TLDR:
- Japan’s FSA will mandate liability reserve funds for crypto exchanges to protect users from hacks.
- Exchanges may be allowed to use insurance to cover part of the reserve mandate.
- The reserve system draws on precedent from Japan’s securities market regulation.
- The FSA is also proposing stricter registration for crypto custody and service providers.
Japan’sFinancial Services Agency (FSA) is moving to require cryptocurrency exchanges to set aside liability reserves to cover losses from hacks or unauthorized outflows. T
he change comes amid global concern over security incidents and aims to give customers quick compensation. A working group under the Financial System Council is drafting a report that will call for new legal obligations. The FSA is expected to submit a bill in 2026 to formalize the reserve requirement.
Mandatory Reserve Funds for Crypto Exchanges
Under the new regulatory proposal, exchanges in Japan will have to maintain a dedicated liability reserve. These funds would act as a buffer to pay customers if assets are stolen or drained due to unauthorized access.
Currently, Japanese exchanges are required only to store customer assets in cold wallets, but they do not need to earmark separate compensation reserves.
The FSA plans to model the reserve requirements on those used in Japan’s securities industry. In traditional markets, brokers are required to set aside capital to cover illegal trades, system errors, or other operational risks.
To help ease the financial burden on exchanges, regulators may allow a portion of these liabilities to be hedged through insurance.
These rules reflect lessons from past incidents.
For example, in May 2024, DMM Bitcoin suffered a major security breach. Regulators believe that setting aside reserve funds will significantly improve consumer protection.
How This Fits Into Broader Regulatory Reforms
The reserve mandate is only one part of a broader regulatory overhaul by Japan’s FSA.
The agency is also proposing new registration rules for crypto custodians and service providers. Under the proposal, any third-party custodian or trading management provider would need to be registered before working with exchanges.
That move addresses security gaps exposed by the DMM Bitcoin hack.
In that case, the attacker exploited weaknesses in a third-party firm that managed DMM’s trading infrastructure. Requiring registered custody providers would limit exchanges to using only vetted, licensed partners.
In parallel, Japan is also revising its legal framework for crypto more broadly.
The FSA is pushing to reclassify crypto assets under the Financial Instruments and Exchange Act by 2026. That shift would bring crypto under the same rules as traditional financial products, including insider trading restrictions.
