SAKURA Law Office | Legal Update by Managing Partner Kenshiro Michishita
October 1, 2026 (corrected October 16, 2026)
SAKURA Law Office | Kenshiro Michishita, Managing Partner
SAKURA Law Office has published the thirtieth edition of the Legal Update series by Managing Partner Kenshiro Michishita, entitled “Electronic Payment Instruments/Cryptoassets Service Intermediary Business in Japan — Market Entry, Scope of Intermediation, Affiliated-Provider Responsibility and Product Governance (2026).”
On June 1, 2026, Japan introduced a new registration category under the Payment Services Act for businesses that, when entrusted by a registered Electronic Payment Instruments Service Provider or Cryptoasset Exchange Service Provider, engage only in the intermediation of purchases, sales or exchanges without holding customer assets. The reform addresses a structural problem that had become increasingly important for games, non-custodial wallets, comparison and referral services, FinTech platforms and other digital businesses: a business could sit between a customer and a registered provider without becoming the transaction counterparty or custodian, yet still risk being treated as engaging in a fully regulated exchange or electronic-payment-instrument business.
The new regime should not, however, be understood as a simplified licence for any business that wishes to add cryptoassets or stablecoins to its product. It is a function-specific regime. Its premise is that the intermediary performs only a defined intermediation function, does not accept customer money or other assets, and operates on behalf of a registered provider that remains embedded in the supervisory and liability structure. Whether the regime is available therefore depends less on the description used in a business plan than on the actual customer journey: who prepares the product information, who recommends or solicits, who receives the order, who controls price and execution, where funds and tokens move, who controls private keys or signing authority, how APIs are permissioned, and who handles complaints, incidents and reversals.
This thirtieth Legal Update builds on two earlier parts of the series. No. 27 addressed Japan’s 2026 cryptoasset reforms and the forthcoming migration of the core cryptoasset regime from the Payment Services Act to the Financial Instruments and Exchange Act. No. 29 examined stablecoins and Electronic Payment Instruments, including issuance, redemption, foreign instruments and distribution. This Update focuses on the customer-facing layer: how a FinTech or Web3 business, online platform, game company, wallet provider, comparison service, overseas operator or regulated financial institution should determine whether conduct amounts to regulated intermediation, construct the affiliated-provider relationship, allocate responsibility and embed the regulatory boundary into the product itself.
The discussion reflects the Payment Services Act, related Cabinet Orders and Cabinet Office Orders, Financial Services Agency supervisory materials, Financial System Council materials and published self-regulatory rules available as of October 1, 2026. It also takes account of the amendments to supervisory guidelines that became applicable on October 1, 2026 following the revised inter-ministerial arrangements for reporting damage caused by cyberattacks. The relevant compliance architecture should therefore be designed not only for registration and launch, but for the continuing life of the service, including changes to features, marketing, outsourcing, systems and incident response.
Executive Summary
The most important practical question under the new Electronic Payment Instruments/Cryptoassets Service Intermediary Business regime is the boundary between a mere referral and regulated intermediation. The FSA’s supervisory approach looks to the substance and position of the conduct within the overall sequence leading to the conclusion of a transaction. Solicitation, product explanations made for solicitation purposes and negotiation of transaction terms will ordinarily point toward intermediation. By contrast, a simple link to a registered provider, unaltered republication of provider-prepared content, or a general explanation of how cryptoassets or Electronic Payment Instruments work may remain outside intermediation where there is no concrete inducement to contract. For digital businesses, this means that the legal analysis must extend to ranking algorithms, recommendation logic, calls to action, push notifications, A/B tests, conversational interfaces and customer-support scripts. UI and UX are not merely presentation layers; they can be part of the regulated act.
The new registration category is available only where the intermediary acts on behalf of an Electronic Payment Instruments Service Provider or Cryptoasset Exchange Service Provider that has entrusted the relevant intermediation. A business that independently carries on intermediation without that affiliated-provider structure may still fall within the full Electronic Payment Instruments Service Provider or Cryptoasset Exchange Service Provider regime. The registration process therefore requires the business model, the relevant Affiliated Provider, the scope and method of the service, outsourcing, internal controls and internal rules to be aligned from the outset. Registration is not a filing exercise added after the product has been designed; it is one element of the product architecture.
Non-custodial operation is a foundational condition of the lighter regulatory treatment. An intermediary must not accept customer money or other property in connection with the intermediary business, and the statutory structure is designed to prevent circumvention through certain closely related persons. Payment and token flows should therefore be designed so that fiat currency, Electronic Payment Instruments and cryptoassets do not pass through or remain with the intermediary. A wallet described as non-custodial may nevertheless raise a different licensing analysis if the intermediary can in substance control private keys, signing authority, recovery mechanisms or other powers that determine the movement of customer assets.
A proportionate regulatory regime does not mean proportionate liability in the ordinary commercial sense. The FSA’s materials place primary responsibility on the registered provider that entrusts the intermediary for ensuring user protection and the proper and reliable conduct of the intermediary activity, while the Payment Services Act also establishes statutory liability of the Affiliated Provider for certain losses caused by the intermediary in entrusted activities. The affiliation agreement must therefore operate as a regulatory control instrument. It should define the permitted products and customer journeys, pre-approval of advertising and interface changes, information sharing, complaint and incident escalation, outsourcing, audit and monitoring rights, record retention, allocation of responsibilities, suspension rights and termination arrangements.
The regime is also transitional in a broader sense. On July 15, 2026, Japan enacted legislation to move the core regulation of cryptoasset transactions from the Payment Services Act to the Financial Instruments and Exchange Act. The provisions that took effect on August 12, 2026 were only part of that reform, including strengthened penalties for unregistered activity and related enforcement powers; the central migration of the cryptoasset framework has not yet fully taken effect as of the date of this Update. Businesses must therefore comply with the current Payment Services Act intermediary regime now, while avoiding contractual and system designs that are unnecessarily difficult to adapt to the future FIEA framework.
1. Why the new regime exists: between full registration and a mere referral
Before the 2025 amendment to the Payment Services Act, a business that carried on the intermediation of a purchase, sale or exchange of cryptoassets or Electronic Payment Instruments could require registration as a Cryptoasset Exchange Service Provider or Electronic Payment Instruments Service Provider even if it never became the principal to the transaction and never took custody of customer assets. The Financial System Council’s working group identified this as a potentially disproportionate outcome for business models such as game applications and unhosted or non-custodial wallets that connect users to registered providers but do not themselves perform the functions that create the principal balance-sheet, safeguarding and settlement risks of a full exchange business.
The reform did not remove regulation from that customer-facing layer. Instead, it reallocated regulation according to function and risk. The registered provider remains the transaction counterparty or regulated execution provider, retains the asset-handling functions and carries the regulatory infrastructure associated with the underlying service. The intermediary is regulated for what it actually does at the interface with the customer: intermediation, explanations, advertising and solicitation, information governance, systems, complaints and related operational controls. The Affiliated Provider is then required to oversee that intermediary relationship, with the statutory framework extending responsibility beyond the immediate contracting entity at the customer interface.
That structure is critical to market-entry analysis. A company should not begin with the question whether it would prefer a lighter licence. It should map who is the contracting party, who creates and controls product and price information, who solicits or recommends, who receives instructions, who executes the transaction, who receives or controls assets, and who is responsible after execution for complaints, cancellation, refunds or rectification. Only after those functions are separated can counsel determine whether the proposed role genuinely remains within intermediation. The intermediary regime is not a reduced version of a full exchange licence; it is a distinct model built around a deliberate allocation of functions.
2. The boundary of intermediation: product interface is part of the regulatory analysis
Under the Payment Services Act, whether conduct amounts to intermediation is determined by substance rather than by the label applied to the service. The FSA’s supervisory materials treat the issue in the context of the sequence of conduct directed toward formation of the underlying transaction. They also make clear that carrying on a business is assessed by reference to public-facing and repeated or continuing activity, including activity planned as a continuing business even before a long operating history exists. It is therefore unsafe to isolate one technical step and conclude, for example, that there is no intermediation simply because the registered provider receives the final order.
The clearest indicators of intermediation are solicitation on behalf of another person, product explanations given for the purpose of solicitation, and negotiation directed toward conclusion of the transaction. In a digital product, those concepts must be translated into interface design. If a platform independently selects a particular cryptoasset, displays it as recommended for a user segment, ranks it above alternatives, supplies its own explanation of why the user should buy it, and places an immediate purchase path next to that explanation, the fact that the ultimate order page belongs to a registered exchange does not necessarily remove the platform from the transaction-forming process. A comparison service similarly presents a different risk profile when it merely reproduces provider-supplied facts than when it edits those facts, applies its own scoring methodology, creates a sponsored or personalized ranking, or frames one product as more suitable for a particular user.
The FSA materials also preserve room for genuine referrals. A simple link to the website of a registered provider, the unaltered display of materials prepared by that provider, general educational content about the mechanics of cryptoassets or Electronic Payment Instruments, and customer introductions without solicitation may remain outside intermediation where they do not amount to concrete inducement to enter into the transaction. The FSA has also discussed digital-service scenarios in which a game or other platform displays an opportunity to transact within its service, but the registered provider is clearly identified as the counterparty and the source of the transaction explanation, while the platform itself does not add or modify information, solicit, recommend, explain or negotiate. In an appropriately structured case, technical integration alone need not determine the regulatory result.
The practical lesson is that a disclaimer is not a regulatory architecture. A statement that a platform 'only introduces' a service will carry limited weight if the same screen independently promotes a particular token and the product logic nudges individual users toward purchase. Conversely, an embedded transaction window does not necessarily create intermediation if the registered provider remains clearly visible as the transaction and explanation provider and the platform does not perform an inducement function. A serious legal review should therefore examine not only screenshots, but content ownership, ranking logic, user segmentation, A/B testing, push notifications, chatbot responses, referral compensation, sales scripts and the way customer-support personnel answer product-specific questions.
Generative AI makes this boundary even more operationally important. Traditional compliance controls often assume that lawyers can pre-approve a fixed advertisement or explanation. A conversational system may instead generate a different product description or recommendation rationale for every user. If a chatbot can move from neutral education into individualized encouragement to transact, the business should define the permitted answer space, prohibited expressions, escalation rules, logging, human oversight and re-validation when the model or system prompt changes. Intermediation risk is therefore not only a legal drafting question; it is a product-governance issue spanning legal, compliance, marketing, data and engineering.
3. The Affiliated Provider model: registration, control and statutory responsibility
The intermediary regime assumes an entrusted relationship with a registered Electronic Payment Instruments Service Provider or Cryptoasset Exchange Service Provider. In this Update, that registered principal is referred to as the 'Affiliated Provider.' An intermediary acts for that provider within the scope of the entrustment. If a business independently carries on the intermediation of purchases, sales or exchanges without such an entrusted structure, the intermediary registration may not be sufficient, and the full provider-registration analysis remains necessary. The business model, the identity of the Affiliated Provider and the regulated service must therefore be defined before the registration strategy can be credible.
The application framework requires disclosure of the relevant Affiliated Provider, the type and method of business, outsourcing and other matters, while the implementing rules and supervisory process require the applicant to articulate its organization, internal control structure, responsible personnel, internal rules and the contractual basis of the affiliation. The absence of the same fixed financial and customer-asset safeguarding requirements that apply to a full exchange business is not a concession to small scale. It follows from the premise that the intermediary does not accept customer assets. If the operational flow contradicts that premise, the legal basis for the proportionate regime is itself undermined.
The Affiliated Provider is not a passive sponsor. The FSA’s supervisory materials emphasize that, although the intermediary must maintain its own user-protection and control framework, the registered provider is expected to bear primary responsibility for ensuring user protection and the proper and reliable performance of the entrusted intermediary business. Article 63-22-14 of the Payment Services Act also creates a statutory mechanism under which the Affiliated Provider may be liable, subject to the applicable requirements and defenses, for losses caused to users by the intermediary in the course of entrusted acts. This makes the relationship materially different from an ordinary distribution agreement.
Accordingly, the affiliation agreement should be drafted as part of the regulated control environment. It should identify the products, tokens, customer segments and territories within scope; allocate responsibility for legally required explanations; govern pre-approval of advertising, campaigns and material UI changes; restrict independent editing of provider-prepared information where appropriate; establish customer-inquiry and complaint escalation; require immediate notification of suspected fraud, system incidents and regulatory events; govern information sharing, record retention and audit; control subcontracting; allocate responsibility for remediation and indemnification; and provide suspension and termination mechanisms capable of protecting users while the commercial relationship is unwound.
Multi-provider models require particular discipline. A platform may wish to connect several registered providers and present a unified customer interface. In that case, both customers and internal teams should be able to identify which provider is responsible for which screen, product and transaction. If that allocation is blurred, ordinary disclosure becomes difficult and incident response becomes significantly more complex. The platform should therefore treat provider identity and responsibility mapping as part of the data model and system design, rather than as information added later to the terms of use.
4. Preserving the non-custodial boundary: asset flows, private keys and AML/CFT interfaces
The clearest statutory boundary of the intermediary regime is the prohibition on accepting customer money or other property in connection with the intermediary business. Article 63-22-13 of the Payment Services Act establishes that prohibition, and the implementing structure addresses circumvention through certain closely related persons. The requirement is not satisfied merely because the intermediary does not show a customer balance on its own ledger. Fiat currency, Electronic Payment Instruments and cryptoassets should be mapped through the entire transaction sequence to confirm that they do not pass through, settle into or remain in an account or wallet controlled by the intermediary.
Wallet products require a technical rather than marketing-based analysis. Calling a wallet 'non-custodial' is not conclusive if the operator can in substance determine asset movement through a private key, signing authority, recovery key, policy engine or combination of credentials. The same principle applies to API integrations. Counsel should distinguish a system that merely transmits transaction data from one that controls pricing, execution or asset movement in substance. A defensible legal analysis should therefore be based on key-management diagrams, signature and recovery flows, API permission sets, settlement sequences and manual fallback procedures, not only on the wording of the customer terms.
The creation of a lighter intermediation regime also does not mean that financial-crime risk disappears at the intermediary layer. The policy rationale for the reform recognized that core transaction verification and monitoring obligations can be concentrated at the registered provider because the intermediary is neither the asset custodian nor the transaction principal. Nevertheless, the intermediary remains subject to user-protection, information-security, misconduct and internal-control requirements, and it may possess data that the Affiliated Provider needs to perform effective AML/CFT and fraud controls. Device information, access patterns, referral data, contact histories and suspicious behavior identified before the customer reaches the provider may be operationally significant.
The affiliation architecture should therefore determine what information must flow from the intermediary to the registered provider, with what latency, in what format and subject to what data-protection controls. The same applies to sanctions alerts, account-takeover indicators, suspected social-engineering attacks and incidents involving compromised links or redirection. An intermediary should not create a data blind spot merely because the formal KYC process occurs downstream at the provider.
Product change management is particularly important. A company may initially design a service so that it never accepts customer assets, then later add a temporary advance, pooled balance, refund buffer, proprietary wallet or other convenience feature. A seemingly small UX improvement can therefore alter the regulatory classification. Each material feature release should include an explicit test of whether asset flows, key authority, credit exposure, settlement risk or the intermediary’s role in transaction execution has changed.
5. Embedding user protection into the product: disclosures, marketing, data governance, outsourcing and cybersecurity
Because the intermediary operates at the customer interface, user protection cannot be delegated entirely to the Affiliated Provider. The Payment Services Act and implementing rules impose requirements relating to identification of the relevant provider, information and explanations concerning the nature and conditions of the product, advertising and solicitation, secure handling of user information, outsourcing controls, books and records and other aspects of proper business conduct. For cryptoassets, disclosures include matters such as the fact that the asset is not Japanese or foreign legal tender, the possibility of losses caused by price movements, and information regarding the nature and characteristics of the relevant cryptoasset. Where the registered provider performs a prescribed explanation and duplication can be avoided, the operational design should still preserve evidence of who delivered which explanation and at what point in the customer journey.
Advertising is where classification and conduct regulation often converge. Banners, landing pages, social-media content, influencer campaigns, push notifications, referral codes and reward programs can move quickly from brand communication into transaction-specific inducement. A robust framework should combine internal legal and compliance approval with the approval rights of the Affiliated Provider, and should record not only the approved wording but the channel, duration, target population, ranking method and compensation relationship. Sponsored placement, recommendation logic, fee disclosures and potentially manipulative interface design should be reviewed together rather than in separate organizational silos.
Data governance and outsourcing are similarly central. An intermediary may collect customer attributes, transaction intent, device information, access logs and other data closely associated with financial activity. That information must be managed not only under the Act on the Protection of Personal Information but also as part of the financial-regulatory control environment. Cloud services, CRM tools, KYC vendors, customer-support platforms, generative-AI systems and analytics tools should be subject to due diligence and contractual controls covering access, security, subcontracting, incident notification, data location, return or deletion at exit, and the ability of the intermediary and Affiliated Provider to obtain information needed for supervision and incident response. Article 58 of the applicable Cabinet Office Order requires the prescribed records of intermediary activities to be retained for at least ten years from the closing of the books. Domestic preservation is the rule; the provision permits specified alternatives, including timely preservation of copies in Japan for records made at a foreign office, or electronic records that can be viewed without delay at a domestic business office. This is not a blanket ten-year rule for every item of analytics or technical log data. The required transaction records, their retention starting point and the legal basis for retaining other personal data should be distinguished when designing the data architecture.
System risk is not peripheral merely because the intermediary does not custody assets. The FSA’s supervisory materials address management awareness of system risk, board-level system strategy, segregation between development and operations, security policies, outsourcing, contingency planning and incident response. An intermediary can cause serious customer harm through account takeover, manipulated links, API abuse, phishing, altered product explanations or leakage of sensitive user information even where the underlying assets remain with the registered provider.
The current supervisory environment also requires attention to incident reporting. Following the revised inter-ministerial arrangements concerning reporting of damage caused by cyberattacks, amendments to the relevant FSA supervisory guidelines became applicable on October 1, 2026. Intermediaries and Affiliated Providers should update their incident procedures and align reporting channels, decision rights and initial response timelines in advance, so that an incident is not delayed while the parties debate who is responsible for reporting.
6. Cross-border services: targeting Japan and choosing a market-entry architecture
An overseas wallet, game, trading application or FinTech platform should not assume that incorporation or hosting outside Japan removes the service from Japanese financial regulation. The Payment Services Act restricts solicitation into Japan by unregistered foreign Electronic Payment Instruments/Cryptoassets Service Intermediary Businesses, and the FSA’s supervisory materials address how internet-based cross-border activity should be structured where a foreign business seeks to avoid targeting persons located in Japan.
The FSA’s analysis is practical rather than limited to the language of a website. Relevant safeguards include procedures to identify user location from address, mailing details, email information, payment method and other data, and measures not to accept orders where there are reasonable grounds to believe that the person is located in Japan. The materials also refer to avoiding Japan-targeted call centers and links from websites directed at persons in Japan. In practice, app-store availability, Japanese-language interfaces, yen display, domestic advertising, Japanese customer support, local influencers or KOLs, domestic events, payment methods and acquisition campaigns may all contribute to the overall assessment of whether the service is effectively directed at the Japanese market.
A foreign business that intends to enter Japan affirmatively should therefore choose an architecture rather than drift into one. Depending on the functions it wishes to retain, the principal routes may involve obtaining the full provider registration, registering under the intermediary regime within an Affiliated Provider relationship, or limiting the Japanese-facing role to referral or technology services while the regulated Japanese provider performs the transaction-forming functions. The choice affects not only licensing cost, but control of the brand, customer data, interface, product selection, revenue share, future licence expansion and the ability to migrate customers if the partnership ends.
For that reason, Japan market entry should not be reduced to a yes-or-no registration opinion. A serious cross-border analysis should integrate regulatory perimeter, customer journey, contracting structure, data transfer, marketing strategy, systems permissions, local support and the economics of the affiliated-provider relationship. The legal structure should support the commercial model rather than merely sit beside it.
7. Designing simultaneously for the current Payment Services Act and the forthcoming FIEA migration
The timing of the 2026 reforms creates an unusual planning problem. The Electronic Payment Instruments/Cryptoassets Service Intermediary Business regime became effective on June 1, 2026. Only weeks later, on July 15, 2026, legislation was enacted to move the core regulation of cryptoasset transactions from the Payment Services Act to the Financial Instruments and Exchange Act. The provisions that became effective on August 12, 2026 were limited to part of the wider reform, including stronger penalties for unregistered activities and related enforcement powers. As of the cut-off date of this Update, the central migration of the cryptoasset regulatory framework has not yet fully taken effect. Businesses conducting cryptoasset intermediation must therefore comply with the current Payment Services Act regime now.
At the same time, it is not commercially sensible to hard-code a multi-year platform around assumptions that may change when the FIEA migration is implemented. The Financial System Council’s work on the cryptoasset regime has contemplated moving cryptoasset intermediation into the FIEA framework with appropriate transitional arrangements and adapting regulatory concepts used for financial instruments intermediation. The final implementing orders, supervisory guidance and transitional measures will need to be monitored as they are completed, but businesses can already design for change by modularizing provider relationships, permissions, advertising controls, personnel governance, record structures, product information and conflicts-management capabilities.
For a new entrant, the first step should therefore not be drafting the registration form. The business should map the existing or proposed user journey and classify each relevant function — referral, intermediation, purchase or sale, exchange, custody or management — across every material screen, message, API and asset flow. It should then redesign the product to remain inside the desired regulatory boundary, negotiate the Affiliated Provider’s control and responsibility model, and align internal rules, systems, contracts and customer disclosures around one coherent operating model. Registration review and product launch should be treated as one integrated workstream.
The same point applies from the registered provider’s perspective. An intermediary channel can expand distribution and reach new user segments, but the provider accepts primary supervisory responsibility and potential statutory exposure in return. Due diligence on the intermediary, ongoing monitoring of interface and advertising changes, system-integration review, controlled change management and effective suspension rights are therefore essential. The new regime can widen the distribution architecture for FinTech and Web3 services in Japan, but its durability depends on whether the intermediary and Affiliated Provider can operate as a single regulatory system rather than as two companies connected only by a commercial referral agreement.
FAQ — Practical Questions for General Counsel, Founders and Product Teams
Q1. Does placing an affiliate link to a registered cryptoasset exchange automatically require intermediary registration?
No. The FSA’s supervisory materials recognize that a simple link or a customer introduction without solicitation can remain outside regulated intermediation. The analysis changes where the platform adds its own recommendation, explains why a particular token or service should be purchased, personalizes the ranking to the user, or otherwise forms part of the inducement to contract. Compensation is relevant to the commercial context but is not, by itself, the legal test. The content and the full user journey should be reviewed.
Q2. Can a comparison website rank exchanges or cryptoassets without becoming an intermediary?
Potentially, but the legal risk increases as the operator moves from neutral presentation into recommendation. Reproducing provider-supplied information is different from editing the information, creating a proprietary score, placing products in a recommended order, personalizing rankings or connecting that ranking directly to a transaction call to action. The ranking criteria, sponsorship, display logic, wording and user segmentation should be reviewed together.
Q3. Can a non-custodial wallet use the new regime to integrate cryptoasset purchases?
Potentially. The structure is most consistent with the regime where the wallet operator is entrusted by a registered exchange to perform only intermediation, does not accept customer assets, does not in substance control private keys or transaction execution, and the registered exchange remains the counterparty and execution provider. A wallet that can in substance move customer assets or independently execute transactions requires a broader licensing analysis regardless of how the product is described.
Q4. If a game allows a user to purchase cryptoassets inside the game interface, is the game company necessarily an intermediary?
Not necessarily. The FSA has contemplated cases in which a digital service can present a transaction opportunity without itself performing intermediation where the registered provider is clearly identified as the counterparty and source of transaction information and the platform does not independently add, modify, recommend, solicit, explain or negotiate the transaction. The actual interface, reward mechanics and purchase prompts must nevertheless be reviewed on their facts.
Q5. May an intermediary receive customer money or cryptoassets for only a few seconds before forwarding them to the registered provider?
That design should be approached with significant caution. The Payment Services Act prohibits an intermediary from accepting money or other property from users in connection with the intermediary business and does not create a general safe harbor based on how briefly the asset is held. Where the desired user experience appears to require temporary receipt, the parties should first consider a structure in which assets move directly to the registered provider or are handled by another appropriately regulated participant.
Q6. Are intermediaries subject to the same capital, segregation, cold-wallet and AML/CFT rules as a full cryptoasset exchange?
No. The reform was designed in part to avoid imposing an asset-custody regulatory package on a business that performs only intermediation and does not accept customer assets. The intermediary is nevertheless subject to user-protection, disclosure, advertising, information-security, systems, outsourcing, recordkeeping and misconduct controls, and it must support the Affiliated Provider’s financial-crime framework through appropriate information sharing. It is a different risk-based regime, not an unregulated or merely administrative registration.
Q7. Can the Affiliated Provider be liable if the intermediary gives an incorrect explanation and the customer suffers loss?
Yes, potentially. The Payment Services Act establishes statutory responsibility of the Affiliated Provider for certain losses caused by the intermediary in entrusted activities, and the FSA’s supervisory approach assigns the registered provider primary responsibility for user protection and proper conduct of the intermediary business. The actual outcome depends on the statutory requirements, the scope of the entrustment, the conduct in question and the provider’s supervision. Contractual indemnities between the companies do not simply eliminate public-law or customer-facing statutory responsibility.
Q8. Does an overseas Web3 service require Japanese registration merely because a person in Japan can access the website?
Accessibility alone does not determine the result. The issue is whether the business is soliciting or effectively targeting persons located in Japan. The FSA looks to practical measures concerning user location and to whether the service uses Japan-directed channels. Japanese-language support, yen display, local advertising, domestic influencers, Japan-specific promotions and app-store distribution can be relevant. A foreign platform should therefore decide deliberately whether it is excluding Japan or entering the Japanese market and build its controls accordingly.
Q9. Is it still worth preparing intermediary registration now that Japan has enacted the future migration of cryptoasset regulation to the FIEA?
Yes. The current intermediary regime has been in force since June 1, 2026 and continues to govern relevant conduct today. The legislation enacted in July 2026 has not yet brought the central cryptoasset migration fully into effect. A business must therefore be compliant under current law while structuring contracts, systems and governance so that future implementing rules and transitional arrangements can be accommodated without unnecessary rebuilding.
About the Legal Update by Managing Partner Kenshiro Michishita
SAKURA Law Office and Managing Partner Kenshiro Michishita publish the Legal Update series on corporate law, M&A, financial regulation, FinTech and Web3, IT and AI, data protection, cross-border transactions and corporate crisis management. The series is intended not merely to describe legal developments, but to translate legislation, regulatory materials and market practice into decisions concerning business models, transactions, contracts, governance, investigations and regulatory strategy for boards, General Counsel, legal and compliance teams, financial institutions, PE and VC investors, overseas companies and business leaders.
For further information, please see the SAKURA Law Office official website and the profile of Managing Partner Kenshiro Michishita.
How SAKURA Law Office Can Assist
SAKURA Law Office advises on the regulatory perimeter of the Electronic Payment Instruments/Cryptoassets Service Intermediary Business, including legal analysis of whether a customer journey amounts to referral or regulated intermediation; UI and product review for games, wallets, comparison services and FinTech platforms; preparation for registration, internal rules and regulatory submissions; affiliation agreements and allocation of responsibilities with Cryptoasset Exchange Service Providers and Electronic Payment Instruments Service Providers; advertising and solicitation controls; information governance, outsourcing and system-risk frameworks; Japanese market-entry structures for overseas businesses; and responses to regulatory inquiries, inspections and administrative matters.
We also advise on transition planning in light of the 2026 amendments that will move the core cryptoasset regulatory framework toward the Financial Instruments and Exchange Act. For both new entrants and existing services, it is important to test whether product changes have moved the business beyond a referral function, altered custody or execution characteristics, or otherwise changed the registration analysis. Regulatory architecture, contractual architecture and product architecture should be reviewed together.
Contact
SAKURA Law Office
Ark Hills South Tower 4F, 1-4-5 Roppongi, Minato-ku, Tokyo 106-0032, Japan
Managing Partner Kenshiro Michishita
https://sakura-lawyers.jp/en/lawyer/michishita-kenshiro/
Principal References
11. Financial System Council, publication page for the Working Group on Payment Services Systems report
12. Financial System Council, Working Group on Payment Services Systems — Report
14. Japan Virtual and Crypto Assets Exchange Association (JVCEA), Rules and Guidelines
15. JVCEA, Rules and Guidelines concerning Cryptoasset Intermediary Activities
16. JVCEA, Rules and Guidelines concerning Entrustment of Cryptoasset Intermediary Activities
17. JVCEA, Rules and Guidelines concerning Electronic Payment Instrument Intermediary Activities
Disclaimer
This Legal Update is based on statutes, regulations, regulatory materials, self-regulatory rules and other public information available as of October 1, 2026 and is provided for general informational purposes only. It does not constitute legal advice concerning any specific matter. Whether a service falls within the Electronic Payment Instruments/Cryptoassets Service Intermediary Business regime, whether registration is required, and how the applicable obligations should be implemented depend on the specific functions of the service, UI and UX, contractual relationships, asset and data flows, solicitation and explanation practices, customer base and cross-border elements. Specific legal advice should be obtained before implementing or materially changing a service.
The 2026 amendments to the Financial Instruments and Exchange Act and Payment Services Act include provisions that have not yet fully taken effect as of the cut-off date of this Update. Effective dates, implementing Cabinet Orders and Cabinet Office Orders, supervisory guidance, transitional measures and related practice may continue to develop. Businesses should confirm the latest legislation and official FSA materials when making regulatory or commercial decisions.