Indonesian Crypto Exchange Licensing Requirements: 2025-2026 OJK Guide

Running a cryptocurrency business in Indonesia used to be a bit of a gray area. You had BAPPEBTI watching over you, but the rules were shifting constantly. That changed dramatically on January 10, 2025. The Otoritas Jasa Keuangan (OJK) is Indonesia's Financial Services Authority, which took over primary regulation of digital assets from BAPPEBTI stepped in as the main regulator. This wasn't just a name change; it was a complete overhaul of how crypto businesses operate under the new Digital Financial Assets (DFA) framework.

If you are looking to launch or expand a crypto platform in Indonesia today, you need to know that the bar has been raised. The days of flying under the radar are gone. The OJK has introduced strict capital requirements, rigorous technical standards, and comprehensive anti-money laundering protocols. But for those who can meet these challenges, Indonesia offers access to one of Southeast Asia’s largest and most active crypto markets.

Understanding the New DFA Framework

The first thing to grasp is the terminology shift. Under the old system, you might have called yourself an "exchange." Now, the term "exchange" is reserved for the overarching authority-the DFA Exchange is the central entity responsible for evaluating and listing tradable crypto assets in Indonesia. Your business, if you are facilitating trades, is classified as a Digital Financial Asset Trading Provider is a licensed entity authorized by OJK to facilitate the trading of digital financial assets.

This distinction matters because it defines your regulatory obligations. If you held a license under BAPPEBTI before July 2025, you were automatically recognized during a grace period. However, that window closed. To keep operating legally, existing players had to reapply and fully comply with the new POJK 27/2024 regulations. For new entrants, there is no shortcut. You start from scratch, proving you meet every single criterion set by the OJK.

The goal here is clear: consumer protection and market stability. The OJK wants to ensure that only well-capitalized, secure, and transparent entities handle Indonesian investors' money. This approach positions Indonesia as a serious player in the global crypto landscape, moving away from the wild west reputation some emerging markets still carry.

Capital Requirements and Corporate Structure

Let’s talk money, because this is where many startups hit a wall. The OJK did not lower the financial barriers; they kept them high to filter out operators who cannot sustain themselves during market volatility.

• Paid-up Capital: You must demonstrate 100 billion rupiah (approximately US$6 million). This cash needs to be in your account, verified and ready.
• Minimum Equity: On top of paid-up capital, you need 50 billion rupiah (about US$3 million) in minimum equity.

These figures are non-negotiable. They serve as a buffer against insolvency and ensure you have the resources to implement robust security measures and customer support systems.

Next, you need to structure your company correctly. Foreign investors typically use a PT PMA is Penanaman Modal Asing, a limited liability company structure for foreign direct investment in Indonesia. This requires registration through the Ministry of Investments website. You will need to provide detailed information about your beneficial owners, corporate statutes, and governance framework. Transparency is key. The OJK will scrutinize who really owns and controls the business to prevent illicit activities.

The Step-by-Step Licensing Process

Getting licensed is not a quick fix. It is a multi-month journey involving five critical steps. Here is what you can expect:

1. Company Registration: Establish your legal entity in Indonesia. Ensure all documents are translated into Indonesian and legally authenticated.
2. Document Collection: Gather everything from beneficial owner IDs to detailed operational plans. This includes proof of your capital reserves.
3. Application Submission: Submit your full application package to the OJK. Make sure every form is filled out correctly; errors here cause delays.
4. Regulatory Inspection: The OJK will review your documentation and may conduct on-site inspections. They will check your physical infrastructure, team qualifications, and technical setup.
5. License Issuance: If you pass inspection, you receive your license as a DFA Trading Provider.

During the inspection phase, expect questions about your risk management strategies. How do you handle a market crash? What happens if your servers go down? The OJK wants to see that you have contingency plans for every scenario.

Technical and Security Standards

You cannot run a crypto platform in Indonesia without top-tier security. The OJK requires detailed information security schemas. This isn't just about having a firewall; it's about demonstrating a comprehensive defense strategy.

Your application must include specifics on:

• Cryptographic Protocols: Detail the algorithms you use to secure transactions and data storage.
• KYC Systems: Explain how you verify user identities. This ties directly into AML compliance.
• Anti-Money Laundering (AML) Mechanisms: Show how you detect and report suspicious activity.

The Financial Transaction Reports and Analysis Center (PPATK) is Indonesia's financial intelligence unit responsible for combating money laundering and terrorist financing plays a crucial role here. Licensed operators must report suspicious transactions to PPATK in real-time. The OJK collaborates with PPATK and law enforcement to monitor transaction patterns. If you fail to integrate these reporting mechanisms, your license will be revoked.

Additionally, consider joining the OJK's regulatory sandbox. This allows you to test new technologies in a controlled environment while maintaining compliance. It’s a great way to innovate without risking your entire license.

Asset Listing and Market Oversight

One major change under the new framework is who decides which cryptocurrencies can be traded. Previously, BAPPEBTI maintained the list. Now, the DFA Exchange holds this power. In April 2025, the first official list was released, featuring 1,444 crypto assets-a 70% increase from the previous 851.

This expansion is good news for traders, offering more variety. However, it comes with conditions. The DFA Exchange reviews this list quarterly. As a trading provider, you can suggest additions, but the final say rests with the regulators. The OJK retains the right to prohibit specific assets or order platforms to stop trading certain coins if they pose a risk to market stability or consumers.

This dynamic means you need to stay agile. Your platform must be able to delist assets quickly if required by the OJK. Hardcoding unsupported tokens into your system is a recipe for disaster.

Taxation Changes for 2025-2026

Regulation isn't just about licenses; it's also about taxes. Starting August 1, 2025, Indonesia implemented MOF Regulation No. 50/2025. This was a game-changer for both businesses and users.

First, Value Added Tax (VAT) on crypto-asset transactions was eliminated. This removes a significant friction point for traders. Second, a final income tax rate of 0.21% was established on crypto transactions. This flat rate simplifies reporting and provides legal certainty. Instead of treating crypto as taxable goods, it is now recognized as a digital financial instrument.

For exchanges, this means easier integration with tax authorities. You need to ensure your platform can calculate and withhold this 0.21% tax accurately. Failure to do so could lead to penalties from the tax office, separate from OJK sanctions.

Compliance Risks and Penalties

What happens if you slip up? The consequences are severe. The OJK does not tolerate non-compliance. Penalties include:

• License Revocation: You lose the right to operate entirely.
• Financial Fines: Significant monetary penalties based on the severity of the violation.
• Asset Delisting: Forced removal of specific cryptocurrencies from your platform.
• Criminal Charges: In cases of fraud or severe AML violations, individuals can face jail time.

The collaborative effort between OJK, Bank Indonesia, and PPATK creates a net that is hard to escape. Real-time monitoring capabilities mean that unusual transaction patterns are flagged immediately. You need a dedicated compliance team that understands Indonesian law and can respond to regulator inquiries instantly.

Strategic Advice for New Entrants

If you are planning to enter the Indonesian market, here is my advice. First, partner with local experts. Navigating PT PMA registration and OJK documentation is complex without native language skills and cultural understanding. Second, prioritize technology. Invest in the best security infrastructure available. Third, build relationships with regulators early. Attend industry forums and engage with the OJK’s sandbox program.

The market is competitive, with established players like Indodax, Tokocrypto, Pintu, and Reku already holding licenses. To succeed, you need to offer something unique-better fees, superior UX, or innovative products tested in the sandbox. But above all, you must be compliant. In Indonesia, trust is your most valuable asset, and the OJK is the gatekeeper of that trust.