Japan
CoinPost
JCBA organizes 347 items for crypto-asset outsourcing vendor management, makes key management a standalone domain
- The draft classifies vendors into five provision models—"holding," "intermediary," "supply," "reference," and "other"—based on whether they hold private keys and their direct system impact, with an accompanying Excel self-assessment sheet and audit-evidence management ledger.
- The working group is chaired by Mayu Suda, a partner at PwC Japan, with participation from wallet providers and audit firms; feedback is being collected via JCBA's dedicated form before revision in light of Japan's amended Financial Instruments and Exchange Act (FIEA) rules and guidelines.
- JCBA cited the backdrop of vendor-targeted cyberattacks, referencing (without naming it directly) the May 2024 incident in which roughly 48.2 billion yen worth of Bitcoin (BTC) was stolen from DMM Bitcoin, which Japanese police attributed to a North Korea-linked hacking group that had approached an employee of a wallet management software firm.