts, the company’s current understanding, unresolved matters, the scope of the investigation and the next procedural steps.

The relationship between the full investigation report and any public report should be planned early. The full report may contain personal information, trade secrets, counterparty data, litigation-sensitive legal analysis or information that could interfere with regulatory or criminal matters. Full publication is not always appropriate. But a public report stripped of material adverse findings can destroy the credibility of an otherwise independent investigation. The company should plan the full report, regulatory or audit materials and public report as different outputs based on the same factual foundation.

Where financial reporting is affected, coordination with the financial auditor is essential. Accounting treatment, internal-control reporting, correction of financial statements and exchange disclosure may need to proceed before the report is complete. Legal, investigation, audit and IR teams should operate from a common factual architecture so that the company does not present materially different versions of events to different stakeholders.

6. From Findings to Corporate-Value Recovery: Root Cause, Accountability and Remediation

A report that identifies only the direct wrongdoer usually does not answer the governance question. The company should ask why the conduct was not detected, why approvals failed, why employees did not escalate concerns, and why board, audit or subsidiary-oversight functions did not respond earlier. Aggressive targets, short-term incentives, concentrated authority, understaffing, weak expertise, deference to senior management, poor subsidiary governance and distrust of internal reporting may be more important than an individual’s ethics.

Japan Exchange Regulation’s misconduct-response Principles call for analysis of root causes rather than lists of superficial causes. Its January 2026 Handbook organizes actual remediation measures by cause and objective and is intended as a practical resource for boards, outside directors, auditors, internal audit, management functions and professional advisers. Remediation should therefore connect each measure to the cause it addresses, identify an owner and deadline, establish monitoring metrics and provide for internal-audit testing and board follow-up.

Neutral fact-finding and accountability should also be separated conceptually. The mandate should state whether the committee is expected to recommend disciplinary or director-responsibility measures, or whether it will limit itself to fact-finding and root-cause analysis, leaving employment, removal, damages claims or criminal complaints to the board or another competent body. Those decisions have separate legal requirements concerning employment rules, corporate law, procedural fairness and proportionality.

Investigations can also affect contractual and insurance rights. D&O and other policy notices, financing covenants, customer or supplier notice provisions, and post-M&A rights under an SPA or W&I policy may require action before the investigation concludes. Counsel should preserve those rights and deadlines without distorting the factual independence of the investigation.

7. Integrate the Investigation into One Corporate-Crisis Program

A serious misconduct investigation can involve the board, statutory auditors, legal, compliance, internal audit, HR, IT, finance, IR, communications, the financial auditor, outside counsel, forensic providers, accountants and foreign law firms. The key is not to let each function develop its own chronology and its own explanation. One evidence architecture, one master timeline and one decision-rights matrix should connect the workstreams.

The board’s work begins rather than ends when the report is delivered. Policies, authority matrices, reporting lines, whistleblower systems, audit plans, subsidiary oversight, staffing, compensation design, training and data governance may need to change. Each material remediation measure should have an owner, deadline and method of verification. If similar misconduct recurs, the central governance question may become not whether the company investigated the first incident, but whether the board supervised implementation of what the first investigation revealed.

Reputation management must also use the same verified facts. Search results, social media, press coverage and increasingly AI-search and generative-AI summaries can associate a company or executive with misconduct long after the immediate event. A short-term public statement that outruns the evidence can create a second credibility crisis. Legal analysis, board decisions, timely disclosure, counterparty communications and crisis communications should therefore remain consistent with the investigative record.

SAKURA Law Office and Managing Partner Kenshiro Michishita focus on designing an investigation process that can be explained and defended after the event. The investigation structure, evidence, forensics, interviews, whistleblower controls, disclosure, authority strategy, M&A and insurance rights, accountability and remediation should operate as one corporate-crisis program rather than a series of disconnected legal tasks.

Frequently Asked Questions

Q1. Should a company establish a third-party committee immediately whenever misconduct is suspected?

No. The appropriate structure depends on seriousness, possible management involvement, the independence and capability of internal functions, listing status, financial and regulatory impact, and stakeholder expectations. Some matters can be investigated internally; others require outside assistance or a fully independent committee.

Q2. If a committee consists entirely of outside lawyers, is it automatically independent?

No. External membership is only one factor. Commissioning authority, conflicts, scope, access to records, budget, secretariat arrangements, interview authority, reporting lines and control of the report all affect substantive independence.

Q3. May the company freely review all data on a company laptop or mailbox?

Not automatically. Company rules, employment relationships, necessity, proportionality, privacy, the APPI, trade secrets and the purpose of the investigation should determine scope. Technical access is not the same as unlimited legal entitlement to review.

Q4. May management be told the whistleblower’s identity?

Only where genuinely necessary for the investigation and response. The Whistleblower Protection Act and CAA guidance require controls against retaliation, attempts to identify reporters and unnecessary sharing of identifying information.

Q5. If lawyers conduct the investigation, are all materials protected by attorney-client privilege?

No. Japan does not provide a single broad U.S.-style privilege across every proceeding. Confidentiality and disclosure risk depend on the procedure and legal basis. The JFTC Determination Procedure is a limited example, not a general rule for corporate investigations.

Q6. Can a listed company wait for the final report before making any disclosure?

Not necessarily. Depending on materiality, TSE disclosure analysis may be required when the concern becomes credible, when an outside committee is formed, when financial effects become known, when the report is received, or when corrections and remediation are decided.

Q7. Must the full investigation report always be published?

No. Personal information, trade secrets, litigation risk and regulatory considerations may justify a separate public version. However, selective omission of material adverse findings can undermine the credibility of the process.

Q8. What if an employee refuses to participate in an interview?

The company should review employment rules, the employee’s duties, the nature and proportionality of the questions, the person’s status and any related criminal or regulatory process. Coercive methods can undermine both fairness and reliability.

Q9. Can a Japanese parent use the same investigation protocol for an overseas subsidiary?

Potentially, but local privacy, employment, data-transfer, regulatory and investigative rules must be checked. A Japan-designed preservation or forensic protocol should not be exported automatically without local-law review.

Q10. What is the most important feature of a remediation plan?

It should directly address the root causes established by the investigation. Adding more policies and training is not enough if the actual problem concerns authority, incentives, staffing, board oversight, whistleblower confidence, subsidiary governance or ineffective controls. Each measure should have an owner, deadline and verification mechanism.

About the Legal Update Series by Kenshiro Michishita

SAKURA Law Office publishes the Legal Update series through the profile of Managing Partner Kenshiro Michishita, addressing practical issues in corporate law, M&A, cross-border transactions, international disputes, AI and technology, data protection, corporate crisis management, internal investigations, third-party committees, defamation and reputation, Web3 and crypto, financial regulation, intellectual property and employment. The series is published in Japanese and English for companies, General Counsel, executives, investors and foreign law firms.

SAKURA Law Office official website — https://sakura-lawyers.jp/en/

Kenshiro Michishita, Managing Partner — Profile — https://sakura-lawyers.jp/en/lawyer/michishita-kenshiro/

How SAKURA Law Office Can Assist

SAKURA Law Office advises Japanese and foreign companies on first-response governance, whistleblower matters, internal investigations, outside investigation committees and independent third-party committees, scope and independence design, evidence preservation, digital forensics, interviews of officers and employees, privacy and cross-border data, director and employee accountability, regulatory and law-enforcement response, TSE timely disclosure, crisis communications, investigation reports, remediation, post-M&A investigations, W&I and other insurance issues, and cross-border investigations. Depending on the matter, we coordinate with forensic accountants, digital-forensics providers, financial advisers, auditors and foreign law firms so that fact-finding, legal analysis, governance and crisis management operate as one process.

Contact

For advice concerning corporate misconduct, whistleblower reports, internal investigations, third-party committees, crisis management or other Japanese corporate-law matters, please contact SAKURA Law Office.
SAKURA Law Office
4F Ark Hills South Tower, 4-5 Roppongi 1-chome, Minato-ku, Tokyo 106-0032, Japan
Kenshiro Michishita, Managing Partner
Web: https://sakura-lawyers.jp/en/

Principal References

1. Companies Act — e-Gov Laws (official Japanese text) — https://laws.e-gov.go.jp/law/417AC0000000086

2. Regulations for Enforcement of the Companies Act — e-Gov Laws (official Japanese text) — https://laws.e-gov.go.jp/law/418M60000010012

3. Whistleblower Protection Act — e-Gov Laws (current text and amendment scheduled for December 1, 2026) — https://laws.e-gov.go.jp/law/416AC0000000122

4. Consumer Affairs Agency — Whistleblower Protection Act and System Overview (current and December 1, 2026 frameworks) — https://www.caa.go.jp/policies/policy/consumer_partnerships/whisleblower_protection_system/overview

5. Consumer Affairs Agency — Whistleblower Handbook aligned with the December 2026 reform (June 30, 2026) — https://www.caa.go.jp/notice/entry/046748/

6. Act on the Protection of Personal Information — e-Gov Laws (official Japanese text) — https://laws.e-gov.go.jp/law/415AC0000000057

7. Personal Information Protection Commission — General Guidelines under the APPI (partially revised June 2026) — https://www.ppc.go.jp/personalinfo/legal/guidelines_tsusoku/

8. Personal Information Protection Commission — Laws and Policies / current rule materials — https://www.ppc.go.jp/en/legal/

9. Japan Exchange Regulation — Principles for Responding to Corporate Scandals (English) — https://www.jpx.co.jp/english/regulation/listing/principle/

10. Japan Exchange Regulation — Principles for Preventing Corporate Scandals (English) — https://www.jpx.co.jp/english/regulation/listing/preventive-principles/

11. Japan Exchange Regulation — Handbook for Strengthening Internal Controls and Preventing Corporate Misconduct (January 2026, Japanese) — https://www.jpx.co.jp/regulation/listing/handbook/index.html

12. Tokyo Stock Exchange — Guidebook for Timely Disclosure of Corporate Information (current Japanese edition: July 2026) — https://www.jpx.co.jp/english/equities/listing/disclosure/guidebook/index.html

13. Financial Services Agency / Tokyo Stock Exchange — Finalization of the Corporate Governance Code (2026 Revision) — https://www.fsa.go.jp/en/news/2026/20260721-2.html

14. Japan Exchange Group — Japan’s Corporate Governance Code (Revised July 2026) — https://www.jpx.co.jp/english/equities/listing/cg/

15. Japan Federation of Bar Associations — Guidelines for Third-Party Committees in Corporate and Other Misconduct (Japanese) — https://www.nichibenren.or.jp/library/ja/opinion/report/data/100715_2.pdf

16. Japan Fair Trade Commission — Determination Procedure (Japanese) — https://www.jftc.go.jp/dk/seido/hanbetsu/index.html

17. Japan Fair Trade Commission — Treatment of confidential attorney communications in the Determination Procedure (Japanese) — https://www.jftc.go.jp/dk/guideline/unyoukijun/hanbetsu.html

18. Financial Instruments and Exchange Act — e-Gov Laws (official Japanese text) — https://laws.e-gov.go.jp/law/323AC0000000025

19. SAKURA Law Office — Official Website — https://sakura-lawyers.jp/en/

20. SAKURA Law Office — Kenshiro Michishita, Managing Partner — Profile — https://sakura-lawyers.jp/en/lawyer/michishita-kenshiro/

Disclaimer

This article provides general information based on Japanese law, official and quasi-official materials, and general practice publicly available as of October 5, 2026. It does not constitute legal advice or a legal opinion concerning any specific matter. The appropriate response to suspected misconduct, the investigation structure, the need for an independent third-party committee, evidence preservation, digital forensics, employee interviews, personal information and cross-border data, whistleblower protection, administrative or criminal processes, TSE disclosure, director or employee responsibility, publication of investigation reports and remediation depend on the facts, the company’s governance structure, listing status, industry regulation, employment arrangements, contracts, applicable foreign laws and the rules in force at the relevant time. The Whistleblower Protection Act has major amendments scheduled for December 1, 2026, and Japan’s personal-data framework also continued to evolve during 2026. Specific matters should be assessed against the law and official materials in force when action is taken, with qualified Japanese counsel.