Japon KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Japon.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Guide d’implémentation portable
Obtenir la checklist PDF
11 domaines de contrôle · 33 contrôles d’implémentation
Dernière revue: 25 September 2026 · Version 1.0
Télécharger la checklistRéponse directe
Que couvre la checklist de conformité pour Japon ?
La checklist pour Japon traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 33 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- FIU
- Japan Financial Intelligence Center (JAFIC), National Police Agency
- Primary AML rule
- Act on Prevention of Transfer of Criminal Proceeds and its current Order and Ordinance
- STR timing and route
- Promptly to the competent administrative authority through its prescribed route; JAFIC centralizes and analyzes notified information
- Threshold reporting
- No universal cash-threshold report; CDD thresholds and transaction-record exclusions are sector- and transaction-specific
- High-risk source check
- For a high-risk transaction transferring more than JPY 2 million, verify assets and income to the extent required by the APTCP framework
- AML records
- Generally 7 years, with the start event depending on verification or transaction record type
- Privacy authority
- Personal Information Protection Commission (PPC) under the APPI
- FATF public lists
- Not listed at 19 June 2026
Détail d’implémentation
Exigences et actions de conformité pour Japon
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingJapan applies the APTCP by specified business, specified activity and specified transaction, with supervision remaining sector-specific.3 éléments+
Map each Japanese activity to the specified-business and specified-transaction perimeter.
- Action d’implémentation
- Classify the legal entity, service, customer, transaction and exemptions under APTCP Article 2, the Enforcement Order and Enforcement Ordinance before onboarding or product launch; do not assume every business or every transaction is covered identically.
- Preuves à conserver
- Perimeter memo, service and funds-flow map, statutory mapping, exemptions and Japanese counsel sign-off.
- Source primaire
- APTCP Articles 2 and 4; Enforcement Order Articles 6 and 7; JAFIC APTCP Overview dated 7 August 2026
Identify the competent administrative authority and filing channel for each regulated activity.
- Action d’implémentation
- Record the sector supervisor, registration or licence, APTCP reporting destination and current e-Gov or authority procedure; distinguish the reporting destination from JAFIC's FIU analysis role.
- Preuves à conserver
- Authority matrix, licence or registration, filing credentials, test submission and escalation contacts.
- Source primaire
- APTCP Articles 8 and 13; JAFIC suspicious-transaction reporting destination table
Obtain the required financial-services registration or authorization before operating.
- Action d’implémentation
- Map banking, funds-transfer, electronic-payment-instrument, crypto-asset, prepaid-payment, financial-instruments and intermediary activities to the current business law and FSA perimeter; obtain approval or registration and observe scope and conditions.
- Preuves à conserver
- Regulatory-perimeter analysis, application, FSA or Local Finance Bureau decision, conditions and renewal or change log.
- Source primaire
- Payment Services Act; Banking Act; Financial Instruments and Exchange Act; FSA FinTech Support Desk guidance
02Governance and risk assessmentControls must reflect Japan's national risk assessment, the operator's own risks and sector-supervisory expectations.3 éléments+
Maintain an enterprise-wide ML/TF/PF risk assessment.
- Action d’implémentation
- Assess customers, beneficial owners, products, services, countries, delivery channels, transactions, technologies, agents and outsourced providers; incorporate the current National Risk Assessment and refresh for material change.
- Preuves à conserver
- Methodology, current assessment, data sources, inherent and residual risk, approval and remediation plan.
- Source primaire
- APTCP Article 11; Enforcement Ordinance Article 32; 2025 National Risk Assessment; FSA AML/CFT Guidelines revised 31 March 2026
Maintain risk-based policies, governance and an accountable control function.
- Action d’implémentation
- Document customer verification, ongoing review, monitoring, STR, transfer information, sanctions, records, training, audit and outsourcing controls; designate an overall manager and give management usable risk reporting.
- Preuves à conserver
- Approved framework, roles, committee minutes, management information, training, control testing and issue closure.
- Source primaire
- APTCP Article 11; Enforcement Ordinance Article 32; FSA AML/CFT Guidelines revised 31 March 2026
Test whether the framework operates effectively.
- Action d’implémentation
- Use independent and risk-based validation to test data, scenarios, customer-risk models, screening, reporting, record retrieval and remediation rather than relying only on policy existence.
- Preuves à conserver
- Testing plan, samples, model and data validation, findings, owners, deadlines and verified closure.
- Source primaire
- FSA AML/CFT Guidelines revised 31 March 2026; FSA dialogue paper on validation of effectiveness
03Natural-person identificationTransaction verification applies at the legally defined trigger and must establish the customer and any person acting for the customer.3 éléments+
Complete transaction verification at each applicable trigger.
- Action d’implémentation
- Before or when conducting a specified transaction, verify identification particulars, transaction purpose and occupation using a method permitted for the channel; aggregate an apparently split transaction when the Order requires it.
- Preuves à conserver
- Trigger analysis, identity data, verification source and method, purpose, occupation, timestamp and exception rationale.
- Source primaire
- APTCP Article 4; Enforcement Order Article 7; Enforcement Ordinance Articles 4 to 10; JAFIC APTCP Overview
Verify the representative and their authority.
- Action d’implémentation
- Where an individual acts for another customer, verify that individual's identification particulars and establish a valid basis for authority; do not treat an employee card or non-representative officer registration alone as sufficient authority.
- Preuves à conserver
- Representative KYC, mandate or authority evidence, customer confirmation, scope and transaction log.
- Source primaire
- APTCP Article 4(4); Enforcement Ordinance Article 12; JAFIC APTCP Overview, representative verification
Use remote verification methods only when every prescribed condition is met.
- Action d’implémentation
- Select a current Enforcement Ordinance method for non-face-to-face onboarding, test document authenticity and impersonation controls, preserve the required evidence and stop or escalate when verification cannot be completed reliably.
- Preuves à conserver
- Method legal mapping, images or electronic evidence, liveness and fraud tests, device signals, result and exception review.
- Source primaire
- APTCP Article 4; Enforcement Ordinance Article 6 as amended; JAFIC materials on transaction-verification methods
04KYB, registries, and beneficial ownershipCommercial-registry evidence supports KYB, but beneficial ownership requires a separate natural-person control analysis.3 éléments+
Verify a legal person's identity, existence, business and representative.
- Action d’implémentation
- Obtain current commercial or corporation registration, constitutional information, head office, corporate number, officers and business purpose from reliable sources and resolve discrepancies.
- Preuves à conserver
- Legal Affairs Bureau certificate or registry data, corporate-number check, constitutional documents, officer list and discrepancy log.
- Source primaire
- APTCP Article 4; Enforcement Ordinance Articles 6 and 7; Commercial Registration Act; Ministry of Justice commercial-registration guidance
Identify the natural persons who ultimately own or control the legal person.
- Action d’implémentation
- For a capital-majority corporation, identify natural persons with more than 25% direct or indirect voting rights unless a person with more than 50% displaces that tier, then assess control by other means and apply the prescribed senior-manager fallback when no other natural person is identified; use the applicable test for other legal-person types.
- Preuves à conserver
- Layered ownership chart, voting-right calculations, control evidence, verified identities and fallback rationale.
- Source primaire
- APTCP Article 4(1)(iv); Enforcement Ordinance Article 11; JAFIC APTCP Overview, beneficial-owner method
Treat the Beneficial Ownership of Legal Persons List as corroboration, not conclusive proof or a universal public register.
- Action d’implémentation
- Where a stock company supplies a registrar-certified copy, verify its date, attachments and scope, then corroborate ownership and control. Record that the system is request-based, is limited to eligible stock companies and does not prove the submitted description is true.
- Preuves à conserver
- Certified list copy, attachment inventory, independent corroboration, current ownership check and limitations note.
- Source primaire
- Ministry of Justice Beneficial Ownership of Legal Persons List System; Enforcement Ordinance Article 11(2)
05PEPs, enhanced due diligence, and remote riskThe APTCP defines foreign PEP transactions as high risk; financial-sector expectations require broader risk-sensitive management where relevant.3 éléments+
Identify foreign PEPs, specified family members and legal persons they beneficially own.
- Action d’implémentation
- Screen customers and beneficial owners at onboarding and periodically for the foreign-PEP categories in the Enforcement Ordinance, including former office holders and covered family relationships.
- Preuves à conserver
- Screening source and date, role and relationship analysis, ownership evidence, false-positive disposition and refresh history.
- Source primaire
- Enforcement Order Article 12; Enforcement Ordinance Article 15; JAFIC APTCP Overview, high-risk transactions
Apply the prescribed enhanced verification to high-risk transactions.
- Action d’implémentation
- Use the stricter identity and beneficial-owner verification method for impersonation or false-information risk, customers in designated high-risk jurisdictions and foreign PEP transactions. For a high-risk transfer above JPY 2 million, verify assets and income to the extent needed for the STR decision.
- Preuves à conserver
- Trigger, enhanced sources, dual verification, assets-and-income evidence where scoped, approval and monitoring plan.
- Source primaire
- APTCP Article 4(2); Enforcement Order Articles 12 and 13; JAFIC APTCP Overview, high-risk verification and JPY 2 million scope
Do not treat domestic PEP screening as an express APTCP foreign-PEP rule.
- Action d’implémentation
- Where sector guidance or the risk assessment supports screening Japanese public functions, document it as a risk-based control and define approval, source-of-funds, source-of-wealth and monitoring measures without mislabeling it as the statutory foreign-PEP category.
- Preuves à conserver
- Policy basis, risk assessment, screening result, approval, corroboration and review history.
- Source primaire
- FSA AML/CFT Guidelines revised 31 March 2026; APTCP foreign-PEP provisions
06Ongoing monitoring and suspicious transaction reportingSuspicion is risk-based, covers attempted or refused activity in relevant cases and must be reported promptly without tipping off.3 éléments+
Keep verified information current and monitor activity against purpose and risk.
- Action d’implémentation
- Refresh customer, representative and beneficial-owner information; compare activity with expected purpose, occupation or business, known history and the National Risk Assessment; investigate unusual or inconsistent activity.
- Preuves à conserver
- Refresh schedule, monitoring scenarios, alert chronology, investigation, decision and quality review.
- Source primaire
- APTCP Articles 8 and 11; Enforcement Ordinance Articles 26 and 32; FSA AML/CFT Guidelines revised 31 March 2026
Report qualifying suspicion promptly to the competent administrative authority.
- Action d’implémentation
- When property received in specified business is suspected criminal proceeds or the customer is suspected of concealment or receipt conduct, record when suspicion arose and submit promptly through the current sector route. Include attempted or refused activity when the statutory test is met; do not wait for proof.
- Preuves à conserver
- Suspicion chronology, legal test, decision-maker, report, submission receipt and authority correspondence.
- Source primaire
- APTCP Article 8; Enforcement Ordinance Articles 25 and 26; JAFIC APTCP Overview and reporting guidance
Apply the professional-sector exceptions and protect report confidentiality.
- Action d’implémentation
- Confirm whether the operator is excluded or whether professional secrecy limits a report. For a reportable case, prevent disclosure to the customer or related person and restrict report data to authorized personnel.
- Preuves à conserver
- Sector and privilege analysis, access log, disclosure controls, training and incident record.
- Source primaire
- APTCP Articles 8 and 12; JAFIC APTCP Overview dated 7 August 2026
07Payments, transfers, thresholds, and virtual assetsAmounts in Japan serve different purposes; no single figure is a universal CDD or cash-reporting threshold.3 éléments+
Apply each sector-specific CDD threshold and anti-structuring rule only to its legal context.
- Action d’implémentation
- Map account opening, large cash transactions, remittances, payment instruments, crypto-assets, professional services and other specified transactions to the current Order. Aggregate an apparently divided transaction where required and apply special-attention CDD even below a normal threshold.
- Preuves à conserver
- Threshold matrix, transaction aggregation logic, scenario tests, exceptions and legal citations.
- Source primaire
- APTCP Article 4; Enforcement Order Article 7; Enforcement Ordinance Articles 4 and 5; JAFIC APTCP Overview
Transmit required originator and beneficiary information for covered transfers.
- Action d’implémentation
- For foreign-exchange transfers, electronic payment instruments and crypto-assets, populate the prescribed sender and recipient fields, validate completeness, retain the information and apply repair or restriction procedures for missing data.
- Preuves à conserver
- Field matrix, payment or transfer messages, validation rules, exception queue, disposition and retention evidence.
- Source primaire
- APTCP Articles 10, 10-3 and 10-5; 2024 fully effective amendments; FSA travel-rule notice effective 3 August 2026
Use the correct Payment Services Act category and registration.
- Action d’implémentation
- Classify funds-transfer services as Type I, II or III and respect the category conditions; register covered crypto-asset exchange and electronic-payment-instrument services before operation and verify counterparties against current FSA information.
- Preuves à conserver
- Product and value-flow analysis, category and limit tests, authorization or registration, counterparty checks and change monitoring.
- Source primaire
- Payment Services Act; FSA FinTech Support Desk; FSA registered crypto-asset exchange provider list
08Targeted financial sanctionsJapan's sanctions framework uses transaction restrictions, permission requirements and domestic asset-freezing measures; the applicable list and legal mechanism must be identified.3 éléments+
Screen against current Japanese designations and restrictions.
- Action d’implémentation
- Screen customers, beneficial owners, controllers, representatives, counterparties and transactions against the Ministry of Finance and Ministry of Foreign Affairs lists at onboarding, before execution and when lists change; assess ownership and control beyond exact-name matching.
- Preuves à conserver
- List versions, update logs, configuration tests, match analysis and disposition.
- Source primaire
- Foreign Exchange and Foreign Trade Act; Ministry of Finance economic-sanctions measures and target lists
Prevent a prohibited or unlicensed payment, capital transaction or asset dealing.
- Action d’implémentation
- Place an immediate operational hold on a potential match, identify whether FEFTA, the International Terrorist, etc. Asset-Freezing Act or another measure applies, obtain any required permission before activity and follow the competent authority's reporting or consultation route.
- Preuves à conserver
- Match and ownership-control analysis, hold timestamp, legal-mechanism memo, authority contact, permission and release decision.
- Source primaire
- FEFTA; International Terrorist, etc. Asset-Freezing Act; Ministry of Finance AML/CFT/CPF regime overview
Keep AML suspicion and sanctions decisions linked but legally distinct.
- Action d’implémentation
- Assess whether the same facts require an STR, sanctions action, both or neither; do not delay sanctions control while investigating suspicion and do not assume a sanctions false positive resolves AML risk.
- Preuves à conserver
- Parallel decision log, STR assessment, sanctions disposition, approvals and case closure.
- Source primaire
- APTCP Article 8; FEFTA; International Terrorist, etc. Asset-Freezing Act
09Records and regulator accessSeven years is the central APTCP period, but the record category determines when the clock starts.3 éléments+
Retain verification records for seven years from the applicable end event.
- Action d’implémentation
- Create the record immediately after verification and retain it for seven years from termination or completion of the contract or transaction specified by the APTCP framework; preserve the method, documents and verified matters.
- Preuves à conserver
- Verification record, retention classification, start event, deletion hold and retrieval test.
- Source primaire
- APTCP Article 6; Enforcement Ordinance Articles 19 and 20; JAFIC APTCP Overview
Retain covered transaction records for seven years from the transaction date.
- Action d’implémentation
- Record the customer or lookup key, date, type, value and transfer origin or destination for covered activity and retain for seven years, subject to the scoped small-transaction exclusions.
- Preuves à conserver
- Transaction record, source and destination fields, exclusion rationale, retention proof and retrieval test.
- Source primaire
- APTCP Article 7; Enforcement Ordinance Articles 23 and 24; JAFIC APTCP Overview
Provide accurate and retrievable records to the competent authority.
- Action d’implémentation
- Maintain Japanese-readable records and controlled export procedures so reports, inspections and correction orders can be answered completely without altering source data or exposing STR information improperly.
- Preuves à conserver
- Request log, data lineage, production package, approval, delivery receipt and remediation tracking.
- Source primaire
- APTCP Articles 15 to 18; applicable sector supervisory law
10Privacy, biometrics, breaches, and transfersKYC necessity does not remove the separate APPI duties for purpose, notice, security, third parties, overseas transfers and incidents.3 éléments+
Specify lawful use purposes and minimize KYC personal information.
- Action d’implémentation
- Identify and communicate the use purpose as specifically as possible, collect only data needed for AML, fraud, sanctions and service purposes, control incompatible use and honor applicable access, correction and cessation rights.
- Preuves à conserver
- Data inventory, purpose register, notices, necessity assessment, rights workflow and deletion schedule.
- Source primaire
- APPI Articles 17 to 21 and 32 to 39; PPC APPI legal materials
Protect identity and biometric data with risk-appropriate safeguards.
- Action d’implémentation
- Classify face images, facial templates and other identity data under the APPI based on their actual form and use; document necessity, accuracy and retention, restrict access, test vendors and avoid treating every biometric as automatically special care-required personal information.
- Preuves à conserver
- Data classification, privacy assessment, security controls, accuracy and bias tests, vendor review and deletion evidence.
- Source primaire
- APPI Articles 2 and 23; PPC Guidelines; PPC facial-recognition principles
Control reportable breaches and foreign third-party transfers.
- Action d’implémentation
- Escalate a qualifying leakage or other incident to the PPC and affected individuals under the Act and Rules, preserving the preliminary and final reporting clocks that apply to the incident. Before providing personal data to a third party abroad, use consent or a valid statutory route, provide required country and safeguard information and maintain continuing-information duties where applicable.
- Preuves à conserver
- Incident assessment, PPC reports and notices, transfer map, recipient-country information, consent or exception, contract and monitoring.
- Source primaire
- APPI Articles 26 and 28; Enforcement Rules; PPC General and Foreign Transfer Guidelines
11Practical evidence packsEvidence should reconstruct the Japan-specific legal basis and every material decision from onboarding through reporting and exit.3 éléments+
Maintain a reconstructable customer and KYB pack.
- Action d’implémentation
- Bundle trigger analysis, identity, representative authority, registry evidence, beneficial ownership, purpose, occupation or business, risk, PEP and sanctions results, privacy records and exceptions under stable identifiers.
- Preuves à conserver
- Complete sampled onboarding pack, source provenance, approvals and retrieval result.
- Source primaire
- Operational control supporting APTCP Articles 4 and 6 and APPI security duties
Maintain a reconstructable monitoring, STR and sanctions pack.
- Action d’implémentation
- Link activity, alerts, information reviewed, suspicion time, promptness decision, submission, confidentiality, sanctions hold, authority contacts and release or exit decision.
- Preuves à conserver
- Complete sampled case pack, timeline, receipts and controlled-access record.
- Source primaire
- Operational control supporting APTCP Article 8 and Japanese sanctions laws
Maintain a launch and change-control pack.
- Action d’implémentation
- Record the service perimeter, licence, competent authority, customer-verification method, transaction thresholds, transfer information, reporting route, sanctions, APPI controls, outsourcing and validation before launch and material change.
- Preuves à conserver
- Signed launch pack, source register, legal-change log, tests, uncertainty register and approvals.
- Source primaire
- Official sources listed below
Registre des sources primaires
22 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Act on Prevention of Transfer of Criminal Proceeds - current Japanese texte-Gov Laws and Regulations · Primary legislation
- Order for Enforcement of the Act on Prevention of Transfer of Criminal Proceedse-Gov Laws and Regulations · Primary delegated legislation
- Ordinance for Enforcement of the Act on Prevention of Transfer of Criminal Proceedse-Gov Laws and Regulations · Primary delegated legislation
- APTCP overview current at 7 August 2026Japan Financial Intelligence Center, National Police Agency · Official current legal guidance
- JAFIC Annual Report 2025Japan Financial Intelligence Center, National Police Agency · Official implementation report
- National Risk Assessment 2025National Police Agency · Official risk assessment
- Suspicious transaction reporting and competent authoritiesJapan Financial Intelligence Center, National Police Agency · Official reporting guidance
- AML/CFT Guidelines revised 31 March 2026Financial Services Agency · Official supervisory guidance
- Reference cases on suspicious transactionsFinancial Services Agency · Official reporting guidance
- Commercial and corporation registrationMinistry of Justice · Official registry guidance
- Beneficial Ownership of Legal Persons List SystemMinistry of Justice · Official beneficial-ownership guidance
- FinTech Support Desk regulatory perimeter guidanceFinancial Services Agency · Official licensing guidance
- Finalized 2026 travel-rule jurisdiction amendmentFinancial Services Agency · Official transfer-rule notice
- Registered crypto-asset exchange service providers - 1 April 2026Financial Services Agency · Official register
- Japan AML/CFT/CPF legislative regimeMinistry of Finance · Official regime overview
- Current economic sanctions measures and target listsMinistry of Finance · Authoritative sanctions lists
- APPI laws and policiesPersonal Information Protection Commission · Primary law and official guidance
- Guidelines for provision to a third party in a foreign countryPersonal Information Protection Commission · Official privacy guidance
- Japan country profile and 2024 follow-up reportFinancial Action Task Force · Authoritative current assessment
- FATF jurisdictions under increased monitoring - 19 June 2026Financial Action Task Force · Authoritative current status
- FATF high-risk jurisdictions subject to a call for action - 19 June 2026Financial Action Task Force · Authoritative current status
- Act on National Flag and Antheme-Gov Laws and Regulations · Primary national-symbol legislation
Réponses directes
Questions KYC, KYB et AML pour Japon
Who receives suspicious transaction reports?+
The competent administrative authority for the specified business receives the report through its prescribed route. The National Public Safety Commission and National Police Agency, through JAFIC, centralize, analyze and disseminate the information.
When must a suspicious transaction be reported?+
Promptly after the statutory suspicion test is met. The APTCP does not set one universal hours-or-days clock, so the operator should record when suspicion arose and why the submission was prompt.
Does Japan require a universal cash-threshold report?+
No. Japan uses sector- and transaction-specific CDD and record rules rather than one universal cash-threshold report. A large-cash CDD trigger must not be described as an automatic threshold report.
What does the JPY 2 million high-risk figure mean?+
It applies to verification of assets and income when a high-risk transaction involves a transfer of property exceeding JPY 2 million. It is not a universal transaction-monitoring or reporting threshold.
How is beneficial ownership determined?+
For a capital-majority corporation, the analysis begins with natural persons holding more than 25% of voting rights, subject to the more-than-50% displacement rule, then control by other means and the prescribed fallback. Other legal-person types use their applicable test.
Is Japan's beneficial-owner list a universal public register?+
No. It is a request-based system for eligible stock companies. A registrar confirms consistency with submitted attachments, but the certified copy does not prove that the company's description is true.
How long are APTCP records retained?+
Generally seven years. Verification records run from the applicable termination or completion event, while covered transaction records run from the transaction date; the precise category and exclusions must be documented.
Must crypto-asset businesses register?+
Covered crypto-asset exchange services require registration under the Payment Services Act. Operators must also apply APTCP controls and the scoped travel rule, including the current designated-jurisdiction framework for transfers to foreign VASPs.
What should happen on a Japanese sanctions match?+
Hold the activity operationally, identify the controlling FEFTA, asset-freezing or other measure, consult or report through the competent route and obtain any required permission before proceeding. Do not describe every Japanese measure as an identical automatic account freeze.
Is Japan on a FATF public list?+
No. Japan was absent from both FATF public lists dated 19 June 2026. FATF's October 2024 follow-up recorded 4 compliant and 35 largely compliant Recommendations, with no partially compliant ratings.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 25 September 2026. The legally effective texts are Japanese. Confirm the current specified-business and specified-transaction perimeter, sector rules, filing route, sanctions designation, privacy basis, outsourcing structure and licensing position with the competent authority and qualified Japanese counsel before launch.