Japan’s Financial Services Agency to Implement Threat-Driven Penetration Testing to Strengthen Security Standards for Crypto Exchanges

On April 3, Japan’s Financial Services Agency officially released the "Cybersecurity Enhancement Guidelines for Crypto Asset Exchanges and Related Businesses." This document was developed based on 18 public comments collected from February to March 2026, with the core goal of effectively protecting investors’ assets.

The guidelines establish a three-tiered cybersecurity reinforcement system of "self-help (industry operators), mutual help (self-regulatory organizations), and public help (regulatory authorities)," aiming to comprehensively enhance security capabilities through responsibilities at the entity level, industry cooperation, and regulatory oversight.

The FSA pointed out that current cyberattack methods are no longer limited to traditional signature key theft but increasingly involve highly organized tactics such as social engineering attacks and supply chain intrusions.

Against this backdrop, relying solely on traditional cold wallet management is no longer sufficient to ensure asset security. The industry urgently needs to build a more systematic defense system.

According to the guidelines, the FSA will subsequently conduct threat-driven penetration tests (TLPT) on some major players by simulating real attack scenarios to test and improve platform security defenses.

At the same time, the FSA plans to revise related operational guidelines to further enhance cybersecurity personnel deployment and external audit standards.

Currently, Japan has begun incorporating crypto asset-related scenarios into the "Delta Wall" cross-industry cybersecurity drills to strengthen the overall industry’s emergency response capabilities.

Additionally, Japan’s self-regulatory organization, the Japan Virtual Currency Exchange Association (JVCEA), will also promote member companies to improve their audit capabilities, aiming to further refine the industry-wide information sharing mechanism.

#日本金融厅 #Cybersecurity Guidelines