On October 9, 2026, the Financial Services Agency (FSA) requested financial institutions and other entities to phase out identity verification methods that involve transmitting images of driver’s licenses and other documents ahead of schedule, and to transition to methods that read IC chip information instead. This request is driven by a large-scale leak of driver’s license images at a major car-sharing company and the rapid escalation of impersonation risks caused by the abuse of generative AI.

Request for accelerating the abolition of identity verification using driver’s license images

On October 9, 2026, the Financial Services Agency (FSA) issued an alert to financial institutions, including banks, trust banks, regional banks, and crypto asset exchange service providers, regarding the strengthening of cybersecurity measures and identity verification procedures at the time of account opening. Following the amendment of the Ordinance for Enforcement of the Act on Prevention of Transfer of Criminal Proceeds, the conventional online identity verification (eKYC) method (the so-called “Ho” method)—in which applicants photograph and submit photo ID documents such as driver’s licenses along with their facial likeness—had been scheduled for abolition on April 1, 2027. However, in light of the current security situation, the FSA has requested that financial institutions take action as quickly as possible without waiting for the enforcement date. Specifically, it is urging an accelerated transition to methods that directly read IC chip information from My Number cards or driver’s licenses using smartphones or similar devices, or to the Public Personal Authentication Service (JPKI). In addition, it has instructed institutions to further thoroughly verify whether there are any unnatural anomalies, such as forgery or tampering, in submitted document or facial images during non-face-to-face applications throughout the transition period.

The Vulnerability of “Image Verification” Highlighted by the Massive Data Breach

The biggest background factor behind the government’s strong demand to move up the schedule for the system changes is a series of identity verification document image leakage incidents caused by successive unauthorized accesses. In September 2026, external unauthorized access was discovered at the car-sharing service “Times Car,” operated under the Park24 group, resulting in the leakage of up to approximately 6.6 million pieces of account information. Of these, about 1.6 million included image data such as driver’s licenses submitted by users upon registration, making it the largest-scale identity verification document leakage incident in Japan. Driver’s license images consolidate unchangeable personal information such as names, addresses, dates of birth, facial photographs, and license numbers. In recent years, advances in generative AI and deepfake technology have made it a reality to forge video images—such as a person “shaking their head” or “blinking”—from a single leaked facial photograph to bypass conventional eKYC authentication. In fact, in March 2026 as well, an incident was uncovered where internet banking accounts were fraudulently opened using facial images generated from other people’s driver’s license images, highlighting the limitations of identity verification that relies merely on transmitting images.

The Identity Verification (eKYC) Market and Its Ripple Effects on the Industry

Affected Industries and the Surge in Demand for IT Solutions

The Financial Services Agency’s request extends beyond mega-banks and regional banks to a wide range of financial institutions, including securities companies, credit card companies, and crypto asset exchanges. Companies are being forced to move up their response plans, which had previously anticipated a grace period until April 2027, making system modifications and the construction of My Number Card integration infrastructure an urgent priority. According to market research published by Yano Research Institute in March 2025, the domestic market size for eKYC, public personal authentication, and identity verification solutions is projected to rapidly expand from 8.993 billion yen in fiscal 2023 to 24.791 billion yen in fiscal 2027. Previously, the penetration rate of My Number Cards and the hassle of entering PINs for driver’s licenses acted as barriers, making image-capture methods the mainstream. However, due to this request to accelerate the timeline and the amendment to the Act on Prevention of Transfer of Criminal Proceeds, demand is accelerating rapidly for solutions utilizing JPKI, which uses the IC chips of My Number Cards, and smartphone-integrated My Number Cards (card-substitute electromagnetic records). The ripple effect of these security measures is spreading beyond the financial sector to non-regulated areas such as matching apps and flea market sites.

Speculation surrounding My Number and security-related stocks in the stock market

The Financial Services Agency’s request to accelerate the abolition also attracted significant attention in the stock market. On October 9, 2026, the announcement date in the Tokyo stock market, speculative buying concentrated on IT companies handling authentication systems and security-related services utilizing My Number cards. Specifically, Showcase (3909), which develops super apps and identity verification platforms compatible with the Public Personal Authentication Service (JPKI), surged rapidly, while Flight Solutions (3753), which provides multi-payment and public personal authentication solutions, saw significant gains, with both stocks updating their year-to-date highs. For businesses, including financial institutions, to transition to IC chip reading methods or JPKI as quickly as possible, the introduction of solutions from proven external vendors is essential. Among market participants, views are strengthening that system development demand and security inspection demand accompanying the technological transition of eKYC will act as short-term earnings-boosting factors, resulting in buying spreading across cyber security-related sectors in general.

Practical Responses of Financial Institutions and Future Prospects

Transition Challenges Faced by Financial Institutions and IC Chip Operational Risks

While moves toward early migration are progressing, practical challenges also exist at the frontline counters and in online operations of financial institutions. Of particular concern is the issue regarding the PIN codes (two 4-digit PINs, PIN 1 and PIN 2) required to read the IC chips on driver’s licenses. Compared to My Number cards, many users have set PIN codes for their driver’s licenses but do not remember them, and repeated input errors require them to have the card unlocked at a police station. The Japanese Bankers Association and other organizations have also expressed concerns in public comments regarding a decline in customer convenience and a sharp increase in troubles at counters. Consequently, financial institutions need to establish alternative workflows that combine the mailing of original documents, such as a copy of a certificate of residence, with non-forwardable mail as a supplementary measure in cases where PIN codes are unknown or IC chips cannot be read. Furthermore, the April 1, 2027 amendment to the Act on Prevention of Transfer of Criminal Proceeds includes a wide range of changes, such as mandating the reading of IC chips in face-to-face transactions and limiting corporate verification to original documents, thereby demanding a comprehensive restructuring of operational processes.

Medium- to Long-Term Approaches to Identity Verification and Future Key Points

This request from the Financial Services Agency goes beyond merely changing the authentication method; it serves as a catalyst for transforming the very philosophy of data management in Japanese society. The conventional practice of “collecting and storing images of identity verification documents” has made the risk of causing fatal secondary damage in the event of a data breach abundantly clear. Moving forward, it will be essential to transition to a security design that does not retain excessive personal information (the principle of data minimization)—specifically, “not retaining images after verification” and “performing authenticity verification solely through IC chips or electronic certificates.” Coupled with the revision of the Act on Prevention of Transfer of Criminal Proceeds toward April 1, 2027, the adoption of My Number card functions on smartphones (the ru method) and the introduction of AI detection technologies to spot deepfakes are expected to advance even further. How to prevent increasingly sophisticated cybercrimes and forgery techniques without compromising user convenience. The reliability of the new identity verification systems built by financial institutions and service providers, as well as the speed at which they are implemented, will be a major focus of attention moving forward.

Reference Page

• [Strengthening Cybersecurity Measures in Light of the Current Situation and Handling of Various Transaction Applications, etc. – Financial Services Agency]https://www.fsa.go.jp/news/r8/sonota/20261009/20261009.html
• [Overview of Online-Completable Identity Verification Methods under the Act on Prevention of Transfer of Criminal Proceeds – National Police Agency JAFIC] https://www.npa.go.jp/sosikihanzai/jafic/index.htm

【#FinancialServicesAgency #eKYC #PublicPersonalAuthentication #ActOnPreventionOfTransferOfCriminalProceeds #Cybersecurity #MyNumberCard】