OJK’s Crypto Reporting Rules Are Now in Force: What Data Is Being Monitored?

Indonesia’s Financial Services Authority, or OJK, began enforcing Board of Commissioners Regulation Number 3 of 2026, known as PADK 3/2026, on September 1, 2026. The regulation establishes the format, structure, and procedures for reports submitted by digital financial asset trading operators, including crypto asset service providers.

The reporting requirements extend beyond monthly transaction value. Operators must submit information covering their financial condition, customer funds, managed crypto assets, daily trading activity, over-the-counter transactions, digital asset transfers, wallet management, and derivatives activity.

The regulation’s appendices reveal an even deeper level of detail. Some reporting forms require information on customers with the largest transaction, deposit, withdrawal, and digital asset transfer values. This means OJK is seeking to understand not only the size of Indonesia’s crypto industry, but also how funds, assets, and operational risks move through individual service providers.

The rule does not create a new obligation for every customer to file a monthly report directly with OJK. The reporting obligation rests with the operator. Customers are more likely to experience its effects through stricter identity verification, transaction recordkeeping, balance reconciliation, wallet controls, and reviews of activity that does not match an account’s profile.

What Does PADK 3/2026 Actually Change?

PADK 3/2026 was enacted on June 30, 2026 and came into force on September 1, 2026. It functions as an operational reporting standard for institutions conducting digital financial asset trading activities under OJK supervision.

The regulation covers several categories of reports:

• Monthly reports.

• Quarterly reports.

• Annual reports.

• Incidental reports.

• Risk self-assessment reports.

• Digital financial asset list evaluation reports.

• Other reports that OJK may request for supervisory purposes.

The main change is standardization. Operational data can otherwise be stored under different definitions and classifications across service providers. PADK 3/2026 specifies reporting formats and structures so that data can be reviewed using more consistent periods, definitions, and categories.

Standardized data should make it easier for OJK to compare financial conditions, customer fund movements, trading activity, and risk exposure across operators. It may also improve investigations when regulators identify balance discrepancies, unusual transfers, liquidity pressure, or weaknesses in customer asset management.

PADK Number 3 of 2026 was enacted on June 30, 2026 and came into force on September 1, 2026. It standardizes reporting by digital financial asset trading operators, including crypto asset service providers. Source: Financial Services Authority of Indonesia, accessed September 30, 2026.

Four Layers of Data Covered by the Reporting System

The required information is not limited to a single industry-wide figure. OJK organizes the data into several layers so that supervisors can connect an operator’s financial position with customer activity and asset movements.

A. Financial Condition and Customer Funds

Operators must report their financial position, including assets, liabilities, capital, income, and expenses. These figures help supervisors assess whether the company’s operations are supported by adequate financial resources.

Customer funds require separate attention because they do not automatically constitute company revenue. Internal records must distinguish company assets from customer money, digital assets held on behalf of customers, and obligations that must eventually be settled.

This distinction becomes especially important when withdrawal activity increases. A platform may report a high trading volume while still facing pressure if its liquid assets do not match its obligations to customers. Financial reports and fund reconciliation allow OJK to examine that risk without relying solely on transaction volume.

B. Spot, OTC, and Derivatives Transactions

Trading reports cover daily and monthly activity. The information can be used to examine transaction value, the assets being traded, activity concentration, and changes in volume from one reporting period to another.

Over-the-counter transactions are reported separately because their mechanics differ from regular order book trading. An OTC transaction can be arranged directly between parties, with a size and price that may not be fully reflected in visible order book liquidity.

Derivatives also carry a different risk profile from spot transactions. The notional value of a contract can be significantly larger than the margin posted by the trader. Derivatives data must therefore be read alongside leverage, collateral, open positions, and liquidation mechanics.

A large derivatives volume does not by itself establish that an operator has taken an equivalent amount of directional exposure. It may represent customer positions, hedged transactions, or offsetting long and short activity. The supervisory value comes from combining volume with the structure of those positions.

C. Asset Transfers and Wallet Management

PADK 3/2026 also covers movements of digital financial assets. This includes incoming transfers, outgoing transfers, and the management of wallets used to hold customer assets.

Transfer data can create an audit trail between an operator’s internal ledger and blockchain transactions. The operator must still be able to explain which assets originated from customer deposits, which assets were transferred out, and which wallets are used for operational or storage purposes.

On-chain data alone is insufficient. A blockchain address does not always reveal the identity of its owner. The operator must connect the address to account data, the transfer time, asset type, network, amount, transaction hash, and relevant internal records.

Wallet management reports can also support reviews of hot-wallet and cold-wallet practices. Hot wallets provide faster operational access but are more exposed to online security threats. Cold storage reduces continuous online exposure but may introduce slower access and more complex authorization procedures.

The regulation does not establish that one custody structure is always superior. It gives OJK more consistent information for assessing whether an operator’s custody and wallet controls match its transaction volume and customer obligations.

D. Customer Concentration and Asset Evaluation

The PADK appendices include reporting formats for customers with the highest transaction values. These forms may contain the type and number of identification document, customer name, domestic or foreign status, individual or business classification, and transaction value.

Inclusion on a largest-customer report does not automatically indicate misconduct. High transaction value may come from active traders, companies, liquidity providers, or customers with legitimate large-value needs. The information serves as a starting point when OJK needs to understand concentrated activity or investigate unusual fund movements.

Operators must also evaluate their list of available digital financial assets at least once every three months, or whenever circumstances require an additional review. The evaluation report must be submitted to OJK no later than five business days after the review is completed.

This requirement matters because an asset that met listing criteria at one point may later face declining liquidity, protocol failure, issuer problems, cybersecurity incidents, regulatory restrictions, or market manipulation concerns. Periodic evaluation creates a formal process for reassessing whether continued availability remains appropriate.

The reporting forms for customers with the largest activity cover transactions, fund additions, withdrawals, and digital financial asset transfers. Inclusion in these forms does not by itself indicate a violation. Source: Appendix to OJK PADK Number 3 of 2026, pages 97 to 100.

When Must Operators Submit Their Reports?

Different reporting categories have different deadlines.

• Monthly reports must be submitted no later than 10 business days after the end of the reporting period.

• Quarterly reports must be submitted no later than 15 business days after the end of the reporting period.

• Annual reports must be submitted no later than April 30 of the following year.

• Asset evaluation reports must be submitted no later than five business days after an evaluation is completed.

• Incidental reports follow the event, condition, or supervisory request specified by OJK.

The different deadlines reflect the speed and purpose of the information. Customer funds and transaction records change rapidly, so they require more frequent reporting. Annual financial statements require a longer closing and review process.

Timeliness alone does not make a report reliable. Information from trading systems, customer fund accounts, wallets, and accounting records must also reconcile. If separate systems produce conflicting balances, an operator may technically submit a report on time while still failing to provide a coherent account of its obligations.

Consistent reporting therefore requires operational work before a file reaches the regulator. Operators need common asset identifiers, synchronized timestamps, network classifications, accurate customer records, and procedures for investigating unmatched transactions.

How Can One Customer Transaction Enter the Reporting System?

Consider a customer who deposits rupiah, purchases IDR20 million worth of a crypto asset, and later transfers part of the asset to a personal wallet.

That activity can create several linked records:

1. The incoming money is recorded in the customer’s cash or account balance.

2. The purchase is recorded as a digital financial asset transaction.

3. The customer’s asset balance changes after the order is completed.

4. The withdrawal is recorded as an outgoing transfer.

5. The destination address, network, asset amount, time, transaction hash, and fee are stored in operational records.

6. The operator’s wallet balance is reconciled against the blockchain transaction.

7. The transaction may be included in periodic aggregate reporting or a more detailed supervisory category, depending on the applicable format.

PADK 3/2026 does not mean that every IDR20 million transaction is published or submitted as a separate public report. Operators process transaction records according to the reporting period and format. Individual information may appear in a specific section when it meets the relevant category, threshold, concentration level, or supervisory requirement.

The example also explains why account names, identification records, and transfer histories must remain consistent. A mismatch can complicate balance reconciliation, source-of-funds reviews, complaint handling, or recovery efforts after an incorrect transfer.

What Does the Regulation Mean for Indonesian Crypto Users?

The most visible changes are likely to involve administration and verification. Operators need sufficiently accurate customer information to meet their reporting obligations and explain recorded activity.

Users may receive requests to update their records when an identification document has expired, the name on a bank account does not match the registered account, a profile is incomplete, or transaction patterns require an additional review.

Such a request does not automatically mean that the account is suspected of wrongdoing. Reviews may be triggered by risk-management procedures, reporting quality controls, anti-money-laundering requirements, or inconsistencies between transaction data and the user profile.

Transaction records also become more valuable when a customer needs to resolve a balance or transfer dispute. Order history, deposit confirmations, withdrawal records, transaction hashes, network information, and destination addresses can help identify where a problem occurred.

Users should therefore keep independent records of material transactions, particularly transfers to self-custody wallets. Screenshots alone may not be sufficient. The transaction hash, blockchain network, token contract when relevant, amount, time, destination address, and platform confirmation provide a stronger record.

More extensive reporting does not eliminate operational risk. Complete data cannot automatically prevent cyberattacks, transfers through the wrong network, account access loss, smart-contract failures, or liquidity problems. The effectiveness of PADK 3/2026 will depend on system quality, supervisory analysis, governance, enforcement, and corrective action.

What Cannot Be Concluded from PADK 3/2026?

The reporting regulation can easily be interpreted too broadly. Four limitations are especially important.

A. It Does Not Require Every User to Submit a Monthly Report Directly to OJK

The primary reporting obligation rests with the operator. Customers provide information during account registration, verification, and transaction activity, but they do not independently file the operator’s monthly operational report.

Separate legal obligations may still apply under tax, anti-money-laundering, criminal, or other regulations. Those obligations should not be inferred solely from PADK 3/2026.

B. It Is Not a New Crypto Tax Regulation

PADK 3/2026 governs supervisory reporting for digital financial asset trading. It does not by itself introduce a new tax rate, redefine taxable income, or replace existing tax rules.

The fact that a transaction is included in an operator’s regulatory report does not automatically determine its tax treatment. Tax consequences depend on the applicable tax legislation and the nature of the transaction.

C. It Does Not Mean All Customer Data Will Be Published

A report submitted to a regulator is different from a public disclosure. Detailed reporting forms do not imply that every user’s identity, balance, and transaction history will be openly displayed.

The regulation should still be read together with applicable requirements on data protection, confidentiality, record retention, lawful access, and information security.

D. It Does Not Mean Every Large Transaction Is Suspicious

Transaction size is only one indicator. A proper risk assessment also requires context, including the customer profile, source of funds, purpose of the transfer, transaction frequency, asset type, wallet relationship, and behavior over time.

A large but well-documented transaction may present a different risk from a series of smaller transactions structured to avoid internal controls. Supervisory analysis must therefore examine patterns rather than rely on one number.

What Should Be Monitored After Implementation?

PADK 3/2026 can only be evaluated after the reporting system has operated for several cycles. The following developments will show whether the regulation improves supervision in practice:

• Additional technical guidance on reporting channels and data formats.

• The quality of reconciliation between customer funds and stored assets.

• Changes to the list of permitted or available digital financial assets.

• Treatment of OTC and derivatives activity.

• Corrective measures or sanctions for late, incomplete, or inconsistent reports.

• Publication of industry statistics derived from standardized data.

• Changes in customer verification and transaction review procedures.

• Evidence that supervisory findings lead to stronger custody, liquidity, or governance controls.

The first reporting cycle may not provide a perfect industry picture. Operators may need time to align classifications, repair data gaps, and update their systems. Trends should be compared cautiously until reporting definitions and data quality become stable.

Conclusion

PADK 3/2026 increases the depth of information available to OJK when supervising digital financial asset trading. Oversight now covers more than total transaction value. It includes the operator’s financial condition, customer funds, spot and derivatives activity, OTC transactions, asset transfers, wallet management, customer concentration, and periodic asset evaluation.

Users do not receive a new obligation to submit monthly operational reports directly to OJK. The practical effects are more likely to appear through stricter identity verification, better transaction records, additional account reviews, and more disciplined asset reconciliation.

The regulation’s success should not be measured by the amount of data collected. The real test is whether standardized reporting allows OJK and operators to detect weaknesses earlier, protect customer assets, and take corrective action before an operational or liquidity problem becomes more severe.

Disclaimer

This article is intended for informational and educational purposes only. It does not constitute investment, legal, tax, or regulatory advice. The interpretation and implementation of PADK 3/2026 may evolve through technical guidance, regulatory correspondence, enforcement practice, or subsequent rules. Users and businesses should consult the official OJK documents and obtain professional advice when assessing specific obligations.