Indonesia’s New OJK Crypto Reporting Rules: What Changes for Users?

New technical reporting rules for digital financial assets, including crypto, took effect in Indonesia on September 1, 2026. The provisions are set out in OJK Board of Commissioners Member Regulation No. 3 of 2026, commonly referred to as PADK OJK 3/2026.

The regulation primarily applies to digital financial asset trading providers. It does not require every crypto holder to submit a monthly personal portfolio report directly to OJK. Users are more likely to feel its effects through changes in how providers maintain records, evaluate assets, report operational conditions, and handle specified incidents.

At first glance, reporting rules may appear to be an administrative matter. In an industry that operates around the clock and handles highly volatile assets, however, reporting quality can influence how quickly a problem is detected and how clearly the regulator understands the risks involved.

More structured reporting still has limits. A larger number of reports does not automatically make every token safe, prevent all operational failures, or guarantee that user losses can be recovered.

What Does the Regulation Cover?

PADK OJK 3/2026 provides technical implementation rules under POJK 23/2025, which amended POJK 27/2024 on digital financial asset trading, including crypto assets.

According to OJK’s official abstract, the regulation covers five main reporting areas:

• reports on the evaluation of digital financial assets included in the Digital Financial Asset List;

• periodic provider reports submitted monthly, quarterly, and annually;

• incidental reports when specified events occur;

• procedures for submitting reports and related applications;

• notifications concerning the clearing, guarantee, and settlement of digital financial asset derivatives.

The scope shows that supervision extends beyond transaction value or volume. OJK also needs information about the assets available for trading, provider operations, risk management, and events that could affect services or consumers.

PADK OJK No. 3 of 2026 covers asset-evaluation reports, periodic and incidental reporting, and notifications related to the clearing and settlement of digital financial asset derivatives. Source: Indonesia Financial Services Authority.

Why Must Asset-List Evaluations Be Reported?

The number of tradable tokens can grow much faster than a retail user’s ability to investigate every project. Asset evaluation provides one layer of screening, although it does not replace independent research.

Evaluation reports can give the regulator a clearer record of why an asset was included in the list, how it performed in subsequent reviews, and whether new risks appeared after trading became available.

A project’s condition can change quickly. Developer activity may slow down, liquidity may decline, ownership may become more concentrated, or a security incident may significantly alter a token’s risk profile.

Token availability on a platform should therefore not be treated as permanent. An asset available today may be reassessed based on project developments, evaluation findings, regulatory requirements, and provider policies.

Inclusion in an eligible asset list is also not a guarantee that the token’s price will increase or that users will recover their invested capital. Regulatory evaluation concerns eligibility within a trading and consumer-protection framework, not expected return.

How Do Periodic and Incidental Reports Work?

Periodic and incidental reports serve different purposes. Periodic reports allow the regulator to examine changes over time, while incidental reports address events that should not wait until the next routine reporting deadline.

Periodic Reports

Monthly, quarterly, and annual reports create a sequence of data that can be compared across different periods. This information can help the regulator monitor changes in transaction scale, operational conditions, risk-management practices, and other indicators required by the reporting format.

A single report may only show conditions during a specified period. When reports are submitted consistently, regulators can identify patterns that may be difficult to detect through a one-time review, including sharp changes in activity or operational risk.

Report quality remains critical. Late, incomplete, or inconsistent data can reduce the value of supervision even when the formal reporting obligation is already in place.

Incidental Reports

Incidental reporting covers specified events that need to be disclosed to the regulator without waiting for the next monthly or quarterly cycle.

Its practical value depends on how reportable events are defined, how quickly information is submitted, how complete the report is, and what action follows after the regulator receives it.

Incident reporting cannot prevent every disruption. Systems may still face cyberattacks, technology failures, third-party problems, or liquidity stress. Its main function is to support detection, documentation, supervision, and response.

Why Do Derivatives Require Particular Attention?

Digital-asset derivatives carry risks that differ from ordinary spot purchases. A derivatives position may use margin, face liquidation, depend on a mark price, and require reliable clearing, guarantees, and settlement.

PADK OJK 3/2026 includes notifications concerning the clearing, guarantee, and settlement of digital financial asset derivatives. This part of the regulation matters because a failure at one point can affect multiple parties.

Margin shortfalls, concentrated positions, or settlement failures can intensify pressure when volatility rises. These risks become more significant when traders use high leverage while market liquidity is declining.

More structured supervision does not change the fundamental nature of leverage. Losses can still develop faster than a user can add margin. A product being legally available also does not mean it is suitable for every user’s goals, experience, or risk tolerance.

What Changes for Users?

PADK OJK 3/2026 focuses on provider obligations. It does not require users to send monthly crypto portfolio reports directly to OJK.

Users may experience indirect operational changes, including:

• more structured requests for and recording of account information;

• more consistent documentation of asset evaluations;

• changes to asset availability following a reassessment;

• stronger requirements for providers to maintain operational data and risk-management systems;

• formal reporting channels for specified incidents;

• clearer notification procedures for derivatives-related activities.

The word “may” matters because the user experience will depend on how each provider implements the requirements and how OJK follows up. A new regulation does not always produce an immediate or visible change to an application’s interface or features.

User Responsibilities Remain the Same

Regulatory supervision does not replace account security or personal risk management. Users still need to:

• protect passwords, devices, and authentication methods;

• verify wallet addresses and networks before transferring assets;

• understand fees and product structures;

• maintain accurate transaction records;

• examine project and liquidity risks;

• understand leverage before opening a derivatives position.

A regulator cannot recover a lost seed phrase or reverse a blockchain transfer sent to the wrong address. Consumer protection therefore still requires both provider supervision and careful user behavior.

Will Users’ Personal Data Be Reported?

Provider reporting obligations are not the same as publishing all users’ personal information. PADK OJK 3/2026 regulates reporting to the authority for supervisory purposes. It does not mean individual portfolios will be made publicly available.

Digital financial asset providers may still need identity, account, and transaction information to comply with applicable regulatory requirements. Users could be asked to update their information or provide additional documents when existing records are incomplete.

The type of data collected, its purpose, how it is stored, and who may access it should be reviewed through the provider’s privacy policy, terms of service, and official disclosures. Users should not assume that all transaction details automatically become public simply because providers have reporting duties to the regulator.

These Rules Are Different from CARF

PADK OJK 3/2026 and the Crypto-Asset Reporting Framework both involve crypto-related data, but they serve different purposes.

PADK governs provider reporting to OJK for the supervision of digital financial asset trading. Its scope includes asset evaluations, operational reports, incidental events, and derivatives infrastructure.

CARF focuses on tax-residency identification and the exchange of crypto transaction information for cross-border tax administration.

PADK is therefore not a new crypto tax and does not replace the need for users to maintain transaction records for tax purposes. A more detailed explanation of the distinction is available in MEXC Crypto Pulse’s guide to CARF implementation in Indonesia.

What Does the New Regulation Not Guarantee?

A more detailed reporting framework can improve governance, but it cannot remove the risks associated with crypto assets.

The regulation does not guarantee that:

• token prices will rise;

• every project has strong fundamentals;

• an asset will never be delisted;

• providers will operate without disruption;

• smart contracts are free from vulnerabilities;

• liquidity will always be available at the expected price;

• losses involving leverage can be recovered;

• scams will no longer occur.

Regulators can establish standards, request reports, conduct examinations, and take action within their authority. They do not determine token prices or eliminate market risk.

Reporting Limits Users Should Understand

Reporting can strengthen supervision only when the data is complete, accurate, timely, consistent, and usable. A large volume of documents does not necessarily lead to more effective oversight if the underlying information is weak.

Reports also describe conditions at a particular time or during a specified period. Rapid changes can occur after the reporting date, especially for assets with limited liquidity or highly concentrated ownership.

Transparency to the regulator is also different from transparency to the public. Some information may support supervision without being fully disclosed because it contains sensitive data, operational details, or user information.

These limits do not make reporting rules ineffective. They mean the regulation’s value should be assessed through implementation quality, timely follow-up, and the ability of the supervisory system to turn reported data into action when risks are identified.

What Should Users Monitor Next?

Once the regulation is in effect, attention shifts to technical implementation. Reporting formats, data quality, provider compliance, and OJK’s response to reported findings will determine the regulation’s practical effect.

Developments worth monitoring include:

• further guidance on reporting formats and procedures;

• changes to the Digital Financial Asset List;

• announcements concerning asset evaluations or trading suspensions;

• incident reports involving user-facing services;

• further provisions for derivatives clearing and settlement;

• public statistics that help users assess industry developments.

More detailed public data would help users determine whether the regulation improves visible transparency or primarily strengthens supervisory processes behind the scenes.

Conclusion

PADK OJK 3/2026 establishes a more structured reporting framework for digital financial asset trading providers. It covers asset-list evaluations, monthly, quarterly, and annual reports, incidental reports, and notifications related to derivatives clearing and settlement.

For users, the main change is not a requirement to submit personal reports directly to OJK. The potential benefit comes from more consistent supervision, better-documented asset reviews, and clearer incident-reporting channels.

The final impact will depend on data quality, provider compliance, and regulatory follow-up. The new rules are better understood as an additional layer of governance, not a certificate that every asset or product is risk-free.

As implementation progresses, the most important measure will not be the number of reports submitted. The real question is whether those reports help detect risks earlier, improve operational standards, and produce protection that users can actually experience.

Disclaimer

This article is for informational purposes and does not constitute legal, tax, or investment advice. Implementation details may evolve through further OJK guidance and policy. Use official regulatory documents as the primary reference and conduct independent research before making financial decisions.