Japan’s Financial Services Agency (FSA) has moved aggressively against the domestic cryptocurrency sector, announcing penalties against seven crypto exchanges and ordering two of them to suspend operations. The action came after inspections launched in the wake of the Coincheck hack revealed deficiencies in customer protection and anti-money-laundering controls, reinforcing concerns that another major exchange incident could occur if oversight was not tightened.
Two Exchanges Ordered to Halt Business
The FSA said Bit Station and FSHO must suspend business from March 8 to April 7. Both firms were operating as quasi-operators, meaning they had been allowed to run exchange services while their registration applications were still under review. In addition to the suspension order, the regulator instructed the two companies to submit business improvement plans by March 22.
Five other exchanges were also told to improve their internal controls and compliance systems. These included Tech Bureau, GMO Coin, Lemuria Bitcoin Exchange (Bitcrements), Mister Exchange, and Coincheck. Of these, Tech Bureau and GMO Coin were fully licensed operators, while the remaining three were quasi-operators still awaiting final registration status.
Regulatory Pressure Intensifies After Coincheck
Japan has been one of the most prominent regulated crypto markets since the revised Payment Services Act took effect in April of the previous year. Under that framework, cryptocurrency exchanges are required to register with the FSA. At the time of the report, 16 exchanges had received licenses, while another 16 were allowed to operate as quasi-operators during the review process. More than 100 additional companies were reportedly seeking to enter the market.
That rapid industry expansion has also increased the burden on supervisors. Following the January hack of Coincheck, the FSA began checking all exchanges in the country. The Coincheck breach had a major impact on the market after approximately 58 billion yen, or about $550 million, worth of NEM tokens was stolen. The scale of the loss renewed scrutiny over how exchanges safeguarded client assets, managed wallets, and monitored internal risks.
Inspections Found Weak Customer Protection and AML Controls
According to the findings cited in the report, the inspections were not yet complete, but the FSA had already identified enough weaknesses to justify immediate intervention. The central concerns were inadequate customer protection measures and insufficient anti-money-laundering controls. These issues were especially serious among some of the unregistered operators, suggesting that firms still in the application stage faced greater compliance gaps than established licensed venues.
Reports indicated that five unregistered exchange operators were viewed as particularly problematic. The message from regulators was clear: these businesses would either need to meet the agency’s requirements and complete registration or withdraw from the process. In practical terms, this signaled that Japan was no longer willing to tolerate prolonged operation under temporary or incomplete compliance standards.
Bit Station Case Raised Additional Concerns
One of the most serious allegations involved Bit Station. Reuters reported that a senior employee at the company had used customers’ bitcoin for personal purposes. The exchange subsequently withdrew its application to become an authorized operator. That detail highlighted a broader regulatory concern: the problem was not limited to external hacking risk, but also included internal misconduct, weak governance, and poor segregation of customer assets.
For regulators, this distinction matters. A major exchange failure can be triggered not only by cyberattacks but also by poor internal controls, abuse of access privileges, and failures in management oversight. By targeting firms where such weaknesses had surfaced, the FSA appeared to be sending a strong signal that operational discipline and corporate governance would be treated as core licensing requirements.
Coincheck’s Financial Position Also Reviewed
Coincheck, which was among the firms receiving a business improvement order, had already been under intense pressure since the January hack. After the breach, the exchange promised to compensate customers for part of their losses, but questions quickly emerged over whether it had enough funds to carry out that commitment. The FSA said it had verified that Coincheck possessed sufficient financial resources to repay users as promised.
That confirmation was significant because it addressed one of the market’s key concerns in the aftermath of the theft. While the regulator was clearly dissatisfied with the exchange’s controls, its statement suggested that customer reimbursement remained financially feasible. At the same time, Coincheck was still required to strengthen oversight and management of the systems implicated in the NEM incident.
A Turning Point for Japan’s Crypto Oversight
The FSA’s actions marked an important phase in the evolution of Japan’s crypto regulatory framework. Rather than stepping back from the sector, authorities chose to tighten supervision while keeping the legal market structure intact. The simultaneous use of suspension orders and business improvement directives suggested a layered approach: firms with the most serious deficiencies faced operational shutdowns, while others were given a chance to remediate under close scrutiny.
The episode also underscored a tension that remains relevant across global digital asset markets: fast growth can outpace internal controls. Japan had become one of the most active crypto jurisdictions, but the Coincheck fallout showed that licensing alone was not enough. Ongoing monitoring, strong internal governance, client asset protection, and robust AML systems remained essential to maintaining trust.
For exchange operators, the message was unmistakable. Access to a major regulated market like Japan comes with high expectations around compliance and operational integrity. For customers, the crackdown may have been disruptive in the short term, but it also reflected an effort to reduce the risk of another large-scale loss. In that sense, the punishment of seven exchanges was not just an enforcement event—it was a broader statement about the standards Japan expected its crypto industry to meet.