Japan Deleted the Privacy Rule Blocking Bank Fraud Data Sharing

Tokyo spent two years dismantling the consent rule that stopped Japanese banks warning each other about fraud accounts, and the whole structure switches on 1 April 2027.

Key Highlights

• On 24 July 2026 Japan's Personal Information Protection Commission and the Financial Services Agency amended the Guidelines for the Protection of Personal Information in the Financial Sector, after a consultation that ran 13 May to 12 June 2026 and drew 14 comments.
• The amendment states that a bank passing fraud-account data to another deposit-taking institution falls inside the "based on laws and regulations" exception in the personal information law, so no customer consent is required.
• The enabling rule, an amended Enforcement Regulation under the Act on Prevention of Transfer of Criminal Proceeds, was promulgated on 26 June 2026 after 54 comments from 19 submitters, and creates a duty of effort rather than a hard obligation.
• The National Police Agency put 2025 special fraud losses at 142.31 billion yen, up 98.0 percent and the worst on record, with SNS investment and romance fraud adding 183.43 billion yen.
• From 1 April 2027 identity verification at Japanese financial institutions must read the IC chip in a government ID; submitting a photo or photocopy is abolished.

Most regulatory arcs end with a new rule. This one ends with a rule being switched off. Japan's financial privacy regime had a load bearing consent requirement: a bank that suspected an account of being a fraud mule could not tell the bank down the road, because the customer had not agreed to the disclosure. Criminals arbitraged that silence. The July 24 amendment removes the legal exposure that made the obvious thing impossible. That is deregulation in substance, wrapped in an anti crime package.

The problem the numbers made unavoidable

Start with the data. Japan's National Police Agency reported 27,832 special fraud cases in 2025 with 142.31 billion yen of losses, up 98.0 percent from the prior record of 71.88 billion yen in 2024.⁵ Add SNS investment and romance fraud and the 2025 total reaches 43,000 cases and 325.74 billion yen, up 63.6 percent.⁵ The FSA notes that within special fraud, transfer type losses were 82.30 billion yen, of which 49.53 billion yen (60.2 percent) moved through internet banking.⁴

The loss curve is the political argument. For most of the last decade Japanese fraud losses drifted lower, from 40.77 billion yen in 2016 to 28.20 billion yen in 2021. Then they went vertical. A regulator can defend a privacy first posture against a flat loss series, but not against a doubling.

How the arc was sequenced

The chain begins with Comprehensive Measures 2.0 to Protect the Public from Fraud, adopted by the ministerial meeting on crime countermeasures on 22 April 2025, which called for a framework letting deposit taking institutions share information on abused accounts and freeze them quickly.² On 27 March 2026 the FSA published a draft amendment to the Enforcement Regulation.¹⁰ The same day, the Minister for Financial Services said the FSA had amended the regulations "to enable financial institutions to actively share information on a legal basis" and would fund a system run by the Cooperation Agency for Anti Money Laundering, a wholly owned subsidiary of the Japanese Bankers Association.⁹

The amended regulation was promulgated on 26 June 2026.³ New Article 32(2) requires deposit taking businesses, as a duty of effort, to hand peers the information needed on accounts recognized as used or likely used for crime, and to organize, analyze and act on what they receive.³ The FSA allocated roughly 320 million yen in the fiscal 2025 supplementary budget for the shared system, which is to be built by March 2027 and to operate from April 2027.⁴

Then the last blocker. Because the sharing bank still faced exposure under the personal information law and banking confidentiality duties, the FSA and PPC amended the Financial Sector Guidelines to state that provision under Article 32 falls within the statutory exception at Article 27(1)(i) of the Act on the Protection of Personal Information.² That amendment was promulgated on 24 July 2026, effective 1 April 2027.¹

Japan is not moving alone. On 12 June 2026 the US Treasury's Financial Crimes Enforcement Network issued updated guidance clarifying that institutions may share suspected fraud information with any eligible institution under section 314(b) of the USA PATRIOT Act, including IP addresses and behavioral fraud indicators.⁸ Two large jurisdictions loosened inter bank fraud information sharing within six weeks. Whether Japan's design converges on the UK, Singapore or Australian models is a claim we found only in secondary sources and could not verify against a primary document, so we treat it as directional rather than confirmed.

The harder mandate is the one about identity

The information sharing rule is a duty of effort. The identity rule is not. An order revising remote verification methods was promulgated in June 2025 and one revising in person verification in March 2026. Both take effect on 1 April 2027.⁴ The FSA's summary is blunt: visual inspection and image of document methods are abolished, and reading the IC chip becomes mandatory.⁴

That is not a compliance memo. It is a procurement event with a fixed deadline, applying to every bank, card issuer and brokerage in Japan that opens accounts remotely.

Where the spending lands

When a regulator abolishes a verification method, it is not writing a rule, it is writing a purchase order. The Japanese electronic know your customer market is unusually concentrated. ELEMENTS, Inc. (5246, Tokyo Stock Exchange Growth), parent of Liquid and Polarify, states that its eKYC services took the number one vendor revenue share domestically for a seventh consecutive year in the ITR Market View report for 2026, that group cumulative identity verifications reached roughly 150 million, and that contracted companies reached roughly 700, covering 66 percent of Japanese banks that have implemented eKYC.⁷

The interim filing makes the link explicit, stating that its eKYC market is expanding under the amended Act on Prevention of Transfer of Criminal Proceeds, and citing Yano Research's estimate that the eKYC and personal authentication market reaches 24.8 billion yen in fiscal 2027.⁶

For the six months to 31 May 2026, ELEMENTS reported revenue of 2,799 million yen (up 65.6 percent), EBITDA of 648 million yen (up 170.2 percent), operating profit of 327 million yen against 17 million yen a year earlier, and net income of 297 million yen against a 451 million yen loss.⁶ Alongside the results it raised full year FY11/2026 guidance to revenue of 5,600 to 5,700 million yen, EBITDA of 1,100 to 1,200 million yen and operating profit of 300 to 400 million yen.⁶ The operating leverage arrived before the mandate did.

Investment Idea: ELEMENTS, Inc. (5246, Tokyo Stock Exchange Growth)

• Thesis type: Primary beneficiary
• Deregulatory catalyst: The July 24, 2026 PPC and FSA guideline amendment, the June 26, 2026 amended Enforcement Regulation, and the paired identity verification orders, all effective April 1, 2027.
• Current price: 743 yen as of the July 31, 2026 close, market capitalization 20.2 billion yen, 52 week range 498 to 1,255 yen.
• Key financial data: H1 FY11/2026 revenue 2,799 million yen (up 65.6 percent), EBITDA 648 million yen, operating profit 327 million yen, net income 297 million yen, on raised full year guidance.
• Regulatory constraint removed: The consent requirement that made inter bank fraud data sharing legally hazardous, plus the abolition of photo and photocopy identity submission, which turns identity proofing into a chip read software workflow.
• Case for the exposure thesis: Every Japanese deposit taker, card issuer and brokerage opening accounts remotely has a hard April 1, 2027 date to replace an abolished verification method, and the incumbent with roughly 700 contracted companies is positioned to capture a disproportionate share of that replacement cycle. The operating model has already crossed into profitability, so incremental volume lands on a fixed cost base.
• Bear case for the exposure thesis: Revenue may be pulled forward rather than added, since the FSA expects institutions able to migrate early to do so without waiting for the effective date. The sharing duty is only a duty of effort, not an obligation, and Japan is relying on persuasion and an industry body utility rather than enforcement for full participation. The addressable market, 24.8 billion yen in fiscal 2027, is small, and the shares are volatile at a 20.2 billion yen market capitalization with a recent history that includes a 700 million yen net loss in FY11/2025.
• What to watch, and what falsifies this: The FY11/2026 fourth quarter disclosure in January 2027 for contracted company count and IC chip verification volume, and any FSA statement on how many institutions commit to the Cooperation Agency for Anti Money Laundering framework before go live. If contracted company growth stalls or a large integrator wins the tender cycle instead, the thesis is wrong.
• Time horizon: Event driven into April 1, 2027, then 18 to 36 months.

Bear Case

The strongest counterargument is that this is a pull forward, not a step change. The FSA expects institutions able to do so to migrate to chip read verification without waiting for the effective date, so a meaningful share of mandate driven revenue may already sit in the reported numbers rather than ahead of them. A one time onboarding wave followed by a slower run rate is plausible.

Second, the information sharing duty is a duty of effort, not an obligation, and the FSA is relying on persuasion and an industry body utility rather than enforcement to get full participation. Voluntary frameworks under deliver. Third, ELEMENTS is a 20.2 billion yen market capitalization company trading at 743 yen against a 52 week range of 498 to 1,255 yen, and its recent history includes a 700 million yen net loss in FY11/2025. Concentration in a small, volatile, single segment issuer is itself the risk. Fourth, leadership of a market that reaches only 24.8 billion yen in fiscal 2027 is leadership of something small, and large integrators can win bank tenders on relationship rather than product.

The Principle

Privacy law and fraud law are both consumer protection, and Japan spent two years discovering they pointed in opposite directions. The resolution was not a new prohibition. It was a clarification that an existing prohibition never applied. That pattern, where the binding constraint turns out to be legal uncertainty rather than legal prohibition, is the most underpriced category of regulatory change there is, because it creates spending without creating a headline rule. Watch the clarifications, not the crackdowns.

1. Personal Information Protection Commission and Financial Services Agency, partial amendment to the Guidelines for the Protection of Personal Information in the Financial Sector, July 24, 2026. fsa.go.jp
2. Personal Information Protection Commission, consultation document on the draft amendment, May 13, 2026. ppc.go.jp
3. Financial Services Agency, promulgation of the Order Partially Amending the Enforcement Regulation of the Act on Prevention of Transfer of Criminal Proceeds and results of public comment, June 26, 2026. fsa.go.jp
4. Financial Services Agency, Money Laundering and Financial Crime Countermeasures, Efforts and Issues, July 3, 2026. fsa.go.jp
5. National Police Agency, Recognized and Cleared Cases of Special Fraud and SNS Investment and Romance Fraud in 2025 (final figures). npa.go.jp
6. ELEMENTS, Inc., FY11/2026 interim consolidated kessan tanshin, filed July 14, 2026. tdnet-pdf.kabutan.jp
7. Liquid, Inc., "ELEMENTS Group companies Liquid and Polarify take number one eKYC market share for a seventh consecutive year, group contracts reach approximately 700 companies," May 18, 2026. liquidinc.asia
8. US Department of the Treasury, "FinCEN Issues Guidance to Help Financial Institutions Share Information About Suspected Fraud," June 12, 2026. home.treasury.gov
9. Financial Services Agency, press conference by Minister Katayama Satsuki, March 27, 2026. fsa.go.jp
10. Financial Services Agency, publication of the draft Order Partially Amending the Enforcement Regulation of the Act on Prevention of Transfer of Criminal Proceeds, March 27, 2026. fsa.go.jp

Related analysis

Read next: Europe's AI labelling rule

Read next: Britain's short-selling disclosure reset

The Free Markets Report is provided by Lead-Lag Publishing, LLC. All opinions and views mentioned in this report constitute our judgments as of the date of writing and are subject to change at any time. Information within this material is not intended to be used as a primary basis for investment decisions, and should also not be construed as advice meeting the particular investment needs of any individual investor. Trading signals produced by The Free Markets Report are independent of other services provided by Lead-Lag Publishing, LLC, or its affiliates, and the positioning of accounts under their management may differ. Please remember that investing involves risk, including loss of principal, and past performance may not be indicative of future results. Lead-Lag Publishing, LLC, its members, officers, directors, and employees expressly disclaim all liability with respect to actions taken based on any or all of the information in this writing.