Japanese Banks Drop ID Photo Checks Early After Data Leaks, Ahead of April 2027 Rules

Stolen license images accelerate a banking change

Japanese banks are bringing forward changes to online account opening after a cyberattack on the Times Car sharing service exposed identity document images associated with about 1.6 million accounts. Mizuho Bank ended verification using photographs of identity documents on October 19, 2026, joining lenders already moving toward checks that read the electronic chips inside identity cards.

The legal deadline is April 1, 2027. The National Police Agency sets out that date in its revised rules FAQ on regulations implementing the Act on Prevention of Transfer of Criminal Proceeds. Banks are accelerating their preparations after the Financial Services Agency urged an early transition on October 9.

For customers, the immediate change depends on the bank and the application route. Some services will require a My Number Card, Japan's national identity card. Others will continue accepting a driver's license, provided the applicant reads its chip rather than simply sending a photograph of the document.

The banks are addressing two connected problems: criminals stealing copies of identity documents from companies, and criminals trying to use those copies to open accounts in someone else's name. An account obtained through impersonation can give a fraudster access to financial services under another person's identity.

The transition also reaches beyond major banks. Regional lenders, online banks and the cryptocurrency exchange Zaif have announced changes. Several deadlines fall in late October and early November, months before the national rules take effect.

What happened at Times Car?

Times Car, operated by an affiliate of Park24, suffered unauthorized access that became a major reason for banks to accelerate their plans. Information associated with approximately 6.6 million accounts was obtained, including identity document images associated with about 1.6 million accounts.

Descriptions of the breach put the number of current and former users whose driver's license images were exposed at more than 1 million. The broader figure of 1.6 million accounts covers identity document images, including documents other than licenses. Using the account figures, roughly 24% of the 6.6 million affected accounts had identity document images exposed.

Times Car plans to delete identity document images after registration checks are completed and to remove existing stored images by the end of October. That changes how long the service keeps a particularly sensitive category of customer information.

Banks are responding at the point where stolen documents might next be used. Their new checks require information from a card's chip or an electronic certificate, adding a verification step beyond the visible name, address, date of birth and photograph on a copied document.

Which major banks have already moved?

Mizuho's October 19 change replaced photographing licenses and other identity documents for remote account opening with verification using chip data from My Number Cards or other supported cards. Its move followed earlier changes at Sumitomo Mitsui Trust Bank and Mitsubishi UFJ Bank.

Sumitomo Mitsui Trust Bank ended document photo verification in March. Mitsubishi UFJ Bank moved its Smart Account Opening app to mandatory chip reading with an update on May 29. Applicants using a supported driver's license can continue to use that document through the chip reading process.

Sumitomo Mitsui Banking Corporation plans to end its document photograph method. Resona Holdings announced its policy against license photo checks for online account opening on October 16 and is considering an accelerated transition across its four subsidiary banks. Mitsubishi UFJ Trust and Banking Corporation is also considering changes. Implementation dates have not been announced for those remaining transitions.

The different stages matter for someone applying now: some banks have already stopped the older method, some have scheduled its closure, and others are still preparing. Each change applies to the account opening service or application route identified by the bank.

The next deadlines for applicants

SBI Shinsei Bank will end verification using photographs of identity documents and applicants' faces on October 27. From October 28, it will generally direct account applications through its app and require chip reading from either a My Number Card or a driver's license.

Aozora Bank will change its BANK deposit account web opening service to My Number Card authentication on October 29. Kyoto Bank will require a My Number Card for new accounts opened through the Kyogin app from November 2, following an announcement on October 15.

The main changes and deadlines span several months:

• March 2026: Sumitomo Mitsui Trust Bank ended document photo checks.
• May 29, 2026: Mitsubishi UFJ Bank made chip reading mandatory in its Smart Account Opening app.
• September 28, 2026: Docomo SMTB Net Bank ended its photograph method for individual account opening, with partner branches following in stages.
• October 9, 2026: The Financial Services Agency urged financial institutions to accelerate the transition.
• October 13 to 19, 2026: Zaif stopped accepting licenses for new individual accounts, Iwate Bank changed its Sora branch process, and Mizuho ended document photo checks.
• October 22 to 29, 2026: Hyakugo Bank, SBI Shinsei Bank and Aozora Bank have scheduled changes to their relevant services.
• November 2, 2026: Kyoto Bank plans to require My Number Card authentication for app account opening.
• April 1, 2027: The revised national regulations take effect.

Hyakugo Bank's October 22 change extends beyond new accounts. It also covers document photograph authentication for procedures including changes to registered addresses and telephone numbers. Chip reading and public personal authentication remain available.

How does a chip check work?

The Financial Services Agency's online verification overview explains the methods banks have used to identify customers remotely. The document photograph method combines an image of a photo identity document with an image of the applicant's face.

That process involves more than photographing a name and portrait. The document images must show information such as the applicant's address and date of birth, along with thickness or other features that help assess whether the document is genuine. Banks or their contractors provide the software used to send the images.

A separate method combines information read from the document's chip with an image of the applicant's face. The chip supplies identity information, including the name, address, date of birth and photograph. The bank can then use information held electronically in the card rather than relying on its photographed surface.

My Number Cards also support the Public Personal Authentication Service, known as JPKI. This uses an electronic certificate and an electronic signature. In simple terms, the certificate supplies a digital identity credential, while the signature lets the bank check that the application information has not been changed.

The FSA overview explains that the certificate's validity and the electronic signature must be checked. Kyoto Bank and Aozora Bank are moving their specified services to this approach. Banks can use an authorized service provider to carry out the certificate and signature checks.

What exactly changes in April 2027?

The revised Enforcement Regulations of the Act on Prevention of Transfer of Criminal Proceeds will remove the document photograph and face comparison route used for remote transactions. Chip information and electronic authentication will become central to the replacement processes.

The National Police Agency's FAQ was published following a public consultation held from December 5, 2025, to January 3, 2026. It explains that chip reading also brings duties for businesses: when using the relevant document presentation methods, they must compare information read from the chip with the information visible on the document.

The agency says this comparison is intended to prevent impersonation through forged or altered documents. A successful chip read is therefore one part of a check that also examines whether the electronic information and the physical document fit together.

The FAQ lists My Number Cards, driver's licenses, residence cards, special permanent resident certificates and passports as examples of documents with qualifying chips. Banks and other regulated businesses can choose which legally permitted verification methods they offer, so customers will encounter different document requirements.

Existing verification records can continue to be used where the conditions for relying on an earlier identity check are met. The FAQ says businesses do not need to repeat a completed check simply because the new regulations have taken effect.

Will customers still be able to use a license?

SBI Shinsei Bank's planned process accepts either a My Number Card or a driver's license through chip reading. Mitsubishi UFJ Bank also continues to accept chip equipped licenses in its relevant app. Applicants using a license there are instructed to prepare the two PINs, each containing four digits, set when the license was issued.

Kyoto Bank is choosing a different route for its app: applicants will need a My Number Card from November 2. Customers opening an account at a branch can still use a driver's license. Aozora's affected web service will similarly require a My Number Card after its change.

SBI Shinsei will retain an alternative for applicants unable to use its app: a web application with identity documents submitted by post. These alternatives have practical importance for people whose phones cannot read a card or who cannot complete the required electronic authentication.

Zaif's October 13 change requires new individual applicants to have a My Number Card and a smartphone capable of reading it. Customers whose identities have already been verified are unaffected by that change.

Regional banks show several routes to the same goal

Iwate Bank changed new account opening at its digital Sora branch on October 16. Customers now use the My Number Card's chip and the password for its signing certificate. Hokuto Bank and Shonai Bank moved their web account opening processes to JPKI on April 20, replacing a process that combined document checks with restricted delivery mail.

Japan Post Bank scheduled a change for October 20 at 9 a.m. for investment trust and NISA account applications through Yucho Direct. Those applications are moving from document image uploads to My Number Card authentication through a dedicated verification app. The change concerns those investment services.

Other institutions have added electronic verification alongside existing methods. UI Bank introduced additional chip and JPKI options in March while retaining document and face photography. Hokuriku Bank added JPKI for specified procedures at Seven Bank ATMs and kept its earlier photograph process available.

Shoko Chukin Bank added chip reading with face photography in July and public personal authentication in October. Aeon Bank, Chiba Bank, Minna Bank, PayPay Bank and Shiga Bank have also introduced chip or certificate options for specified services. Their customers currently have a mixture of choices, depending on the institution and procedure.

Japan also set October 20 as a target for adding the My Number Card to Google Wallet on Android phones. The FSA overview already describes a legal method using electronic records that substitute for a physical card, with designated programs transmitting and verifying the requested identity information.

The risks extend beyond bank accounts

Hiroyuki Minami, a professor at Hokkaido University's Information Initiative Center who specializes in cybersecurity, identifies driver's license images as particularly dangerous information to lose. He warns that criminals may use stolen images to apply for credit cards, take out consumer loans or arrange mobile phone contracts under another person's name.

Minami recommends promptly notifying a credit information agency such as CIC when a person learns that their license image has been exposed. His advice addresses the risk that someone may try to obtain credit using the stolen identity.

The Financial Services Agency's October 9 warning asked institutions to review cybersecurity, including contractors, systems exposed to the internet and arrangements for responding to incidents. It also called for scrutiny of unusual features in document and face images while banks accelerate chip verification.

Katsuhiko Kato, chairman of the Japanese Bankers Association and president of Mizuho Bank, called at an October 15 press conference for banks to move as quickly as possible toward checks that read identity document chips. The association had been working toward April 2027 adoption and is urging members to act sooner following the regulator's request.

The National Police Agency's FAQ also addresses data handling. It says information read from a chip during an in person check does not have to be transmitted elsewhere. Existing verification record requirements continue, while businesses may voluntarily keep logs showing that a chip was read. Banks must therefore decide both how they authenticate customers and how they manage the information involved.

Key Points

• Japan's revised identity verification regulations take effect on April 1, 2027.
• Mizuho ended document photo verification on October 19, following earlier moves by Sumitomo Mitsui Trust Bank and Mitsubishi UFJ Bank.
• The Times Car breach exposed identity document images associated with about 1.6 million accounts.
• SBI Shinsei, Aozora and Kyoto Bank have scheduled changes between October 28 and November 2.
• Some services require a My Number Card; others continue accepting driver's licenses through chip reading.
• Branch and postal alternatives remain available at specified banks.
• The FSA has urged faster adoption alongside checks on cybersecurity and incident response.