JCBA Releases First Vendor-Focused Cybersecurity Guidelines to Shore Up Crypto Supply Chain
The Japan Cryptoasset Business Association (JCBA) has published a draft set of operational security practices tailored specifically for third-party system vendors in the cryptocurrency sector, establishing the domestic industry's first vendor-centric cybersecurity framework.
The publication arrives amid a wave of cyberattacks targeting external wallet and transaction-signing providers. The initiative directly anticipates tightening regulatory obligations under Japan's revised Financial Instruments and Exchange Act (FIEA). Enacted and promulgated in July 2026, the updated legislation introduces a formal regulatory framework for "crypto-asset management-related service providers," bringing key third-party infrastructure contractors under direct regulatory oversight within a year of promulgation.
Historically, operational checklists issued by the self-regulatory Japan Virtual and Crypto Assets Exchange Association (JVCEA) and guidelines from the Financial Services Agency (FSA) have placed the burden of risk management on licensed exchange operators rather than their technology providers. Furthermore, broad third-party assurance certifications such as SOC 2 reports have frequently proven insufficient for evaluating digital asset operations, particularly regarding private key lifecycle controls, hot/cold wallet segregation, and transaction validation.
To create a standardized compliance baseline, a JCBA working group—chaired by Mayu Suda, partner at PwC Japan LLC, alongside security officials from Ginco, JPYC, and other digital asset infrastructure firms—compiled a 347-item evaluation framework. The practice guide translates existing institutional standards into standard auditing vocabulary across 10 core domains (Categories A through J). These encompass general IT governance, physical access, business continuity, and incident response, anchored by a dedicated category focused entirely on private key management and transaction-signing infrastructure.
To avoid rigid or redundant compliance mandates, the framework establishes five risk-based service models based on each vendor’s systemic access and direct attack surface:
- Key-Holding Type (GR1): Vendors that temporarily or permanently retain cryptographic private keys or key fragments.
- Intervening Type (GR2): Suppliers with unauthorized or direct operational access capable of altering production environments, such as SaaS wallet providers and maintenance contractors.
- Supplying Type (GR3): Software and hardware providers whose deliverables—such as node packages or signing appliances—are vetted and imported only after client approval.
- Reference Type (GR4): Data vendors supplying mission-critical operational inputs, including transaction-screening data, node status feeds, and address validation lists.
- Other Services: Third-party services with no direct role in asset transfers or operational decision-making, such as general cloud infrastructure or standalone KYC/AML verification software.
Alongside the evaluation criteria, the JCBA released integrated spreadsheet toolkits, pairing a service-tailored self-assessment matrix with an audit evidence register to allow technology vendors to track and disclose verification artifacts efficiently. The tools aim to eliminate disparate, duplicative due-diligence questionnaires between exchanges, vendors, regulatory authorities, and independent auditors.
The JCBA is soliciting feedback on the pilot draft from exchange operators, custody technology vendors, and auditing firms. The association stated it will update the framework iteratively as Japanese authorities finalize cabinet orders and administrative guidelines under the revised FIEA.
Norbert Gehrke
