JP v13.3.0

Japan (JP) · Module Detail

Japan: Operational Resilience & Critical Infrastructure

← Full Japan overview Build report with Japan Request deeper dive

#

Operational resilience for the financial sector is delivered through the FSA's Comprehensive Supervision Guidelines for Major Banks (which embed operational-resilience expectations) referencing the Guidelines on Cybersecurity for the Finance Sector (published Oct 2024), plus the FISC Security Guidelines (13th edition, March 2025). Financial institutions in funds settlement are designated critical infrastructure under the Cybersecurity Basic Act. The BOJ co-supervises FMI/operational resilience and runs threat-led penetration testing. A draft amendment to the SMB Comprehensive Guidelines was issued 8 December 2025 (comments to 13 January 2026).

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →

Horizon · 2030 (± more than a year)Next-generation Zengin settlement system target launchProposed · Tier 3 source
Standing sub-brief · as of 16 August 2026128 words · last cycle 2026-08-16

Operational Resilience & Critical Infrastructure

The Bank of Japan's Payment Systems Forum, at its 22nd session on 17 April 2026, endorsed a roadmap to replace the Zengin System entirely by 2030, and Zengin-Net has established a preparatory office to carry the work forward. This is treated as a proposed, multi-year horizon item rather than a committed near-term implementation, given the multi-year uncertainty band attached to the 2030 target. The roadmap sits alongside the accelerated ISO 20022 messaging migration tracked separately under correspondent banking, both pointing toward a materially different settlement and messaging architecture for Japan by the end of the decade.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and findings (4)
  1. T1https://www.fsa.go.jp/common/law/cybersecurity_guideline_en.pdfretrieved
  2. T2https://practiceguides.chambers.com/practice-guides/cybersecurity-2026/japanretrieved
  3. T3https://cpl.thalesgroup.com/compliance/apac/fisc-security-guidelines-japan-financial-institutionsretrieved
  4. T1https://www.elibrary.imf.org/view/journals/002/2024/113/article-A001-en.xmlretrieved