Japan
The oldest comprehensive regime in the world, written in the aftermath of Mt. Gox and hardened again after Coincheck.
Who regulates this
Financial Services AgencyFSA
Crypto-Asset Exchange Service Providers under the Payment Services Act.
Licences and permissions
Crypto-Asset Exchange Service Provider registration
Exchange, transfer and custody of crypto-assets.
Listing a new token requires effective clearance through the self-regulatory body, JVCEA. The token list is not the operator's unilateral decision.
What it takes
Capital
JPY 10,000,000 minimum capital, positive net assets, and strict segregation of customer money and assets.
Timeline
Twelve to eighteen months, and applicants are commonly asked to re-file after substantive feedback.
Substance
A Japanese entity, Japanese-resident management, and Japanese-language operational documentation.
Where a software vendor sits
The FSA holds the registered operator responsible for system risk management in detail. Foreign technology providers are workable, but the operator must be able to explain and control the system in Japanese, to a Japanese regulator, without depending on the vendor to answer.
What catches people out
Cold-storage obligations for customer assets are hard requirements, not guidance. Japan wrote these rules by watching exchanges fail, and the rules read that way.
Verify this yourself
We would rather you checked. These are the primary and authoritative secondary sources behind the summary above.