• Japan's Financial Services Agency asked financial institutions on 9 October 2026, per Jiji Press, to review cyberattack response procedures and fix deficiencies promptly.
• The request followed a recent series of customer data breaches tied to unauthorized access.
• Firms were told to check ID document images thoroughly for irregularities, including in remote identity verification.
• Finextra reports Japan is drafting an emergency cybersecurity policy package; its contents are unconfirmed.
• Jiji Press reports the industry ministry planned to ask about 1,000 industry groups to assess vulnerabilities in communications equipment and systems.

Japan's financial regulator has told banks and other financial firms to review their cyber defences after a run of customer data breaches. According to Jiji Press, the Financial Services Agency's request on 9 October 2026 stresses identity verification, including remote checks. Finextra separately reports that an emergency policy package is being drafted. We could not read that package, so its scope remains unconfirmed.

What the regulator asked for

According to Jiji Press, as carried by Nippon.com on 9 October 2026, the Financial Services Agency asked financial institutions to examine their procedures for responding to a cyberattack and to take necessary measures promptly if deficiencies are found. The request responds to a recent series of customer data breaches tied to unauthorized access. It is described as a request to review, not a new rule, and the summary available to us mentions no deadline or penalty.

Identity checks are the named focus

The same request urged firms to check images of driver's licenses and other identification documents thoroughly for irregularities, including when verifying customers' identities remotely. Financial Services Minister Satsuki Katayama said at a press conference that institutions should properly carry out identity checks, including reading the chip data on ID documents, which the report describes as a highly effective method against unauthorized access. The reporting ties the guidance to identity verification; it does not say how the breaches occurred.

A wider package, beyond banking

Finextra reports that Japan is drafting an emergency cybersecurity policy package alongside the request to banks. Jiji Press adds that the industry ministry planned to ask about 1,000 industry groups, including auto and retail sectors, to assess vulnerabilities in their communications equipment and systems. We could not read the package itself or a release from the Financial Services Agency, so its contents, timing and legal force remain unconfirmed, and the scrutiny extends well beyond finance.

What to watch next

Three details would show whether this hardens into a standard: publication of the drafted package, any deadline or reporting requirement attached to the review, and whether supervisors name chip-data reading as an expected control rather than an endorsed one. Until those appear, the evidence supports only a narrow reading: Japanese authorities have flagged identity verification as an area to check. For compliance teams, the practical step is to document what a review covered and what changed.