Blog

Fintech License Indonesia: 2 Regulators, 1 Smart Path

Summary:

Getting a fintech license Indonesia requires isn’t a single application — it’s figuring out which of two separate regulators, Bank Indonesia (payments) or OJK (nearly everything else), governs your specific product first.
Foreign fintechs offering P2P lending, securities crowdfunding, or BNPL must secure OJK or BI licensing before serving Indonesian customers — there is no informal-operation grace period, and OJK actively publishes lists of unlicensed “illegal” fintech platforms.
A fresh regulatory shift matters immediately: Bank Indonesia Regulation 10/2025 took effect March 31, 2026, replacing entity-based payment licensing with a risk-based, activity-bundled model — meaning your license requirements now depend on what your product actually does, not what category you register under.
Indonesia’s demand-side case is proven — financial literacy climbed from 38% in 2019 to over 65% in 2024 — which means the real bottleneck for foreign entrants is almost entirely regulatory sequencing, not market appetite.

Why "Southeast Asia" Is the Wrong Unit of Analysis

Most companies plan “Southeast Asia expansion” as if the region were a single market with a single entry decision. It isn’t. Southeast Asia market entry 2026 planning that treats the region as one unit typically discovers, only after budget is already committed, that Singapore’s contract law, Indonesia’s foreign investment rules, and Vietnam’s manufacturing incentives have almost nothing in common — different regulators, different buyer expectations, different timelines to revenue.

The fix isn’t complicated, but it does require reframing the question. “Entering Southeast Asia” should be treated as a sequencing decision — which country first, and in what order the rest follow — not a single go/no-go call made once and applied uniformly across six very different economies.

Why Does Indonesia Have Two Fintech Regulators Instead of One?

Indonesia’s fintech opportunity is well known. The licensing path is where most foreign fintechs actually lose months — and the first reason is structural: there is no single fintech regulator to register with. Bank Indonesia (BI) governs payment systems specifically — e-wallets, payment gateways, remittance, and fund transfers — while OJK (Otoritas Jasa Keuangan), Indonesia’s financial services authority, covers nearly everything else: digital banking, insurtech, wealthtech, crypto, BNPL, and P2P lending, largely under the ITSK (Inovasi Teknologi Sektor Keuangan) framework introduced by the 2023 P2SK Law.

This split isn’t a bureaucratic accident — it reflects a genuine functional distinction the P2SK Law was designed to formalize: BI’s mandate covers the movement of money through the payment system, while OJK’s mandate covers the broader universe of financial products and services built on top of that system. But for a foreign fintech evaluating Indonesia, the practical consequence is the same regardless of the rationale: the first and most consequential question isn’t “how do I get licensed” — it’s “which regulator actually applies to what I’m building.”

Which License Applies to Your Product?

The regulator that governs your fintech depends entirely on what your product actually does, not what you call it.

Payment-related products — e-wallets, payment gateways, digital remittance, e-money issuance — fall under Bank Indonesia. As of BI Regulation 10/2025, which took effect March 31, 2026, this category is now assessed through a five-factor TIKMI framework (Transaction, Interconnection, Competence, Risk Management, IT Infrastructure) that determines whether a company is classified as a Primary PSP or Non-Primary PSP, which in turn determines which of three activity “bundles” it’s licensed to operate under. As of the most recent Chambers and Partners data, 566 payment service providers have already been licensed by Bank Indonesia — this is a mature, well-populated regulatory category, not an emerging one.

P2P lending, securities crowdfunding, digital banking, insurtech, wealthtech, and crypto fall under OJK. As of August 2025, OJK had recognised 96 licensed P2P lending companies — a fraction of the 566 BI-licensed payment providers, reflecting both a smaller addressable segment and OJK’s more demanding entry bar for this specific category.

BNPL (buy-now-pay-later) sits within OJK’s broader ITSK jurisdiction, alongside financial services aggregators and digital financial asset platforms, each governed by their own specific OJK regulation (Regulation No. 3 of 2024 for ITSK broadly, No. 40 of 2024 for P2P lending, No. 4 of 2025 for aggregators, No. 27 of 2024 for digital financial assets).

There is no informal-operation grace period for any of these categories. Foreign fintechs offering P2P lending, securities crowdfunding, or BNPL are statutorily required to secure the applicable license before serving a single Indonesian customer.

What Happens Before You File — Entity, Capital, and Governance

Licensing is the visible milestone, but it’s the last step in a longer sequence, not the first. Before a foreign fintech can even file a license application, it needs the right legal entity — typically a PT PMA (foreign-owned limited liability company) — correctly structured for its specific fintech category, since capital requirements vary sharply by category and getting the entity wrong at incorporation is expensive to unwind later.

Capital requirements illustrate this well. P2P lending operators, for instance, must hold a minimum of IDR 25 billion in issued capital — a tenfold increase introduced by OJK Regulation No. 40 of 2024, reflecting the sector’s tightening oversight. Other ITSK-registered categories carry more accessible thresholds, while digital banking licenses sit at the high end of Indonesia’s capital requirements across virtually all sectors. Governance requirements compound this: P2P operators, for example, must obtain prior OJK approval before employing foreign workers, and those workers face a two-year maximum term (extendable once) and can only work in IT-specific roles, treated organizationally as one level below the Board of Directors.

The practical implication: entity structure and capital planning aren’t a formality to handle after deciding on a license category — they need to happen in parallel with (and often before) the license application itself, since the regulator will evaluate the entity’s capitalization and governance as part of the licensing decision.

Foreign Ownership Limits by Category

Foreign ownership caps apply differently depending on which fintech category you’re licensed under, and getting this wrong at the ownership-structure stage is one of the most consequential — and hardest to reverse — mistakes a foreign fintech can make.

For P2P lending, OJK Regulation No. 40 of 2024 caps direct or indirect foreign ownership at 85%, meaning at least 15% must sit with Indonesian shareholders. Notably, POJK 40/2024 removed a prior exemption that had let publicly-listed companies bypass this cap entirely — a tightening move worth flagging for any foreign fintech assuming a future IPO would simplify its ownership structure. The regulation also indicates that separate implementing regulations may eventually adjust this percentage, but until those are issued, 85% remains the operative ceiling.

For financial services aggregators, OJK Regulation No. 4 of 2025 sets its own ownership and governance requirements aligned with the broader ITSK framework. For digital financial asset platforms, OJK Regulation No. 27 of 2024 governs ownership separately again, following the transfer of crypto oversight from Bappebti to OJK in January 2025.

There’s a separate structural constraint worth budgeting for early, distinct from ownership percentage: Bank Indonesia prohibits fintechs from using foreign currency or virtual currency within their services. This is easy for a foreign team to overlook during early product planning, since it affects not just compliance paperwork but actual product architecture — pricing, settlement, and reporting all need to be built around rupiah-denominated operations from the start, not retrofitted after a foreign-currency-based MVP is already built.

The Compliance Timeline Founders Underestimate

The gap between “we understand the regulatory landscape” and “we’re licensed and serving customers” is where most foreign fintech timelines go wrong, and 2026’s regulatory shift makes that gap more consequential, not less.

Under BI Regulation 10/2025, existing and new Payment Service Providers face specific, dated obligations: PSPs must submit their first Strategic Business Plan (SBP) and Payment System Business Plan (RBSP) by April 30, 2026, and Bank Indonesia will complete its initial TIKMI classification assessment — determining whether a company is a Primary or Non-Primary PSP — within one year of the regulation’s March 31, 2026 effective date. Companies that don’t yet meet the new licensing or TIKMI requirements get three years to comply, with a possible two-year extension subject to BI approval — a meaningful grace period, but one that still requires active engagement with the new framework rather than passive waiting.

Two structural realities make this timeline easy to underestimate. First, the regulatory landscape itself isn’t static — BI Regulation 10/2025 replaced a framework that had been in place since July 2021, and OJK has issued several major fintech-specific regulations just since late 2024 (POJK 40/2024 on P2P lending, POJK 3/2024 on ITSK, POJK 27/2024 on digital financial assets). A company that built its entry timeline around regulations from even eighteen months ago is likely planning against rules that no longer fully apply. Second, OJK actively maintains and publishes lists of unlicensed “illegal” fintech platforms as part of its enforcement posture — meaning operating in any gray area while licensing is pending carries genuine regulatory and reputational risk, not just a theoretical compliance gap.

The demand-side case, meanwhile, isn’t the bottleneck. Indonesia’s financial literacy index climbed from 38% in 2019 to over 65% in 2024 — a level of consumer readiness that makes the market opportunity largely proven. The constraint foreign fintechs actually run into is almost entirely regulatory sequencing: getting the right entity, the right ownership structure, and the right license category aligned before attempting to serve customers, not whether Indonesian consumers want the product.

Distribution Angle: QRIS Cross-Border and Regional Interconnection

Once licensed, foreign payment-focused fintechs have a distribution advantage worth building into go-to-market planning from the start: Indonesia’s QRIS cross-border payment network. Bank Indonesia has been steadily extending QRIS interoperability to Thailand, Malaysia, Singapore, Japan, South Korea, and China, with a QRIS-UPI link to India targeted for completion by the end of 2026 — using a Local Currency Transaction (LCT) settlement mechanism that bypasses USD conversion entirely.

For a licensed foreign payment provider, this interconnection isn’t just a macro policy trend to note — it’s a genuine distribution channel. A payments product that integrates properly with QRIS acceptance infrastructure inherits reach into Indonesia’s roughly 45 million existing QRIS merchants, and increasingly into cross-border tourist and merchant flows from six (soon seven) partner countries, without needing to build separate acceptance infrastructure for each corridor. Foreign fintechs planning their Indonesia entry around payments specifically should treat QRIS cross-border integration as part of the core product roadmap, not a later-stage nice-to-have.

Frequently Asked Questions

Which regulator do I need for a fintech license in Indonesia — OJK or Bank Indonesia?
It depends on your product. Payment-related products (e-wallets, payment gateways, remittance) fall under Bank Indonesia. Nearly everything else — P2P lending, digital banking, insurtech, wealthtech, crypto, and BNPL — falls under OJK, primarily through the ITSK framework.

What foreign ownership limit applies to a P2P lending fintech in Indonesia?
OJK Regulation No. 40 of 2024 caps foreign ownership at 85% for P2P lending operators, meaning at least 15% must be held by Indonesian shareholders. This cap could change under future implementing regulations, but 85% remains the current ceiling.

What changed with Bank Indonesia Regulation 10/2025?
It replaced Indonesia’s entity-based payment system licensing model with a risk-based, activity-bundled framework, effective March 31, 2026. Payment providers are now assessed via a five-factor TIKMI framework and classified as Primary or Non-Primary PSPs, which determines which specific licensed activities they can operate.

Can a foreign fintech operate in Indonesia while its license application is pending?
No. There is no informal-operation grace period for P2P lending, securities crowdfunding, or BNPL — foreign fintechs must secure the applicable license before serving Indonesian customers, and OJK actively publishes lists of unlicensed platforms as part of its enforcement approach.

Before You Book a Call With a Law Firm

Everything above — the two-regulator split, the category-specific ownership caps, the 2026 licensing overhaul — is the strategic overview most foreign fintechs only get after weeks of conversation with local counsel. Knowing which regulator actually applies to your specific product is the question that should come first, not somewhere in the middle of a legal engagement that’s already billing by the hour.

Gateway’s free GTM report pulls a regulatory overview from official ASEAN data sources and flags your fintech category’s licensing path — a shortcut past the uncertainty this article just walked through, not a generic “learn more” link.