Tokocrypto review.

Overview

Tokocrypto is an Indonesian spot crypto exchange operated by PT Aset Digital Berkat, a Jakarta company holding OJK permission S-14/D.07/2025 of 1 February 2025. Anyone researching it in 2026 meets an alarming headline first: Indonesia’s licensed crypto bourse CFX revoked its membership with effect from 18 June 2026. That revocation is real, and it is not what it sounds like. The signed decision CFX/SK/005/VI/2026, set in Jakarta on 17 June 2026 and effective the next day, gives exactly one operative ground, the firm’s own voluntary resignation letters of 7 May and 20 May 2026, and records no breach, no sanction and no penalty anywhere in its three pages. On the same two dates the second OJK licensed bourse, PT Fortuna Integritas Mandiri, admitted the firm under ICEX/SK-SPAB/VI/2026/005, established 17 June 2026 and effective 18 June 2026. Clearing moved from PT Kliring Komoditi Indonesia to PT Pranata Karya Solusi on that same 18 June, again on a voluntary resignation, and the receiving clearing house issued its own membership certificate CACI/SK-SPAK/VI/2026/005 dated 18 June 2026. Four instruments, four venues, two dates. Tokocrypto was never off a licensed bourse or a licensed clearing house for a single day.

One caveat on that evidence, and the reader should have it up front. The two exits are genuinely third party: CFX and KKI both published decisions removing a firm that had asked to leave, and neither venue has any reason to flatter it. The admission is not arm’s length in the same way. Tokocrypto is a shareholder of ICEx. ICEx’s own release records Rp1 trillion of strategic funding from its shareholders, a list that names Tokocrypto alongside FLOQ, Mobee, OSL Indonesia, Reku, Samuel Kripto, Triv, Upbit Indonesia and Nanovest. So the second bourse is part owned by the digital asset traders that trade on it, and the firm was admitted to a venue it holds a stake in. That does not weaken the licensing point, because ICEx holds its own OJK permission KEP-2/D.07/2026 and the permission is what matters, but the ICEx leg of the corroboration is related party and we will not present it as independent.

CFX also words a for cause revocation completely differently. When it removed PT Everest Kripto Indonesia on 26 February 2026 under CFX/DIR-SK/008/II/2026 it stated the ground plainly, that the firm held no OJK permission at all. Nor was this a Tokocrypto event: ICEx recorded five digital asset traders migrating to it by 22 June 2026, namely OSL, Upbit, Nanovest, Mobee and Tokocrypto, KKI published exit notices for Nanovest, Mobee, Tokocrypto and Floq, and the receiving clearing house publishes membership certificates for FLOQ, Mobee, Nanovest, OSL Indonesia, Upbit and Tokocrypto.

The real problems with this exchange sit elsewhere, and they are about custody and staleness rather than licensing. Nobody else holds the coins. The binding customer agreement defines a Hosted Digital Asset Wallet and states that the private keys sit in the firm’s own control across online and offline storage, with no third party custodian named for the Indonesian service and no segregation clause in either language version. The proof of reserves page is largely unadapted Binance boilerplate, with a dozen of its interface strings still saying Binance where they should say Tokocrypto, and it shows a logged out visitor no auditor name, no attestation date and no reserve figure. The advertised 0.1500% trading fee is 0.4044% all in, and only 40 of 437 listed assets carry a rupiah pair, so a customer holding rupiah pays the expensive band across nearly the whole book. And the firm’s own marketing still points at the regulator it left behind: the homepage badge row carries Kementerian Perdagangan and Kominfo marks with no OJK badge, and the site’s llms.txt still describes the firm as Bappebti registered and still lists CFX and Kliring Komoditi as current memberships, 55 days after its own announced migration.

Set against that, the firm discloses its permission number and registered address in its own contract, and both match OJK’s register in substance, its ISO 27001 certificate is real and current, it pre-announced the venue migration to customers six days before the bourse published anything, and a complete enumeration of its 3,360 article help centre turned up no security incident, no hack and no unscheduled withdrawal halt.

Overview Table

Facts List

• Licensed entity PT Aset Digital Berkat, OJK permission S-14/D.07/2025, verified on OJK’s own PAKD register dated 25 May 2026 and at row 23 of OJK press release SP 226/GKPB/OJK/XII/2025.
• S-14 is a transfer letter, not a fresh assessment. Every incumbent moved across from BAPPEBTI on 1 February 2025 carries an S- number (Indodax S-18, Pintu S-15, CFX itself S-7), while every later grant carries a KEP- decision (ICEx KEP-2/D.07/2026, Luno KEP-17/D.07/2026).
• Bourse membership moved CFX to ICEx and clearing moved KKI to PT Pranata Karya Solusi, all effective 18 June 2026, with a maintenance window of 17 June 23:00 WIB to 18 June 01:00 WIB.
• Custody is the exchange’s own hands. Private keys are held in the firm’s control in a hosted wallet, and the words segregasi, pemisahan dana and rekening terpisah return zero hits across both language versions of the agreement and the full help centre corpus.
• Proof of reserves is published as a page whose own copy says Binance, with no named auditor and no attestation date.
• All in trading cost is 0.4044% on crypto and USDT pairs at the Regular tier against a 0.1500% headline, the gap being 0.21% final income tax plus a 0.0444% exchange fee.
• ISO/IEC 27001:2022 certificate IS 740524, current to 18 February 2027, scoped to the crypto asset exchange service on web and mobile, verified in BSI’s own client directory.
• Fiat withdrawal fee Rp10,000; deposits by QRIS and e-wallet carry 2%; minimum order is IDR 20,000 notional.
• No OJK enforcement action found, and the firm is absent from OJK’s Satgas PASTI illegal operator list of 22 June 2026.
• tokocrypto.com was registered on 6 May 2017 and is paid to 6 May 2030, which is not the profile of a wind down.

Key Takeaways

• The June 2026 bourse revocation was not enforcement. CFX/SK/005/VI/2026 rests solely on the firm’s own resignation letters, ICEx admitted it the same day under ICEX/SK-SPAB/VI/2026/005, and clearing moved to PT Pranata Karya Solusi under certificate CACI/SK-SPAK/VI/2026/005. Four instruments, four venues, two dates, no gap.
• One leg of that evidence is related party. The two exits were published by venues the firm was leaving, but Tokocrypto is a shareholder of ICEx, the bourse that admitted it.
• The permission is real and it covers the entity you actually onboard with. S-14/D.07/2025 appears on OJK’s own register, in an OJK press release, and printed by number in the firm’s binding customer agreement, with the Jakarta Selatan address matching all three.
• You own a claim, not coins. The exchange holds the keys itself in a hosted wallet. No custodian is named, no segregation language exists, and the customer’s position is contractual against PT Aset Digital Berkat.
• Proof of reserves does not survive contact. The page is largely Binance’s boilerplate with Binance’s name left in a dozen of its strings, and a logged out visitor sees no auditor, no date and no reserve figure.
• The real fee is 2.7 times the advertised one. 0.1500% becomes 0.4044% all in, and with only 40 IDR pairs out of 437 assets a rupiah holder pays that band on most of the book, twice on a round trip.
• The marketing is out of date in the firm’s own favour and against it. The homepage badge row shows no OJK mark, and llms.txt still calls the firm Bappebti registered and lists memberships it resigned in June.
• Spot only. No leverage, no margin, no futures, so no liquidation mechanics to worry about and no way to lose more than you put in through leverage.
• Nothing in the record shows a withdrawal problem. A complete enumeration of 3,360 help centre articles found no hack, no insolvency and no unscheduled halt, and crypto withdrawals stayed live through the migration.

Licences & Custody

One company, one permission, one set of pages. PT Aset Digital Berkat holds OJK permission S-14/D.07/2025, dated 1 February 2025, under the heading Pedagang Aset Keuangan Digital. We read it in two independent OJK primary sources on 12 August 2026: the register titled Daftar Penyelenggara Perdagangan Aset Keuangan Digital Posisi 25 Mei 2026, and press release SP 226/GKPB/OJK/XII/2025 of 19 December 2025, whose row 23 carries the same number, the Prudential Centre address in Jakarta Selatan and the tokocrypto.com website. The firm prints the same number in the COMPANY INFORMATION block of its own customer agreement, so this is disclosed rather than merely discoverable.

The registered address matches in substance across four independent sources, OJK’s whitelist, OJK’s register, the BSI certificate and the firm’s own contract, all placing the company at the Prudential Centre on Jalan Casablanca Raya Kav. 88 in Menteng Dalam, Tebet, Jakarta Selatan 12870. The spelling varies between them, with OJK’s whitelist printing Casablanka where the contract prints Casablanca, so this is a substantive match rather than a character for character one.

Read the letter prefix, because it changes what the permission means. Supervision of this sector passed from BAPPEBTI to OJK under Government Regulation 49 of 2024, with the handover minutes and memorandum of understanding signed on 10 January 2025, and OJK issuing POJK 27 of 2024 to run it. Three weeks later every transferred incumbent received an S- letter dated 1 February 2025: Tokocrypto S-14, Indodax S-18, Pintu S-15, BTSE S-20, CFX itself S-7, the clearing house KKI S-6. Every authorisation granted afterwards carries a KEP- decision with its own later date, such as ICEx KEP-2/D.07/2026 of 5 January 2026 and Luno KEP-17/D.07/2026 of 25 May 2026. So S-14 recognises a licence the firm already held under BAPPEBTI, granted as 03/BAPPEBTI/PFAK/09/2024 on 5 September 2024 and still published on BAPPEBTI’s own live list of physical crypto traders. “Licensed by OJK since February 2025” is true and reads stronger than the document supports.

Licence Table

Bourse membership, clearing and a depository relationship are not licences to hold client money. They are market structure requirements. None of them is evidence that anyone other than the exchange holds a customer’s coins, and none of them creates a compensation route.

Which Entity Serves You, By Residence

This matrix is unusually simple, and the simplicity is the finding. One company serves every country that is served at all.

Custody, And What You Actually Own

The customer agreement defines a Hosted Digital Asset Wallet and states, in the firm’s own Indonesian, that it stores crypto asset private keys securely “dalam kendali kami”, in its own control, across a combination of online and offline storage. No third party custodian is named for the Indonesian service. There is no segregation clause: segregasi, pemisahan dana and rekening terpisah return zero hits across the full agreement in both languages and across the complete 3,360 article help centre. The closest published statement is in the staking terms, that assets subscribed through Tokocrypto “will be stored in wallets managed by Tokocrypto”. What a customer holds is a contractual claim against PT Aset Digital Berkat, not title to identifiable coins held by somebody else.

The agreement also carries an annex most customers will never read. Annex 1 is an Access Agreement under which the user agrees they may trade on Binance RIE and clear and settle at Binance RCH through transactions executed by Tokocrypto acting on the user’s behalf. The agreement defines those bodies itself, as Nest Exchange Limited and Nest Clearing and Custody Limited, and says the second provides “custody, clearing and settlement services”. A re-check of the ADGM FSRA register reached it and lists Nest Exchange Limited as an active Recognised Investment Exchange, recognised on 5 January 2026. The user accepts the ADGM Terms and Conditions as amended from time to time, and agrees to be bound by the dispute mechanism under the Exchange Rules “termasuk, untuk menghindari keraguan, ketentuan arbitrase pada aturan 244 Peraturan Bursa”, the arbitration provision at rule 244. The body of the same agreement puts disputes under Indonesian law and LAPS SJK, the Indonesian financial sector ADR body. Both sit in one document. A Wayback capture of 14 October 2025 contains none of it, with controls firing strongly on the same file, and the article’s own metadata dates the substantive edit to 2 March 2026, before the resignation letters. We state that sequence and assert no cause, because we have not seen a document in which the firm explains why it moved.

What We Checked, And What We Could Not

Searched with controls that fired, and not found, which is expected of an Indonesian spot exchange and is not scored as a fault: MAS, FCA, DFSA, BVI FSC’s VASP register, Labuan FSA, and the ESMA interim MiCA files CASPS, NCASP and OTHER. OJK’s pengumuman, siaran pers and info terkini were each searched for both “Aset Digital Berkat” and “Tokocrypto” and returned zero rows while controls returned dated results, so no OJK enforcement action exists in what we could reach, and the firm is absent from OJK’s Satgas PASTI illegal operator list of 22 June 2026, a 228 row PDF we parsed. Neither “Tokocrypto” nor “PT Aset Digital Berkat” appears anywhere across those 228 rows.

That list is worth reading for who is on it. It is headed “DAFTAR ENTITAS PAKD YANG TELAH DILAKUKAN PEMBLOKIRAN”, a list of digital asset trading entities that have been blocked, and entry number 1 is Binance, recorded against binance.com/id and its app store listings, followed by KuCoin, Coinbase, Bybit and OKX. That is a blocking of platforms operating without Indonesian authorisation. It is not a finding about Tokocrypto, whose own permission is verified above and which appears nowhere on the list. It belongs in this review only because of a relationship the firm itself documents: Tokocrypto runs on a Binance Cloud deployment, ships an Android package named com.binance.cloud.tokocrypto, and publishes a proof of reserves page still carrying Binance’s name in a dozen of its interface strings. The regulator that licenses Tokocrypto has blocked Binance’s own Indonesian facing site, and a reader weighing that dependency is entitled to know it. Keep one distinction clear: the ADGM Recognised Bodies named in the customer agreement are separate legal entities recognised in Abu Dhabi, and nothing on this Indonesian list concerns them.

The controls matter more than the nil results, so here they are by name. Searching OJK’s own announcement index for “Sompo” returned a row dated 11 August 2026, “Fortuna Integritas” returned one dated 8 January 2026, and “Pencabutan Izin” returned four licence revocations dated 17 June, 3 July, 8 July and 16 July 2026. The search demonstrably surfaces recent licence revocations. It returns nothing for this firm.

Not checked, which is a fact about us and not about anyone else. The Kominfo PSE detail page fails TLS certificate verification from here on both HTTP/2 and HTTP/1.1, and we did not bypass verification. The BAPPEBTI article behind the homepage badge returned navigation chrome with no body, and so did a live control article from the same index while BAPPEBTI’s site is mid redesign, so nothing may be concluded about that link. AUSTRAC, the AHU company register and PT Pranata Karya Solusi’s own member list were not checked at all. Whether the depository relationship moved is unresolved: OJK licenses PT Kustodian Koin Indonesia and PT Arganis Konsultindo Utama, and the firm’s migration notice names the bourse and the clearing house only.

Trading & Execution

Spot only. There is no margin, no futures, no perpetuals, no options and no leverage of any kind available on this venue. The firm says so itself, /margin returns 404, no margin product appears anywhere in the 3,360 article help centre, and all 40 rupiah markets are flagged spot only. One thing to know if you query the symbols endpoint yourself, because it looks alarming and is not: 694 of the 829 markets carry a MARGIN permission flag and marginTradingEnable set to 1. Those flags are the shape of the Binance Cloud platform underneath rather than a product a Tokocrypto customer can reach, and nothing in the interface or the help centre exposes them. So there is nothing to say about liquidation prices, maintenance margin, margin calls, forced closure or liquidation fees, because none of those mechanics exist here. A customer cannot lose more than they deposit through leverage. That is a real safety property and it is worth naming rather than leaving a reader to wonder why the section is quiet.

Execution is an order book with maker and taker pricing. Published order types include OCO and Stop Market alongside ordinary spot orders, with a Recurring Buy feature for scheduled purchases and an OTC desk for larger tickets. Charting is TradingView. There is a documented public REST and WebSocket API using HMAC SHA256 signing with CCXT SDK support, and the firm gave advance notice of a breaking change in December 2025 when an IDR migration affected 31 trading pairs, which is the correct way to treat API consumers.

The matching engine is not the firm’s own. The web front end carries Binance’s runtime object window.__NEZHA_BRIDGE__, the Android package identifier is com.binance.cloud.tokocrypto, and the firm’s own about site records a May 2020 Binance investment and a relaunch “Powered by Binance Cloud”. That is a technology relationship the firm publishes itself. What follows from it commercially is set out in the contract: a Third Party Liquidity Provider is defined as any third party from which Tokocrypto may source liquidity, pricing, execution or related services, and the definition says this includes but is not limited to the ADGM Recognised Bodies, meaning Binance’s Nest entities in Abu Dhabi.

Where orders actually match on a given day is not something we verified, and we do not claim it. What is established is what the contract permits and what it names. The one Indonesian venue fact we can pin down is the membership: from 18 June 2026 the firm clears through PT Pranata Karya Solusi and its bourse membership sits with ICEx. The customer agreement names neither, nor CFX, nor KKI, nor OJK in words. The only exchange and clearing house named anywhere in it are Binance’s ADGM entities.

Whether the venue trades against its users is not disclosed either way in the documents we hold. There is no statement of a dealing desk, no principal trading disclosure and no conflict of interest policy on the point. Record that as unanswered rather than as an answer.

What A Trade Costs You

Pricing since 18 June 2026, published by the firm in both languages and cross checked against the live fee schedule page:

The arithmetic reconciles across two independently fetched sources to the basis point. The live fee page shows a Regular tier of 0.1500% maker and taker beside 0.4044% “termasuk Pajak dan Biaya Bursa”, and the wedge of 0.2544 points is constant across all ten tiers, holding at VIP 9 where 0.3348 minus 0.0804 is again 0.2544. That 0.2544 is exactly the 0.21% tax plus the 0.0444% exchange fee. Most of the gap is government tax rather than the firm’s take, and the firm publishes the all in number on the same page as the headline, which many venues do not. It is still 0.4044%.

Accounts & Fee Tiers

An exchange has one account, not a menu of them. Every Tokocrypto customer opens the same account and moves along a volume fee ladder, with a separate verification ladder deciding what they may move. There is no islamic account, no professional account and no demo account in the evidence.

Verification Levels And What Each Unlocks

Published in the Indonesian trading rules, article 4475791634445, updated 18 June 2026:

Without completing verification a user cannot buy, sell, deposit or withdraw crypto assets at all. One KTP means one account. Withdrawals go only to a bank account in the account holder’s own name, and two factor authentication is available by SMS or Google Authenticator.

The Fee Ladder

Ten tiers, Regular through VIP 9, gated on 30 day rupiah volume or TKO token balance, whichever qualifies. Tiers are re-evaluated daily at 00:00 UTC and applied at 01:00 UTC. Paying fees in TKO takes 25% off maker and taker. Figures below are the firm’s own headline rates before tax and the exchange fee, which add a flat 0.2544 points at every tier.

Note what the TKO route does. A customer can buy their way down the fee ladder by holding the exchange’s own token, which converts a trading discount into exposure to a token whose value is tied to the venue granting the discount. That is a common exchange design and it is a risk the ladder does not mention.

Above the ladder sits Prestige, a separate VIP and institutional programme on its own subdomain offering reduced fees and priority support. Its qualification thresholds and its actual rates are not published on any page we could reach, so we state that it exists and nothing more. The Buy and Sell quick trade feature is not a cheaper route: the firm’s own fee article says it “mengikuti biaya trading spot”, follows spot trading fees, at 0.15% maker and taker on the Regular tier or 0.1125% paying in TKO, and that it executes on IDR pairs through the order book. So it carries the rupiah wedge of 0.0222 points on a buy and 0.2322 on a sell rather than the 0.2544 that applies to crypto pairs.

No inactivity or dormancy fee was found, over the fee page and the complete 3,360 article corpus. We report that as not published rather than as not charged. A separate service fee for abnormal transactions does exist as its own help centre article, and its trigger conditions are described there rather than as a schedule.

Proof of Reserves

This is the section a crypto reader should read first, and it is the weakest thing in the review. Tokocrypto publishes a proof of reserves page at /id/proof-of-reserves and /en/proof-of-reserves. Its copy is largely unadapted Binance boilerplate. Counting the proof of reserves interface strings in the page source, 12 in the Indonesian bundle and 13 in the English one still say Binance, while only 5 and 6 respectively were edited to say Tokocrypto. So somebody did adapt part of it and stopped. The heading string reads “Bukti Cadangan Aset (PoR) | Merkle Tree | Binance”. The explainer reads that “kami menunjukkan bukti dan pembuktian bahwa Binance memiliki dana yang mencakup semua aset pengguna kami 1:1”, that Binance has funds covering all of our users’ assets one to one. The how to string instructs the reader to “Masuk ke Situs Binance”, log in to the Binance site, then click Wallet and Audit. Another string assures the reader that an emergency fund, the SAFU fund, is in place. A customer following those instructions on the page of the exchange holding their coins is being sent to a different company.

The auditor and the date are a separate matter, and the precise position is narrower than “absent”. The page carries labelled slots for them, named proof-auditor, proof-auditDate, proof-auditId and proof-auditType in its own string bundle, and none of them carries a value in the public page source. The endpoints that would fill them answer 403 unauthorized to a logged out request, and the page chunk redirects to login on that response, so this data is served to signed in users. What a prospective customer can see before opening an account is therefore a proof of reserves page with no auditor name, no attestation date and no reserve figures. Whether a logged in user sees a named auditor and a dated attestation is something we did not test, and we do not assert it either way. The help centre tutorial explaining how to check the page was last updated on 22 August 2024.

We make no claim about the reserve numbers themselves, because we could not see them. The reserve ratio table and the Merkle root load by XHR behind the same gate and did not render for our fetcher, which receives 729 characters of chrome. That is partly a limit of our tooling and partly a design decision by the firm, and we will not convert either into a claim that the reserves do not exist.

Set that against what the firm does hold. The ISO/IEC 27001:2022 certificate IS 740524 is real, verified in BSI’s own client directory on 12 August 2026, originally registered on 19 February 2021, effective from 29 May 2024, running to 18 February 2027, and scoped to “the information security management system in the provision of digital crypto asset exchange service based on web and mobile apps”. That scope covers the exchange service itself rather than being narrowed to customer data administration, which is better than some peers publish. The certificate number matches the one printed in the customer agreement to the character. A second claim does not hold up as well. The site’s meta description in both languages says the firm is “ISO 27001 & 27017 certified”, and the homepage displays two BSI badges side by side, the first served from an asset file named bsi-27010-with-border.svg under a CSS class named bsi27017-img. Both badges link to the same BSI profile, and that profile carries only ISO 27001. ISO 27017 appears nowhere on it and nowhere in the customer agreement in either language, and the firm’s own three references to the standard disagree with one another on what it even is. We did not search other certification bodies, so record that as not found where the firm pointed us, rather than as a false claim.

An information security certificate is not a proof of solvency. It says the firm runs a certified security management system. It says nothing about whether the coins are there.

Listed Assets

Counted from the firm’s own public symbols endpoint on 12 August 2026: 829 live markets across 437 distinct base assets, with BTC_IDR and ETH_IDR present as positive controls, so this is the real book rather than a stale page. Spot only. No futures, no perpetuals, no leveraged tokens and no derivatives appear anywhere in the symbol set or in the firm’s own description of itself.

What Each Quote Currency Actually Covers

The asset count is true and the rupiah framing is not. The homepage meta description in Indonesian markets “400+ aset kripto dengan IDR”, and llms.txt tells any AI assistant that reads it that the venue offers “spot trading for 400+ digital assets with IDR pairs”. There really are 437 assets. Forty of them have a rupiah pair. The complete IDR list is ADA, ALCH, ARB, ASTER, AVAX, BNB, BTC, CARV, DOGE, DOGS, DRX, ETH, FLOKI, GOAT, GRAM, HBAR, JELLYJELLY, MANTA, MOODENG, NBT, ONDO, POL, RENDER, SCR, SKYA, SOL, SOON, SPX, SUI, TAO, TKO, U, USDC, USDT, VELO, VIRTUAL, WIF, WLD, XRP and ZIL. To reach any of the other assets a customer holding rupiah must buy USDT or USDC first, and that second leg sits in the 0.4044% band rather than the 0.2222% one, paid again on the way out.

One thing cuts the other way and a reader should have it. The minimum order size is not IDR 20,000 across the book. That figure applies to the 40 rupiah markets; on the stablecoin pairs the floor is mostly around 5 USDT or USDC, and on the crypto quoted pairs it runs to 0.0001 BTC, 0.001 ETH, 0.01 BNB and 0.05 SOL. So the long tail is cheaper to enter in absolute terms than the rupiah book, even though each trade there is taxed at the higher rate.

Who Decides What Gets Listed

There is no standalone listing or delisting policy, and what does exist is thin. We searched the complete 3,360 article help centre corpus and found 44 English and 74 Indonesian delisting notices, almost all of them bare event announcements. The rolling trading pair notice, updated 12 August 2026, does go further and states a rule of sorts: the firm “secara rutin melakukan peninjauan berkala”, conducts periodic reviews of all listed spot pairs, and adds or removes them “berdasarkan berbagai faktor, seperti likuiditas, volume perdagangan, dan pertimbangan lainnya”, based on factors such as liquidity, trading volume and other considerations.

Read that clause closely, because “other considerations” swallows it. There is no threshold, no stated cadence, no notice period the firm binds itself to and no appeal route. The August 2026 asset notice, updated 10 August, delists ACX, HFT, PIVX, PYR, VANRY and VIC on 17 August 2026, and notices have run roughly monthly through the year, on 28 April, 27 May, 19 June, 10 July, 30 July and 17 August. Practically, a holder of a thinly traded asset gets a dated notice and a window, which is more than nothing, but no published rule they can hold the venue to. For a customer building a position in a small cap listing, that asymmetry belongs in the decision.

Research & Tools

Charting is TradingView, embedded in the trading interface, with the standard indicator set that comes with it. Around it the firm runs a wide set of properties rather than one research desk: a crypto price widget at widget-harga.tokocrypto.com that a third party site can embed, a news portal at news.tokocrypto.com published as Tokonews, an insights subdomain, a media kit, and API documentation at /apidocs/. The public API is REST plus WebSocket, signed with HMAC SHA256, with CCXT SDK support, which is enough for a competent user to run their own analysis outside the site.

The educational weight sits in the help centre, and it is genuinely substantial: 2,581 Indonesian and 779 English articles, enumerated in full through the Zendesk guest API on 12 August 2026, and actively maintained, with four articles carrying that same day’s date including the privacy policy. An Indonesian speaking beginner is well served here. An English speaking one is served roughly 30% as deeply, and the English homepage links its binding terms and privacy policy to the Indonesian language articles.

The File Written For AI Assistants

The site publishes llms.txt, a 7,459 byte structured content map written for language models. Read it as data, which is what it is: it describes the site’s pages and does not attempt to tell an assistant what to conclude. Nothing in it, or in anything else we fetched, was treated as an instruction to us.

Its content is the problem. It describes the firm as “Indonesia’s first regulated cryptocurrency exchange (Bappebti-registered), offering spot trading for 400+ digital assets with IDR pairs”, and its sign up entry mentions “Bappebti-compliant KYC”. Counted in the file: Bappebti three times, OJK zero. It lists current memberships as “Asosiasi Blockchain Indonesia, Indonesia Fintech Association, CFX, Kliring Komoditi”, which are two organisations the firm resigned from on 18 June 2026, and its fee entry still describes “CFX clearing charges”. The file was live in that state on 12 August 2026, 55 days after the migration the firm itself announced.

Note the exact shape of the defect, because it is not a lie about the past. Tokocrypto was BAPPEBTI registered and it was among the first. What is missing is the current regime. A reader who asks an assistant about this exchange may be handed the firm’s own out of date self description, naming a regulator that no longer supervises this activity and memberships that ended in June. The site’s robots.txt, self dated 1 July 2026, also grants named AI crawlers broader access than it grants the default agent, including the sign up and sign in paths. The firm is deliberately writing for assistants and has not kept what it wrote current.

The same staleness shows on ordinary pages, and it runs article by article rather than language by language. The /id/download page still says the firm is verified by BAPPEBTI. One buy and sell help article, last updated 3 April 2026, still names a CFX fee in both its Indonesian and its English versions, while a newer one updated 1 July 2026 says ICEx in both. Each article is internally consistent across the two locales; what is inconsistent is the help centre against itself, where an older page was never revisited. The public fee page names neither venue, saying only Biaya Bursa. And about.tokocrypto.com, still linked from the live footer as Tentang Perusahaan, carries a timeline ending in August 2021 and a 2024 copyright line.

Earn, Staking & Lending

Three yield or reward products are published: Tokocrypto Staking, locked and quoted as an APR, TKO Lock, a 30 day lock paying daily TKO rewards, and a Reward Hub. No lending product is published. The staking coin and APR table loads by XHR and did not render for our fetcher, so we make no claim about which assets are offered or at what rate.

The terms are the point. The staking terms and conditions run 50,654 English and 58,709 Indonesian characters, updated 11 August 2026, and they say four things a customer should weigh:

• Assets subscribed through staking “will be stored in wallets managed by Tokocrypto”, which is the same custody position as the main balance.
• APR values shown on the platform are “determined at Tokocrypto’s sole discretion and are subject to change at any time without prior notice”.
• Early redemption forfeits all rewards accumulated or distributed during the lock up, and the principal is returned minus any rewards already paid out.
• The firm “does not guarantee any specific reward value you may receive through Staking”.

Tax applies to the yield and the firm publishes the rate: “Pajak dalam fitur Staking menjadi 5% (PPh Progresif) dan DCA menjadi 0%”, a 5% progressive income tax on staking and 0% on the recurring buy feature. The staking terms work an example at a 6% tax fee. Whichever applies to a given customer, a quoted APR is not what lands in the wallet, and the platform quotes the APR rather than the net.

What the document does not say matters as much. Term counts over the full text return zero for title, transfer of, custody, pooled, lend, loan and Binance. So there is no title transfer clause, no rehypothecation clause, no named third party staking provider, and no statement of who bears the loss if the underlying staking fails. At many venues the consequential term of a yield product is that title to the coins passes to the operator. Here that term is neither granted nor excluded, which leaves the customer relying on general contract terms under which they already hold a claim rather than coins.

The TKO token has a second role worth naming. Holding it moves a customer down the fee ladder and paying fees in it takes 25% off, so the same token is a discount mechanism and a locked yield product issued by the venue granting the discount. That concentration is the risk, and the product pages do not discuss it.

Opening an Account

Opening is fast and narrow. Verification is mandatory before any deposit, trade or withdrawal, and the firm states that verification is processed automatically within a maximum of one working day, while the app markets sub two minute KYC on version 2.28. On the evidence, one working day is the number to plan around.

Verification is mobile app only, and has been since 12 June 2025. A desktop user cannot complete onboarding on the web at all, which is a genuine limitation and is not signalled on the homepage. The steps for a Level 1 account are a KTP national identity document, address and phone details, a selfie and a liveness check. One KTP means one account. A separate guide covers foreign nationals, so non Indonesian identity documents are contemplated, though we did not test that route.

Level 2 requires a source of wealth form and three months of bank statements, reviewed by the KYC team rather than automatically, and raises the daily fiat withdrawal ceiling from Rp250,000,000 to Rp5,000,000,000 and the crypto ceiling from 3 BTC to 100 BTC.

We did not open an account, and we could not load the sign up funnel. Our proxy refuses the /account/signup and /account/signin paths under its own robots policy, returning HTTP 402 from three countries. That is a fact about our tooling and not about Tokocrypto, and it means the screens themselves, the exact consent checkboxes and the in flow disclosures were not inspected. What the registration forms are checkable on is that they were live on the homepage in all nine served countries on 12 August 2026, and the onboarding help articles were updated within the preceding week.

Two things to know before you tick the box. First, what you accept is a single long agreement that carries the risk disclosure inside it as a section rather than as a standalone document, with a click through acknowledgement, and that includes the ADGM Access Agreement annex described in the licences section. Second, if you read English, the English homepage points you at the Indonesian language versions of the terms and the privacy policy. Only the cookie policy carries an English link. Accepting a binding contract in a language you may not read is a real defect, and it is the firm’s to fix.

Security controls at opening are ordinary and adequate: two factor authentication by SMS or Google Authenticator, and withdrawals restricted to a bank account in the account holder’s own name. A password reset triggers a 72 hour withdrawal suspension, which is a sensible anti takeover control and worth knowing before you reset one on the day you plan to withdraw.

Deposits & Withdrawals

Rupiah rails are the strength here. Deposits run through bank virtual accounts with BCA, Mandiri, BRI, Nobu Bank, blu by BCA Digital and Bank Syariah Indonesia, plus QRIS, GoPay, OVO, ShopeePay and LinkAja. Crypto arrives on chain, and an internal Binance Transfer route exists for users who have completed Level 1 verification and is stated to carry no fee as an internal transfer.

The published numbers: minimum fiat deposit IDR 10,000, phased in during June 2026. Deposits by QRIS and e-wallet carry 2%. The fiat withdrawal fee is Rp10,000, stated in both languages in the pricing and fees disclosure that the customer agreement itself cites, updated 26 July 2026, and repeated in the trading rules. Note the asymmetry: e-wallets take money in but cannot take it out. The trading rules state that withdrawals to GoPay, OVO, DANA, ShopeePay or LinkAja are “belum tersedia”, not yet available, so every rupiah leaves by bank transfer. Fiat withdrawals are stated to complete within one times 24 hours, to a bank account in the account holder’s own name only, subject to the Level 1 ceiling of Rp250,000,000 or the Level 2 ceiling of Rp5,000,000,000 per 24 hours.

One gap: the per asset crypto withdrawal fee schedule is not published on a page we could reach. The fee page carries a deposit and withdrawal tab whose contents load by XHR after a click, and our fetcher did not run it. Individual network fee changes are announced case by case in the help centre. Treat the crypto side as undisclosed to us rather than undisclosed by the firm.

Incident Record

Compiled from the firm’s own announcements across the complete 3,360 article help centre corpus. Every row is dated and sourced to an article on support.tokocrypto.com.

The Withdrawal Halt History, Which Is The Absence Of One

This is the most predictive fact on the page and it reads well. Across a complete enumeration of 3,360 articles, searched for hack, peretasan, breach, insiden and security incident, no security incident, no hack, no insolvency and no unscheduled withdrawal halt is disclosed. The only withdrawal suspensions found anywhere are the 72 hour hold after a password reset, which is an ordinary security control, and per network wallet maintenance. Thirty articles carry maintenance in the title and every one of them is a scheduled window.

The June 2026 migration is the closest thing to a stress test in the record, and it was handled properly. The firm announced it on 11 June 2026, six days before CFX’s own decision was even set, in both Indonesian and English, with a maintenance window, a table of which deposit channels closed when, a warning that virtual account numbers would change, a fee table, and an explicit statement that a user who did not wish to continue “may still withdraw all funds and/or Digital Financial Assets recorded in their Tokocrypto account”. Crypto rails stayed up. Fiat was down for about two hours.

Two honest limits on that record. It is the firm’s own disclosure, and an exchange that suffered an incident and never published it would look identical here. And there are no verified user reports in the evidence in either direction, so nothing corroborates the record from the customer side.

Customer Support

Channels are broader than most exchanges publish. Live chat on web and in the app is stated as 24/7 and free of charge, there is a telephone number, 021-30629429, printed in the customer agreement, three support email addresses at support@, hello@ and [email protected], and a Zendesk help centre of 3,360 articles. The registered address is published in full and matches OJK’s register.

We could not confirm the chat hours ourselves. The /id/chat page renders ten characters of text server side because the widget is entirely client side, so 24/7 rests on the firm’s own repeated statements through 2026 rather than on anything we observed. Take it as a claim.

Complaints, And Where They Go

The customer agreement designates a Customer Complaints Officer as a role, without naming a person, and commits to a resolution notice within 10 business days. Disputes that cannot be settled by deliberation go to LAPS SJK, the Indonesian financial services sector alternative dispute resolution body, under the laws of the Republic of Indonesia. That is a real external escalation route with a named body behind it, and it is more than many crypto venues offer.

It sits awkwardly beside Annex 2. Transactions executed through the ADGM Recognised Bodies fall under the ADGM Exchange Rules and their arbitration provision at rule 244, and the agreement states that the user “will not have any direct interactions or communications with the ADGM Recognised Bodies”, all such contact being through Tokocrypto only. So one document contains an Indonesian ADR route and an Abu Dhabi arbitration clause, and it does not explain to a retail customer which of the two governs a given complaint. That is worth knowing before a dispute rather than during one.

Incident Response, Which Is Where It Scores Best

Weighted the way a crypto review should weight it, support here is good. The bourse and clearing migration was announced to customers on 11 June 2026, six days ahead of the bourse’s own decision, in both languages, with the operational detail a customer needed and an explicit right to withdraw everything instead of continuing. That is the behaviour you want to see and it is documented rather than claimed.

Where It Falls Short

Two languages only, Indonesian and English, with the English help centre at roughly 30% the size of the Indonesian one, and the English homepage linking its binding terms and privacy policy to Indonesian language documents. There is also a published Live Chat Suspension policy under which abusive users are cut off from human agents and left with bots, updated 4 June 2026. That is a defensible policy for a support team, and a reader should know that access to a human is conditional and that the firm decides the condition.

No verified user reports of support quality exist in our evidence in either direction, so nothing here rests on customer testimony.

Restricted Countries

One country is blocked and the firm does it at the network edge. Fetched from ten countries on 12 August 2026, the United States returns HTTP 451 and a 115 byte shell that embeds the firm’s own notice page. Three URLs, three attempts each, stable, while the same paths return 229,827 bytes to the other nine exits.

The notice reads, in the firm’s own words and with their own typo preserved:

Your IP address indicates that you’re attempting to access our services from a restricted county. As per our Terms of Use , we’re unable to provide services to users from this region.

“County” is theirs. The same page renders a literal unsubstituted template placeholder in its footer where a year should be, which tells you how closely these edges are watched.

The Terms of Use that notice cites publish no restricted country list. We hold the complete customer agreement in both languages and it contains no country list, and mentions the United States only in sanctions screening boilerplate. So a prospective customer anywhere other than the United States cannot check in advance whether they are welcome, and can only discover it by loading the site. The nine countries we reached were all served the identical page, which is not the same thing as being invited: a visitor in London or Berlin gets the same Indonesia facing exchange, whose fiat rails are rupiah bank virtual accounts and Indonesian e-wallets, and whose verification asks for a KTP.

Blocking a jurisdiction you are not licensed for is correct behaviour, and we do not score it against the firm. Failing to publish the list is a disclosure gap, and it is unresolved: we searched the agreement and the complete help centre corpus and found no list anywhere.

Conclusion

Tokocrypto scores 6.6 out of 10, which lands it in the workable band, and the reasoning runs in two directions that a headline cannot carry.

The regulatory position is solid, and it is a good deal stronger than the June 2026 news implies. The permission is verified three ways, on OJK’s own register, in an OJK press release, and printed by number in the firm’s binding contract, with the Jakarta Selatan address matching across all three plus the BSI certificate. The entity that holds the licence is the entity a customer onboards with, in every one of the nine countries served, which is the opposite of the usual pattern where a top tier licence sits over an offshore onboarding arm. And the bourse change was a same day handover between two OJK licensed venues, with both exits recording a voluntary resignation in decisions published by the venues the firm was leaving, and the receiving clearing house issuing its own membership certificate on the same date. Five digital asset traders made the same move in the same period. The one leg that is not arm’s length is the admission itself, since Tokocrypto is among ICEx’s shareholders. There is no OJK enforcement action, no Satgas PASTI listing, and no security incident or unscheduled withdrawal halt anywhere in 3,360 of the firm’s own articles.

What holds the score down is what a crypto reader should actually be asking. Nobody else holds the coins. The keys are in the exchange’s hands in a hosted wallet, no custodian is named, and no segregation language exists in either language of the contract or anywhere in the help centre. What a customer owns is a claim on PT Aset Digital Berkat. The proof that would offset that is not there: the proof of reserves page is Binance’s boilerplate with Binance’s name still in it, names no auditor and carries no date. Cost is high, at 0.4044% all in against a 0.1500% headline, and with 40 rupiah pairs out of 437 assets a rupiah holder pays that band on nearly the whole book. And the firm’s own marketing still points readers, and AI assistants, at a regulator that stopped supervising this sector in January 2025 and at memberships it resigned in June 2026.

Who it suits. An Indonesian resident who wants rupiah bank and e-wallet rails into a locally licensed venue with a long operating history and a documented incident record, who trades the liquid IDR pairs rather than the long tail, and who accepts that the exchange holds the keys. The 24/7 chat, the phone number, the designated complaints officer and the LAPS SJK route are real advantages for that customer.

Who it does not suit. Anyone who wants third party custody or a dated, named attestation that the reserves exist, because neither is available here. Anyone trading the long tail of the book from rupiah, because the fee structure penalises exactly that. Anyone who needs leverage or derivatives, which this venue does not offer at all. Anyone who cannot read Indonesian and wants to read the contract they are agreeing to, since the English homepage links the Indonesian versions. And anyone in the United States, who is blocked at the door.

Two things would move this score. A named auditor and a dated attestation covering liabilities as well as assets would address the single largest gap. Client asset segregation, or a named third party custodian, would address the other. Both are the firm’s to publish and neither requires anybody’s permission.

One editorial note the reader is entitled to: our score is set from the evidence packs before any of this prose is written, and the writer cannot change it. Where we could not check something, we have said so by name rather than treating our own failed request as a finding about anyone else.

FAQ