FSA Business Improvement Order (BIO) domestic VASP administrative-action history (2018-2026)

Wiki route

This entry sits under exchanges index. Read it against FSA crypto-asset exchange registration system — number system / Local Finance Bureau jurisdiction / registration requirements for peer / contrast context and Japan Financial Regulation — Legal Framework for Tokens, Crypto Assets, and Payments for the broader system / regulatory boundary.

1. Framework overview

A Business Improvement Order (BIO) is, among the administrative actions the Financial Services Agency issues to supervised operators, a mid-level action ordering the submission and execution of an improvement plan. For VASPs, the basis is Article 63 -9 of the revised Payment Services Act, and for operators that also conduct derivatives business, Article 51 of the FIEA. It is distinguished from the heavier Business Suspension Command (BSC), which orders a full suspension of business for a fixed period (issued together with a BIO for 2018 Coincheck, 2018 Tech Bureau, etc.). A BIO on its own is not an order to cease operations; business can continue with submission of an improvement plan and quarterly reporting.

2. Major BIO timeline (2018-2026)

• 2018-01-29 jp-exchange-coincheck — BIO + BSC after the outflow of approx. 580 億円 in NEM
• 2018-03 simultaneous on-site inspections 16 社 → BIOs issued in succession to multiple operators (bitFlyer / GMO Coin / multiple deemed operators)
• 2018-04 5 社 deemed operators withdraw (withdrawing registration applications due to difficulty submitting improvement plans)
• 2018-09-25 Tech Bureau (after the Zaif outflow of approx. 70 億円) jp-exchange-zaif — 3 th BIO
• 2018-12-21 Liquid (formerly QUOINE) jp-exchange-custodiem — deficiencies in business-operation framework
• 2019-07-05 BITPoint Japan — BIO after the outflow of approx. 35 億円
• 2021-04-23 Coincheck recurrence — deficiencies in the recurrence-prevention framework
• 2024-09-26 jp-exchange-dmm-bitcoin — BIO after the outflow of 4,502.9 BTC (approx. 482 億円) → moving toward ceasing business in 2025-03
• 2024 Custodiem (formerly FTX Japan) related action

3. Typical BIO structure (5 elements)

(a) review of the business-execution framework (staff placement / division of authority); (b) strengthening of segregated management of customer assets (cold-storage ratio / third-party audit); (c) building a system-risk-management framework (vulnerability management / intrusion detection); (d) strengthening of corporate governance (board involvement / independence of internal audit); (e) reporting obligations — submission of an improvement plan + quarterly progress reports.

4. Regulatory reflection

The BIO-concentration period 2018 年 (the chain of NEM / Zaif outflows) accelerated jvcea-self-regulatory-overview (certified 2018-10 ), the strengthening of self-regulation, and the cold-storage 95% obligation (2020 revised Payment Services Act). The 2024 DMM Bitcoin case, with Lazarus Group involvement, developed into international coordination on North Korea countermeasures (the 2024-12 US–Japan–South Korea joint statement).

5. International comparison

• Japan (FSA) = ex-ante supervision type — registration system + on-site inspection + continuous improvement via BIO
• US (SEC/CFTC) = ex-post prosecution type — civil lawsuits / criminal settlements against Coinbase / Kraken / Binance (2023-11 Binance $4.3B, etc.)

The Japan model emphasizes outflow prevention, but its regulatory power over unregistered overseas operators is limited to the issuance of warning letters (see: fsa-foreign-exchange-warning-system).

---

Related: jp-vasp-incident-history · jp-exchange-coincheck · jp-exchange-zaif · jp-exchange-custodiem · jp-exchange-dmm-bitcoin · jvcea-self-regulatory-overview · jp-vasp-regulatory-timeline · coincheck-nem-hack-detailed-analysis · dmm-bitcoin-lazarus-hack-detailed-analysis · global-vasp-regulatory-comparison-matrix

Sources: FSA published list of Business Improvement Orders (www.fsa.go.jp), Nikkei, ITmedia NEWS. Date tags have been applied to figures.