APTCP Compliance: Japan's Verification, Record and STR Duties

The Act on Prevention of Transfer of Criminal Proceeds imposes four duties on specified business operators: verify the customer at the time of transaction, prepare and keep verification and transaction records for seven years, file suspicious transaction reports with the sector supervisor, and maintain measures that keep verification accurate over time.

Key takeaways

• Verification at the time of transaction (取引時確認, torihiki-ji kakunin) covers four items under Article 4, not just identity documents.
• Verification records under Article 6 and transaction records under Article 7 both run for seven years.
• Suspicious transaction reports go to the sector's competent administrative authority, which notifies the National Public Safety Commission; JAFIC received 849,861 in 2024.
• Passbook and account-credential trading penalties tripled on 10 July 2026, from one year and JPY 1 million to three years and JPY 5 million.
• Where a high-risk transaction moves more than JPY 2 million in assets, source of wealth and source of funds must be verified as well.

What is the Act on Prevention of Transfer of Criminal Proceeds?

The APTCP, Act No. 22 of 2007 and known in Japanese as 犯罪収益移転防止法 or 犯収法, is Japan's preventive AML statute. It does not criminalise money laundering, which sits in the Act on Punishment of Organized Crimes. It obliges private-sector firms to make laundering harder and traceable.

The operative detail is spread across three instruments. The Act itself sets the duties, the Enforcement Order defines which transactions are specified transactions and which countries attract enhanced treatment, and the Enforcement Ordinance sets acceptable verification documents and methods. JAFIC publishes all three alongside its commentary.

Amendments arrive through the subordinate instruments far more often than through the Act. During 2024 alone the Enforcement Order or Ordinance was amended five times, over matters such as the abolition of the Special Child Rearing Allowance Certificate and health insurance cards as identity documents.

For the regulator map and the wider statutory framework, see our guide to how Japan's AML regime fits together. This article stays inside the APTCP.

What must you verify at the time of a transaction?

Article 4 sets out verification at the time of transaction, and it is broader than identity checking. A firm must confirm four things, and separately confirm the identity of the natural person actually conducting the transaction on the customer's behalf.

Beneficial ownership must be traced through to the natural person who controls the legal person, not stopped at the first corporate shareholder. Where an employee presents themselves as acting for a company, an employee ID card is not accepted as proof of authority; a letter of attorney or a certificate of registered matters naming them as a representative officer is required.

Documents carrying an expiry date must be valid on the day they are presented. Documents without one must have been prepared within six months of presentation. Firms may refuse to perform the transaction until the customer complies with a verification request, and a customer who gives false identification information with intent to conceal commits an offence in their own right.

Which transactions trigger verification?

There is no single monetary threshold. Each category of specified business operator has its own trigger, published by JAFIC in its guidance to business operators.

For financial institutions, the triggers are opening a deposit account, a cash transaction exceeding JPY 2 million, and a cash remittance exceeding JPY 100,000. Financial leasing operators are caught where the lease fee exceeds JPY 100,000 per payment. Dealers in precious metals and stones are caught on cash contracts over JPY 2 million.

Structuring is addressed directly. Where it is apparent that several linked transactions have been split to keep each below a threshold, verification must be performed as though a single transaction had been conducted. Verification is also required whenever money laundering is suspected, regardless of value.

Simplified due diligence is available for a defined list of low-risk transactions, and that list moves. Opening a special account for book-entry corporate securities was added on 1 November 2024, and a temporary carve-out for donation transfers of JPY 2 million or less after the 2024 Noto Peninsula Earthquake ran from January to December 2024.

What makes a transaction high-risk under the APTCP?

The Act names three categories, and they are narrower than a firm's own risk appetite would suggest. The first is a transaction where identity theft is suspected, or where the customer is suspected of having falsified information given at an earlier verification. The second is a transaction with a customer residing or located in a designated country, with Iran and North Korea named. The third is a transaction with a foreign politically exposed person.

Where a transaction falls into any of these, verification must use a more stringent method than usual. In practice that means additional identification documents beyond those already accepted, and for legal persons a shareholder register or securities report to confirm beneficial ownership rather than a declaration alone.

The JPY 2 million rule sits on top. Where a high-risk transaction involves the transfer of assets worth more than JPY 2 million, the firm must also verify the customer's source of wealth and source of funds, to the extent needed to decide whether a suspicious transaction report is required.

Foreign PEP status is a statutory trigger rather than a risk-scoring output, which is why PEP and sanctions screening has to run before the transaction completes. Our post on PEP screening obligations in Japan covers the domestic and international distinction.

How long must APTCP records be kept, and from when?

Seven years, under two separate articles with two different start dates. Article 6 requires verification records, covering both the data confirmed and the method used to confirm it, kept for seven years from the day the transaction was completed or terminated. Article 7 requires records of the date and contents of the transaction itself, also for seven years.

The distinction matters for account relationships. A verification record for a deposit account does not start its seven-year clock at onboarding; it starts when the relationship ends. A firm closing a fifteen-year-old account is therefore holding onboarding evidence for twenty-two years in total.

A third clock runs alongside. The Foreign Exchange and Foreign Trade Act obliges banks, currency exchange operators, funds transfer service providers and crypto-asset exchange service providers to prepare an identity confirmation record and retain it for seven years from the end of the transaction, for asset-freezing purposes rather than AML purposes.

Records are what supervisory inspection actually examines. The competent authority's powers include collecting reports and conducting on-site inspections, and the offence of refusing an inspection carries the same penalty as filing a false report.

When and how do you file a suspicious transaction report?

Article 8 requires a report where an asset received through the specified business is suspected of being criminal proceeds, or the customer is suspected of engaging in money laundering. There is no monetary floor and no fixed filing clock in the Act, unlike the 30-day rule in the United States.

The routing is the part firms get wrong. The report goes to the competent administrative authority for the sector, not to JAFIC. That authority is then required to promptly notify the National Public Safety Commission, and JAFIC collects, organises and analyses the reports before disseminating them. Where the competent authority is a prefectural governor, the notification travels via the competent minister under Article 23.

The suspicion judgement must take account of the National Risk Assessment as well as the verification result, the pattern and nature of the transaction and other circumstances. Volumes are set out in JAFIC's annual report: 849,861 reports in 2024, of which banks and other depository institutions filed 580,382.

Scope widened recently. Since April 2024, certified administrative procedures legal specialists, certified public accountants and certified public tax accountants have been required to file, except on matters covered by professional confidentiality. Judicial scriveners remain outside the reporting duty, and lawyers follow Japan Federation of Bar Associations rules instead.

What do Articles 10 to 11 add beyond onboarding?

Article 11 is the one most often missed, because it has no transaction trigger. It requires specified business operators to keep verified information up to date, to formulate internal rules for how verification is carried out, and to appoint a person responsible for supervising the business. That is the statutory hook underneath ongoing customer due diligence.

Articles 10 and 10-2 to 10-5 carry the travel rule. On cross-border wire transfers, firms must pass originator and beneficiary information to the receiving institution. Since the amendments fully in force by 1 April 2024, that duty covers payee information as well as payer information, and extends to electronic payment instruments and crypto-asset transfers.

Correspondent relationships have their own check. Article 9 requires a firm concluding a correspondent banking contract with a foreign exchange business operator to verify that the counterparty has a framework capable of performing the equivalent of verification at the time of transaction. Articles 10-2 and 10-4 apply the same test to foreign electronic payment instruments and crypto-asset service providers.

The list of jurisdictions treated as having equivalent travel rule rules is maintained by the FSA under Articles 17-2 and 17-3 of the Enforcement Order, and it grows: five jurisdictions were added on 1 May 2026.

What penalties apply for APTCP failures?

Supervisory penalties are modest and are aimed at obstruction rather than at weak controls. Failing to submit a report or materials, submitting false ones, or refusing an on-site inspection carries up to one year's imprisonment or a fine of up to JPY 3 million. Violating a rectification order carries up to two years or JPY 3 million.

The passbook trading offences under Articles 25 to 31 are where the real enforcement volume sits, and where the numbers changed this year. Police cleared 4,513 APTCP violation cases in 2024, against 1,283 money laundering convictions. The 2026 amending Act was promulgated on 10 June 2026 and its penalty provisions took effect on 10 July 2026.

A third limb of the same Act, creating a police-operated fictitious-name account scheme at Articles 19-2 to 19-29, has not yet commenced. It takes effect on a date to be fixed by cabinet order within one year of 10 June 2026, so treat it as forthcoming rather than current. Firms rebuilding controls around this should read our Japan country coverage page and the transaction monitoring guidance alongside the glossary of AML terms.