Introduction

On July 31, 2026, the Securities and Exchange Surveillance Commission (the “SESC”) published its “Basic Policy for Securities Monitoring for Program Year 2026” (the “PY2026 Policy”). Each year, the SESC publishes a basic policy outlining the key areas of focus for its inspections and monitoring of Financial Instruments Business Operators and other regulated entities (collectively, “FIBOs”) (together, “securities monitoring”). The PY2026 Policy covers the period from July 2026 through June 2027.

This article provides an overview of the key issues for securities monitoring under the PY2026 Policy, with a focus on changes from the previous year’s policy (the “PY2025 Policy”) as well as a discussion of some of the issues referenced in the “Overview and Case Studies of Securities Monitoring for Program Year 2025” ¹, which was also published by the SESC on July 31, 2026, the same day as the publication of the PY2026 Policy.

¹ Each year, the SESC publishes an “Overview and Case Studies of Securities Monitoring,” summarizing issues identified through its inspections of FIBOs and monitoring activities. The “Overview and Case Studies of Securities Monitoring for Program Year 2025” covers the period from July 2025 through June 2026.

Overview of the FY2026 Policy

As in the previous program year, the PY2026 Policy sets out the key areas of focus for securities monitoring of FIBOs under two categories: “Cross-Industry Areas of Focus” and “Key Areas of Focus by Size and Business Type.” For further details, please refer to the source cited below.

Source: SESC website （https://www.fsa.go.jp/sesc/news/c_2026/2026/20260731-2/02.pdf）

Cross-Industry Areas of Focus

The PY2026 Policy identifies the following four areas of focus:

(1)Business operations that take customers’ best interests into account and appropriate investment solicitation practices based on the suitability principle
The specific areas of focus are set out below.

Whether FIBOs take customers’ best interests into account and conduct their business with integrity and fairness toward customers. In light of the increasing diversity of financial products:(a) whether FIBOs appropriately define target customers for the sale of complex or high-risk products; and(b) whether FIBOs provide explanations in a manner and to an extent necessary for customers to understand the products, taking into account their individual characteristics, including their level of digital literacy in relation to the provision of information. Whether FIBOs engage in unreasonable solicitation of customers to switch to other products or services over a short period. Whether FIBOs have appropriate internal rules in place in relation to these matters and adequately monitor compliance with those rules.

These areas of focus are broadly consistent with those set out in the PY2025 Policy. ² This suggests that, in PY2026, FIBOs will continue to be expected to operate their businesses with due regard to customers’ best interests and the suitability principle.

² With respect to item 2.(b), the PY2025 Policy referred simply to “explanations to customers,” whereas the PY2026 Policy provides more specific guidance, referring to explanations provided “in a manner and to an extent necessary for customers to understand” the products in light of their individual characteristics. The PY2025 Policy also addressed the need to take customers’ digital literacy into account when providing information, but did so under the “Cross-Industry Areas of Focus” relating to changes in business models and the development of corresponding internal control frameworks.

At the same time, certain areas of focus included in the PY2025 Policy are not expressly mentioned in the PY2026 Policy. These include the sales and solicitation practices and internal control frameworks relating to collaboration between banks and securities companies, as well as measures to prevent misconduct by financial institution employees.

Nevertheless, with respect to the former, it is worth noting that the SESC’s inspection findings for PY2025 identified inadequate management of non-public information between banks and securities companies prior to obtaining customer consent as an internal control deficiency. ³ With respect to the latter, FIBOs should also remain alert to the continuing occurrence of misconduct by employees, including embezzlement by employees of insurance companies, banks and cooperative financial institutions, as well as insider trading by employees of securities companies and other firms.

³ SESC, “Overview and Case Studies of Securities Monitoring for Program Year 2025,” p. 13.

(2) System Risk Management
The PY2026 Policy states that the SESC will focus on whether FIBOs have appropriate system risk management measures in place, taking into account the Comprehensive Guidelines for Supervision of Financial Instruments Business Operators and other relevant guidance (the “Supervisory Guidelines”), as well as changes in the threat landscape resulting from frontier AI.

①Measures Against Unauthorized Access and Transactions in Internet Trading
Unauthorized access and transactions in internet trading using customer information stolen from fake securities company websites (phishing sites) increased sharply from around March 2025. In response, the Financial Services Agency (the “FSA”) amended the Supervisory Guidelines in October 2025 to strengthen authentication methods and measures to prevent unauthorized access and transactions in internet trading.

The amendments added requirements in areas including: (a) establishing internal control frameworks, such as treating measures against unauthorized access as a top management priority; (b) ensuring security, including mandatory use of phishing-resistant multi-factor authentication for important operations such as logging in; and (c) customer support, including providing alerts and information on security measures that customers should take.
Although the amendments took effect immediately upon publication of the results of the public consultation, the FSA recognized that implementation would require a certain amount of time. The FSA therefore generally expected securities companies to implement phishing-resistant multi-factor authentication by the end of June 2026. ⁴

In PY2026, the SESC is expected to conduct full-scale reviews of measures taken in response to unauthorized access and transactions in internet trading based on the revised Supervisory Guidelines. It should also be noted that these measures are expected to be implemented not only by securities companies but also by other FIBOs. ⁵

⁴ FSA, “Key Issues Raised by the Financial Services Agency at Meetings with Industry Associations (JSDA, July 15, 2025).”

⁵ FSA, “Publication of the Results of the Public Consultation on the Proposed Amendments to the Comprehensive Guidelines for Supervision of Financial Instruments Business Operators and Other Relevant Guidelines,” October 15, 2025, Responses to Comments, pp. 11–12, Nos. 28 and 30.

② Measures in Response to Changes in the Threat Landscape Resulting from Frontier AI
In May 2026, the FSA and the Bank of Japan jointly requested that financial institutions and other relevant entities take “Short-Term Measures by Financial Institutions and Other Entities in Response to Changes in the Threat Landscape Resulting from Frontier AI.” ⁶
The request identifies the following short-term measures expected of financial institutions and other entities to address the large number of vulnerabilities arising from frontier AI. Considering developments in the activities of AI model developers, institutions are expected to implement these measures generally within approximately one month. The SESC is expected to place particular focus on the status of implementation of these measures in PY2026.

Treat responses to frontier AI as a management priority. Identify services and IT systems that require priority treatment. Address technical deficiencies in the identified assets. Allocate additional human resources for applying security patches. Review the terms of maintenance and support agreements with vendors. Adopt a risk-based approach to the patching process. Strengthen measures other than patching. Prepare for the suspension of priority services and IT systems. Maintain and strengthen coordination with external parties.

⁶ FSA, Director-General of the Strategy Development and Management Bureau and others, “Request for Short-Term Measures by Financial Institutions and Other Entities in Response to Changes in the Threat Landscape Resulting from Frontier AI,” May 22, 2026.

(3) Establishment of Internal Control Frameworks for Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT)
As in the PY2025 Policy, the PY2026 Policy identifies as specific areas of focus the establishment and enhancement of AML/CFT systems based on the “matters requiring action” set out in the Guidelines for Anti-Money Laundering and Combating the Financing of Terrorism (the “AML/CFT Guidelines”). It should be noted that the AML/CFT Guidelines were amended in March 2026. ⁷

The amended AML/CFT Guidelines added or elevated the following matters as “matters requiring action”:

Taking appropriate risk mitigation measures in transaction monitoring and filtering, taking into account the degree of suspicion associated with detected transactions and trends in money laundering and terrorism financing risks; Utilizing new technologies; and Verifying the AML/CFT risk management systems of outsourced service providers.

⁷ FSA, “Publication of the Results of the Public Consultation on the Proposed Amendments to the Guidelines for Anti-Money Laundering and Combating the Financing of Terrorism,” March 31, 2026.

(4) Measures to Ensure the Effectiveness of Internal Control Frameworks
The PY2026 Policy sets out the following specific areas of focus:

Regardless of whether any material issues relating to investor protection, compliance or other matters have arisen, whether effective internal control frameworks have been established in accordance with the characteristics and scale of each FIBO’s business; Where the business model has changed in response to changes in major shareholders or the management structure, or where the location of the head office differs from the actual operational base, whether governance is effective; and Whether management fully recognizes the importance of findings identified through internal audits and audits or other reviews by self-regulatory organizations and proactively implements effective remedial and preventive measures.

With respect to item 1, the PY2025 Policy focused on changes to, and the continuation of, business models when examining the establishment of internal control frameworks. In contrast, the PY2026 Policy appears to take a broader approach, examining whether effective internal control frameworks have been established based on the characteristics and scale of each FIBO’s business, regardless of whether its business model has changed or remained unchanged.

Item 2 is broadly consistent with the PY2025 Policy, although the wording differs slightly. Item 3 appears to incorporate into this area of focus matters that were addressed separately in the PY2025 Policy.

The “Key Areas of Focus by Size and Business Type” will be discussed in Part 2.