Japan's Financial Services Agency announces cybersecurity enhancement guidelines for cryptocurrency exchange operators

ME News message, on April 4 (UTC+8), according to market sources, Japan’s Financial Services Agency has officially released the “policy guidelines on strengthening cybersecurity measures for operators of crypto asset exchanges and related businesses.” The guidelines were developed based on 18 public submissions collected from February to March 2026, with protecting investors’ assets as the top priority. They propose a three-tier security strengthening framework of “self-help (individual operators), mutual help (industry self-regulatory oversight bodies), and public help (regulatory authorities).” The authority noted that cyberattacks have evolved from simple theft of signing keys to highly organized methods such as social engineering attacks and supply-chain intrusions, and that traditional cold-wallet management can no longer ensure security. Going forward, the Financial Services Agency will conduct threat-driven penetration testing (TLPT) on certain major operators, and also plans to revise the transaction guidance to improve cybersecurity staffing and external audit standards. (Source: ChainCatcher)