Indonesia’s Financial Services Authority, OJK, has reaffirmed that crypto businesses must protect customer assets and take responsibility when assets held in their custody go missing. The reminder puts customer protection back in focus as the industry responds to the Binance cybersecurity incident.
Speaking on November 5, OJK official Adi Budiarso pointed to existing custody obligations rather than announcing a new compensation programme. For users, the distinction matters: responsibility for lost assets does not mean every claim produces an immediate, automatic payout.
Key Takeaways
- OJK says crypto providers and custodians have responsibilities for customer assets they hold.
- Loss settlements depend on the cause, examination findings and applicable rules.
- Customers should check the legal entity behind their platform and its Indonesian licensing status.
What OJK Said About Lost Assets
According to ANTARA’s report, Budiarso cited Article 91 of POJK 27/2024, amended by POJK 23/2025. The obligation concerns businesses holding customers’ digital assets; “traders” in this context means providers, rather than individual retail investors.
Providers may directly hold up to 30% of customer assets, with the remainder placed with a storage manager or custodian. At least 70% of the portion directly held must be in cold storage, while no more than 30% may be online.
Those percentages apply to different layers of custody. They should not be read as saying that 70% of all customer assets must sit in a provider’s own cold wallets. UPay’s guide to cold and hot storage explains the underlying distinction between offline and internet-connected wallets.
Why the Binance Incident Matters
CNBC Indonesia reported that OJK viewed the Binance incident as a reminder to strengthen technology governance, access controls, staff competence and internal oversight. The regulator called for adequate risk management and cyber resilience across Indonesia’s licensed digital-asset businesses, including exchanges, clearing institutions and custodians.
OJK also urged the public to remain calm and use authorised providers. Its response focuses on strengthening the domestic industry’s safeguards; it should not be interpreted as a finding that every Indonesian platform suffered the same incident.
The wider lesson is operational. A platform’s size alone cannot tell customers how permissions are controlled, how assets are stored or how quickly withdrawals can resume after an incident. Our Binance withdrawal update covers the separate service-access story.
What Customers Should Check
Start with the company providing the service. OJK publishes licensing information on its official digital-asset licensing page. Match the legal entity and service to the regulator’s information instead of relying on a familiar brand name or a screenshot shared in a chat group.
Next, understand who controls the assets. A platform balance and a wallet you control create different dependencies. UPay’s explanation of crypto exchanges and wallets helps clarify that difference before you choose where to keep funds.
If an incident affects your account, preserve transaction references, account statements and support correspondence. These records can help you describe the problem accurately when contacting the provider. Follow verified announcements for withdrawal availability and complaint procedures rather than treating social-media promises as official instructions. For people using crypto to fund a payment or transfer, access matters alongside the displayed balance. A planned transaction can be delayed even when an account still shows funds. Check the relevant token and network before depending on a withdrawal, and separate a service interruption from a confirmed loss of assets. These are different problems and may require different explanations from the provider.
Finally, distinguish missing assets from a fall in market value. OJK’s statement addresses custody losses. It should not be presented as a promise to reverse investment losses or guarantee token prices. Any proposed settlement still needs to be assessed against the circumstances of the case.
Conclusion
OJK’s reminder makes custody accountability central to Indonesia’s response to crypto security risks. For customers, the practical priorities are clear: verify the provider, understand where assets are held and keep reliable records. The responsibility exists, but the outcome of a particular loss claim depends on examination and the applicable provisions.
