How to Get a Crypto Exchange License in Indonesia: 2026 Requirements

Thinking about launching a crypto platform in Indonesia? You've picked a high-growth market, but the rules of the game changed completely on January 10, 2025. If you're still looking at old guidelines from BAPPEBTI, you're outdated. The Otoritas Jasa Keuangan is Indonesia's Financial Services Authority, which now serves as the primary regulator for all cryptocurrency and digital asset activities. This shift isn't just a change in name; it's a total overhaul of how you get licensed and stay compliant.

The Fast Facts: What You Need to Know Now

Before we get into the weeds, here is the reality of the current landscape. To operate legally, you aren't just opening an "exchange"-you are applying to be a Digital Financial Asset (DFA) Trading Provider. The barriers to entry are high, designed to keep out small-time operators and ensure only financially stable companies handle public funds.

The New Regulatory Framework: From BAPPEBTI to OJK

For years, the commodity futures regulator (BAPPEBTI) handled crypto. That ended with the introduction of the DFA Framework under POJK 27/2024. This new structure treats crypto not as a commodity, but as a digital financial asset. This is a massive distinction because it integrates crypto into the broader financial system, giving the OJK much more power to oversee market stability.

If you already had a license under the old regime, you weren't immediately kicked out, but you were put on a clock. Companies had until the July 2025 grace period to reapply and prove they meet the new OJK standards. If you're starting from scratch today, you're entering a system that is far more professionalized and rigorous than it was three years ago.

Step-by-Step Guide to the Licensing Process

Getting your license isn't as simple as filling out a web form. It's a multi-month marathon of legal and technical scrutiny. Here is the exact path you need to follow:

1. Company Registration: You must first register your business in Indonesia through the Ministry of Investments. Most foreign investors use the PT PMA designation, which allows for foreign equity allocation.
2. Documentation Gathering: This is where most applicants stall. You need your company statutes, a detailed governance framework, and clear proof of your 100 billion IDR paid-up capital.
3. Technical Submission: You have to submit a full information security schema. This means detailing your cryptographic protocols, the specific algorithms you use for encryption, and how your KYC (Know Your Customer) systems actually work.
4. Regulatory Inspection: Once your papers are in, the OJK doesn't just take your word for it. They conduct inspections to verify that your operational scope matches your application.
5. License Issuance: After the review of your beneficial owners' reputations and technical audits, the OJK issues the final license.

Pro tip: Every single document must be translated into Indonesian and legally authenticated. Don't leave this until the last minute, as a translation error can trigger a request for clarification that pushes your timeline back by weeks.

The DFA Exchange: Who Decides What You Trade?

In the old days, exchanges had a bit more leeway with asset listings. Now, there is a central authority called the DFA Exchange. This entity is the gatekeeper. They evaluate and issue the official list of tradable crypto assets. If a coin isn't on the DFA list, you can't trade it legally in Indonesia.

The market has opened up significantly, though. In April 2025, the first official list grew to 1,444 assets-nearly double what the previous regulator allowed. While the DFA Exchange reviews this list quarterly, keep in mind that the OJK can still step in and ban a specific asset overnight if they deem it a risk to consumers. As a trader, you can suggest new coins for the list, but the power remains firmly with the regulator.

Staying Compliant: AML, KYC, and Monitoring

Once you have the license, the hard work begins. You are now an arm of the state's financial surveillance. Under SEOJK No. 20 of 2024, compliance isn't optional; it's a daily operational requirement.

You must maintain a direct pipeline to the PPATK (Indonesia's Financial Transaction Reports and Analysis Center). Any suspicious transaction-no matter how small-must be reported. The OJK now has real-time monitoring capabilities, meaning they can see transaction patterns as they happen. If you're caught ignoring AML (Anti-Money Laundering) protocols, the consequences are swift: financial penalties, immediate asset delisting, or the total revocation of your license.

The New Tax Landscape

The tax burden for users and providers changed drastically on August 1, 2025, with the implementation of MOF Regulation No. 50/2025. Previously, crypto was treated like a taxable good. Now, it's viewed as a digital financial instrument.

• VAT Removal: Value Added Tax (VAT) on crypto transactions has been eliminated, making the market much more attractive for high-volume traders.
• Income Tax: A final income tax rate of 0.21% is now applied to transactions.

For an exchange operator, this simplifies the administrative side of tax collection and reporting, but it requires your software to be perfectly aligned with these specific rates to avoid audit failures.

Technical Safeguards and the Regulatory Sandbox

The OJK is obsessed with security-and for good reason. Your platform must demonstrate "institutional-grade" security. This includes not just cold storage, but detailed schemas on how you handle private keys and how your internal APIs are secured.

If you're developing a truly novel piece of fintech-maybe a new type of automated liquidity provision or a unique staking mechanism-you don't have to launch it into the wild immediately. The OJK offers a regulatory sandbox. This is a controlled environment where you can test your innovation under the eyes of the regulator. It's the safest way to innovate without risking your primary license.

Next Steps for Operators

If you are a startup and can't hit the 100 billion IDR capital requirement on your own, your best bet is a strategic partnership or joint venture with an existing local player. Many of the top platforms like Indodax or Tokocrypto have already navigated these waters and are the benchmark for what the OJK expects.

For established firms, the priority should be a gap analysis of your current KYC/AML software against the requirements of SEOJK No. 20 of 2024. If your reporting to the PPATK isn't automated and real-time, you are a liability to your own business.