The Request That Never Says How Long: Japan's Eleven-Point Withdrawal Restriction Demand on Crypto Exchanges

Most of the Eleven Points Are Transplanted Banking Practice

Listing the contents makes their character clear: strengthened fraud prevention and fact-finding at account opening; verification and warnings to prevent fraud losses; withdrawal restrictions for a set period after fiat deposit or crypto purchase; advance registration of withdrawal destinations with a subsequent restriction period; appropriate withdrawal limits; enhanced transaction and access-environment monitoring; faster customer verification, transaction restriction and account freezing after detecting suspicious activity; strengthened authentication where impersonation is suspected; matching of remitter names against account holder names; information sharing among operators; and enhanced information provision to and coordination with police.

Specific measures include building mechanisms to verify the authenticity of identity documents, implementing and mandating phishing-resistant multi-factor authentication, applying detection scenarios keyed to current fraud patterns, detecting transactions from the same device or access environment as accounts confirmed to be misused, and establishing capacity to impose restrictions promptly at night and on holidays.

Most of this is a transplant of practice that banks built over nearly two decades responding to wire fraud. Remitter name matching, limit management, and scenario-based monitoring are close to standard equipment in banking. Crypto exchanges are now being asked to reach the fraud-control standard of deposit-taking institutions without the staffing or institutional history those institutions possess.

The One Genuinely New Element Is the Destination Registry

The item without a direct banking analogue is the fourth: advance registration of withdrawal destinations. The request calls for registering destination information in advance, checking it for connections to fraud, preventing withdrawal where such a connection is found, and imposing a temporary restriction on newly registered destinations.

In substance this asks each exchange to operate a whitelist of blockchain addresses alongside a reference database of fraud-linked addresses. The former can be built in-house; the latter cannot. Determining which addresses are fraud-linked requires cross-industry data and law enforcement data to be accurate. That is precisely why the tenth item on inter-operator information sharing and the eleventh on police coordination sit in the same request. Who holds the authority and the data to adjudicate a withdrawal destination is an open question the request leaves unanswered.

"A Set Period" Is Never Defined

The phrase recurring throughout the request is never given a number of days. Nor is any guidance offered on withdrawal limits. The request states at the outset that the method and depth of measures should be determined according to each operator's business and services and the incidence of misuse, and that where system work makes immediate implementation difficult, a planned approach is important. No reporting deadline is set.

Leaving discretion has a rationale. Imposing a uniform period on operators with different assets and customer bases would produce over-regulation and under-regulation simultaneously. But discretion has a side effect. Tighter restrictions degrade customer experience; looser ones confer competitive advantage. When every operator receives the same request but sets its own parameters, activity gravitates toward whoever chooses the loosest setting—and so, disproportionately, does fraudulent money. The request's explicit statement that operators with inadequate measures are more likely to be targeted by criminals reflects awareness of exactly this dynamic. In practice, the months before an informal industry norm settles will be the hardest period in which to make decisions.

Partial precedent exists domestically. bitFlyer already restricts transfer of assets equivalent to deposits made via Pay-easy or convenience stores for 168 hours. That measure, however, is confined to specific deposit channels and is far narrower in scope than the comprehensive restriction now requested.

The Same Week, Brazil Chose the Opposite Drafting

A contrasting case appeared in the same week. On August 7, 2026, the Central Bank of Brazil published Resolution 584, extending fraud prevention rules for payment services to virtual asset services. Transfers exceeding $10,000 in a single transaction or in a customer's same-day aggregate, when directed to overseas virtual asset providers or self-custody wallets, must be held for up to 24 hours while a risk assessment is performed. The rule takes effect January 1, 2027, delayed by a year from the original October 2026 proposal. The central bank retains authority to set periods beyond 24 hours and to extend coverage below the $10,000 threshold.

Japan's request and Brazil's resolution are opposite solutions to the same problem. Japan issued a non-binding request with no threshold, no period, and no deadline, delegating judgment to operators. Brazil issued a binding resolution specifying the monetary threshold, the maximum hold, the effective date, and its reserved future discretion. The former is flexible but lacks predictability; the latter is rigid but supports investment decisions. For Japanese operators, the practical difficulty is that the numbers required for a system investment decision have not been provided.

Business Development Insights

1. The premise of instant settlement in onchain finance is being deliberately dismantled from the regulatory side. Withdrawal restrictions and destination pre-registration both amount to designing latency into payment. Around-the-clock instant finality has been a central value proposition of crypto infrastructure; if multi-day waiting becomes standard at the exchange gateway, practical scenarios for onchain finance including DeFi connectivity and RWA trading require reconsideration from first principles. Firms whose product design assumes exchange connectivity should treat "lead time from deposit to withdrawal availability" as an explicit design variable. This matters particularly for corporate payment and treasury flows built on stablecoins, where an exchange-mediated funding path can become the binding constraint.
2. No one has yet been designated to operate the data infrastructure that adjudicates withdrawal destinations. That inter-operator information sharing and police coordination appear in the same request is the flip side of requirements individual firms cannot meet alone. A shared database of fraud-linked addresses, its update and false-positive handling, and the legal basis for sharing under personal information protection law are naturally built as common industry infrastructure. Whether a blockchain analytics provider, the industry association, or a newly formed joint body takes that role is undetermined, making this one of the few clearly vacant layers in Japan. For firms considering entry, connectivity to law enforcement and cross-industry consensus-building are the barriers—and equally the source of first-mover advantage.
3. A request with undefined parameters risks delaying compliance investment decisions. With no restriction period, monetary threshold, or reporting deadline specified, each firm must define for itself what constitutes sufficiency. Where numbers are explicit, as in Brazil, system investment and implementation schedules can be derived mechanically. Japan's design does not permit that, and a wait-and-see posture becomes likely. The effective approach here is to complete a gap analysis mapping the eleven items against current controls first, and for items with undefined parameters, secure only the implementation feasibility across multiple scenarios in advance. Firms that wait for an industry norm to settle before starting will be reliably behind.

Sources

• Financial Services Agency, "Further Strengthening of Measures to Prevent Fraud Using Crypto Assets" (August 6, 2026) https://www.fsa.go.jp/news/r8/sonota/20260806/20260806.html
• Summary of the request (PDF, full eleven points) https://www.fsa.go.jp/news/r8/sonota/20260806/20260806.pdf
• National Police Agency, corresponding announcement https://www.npa.go.jp/bureau/sosikihanzai/tokusyusagi/angoushisan_taisakukyouka20260806.html
• NADA NEWS, "NPA Requests Strengthened Withdrawal Restrictions from All Crypto Exchanges" https://www.nadanews.com/362825/
• Atarashii Keizai, "FSA and NPA Request Withdrawal Restrictions from Crypto Exchanges" https://www.neweconomy.jp/posts/598862
• CRYPTO TIMES, "Will Crypto Become Unsendable Right After Purchase?" https://crypto-times.jp/news-fsa-japanese-cex-withdrawal-limit/
• National Police Agency, "Recognition and Clearance Status of Special Fraud and SNS-Based Investment and Romance Fraud in 2025 (Final Figures)" https://www.npa.go.jp/bureau/safetylife/sos47/new-topics/260605/01.html
• BeInCrypto Japan, on Central Bank of Brazil Resolution 584 https://jp.beincrypto.com/brazil-central-bank-crypto-transfer-delay/
• CoinPost, "Brazil's Central Bank Mandates Up to 24-Hour Delay on Crypto Transfers" https://coinpost.jp/?p=730620
• bitFlyer, FAQ on service restrictions for Pay-easy and convenience store deposits https://bitflyer.com/ja-jp/faq/6-20