title: Japan — Operational Resilience & Critical Infrastructure | World Payments Monitor canonical: https://payments.gi/jurisdictions/japan/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-06-27 Operational resilience for the financial sector is delivered through the FSA's Comprehensive Supervision Guidelines for Major Banks (which embed operational-resilience expectations) referencing the Guidelines on Cybersecurity for the Finance Sector (published Oct 2024), plus the FISC Security Guidelines (13th edition, March 2025). Financial institutions in funds settlement are designated critical infrastructure under the Cybersecurity Basic Act. The BOJ co-supervises FMI/operational resilience and runs threat-led penetration testing. A draft amendment to the SMB Comprehensive Guidelines was issued 8 December 2025 (comments to 13 January 2026). Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/japan/) Horizon · 2030 (± more than a year) Next-generation Zengin settlement system target launch_Proposed · Tier 3 source_ Standing sub-brief · as of 16 August 2026 128 words · last cycle 2026-08-16 #### Operational Resilience & Critical Infrastructure The Bank of Japan's Payment Systems Forum, at its 22nd session on 17 April 2026, endorsed a roadmap to replace the Zengin System entirely by 2030, and Zengin-Net has established a preparatory office to carry the work forward. This is treated as a proposed, multi-year horizon item rather than a committed near-term implementation, given the multi-year uncertainty band attached to the 2030 target. The roadmap sits alongside the accelerated ISO 20022 messaging migration tracked separately under correspondent banking, both pointing toward a materially different settlement and messaging architecture for Japan by the end of the decade. #### Outlook Implementation of the preparatory office's work programme, and any interim milestones Zengin-Net publishes toward the 2030 target, will be the markers to watch in coming cycles. No new data since the standing brief. 1 periodic run re-emitted it unchanged. **Sources and findings (4)** 1. T1 [https://www.fsa.go.jp/common/law/cybersecurity_guideline_en.pdf](https://www.fsa.go.jp/common/law/cybersecurity_guideline_en.pdf) retrieved 2026-06-27 2. T2 [https://practiceguides.chambers.com/practice-guides/cybersecurity-2026/japan](https://practiceguides.chambers.com/practice-guides/cybersecurity-2026/japan) retrieved 2026-06-27 3. T3 [https://cpl.thalesgroup.com/compliance/apac/fisc-security-guidelines-japan-financial-institutions](https://cpl.thalesgroup.com/compliance/apac/fisc-security-guidelines-japan-financial-institutions) retrieved 2026-06-27 4. T1 [https://www.elibrary.imf.org/view/journals/002/2024/113/article-A001-en.xml](https://www.elibrary.imf.org/view/journals/002/2024/113/article-A001-en.xml) retrieved 2026-06-27