Japan's Financial Services Agency issues guidelines to strengthen cybersecurity at crypto exchanges

Japan’s Financial Services Agency (FSA) has issued guidelines aimed at strengthening cybersecurity at virtual asset (cryptocurrency) exchanges.

According to CoinPost on the 3rd (local time), the FSA formally published the “Policy direction for measures to strengthen cybersecurity in virtual asset exchange services and the like.” Reflecting 18 public submitted during a consultation conducted from February through March this year, the policy sets the protection of investors’ assets as the top priority.

The guidelines aim to harden security through a three-tier approach: “self-help” by individual firms, “cooperation” led by self-regulatory organizations, and “cooperation” by the authorities. In particular, they call for stronger organizational response capabilities in light of increasingly sophisticated attack methods—going beyond simple theft of private keys (seed phrases) to social engineering techniques and intrusions via outsourced service providers.

The authorities plan to boost the industry’s rapid-response capabilities by introducing crypto-specific scenarios into the joint financial-sector cyber drills known as “Delta Wall.”

Going forward, the FSA plans to conduct Threat-Led Penetration Testing (TLPT) at some major firms to directly verify the effectiveness of their security. It is also considering revising administrative guidelines to raise standards for cybersecurity-related staffing and external audit criteria, suggesting regulations will become more specific over time.