When Indonesia switched its crypto regulator from BAPPEBTI to the Otoritas Jasa Keuangan (OJK) on January 10, 2025, it didn’t just change a name-it rewrote the rules for everyone trading digital assets in the country. If you’re running or planning to launch a crypto exchange in Indonesia, you’re now operating under a far stricter, more complex system called the Digital Financial Assets (DFA) Framework under POJK 27/2024. This isn’t a minor update. It’s a full overhaul designed to protect investors, shut down shady operators, and position Indonesia as a serious player in Southeast Asia’s digital finance scene.
Who Needs a License and What’s Changed?
Under the old system, crypto platforms were called exchanges and reported to BAPPEBTI. Now, they’re officially Digital Financial Asset Trading Providers. The term "exchange" is reserved for one single entity-the DFA Exchange Authority-that controls which assets can be traded. All other platforms are traders, not marketplaces. This distinction matters because it centralizes control over asset listings and removes ambiguity about who’s responsible for what.If you were already licensed under BAPPEBTI before January 2025, you’re not automatically grandfathered in. You have until July 2025 to reapply under the new DFA rules. Miss the deadline, and your license expires. No extensions. No exceptions. That’s how serious OJK is about compliance.
Capital Requirements: It’s Not Just a Suggestion
The financial bar is high-and it’s not going down. To get licensed, you need:- 100 billion Indonesian rupiah (about $6 million USD) in paid-up capital
- 50 billion rupiah (about $3 million USD) in minimum equity
These numbers haven’t changed from the old BAPPEBTI rules, but now they’re enforced with real consequences. OJK doesn’t just ask for proof-you have to show it’s locked in a local bank account, audited, and tied to your legal entity. No offshore funding. No shell companies. No creative accounting.
This effectively blocks small startups and fly-by-night operators. Only well-funded companies with real backing can enter. That’s intentional. OJK wants platforms that can absorb losses, survive market crashes, and handle regulatory audits without collapsing.
The Licensing Process: Five Steps, No Shortcuts
Getting licensed isn’t a form you fill out online. It’s a multi-month legal and technical marathon:- Register your company in Indonesia through the Ministry of Investments website. You’ll need to set up a PT PMA (foreign investment limited liability company) if you’re not Indonesian-owned.
- Gather documents-this includes articles of association, proof of capital, beneficial owner profiles, governance structure, operational manuals, and detailed cybersecurity plans.
- Submit everything to OJK in Indonesian. All documents must be translated by a certified translator and notarized.
- Undergo inspection. OJK sends auditors to review your physical and digital infrastructure. They’ll test your KYC system, check your server security, and verify that your AML protocols actually work.
- Receive approval. Only after all checks pass will you get your license. The entire process can take 4 to 8 months.
There’s no fast-track option. Even big players like Indodax and Tokocrypto had to go through this. If your KYC system can’t verify a user’s ID with a live selfie and government document match, you won’t pass. If your server logs aren’t encrypted and stored for 5 years, you won’t pass. If your beneficial owners have any past financial violations, you won’t pass.
Asset Listing: One Authority, One List
Before 2025, each exchange picked its own coins and tokens. Now, only the DFA Exchange Authority can approve what’s tradable. The first official list, released in April 2025, included 1,444 digital assets-up from 851 under BAPPEBTI. That’s a 70% increase, but don’t assume it’s a free-for-all.Every asset on the list had to pass a rigorous review for technical security, liquidity, team transparency, and legal standing. OJK doesn’t just look at the coin-it looks at the team behind it, the whitepaper, the smart contract audits, and whether it’s been flagged elsewhere globally.
Trading platforms can suggest new assets, but the final call is OJK’s. And if OJK decides a coin is risky-say, a new meme token with no real utility or a token linked to a sanctioned entity-they can remove it immediately. You don’t get to argue. You just stop trading it.
Compliance: KYC, AML, and Real-Time Monitoring
You can’t just collect IDs and call it a day. Under SEOJK No. 20 of 2024, you must implement:- Real-time KYC verification using biometric matching (face + ID document)
- Automated AML screening that flags suspicious transactions (large transfers, rapid deposits/withdrawals, layered trading)
- Direct reporting to PPATK (Indonesia’s Financial Transaction Reports and Analysis Center) for all flagged activity
- Secure, encrypted logs of every transaction, stored for at least five years
OJK doesn’t wait for complaints. They monitor trading activity in real time. If they see patterns that look like money laundering or market manipulation, they can freeze accounts, halt trading, or shut down your platform-within hours.
Non-compliance isn’t just a fine. It’s license revocation, criminal charges, and asset seizure. In 2025, two platforms were shut down for failing to report suspicious transactions. Their founders were barred from ever working in Indonesia’s financial sector again.
Taxes: Simpler, But Still Mandatory
As of August 1, 2025, Indonesia changed how crypto is taxed. The old VAT on crypto trades? Gone. Now, there’s a flat 0.21% final income tax on every transaction-buy, sell, or trade. It’s automatically calculated and withheld by the exchange. You don’t need to file separate tax returns.This is a huge shift. Before, crypto was treated like goods-subject to VAT and complex reporting. Now, it’s treated like a financial instrument. The goal? Reduce administrative burden and make compliance easier. But don’t think it’s a loophole. The tax is mandatory, tracked, and reported to the Ministry of Finance. Avoiding it is now a criminal offense.
What Happens If You Don’t Comply?
The penalties aren’t warnings-they’re endings.- License revoked
- Assets frozen or seized
- Trading banned for all users on your platform
- Founders and executives banned from financial services in Indonesia
- Criminal prosecution under Indonesia’s Financial Services Law
There’s no "first offense" rule. OJK operates on zero tolerance. Even a single failure in KYC or a missed PPATK report can trigger an audit that ends your business.
Who’s Already Licensed?
As of March 2025, OJK has granted one official DFA Exchange license (the central asset listing body). But over 20 platforms still operate under their old BAPPEBTI licenses while they reapply. Major names include:- Indodax
- Tokocrypto
- Pintu
- Reku
These companies spent millions upgrading their systems, hiring compliance officers, and restructuring ownership to meet the new rules. Smaller exchanges either merged with bigger ones or shut down.
The Future: Innovation Within Bounds
OJK isn’t just cracking down-it’s also creating space for innovation. The regulatory sandbox lets licensed platforms test new products like crypto-backed loans, staking services, or tokenized assets-under supervision. But you can’t just launch anything. Every test must be approved, limited in scale, and monitored for consumer risk.Indonesia’s goal is clear: become a regional crypto hub, but not a Wild West. The rules are tight, the oversight is real, and the cost of entry is high. But for those who make it through, the payoff is legitimacy, investor trust, and long-term growth in one of the world’s fastest-growing digital economies.
What You Need to Do Now
If you’re operating in Indonesia:- Check if your license is still valid under OJK’s new system
- Start gathering documents for reapplication-translation and notarization take time
- Upgrade your KYC/AML systems to meet real-time monitoring standards
- Confirm your capital is in a local Indonesian bank account
- Prepare for a 4-8 month review process
If you’re thinking of launching a new exchange: walk away unless you have at least $9 million in ready capital and a team that understands Indonesian financial law. This isn’t a startup playground. It’s a regulated financial market-and OJK is the sheriff.
Do I need to be an Indonesian citizen to run a crypto exchange in Indonesia?
No, you don’t need to be a citizen, but you must register as a foreign-invested company (PT PMA). Foreign ownership is allowed, but all operations, capital, and compliance must be based in Indonesia. You’ll need local legal representation, an Indonesian bank account, and a local address for official correspondence.
Can I still list new cryptocurrencies after getting licensed?
No, not directly. Only the DFA Exchange Authority can approve which assets are tradable. You can submit suggestions, but the final decision rests with OJK. Your platform can only trade assets on the official list. If you try to list something not approved, your license will be revoked.
What happens if my exchange gets hacked?
You’re required to have cyber insurance and proof of secure infrastructure. If a hack occurs, you must report it to OJK and PPATK within 24 hours. Failure to report can lead to license suspension. OJK will investigate whether your security measures met regulatory standards. If they didn’t, you could face fines, asset freezes, or revocation-even if you weren’t at fault.
Is staking or yield farming allowed under the new rules?
Not yet, unless you’re in OJK’s regulatory sandbox. General staking services aren’t permitted on licensed platforms as of 2026. OJK considers them high-risk and unregulated. If you want to offer staking, you must apply for sandbox approval, prove your model is secure, and limit participation to verified institutional users.
How often does OJK review licensed exchanges?
OJK conducts mandatory annual audits and can perform surprise inspections at any time. Real-time transaction monitoring is continuous. If your platform shows unusual activity-like sudden spikes in withdrawals or KYC failures-you’ll be flagged immediately. Compliance isn’t a one-time check-it’s an ongoing obligation.
