Indonesian Crypto Exchange Licensing Requirements in 2025

Indonesia’s crypto scene has turned into a regulatory headline after a sweeping overhaul in early 2025. If you’re eyeing the market, you need to know exactly what the new licensing regime demands, how much capital you must lock up, and which compliance hoops you’ll jump through. This guide walks you through every step, from forming a legal entity to handling taxes, so you can decide whether to launch, partner, or wait.

What changed on January102025?

On that date, Otoritas Jasa Keuangan (OJK) replaced BAPPEBTI as Indonesia’s primary crypto regulator. The shift introduced the Digital Financial Assets (DFA) framework under POJK 27/2024. The new law re‑classifies platforms as Digital Financial Asset Trading Providers and creates a dedicated DFA Exchange Authority for asset listings.

Capital thresholds you can’t ignore

The DFA framework kept the hefty financial bar set by BAPPEBTI: at least 100billion rupiah (≈US$6million) in paid‑up capital and 50billion rupiah (≈US$3million) in equity. Those numbers are not negotiable and are meant to filter out under‑capitalized players. For comparison, here’s a quick side‑by‑side look at the old and new regimes:

Step‑by‑step licensing process

Getting the green light involves five critical steps. Skipping any of them will delay or kill your application.

1. Company registration: Use the Ministry of Investments portal to set up a PTPMA (foreign‑owned PT) or a domestic PT, depending on your ownership structure.
2. Document collection: Gather the full suite-beneficial‑owner IDs, statutes, governance charter, proof of capital, and a detailed info‑security schema covering cryptographic protocols, KYC, and AML workflows.
3. Application submission: Upload all documents (translated into Indonesian and notarized) through OJK’s DFA Licensing portal. Include a technical whitepaper that outlines your platform’s architecture, encryption standards, and transaction‑monitoring engine.
4. Regulatory inspection: OJK conducts on‑site and remote audits. Expect questions about your key‑management process, incident‑response plan, and how you’ll report suspicious activity to PPATK (the Financial Transaction Reports and Analysis Center).
5. License issuance: Once approved, you’ll receive a DFA Trading Provider license valid for three years, after which a renewal audit is mandatory.

Typical review time ranges from three to six months, depending on how clean your documentation is and the reputation of your beneficial owners.

Compliance obligations that keep you on your toes

The DFA framework leans heavily on SEOJK No.20 of2024, mandating robust AML/KYC programs. Key duties include:

• Real‑time transaction monitoring with automated alerts for thresholds set by OJK.
• Monthly suspicious‑activity reports filed with PPATK.
• Quarterly asset‑listing reviews with the DFA Exchange Authority; the list grew from 851 to 1,444 assets in April2025, showing OJK’s appetite for broader adoption.
• Immediate cessation orders for any crypto that OJK deems high‑risk.

Non‑compliance can result in license revocation, heavy fines (up to 10% of annual turnover), asset delisting, and even criminal prosecution for senior management.

Taxation under the new MOF Regulation No.50/2025

Effective August12025, MOF Regulation No.50/2025 removed VAT from crypto‑asset trades and set a flat final income tax of 0.21% on transaction value. The shift treats crypto as a digital financial instrument rather than a taxable good, simplifying filing for both exchanges and individual traders. You’ll need to integrate tax‑calculation modules into your platform to automatically deduct and remit the 0.21% fee to the tax authority.

Technical and security standards you must meet

OJK’s supervision framework expects a multi‑layered security posture:

• Cryptographic protocols: Use industry‑grade algorithms such as AES‑256 for data at rest and ECDSA‑secp256k1 for transaction signing.
• Secure key management: Hardware Security Modules (HSMs) are mandatory for private‑key storage.
• Customer identification: Multi‑factor KYC (ID scan, facial recognition, and proof of address) with real‑time verification.
• AML engine: Rule‑based and AI‑enhanced monitoring to flag structuring, rapid turnover, and cross‑border transfers.
• Regulatory sandbox: OJK offers a sandbox environment where you can test novel features (e.g., DeFi lending) before full rollout, provided you keep the sandbox‑specific risk‑mitigation plan updated.

Industry response and market outlook

By March2025, OJK had granted one DFA Exchange license and over 20 trading platforms-including Indodax, Tokocrypto, Pintu, and Reku-the chance to operate under the new regime. Smaller startups are looking at joint‑ventures or acquisition routes to meet the capital bar. The upside? A clearer legal framework, stronger consumer confidence, and a path toward becoming Southeast Asia’s crypto hub.

Future tweaks are expected. OJK plans quarterly revisions of the DFA asset list, and experts predict tighter AML thresholds as global pressure rises. Staying agile-especially in compliance tech-will be key to thriving.

Quick checklist before you submit

• Form a PTPMA or local PT and register via the Ministry of Investments.
• Secure 100bnIDR paid‑up capital and 50bnIDR equity.
• Prepare a full info‑security schema (AES‑256, HSM, KYC workflow).
• Translate and notarize all documents in Indonesian.
• Integrate 0.21% transaction tax module.
• Set up real‑time AML monitoring and PPATK reporting pipeline.
• Plan for quarterly asset‑list updates with the DFA Exchange Authority.