Japan Ends Photo ID Checks in April 2027, and Your App Has Decisions to Make First

You have probably done this. You open a bank or wallet app, photograph the front and back of your driver's license, photograph it again at an angle, then turn your face left and right for the camera.

That method stops being allowed in Japan on April 1, 2027.

I keep hearing "our eKYC vendor will swap the SDK, so we can just wait." That is half right. The vendor will update the part that reads the card. But the order of the steps, what you ask people to prepare, and where you send the people who fail are all decided by the app. That is where drop-off goes up or down.

I am a designer, not a lawyer. Whether your company is covered and which method you should use are questions for the original documents and for your counsel.

What changes

On June 24, 2025, Japan's National Police Agency promulgated an amendment to the enforcement rules of the Act on Prevention of Transfer of Criminal Proceeds. It takes effect on April 1, 2027. The agency's annual report for 2025 gives the reason: forged and altered ID documents of high quality are being used. For remote checks of individuals, the amendment in principle abolishes receiving photos of ID documents and receiving copies of them by mail.

The same report has a comparison table. Here is the part that matters for online flows:

• Sending photos of your face and your ID document (the so-called "ho method") is abolished.
• Sending a photo of your face plus the data from the ID's IC chip stays.
• The method that combined an ID photo with a bank account check loses the photo part. The IC chip replaces it.
• Mailing a copy of an ID document is abolished.
• Public key authentication with the My Number Card (JPKI) stays.

The report also quotes the government's priority plan, approved by the Cabinet on June 13, 2025. The direction is to consolidate remote identity checks, in principle, on My Number Card public key authentication. A separate amendment on March 6, 2026 made reading the IC chip the default for in-person checks too. It takes effect on the same day, April 1, 2027.

The rules apply to businesses that must verify customers under that law. That includes banks, funds transfer services, crypto exchanges and credit card companies. If you are not covered but use the same eKYC vendor for age checks or similar, ask the vendor what they plan to do.

What happens on the screen

Moving from photos to the IC chip changes what the user physically does.

A photo meant pointing the camera. Reading the chip means laying the back of the phone on the card and holding still for a few seconds. The antenna sits in a different place on every model, and most people have no idea where theirs is. If the card slips, they start over.

Then there is the PIN. My Number Card public key authentication needs the signing password, 6 to 16 letters and numbers. Driver's license chips have PINs too. People set both once when the card was issued and many never think about them again.

So people will drop off in different places for different reasons. Your current drop-off numbers will not tell you much about the new flow.

What to decide now

1. What to ask for first. My Number Card, driver's license or residence card. Which one you suggest first changes how many people remember the PIN. It is worth finding out what your users carry and which PIN they are most likely to know.

2. What to do for people whose card is on their phone. The Digital Agency launched the My Number Card on iPhone on June 24, 2025. The amended rules keep a method that uses the record stored on the phone. The more people stop carrying the physical card, the more this path matters.

3. Where to send people who cannot read a chip. For people without an NFC phone or an IC card, a method remains: they mail you an original document with anti-forgery features, such as a certified copy of their resident record, and you send transaction documents back by mail marked do not forward. The agency's Q&A says this method was kept so people without chip documents can still be verified remotely. Your flow needs a clear path to it. A dead end screen turns straight into a support ticket.

4. How to handle addresses for foreign residents. When a foreign resident moves, the new address is written on the back of the residence card, but the chip is not updated. The same Q&A says a photo of the back does not count, and the current address has to be confirmed separately. If many of your users are foreign residents, that is one more step.

5. What to do about existing users. According to the same Q&A, accounts verified before the change with a method that is being abolished do not have to be verified again afterward. The rules do not require a screen asking everyone to resubmit.

What you cannot hand to the SDK

The vendor supplies the reading component. The screens around it belong to the app.

That means the screen telling people what to have ready before they start, the screen telling someone who forgot their PIN where to reset it, and the screen offering another method after three failed reads. It also means the help page your support team works from, so everyone gives the same answer.

If you start these when the SDK update arrives, you will be late. A few months before the deadline, have people inside the company run the whole flow with real cards on several phone models.

At the first meeting

If you are reviewing your identity verification screens, tell me three things at the first meeting: which method you use today, whether you can see drop-off at each step, and roughly how many of your users are foreign residents or older people.

With those three, we can find where people are likely to get stuck in the new flow before the deadline arrives.