Regulatory Update: OJK Regulation 27/2024 Redefines Crypto — From Commodity to Financial Asset

On 10 December 2024, the Indonesian Financial Services Authority (Otoritas Jasa Keuangan or “OJK”) enacted OJK Regulation No. 27 of 2024 on the Organization of Digital Financial Assets Trading, including Crypto Assets (“OJK Regulation 27/2024”). Effective as of 10 January 2025, this regulation marks a transformative shift in the governance of crypto assets in Indonesia. It transfers oversight from the Commodity Futures Trading Regulatory Agency (Badan Pengawas Perdagangan Berjangka Komoditi or “BAPPEBTI”) to OJK under the mandate of Law No. 4 of 2023 on Financial Sector Development and Strengthening.

This regulation aims to address the evolving nature of crypto assets and their integration into the broader financial system. By introducing more comprehensive oversight and stricter compliance standards, it enhances market integrity, bolsters consumer protection, and aligns Indonesia’s crypto ecosystem with international norms.

This article delves into key aspects of the regulation, its impact on organizers and consumers/investors, and the steps necessary for compliance.

The term ‘organizers’ under OJK Regulation 27/2024 refers to entities involved in the trading, storage, and management of crypto assets. These include:

• Exchanges (Penyelenggara Bursa Aset Keuangan Digital termasuk Aset Kripto).
• Clearance Institutions (Lembaga Kliring Penjaminan dan Penyelesaian Perdagangan Aset Keuangan Digital termasuk Aset Kripto).
• Storage Managers (Pengelola Tempat Penyimpanan Aset Keuangan Digital termasuk Aset Kripto).
• Traders (Pedagang Aset Keuangan Digital).

Transition from BAPPEBTI to OJK: What Has Changed?

The shift of crypto asset oversight from BAPPEBTI to OJK marks a redefinition of how crypto assets are classified and regulated. Under BAPPEBTI’s regime, crypto assets were regarded as intangible commodities intended for trading. Under OJK’s regime, they are now defined as digital representations of value with expanded economic applications, such as value storage, investment, and asset representation.

This redefinition aligns crypto assets more closely with financial market principles. OJK’s framework emphasizes investor safeguards, risk management, and governance, addressing gaps left by the commodity-focused approach. By broadening the regulatory scope, OJK ensures crypto assets are integrated more securely and effectively into Indonesia’s financial ecosystem, meeting both domestic and international standards.

The following table highlights the key differences in crypto asset classification under BAPPEBTI and OJK regimes:

Reclassification of crypto assets under OJK Regulation 27/2024 introduces higher compliance requirements for crypto assets trading organizers. These include detailed criteria for tradable crypto assets, stricter security measures, implementation of Anti-Money Laundering (AML), Counter-Financing of Terrorism (CFT), and Counter Proliferation Financing (CFP) programs, and specific personal data protection measures, as outlined in the following sections of this article.

Criteria of Tradable Crypto Assets

OJK Regulation 27/2024 sets clear, rigorous criteria for determining which crypto assets can be traded in Indonesia as follows:

• General criteria: All digital assets, including crypto assets, must meet basic eligibility criteria, such as operating on distributed ledger technology, complying with legal regulations, not being classified as financial assets by financial institutions, and fulfilling additional criteria imposed by OJK.
• Specific criteria: Crypto assets must demonstrate clear utility or asset backing, utilize publicly accessible distributed ledger technology, ensure traceability, and satisfy assessment standards set by exchanges. OJK and the exchange evaluate these assets based on factors such as market capitalization, trading volume, legal compliance, governance, consumer protection, economic potential, and risks related to money laundering, terrorism financing, and data security.

For the evaluation process, OJK shall review the proposed crypto assets to determine if they meet the general criteria. Further, the exchange shall assess and analyze the crypto assets by also considering the general and specific criteria before adding them to the List of Crypto Assets (Daftar Aset Kripto). Crypto assets that do not meet the stipulated criteria, hence excluded from the List of Crypto Assets, making them prohibited for trading in the market.

The comprehensive criteria for tradable crypto assets under OJK Regulation 27/2024 reflect a strong emphasis on transparency, security, and market stability. By establishing detailed standards and a clear approval process, OJK ensures that only legitimate and economically viable crypto assets are made available for trading, safeguarding both the market and consumers/investors.

Key Compliance and Operational Standards

Security System Measures

OJK regulates various aspects of organizers, encompassing their institutional framework, business licensing, and fit and proper assessment of their management and controllers. Among these, one critical element of the institutional framework is the system security requirements.

OJK Regulation 27/2024 mandates specific compliance requirements for different types of organizers, including certified personnel, secure systems, data protection, database management, business continuity, and audits.

Anti-Money Laundering (AML), Counter-Financing of Terrorism (CFT), and Counter Proliferation Financing (CFP)

Traders must implement robust consumer acceptance processes, including establishing agreements with prospective consumers that detail the trader’s profile, trading procedures, and disclosures of risks such as price fluctuations, system failures, and other risks.

Prospective consumers must fulfill identification and verification requirements, with individual consumers proving ownership of their funds and business entities providing evidence of their lawful financial sources.

Traders must adopt systems integrated with regulatory technology, biometric verification, and data sources to ensure compliance, and in the context of digital asset transfers, traders must enforce the Travel Rule:

• Transfer of USD 1,000 or more must include detailed sender and recipient information.
• Transfers below USD 1,000 require basic sender and recipient details.

Traders are prohibited from facilitating transfers that do not comply with Travel Rule requirements.

Source of organizers’ capital

Additionally, OJK Regulation 27/2024 explicitly prohibits organizers’ capital from originating from money laundering and/or terrorism financing activities, loans, and other prohibited/illegal activities.

Personal Data Protection

OJK Regulation 27/2024 addresses privacy concerns by introducing strict personal data protection requirements, ensuring consumer data is handled with integrity, security, and transparency. Organizers are mainly required to:

• Maintain data confidentiality to prevent misuse or unauthorized access.
• Obtain explicit consent before using consumers’ personal data (including for transfers to third parties).
• Notify OJK before sharing data with third parties, ensuring oversight and accountability.

The explicit consent mandate under this regulation differs from Indonesia’s Personal Data Protection Law (UU PDP), which permits other legal bases for data processing, such as contractual necessity, legal obligations, or legitimate interests. While this approach provides stronger consumer protection, fostering trust, it also presents challenges for organizers, particularly in managing consent for routine or large-scale data transfers. Additionally, the potential revocation of consent could disrupt services, posing operational hurdles.

Key Aspects of Transitional Provisions

The transitional provisions under OJK Regulation 27/2024 outline a clear shift of regulatory authority over crypto assets from BAPPEBTI to OJK as follows:

BAPPEBTI’s oversight ceases for crypto assets

Upon enactment of OJK Regulation 27/2024, BAPPEBTI no longer oversees crypto assets trading. All licensing, approvals, and supervisory functions for crypto assets are transferred to OJK. However:

1. Licenses, approvals, and registration issued by BAPPEBTI before the enactment of this regulation remain valid.

2. Pending applications will be finalized by OJK under the new framework.

Status of ongoing dispute resolution and investigations

Ongoing cases or investigations initiated by BAPPEBTI before the transition will still be resolved under BAPPEBTI’s jurisdiction.

Temporary validity of List of Crypto Assets from BAPPEBTI

The List of Crypto Assets issued by BAPPEBTI remain valid until OJK requires the exchange to issue the new List of Crypto Assets within three months since the enactment of OJK Regulation 27/2024.

Restriction on new activities

Physical crypto asset traders cannot introduce new products unless already in the licensing process with BAPPEBTI before the enactment of OJK Regulation 27/2024.

To summarize, BAPPEBTI no longer plays any regulatory role in crypto assets upon the issuance of OJK Regulation 27/2024, since OJK will take full responsibility for supervision, licensing, and compliance. BAPPEBTI’s role now is limited to resolving pending investigations or disputes before OJK Regulation 27/2024 came into force.

Impact on Organizers and Consumers/Investors

For Organizers

The transition to the new regulatory framework presents both opportunities and challenges for organizers. Operational adjustments will be necessary, including the implementation of enhanced cybersecurity measures. Companies will also need to invest significant resources into compliance efforts, such as staff training, technology upgrades, and regulatory reporting. However, organizers that successfully meet OJK’s standards are likely to gain a competitive advantage by attracting consumers/investors and fostering greater consumers/investors trust.

For Consumers/Investors

The enhanced regulatory framework offers a safer environment for consumers/investors. It increases transparency in trading operations and reduces the risks of fraud and market manipulation through stricter oversight, and provides greater assurance of data security and fund protection.

Future Development

OJK Regulation 27/2024 is just the beginning of Indonesia’s journey to regulate its crypto ecosystem. As innovations like decentralized finance (DeFi) and stablecoins gain traction, OJK is likely to introduce tailored regulations to address their unique risks and opportunities. Similarly, Initial Coin Offerings (ICOs), currently excluded, may be integrated into future policies, creating a more comprehensive regulatory framework.

These developments will shape Indonesia’s position in the global crypto landscape, balancing innovation with market stability and consumer protection.