Indonesia Crypto License: OJK & Bappebti CASP 2026

Since 2025 under Law 4/2023, OJK (Otoritas Jasa Keuangan) is the primary regulator for crypto as financial assets, taking over from Bappebti. Bappebti may retain some commodity futures aspects. OJK supervises crypto exchanges, custodians, and other crypto service providers under the new financial sector framework.

Under the OJK framework, capital requirements are significant — ranging from IDR 100 billion to over IDR 1 trillion (approximately USD 6M–65M) depending on the scale and type of activity. This reflects Indonesia's focus on financial stability and investor protection.

Foreign investment in Indonesian financial services requires establishing a PT PMA (Foreign Investment Company) through BKPM. Foreign ownership in financial services is restricted — typically maximum 85% foreign ownership, with some sectors lower. Legal counsel is essential.

Indonesia has 280 million people and one of the fastest-growing crypto adoption rates in the world. The Bappebti-registered exchange ecosystem handled tens of billions USD in annual volume. Tokocrypto (Binance-backed) and Indodax are among the largest Indonesian exchanges.

Under the new OJK framework (from 2025), licensing is expected to take 6–12 months. The transition from Bappebti to OJK oversight is ongoing, and new detailed licensing rules are being developed. Early engagement with OJK is recommended.

The total cost typically ranges from USD 50,000 to USD 150,000, including application fees to OJK/Bappebti, legal consultation, compliance infrastructure setup, and initial capital reserves. Ongoing compliance costs add approximately USD 15,000 to USD 30,000 annually for regulatory reporting, audits, and system maintenance. These costs vary depending on your business model and the complexity of your operations.

You must provide business registration documents, shareholder information, detailed business plans, anti-money laundering (AML) and know-your-customer (KYC) procedures, financial statements, proof of capital, organizational structure, security protocols, and CVs of key management personnel. OJK also requires comprehensive risk management frameworks and documentation of your IT infrastructure and cybersecurity measures. All documents must be translated into Indonesian and notarized.

Indonesia's OJK framework is generally less prescriptive than Singapore's MAS framework, making it faster to obtain but with evolving regulatory expectations. Singapore requires more detailed capital adequacy and market conduct rules, while Indonesia focuses more heavily on KYC/AML and spot trading compliance. Both jurisdictions require regular audits, but Indonesia's requirements are currently less stringent, making it attractive for startups seeking faster market entry.

Licensed crypto exchanges must establish relationships with Indonesian banks approved by Bank Indonesia (BI) and OJK. Banks are increasingly cautious about crypto clients, so most exchanges use designated payment service providers or work with international banking corridors. You cannot offer crypto-to-fiat conversions directly without banking partnerships, which is one of the most challenging compliance aspects in Indonesia.

Licenses require annual renewal with updated financial statements, compliance reports, and proof of maintained capital requirements. OJK conducts compliance audits every 12-18 months and may request enhanced due diligence on specific transactions. You must maintain cyber insurance, update your AML/KYC systems annually, and report any significant changes to your business model or ownership structure within 30 days.

Licensed exchanges are subject to Indonesia's standard corporate income tax (around 22% in 2026), value-added tax (VAT) on services, and must report customer transaction data for tax compliance purposes. Capital gains from trading are taxed at the customer level, not the exchange level. You may also face municipal business taxes depending on your operational location within Indonesia, typically ranging from 0.1% to 0.3% of gross revenue.

Violations can result in fines ranging from IDR 5 billion to IDR 50 billion (USD 300,000 to USD 3 million), operational suspension, or complete license revocation. OJK conducts surprise inspections and has increased enforcement activity since 2024, particularly around AML/KYC violations and market manipulation. Criminal penalties including imprisonment are possible for serious breaches, especially regarding money laundering or terrorist financing violations.