Japan: technology regulation at a glance

Framework: Payment Services Act (PSA, Act No. 59 of 2009, as amended) and Financial Instruments and Exchange Act (FIEA), administered by the Financial Services Agency (FSA), supported by self-regulatory organisations JVCEA (exchanges) and JSTOA (security tokens). A 2026 FIEA Amendment Bill (passed Lower House 11 June 2026) will migrate crypto-asset conduct rules from the PSA into the FIEA, with full effect expected within one year of promulgation.

Japan was one of the first jurisdictions to formally regulate crypto and operates a comprehensive, in-force licensing regime: crypto-asset exchange service providers (CAESPs) must be registered with the FSA under the PSA, stablecoins are codified as 'electronic payment instruments' (with a new foreign trust-type pathway effective 1 June 2026), and tokenised securities fall under the FIEA. A 2025 PSA amendment package (enacted 6 June 2025, taking effect 1–13 June 2026) broadens the perimeter to intermediary businesses and tightens stablecoin reserve, custody and redemption rules; a separate 2026 FIEA amendment will reclassify crypto-assets as financial instruments alongside a planned flat 20% tax (anticipated from 1 January 2028).

Framework: Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology (AI Promotion Act, Act No. 47 of 2025), supplemented by the Cabinet-level AI Basic Plan, the AI Strategy Headquarters under the Prime Minister's Office, and METI/MIC AI Guidelines for Business

Japan enacted its first dedicated national AI statute, the AI Promotion Act, on 28 May 2025, with full enforcement from September 2025. The law takes an innovation-first, light-touch approach: it sets basic principles, roles for the state, industry, academia and citizens, and creates an AI Strategy Headquarters chaired by the Prime Minister, but contains no penalties, no prohibitions and no mandatory conformity assessments — enforcement relies on administrative guidance, a 'name-and-shame' publication mechanism, and non-binding guidelines, backed by existing laws on personal data (APPI), copyright, consumer protection and sectoral regulation.

Framework: Act on the Protection of Personal Information (APPI, Act No. 57 of 2003), administered by the Personal Information Protection Commission (PPC)

Japan has a comprehensive, GDPR-adjacent personal data protection regime centred on the Act on the Protection of Personal Information (APPI), supervised by the independent Personal Information Protection Commission (PPC). The APPI covers private- and public-sector handling of personal information, grants data-subject rights (access, correction, deletion, opt-out) and imposes purpose-limitation, breach-notification and cross-border transfer obligations. Japan and the EU operate a mutual adequacy arrangement in force since January 2019, and a further APPI amendment package introducing administrative fines, child-specific protections, biometric rules and an AI/statistics processing lane was promulgated on 17 July 2026, to enter into force within two years.

Framework: Payment Services Act (PSA, Act No. 59 of 2009, as amended through 2025 — in force 1 June 2026); supervised by the Financial Services Agency (FSA) and Local Finance Bureaus. Supplementary regimes: Banking Act (open-banking APIs), Installment Sales Act (credit/BNPL, administered by METI).

Japan operates a mature, in-force licensing regime for non-bank payments and e-money under the Payment Services Act, administered by the FSA. The PSA creates distinct registration categories for Fund Transfer Service Providers (three tiers by ticket size), Prepaid Payment Instrument Issuers, Electronic Payment Instrument Service Providers (stablecoin exchange/intermediation), and Electronic Payment Service Providers (open-banking API intermediaries). The 2025 amendment package, effective 1 June 2026, extends the regime to foreign trust-type stablecoins, tightens asset-conservation rules, and creates a new crypto-asset / electronic-payment-instrument intermediary business.

Framework: Specified Visa – Designated Activities (Notice No. 53) for 'Digital Nomad' and spouse/child, administered by the Ministry of Foreign Affairs (MOFA) and the Immigration Services Agency of Japan (ISA)

Japan launched a dedicated digital nomad visa on 31 March 2024 under the 'Designated Activities' residence category, letting qualifying foreign remote workers stay up to six months while performing overseas-based work. Eligibility is restricted to passport holders of ~49–51 jurisdictions that are both visa-exempt for short stays and party to a tax treaty with Japan, and requires JPY 10 million (~USD 68k) annual income plus private health insurance with JPY 10 million medical coverage. The visa is non-renewable and non-extendable, and separate longer-term routes (Highly Skilled Professional, Business Manager) remain the main pathways to residency and permanent residence, as Japan has no traditional 'golden visa'.

Framework: Information Distribution Platform Act (IDPA, amended Provider Liability Limitation Act, in force 1 April 2025), administered by the Ministry of Internal Affairs and Communications (MIC); supplemented by the 2008 Act on Development of an Internet Environment for Young People, with a dedicated child-safety / age-verification regime still at the proposal stage.

Japan does not have a single DSA/OSA-style omnibus online-safety statute, but since April 2025 its amended Provider Liability Limitation Act — renamed the Information Distribution Platform Act (IDPA) — imposes mandatory takedown-procedure and transparency obligations on MIC-designated large platforms (Google, Meta, X, TikTok, LINE Yahoo and others). Youth protection remains governed by the older 2008 Youth Internet Environment Act (mobile filtering + 'best efforts' duties), while a 2026 MIC/Children & Families Agency panel is still consulting on binding age-verification and penalty rules expected around FY2027.

Framework: Basic Act on Cybersecurity (Act No. 104 of 2014, amended 2025) supplemented by the Active Cyber Defense Acts (May 2025), the Economic Security Promotion Act (2022), and the Act on the Protection of Personal Information (APPI); coordinated by the National Cybersecurity Office (NCO, successor to NISC, July 2025)

Japan operates a comprehensive, multi-layered cybersecurity regime anchored by the Basic Act on Cybersecurity (2014, amended 2025) and recently strengthened by the Active Cyber Defense (ACD) Acts enacted on 16 May 2025, which impose incident-reporting and cooperation duties on operators across 15 critical-infrastructure sectors with phased implementation through 2026-2027 and most provisions commencing 1 October 2026. The National Cybersecurity Office (NCO), established July 2025 as the enhanced successor to NISC within the Cabinet Secretariat, is the central coordinating authority, while the APPI (overseen by the Personal Information Protection Commission) governs personal-data breach notification. Sectoral regulators (FSA, METI, MIC, MHLW, etc.) layer additional cybersecurity rules on finance, telecoms, energy, healthcare and other critical sectors.

Framework: Japan Companies Act (Kaishahō) governs incorporation; registration is handled by the Legal Affairs Bureau (Hōmukyoku) under the Ministry of Justice. Foreign investment is overseen under the Foreign Exchange and Foreign Trade Act (FEFTA), administered by the Ministry of Finance and the Bank of Japan. Residency/work rights for founders are governed by the Immigration Control Act, in particular the 'Business Manager' status of residence.

Japan permits 100% foreign ownership of a Japanese company (Kabushiki Kaisha/K.K. or Gōdō Kaisha/G.K.) with no legally required minimum capital under the Companies Act, and registration is centralized at the Legal Affairs Bureau. In practice, however, incorporation involves Japanese-language articles of incorporation, notarization, capital deposit, FEFTA notification for designated sectors, and a tightened Business Manager Visa regime (effective 16 October 2025) that requires at least ¥30 million in capital and one qualifying full-time employee for founders needing residency. Setup is straightforward on paper but friction with banking, language and immigration makes the overall experience moderate rather than easy.