A virtual-asset service provider ("VASP") registered in Tokyo processes a withdrawal request. The beneficiary wallet traces back to an address linked to a designated entity. The compliance officer has minutes to decide whether to freeze the funds, file a report, and halt the relationship. Does Japan's sanctions regime require all three? And how does that obligation align with what OFAC or OFSI would expect of the same firm's US or UK operations?
Crypto and VASP sanctions compliance under Japan rules sits at the intersection of the Foreign Exchange and Foreign Trade Act ("FEFTA"), the Act on Prevention of Transfer of Criminal Proceeds, and administrative guidance issued by the Financial Services Agency ("FSA") and the Ministry of Finance ("MOF"). As of August 2026, Japan maintains its own autonomous sanctions list alongside its implementation of United Nations Security Council obligations. VASPs registered under the Payment Services Act must screen customers and transactions against those lists, freeze assets where a match is confirmed, and report to the competent authority without delay.
This briefing explains who administers the regime, what the core prohibitions require of crypto businesses, how the ownership and control test applies in the virtual-asset context, what an enforcement action looks like, and where Japan's rules diverge from the OFAC and OFSI positions that many cross-border VASPs must satisfy simultaneously.
Who administers Japan's crypto and VASP sanctions regime?
Japan's sanctions and VASP compliance obligations are administered jointly by the FSA and the MOF, operating under the authority of FEFTA and the Payment Services Act. The FSA supervises registered crypto-asset exchange service providers ("CAESPs") – the Japanese regulatory category that covers most VASPs – and issues supervisory guidelines that set out screening and reporting expectations in operational terms. The MOF administers asset-freeze orders under FEFTA and coordinates with the Ministry of Foreign Affairs on the implementation of UN Security Council resolutions and autonomous measures.
The National Public Safety Commission, working through the National Police Agency, administers the Act on Prevention of Transfer of Criminal Proceeds. That act imposes customer due diligence and suspicious-transaction reporting obligations that run alongside – and reinforce – the sanctions screening duties under FEFTA. A VASP that fails on the financial-crimes side will very often have a corresponding gap in its sanctions controls.
In our cross-border practice, firms often underestimate how tightly these three agencies coordinate. An FSA supervisory inspection of a CAEXP will examine transaction monitoring, customer identification, and sanctions screening as an integrated set. A weakness in any one dimension flags the others.
Japan's autonomous sanctions list is maintained by the MOF and updated following Cabinet decisions. UN Consolidated List obligations are absorbed directly into Japanese law and carry the same legal weight as domestically designated measures. VASPs must screen against both in real time, not sequentially.
What are the core prohibitions for virtual-asset businesses?
The core prohibitions require Japanese-registered VASPs to refrain from executing any transaction – deposit, withdrawal, exchange, transfer, or custody – that would confer an economic benefit on a designated person or entity. FEFTA frames this as a prohibition on "capital transactions" with designated counterparties. In the virtual-asset context, that prohibition extends to processing a transfer where the originator, the beneficiary, or any intermediary wallet address is associated with a listed person.
Three categories of obligation flow from that prohibition. First, a VASP must screen all customers at onboarding and on a continuous basis against the MOF asset-freeze list and the UN Consolidated List. Second, where a match is identified, the VASP must freeze the relevant funds or assets immediately and report the freeze to the MOF within the statutory window. Third, a VASP must not "tip off" the counterparty that a freeze has been applied.
The travel rule – Japan's implementation of the Financial Action Task Force standard requiring originator and beneficiary information to accompany virtual-asset transfers – creates a practical enforcement mechanism. A transfer that arrives without the required information cannot be processed until the VASP has verified the parties. That verification step is also the point at which a sanctions match may be discovered. Have you mapped the moment in your transaction workflow at which a travel-rule gap could conceal a sanctions exposure?
Unhosted wallet transactions attract additional scrutiny. The FSA's supervisory guidelines require VASPs to apply enhanced due diligence when a transfer involves a self-custodied wallet above a defined value threshold. The practical effect is that a VASP must have a documented procedure for tracing ownership of unhosted addresses before it processes a high-value withdrawal to one.
How does the ownership and control test apply in the virtual-asset context?
Japan's ownership and control analysis determines whether a non-listed entity is caught by the prohibitions because a designated person holds a sufficient stake in or exercises control over it. Under FEFTA, this assessment follows Cabinet Office guidance that treats entities with significant designated-person ownership as subject to the same restrictions as listed persons themselves.
The test is not purely mechanical in the way the OFAC 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) is. Japanese administrative practice combines a percentage-of-ownership indicator with a control analysis: even where a designated person holds less than a majority stake, the MOF may treat the entity as caught if the designated person can direct its financial or operational decisions. This aligns more closely with the approach taken by OFSI and the EU, where a control test supplements – and in some cases overrides – a formal ownership threshold.
For VASPs, the implication is material. A crypto exchange that onboards an institutional client must not only run the legal entity against the list; it must map the client's beneficial ownership chain and assess whether any designated person exercises de facto control. That process mirrors the beneficial ownership (the identification of the natural persons who ultimately own or control a legal entity) procedures required for anti-money-laundering purposes – but the sanctions trigger and the AML trigger can arise at different points in the ownership structure.
We regularly advise cross-border VASPs on this precise question. The gap between the Japanese control test and the OFAC ownership threshold is one of the most common sources of undetected exposure in multi-jurisdiction VASP compliance programmes. A firm may be clean under the OFAC mechanical test and still be non-compliant under Japanese or EU standards.
Where the ownership chain includes entities in jurisdictions with limited corporate-transparency regimes, the FSA expects VASPs to apply enhanced due diligence to close the gap. A bare registry search is not enough. The standard is reasonable verification of the ultimate beneficial owner.
How does Japan's regime compare with OFAC and OFSI?
Japan, the United States, and the United Kingdom impose materially overlapping but structurally distinct obligations on VASPs. Understanding those distinctions is essential for any business that holds licences or serves customers in more than one of these jurisdictions.
Under OFAC, the ownership test is the determinative rule: an entity owned 50 percent or more by one or more SDN List (OFAC's list of Specially Designated Nationals and blocked persons) persons is itself blocked, regardless of whether it is separately listed. The test is applied in aggregate across all SDN-listed holders. Control, absent majority ownership, does not independently trigger the prohibition under OFAC guidance – though OFAC retains discretion to designate a controlled entity separately. For more on the OFAC position, see our OFAC crypto and VASP compliance briefing.
Under OFSI, the ownership and control (the UK and EU test for whether a non-listed entity is caught through a listed person) test is broader. A designated person's ability to direct or influence a company's activities – without majority ownership – can bring that company within the asset-freeze obligation. OFSI has published guidance making clear that control includes indirect control exercised through contractual arrangements or management structures. For a detailed treatment, see our OFSI crypto and VASP compliance briefing.
Japan's position, as noted above, blends both approaches. The MOF ownership indicator sits alongside a control analysis, producing a test that is administratively heavier than OFAC's but that operates through regulatory guidance rather than the publicly published primary-regulation framework that characterises OFSI's approach.
For a VASP holding both a CAEXP registration in Japan and a registration under another regime, the principle that the stricter prohibition governs means that satisfying the OFAC test alone is not sufficient. The cross-border compliance programme must be calibrated to the most demanding standard applicable to each legal entity and each customer relationship.
One further divergence concerns the treatment of decentralised protocols. OFAC has taken an enforcement position on immutable smart contracts; neither the FSA nor OFSI has issued guidance that matches the specificity of the US position. That gap creates uncertainty for Japanese VASPs with exposure to decentralised-finance activity, and it is an area where early counsel engagement reduces risk.
What are the key risk flags for VASPs operating under Japan's regime?
Experience before the FSA's supervisory process identifies a consistent set of risk flags that precede adverse findings in CAEXP inspections. Each flag represents a control gap that a well-designed compliance programme should address before the regulator identifies it.
The first flag is list-update latency: the gap between a Cabinet decision updating the MOF autonomous-sanctions list and the moment the update is reflected in a VASP's production screening system. Japanese administrative practice does not specify a maximum permitted latency in public guidance, but FSA inspections have focused on this point. The expectation is that updates are reflected promptly – measured in hours, not days.
The second flag is incomplete travel-rule data. Where a VASP receives a transfer with absent or manifestly incorrect originator information, the correct response is to place the transaction in a pending queue and apply enhanced due diligence before processing. A VASP that processes such transactions on the basis that "the amount is below the threshold" without verifying the originator has a systematic sanctions-screening gap.
The third flag is unhosted wallet policy inconsistency. The FSA supervisory guidelines set out enhanced due diligence expectations for transfers to and from self-custodied wallets. A VASP that applies those expectations inconsistently – for example, by applying enhanced due diligence only on withdrawals and not on deposits – has an asymmetric control that will not satisfy a supervisory review.
The fourth flag is beneficial-ownership gap in institutional onboarding. Institutional clients onboarded as legal entities without a documented beneficial-ownership trace to the natural-person level represent an unresolved risk. The FSA expects the ownership chain to be mapped and assessed at onboarding and reviewed periodically.
The fifth flag is inadequate documentation of freeze decisions. When a VASP freezes an asset under FEFTA, it must document the basis for the freeze, the date and time of the freeze action, and the report made to the MOF. Incomplete records make it impossible to demonstrate compliance in a subsequent inspection.
Is your compliance programme built to the expectation that the FSA will ask to see the audit trail for every freeze action taken in the past year?
Reporting obligations and record-keeping
Japan's reporting obligations for VASPs under the sanctions regime require prompt notification to the MOF when a VASP identifies a match and applies a freeze. The notification must include the identity of the customer or transaction counterparty, the basis for the freeze, and the value of the assets frozen. The MOF may then issue further instructions, including whether to maintain the freeze or take additional action.
Suspicious-transaction reporting under the Act on Prevention of Transfer of Criminal Proceeds is parallel and procedurally distinct. A freeze under FEFTA and a suspicious-transaction report to the Japan Financial Intelligence Unit may both be required in response to the same event. VASPs must have procedures that ensure both obligations are met without one being treated as a substitute for the other.
Record-keeping requirements under Japanese financial regulation require VASPs to retain customer identification records, transaction records, and due-diligence documentation for a period set by the applicable rules. The FSA supervisory guidelines treat record completeness as a proxy for control quality: a VASP that cannot produce clean records during an inspection is presumed to have had inadequate controls at the time of the transaction.
In our experience, the record-keeping gap is often discovered only during an inspection, at which point remediation is reactive rather than planned. A pre-inspection review of record completeness, conducted independently of the compliance function's own assessment, surfaces gaps before they become findings.
Enforcement posture and when to involve counsel
The FSA's enforcement posture in the crypto and VASP sector has become materially more active since the Payment Services Act was amended to bring CAESPs within a full supervisory perimeter. Enforcement actions have taken the form of business improvement orders, registration suspensions, and, in the most serious cases, criminal referrals to the National Police Agency. The range of outcomes reflects the severity of the breach and the VASP's demonstrated commitment to remediation.
A business improvement order – the FSA's standard first-response tool for a compliance deficiency – requires the VASP to submit an improvement plan within a defined period and to report on implementation. The order is public. That publicity carries reputational consequences for a CAEXP that extend well beyond the regulatory sanction itself.
The position above covers the standard supervisory track. Your facts – the nature of the breach, the duration of the control gap, whether a voluntary disclosure was made, and the VASP's remediation posture – change the analysis significantly.
Early counsel involvement matters for three reasons. First, a voluntary self-disclosure (VSD – a voluntary self-disclosure to a regulator) made before the regulator identifies the breach independently is treated more favourably in most jurisdictions, including Japan. Second, the improvement plan submitted in response to a business improvement order is a legal document that will be assessed by the FSA against the applicable standard; it should be prepared with legal input. Third, where the same breach has implications under OFAC or OFSI – as is common for cross-border VASPs – coordinating the disclosures and the remediation across jurisdictions requires a single view of the facts and a strategy that avoids inadvertently prejudicing the position in one regime while addressing another.
If a transaction has already been flagged, or an FSA inspection is imminent, an early review can preserve options that narrow with time. For a confidential review of a potential breach or an upcoming inspection, contact Calder & Vance at info@caldervance.com.
Common misconceptions about Japan's crypto sanctions regime
A persistent misconception in the cross-border VASP sector is that Japan's sanctions obligations are adequately satisfied by complying with OFAC – on the basis that OFAC's extraterritorial reach is broader and its lists more comprehensive. This is incorrect for two reasons.
First, Japan maintains its own autonomous designations that do not map one-to-one to the OFAC SDN List. A counterparty that does not appear on the SDN List may nevertheless be designated under Japanese autonomous measures. A screening programme that pulls only from OFAC lists will miss those entries entirely.
Second, as noted above, the control test under Japanese practice is broader than OFAC's purely ownership-based trigger. A VASP that screens only for direct SDN ownership will have a structural gap relative to the Japanese standard.
A second misconception is that decentralised protocols fall outside Japan's regulatory perimeter because they have no central operator. The FSA's supervisory approach treats the registered CAEXP – the business that provides access to the protocol – as the regulated entity, and requires that entity to apply sanctions controls to the extent technically feasible. The absence of a central counterparty does not remove the VASP's obligation to refuse service to a designated person.
We have acted for VASPs that entered the Japanese market on the basis of their existing OFAC compliance programme, only to discover material gaps when the FSA's supervisory guidelines were mapped against their actual controls. Early-stage gap analysis before registration, rather than after the first inspection, is the more cost-effective path.
Related practices
- Compliance audit and testing – Australia – sanctions screening audit and gap analysis for the Australian regime
- OFAC crypto and VASP compliance briefing – how the OFAC regime applies to virtual-asset businesses
- OFSI crypto and VASP compliance briefing – the UK ownership and control test and VASP obligations under OFSI