Japan EMV 3DS Requirement Explained

The Japan EMV 3DS requirement is often described as a government mandate that took effect in April 2025. The reality is more specific. It comes from Japan’s Credit Card Security Guidelines, which set expectations for card issuers and ecommerce merchants, and it has now been in effect for more than eighteen months. The guidelines ask different things of issuers and merchants, and the difference matters to overseas merchants selling to Japanese cardholders as well.

Where the Japan EMV 3DS expectations come from

The Credit Card Security Guidelines are compiled by the Credit Transaction Security Measures Council, whose secretariat is the Japan Consumer Credit Association (JCA), with the Ministry of Economy, Trade and Industry (METI) involved. They are positioned as the practical guidance for the security obligations in Japan’s Installment Sales Act, as Japanese security press coverage of the 2024 revision explains. That makes them more than voluntary best practice, but they are guidelines, not a separate statute.

What the guidelines asked of issuers and merchants

METI’s summary of version 5.0 set two issuer targets for the end of March 2025, following the issuer roadmap of November 2023:

EMV 3DS registration of 80 per cent of cardholders who use ecommerce.
Migration of 100 per cent of EMV 3DS-registered cardholders to dynamic methods such as one-time passwords, away from static passwords.

For ecommerce merchants, the guidelines asked that, in principle, all merchants introduce EMV 3DS by the end of March 2025, with merchants that had experienced fraud expected to act sooner. Version 6.0, adopted at the council’s meeting on 4 March 2025, kept EMV 3DS as a core measure and added further expectations on merchant system security, according to trade press coverage. The JCA has since described a layered approach covering measures before, during and after payment, as reported by Payment Navi.

What it means now for each party

Party	What the guidelines expect	Practical focus now
Japanese issuers	Broad EMV 3DS registration and dynamic authentication methods	Challenge completion, enrolment of remaining cardholders, moving beyond SMS where appropriate
Japanese ecommerce merchants	EMV 3DS introduced as a baseline measure, with broader security controls	Data quality to keep genuine customers frictionless; layered controls around authentication
Overseas merchants selling to Japanese cardholders	Not directly addressed as merchants contracting outside Japan	Japanese issuers are now broadly ready to authenticate, so requesting EMV 3DS on Japanese cards is more likely to succeed

For overseas merchants, the practical consequence is the most useful one. Japanese cardholders are now broadly enrolled with dynamic methods, so an authentication request is likely to reach a ready issuer and a familiar challenge.

What EMV 3DS does not solve on its own

The JCA has emphasised that EMV 3DS is one measure among several. Payment Navi reports the association citing card fraud losses of 55.5 billion yen, with more than 90 per cent involving stolen card numbers, and the guidelines now ask for controls before and after the payment as well as at it. The article on regulators retiring SMS OTPs covers why the choice of challenge method still matters once authentication is in place.

Frequently asked questions

Is EMV 3DS legally mandatory in Japan?

The expectation comes from the Credit Card Security Guidelines, which serve as practical guidance for the security obligations in the Installment Sales Act. They are not a separate statute, but businesses in Japanese card transactions are expected to follow them.

Does the Japan EMV 3DS requirement apply to overseas merchants?

The guidelines address businesses involved in Japanese card transactions, such as Japanese issuers, acquirers and merchants. Overseas merchants should confirm their position with their acquirer, but benefit from Japanese issuers’ readiness either way.

Can static passwords still be used for EMV 3DS in Japan?

The target was for all EMV 3DS-registered cardholders to move to methods other than static passwords, such as one-time passwords or app authentication, by the end of March 2025.

Does EMV 3DS stop card fraud in Japan on its own?

No. The JCA treats it as one layer, and version 6.0 of the guidelines adds controls before and after the payment.

Which card brands are covered?

The guidelines apply to credit card transactions in Japan generally, including domestic brand JCB, which runs its own EMV 3DS programme for merchants.

Supporting authentication for Japanese cards

GPayments provides ActiveAccess for issuers and ActiveServer for acquirers, PSPs and merchants. To discuss authentication for Japanese cardholders, contact GPayments.