FSA Publishes Crypto-Asset AML Information-Sharing Pilot Results

The Financial Services Agency established the FinTech Proof-of-Concept Hub on September 21, 2017, to dispel hesitation and concerns among fintech companies and financial institutions undertaking unprecedented pilot projects.

The announcement concerns Case 13, for which support was approved under this framework, and the pilot project was announced on February 27, 2026. The project was conducted from March through May 2026.

Crypto-assets and related instruments can be transferred instantly across borders, but a blockchain address alone cannot identify the holder. Against this background, the effectiveness and legal issues of joint information sharing among private-sector businesses were examined.

If suspicious addresses and transaction information can be shared across industries, risk indicators that are difficult for individual businesses to identify alone could be used to enhance and improve the efficiency of AML measures for crypto-assets and related instruments.

At the same time, businesses are required to establish mechanisms that make the grounds for alerts understandable and to make specific individual judgments so that false positives do not unjustly harm the rights and interests of customers and others.

Going forward, AML measures for crypto-assets and related instruments are expected to be enhanced and made more efficient through mutual assistance among businesses.

The applicant was Hitachi, Ltd. Participating financial institutions and other organizations included Aozora Bank, Ltd., JPYC Inc., GMO Coin, Inc., Chainalysis Japan K.K., DCP Co., Ltd., Digital Platformer Co., Ltd., NEC Corporation, Japan Blockchain Foundation, Inc., finoject Inc., bitbank, Inc., Rakuten Wallet, Inc., Laser Digital Japan Co., Ltd., KPMG AZSA LLC, Digital Asset Markets, Inc., and 3 businesses whose names were not disclosed.

The information shared included suspicious addresses, transaction information, risk categories, risk scores, detection reasons, information sources, and confirmation dates and times. The evaluation combined information shared among businesses, sanctions and crime-related connections, fraud-related addresses, transaction-behavior similarity, and disposable addresses.

The monitoring system tested subsequent monitoring for continuous customer due diligence and transaction monitoring, real-time online assessment to verify destination addresses before transactions were executed, and token monitoring to identify the holding and transfer status of electronic payment instruments and use the information for freezing and cancellation.

The project confirmed that alerts alone may be insufficient for deciding whether to file suspicious transaction reports, restrict transactions, or freeze and cancel electronic payment instruments, and that additional investigations into fund flows, public information, and related addresses are necessary.

The Financial Services Agency advised that businesses should make it possible to understand the grounds for alerts and establish procedures for the relevance, accuracy, and timeliness of data, as well as for correction, updating, deletion, and the exercise of rights. Regarding the provision of personal data to third parties based on consent, it was determined that previously collected personal data may also be provided if valid consent exists at the time of provision. By contrast, applying the exception for protecting property requires an individual and specific balancing of interests based on factors including the disadvantage to the individual, the necessity of the provision, the likelihood that the individual is connected to fraud or other wrongdoing, and the reasonableness of the scope of the data and recipients.

The participants confirmed the need to examine the scope and conditions of sharing, data quality, data-management responsibilities, retention periods, correction and deletion, improvements to detection logic, access controls, authorization management, audit logs, and responses to complaints and objections, and to establish internal rules, contracts, and operational procedures based on legal reviews and privacy impact assessments.