Indonesian Crypto Exchange Licensing Requirements 2025: Capital, Compliance, and Key Changes

Posted By Tristan Valehart    On 9 Dec 2025    Comments (24)

Indonesian Crypto Exchange Licensing Requirements 2025: Capital, Compliance, and Key Changes

Indonesia Crypto License Capital Calculator

Calculate Your License Capital

Based on OJK requirements: 100 billion Rupiah (≈$6M) paid-up capital + 50 billion Rupiah (≈$3M) minimum equity

Required Capital

Paid-up Capital: 0 Rupiah
Minimum Equity: 0 Rupiah
Total Capital: 0 Rupiah
Current rate: 1 USD = 15,000 IDR

Note: Actual requirements must be met in Rupiah. Current rates may fluctuate. OJK requires verified bank deposits.

Before January 2025, running a crypto exchange in Indonesia meant dealing with BAPPEBTI. Now, it’s all about the OJK and the Digital Financial Assets (DFA) framework. If you’re trying to launch or operate a crypto platform in Indonesia, you’re not just upgrading your tech-you’re entering a completely new regulatory world. The rules changed overnight. And the stakes? Higher than ever.

Who Regulates Crypto in Indonesia Now?

The Otoritas Jasa Keuangan (OJK) took over from BAPPEBTI on January 10, 2025. That’s not just a name change. It’s a full structural overhaul. OJK doesn’t just supervise banks and insurance-it now controls every part of digital asset trading. The shift means crypto is no longer treated like a commodity. It’s now classified as a financial asset, subject to the same scrutiny as stocks or bonds. This puts Indonesia on par with Singapore and Malaysia in terms of regulatory maturity.

How Much Money Do You Need to Start?

You can’t just set up a website and call it an exchange. The capital requirements are brutal. You need at least 100 billion rupiah (about $6 million USD) in paid-up capital. That’s money you have to actually have in the bank, not just promise. On top of that, you need 50 billion rupiah ($3 million USD) in minimum equity. These aren’t suggestions. They’re non-negotiable. This filters out small operators and startups without serious funding. Only well-capitalized firms-like Indodax, Tokocrypto, and Pintu-can realistically compete. For new entrants, this means either bringing in deep-pocketed investors or partnering with existing players.

The Licensing Process: Five Steps You Can’t Skip

Getting licensed isn’t a formality. It’s a marathon. Here’s what it actually takes:

  1. Register your company as a PT PMA (foreign investment company) through Indonesia’s Ministry of Investments portal. This isn’t just paperwork-it’s legal identity.
  2. Collect every document needed: articles of incorporation, shareholder lists, beneficial owner profiles, governance policies, and proof of capital. Everything must be notarized.
  3. Submit your application to OJK with full documentation. All files must be translated into Indonesian by a certified translator. No English documents accepted.
  4. Pass the inspection. OJK sends auditors to check your tech setup, security protocols, KYC systems, and AML controls. They’ll test your systems. They’ll dig into your ownership history.
  5. Wait for approval. The review can take 4 to 8 months. There’s no fast track. If any part of your application is incomplete, you start over.
Server room in a Javanese villa with technicians monitoring crypto systems under OJK inspector's watch.

Your Tech Has to Be Bulletproof

OJK doesn’t care how fancy your app looks. They care about how secure it is. You need:

  • End-to-end encryption for all user data
  • Multi-signature wallet systems for cold storage
  • Real-time KYC verification with ID and facial recognition
  • AML monitoring tools that flag suspicious transactions
  • A documented information security policy approved by OJK
Your platform must pass penetration tests. Your servers must be located in Indonesia. You can’t use offshore cloud services. OJK requires full control over data flow. If you’re using third-party APIs for trading or wallet services, those providers must also be licensed under the DFA framework.

What Coins Can You Trade?

The new DFA Exchange, a separate body under OJK, now controls which cryptocurrencies can be traded. In April 2025, they released the first official list: 1,444 digital assets. That’s a 70% jump from BAPPEBTI’s last list of 851. Bitcoin, Ethereum, Solana, and Cardano are all included. But so are dozens of lesser-known tokens-each vetted for liquidity, community activity, and technical integrity.

Here’s the catch: even if a coin is on the list, OJK can pull it at any time. If a token shows signs of market manipulation, fraud, or low trading volume, it gets delisted immediately. Exchanges can suggest new coins, but the final call rests with OJK. You can’t list anything without approval. Period.

Compliance Isn’t Optional-It’s Constant

Once you’re licensed, the work doesn’t stop. You’re under 24/7 surveillance. Every trade, every deposit, every withdrawal is monitored. You must report suspicious activity to PPATK, Indonesia’s financial intelligence unit, within 24 hours. Failure to report? That’s a criminal offense.

You also need:

  • A dedicated compliance officer based in Indonesia
  • Quarterly audits of your AML/KYC systems
  • Annual reporting to OJK on transaction volumes, user growth, and risk exposure
  • Real-time dashboards accessible to regulators
OJK can shut you down without warning if they spot repeated violations. In 2025, two platforms lost their licenses for failing to verify 30% of their users. That’s not a fine. That’s a total shutdown.

Marketplace with digital coins and gold bars, giant regulator holding DFA list, delisted tokens popping.

What About Taxes?

On August 1, 2025, Indonesia changed how crypto is taxed. Gone is the 10% VAT on trades. In its place: a flat 0.21% final income tax on every transaction. That’s it. No complex reporting. No income brackets. No deductions. The tax is automatically withheld by the exchange and paid to the government.

This move was designed to remove friction. Before, traders had to file separate tax returns. Now, the system is seamless. It also signals that the government sees crypto as a legitimate financial instrument-not a gray-market gamble.

Who’s Already Licensed?

As of March 2025, only one company holds the new DFA Exchange license. But over 20 platforms still operate under their old BAPPEBTI permits-grace period until July 2025. After that, they all must reapply under OJK rules. The big names you know-Indodax, Tokocrypto, Pintu, Reku-are all working to meet the new standards. Smaller platforms? Many are merging. Others are shutting down.

What’s Next?

OJK is running a regulatory sandbox for fintech startups. If you’re building something new-like tokenized bonds or DeFi lending-this is your chance to test it legally. But you still need to be licensed. The sandbox doesn’t give you a free pass.

Looking ahead, Indonesia will likely align more closely with global standards-FATF guidelines, MiCA-like rules, and cross-border cooperation with ASEAN neighbors. But for now, the message is clear: if you want to operate here, you play by Indonesia’s rules. No shortcuts. No exceptions.

Can foreign companies apply for an Indonesian crypto license?

Yes, but they must register as a PT PMA (foreign investment company) with the Ministry of Investments. All operations, including servers and staff, must be based in Indonesia. Foreign ownership is allowed, but local compliance officers and physical presence are mandatory.

What happens if I don’t reapply by July 2025?

Your existing BAPPEBTI license becomes invalid. You must stop all trading activities immediately. Continuing to operate without an OJK license is illegal and can lead to criminal charges, asset seizures, and fines up to 10 billion rupiah ($600,000 USD).

Can I list a new cryptocurrency without OJK approval?

No. Only assets on the official DFA Exchange list can be traded. You can submit a request for inclusion, but OJK reviews each proposal for risk, liquidity, and compliance. Approval is not guaranteed, and the process takes 60-90 days.

Is there a minimum user requirement to get licensed?

No, there’s no minimum user threshold. But OJK requires proof of operational readiness-meaning you must demonstrate you can handle real trading volume, not just a test environment. Platforms with no users or low activity may be flagged during inspections.

How often does OJK inspect licensed exchanges?

At least once a year, but inspections can happen anytime. OJK uses real-time monitoring tools to track trading patterns. If suspicious activity is detected-like rapid wash trading or unverified deposits-an unscheduled audit is triggered immediately.

Do I need to store user funds in Indonesia?

Yes. All cold wallets and hot wallets holding user assets must be physically located within Indonesia. You cannot use foreign custody providers unless they’re licensed under the DFA framework and approved by OJK.