The Financial Services Agency criticized the exchanges for lacking the proper internal control systems, and ordered them to make improvement in areas from risk management to preventing the criminal use of digital money.

The exchanges included Coincheck, served with its second such notice since it was targeted in the late-January heist, and GMO Coin, run by GMO Internet Inc (9449.T). Two exchanges, Bit Station and FSHO, were ordered to halt operations for a month from Thursday.

The punishments represent the FSA’s widest response yet to concerns over security flaws at Japanese cryptocurrency exchanges, which first grew from the 2014 collapse of the Mt. Gox exchange and resurfaced with the Coincheck heist.

The regulator said Coincheck lacked proper systems for dealing with risks such as money laundering and terrorism financing. It gave the exchange until Mar. 22 to submit a report on how it would improve.

Coincheck said it would hold a press conference at 1600 local time (0700 GMT).

“We will carry out a far-reaching review of our internal control and management systems to ensure proper and reliable business operations from the viewpoint of customer protection,” it said in a statement.

The sanctions knocked the price of bitcoin lower while a lawmaker from the country’s ruling party criticized what she saw as flaws in Japan’s registration regime for cryptocurrency exchanges.

Bitcoin BTC=BTSP fell as much as 5.7 percent, before recovering to $9,812 at 0600 GMT. The virtual currency hit a peak of $19,458 in December but has since fallen by more than half following a series of crackdowns by regulators across the globe on the digital coin trade.

The theft from Coincheck, one of the biggest digital money heists ever, underscored the risks policymakers across the globe face in regulating cryptocurrency trading, and drew attention to Japan’s pioneering system of regulating the exchanges.

UNREGISTERED EXCHANGES

Japan last year became the world’s first country to regulate cryptocurrency exchanges. Some 16 exchanges are currently registered, while a further 16 – including Coincheck – were allowed to continue operating while their applications are checked.

Five of the seven exchanges punished by the FSA are unregistered, including the two forced to suspend business, Bit Station and FSHO. A senior employee at Bit Station used customers’ bitcoin for their own purposes, the FSA said, adding that the exchange has now dropped its registration application.

Bit Station and FSHO did not immediately respond to emailed requests for comment.

The head of the ruling Liberal Democratic Party’s cybersecurity taskforce said it was not ideal that exchanges that had not registered with the governments should be allowed to continue operations.

“It’s problematic that these 16 unregistered exchanges have been able to continue trading,” Sanae Takaichi told Reuters. “In the first place, should they have been allowed to operate while their applications for registrations are still incomplete?”

On GMO Coin, which was registered, the FSA said that problems with its systems had occurred frequently but the company had not sufficiently analyzed the causes. The regulator ordered it to submit a report by Mar. 22.

Shares in GMO Internet fell as much as 5.6 percent. The benchmark Nikkei average .N225 closed up 0.5 percent. 

“We will look again at our system risk management, and take thorough steps to improve to regain users’ trust,” a spokeswoman for GMO said.