A trading house with Asia-Pacific distribution routes runs a quarterly screen of its counterparty list. The Japan regime flags appear peripheral – no headline designation, no obvious red list match. The compliance team files the report and moves on. Six months later, an export of controlled goods has moved to an end-user whose affiliates appear on the Ministry of Economy, Trade and Industry's watch lists. The deal has closed. The window for voluntary disclosure is narrowing.
A compliance audit and testing programme under Japan's sanctions and export-control regime requires systematic review of four interlocking obligations: the Foreign Exchange and Foreign Trade Act (FEFTA, Japan's primary instrument governing foreign transactions and export controls), the Ministry of Economy, Trade and Industry (METI) licensing and screening requirements, the Ministry of Finance (MOF) asset-freeze rules, and the alignment of internal controls with those obligations. As of July 2026, Japan's autonomous sanctions and export-control rules operate alongside UN Security Council measures, and a business with Japan-nexus supply chains or counterparties must audit both layers.
This guide walks through the audit and testing procedure in sequence: how to map the regime's scope, how to structure the testing cycle, where the cross-regime comparison with OFAC and OFSI changes the risk picture, and when to involve external counsel.
What legal framework governs compliance in Japan?
FEFTA is the governing instrument. It places export-licensing obligations on exporters and re-exporters, and it gives METI the authority to control the movement of controlled goods, software, and technology. The MOF administers asset-freeze measures that derive both from UN Security Council resolutions and from Japan's autonomous sanctions decisions. Both agencies have enforcement authority; penalties can include criminal prosecution and administrative prohibition orders.
METI operates the Foreign End-User List – a watch list of entities of concern, analogous in function to the US Entity List administered by BIS under the Export Administration Regulations (EAR). Appearance on that list does not automatically prohibit a transaction, but it triggers a heightened licensing obligation and a mandatory end-use inquiry. A compliance audit must test whether the firm's screening tools reach that list and not just the UN Consolidated List or the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons).
Japan's autonomous asset-freeze designations are published by the MOF. These operate separately from METI's export-control watch lists. A compliance programme that conflates the two risks screening against the wrong list for the wrong transaction type. In our experience, this conflation is the single most common structural gap we find when we first review a client's Japan-facing controls.
Step 1 – Map the scope of your Japan exposure
Before any test is run, the audit must establish which obligations actually apply. The scope exercise answers five questions: Does the business export goods, software, or technology that originates in Japan or passes through Japan? Does it hold assets, accounts, or payment flows connected to Japan-designated persons? Does it have counterparties that appear on the METI Foreign End-User List? Does it operate a subsidiary or branch in Japan? Does it export items to third countries under circumstances where Japanese re-export controls could reach the transaction?
Each affirmative answer adds a layer to the audit scope. A pure importer of Japanese components may face only the asset-freeze layer. An exporter of dual-use goods to Asian markets may face the full FEFTA export-licensing layer plus end-use controls. A financial institution processing yen settlements may face both the asset-freeze and the transaction-reporting layer.
Mapping the scope also identifies which internal teams carry the obligation. Trade operations, treasury, compliance, and legal may each hold a piece of the Japan exposure. An audit that reviews only the compliance team's screening logs misses the export-operations team's shipping instructions and the treasury team's payment-approval records. Scope mapping should produce a written register of obligation owners before testing begins.
Step 2 – Structure the testing cycle
A testing cycle under the Japan regime should cover three planes: transactional testing, control testing, and scenario testing.
Transactional testing reviews a sample of completed transactions against the obligations that applied at the time of execution. It asks: was the counterparty screened at the right point in the transaction lifecycle? Was the correct list consulted? Was a licence obtained where one was required? Was the end-use documentation collected and retained? The sample should be risk-weighted – higher-risk sectors (semiconductors, advanced materials, aerospace components) warrant larger samples and deeper file review.
Control testing examines whether the systems and procedures are fit for purpose independent of any particular transaction. It tests whether the screening tool is connected to updated lists, whether the update frequency is adequate, whether alert thresholds produce false-negative rates that the firm can quantify, and whether escalation paths are actually followed when an alert fires. Do your screening records show the version of the list that was consulted? That detail matters when a regulator reviews your records.
Scenario testing runs the compliance programme against hypothetical fact patterns designed to stress its edges. A well-designed scenario might introduce a counterparty that does not appear on any list but whose ultimate beneficial owner does, or a re-export of a controlled item where the first destination is not subject to a licence requirement but the end destination is. Japan's re-export controls under FEFTA have extraterritorial reach in defined circumstances, and scenario testing should probe whether the programme would catch a violation in that posture.
The position above covers the standard audit structure. Your facts – the goods you move, the jurisdictions in play, the ownership structure of your counterparties – change the depth and the priority of each plane. If you are uncertain which plane to prioritise, contact Calder & Vance at info@caldervance.com.
How does Japan differ from OFAC and OFSI on ownership and control?
Japan's asset-freeze rules use an ownership-and-control test to determine whether a non-listed entity is caught through its relationship with a listed person. The test is broadly analogous to the UK OFSI and EU approach: control – not just a fixed ownership percentage – can bring an unlisted entity within scope. This contrasts with the OFAC position, where the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) is a mechanical numerical threshold.
What does this mean for a compliance audit? Under OFAC, the ownership analysis is a percentage calculation. Under Japan's MOF rules, and similarly under OFSI and the EU, the analysis also asks whether a listed person can exercise decisive influence over an entity – through contractual rights, board control, veto powers, or de facto operational authority – even if formal ownership sits below any trigger level. A compliance programme calibrated only to the OFAC numerical test will under-detect exposure under Japan, UK, and EU rules.
Cross-regime auditing therefore requires the ownership-and-control analysis to run in two modes. The numerical screen captures the OFAC layer. A qualitative control analysis captures the Japan, OFSI, and EU layer. We regularly advise clients that their beneficial-ownership due diligence collects the data needed for the numerical screen but does not ask the questions needed for the control test. Fixing that gap requires revising the due-diligence questionnaire, not just the screening tool.
Japan also diverges from OFAC on licensing architecture. FEFTA operates a prior-approval system for controlled exports that is distinct in structure from OFAC's specific-licence (specific licence: a case-by-case authorisation to conduct an otherwise prohibited transaction) mechanism. METI's licensing window and evidentiary requirements differ in material respects from OFAC's. A compliance programme designed around the OFAC licence structure will not map cleanly onto FEFTA requirements without adjustment. The audit should test whether licence applications under FEFTA follow METI's specific procedural requirements and not a repurposed OFAC workflow.
If a transaction has already been flagged, or a filing has been made under the wrong procedure, an early review of the Japan-specific requirements can preserve options that narrow with time. Contact our team at info@caldervance.com for a confidential review.
Step 3 – Test record-keeping and reporting obligations
Record-keeping under Japan's export-control regime requires exporters to retain transaction records for a defined period. Verify the current retention requirement under FEFTA before relying on any specific figure, as the applicable obligation can change. The audit should confirm that records are retained in the correct form, that they are accessible to the compliance function without routing through the business line, and that they contain the information METI would require in an inspection: licence details, end-user statements, shipping documentation, and screening records.
Reporting obligations also apply when a business identifies an apparent breach. Japan's framework does not have a formalised voluntary self-disclosure (VSD: voluntary self-disclosure to a regulator) programme comparable to the OFAC VSD mechanism, but engaging with METI or the MOF early in a potential breach scenario is generally preferable to awaiting regulatory contact. The absence of a formal VSD regime does not mean that self-reporting carries no weight. In our cross-border practice, we have seen cases where early, documented engagement with the relevant Japanese authority produced a more proportionate regulatory response than silence followed by investigation.
The audit should also test whether the business has a documented internal-escalation procedure for potential violations. This includes the trigger for legal review, the timeline for internal investigation, and the decision authority for any external disclosure. A procedure that exists only in the compliance manual but has never been tested through a tabletop exercise will not perform under the pressure of an actual incident.
Step 4 – Identify risk flags and design remediation
Compliance testing generates findings. The value of the exercise depends on how those findings are triaged and acted upon. The audit should produce a risk register that distinguishes between three categories of finding: systemic gaps (a screening tool that does not reach the METI list, a due-diligence process that omits the control test), transactional gaps (individual transactions where the required controls were not applied), and documentation gaps (transactions where the controls were applied but the records are incomplete).
Systemic gaps require redesign of the programme. Transactional gaps require a look-back review to quantify the historical exposure. Documentation gaps require remediation of the records and consideration of whether the gap is significant enough to warrant regulatory engagement.
Risk flags that recur across the Japan regime include: screening against only the UN Consolidated List without supplementing it with METI and MOF lists; beneficial-ownership analysis that stops at direct shareholders rather than tracing ultimate ownership through intermediate holding structures; end-use documentation that was collected but not reviewed for red flags before the transaction was approved; and export-classification decisions made by the logistics team rather than a trained compliance officer.
Remediation planning should set a priority order, assign an owner for each action, and establish a retesting date. A compliance audit without a remediation plan is a diagnostic without a treatment pathway. External counsel can assist in structuring the remediation to meet the standard that METI or the MOF would apply in an inspection.
Common myths and practical misconceptions
A persistent misconception among businesses with Japan-nexus exposure is that Japan's sanctions regime is narrower in scope than OFAC or the EU and therefore requires less intensive compliance infrastructure. This is not accurate. Japan maintains an autonomous sanctions regime that extends beyond UN Security Council requirements, covering a range of designated persons and entities. METI's Foreign End-User List is actively maintained and is not a short document. The FEFTA export-licensing regime applies to a broad range of dual-use goods and technologies, and METI conducts inspections.
A related misconception is that compliance infrastructure designed for OFAC automatically satisfies the Japan requirement. The ownership-and-control divergence outlined above illustrates why this is not so. OFAC tools are optimised for the numerical ownership threshold. Japan, OFSI, and the EU require a control analysis that a pure percentage-based tool will not perform. Building the Japan requirement into an existing OFAC-centric programme requires targeted additions, not just a list update.
We have acted for businesses that discovered both gaps simultaneously – their OFAC programme was well-maintained but their Japan compliance had been treated as an afterthought. Bringing those programmes into alignment required a structured gap analysis and a phased remediation over several months. There is no shortcut where a business has meaningful Japan-facing exposure and has not tested its controls against the Japan-specific requirements.
Related practices
- Compliance audit and testing – Australia – structured audit and testing for the Australian autonomous sanctions regime and DFAT obligations.
- Compliance audit and testing under Japan (advanced guide) – deeper analysis of FEFTA licensing, end-use controls, and METI inspection preparation.
- Compliance audit and testing under OFAC – OFAC-specific audit methodology, the five-element compliance programme standard, and VSD considerations.