OJK is Indonesia’s Financial Services Authority, the regulator that will assume supervisory authority over crypto assets after the transition period. In this context, it represents a shift from commodity-style oversight toward a broader financial services framework, which may change how crypto businesses are licensed, governed, and classified.
What OJK Means in Crypto Regulation
OJK is best understood as a regulatory shift, not just a name change. For crypto businesses in Indonesia, the important issue is that oversight moves from a commodity-style lens toward a financial services framework, which can affect licensing, classification, conduct rules, and ongoing supervisory expectations.
Why the Transition Matters for Crypto Businesses
The practical significance of OJK is that businesses may be judged more like regulated financial intermediaries than like lightly supervised trading venues. That can change how firms document ownership, market products, handle customer disclosures, and evidence control over operational and financial risk.
When a regulator changes, the compliance burden often changes with it. Firms that were built around one rule set may need to revisit their operating model, because the regulator’s expectations around governance, reporting, and consumer protection are often more structured in a financial services regime.
Supervision, Licensing, and Classification
In regulatory terms, supervisory authority is not just about enforcement. It also shapes how an activity is categorized, which licence path applies, what activities are permitted, and which internal controls a business must be able to demonstrate to stay authorised.
That matters especially where a crypto business straddles exchange, custody, brokerage, payments, or other financial-service-like functions. A shift to OJK can therefore force a clearer separation between product description, legal classification, and actual operational permissions.
Governance and Control Expectations Under OJK
Financial-sector supervision usually brings stronger emphasis on accountability, board oversight, risk management, recordkeeping, and fit-for-purpose controls. For crypto firms, that means governance should be designed to withstand regulator scrutiny, not just to support day-to-day trading or platform operations.
Businesses should expect the supervisory conversation to move beyond technical security alone. Control evidence, policy ownership, customer treatment, incident handling, and the ability to explain decision-making may become as important as platform functionality.
OJK’s role also makes classification discipline more important. If a crypto activity is treated as a financial service, organisations may need to show that the service model, disclosures, and control environment match that regulatory interpretation.
Risk and Threat Considerations
A regulatory transition creates a window of exposure because firms can be misaligned with the new supervisory model even when their technology is unchanged. The main risk is not only enforcement, but also weak classification, incomplete licensing readiness, and gaps between operational reality and the controls expected under financial services oversight.
Failure mechanism: A business may continue operating under outdated assumptions, leaving governance, reporting, and customer-protection controls insufficient for the new oversight regime, while supervisors assess it against a different regulatory standard.
Impact: This can lead to licensing friction, remediation orders, restricted activity, reputational damage, or a forced redesign of products and internal controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | OJK changes the business context and supervisory model for crypto firms. |
| GV.RM-01 — Risk Management Strategy | The transition creates regulatory and operating-model risk that must be formally managed. | |
| Recommendation — Map the business under the new supervisory context and update governance ownership accordingly. Update the risk strategy to cover licensing, classification, and supervisory transition risks. | ||
| ISO/IEC 27001:2022 | A.5.31 — Legal, statutory, regulatory and contractual requirements | OJK introduces regulatory obligations that affect licensing and oversight. |
| A.5.36 — Compliance with policies, rules and standards for information security | Financial-sector supervision raises the need to evidence policy and control compliance. | |
| Recommendation — Identify and track the regulatory obligations that apply under the new supervisory regime. Demonstrate that internal policies and controls match the regulator’s requirements. | ||
| NIST SP 800-53 Rev 5 | PM-9 — Risk Management Strategy | The shift to OJK requires an enterprise risk approach to governance and oversight changes. |
| Recommendation — Extend the risk management strategy to cover supervisory transition and governance impacts. | ||
Practitioner Guidance
Why practitioners should care: The most important task is to treat OJK as a classification and operating-model issue, not just a legal footnote. The firms that cope best are the ones that align product scope, governance, and compliance ownership before supervisory expectations harden.
Practitioner takeaway: If a crypto business might fall under OJK supervision, its control design should be tested against a financial-services mindset, not only against its current market or technology assumptions.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org