Japan's Financial Services Agency, working with the National Police Agency, has asked domestic crypto exchanges to slow down withdrawals as a defense against fraud. The request, reported by Cointelegraph on August 7, 2026, went to the Japan Virtual and Crypto Assets Exchange Association, the industry's self-regulatory body. It lays out a set of controls designed to keep stolen or scam-linked money from leaving an exchange before it can be flagged.
The core idea is friction. When a criminal tricks a victim into depositing funds or buying crypto, the money often needs to move fast to a wallet the attacker controls. Every measure in the FSA's request attacks that speed.
The measures on the table
The regulator asked exchanges to consider five main controls:
- Withdrawal delays after a fiat deposit or a digital asset purchase, holding funds for a specified window before they can leave the platform.
- Address pre-registration, where users register a withdrawal address in advance and wait out a cooldown before a newly added address becomes usable.
- Customer-specific limits tailored to each account's history and risk profile, rather than one blanket cap.
- Phishing-resistant multifactor authentication, moving away from methods that attackers can intercept or socially engineer around.
- Tighter monitoring of transactions and login environments, plus a check that the bank remitter name matches the crypto account holder's name.
The FSA framed the request around a concrete problem. In its statement, the agency pointed to "growing losses among crypto exchange users and cases where funds obtained through fraudulent schemes are being transferred to exchange accounts." Exchanges act as both the entry point for victim money and the exit ramp for stolen funds, which puts them in a position to break the chain.
Guidance, not a mandate
These are recommendations, not binding rules. Exchanges keep discretion over how and whether to apply each control based on their own operations and risk exposure. That distinction matters. A non-binding request from the FSA still carries weight in Japan, where the regulator's expectations tend to shape industry practice even without formal enforcement, but it leaves room for platforms to calibrate rather than adopt every measure wholesale.
The approach fits a wider pattern. Rather than write prescriptive law for a fast-moving sector, the FSA is nudging the self-regulatory body to set standards its members then implement. It is slower than a mandate but more flexible, and it avoids locking rigid rules into statute while fraud tactics keep shifting.
Friction versus access
Every control here trades convenience for safety. A withdrawal delay that stops a scammer also stops a legitimate user who needs funds during a fast market. Address pre-registration protects against a hijacked account draining to a fresh wallet, but it frustrates anyone moving to a new exchange or hardware wallet on short notice. Per-customer limits reduce blast radius while capping power users.
That tension is the real story. Japan is betting that most users will accept a short wait in exchange for a lower chance of losing everything to a scam, and that the friction lands harder on criminals working against the clock than on ordinary account holders.
For anyone who funds a crypto card or spending account from a Japanese exchange, the practical takeaway is timing. If withdrawal delays and address cooldowns become standard, moving balances from an exchange to a self-custody wallet or a card top-up will need more lead time. People who spend from their own wallet sidestep some of this, since the exchange withdrawal happens once rather than on every transaction, but the first move off the exchange still runs through whatever hold an exchange adopts. Users in Japan should expect the funding step to get slower before it gets safer.
Overview
Japan's FSA and National Police Agency jointly asked crypto exchanges, through the country's self-regulatory association, to add friction to withdrawals: holding periods after deposits, pre-registered addresses with cooldowns, per-customer limits, phishing-resistant authentication, and name-matching checks. The measures target the moment stolen funds try to leave an exchange. They are recommendations rather than law, so adoption will vary by platform. Expect slower withdrawals and more upfront setup at Japanese exchanges if the guidance takes hold, with the trade-off being fewer completed scam payouts.
