Indonesian Crypto Exchange Licensing Requirements: OJK Guide for 2026

Imagine trying to launch a crypto platform in Jakarta today. You might think you're just filing paperwork with the old commodity regulator, but that world vanished on January 10, 2025. The Otoritas Jasa Keuangan (OJK), Indonesia's financial services authority, took full control of cryptocurrency oversight from BAPPEBTI. This wasn't just a name change; it was a fundamental shift in how digital assets are regulated, moving them from commodities to financial instruments. If you're an operator, investor, or tech founder eyeing the Indonesian market, understanding these new rules isn't optional-it's survival.

The Shift from BAPPEBTI to OJK

For years, crypto exchanges in Indonesia operated under the supervision of BAPPEBTI, treating digital tokens like tradable commodities such as gold or coffee beans. That era is over. Under the new Digital Financial Assets (DFA) framework governed by POJK 27/2024, crypto platforms are now classified as Digital Financial Asset Trading Providers. This classification aligns crypto more closely with traditional financial markets, bringing stricter consumer protections and higher compliance standards.

Why does this matter? Because the regulatory lens changed. OJK doesn't just look at whether you can trade; they look at your capital adequacy, your risk management, and your impact on financial stability. Existing companies licensed by BAPPEBTI didn't lose their licenses overnight, but they faced a critical deadline. By July 2025, all operators had to reapply and prove they met the new, tougher standards. If you missed that window, you were effectively out of business unless you secured a partnership or acquired a compliant entity.

Capital Requirements: The Big Barrier to Entry

Let's talk money. The biggest hurdle for many startups is the capital requirement. It hasn't dropped since the BAPPEBTI days, and frankly, it shouldn't if you want serious players in the market. To get a license, you need 100 billion rupiah (approximately US$6 million) in paid-up capital and 50 billion rupiah (US$3 million) in minimum equity.

This isn't just a number on a balance sheet. It’s a filter. It ensures that only entities with substantial financial backing can operate, reducing the risk of small, unstable platforms collapsing and hurting retail investors. For smaller fintech startups, this often means seeking venture capital funding or forming joint ventures with established local banks or conglomerates. If you’re bootstrapping, check your bank account twice-you’ll likely need external investment before you even submit your application.

The Five-Step Licensing Process

Getting the license isn't a one-click process. It’s a marathon involving five distinct stages. First, you must register your company through the Ministry of Investments website. If you’re a foreign entity, this usually means setting up a PT PMA (Penanaman Modal Asing), which allows foreign ownership within specific limits.

Next comes document collection. This is where most applications stall. You need comprehensive statutes, details on every beneficial owner, and a clear governance framework. Remember, everything must be translated into Bahasa Indonesia and legally authenticated. Don’t underestimate the time this takes. Third, you submit the application. Fourth, OJK conducts a rigorous inspection. They don’t just read your docs; they scrutinize the reputation of your owners and the robustness of your tech stack. Finally, if you pass, you receive your license. The entire process can take several months, so plan your cash flow accordingly.

Technical Compliance and Security Standards

Indonesia isn't just checking your wallet; they're checking your code. The technical requirements are stringent because OJK wants to prevent hacks and fraud. Your platform must demonstrate a detailed information security schema. This includes cryptographic protocols, secure algorithms, and robust Know Your Customer (KYC) systems.

You also need anti-money laundering (AML) mechanisms that work in real-time. It’s not enough to have a policy on paper; your system must automatically flag suspicious transactions. These flags go straight to PPATK, Indonesia’s financial intelligence unit. If your system misses a pattern of rapid, high-volume transfers from a new account, you could face penalties. OJK uses real-time monitoring tools to watch trading activities, so your infrastructure needs to be scalable and transparent.

Asset Listing and the DFA Exchange Role

Here’s a nuance many miss: individual exchanges don't decide what coins to list freely anymore. A newly established DFA Exchange acts as the central authority for evaluating and issuing the list of tradable crypto assets. In April 2025, this body released its first list containing 1,444 assets-a massive jump from the previous 851 allowed under BAPPEBTI. This expansion shows Indonesia is opening up, but with guardrails.

The list is reviewed quarterly. If you want to add a new token, you submit a suggestion, but the final say rests with the regulatory authorities. OJK retains the power to ban specific assets if they deem them too risky or manipulative. So, when you build your product roadmap, don't assume you can instantly list the next viral meme coin. Check the current DFA list first.

Taxation Changes: No More VAT on Trades

Effective August 1, 2025, the tax landscape shifted dramatically. Previously, crypto trades were treated somewhat like goods sales, subject to Value Added Tax (VAT). That’s gone. Now, under MOF Regulation No. 50/2025, crypto is treated as a digital financial instrument.

The new rule imposes a final income tax rate of 0.21% on transaction values. This simplifies things massively for both traders and platforms. You no longer need complex VAT accounting for every swap. Instead, the platform typically withholds this small percentage at the point of sale. For users, this lowers the cost of trading. For businesses, it reduces administrative burden. It’s a win-win that encourages volume and liquidity in the market.

Compliance Risks and Penalties

What happens if you cut corners? The consequences are severe. Non-compliance with SEOJK No. 20 of 2024 can lead to immediate license revocation. Beyond losing your right to operate, you face financial penalties and potential asset delisting. In extreme cases involving fraud or negligence, criminal charges are possible.

PPATK plays a key role here. If your AML systems fail to report suspicious activity, you’re exposed. Indonesia is keen to show international regulators that it’s cleaning up its act. They collaborate closely with law enforcement to track illicit flows. So, invest in your compliance team early. Hiring a local legal expert who understands OJK’s expectations is cheaper than paying fines later.

Market Landscape: Who Survives?

As of March 2025, only one DFA Exchange license had been issued, while over 20 trading platforms operated under transitional arrangements. Major players like Indodax, Tokocrypto, Pintu, and Reku have adapted, leveraging their existing user bases and capital reserves. But the field is tightening. Smaller exchanges without deep pockets are merging or exiting.

For investors, this consolidation means safer platforms. You’re less likely to see a sudden collapse of a mid-tier exchange because the survivors are well-capitalized. For entrepreneurs, it means the barrier to entry is high, but the prize-a stable, regulated market with growing adoption-is worth the fight. Indonesia is positioning itself as a Southeast Asian hub, balancing innovation with strict consumer protection.