Financial regulations in Japan

Country Overview

Although Japan is renowned for its wealthy economy and innovative technologies, the country scores low on indicators for digital competitiveness and digital talent per the IMD World Digital Competitiveness Ranking 2020. Usage of digital government services, mobile banking and e-commerce lags well behind ratings for other advanced economies. This puts Japan’s status as the world’s third-largest economy at risk of being surpassed by digital powerhouses like Germany and India.¹

Meanwhile, Japan has grappled with the devastating effects of the COVID-19 pandemic, which led to three states of emergency and a 4.8% contraction in the 2020 GDP.² The Organisation for Economic Co-operation and Development (OECD) predicts a modest 2021 economic expansion of 2.6%, down from 2.7%, due to containment measures instituted in April.³ Its slow vaccine rollout, alongside the risk of further outbreaks and restrictions, could threaten Japan’s fragile recovery. The financial sector remains stable overall, however, and Mitsubishi UFJ Financial Group—Japan’s largest bank—reported a 47% rise in net profit for the year ending in March 2021.⁴

The COVID-19 pandemic highlighted weaknesses in Japanese digitalization, but it has also offered the country a chance to accelerate its efforts. In 2020, traditionally cash-reliant Japanese flocked to digital payment solutions. E-commerce sales are estimated to have soared by 10.1%⁵ and top banks began research into digital currencies and electronic money.⁶ Japan’s COVID-19 recovery package, introduced in December 2020, allocates JPY 1 trillion (approximately USD $9 billion) towards digital transformation.⁷

Prime Minister Yoshihide Suga, who came into power September 2020, has been vehement in spearheading digitalization with a mind towards boosting efficiency and productivity. His 2021 digital platform focuses on the digitalization of government, society and economy; it also encompasses a central bank digital currency (CBDC) experiment and the beginning stages of the development of a national AI framework. In May 2021, Suga stated that the government was working towards achieving a “free and open digital space” in the Indo-Pacific region.⁸ A key challenge will be ensuring that cybersecurity readiness is strengthened alongside digitalization, as Japan’s current cybersecurity framework is insubstantial to protect against a growing risk landscape.⁹ Indeed, the government plans to establish a cross-sectoral unit in 2022 dedicated to studying cyberattacks and developing stronger defenses.¹⁰

Financial Regulatory Authorities

The Bank of Japan is the central bank and primary monetary policymaker for the country.  

The Personal Information Protection Commission (PPC) is the central data protection authority in Japan. The agency enforces the 2003 Act on the Protection of Personal Information (APPI). 

The Financial Services Agency (FSA) is responsible for overseeing banking, securities, exchange and insurance sectors in Japan.  

Other Regulatory Authorities

The Japan Financial Intelligence Center (JAFIC) is an independent agency that enforces the Act on the Prevention of Transfer of Criminal Proceeds. 

The Ministry of Trade, Economy and Industry (METI) seeks to develop the Japanese economy and industry by promoting the economic vitality of private companies and external economic relationships.   

Policy, Laws and Regulations

Digital Society Formation and Development Act

In September 2021, the Digital Society Formation and Development Act took effect. It replaces the requirement for wet signatures and seals in real estate transactions with electronic signatures. Real estate contracts can now be executed electronically for both residential and land leases. Included in the Act is a Deregulation Plan, which modifies regulations requiring ink signatures in order to promote digitization in the government, healthcare and real estate sectors. 

Implementation of the FATF’s Travel Rule, 2022

Published in 2021, the amended APPI strengthens the rights of data subjects and imposes new requirements on entities that process personal data. It obliges entities to report data breaches to the Personal Information Protection Commission (PPC), expands the PPC’s powers such that it can request reports or investigate offshore companies, increases penalties in the case of non-compliance, and introduces the concept of pseudonymization. 

Pseudonymization is a data management procedure by which data subjects’ personally identifiable information is replaced with a pseudonym, thus protecting their rights and enabling processors to more readily use their information. The amended APPI also expands data subjects’ rights to deletion and cessation of the use of personal data, and allows data subjects to select the method of receiving their data (writing or email), per the right of access. 

Like the EU’s General Data Protection Regulation (GDPR), the APPI has extraterritorial scope, applying to all entities that process personal data of Japanese citizens, regardless of the entities’ physical location. The amended APPI enables the PPC to request that foreign obliged entities report on their processing activities, and the PPC will be able to impose fines on them in the case of non-compliance. 

Amendments to the Enforcement Rules for the Act on the Protection of Personal Information (APPI), April 1, 2022

In 2021, Japan’s Financial Services Agency (FSA) announced that it will implement the Financial Action Task Force (FATF)’s “Travel Rule” per its guidelines on virtual assets (VAs) and virtual asset service providers (VASPs). The Travel Rule, which requires the exchange of identification data between senders (originators) and recipients (beneficiaries) of digital funds transfers, seeks to prevent ML/TF by cracking down on anonymity in wire and crypto transactions.
Required information aligns closely with customer due diligence information standards, and includes the originator’s name, address, birth date, birthplace, account number and identity number, as well as the beneficiary’s name and account or virtual wallet number. The rule will go into effect in 2022.
 

Parliament Passes Set of Digital Reform Laws, Including Digital Agency Law, 12 May 2021 

The Japanese parliament—the Diet—passed a set of digital reform laws, including the Digital Agency Law, which will establish a Digital Agency in September 2021. The government agency, to be headed by a cabinet minister and a top administrative official, will promote digitalization in government and the private sector while ensuring the protection of personal data. It will also be tasked with encouraging the use of the My Number system, a 12-digit number issued to all citizens and residents that enables access to online public services. The laws seek to revamp historically paper-reliant government and administrative services and oust the use of the hanko seal, an individualized stamp used to sign official documents. Local governments will be required to utilize computer systems to improve the provision of public services.

An October 2020 move by Prime Minister Suga will have banks and other financial institutions leverage electronic signature technology and digitize their forms by the end of 2022. Companies have traditionally filed paper documents with the Financial Services Agency, which has reduced efficiency and driven up costs.¹¹ In a 16 March 2021 speech entitled “Integrating Information and Financial Systems: Beyond As-a-Service,” Bank of Japan Governor Haruhiko Kuroda addressed the need to digitalize the “paper-bound” work culture in Japan. Goals in supporting innovation must center on improving business efficiency and “creating new business models linking information.” 

Central Bank Issues Announcement on Central Bank Digital Currency Experiment, 05 April 2021 

The central bank issued a press release announcing that its Proof of Concept (PoC) Phase 1 of a CBDC experiment had begun. During the PoC Phase 1—which will last until March 2022—the bank will test basic functions of a CBDC system, including issuance, distribution and redemption. A second Proof of Concept phase will then analyze more in-depth functions and issues, like limits on the amount of CBDC an entity can hold.¹² A possible third stage of testing would create a pilot program involving payment service providers and end users. Central bank Governor Haruhiko Kuroda stated in March 2021 that, although there is no plan to issue a digital yen, the bank aims to make necessary preparations in light of “the advent of digital society.¹³”

On 08 October 2020, the Bank of Japan published a policy document on CBDCs, which outlined three primary motivations for the development of a CBDC. Drivers include improving the stability and efficiency of payment and settlement systems; providing an alternate payment method if cash use significantly declines; and supporting an increasingly digital society. In January 2020, then-Parliamentary Vice Minister for Foreign Affairs Norihiro Nakayama said, “China is moving toward issuing digital yuan, so we’d like to propose measures to counter such attempts,¹⁴” pointing towards the longstanding China-Japan rivalry. 

On 02 July 2020, the Bank of Japan published a research paper on CBDCs, which largely addressed how to facilitate offline payments. This is of particular importance to the country in light of recent earthquakes and power outages. 

Amendments to the Enforcement Rules for the Act on the Protection of Personal Information, 23 March 2021 

The Personal Information Protection Commission published amendments to the Enforcement Rules for the Act on the Protection of Personal Information in the official gazette, thus further implementing provisions of the Act Amending the Act on Protection of Personal Information (APPI). The amended APPI, approved by the Japanese Diet on 05 June 2020, strengthens the rights of data subjects and imposes new requirements on entities that process personal data. It obliged entities to report data breaches to the PPC, expands the PPC’s powers such that it can request reports or investigate offshore companies, increases penalties in the case of non-compliance and introduces the concept of pseudonymization. Pseudonymization is a data management procedure by which data subjects’ personally identifiable information is replaced with a pseudonym, thus protecting their rights and enabling processors to more readily use their information. The amended APPI also expands data subjects’ rights to deletion and cessation of the use of personal data, and allows data subjects to select the method of receiving their data (writing or email), per the right of access. Like the EU’s General Data Protection Regulation (GDPR), the APPI has extraterritorial scope, applying to all entities that process personal data of Japanese citizens, regardless of the entities’ physical location. The amended APPI enables the PPC to request that foreign obliged entities report on their processing activities, and the PPC will be able to impose fines on them in the case of non-compliance. The Act will come into effect 01 April 2022. 

Financial Services Agency Adopts Financial Action Task Force Guidelines on Virtual Assets and Virtual Asset Service Providers, 31 March 2021 

The Financial Services Agency (FSA) announced that it will implement the Financial Action Task Force (FATF)’s “Travel Rule” per its guidelines on virtual assets (VAs) and virtual asset service providers (VASPs). The Travel Rule, which requires the exchange of identification data between senders (originators) and recipients (beneficiaries) of digital funds transfers, seeks to prevent ML/TF by cracking down on anonymity in wire and crypto transactions. Required information aligns closely with customer due diligence information standards, and includes the originator’s name, address, birth date, birth place, account number and identity number, as well as the beneficiary’s name and account or virtual wallet number. The rule will go into effect in 2022.  

Draft Report on Governance Innovation, 19 February 2021 

The Ministry of Economy, Trade and Industry published a draft report entitled Governance Innovation v.2: A Guide to Designing and Implementing Agile Governance, following a first report published in July 2020. The draft presents the ideas of the Study Group on a New Governance Model in Society 5.0, a research group that has been investigating means to achieve the Society 5.0 policy. The ambitious policy seeks to bolster economic development and address social challenges through the use of artificial intelligence, Internet of Things, big data and cyber-physical systems. Society 5.0 will be driven by a human-centric approach and by continuously adapting to changes brought on by emerging technologies. Agile governance will be flexible and adaptable to this constantly evolving landscape, and its governance model will hinge on an analysis of conditions and risks, continuously revised goals, transparency and accountability, inclusiveness and the participation of multiple stakeholders in its design, amongst other criteria. The report raises important implications in the realization of Society 5.0, including the protection of data privacy, regulating AI and defending against increasingly sophisticated cyberattacks. Indeed, Society 5.0 could be crucial in revolutionizing tradition-heavy Japanese society— which Prime Minister Suga has eagerly sought to modernize—but it will also require regulatory frameworks to mitigate the challenges and risks posed by digitalization. 

---

Reference:

^{1. “How Japan can make digital ‘big moves’ to drive growth and productivity.” McKinsey, 24 February 2021. https://www.mckinsey.com/business-functions/mckinsey-digital/our-insights/how-japan-can-make-digital-big-moves-to-drive-growth-and-productivity.}

^{2. “Japan's economy shrinks 4.8% in 2020 due to Covid.” BBC, 15 February 2021. https://www.bbc.co.uk/news/business-56066065.}

^{3. “OECD raises 2021 global growth outlook while cutting Japan forecast.” The Japan Times, 31 May 2021. https://www.japantimes.co.jp/news/2021/05/31/business/economy-business/oecd-2021-outlook/.}

^{4. Obe, Mitsuru. “MUFG's 47% earnings jump in 2020 shows banks can thrive amid COVID.” Nikkei Asia, 17 May 2021. https://asia.nikkei.com/Business/Finance/MUFG-s-47-earnings-jump-in-2020-shows-banks-can-thrive-amid-COVID.}

^{5. “COVID-19 accelerates e-commerce market growth in Japan, says GlobalData.” GlobalData, 22 January 2021. https://www.globaldata.com/covid-19-accelerates-e-commerce-market-growth-japan-says-globaldata/.}

^{6. Faridi, Omar. “Digital Transformation: Japan’s Big Banks are Studying Virtual Currencies and how to Make Banks and Cashless Payments Systems Interoperable.” Crowdfund Insider, 05 June 2020. https://www.crowdfundinsider.com/2020/06/162359-digital-transformation-japans-big-banks-are-studying-virtual-currencies-and-how-to-make-banks-and-cashless-payments-systems-interoperable/.}

^{7. Kihara, Leika and Tetsushi Kajimoto. “Japan unveils $708 billion in fresh stimulus with eye on post-COVID growth.” Reuters, 07 December 2020. https://www.reuters.com/article/us-japan-economy-stimulus-idUSKBN28I02Y.}

^{8. Suzuki, Wataru. “Suga vows to lead 'free and open digital space' in Indo-Pacific.” Nikkei Asia, 20 May 2021. https://asia.nikkei.com/Spotlight/The-Future-of-Asia/The-Future-of-Asia-2021/Suga-vows-to-lead-free-and-open-digital-space-in-Indo-Pacific.}

^{9. Tsukimori, Osamu. “As cyberattacks rise globally, Japan's digital security found lacking.” The Japan Times, 18 September 2020. https://www.japantimes.co.jp/news/2020/09/18/business/japans-cybersecurity-lacking/.}

^{10. Tajima, Yukio. “Japan calls on industry and academia to fortify cyber defenses.” Nikkei Asia, 21 October 2020. https://asia.nikkei.com/Business/Technology/Japan-calls-on-industry-and-academia-to-fortify-cyber-defenses.}

^{11. Okabe, Takanori. “Suga digitization push to put all financial filings online by 2022.” Nikkei Asia, 15 October 2020. https://asia.nikkei.com/Business/Finance/Suga-digitization-push-to-put-all-financial-filings-online-by-2022.}

^{12. “Japan's central bank kicks off experiments on issuing digital currency.” Reuters, 05 April 2021. https://www.reuters.com/article/us-japan-economy-cbdc-idUSKBN2BS0EG.}

^{13. Kuroda, Haruhiko. “Integrating Information and Financial Systems: Beyond As-a-Service.” Bank of Japan, 16 March 2021. https://www.boj.or.jp/en/announcements/press/koen_2021/data/ko210316a.pdf.} 

^{14. Kajimoto, Tetsushi and Leika Kihara. “Japan ruling party lawmakers to float idea of issuing digital currency.” Reuters, 24 January 2020. https://www.reuters.com/article/uk-japan-economy-digital-idUKKBN1ZN0QK.}

---

^{*DISCLAIMER: This information is OneSpan's interpretation of the compliance requirements as of the date of publication. Please note that not all interpretations or requirements of the applicable laws are well-settled and its application is fact- and context-specific. The information contained in this document should not be relied upon as legal advice or to determine how the law applies to your business or organization. We encourage you to seek guidance from your legal counsel with regard to law applying specifically to your business or organization and how to ensure compliance. This information is provided “as-is” and may be updated or changed without notice. OneSpan does not accept liability for the contents of these materials.}

Last updated: November 2021