Once known for speed and disruption, Indonesia’s crypto industry is now facing its biggest reckoning: compliance or irrelevance.

With OJK taking the regulatory reins and the Travel Rule now in force, crypto firms in Indonesia must evolve fast or risk falling behind in global markets, regulatory approval, and user trust. For these firms, it’s a call to build trust, embrace transparency, and lead with compliance as the new currency of credibility.

These developments were the focus of a recent webinar, “Strengthening Your Crypto Compliance Program: Addressing AML and OJK Requirements,” part of the Indonesia Crypto Literacy Program.

The session, hosted by Arys Agusman, Business Development Manager for Sumsub APAC, brought together Sumsub, Sygna, RedotPay and Asosiasi Blockchain Indonesia to outline what Indonesian crypto firms must do to stay ahead in regulatory compliance.

News Regulatory Body, New Regulations to Adhere to?

What was once a fast-moving, lightly regulated ecosystem is now being reshaped under OJK’s supervision to resemble the formal financial sector.

Yudhono Rawis, Vice Chairman for Crypto Asset, Indonesia Blockchain and Crypto Asset Association, shared,

“For the longest time, it seems like the words crypto and compliance don’t or cannot seem to coexist. But I think globally, including in Indonesia, the industry that we all really like and are part of is increasingly becoming regulated rather than unregulated, which is actually key.”

OJK’s framework isn’t just a cosmetic change. Crypto businesses are now expected to meet rigorous licensing standards, from protecting personal data and ensuring market integrity to maintaining sufficient system security and reliability, all while adhering to AML, CFT and other regulatory requirements.

Anastasia Sakharova, Head of the Fintech Compliance Team at Sumsub, described the transition as nothing short of transformative.

“OJK mandates that regulated entities implement strong principles of governance, robust risk management processes, cybersecurity resilience, and maintain market integrity. It’s important to note that governance of personal data protection and consumer protection rules must be followed within 6 months from the OJK regulation, meaning by July 2025.”

The timeline is urgent, and all existing providers must demonstrate full compliance.

The Travel Rule, a Critical Point for Crypto Compliance

One of the most defining aspects is the Travel Rule, a requirement from the Financial Action Task Force (FATF) that crypto firms securely collect and transmit sender and recipient information before processing transactions.

It requires integration with international compliance networks and the ability to verify counterparty information in real time.

Despite its critical role, Emeka Mgbenu, Senior Product Manager of Sumsub, notes that many crypto firms are mostly still unprepared. Fragmentation across jurisdictions and incompatible data protocols are major barriers, leading to insecure or incomplete transaction regulation flows. Emeka shared insights from the Sumsub State of the Crypto Industry 2025 report,

“Only 29% of companies of VASPs through the world are fully compliant with Travel Rule. Businesses want faster verification processes and to improve user experience, a major bottleneck in onboarding users.”

The gap is largely due to fragmentation across jurisdictions. Many providers use different protocols that don’t talk to each other, making it difficult to securely transfer and verify transaction data across platforms.

He explained that compliance isn’t just about onboarding. 95% of fraud happens after the onboarding stage, reinforcing that the true risk lies in the ongoing flow of transactions, not just the first touchpoint.

Source: Sumsub

Indonesia’s vulnerability is especially concerning: the country ranks among the top five in APAC with the highest identity fraud rates, according to Sumsub’s APAC Identity Fraud 2024 report.

How to Build a Robust Compliance Program?

Maggie Qiu, Head of Compliance at RedotPay, outlined the mindset and building blocks required to stay ahead of regulatory expectations and operational risks.

She opened with a simple but powerful reminder: stay close to your regulators. As OJK assumes full supervisory control, she urged firms to engage directly, understand the regulator’s priorities, and their initiatives.

“We’re facing common challenge not only to understand regulation environment, but also to really understand how to interpret the compliance requirement accurately, and then how to implement right. The devil is always in the details; the key element in my survival guide is always stick with the basics.”

She added on, saying that the crypto industry presents a unique opportunity to adopt AI and more technological solutions to reduce the noise and zoom in more accurately within a short period of time.

Crypto firms would need to invest in the right infrastructure to meet crypto compliance Indonesia requirements.

Following her remarks, Emeka outlined how Sumsub helps crypto firms tackle compliance challenges head-on. Built for the industry, Sumsub’s platform offers end-to-end coverage: from seamless user onboarding and fraud prevention to AML screening, Travel Rule compliance, and beyond.

Sumsub Simplifies Travel Rule and Transaction Monitoring

When it comes to the Travel Rule, Sumsub’s solution architecture covers VASP due diligence, unhosted wallet confirmation, infinitely customisable compliance logic, VASP discovery, and integrated AML checks. Aegean Yao, Product Manager of Sygna, added on about the solution,

“In a high risk transaction, the beneficiary VASP is able to request enhanced Customer Due Diligence (CDD) information if they find a significant risk on the originator. And after receiving the CDD information, the beneficiary bag has second chance to follow their own AML or the CFT policy and decide whether to accept the request eventually.”

What happens after Travel Rule data is exchanged is equally critical. Transaction monitoring under the Travel Rule plays a vital role in long-term compliance and risk detection.

As highlighted, effective monitoring involves analysing a user’s full risk profile, from onboarding behaviour to transaction activity, logins, transfers, and counterparty interactions. This continuous risk assessment helps flag suspicious patterns before they become compliance incidents.

After all, in crypto, your greatest asset isn’t just your tech. It’s your credibility.

Navigating Crypto Compliance in a Brave New World

As Indonesia embraces its new regulatory chapter, the shift from commodities to financial assets represents more than a classification change. It signals a deeper alignment with traditional financial standards.

And with that comes the reality check: crypto firms must now navigate the almost-same compliance terrain as banks.

To succeed, crypto firms must balance regulatory depth with operational agility, leveraging technology, staying closely engaged with OJK, and building a culture of compliance from the ground up.

This is no longer a wait-and-see moment. For crypto compliance Indonesia players, it’s time to act, adapt, and evolve fast.

Watch the webinar replay here to dive deeper into the discussion.

Featured image: Edited by Fintech News Indonesia, based on image by user23135379 via Freepik