A payment platform based in one jurisdiction routes digital-asset transfers through a Japanese exchange partner. A routine transaction-monitoring alert flags a wallet address. The compliance team hesitates: is this a Japan-regime obligation, a United States OFAC exposure, or both? The answer determines who acts, how quickly, and what disclosure obligations attach.
Crypto and VASP sanctions compliance under the Japan regime is governed by the Foreign Exchange and Foreign Trade Act and administered by the Ministry of Finance, with the Financial Services Agency playing a central supervisory role for virtual-asset service providers. Japan's obligations run in parallel with – and can diverge from – OFAC and EU requirements, meaning a transaction flagged under one regime may be permissible or separately prohibited under another.
This case comment traces an anonymised matter in which a cross-border VASP faced exactly that multi-regime collision. It sets out the legal question, the analysis across regimes, the route taken, and the lesson for virtual-asset businesses handling Japan-connected flows.
The situation: what the business was doing and why it raised a flag
The client was a virtual-asset service provider incorporated outside Japan, operating a platform that processed transfers denominated in digital assets on behalf of institutional and retail users across several time zones. Its Japanese exchange partner was regulated under Japan's applicable VASP licensing regime, administered by the Financial Services Agency.
The platform's transaction-monitoring system generated an alert against a wallet address associated with a counterparty whose ultimate beneficial owner appeared on a designation list. The designation was not a Japan-only listing. It appeared on multiple regimes simultaneously – including the consolidated list maintained under United Nations Security Council authority and a parallel designation under US OFAC rules. The platform's compliance team identified the overlap within hours, but the question was immediate: did Japan's asset-freeze and prohibition rules require action before the OFAC obligations, after, or at the same time?
The platform had no prior experience working through a concurrent Japan and OFAC matter. Its internal sanctions policy had been designed primarily around OFAC screening, with Japan treated as a secondary consideration. That asymmetry in the programme was the first risk factor that materialised.
What is the legal question that a VASP faces when Japan and OFAC obligations run simultaneously?
When a VASP faces concurrent obligations under Japan's applicable country regime and OFAC, the controlling principle is that the stricter prohibition governs each step – but the procedural obligations are regime-specific and cannot be consolidated into a single filing.
Under Japan's rules, a VASP handling a transaction involving a designated person or entity is required to freeze assets and report to the relevant authority within the applicable statutory window. That window is short. The obligation is direct: it does not depend on whether the transaction is denominated in yen or in a digital asset, and it applies to entities with a sufficient Japan nexus even if they are not incorporated there.
OFAC operates on a different trigger and a different reporting structure. Blocked property must be reported within a short statutory period after the blocking event. The obligation runs to any US person and – through secondary-sanctions exposure – reaches non-US persons in some circumstances. The two regimes use different definitions of "blocked property," different lists, and different licensing channels. A transaction that is licensed under one regime is not thereby licensed under the other.
In our cross-border practice, we regularly advise VASPs that assume a UN-listed designation resolves the analysis. It does not. A Security Council listing creates obligations under the domestic implementing measures of each member state separately. Japan's implementing measures, the OFAC implementing measures, and the EU Council regulations each have their own scope, their own asset definitions, and their own procedural requirements. The UN list is the floor; domestic regimes can and do add obligations above it.
How the matter developed: the legal analysis in practice
The first task was to verify the designation status across all three relevant regimes – Japan, OFAC, and the UN Consolidated List. The beneficial-owner match appeared on all three. That confirmation resolved the threshold question: the transfer was prohibited under each regime, and the platform's obligation to freeze and report arose simultaneously under each applicable set of rules.
The second task was more difficult. The platform needed to determine whether its Japan nexus was sufficient to trigger the domestic reporting obligation directly, or whether that obligation fell primarily on its Japanese exchange partner. The answer turned on the structure of the routing arrangement. Because the platform held the transaction data and had contractual control over the transfer instruction at the point of the alert, both the platform and the exchange partner carried a reporting exposure. Joint exposure of this kind is not unusual in VASP-to-VASP transfer chains; it is one of the operational features of digital-asset flows that Japan's applicable rules address explicitly.
The third issue was timing. The platform had frozen the transfer correctly. The question was how to manage the reporting obligations under two regimes without the reports conflicting. We advised that the reports should be filed separately to each authority, in the form and within the window required by each regime, and that neither report should be delayed pending the other. Where the two authorities' requirements overlapped in substance, the report to each could reference the other jurisdiction's parallel filing – but that cross-reference does not substitute for the full disclosure required by each regime's own rules.
One further complication arose from the travel-rule obligations that apply to VASP-to-VASP transfers under Japan's rules. The travel rule requires that identifying information about the originator and beneficiary of a virtual-asset transfer accompanies the transaction. In this matter, the flagged wallet address appeared at the beneficiary layer. The travel-rule data the platform had received from the originating VASP was incomplete. That gap compounded the compliance exposure: the platform was dealing not only with a sanctions freeze obligation but also with a deficient information chain. We assisted in documenting the gap and framing the remediation steps for inclusion in the reporting package.
Cross-regime divergence: where Japan, OFAC, and EU rules produce different answers
The divergence between Japan's applicable regime, OFAC, and EU Council regulations matters most for three practical questions: the ownership and control test, the definition of "virtual assets" within scope, and the treatment of incomplete travel-rule data.
On ownership and control, OFAC applies the 50 percent rule (the rule treating entities owned 50 percent or more by blocked persons as themselves blocked), which is mechanical and additive. Japan's rules and the EU Council regulations both apply an ownership and control analysis, but the control element can extend the prohibition to entities that fall below the mechanical ownership threshold. In this matter, the ultimate beneficial owner's holding in the flagged wallet's associated entity was just below fifty percent. Under OFAC's mechanical test, the entity was not directly blocked by the ownership rule alone. Under the Japan regime and the EU analysis, the control question remained open. That divergence required separate analysis for each regime rather than a single pass.
On the scope of "virtual assets," Japan's applicable rules cover a defined category of crypto-assets that includes the asset type used in this transaction. The EU's applicable instruments cover a broadly comparable category. OFAC's approach is property-based: any property in which a designated person has an interest is blocked, regardless of the asset form. The practical effect is that the OFAC prohibition is typically wider, but the licensing route for each regime is separate.
On travel-rule gaps, Japan's rules impose obligations on both the originating and receiving VASP to obtain, verify, and transmit counterparty information. Where that information is missing or incomplete at the point of a compliance alert, the receiving VASP faces a concurrent question: does the gap create an independent breach exposure, separate from the sanctions freeze? In this matter, the answer was yes. We assisted the client in scoping the two exposures separately and preparing the necessary remediation documentation.
The position above covers the standard analytical structure. Your facts – the asset type, the routing chain, the jurisdictions involved, the nature of the wallet relationship – change the analysis materially. For a review of your current exposure across the Japan, OFAC, and EU regimes, contact Calder & Vance at info@caldervance.com.
What is the lesson for similar businesses operating across Japan and other regimes?
The central lesson is that a compliance programme designed around one regime – even OFAC, the most broadly extraterritorial – is not a substitute for a programme that addresses Japan's distinct obligations directly.
Four specific gaps appear repeatedly in our practice when we review VASP compliance programmes with Japan-connected flows.
First, the screening configuration. Most platforms screen against the OFAC SDN List and the UN Consolidated List as a baseline. Fewer platforms screen systematically against Japan's designated-persons list as maintained by the relevant authority. A counterparty who appears on the Japan list but not on OFAC's list will pass through a programme configured only to the US baseline.
Second, the ownership and control mapping. A compliance programme that applies only the OFAC fifty-percent test will miss entities caught by Japan's broader control analysis. Ownership-chain mapping needs to be calibrated to the most demanding applicable test, not the most familiar one.
Third, the travel-rule integration. Japan's travel-rule requirements apply to the platform's counterpart relationships, not merely to the transactions themselves. A programme that treats travel-rule compliance as a separate operational function from sanctions screening will generate exactly the gap this matter illustrated.
Fourth, the reporting calendar. The obligation to freeze and report under Japan's rules runs to a specific window from the date of knowledge. If a platform's internal escalation process is designed around OFAC's reporting calendar, it may miss Japan's window. The reporting obligation is not satisfied by filing one report to one authority; each regime requires its own timely response.
Have you mapped the full reporting calendar across all regimes where your platform has a nexus, or only against the regime where your primary regulator sits?
A common misconception: "We are not incorporated in Japan, so Japan rules do not apply to us"
This misconception persists among digital-asset businesses and financial institutions alike, and it is one we correct regularly. Japan's applicable rules apply on the basis of the transaction nexus, not only on the basis of incorporation.
A VASP incorporated outside Japan may nonetheless face Japanese obligations if it processes transfers through a Japanese exchange partner, holds accounts with a Japanese financial institution, services Japanese residents, or routes digital assets through Japanese infrastructure. The test is not where the entity is registered. It turns on whether the activity or the asset has a sufficient connection to Japan for the applicable rules to reach it.
The same principle applies, in different form, to OFAC and to the EU Council regulations. OFAC's reach over non-US persons is grounded in secondary-sanctions risk and in the US dollar's role in settlement. The EU's rules apply to any person conducting business in the EU, irrespective of where they are incorporated. Each regime uses a different jurisdictional hook; none of them is confined to entities formed within the enforcing jurisdiction.
In our experience, the businesses most exposed to unexpected Japan-regime obligations are those that have grown their operations in Asia without revisiting their compliance programme since inception. The programme was built for a single-regime world. The operations have outgrown it.
If a transaction has already been flagged, or a report has been filed under one regime but not yet under another, an early review can preserve options that narrow with time. For a confidential review of your position, contact Calder & Vance at info@caldervance.com.
What practical steps should a VASP take now?
A VASP with any Japan-connected flow should take the following steps as a baseline.
- Map the jurisdictional nexus of the platform: where are partners, accounts, users, and routing infrastructure located? Every jurisdiction with a material nexus is a potential source of obligations.
- Configure screening tools to cover Japan's designated-persons list explicitly, not as a subset of another regime's list. Lists diverge. A supplementary Japan-specific feed is a standard requirement.
- Apply the most demanding ownership-and-control test across the full ownership chain for all counterparties. Where a counterparty's ownership structure is opaque, treat that opacity itself as a risk flag warranting enhanced due diligence.
- Integrate travel-rule data collection into the sanctions alert workflow. When a travel-rule gap coincides with a sanctions alert, treat the two as a combined exposure requiring a combined response.
- Maintain a jurisdiction-specific reporting calendar. Map the statutory window for each regime where the platform has a nexus and build the internal escalation process to the shortest applicable window, not the most familiar one.
- Review the compliance programme at least annually, or whenever the platform enters a new market or adds a new asset type, to ensure that each new nexus is reflected in the screening and reporting configuration.
These steps apply regardless of whether a specific alert has been triggered. They represent the baseline for a programme that is proportionate to the cross-regime exposure of a VASP operating across Japan and other major regimes.
Related practices
- Sanctions compliance audit and testing – structured programme review for cross-border compliance gaps
- Escalation and reporting: an OFAC matter – how internal escalation structures affect voluntary self-disclosure outcomes
- The fifty-percent rule: an OFSI ownership matter – ownership and control analysis under the UK regime