PSE registration is mandatory for any foreign digital company whose platform Indonesian users can reach, even if the company has no office, staff or legal entity in Indonesia. The duty comes from Ministerial Regulation No. 5 of 2020 on private scope electronic system operators, it has no size threshold, and the ministry was still warning unregistered foreign platforms in June 2026. This guide explains who must register, how registration works, what Komdigi asks for, and what happens if you skip it.
The Ministry Renamed Itself, the PSE Registration Duty Did Not
The ministry that used to be Kominfo is now Komdigi, the Ministry of Communication and Digital Affairs. The rename did not change the registration duty for private companies. Komdigi’s own notices to unregistered platforms in November 2025 and June 2026 still cite Ministerial Regulation No. 5 of 2020 (Permenkominfo 5/2020), which was issued under Government Regulation No. 71 of 2019 on electronic systems and transactions. An amendment in 2021 (Permenkominfo 10/2021) changed the transition deadline for existing operators, not the core duty.
One newer rule causes confusion. Permenkomdigi No. 5 of 2025, in force since 25 March 2025, regulates public scope operators, meaning state institutions and the bodies they appoint. A foreign commercial platform is a private scope operator, so the 2020 regulation is still the one that applies to it.
Who Must Register: Public and Private Scope
Electronic system operators, known as PSE, fall into two groups.
PSE Lingkup Publik
Public scope operators are state institutions or bodies appointed by them. Most foreign companies are not in this group.
PSE Lingkup Privat
Private scope operators are individuals, companies and communities that run an electronic system. The regulation covers, among others, operators with a portal, website or app used to offer or trade goods and services, run financial transactions, deliver digital content, provide communication services or search engines, or process personal data for transactions.
For foreign companies, Article 4 extends the duty to operators established under foreign law or permanently based abroad when any one of three conditions applies:
- they provide services in Indonesia;
- they do business in Indonesia; or
- their electronic system is used or offered in Indonesia.
The regulation text sets no minimum size, revenue or user count. A small SaaS tool and a global platform face the same duty.
Explore Our Services Regulatory Compliance in Indonesia
Registering From Abroad: What the Regulation Requires
Registration is submitted to the minister through the OSS system (Article 3). It must be done before the system starts to be used by users in Indonesia (Article 2).
Foreign operators fill in a registration form with the following (Article 4):
- the identity of the foreign operator and of its leader or responsible person;
- its domicile, or its certificate of incorporation;
- the number of Indonesian users; and
- the value of transactions from Indonesia.
Documents that are not in Indonesian must be translated by a sworn translator.
The regulation does not say that a foreign operator must first set up an Indonesian company, but every private scope operator must appoint a contact person who lives in Indonesia (Article 25, see below). In practice, guides describe getting a business identification number (NIB) in OSS first and then submitting the PSE form. Our guide to OSS RBA registration for foreign companies covers the OSS steps, and what the NIB actually controls once it is issued explains why the NIB matters. Confirm in OSS which account type and business activity code (KBLI) your company can use before you start, and read how primary and secondary KBLI codes work so the code matches what the platform does.
What the PSE Registration Form Asks For
The form is not just an administrative step. It asks you to describe how the system works and to make commitments (Article 3):
- how the system operates, its information security and its personal data protection;
- a commitment to system feasibility testing;
- the system name, sector, URL, domain or IP address, business model and functions;
- the types of personal data processed and where data is stored or processed; and
- a statement that you will give the authorities access to the system and data for supervision and criminal law enforcement.
The last item matters most for foreign operators. Registering also means accepting the content rules in the regulation, including the duty to appoint at least one contact person domiciled in Indonesia to receive access and takedown requests (Article 25). Prohibited content must be taken down within 24 hours of a ministry order, or within 4 hours in urgent cases such as terrorism, child pornography or content that disturbs public order (Articles 14 and 15).
Registration does not replace data protection compliance. Law No. 27 of 2022 on personal data protection applies separately, and its two-year adjustment period ended on 17 October 2024 (Article 74).
What Happens If a Foreign Platform Does Not Register
The sanction for failing to register is access termination, meaning the platform is blocked for users in Indonesia (Article 7). Enforcement has been real, and it comes in rounds:
- July 2022: Kominfo blocked seven unregistered platforms from 30 July 2022, among them Yahoo, Steam and Epic Games. It said access could be restored once the operator registered, and Yahoo and Steam were restored on 2 August 2022.
- November 2025: Komdigi wrote to 25 unregistered private operators, including OpenAI, Cloudflare and Wikimedia Foundation, and said it would apply sanctions up to access termination.
- June to July 2026: Komdigi sent notices on 26 June 2026 to another 25 operators, 15 of them foreign, covering 57 systems, with a deadline of 3 July 2026. Press reports at that time described a warning and possible sanctions, not blocks.
Check the current status before you rely on this list, because enforcement rounds change.
Sector and Tax Layers on Top of PSE Registration
PSE registration is the base layer. Other obligations sit on top, depending on what the platform does.
- E-pharmacy. A platform that sells medicines online to the public must hold a business license as a pharmaceutical electronic system operator, known as a PSEF (BPOM Regulation No. 14 of 2024, Article 6), and PSE registration is listed among the PSEF requirements. See our PSEF license guide.
- VAT on digital services. Collecting VAT on digital sales is a separate tax obligation. Foreign digital providers designated as VAT collectors must file a VAT return for every tax period, due by the end of the following month (PER-12/PJ/2025, Article 13). See our coverage of PER-12/PJ/2025 and VAT on digital services.
- Permanent establishment. Serving Indonesian customers can also raise tax questions that registration does not answer. See Indonesia permanent establishment risk for foreign companies.
PSE Registration Checklist for Foreign Companies
- Confirm that your system is private scope and meets at least one of the three conditions in Article 4.
- Decide which company entity will register, and gather its certificate of incorporation with a sworn translation.
- Prepare the system description: name, URL, business model, data types processed and data location.
- Prepare the personal data protection and information security statements.
- Identify sector licenses and tax obligations that apply on top.
- Appoint a contact person domiciled in Indonesia for access and takedown requests, and put an internal process in place for the 24-hour and 4-hour deadlines.
- After registration, download the signed registration certificate from OSS and keep it on file.
Not sure which step comes first? Our business licensing service covers OSS, NIB and sector licenses, or you can contact XPND’s regulatory team.
