November 6, 2026, 8:30 a.m. (JST)
[Japan] The enforcement regulations for the “Act on Prevention of Transfer of Criminal Proceeds” (Criminal Proceeds Act), designed to prevent money laundering and the financing of crime, will be amended in April 2027. These regulations apply to specified transactions—including those involving financial institutions, real estate, and jewelry and precious metals—and will impose legal obligations such as stricter customer identification procedures.Coinciding with this, there has been a spate of personal information leaks resulting from server attacks on companies, and financial institutions and others are moving to implement measures—such as making IC chip reading mandatory—in anticipation of the legal amendments.
Tomoe Watanabe, Mail-Order Research Institute
Key Points of the Article!
① Financial institutions and others are designated
as “specified businesses” under the law ② IC chip reading and other measures are mandated
③ Non-face-to-face identity verification methods (eKYC) are set
to change ④ The Financial Services Agency is encouraging
implementation ahead of the effective date ⑤ PayPay standardizes
its application process to require IC chip reading ⑥ Will “businesses handling jewelry and precious metals” be designated as specified businesses?
⑦ “IC chip reading” becomes the sole option for addressing AI threats
Financial institutions and others are designated as “specified businesses” to prevent the transfer of criminal proceeds
The “Act on Prevention of Transfer of Criminal Proceeds” is a law designed to track and block money laundering and the flow of criminal funds. It designates financial institutions and other entities as “specified businesses” and mandates “customer due diligence” as well as the creation and retention of records. The law aims to prevent transactions conducted under anonymous or false names, identity theft, and the transfer of criminal funds.The National Public Safety Commission and the National Police Agency are in charge of enforcement, with multiple ministries and agencies involved, including the Financial Services Agency, the Ministry of Internal Affairs and Communications, the Ministry of Justice, the Ministry of Finance, the Ministry of Health, Labor and Welfare, the Ministry of Agriculture, Forestry and Fisheries, the Ministry of Economy, Trade and Industry, and the Ministry of Land, Infrastructure, Transport and Tourism.
The definition of “specified business operators” is broad, encompassing banks, credit unions, and trust companies, as well as credit card companies, mutual aid societies, cooperatives, insurance companies, real estate brokers, mail-receiving services, telephone answering services, mail-forwarding agencies, and dealers in jewelry and precious metals.Furthermore, the scope extends to certain licensed professionals, such as attorneys, judicial scriveners, certified public accountants, and tax accountants.
Following the amendment, the conventional method of relying solely on photographs of identification documents will be revised, and businesses will be required to verify identities using methods stipulated by law, such as reading IC chips. Companies must confirm whether their business or transactions fall under the category of “specified businesses” and whether their current identity verification methods will remain compliant after the amendment.
Changes to Non-Face-to-Face Identity Verification Methods
A key aspect of these amendments is the change to non-face-to-face identity verification methods (eKYC). For application methods using documents such as My Number Cards, driver’s licenses, driving history certificates, and residence cards, the conventional method—which involved photographing these identity verification documents and submitting the image data—will be abolished. Instead, a method involving the reading of IC chips will be adopted.
Necessary supplementary measures have also been put in place for individuals who do not possess identification documents with IC chips. The regulations stipulate methods such as sending original documents—including certified copies of resident registration records and seal registration certificates, which have been secured to prevent forgery—via registered mail marked “Do Not Forward.” As a general rule, these verification records and transaction records must be retained for seven years.
Increasing Number of Companies Accelerating Measures Due to Cyberattacks
While many financial institutions had planned to introduce IC chip authentication in time for next year’s amendments, given the ongoing leakage of personal information due to cyberattacks, the Financial Services Agency issued a warning in October urging them to implement countermeasures ahead of schedule.The agency stated, “When conducting non-face-to-face identity verification, thoroughly re-examine images of identification documents and facial images to ensure there are no irregularities,” and, given the current situation, urged institutions to promptly implement measures such as IC chip reading without waiting for the enforcement date.
In response, financial institutions and others are accelerating their transition to authentication using the IC chip on My Number Cards. In late October, PayPay announced that, for its “PayPay” payment service, it would phase out applications involving the submission of photos of identification documents—such as My Number Cards and driver’s licenses—by early November 2026. The company stated it would standardize the application process to require IC chip reading.
The service will support either entering the PIN for the electronic certificate used for signatures—set at the time of My Number Card issuance—to read the IC chip, or using the number printed on the My Number Card along with facial recognition to read the IC chip. Applications using driver’s licenses will also be enabled by reading the IC chip.
In response to incidents such as the massive leak of driver’s license information due to cyberattacks, major banks have also begun tightening their identity verification procedures. In late October, Sumitomo Bank discontinued identity verification via “submission of images of identification documents” for online account openings.While other methods of identity verification using the Public Key Infrastructure (JPKI) system—other than submitting images—remain available, the bank is transitioning to applications that rely on reading the IC chip on the My Number Card.
E-commerce companies dealing in jewelry and precious metals may be classified as “specified businesses”
Under the “Proceeds of Crime Act,” the Ministry of Economy, Trade and Industry (METI)—which oversees the retail sector—defines “businesses dealing in jewelry, precious metals, and similar items (including secondhand dealers)” as “specified businesses.” Caution is advised, as both Physical Stores and e-commerce businesses that fall under this category and engage in specified transactions are subject to legal obligations.
The Ministry of Economy, Trade and Industry (METI) has already launched a dedicated website and published guidelines, urging businesses to confirm their status as “businesses dealing in jewelry, precious metals, and similar items” and to take appropriate measures. METI points out that jewelry and precious metals, due to their high monetary value and ease of transport, are particularly susceptible to money laundering and terrorist financing.
The definition of “Businesses Handling Jewelry, Precious Metals, and Similar Items” is as follows:
① Gold, platinum, silver, and their alloys (precious metals); ② diamonds and other precious stones, semi-precious stones, and pearls (gemstones); ③ products made using items in ① and ②, such as accessories crafted from gold or precious stones—companies that handle these items. The current policy is to include high-value wristwatches under ③ in a broad sense.
Furthermore, “specific transactions” conducted by “businesses dealing in jewelry, precious metals, and similar items” fall into two categories: (1) cash transactions exceeding 2 million yen, and (2) transactions requiring special attention. A key point regarding category (1) is that even transactions of 2 million yen or less will be deemed “specific transactions” if it is evident that the transaction amount per instance has been split into multiple payments to reduce the amount.Category ② refers to transactions other than those in Category ① that require special attention, such as “transactions deemed to be suspected of money laundering.”
The Consumer Products Division of the Manufacturing Industries Bureau at the Ministry of Economy, Trade and Industry (METI) points out that, based on the provisions of category ②, even transactions of 2 million yen or less may fall under the category of “specified businesses” depending on monitoring by the authorities. E-commerce companies dealing in jewelry, precious metals, and similar items are advised to create internal manuals—covering topics such as “customer identification procedures” and “customer risk assessment”—as soon as possible.
Summary
Personal information is being exposed to risk due to the recent spate of cyberattacks, and strengthening identity verification security is an urgent and critically important social issue. With the rise of AI, image-based identity verification is becoming increasingly unreliable, and future online authentication will likely shift to an era where “IC chip reading” is the only viable option.
While the recent amendments to the “Act on the Prevention of Unlawful Acquisition and Use of Personal Information” will impose cumbersome tasks and significant costs on affected companies, these measures are unavoidable if serious problems caused by fraud are to be prevented. In this day and age, companies must recognize these measures as a form of insurance to protect their businesses and take prompt action.
