Japan's FSA and police urge crypto exchanges to add withdrawal delays and tougher anti-fraud controls

Japan's Financial Services Agency (FSA) and the National Police Agency (NPA) on Aug. 6 called on the domestic crypto industry to introduce withdrawal delays, preregistered withdrawal addresses and stronger anti-fraud safeguards, citing a sharp rise in scam losses tied to digital assets. The request was delivered to the Japan Virtual and Crypto Assets Exchange Association (JVCEA), the industry's self-regulatory body. Regulators described the measures as guidance rather than a binding rule. Key measures regulators are seeking include: temporary holds on withdrawals after fiat deposits or crypto purchases; an added waiting period when customers register a new withdrawal address; advance registration of withdrawal destinations; and controls that recheck accounts when customers make large or rapid withdrawals after restrictions expire. The FSA did not set specific delay durations, telling exchanges to calibrate timeframes based on service design and risk profiles. Regulators also want individualized withdrawal limits that reflect customer risk, assets held, transaction purpose and past behavior. Additional expectations cover stronger transaction and access monitoring to detect activity that deviates from customer profiles, the ability to flag accounts using devices linked to known misuse, and quicker responses to suspicious activity, including holds, withdrawal restrictions or account freezes. The guidance also highlights phishing-resistant multi-factor authentication and tighter identity checks in high-risk cases, including comparing remitter bank names with crypto account owners and acting on mismatches. Regulators urged faster sharing of fraud indicators and quicker information transfers to police. The push comes as reported scam volumes and losses remain elevated. The NPA's latest published figures through May 2026 show 18,067 "special fraud" cases totaling about 151.47 billion yen in losses. Social media (SNS) investment scams accounted for 5,099 cases and roughly 70.04 billion yen in losses, while SNS romance scams added about 20.2 billion yen in losses. Earlier figures pointed to the same trajectory. In 2025, police recorded 9,523 SNS investment-scam cases with 128.8 billion yen lost, and 5,645 romance-scam cases with 54.64 billion yen lost. Crypto-transfer romance scams reached 2,177 cases over that period, with losses of about 24.77 billion yen, a key reason regulators are prioritizing digital-asset withdrawal controls. The initiative builds on earlier steps aimed at banks. In February 2024, the FSA and police urged financial institutions to block transfers to crypto exchange accounts when the sender name did not match the originating bank account, and to strengthen monitoring for suspicious transfers. The new guidance extends similar protections to exchange withdrawal processes and aligns with Japan's broader tightening of crypto oversight and investor protection. Implementation is expected to vary by platform. The FSA avoided imposing a single nationwide waiting period and asked exchanges to phase in system updates where needed, tailoring controls to business models and abuse patterns. Some platforms already apply restrictions; SBI VC Trade, for example, says certain quick deposits cannot be withdrawn or converted to crypto until the eighth day. For users, the changes likely mean more friction: slower first-time withdrawals or transfers to newly added addresses, mandatory address registration, customized limits and additional verification when activity appears anomalous, such as registering a new wallet and immediately attempting a large transfer. Regulators did not call for blanket withdrawal freezes. The FSA and NPA asked the JVCEA and member exchanges to begin strengthening controls starting in August, assessing which policies and system changes can be deployed immediately and which will require phased implementation. With no single start date or mandated delay length, attention will turn to exchange-specific notices, any JVCEA guidance, and whether the FSA ultimately formalizes parts of the request into supervisory requirements. In the meantime, practices are expected to diverge across platforms.