How to Get a Crypto Exchange License in Indonesia: 2026 Guide

Trying to launch a crypto platform in Indonesia? You've probably noticed the rules changed almost overnight. If you're still looking for BAPPEBTI, you're looking in the wrong place. As of 2025, the game has completely changed, moving from a commodity-based approach to a sophisticated financial asset framework. Getting a license now isn't just about filling out forms; it's about meeting heavy capital requirements and proving your tech can withstand a professional audit. If you don't have a few million dollars in the bank and a watertight security schema, you'll find the barrier to entry incredibly high.

The New Era: From BAPPEBTI to OJK

For years, crypto in Indonesia was treated like trading gold or coffee. That ended on January 10, 2025. Now, the Otoritas Jasa Keuangan is Indonesia's integrated financial services authority responsible for regulating the digital financial asset sector. They've introduced the Digital Financial Assets (DFA) framework, which officially classifies crypto businesses as "Digital Financial Asset Trading Providers."

Why does this matter? It means the government now views crypto as a financial instrument, not just a commodity. This shift brings the industry under the same kind of scrutiny as banks and insurance companies. If you were already licensed under the old system, you aren't totally out of luck, but you had to reapply by July 2025 to stay legal. If you're starting from scratch, you're entering a world where compliance is the priority, not an afterthought.

The Financial Hurdle: Capital Requirements

Let's be honest: Indonesia is not looking for small-scale startups. The financial barriers are designed to keep only the most stable players in the game. To get your foot in the door, you need a paid-up capital of 100 billion rupiah (roughly $6 million USD). On top of that, you must maintain a minimum equity of 50 billion rupiah (about $3 million USD).

These numbers are steep. For many mid-sized fintechs, this is where the dream hits a wall. However, these requirements act as a safety net for users. When a platform has this much skin in the game, it's less likely to vanish overnight or suffer from catastrophic liquidity issues. If you can't hit these numbers alone, your best bet is looking for a joint venture or a strategic partner who can bridge the gap.

Step-by-Step: The Licensing Process

Getting your license isn't a one-stop shop. It's a multi-month marathon of paperwork and inspections. Here is the actual path you'll need to follow to become a legal provider:

1. Company Registration: You must first register your business through the Ministry of Investments website. Most foreign investors use the PT PMA designation, which allows for foreign equity allocation.
2. Documentation Gathering: This is the tedious part. You'll need your company statutes, a full governance framework, and a detailed list of beneficial owners. Every single page must be translated into Indonesian and legally authenticated.
3. Technical Submission: You can't just say "our site is secure." You need to provide full information security schemas. This includes the specific cryptographic protocols you use, your encryption algorithms, and your detailed KYC (Know Your Customer) and AML (Anti-Money Laundering) workflows.
4. Regulatory Inspection: OJK won't just take your word for it. They will conduct inspections to ensure your operational reality matches your paperwork.
5. License Issuance: Once you pass the scrutiny, the OJK issues the final license, allowing you to officially trade DFAs.

Who Decides Which Coins Are Tradable?

In the old days, BAPPEBTI handled the "approved list." Now, a new entity called the DFA Exchange takes the lead. They evaluate and issue the list of tradable crypto assets. This is a huge deal because if a coin isn't on this list, you can't legally offer it to Indonesian users.

The scale of adoption is growing fast. In April 2025, the DFA Exchange released a list of 1,444 crypto assets-a massive jump from the previous 851. While you can suggest new coins for addition, the OJK still holds the ultimate veto. They can order you to stop trading a specific token immediately if they decide it poses a risk to the market or users.

Staying Compliant: AML and Real-Time Monitoring

Once you have the license, the hard work actually begins. Compliance isn't a checkbox; it's a daily operation. Under SEOJK No. 20 of 2024, you are required to maintain strict monitoring of every transaction.

You'll need a direct line to the PPATK (Financial Transaction Reports and Analysis Center). If you spot a suspicious transaction, you don't just flag it internally-you report it to the PPATK. The OJK now has real-time monitoring capabilities, meaning they can see patterns and detect fraud almost as it happens. If you ignore these rules, the consequences are brutal: your license gets revoked, you face heavy fines, and you could even face criminal charges.

Taxes: The New 0.21% Rule

Taxation used to be a grey area, but that cleared up on August 1, 2025, with MOF Regulation No. 50/2025. The government stopped treating crypto like a taxable "good" (which meant VAT was a headache) and started treating it as a financial instrument.

The current system is much simpler: a final income tax rate of 0.21% on crypto transactions. This is a welcome change for most traders and platforms because it streamlines the reporting process and provides the legal certainty needed for institutional investors to enter the market.

The Tech Stack: Security Expectations

OJK isn't just looking at your balance sheet; they're looking at your code. To get licensed, your infrastructure must be industrial-grade. They expect a detailed technical schema that proves how you protect private keys and how you secure user data.

For those wanting to innovate with new features (like staking or advanced lending), OJK offers a regulatory sandbox. This is a controlled environment where you can test new financial tech without the risk of immediate license revocation, provided you follow the sandbox's specific security guidelines. It's a great way to pivot your product while keeping the regulators happy.

Next Steps for Applicants

If you're ready to move forward, your first move should be a legal audit. Don't try to navigate the PT PMA registration alone-hire a local firm that specializes in OJK compliance. Start by auditing your current capital levels; if you're short of the 100 billion rupiah mark, begin scouting for strategic partners now. Finally, document every single part of your security stack. The OJK doesn't like surprises; the more detailed your initial submission is, the smoother the inspection process will be.