Bappebti is Indonesia’s Commodity Futures Trading Regulatory Agency, which has been the main supervisor for crypto asset trading. It oversees commodity-style crypto activity, licensing, and market rules until authority transfers to OJK under the new financial sector law. Its role is central to current compliance and market access requirements.
What Bappebti Means for Crypto Market Oversight
Bappebti is not just a generic regulator, it is the agency that has set the current rulebook for Indonesia’s commodity-style crypto trading market. For practitioners, that means market access, licensing status, product structure, and compliance expectations have all been shaped by a futures-market supervisory model rather than by a pure securities regulator model.
Why Its Commodity-Futures Mandate Matters
The practical importance of Bappebti comes from the way it frames crypto assets as regulated trading instruments under commodity-style supervision. That framing affects which firms can operate, what permissions are needed, how products are marketed, and which compliance obligations sit between the business and the customer. It also explains why rule changes can alter commercial viability quickly when authority shifts between regulators.
This kind of supervisory model is especially important in fast-moving digital asset markets, where legal classification determines whether an activity is permitted, restricted, or deferred pending further licensing. The same product can become compliant, non-compliant, or newly supervised depending on how the market is categorised and which authority is in force.
Licensing, Market Access, and Transition to OJK
Bappebti’s role is central to licensing and market access because firms must align with the agency’s current supervisory requirements before they can legally participate in the market. That includes understanding which activities are authorised, what disclosures or operating conditions apply, and how existing approvals may be affected as the regulatory handover to OJK progresses under the new financial sector law.
For firms, this transition is not a simple branding change. It is a governance and operational shift that can affect onboarding, product approvals, exchange relationships, customer servicing, and the timing of future compliance work. The safest reading is to treat Bappebti as the current authority for the applicable crypto trading regime while monitoring the transfer path to OJK for the next supervisory phase.
What Compliance Teams Should Watch
Compliance teams should focus on three things: the current authorised activity set, the status of local licensing or registration, and whether internal policies still reflect the active supervisory authority. When a market is governed by a transition from one regulator to another, outdated policy language and stale control ownership are common sources of error.
That matters because crypto compliance is not only about following rules, it is also about proving that the business is operating under the right rule source at the right time. If the supervisory authority changes, the control environment must change with it, including legal review, customer disclosures, product governance, and market-entry assumptions.
Risk and Threat Considerations
Regulatory transition creates exposure when firms treat the old regime as if it still fully applies, or when they assume the new regime has already replaced it. In crypto markets, that can lead to licensing gaps, product restrictions being missed, and misstatements about market access that create legal and operational risk.
Failure mechanism: Regulatory ambiguity, stale policy mapping, or delayed control updates can leave a firm operating under the wrong supervisory assumptions during the handover period.
Impact: The result can be non-compliant trading activity, delayed approvals, customer harm, enforcement exposure, and avoidable disruption to business operations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while ISO/IEC 27001:2022 and DORA define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Bappebti defines the current regulatory context for crypto market activity in Indonesia. |
| GV.PO-01 — Policy | The term centers on policy change and supervisory handover for crypto trading. | |
| GV.RM-01 — Risk Management Strategy | Authority transfer creates compliance and operational risk that needs explicit management. | |
| Recommendation — Map regulatory authority and market-access obligations into your governance context. Update policies to reflect the active regulator and transition path. Track regulatory transition risk and assign ownership for control updates. | ||
| ISO/IEC 27001:2022 | A.5.31 — Legal, statutory, regulatory and contractual requirements | Bappebti governs legal and regulatory requirements for the market today. |
| A.5.36 — Compliance with policies, rules and standards for information security | Licensed operation depends on keeping internal rules aligned to the active supervisory regime. | |
| Recommendation — Identify and maintain the regulatory obligations tied to crypto market activity. Align internal rules and evidence to the current supervisory authority. | ||
| DORA | Article 5 — Governance and organisation | The topic involves governance ownership during a supervisory transition. |
| Recommendation — Assign clear accountability for regulatory-change monitoring and response. | ||
Practitioner Guidance
Governance implication: Assign one accountable owner for monitoring the active regulator, the transition timetable, and the exact policies that depend on supervisory authority. In a handover environment, ownership matters as much as interpretation because compliance failures often begin with unclear responsibility.
What to watch for: Watch for duplicated rulebooks, outdated licensing references, and operational teams relying on assumptions from the previous regulatory phase. A clean transition requires the legal, compliance, product, and market-access views to stay aligned.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org