Tokyo Stock Exchange, Inc. (TSE) and Osaka Exchange, Inc. (OSE) have taken disciplinary action against Moomoo Securities Japan Co., Ltd.

The Exchanges censured Moomoo Securities Japan and requested that the Company submit a business improvement report.

The Securities and Exchange Surveillance Commission has conducted an inspection of the Company’s business operations and identified the following issues.

(1) Inappropriate Business Operations Relating to the Registration of NISA-Eligible Products

i. Providing customers with false information in connection with the conclusion of contracts concerning U.S.-listed ETFs and U.S.-listed ETNs

The Act on Special Measures Concerning Taxation, the Order for Enforcement of the Act on Special Measures Concerning Taxation, and other relevant regulations provide that listed ETFs and similar products are eligible for the growth investment category under the NISA scheme, whereas listed ETNs, which are foreign corporate bonds designed to have their redemption value linked to specified indices, and similar products are ineligible. In addition, investment trusts and similar products that make monthly distributions or use derivatives transactions other than for hedging and similar purposes are prescribed as products ineligible for NISAs. Such exclusion criteria, together with the foregoing ineligible products, are hereinafter referred to as the “Exclusions.”

The department responsible for registering NISA-eligible products in the Company’s systems (hereinafter referred to as the “Responsible Department”) did not accurately understand the Exclusions and the Company’s internal rules did not contain provisions concerning them. Consequently, from February 21 through May 27, 2025, the Company sold a total of at least 77 issues of U.S.-listed ETFs and U.S.-listed ETNs (hereinafter referred to as the “Relevant Issues”) that fell under the Exclusions while erroneously indicating on order-entry screens of the Online Trading Service, accessible to customers through its website or application, that they were eligible for NISA.

As a result, 59 customers conducted transactions in 25 of the Relevant Issues through their NISA accounts.

The Company became aware of the aforementioned conduct following customer inquiries, and, on May 27, 2025, took measures including suspending the sale of the Relevant Issues as NISA-eligible products. However, the Company did not formulate effective improvement measures, such as revising its internal rules or establishing a checking system. This inspection found that between November 19, 2025 and January 14, 2026, the Company offered for sale one U.S.-listed ETF that was ineligible for NISAs under the Exclusions while falsely representing it to be eligible, as it had done with the Relevant Issues.

As a result, one customer purchased that issue through a NISA account.

The aforementioned conduct by the Company is deemed to constitute an act of providing a customer with false information in connection with the conclusion of a financial instruments transaction contract or in connection with the solicitation thereof, as prescribed in Article 38, Item 1 of the Financial Instruments and Exchange Act (FIEA).

ii. Grossly inadequate treatment of the Affected Customers

After considering how to handle the Affected Customers, the Company, led by the person responsible for overall internal management, notified the Affected Customers on June 10, 2025 that they could choose either to transfer the relevant holdings to a taxable account (either a specified account or a general account) or to cancel the executed transactions (hereinafter referred to as “Notification (i)”).

Thereafter, having become aware that transfers to specified accounts were not possible due to its system specifications, the Company sent a second notification to the Affected Customers on July 4, 2025 to the effect that transfers could be made only to general accounts (hereinafter referred to as “Notification (ii)”).

At the time of sending Notification (i) and Notification (ii), the Company decided that, while it would individually correct the annual investment limit for each Affected Customer, customers holding multiple Relevant Issues would be permitted to choose only one of the following alternatives: transfer of all such holdings to a taxable account or cancellation of all relevant executed transactions. The Company further decided that it would not accommodate requests by such customers for different treatment on an issue-by-issue basis.

However, although those decisions contained information that could affect customers’ decision-making and tax filings, the Company did not notify the Affected Customers of those decisions, except for certain customers who made individual inquiries to the Company.

Furthermore, in considering its future treatment of the Affected Customers, the Company issued Notification (i) without making basic confirmations, including whether the proposed measures could be accommodated by its systems. Moreover, the Company decided not to transfer holdings to specified accounts, and issued Notification (ii), without considering any alternative arrangements for customers who wished to make such transfers. This decision was made solely for the Company’s own convenience, namely, because its system specifications did not permit such transfers to be processed in bulk.

The Company’s treatment of the Affected Customers was grossly inadequate.

iii. Inconsistent treatment of the Affected Customers

Although the Company stated that it would correct annual investment limits, it corrected the limit for only one Affected Customer at that customer’s request in July 2025. As of the inspection reference date (August 25, 2025), the Company had not considered a schedule or specific measures for correcting the limits of the other Affected Customers because it lacked sufficient human resources.

As a result, the annual investment limits of the other 58 Affected Customers had not been corrected by December 2025, meaning that the Company treated the Affected Customers inconsistently.

The aforementioned circumstances at the Company arose from the Responsible Department’s and internal management department’s insufficient understanding of applicable laws, rules, and regulations. The selling of financial products falling under the Exclusions by falsely representing to customers that those products were eligible for NISAs was solely the responsibility of the Company, and the Company should therefore have made every effort to ensure prompt and appropriate responses to customers.

However, the Company prioritized the expansion of its business, including the introduction of new products and services, while lacking sufficient awareness of the impact on customers, leading to grossly inadequate and inconsistent treatment of customers.

Accordingly, the Company is deemed to have engaged in inappropriate operations relating to the registration of NISA-eligible products.

(2) Breach of the Duty of Due Care of a Prudent Manager in Securities, etc. Management

As part of its securities, etc. management, the Company maintains an account with Japan Securities Depository Center, Inc. (JASDEC) and, as an account management institution, conducts book-entry transfer operations involving domestic listed stocks and publicly offered investment trusts handled under the book-entry transfer system (hereinafter collectively referred to as “Stocks, etc.”).

JASDEC has established the operational rules for book-entry transfer of stocks, etc. and other rules pursuant to the Act on Book-Entry Transfer of Corporate Bonds and Shares. Under those rules, where a customer applies for the deposit or withdrawal of Stocks, etc., the account management institution is required to take action in accordance with the application.

For these purposes, “deposit” means the transfer of securities from a securities account with another securities company to a securities account with the Company in the name of said customer, and “withdrawal” means the transfer of securities from a securities account with the Company to a securities account with another securities company in the name of said customer.

In this context, while prioritizing the expansion of its business, including the introduction of new products and services, the Company did not sufficiently promote awareness of compliance with applicable laws, rules, and regulations, meaning that due to its insufficient understanding of the laws, rules, and regulations governing book-entry transfer operations, the Company mistakenly believed, among other things, that responding to customers’ applications for deposits and withdrawals was merely a part of its services and that it was permissible not to respond to such applications. Accordingly, since April 2024, the Company has uniformly refused to accept customers’ applications for withdrawals of domestic listed stocks, except where a tender offer is to be made for such stocks.

Furthermore, since September 2024, the Company has uniformly refused to accept customers’ applications for deposits and withdrawals of publicly offered investment trusts, even where the relevant investment trusts were handled by both the Company and other securities companies and the Company was able to process such deposits and withdrawals.

In addition, although the Company has indicated on its website since at least April 2024 that it plans to enable withdrawals of domestic listed stocks, it had not taken any steps necessary to do so as of the inspection reference date, including formulating a system development plan or making budgetary allocations.

The Company is required to fulfill its responsibilities as an account management institution responsible for managing transfers of customers’ securities. The aforementioned conduct is therefore deemed to constitute a breach of the duty of due care of a prudent manager prescribed in Article 43 of the FIEA, as the Company did not engage in securities, etc. management (book-entry transfer operations) with the due care of a prudent manager toward its customers.

(3) Failure to Assess Whether Transactions Constituted Suspicious Transactions

Pursuant to the Act on Prevention of Transfer of Criminal Proceeds, the Company is required to examine and determine whether a transaction constitutes a suspicious transaction and, where it determines that it does, file a suspicious transaction report.

However, the Company did not sufficiently promote awareness of compliance with applicable laws, rules, and regulations and had an insufficient understanding of the laws, rules, and regulations governing suspicious transaction reporting since launching its account-opening services. As a result, the Company erroneously believed that it was not required to assess whether a transaction constituted a suspicious transaction where it had refused to open an account for a customer, or taken similar action, as this would mean it had not established a transactional relationship with that customer.

As a result, from September 2023 through July 17, 2025, the Company failed to examine and determine whether transactions constituted suspicious transactions in respect of at least 1,531 customers for whom it had refused to open accounts or taken similar action.

The aforementioned circumstances raise concerns that suspicious transaction reports were not filed for transactions that should have been reported, potentially constituting a violation of the Act on Prevention of Transfer of Criminal Proceeds.

(4) Insufficient Management of Electronic Data Processing Systems for Financial Instruments Business (Insufficient System Risk Management Structure Including Cybersecurity)

i. Insufficient system risk assessment

The Company has not adequately established internal rules for system risk assessment. As a result, system risk assessments of important information assets were not conducted adequately, such as certain core systems not being included in its information asset inventory. Furthermore, the Company did not centrally and consistently monitor the progress of its responses to issues identified through system risk assessments, system audits, and other processes. Accordingly, issues relating to system risk were not adequately managed. The Company’s system risk assessment and related management were therefore insufficient.

ii. Insufficient cybersecurity management

The Company has not adequately established internal rules and inventories relating to cybersecurity management. As a result, configuration information for hardware, software, and other assets was not properly managed. Moreover, with respect to vulnerabilities identified through vulnerability assessments and other means, the Company did not analyze their impact on its business or prioritize its responses. Consequently, its responses to those vulnerabilities were insufficient. In addition, the Company has not taken adequate measures to ensure the effectiveness of its contingency plan for cyberattacks, meaning that its cybersecurity management was also insufficient.

iii. Insufficient system failure management and problem management

The Company has not adequately established internal rules or allocated appropriate human resources for system failure management. As a result, it did not adequately record system failures, identify their root causes, or conduct trend analyses. The Company’s system failure management and problem management were therefore insufficient.

iv. Insufficient monitoring of system risks

The Company’s internal rules require the person responsible for information management in each department to verify the status of information security management. However, such verification was not carried out. As a result, the Company did not appropriately ascertain the actual state of information security management in its departments, meaning that its monitoring of system risks was insufficient.

v. Insufficient system audits

Due to insufficient human resources for system audits, the Company did not follow up effectively on audit findings. As a result, those findings remained unremedied, and subsequent system audits identified the same or similar issues. The Company’s system audits were therefore insufficient.

vi. Insufficient governance relating to system risks

The Company has established an information security committee, chaired by its representative director and president. The committee plays a central role in IT governance, including establishing internal rules on information security management, developing a management system, and verifying the status of information security in each department.

Although aware of the circumstances, the information security committee did not direct corrective action and allowed the problems to persist.

In addition, several years had passed since the launch of the Company’s Online Trading Service, and the Company’s management had become aware of the issues described above concerning the system risk management structure through the information security committee. Nevertheless, the Company’s management did not direct timely and appropriate action.

For these reasons, the Company’s governance relating to system risks was insufficient.

The foregoing circumstances regarding the Company’s business operations raise serious concerns from the standpoint of investor protection and are deemed to constitute circumstances in which it is “necessary and appropriate in the public interest or for the protection of investors as concerns a financial instruments business operator’s business operations” as prescribed in Article 51 of the FIEA.

Furthermore, as a trading participant, the Company’s insufficient business management system and internal management system caused a broad range of violations of laws, rules, and regulations, and other misconduct. Such conduct constitutes “extremely careless business practices,” which undermines confidence in its trading qualification, and is deemed to constitute both (i) a violation of just and equitable principles of trade as prescribed in Rule 42, Item (2) of the TSE Trading Participant Regulations and (ii) a breach of just and equitable principles of trade as prescribed in Rule 51, Item (2) of the OSE Trading Participant Regulations.