Japan's Financial Regulator Asks Crypto Exchanges to Add Withdrawal Delays

On Thursday, Japan's Financial Services Agency, together with the National Police Agency, asked cryptocurrency exchanges to introduce withdrawal delays and a set of other safeguards against scams. It is not yet a binding requirement, only a request to the industry's self-regulatory body, but steps like this often end up shaping rules in other countries too.

What exactly did the FSA ask for?

The FSA's request grew out of a clear problem: losses among crypto exchange users are rising, and funds obtained through fraud are increasingly ending up in exchange accounts. The agency sent its proposal to the Japan Virtual and Crypto Assets Exchange Association, the country's self-regulatory body that brings together its licensed crypto platforms.

This is not a law or a formal rule, but a request built around a set of recommended measures. Each exchange decides for itself which of them to adopt, based on its own products, services, and the level of abuse risk it actually faces. Complaints about crypto-related investment scams have risen in Japan over the past couple of years, including fake mobile apps and social media profiles impersonating well-known traders or celebrities. Scammers often pair social engineering with crypto: they convince a victim to invest through a fake platform, then instantly move the money to wallets they control before the exchange has a chance to suspect anything. It's telling that the request targets exchanges rather than banks. Most financial institutions already run mandatory anti-money-laundering procedures, while Japan's crypto market is still actively building out its own standards.

How would the withdrawal delay actually work?

The core proposal is to restrict crypto withdrawals for a set period after a customer deposits fiat currency or buys digital assets. The logic is simple: if a scammer has gained access to someone's account and funded it with stolen money, the delay gives the exchange time to spot suspicious activity and block the withdrawal.

The second part of the proposal concerns withdrawal addresses. Exchanges are asked to require customers to pre-register the wallet address they plan to withdraw to, and to impose a waiting period before a newly added address can be used. That closes off the scenario where a scammer instantly swaps the payout address right after breaking into a victim's account. For example, if a customer's account suddenly receives a large sum from an unfamiliar bank, and someone immediately tries to withdraw funds to a new, freshly added address, that's a textbook fraud pattern the delay is meant to stop. The FSA deliberately did not set a specific delay length in hours or days, leaving that parameter up to each exchange, since risk profiles vary by customer base and transaction volume.

What other safeguards does the regulator propose?

Beyond withdrawal delays and address registration, the FSA's request includes a few more items related to monitoring and identity checks. Each item on its own is already used somewhere in the world, but combining all six at once makes the FSA's proposal one of the most detailed among Asian regulators today.

• Customer-specific withdrawal limits: capping how much a given customer can withdraw at once or over a set period.
• Stronger monitoring of transactions and the access environment, including analysis of a user's typical behavior.
• Phishing-resistant multifactor authentication: a method that cannot be defeated simply by intercepting a one-time code through a fake site.
• Checks that the remitter's name on a bank transfer matches the name on the crypto account, to rule out funding with someone else's money.

Together, these measures aim to make life harder for scammers at every stage, from first contact with a victim to the moment stolen funds get cashed out as "clean" crypto.

Why aren't these requirements mandatory?

The FSA stated plainly that the measures are not binding rules. Each exchange determines how to implement them based on its own products, services, and exposure to abuse. That approach is typical for Japan's crypto regulator, which traditionally favors industry self-regulation through crypto exchanges organized under the JVCEA, keeping for itself the role of an overseer that steps in only when systemic problems appear. JVCEA has held official self-regulatory status since 2020 and has since worked with the FSA on industry standards without direct legislative involvement. That balance lets the system react quickly to new fraud schemes instead of waiting months for parliament to pass amendments to the law.

The regulator has used this soft-touch format before, when it asked exchanges to tighten customer checks after a wave of complaints about scams involving fake investment platforms on social media. Some large players rolled out changes within a few months back then, well before any formal rules appeared.

The next move belongs to exchanges and regulators elsewhere

In the coming months, expect large Japanese exchanges to start adopting some of these measures voluntarily, aiming to get ahead of any future tightening of the rules. Japan has traditionally been among the first developed markets to formalize protections for crypto exchange users, so regulators in South Korea, Singapore, and other Asian jurisdictions often end up echoing its recommendations. Around the same time as this request, news broke that the exchange Bitget plans to exit Japan and close out client positions by the end of December. That's another sign of how uncomfortable the Japanese market is becoming for players unwilling to invest in local compliance.

For an everyday holder of Bitcoin or other crypto, this means one thing: withdrawing funds after a deposit or after adding a new wallet address might get a bit slower. That inconvenience is small next to the risk of losing funds to an instant transfer to a scammer's address before the exchange has a chance to catch the suspicious activity. The FSA tends to judge the success of requests like this by how fast the industry adopts them voluntarily. If most large exchanges apply at least some of the measures within a few months, the FSA may drop plans to make them mandatory at all.