Japan

The Japan Corporate Governance Code represents a modern “soft law” that lays down the basic principles of sustainable development and the creation of mid-to-long-term value among listed companies. Managed jointly by the Financial Services Agency and Tokyo Stock Exchange, the Code operates under a non-binding “Comply or Explain” model included in the listing rules of exchanges, obliging listed companies either to apply the principles of governance or explain their deviations from the established norms. With the recently adopted 2026 Revision, an efficient streamlining of the model was achieved by discarding the complex set of supplementary principles and developing the transparent system of General Principles, Principles, and Interpretive Guidance. Such an active revision compels listed companies to take responsibility and use idle cash to grow, increase diversity to 30% women officers by 2030, and provide maximum transparency through issuing an annual securities report (Yuho) three weeks before the annual general meeting, with all listed companies being obliged to issue the report by July 2027.

In Japan, the Payment Services Act (PSA) creates a regulatory framework for non-banking payment services and digital currencies, overseen by the Financial Services Agency (FSA). The June 2026 amendment to the PSA updates this framework through a new level of intermediary-only registration and compliance protocols for foreign stablecoins such as USDC.

The Act on Prevention of Transfer of Criminal Proceeds is Japan’s consolidated anti-money laundering/terrorist financing and anti-organized crime legislation. It requires all “specified businesses,” such as commercial banks, security firms, cryptocurrency exchanges, real estate agents, precious metals dealers, lawyers, and many others, to undertake thorough customer due diligence (CDD), identify beneficial owners, and document all transactions. All “specified businesses” are obligated to submit suspicious transaction reports (STRs) to JAFIC in case of any transaction suspected of using criminal proceeds. The law has extraterritorial surveillance measures and implements strict Travel Rules applicable to virtual assets. Moreover, the law authorizes regulators to perform risk-based inspections and imposes serious corporate penalties, thus guaranteeing that Japan’s economy will not have any relations with domestic organized crime groups (Yakuza).

The Financial Instruments and Exchange Act (FIEA) is regarded as Japan’s main statutory legislation on capital markets and corporate disclosures, as well as investor protections. Future amendments planned for May 2026 would update the tender offer and 5% Rule for large shareholding disclosures, whereas fiscal year 2027 reforms would move spot crypto asset regulation away from the Payment Services Act to the FIEA.

The Act on the Protection of Personal Information is a very well-balanced piece of legislation that creates a framework for the processing of personal information, providing extraterritorial jurisdiction over any entity operating globally that processes personal information about individuals in Japan. In accordance with the regulation, data controllers are required to disclose the intended purpose of the processing of the data, to take proper security measures in order to prevent any leaks, to keep transactional logs, and to receive explicit consent before transferring personal data to third parties and internationally. The Act contains a reciprocal data adequacy regime with the European Union and the UK, making it an extremely strong privacy standard for the whole world. The major amendments adopted in 2026 move Japan away from its pure consent approach to a risk-based approach for an accountable AI ecosystem. The new amendments include a very strict fines regime for business organizations, the creation of a highly protected category of "Specific Biometric Personal Information" (for example, facial recognition data), very tough rules for obtaining parental consent for minors under 16 years old, and transparency exceptions making it easier to use data for training AI models.

The Banking Act sets out a strict prudential regime to promote financial stability and protection for depositors and control of credit systems. According to its statutory provisions, no person may conduct the business of core banking that involves accepting deposits and lending money or providing transfers of money without being granted a bank license by the Prime Minister through the FSA. The legislation provides strict capital adequacy ratios according to global Basel III norms, corporate governance standards, accounting disclosures, and prohibits banks from conducting unapproved speculation in the form of secondary businesses. Moreover, it empowers the FSA to have strong regulatory powers to mandate internal audits, on-site examinations, enforceable Business Improvement Orders, or even cancel the banking licenses of institutions altogether to avoid macro-prudential risks to the system.