Indonesian Crypto Exchange Licensing Requirements: OJK Rules for 2026

Running a cryptocurrency business in Indonesia is no longer about hiding in the shadows or operating on borrowed time. Since early 2025, the regulatory landscape has shifted dramatically. If you are looking to launch a crypto platform or expand an existing one into this Southeast Asian market, you need to understand that the old rules are gone. The Otoritas Jasa Keuangan (OJK) is now the primary regulator, having taken over from BAPPEBTI. This change introduced the Digital Financial Assets (DFA) framework under POJK 27/2024, which fundamentally reshapes how crypto businesses operate.

This isn't just bureaucratic shuffling. It means stricter oversight, higher capital requirements, and a new way of thinking about what a 'crypto exchange' actually is. For many founders, the path to compliance feels steep, but it also offers legal certainty and access to a massive, tech-savvy population. Here is exactly what you need to know to get licensed and stay compliant in 2026.

The New Regulatory Landscape: OJK Takes Charge

On January 10, 2025, the baton was passed. The Otoritas Jasa Keuangan (Financial Services Authority), commonly known as OJK, replaced BAPPEBTI as the main authority overseeing digital assets. This transition was not minor; it redefined the entire industry structure. Under the previous regime, platforms were loosely regulated. Now, they fall under the strict purview of financial services law.

The core concept here is the Digital Financial Asset (DFA) framework. In this new world, your platform is not called an 'exchange' in the traditional sense. Instead, you apply to become a DFA Trading Provider. The term 'exchange' is reserved for the entities that oversee the broader ecosystem, specifically the DFA Exchange. This distinction matters because it changes your reporting lines, your compliance obligations, and how you interact with the government.

If you were already licensed under BAPPEBTI before the switch, you got a grace period until July 2025 to fully comply with the new OJK standards. That deadline has passed. Any platform operating today must meet the current OJK criteria, or face immediate sanctions. For new entrants, there is no grace period-you must start from scratch with the full set of requirements.

Capital Requirements: The Barrier to Entry

Let’s talk money, because this is where most startups hit a wall. The Indonesian regulators want to ensure that only serious, well-capitalized players enter the market. They are trying to prevent the kind of instability seen in other jurisdictions where underfunded exchanges collapsed, taking user funds with them.

To get your license, you need to prove you have substantial financial backing. The requirements are non-negotiable:

• Paid-up Capital: You must have at least 100 billion rupiah (approximately US$6 million). This cash needs to be in the bank, verified, and available. It is not a projection; it is a requirement.
• Minimum Equity: On top of that, you need 50 billion rupiah (approximately US$3 million) in minimum equity.

These figures were retained from the BAPPEBTI era but are now enforced with much greater scrutiny by OJK. Why so high? Because these funds act as a buffer against operational risks and potential losses. For smaller operators, this often means seeking strategic partnerships, joint ventures, or significant venture capital injection before even starting the application process. You cannot bootstrap a licensed crypto exchange in Indonesia anymore.

Step-by-Step Licensing Process

Getting the license is not a simple form submission. It is a multi-stage process that can take several months. You need to be prepared for intense scrutiny at every step. Here is the roadmap:

1. Company Registration: First, you must establish a legal entity in Indonesia. Most foreign investors use the PT PMA (Penanaman Modal Asing) designation, which allows for foreign equity allocation. You register this through the Ministry of Investments website.
2. Document Collection: Gather everything. This includes detailed beneficial owner information, comprehensive company statutes, your governance framework, and proof of your operational scope. Every document must be translated into Indonesian and legally authenticated. Do not underestimate the translation work; errors here cause delays.
3. Application Submission: Submit your full dossier to OJK. This includes technical schemas showing your security measures, your KYC systems, and your AML mechanisms.
4. Regulatory Inspection: OJK will review your documents and likely conduct inspections. They look at your technology, your team, and your financial health. They check the reputation of your beneficial owners rigorously.
5. License Issuance: If you pass all checks, you receive your license as a DFA Trading Provider.

During the inspection phase, expect questions about your cryptographic protocols, your data storage methods, and how you handle customer disputes. The regulators are looking for robustness, not just compliance on paper.

Technical and Security Standards

In the digital asset world, trust is built on code and security. OJK knows this, which is why the technical requirements are stringent. You aren't just proving you have money; you are proving you can keep users safe.

Your application must include detailed information security schemas. This means documenting your:

• Cryptographic protocols used for securing transactions and data.
• Algorithms employed for matching orders and managing liquidity.
• Know Your Customer (KYC) systems that verify user identities thoroughly.
• Anti-Money Laundering (AML) mechanisms that detect suspicious activity in real-time.

OJK has established real-time transaction monitoring capabilities. They don't just audit you once a year; they can monitor your platform continuously. This collaboration with PPATK (the Financial Transaction Reports and Analysis Center) means that if fraud or market abuse occurs, authorities can react quickly. For operators, this means your tech stack must be transparent enough to allow for oversight but secure enough to protect user data. It is a delicate balance.

Asset Listing and the DFA Exchange

One of the biggest changes under OJK is who decides which cryptocurrencies you can trade. Previously, BAPPEBTI maintained a whitelist. Now, the newly established DFA Exchange holds this power. This body evaluates and issues the list of tradable crypto assets.

In April 2025, the first official DFA list was released, featuring 1,444 crypto assets. This was a massive jump from the previous 851 assets, showing Indonesia's intent to be inclusive while maintaining quality control. However, this list is not static. The DFA Exchange reviews it quarterly. As a trader, you can submit suggestions for adding or removing assets, but the final call rests with OJK.

Be aware that OJK retains the ultimate authority to prohibit specific digital assets or order traders to cease trading certain cryptocurrencies if they deem them risky. This means your product roadmap must be flexible. You might build support for a token, only to find it gets delisted from the national registry. Always check the latest DFA list before integrating new pairs.

Taxation Changes in 2025

Regulation isn't just about licenses; it's also about taxes. Effective August 1, 2025, Indonesia implemented MOF Regulation No. 50/2025, which changed how crypto transactions are taxed. This is good news for clarity, if not necessarily for the bottom line.

The key changes are:

• No VAT: Value Added Tax has been eliminated on crypto-asset transactions. This simplifies accounting significantly, as you no longer need to track and remit VAT on trades.
• Final Income Tax: A flat final income tax rate of 0.21% applies to crypto transactions.

This shift treats crypto assets more like digital financial instruments rather than taxable goods. For your platform, this means you need to update your backend systems to automatically calculate and withhold this 0.21% tax where applicable, or ensure your users are correctly reporting it. The regulation aims to streamline administrative procedures, making it easier for both the government and the businesses to manage tax collection.

Compliance and Penalties

Once you have your license, the hard work continues. Compliance is ongoing. Under SEOJK No. 20 of 2024, licensed operators must adhere to strict AML and KYC obligations. You must report suspicious transactions to PPATK immediately. Failure to do so can result in severe consequences.

What happens if you slip up? The penalties are harsh. OJK can revoke your license, impose heavy financial fines, force the delisting of assets, or even pursue criminal charges against executives. Given the high capital requirements, losing your license is effectively the death of your business in Indonesia. Therefore, investing in a strong compliance team is not optional; it is essential for survival.

Major players like Indodax, Tokocrypto, Pintu, and Reku have already navigated this transition. Their success provides a blueprint, but remember that the market is competitive. The regulatory sandbox offered by OJK allows you to test new technologies, but you must still maintain full compliance with security and consumer protection standards during testing.

Strategic Advice for New Entrants

If you are planning to enter the Indonesian market in 2026, here is my advice. First, secure your funding early. The $9 million total capital requirement (paid-up plus equity) is a hard filter. Second, hire local legal counsel who specializes in OJK regulations. The nuances of PT PMA registration and document authentication are easy to mess up. Third, build your tech stack with transparency in mind. OJK wants visibility. Design your systems to facilitate audits and real-time monitoring from day one.

Finally, stay agile. The DFA list changes quarterly. Tax laws may evolve. The regulatory framework is designed to be responsive to market innovations. By staying close to OJK announcements and engaging with the regulatory sandbox, you can position your business as a leader in this growing Southeast Asian hub. The barriers are high, but the reward is access to one of the most dynamic crypto markets in the region.