Fintech Licensing in Indonesia: What Foreign Companies Need to Know

Your fintech product is ready. The business case for Indonesia makes sense on paper: 278 million people, digital adoption that accelerated sharply post-pandemic, and a financial literacy index that climbed from 38% in 2019 to 65.43% in 2024. The question is not whether the market is worth entering. The question is how to enter it correctly, and in what sequence.

This is where many foreign fintech companies lose time. They underestimate how much of the entry process happens before a single license application is submitted. Entity structure, capital planning, regulatory classification, and governance setup all need to be in place first. Getting any one of these wrong creates delays that compound quickly, and in a market moving as fast as Indonesia’s, delays have a real cost.

The sections below walk through what the licensing landscape looks like today, what Indonesia actually requires from a foreign company before it can operate, and where the most common missteps happen.

Two Regulators, One Market

The first thing to understand about fintech licensing in Indonesia is that there is no single authority that covers everything. Two institutions divide the regulatory space, and your business model determines which one, or which combination, you will need to work with.

Bank Indonesia (BI) handles payment system activities. If your product involves moving money, processing transactions, running digital wallets, or operating payment infrastructure, BI is your primary regulator. The core frameworks here are BI Regulation No. 23/6/PBI/2021 on Payment System Providers and BI Regulation No. 22/23/PBI/2020 on Payment Systems.

The Financial Services Authority (Otoritas Jasa Keuangan or OJK) covers everything else, including banks, capital markets, insurance, and the broader category now known as Financial Sector Technological Innovation (Inovasi Teknologi Sektor Keuangan or ITSK). For most fintech models outside payments, OJK is the licensing authority you will be dealing with.

There is also a third name that comes up frequently in older research: the Commodity Futures Trading Regulatory Agency (Badan Pengawas Perdagangan Berjangka Komoditi or Bappebti). Bappebti previously oversaw crypto assets, but as of January 2025, that authority transferred fully to OJK under Law No. 4 of 2023 on the Development and Strengthening of the Financial Sector (Undang-Undang Pengembangan dan Penguatan Sektor Keuangan or P2SK Law). If your team has been referencing pre-2024 frameworks for crypto, those documents are now outdated.

What Changed in 2023 and 2024

Indonesia’s fintech regulatory landscape went through a significant overhaul in the past two years, and understanding what changed matters for any foreign company planning to enter now.

The P2SK Law of 2023 was the catalyst. It consolidated regulatory authority, introduced ITSK as a formal category, and directed OJK to build sector-specific licensing regimes for each fintech business model. The most direct result for foreign companies was OJK Regulation No. 3 of 2024 on the Implementation of ITSK, which replaced the Digital Financial Innovation framework that had been in place since 2018.

The new framework expanded the list of recognised fintech business models, changed the licensing process, and introduced clearer rules around ownership and governance. At the end of 2024, OJK followed this with Regulation No. 40 of 2024, which overhauled peer-to-peer (P2P) lending rules, and Regulation No. 27 of 2024, which established the framework for digital financial asset trading after the crypto oversight shift from Bappebti. 

In early 2025, OJK Regulation No. 4 of 2025 then introduced the first dedicated licensing framework for financial services aggregators, which are platforms that collect and compare financial product information for consumers.

What this means practically is that research done even 18 months ago may no longer reflect current requirements. The regulatory floor has moved, and the implications for foreign entrants, particularly around ownership structure and capital thresholds, are material.

Which Activities Require a License

One of the first questions foreign fintech teams ask is whether their specific product actually falls under Indonesian licensing requirements. The answer depends on what the product does, not what it is called.

Under OJK Regulation No. 3 of 2024, the following activities fall under the ITSK classification and require a license from OJK:

• Transaction settlement for securities, including clearing, recording, and custody in money and capital markets
• Capital raising, including equity crowdfunding and smart contract-based instruments
• Investment management using advanced algorithms, such as robo-advisory services, digital financial planning, and retail algorithmic trading
• Risk management activities related to product development and underwriting
• Fundraising and fund disbursement, such as P2P lending and financing agent models
• Market support activities including credit scoring, financial product aggregation, and digital Know Your Customer (KYC) using AI or big data
• Activities related to digital financial assets, including crypto assets

Payment activities sit under BI’s separate framework. If your business model spans both categories, you may need to engage both regulators, each with its own licensing process and timeline.

Before You Apply for a License: The Entity Question

Indonesian law requires that any entity applying for a fintech operating license, whether an ITSK license from OJK or a payment system license from BI, must be incorporated under Indonesian law. You cannot hold a license as a foreign parent company. You cannot operate through a representative office. The license must be held by a locally incorporated legal entity.

For foreign companies, this almost always means establishing a Foreign Investment Company (Perusahaan Terbatas Penanaman Modal Asing or PT PMA). A PT PMA is the standard legal vehicle for foreign direct investment in Indonesia. It is the entity that can hold sector-specific licenses, enter commercial contracts, hire employees, and operate at scale.

Getting the PT PMA set up correctly from the start matters more in fintech than in many other sectors, because your KBLI classification, your capital structure, and your shareholder composition all feed directly into your licensing eligibility. A structure that looks clean from a general incorporation standpoint may create problems the moment you try to apply for an OJK license. This is why the incorporation stage is not just an administrative step. It is a strategic decision.

It is also worth being clear about what a Representative Office (Kantor Perwakilan Perusahaan Asing or KPPA) can and cannot do. A KPPA cannot hold a commercial license, cannot issue invoices, and cannot generate revenue. It is a presence structure designed for market research and coordination, not for operating a regulated financial product. Some foreign companies choose a KPPA as a lighter first step, only to discover it cannot serve as the license-holding entity. If you are considering this route, make sure you understand its limitations before committing to that structure.

XPND handles PT PMA incorporation end-to-end, including capital planning, KBLI classification, OSS-RBA registration, and compliance with the latest requirements under BKPM Regulation No. 5 of 2025. You can read more on our PT PMA (Foreign Investment Company) service page.

Explore Our Services Establish Your PT PMA in Indonesia

Foreign Ownership Limits You Need to Know

Establishing a PT PMA does not automatically mean you can hold 100% of the shares. For most general business sectors, full foreign ownership is permitted. For specific fintech categories, ownership caps apply, and these need to be built into your shareholder structure at incorporation, not adjusted afterwards.

For P2P lending, OJK Regulation No. 40 of 2024 caps foreign ownership at 85%, meaning at least 15% must be held by Indonesian shareholders. For financial services aggregators, OJK Regulation No. 4 of 2025 introduced ownership and governance requirements that align with the broader ITSK framework under OJK Regulation No. 3 of 2024. For digital financial asset platforms, OJK Regulation No. 27 of 2024 sets its own licensing and governance requirements following the crypto oversight transfer from Bappebti.

Getting the ownership structure right before you incorporate is one of the most consequential decisions in the entire entry process. If you are unsure how the caps apply to your specific business model, this is the right moment to work through it with an advisor, before the company exists on paper, not after.

Capital Requirements by Segment

Capital adequacy is closely tied to licensing eligibility, and the requirements vary significantly by fintech category:

The sector-specific thresholds almost always supersede the general PT PMA minimum. A P2P lending company needs IDR 25 billion at establishment, not IDR 2.5 billion, and that distinction catches more than a few foreign companies off guard during planning.

Capital planning also matters beyond the incorporation stage. Under BKPM Regulation No. 5 of 2025, newly incorporated PT PMAs are subject to a 12-month capital lock-up period. Your capital cannot simply sit idle in a company account. It needs to be productively allocated while remaining compliant with investment realization requirements and LKPM (Laporan Kegiatan Penanaman Modal or Investment Activity Report) reporting obligations. XPND helps clients plan this allocation strategy from day one, covering operational funding, asset acquisition, and expenditure documentation for audit and reporting purposes.

The ITSK Licensing Pathway

Once your PT PMA is incorporated and your capital structure is in order, the ITSK licensing process under OJK Regulation No. 3 of 2024 moves through three stages.

The first is the regulatory sandbox, OJK’s supervised testing environment where your business model, risk management framework, consumer protection mechanisms, and data governance approach are evaluated. The sandbox is not a formality. It is a substantive review that typically takes several months and requires detailed documentation. OJK issues one of three outcomes at the end of the period: a recommendation to proceed, a request for further development, or rejection.

Companies that receive a positive recommendation then enter the second stage: registration as an ITSK provider. You have six months from the date of the recommendation to submit this application. Registration formally establishes you within OJK’s supervisory framework and confirms that your business model has cleared the core regulatory review, though it is not yet a full operating license.

The third and final stage is the full license application, where OJK evaluates your compliance capacity, governance structure, capital adequacy, and operational readiness on an ongoing basis. Only licensed ITSK providers can operate commercially at scale in Indonesia.

The total timeline from PT PMA incorporation to a full ITSK license realistically runs between 12 and 18 months for most foreign entrants. Building your compliance infrastructure in parallel with the licensing process, rather than after it, is one of the more impactful ways to keep that timeline from stretching further.

What Happens After You Are Licensed

Getting licensed does not end your compliance obligations. It marks the beginning of an ongoing reporting cycle that needs to be built into your operational structure well before your first license is issued.

As a PT PMA, you are required to submit quarterly Investment Activity Reports to the Ministry of Investment, tracking capital realization against the investment plan submitted at incorporation. This alone is a standing obligation that runs from day one of your company’s existence, regardless of whether your license has been issued yet.

On top of that, licensed fintech operators carry periodic reporting obligations to OJK and, where applicable, BI, covering financial position, operational metrics, and compliance status. Annual general meeting documentation, tax filing, and corporate secretary obligations also run continuously throughout the year.

These are not tasks that can be handled ad hoc. XPND’s Business Process Outsourcing (BPO) services cover tax compliance and corporate secretary functions specifically for foreign-owned companies operating in Indonesia, so that your team can focus on running the business rather than managing the administrative layer underneath it.

Bringing Foreign Staff Into Your Indonesian Entity

For most foreign fintech companies, placing foreign professionals into the local entity runs as a parallel process to the corporate and licensing setup. Directors, technical leads, and senior consultants all need proper immigration documentation before they can work in Indonesia.

Foreign employees need a Work Permit (Izin Mempekerjakan Tenaga Kerja Asing or IMTA) and a Temporary Stay Permit (Kartu Izin Tinggal Terbatas or KITAS). For investor-level positions, an Investor KITAS requires a minimum capital commitment of IDR 10 billion. There are also segment-specific restrictions to be aware of: under OJK Regulation No. 4 of 2025, foreign workers in licensed aggregator companies may only serve one level below the Board of Directors or in an expert or consultant capacity, with terms limited to three years per appointment.

XPND handles the full KITAS and Work Permit (IMTA) process, including Foreign Worker Utilization Plan (Rencana Penggunaan Tenaga Kerja Asing or RPTKA) preparation, IMTA application, and KITAS processing. If you want to understand how the two-stage work permit process works before you start, our guide on RPTKA vs IMTA covers this in detail.

Explore Our Services Immigration Services

Common Mistakes That Cost Foreign Fintech Companies Time

Most of the problems foreign fintech companies run into in Indonesia are not caused by the regulations being unclear. They are caused by decisions made too early, before the full picture was understood.

Incorporating with the wrong KBLI classification is one of the most common. The Standard Classification of Indonesian Business Fields (Klasifikasi Baku Lapangan Usaha Indonesia or KBLI) code you register under determines your licensing pathway, your tax obligations, and your ownership eligibility. Getting this wrong at incorporation creates problems that are expensive and time-consuming to fix.

Treating the Representative Office as a stepping stone is another. A KPPA cannot hold a fintech license, and discovering this after you have already incorporated one means rebuilding your structure from scratch. If you know you are pursuing a commercial license, start with a PT PMA.

Designing your ownership structure based on what works in your home market is a third. Indonesia’s ownership caps are segment-specific. A structure that is straightforward in Singapore or Hong Kong may not be compliant for an Indonesian P2P lending platform where foreign ownership is capped at 85%.

Beyond structure, underestimating the sandbox timeline is a consistent issue. Foreign companies that plan for a three to six month process frequently find themselves still in review at nine months or beyond, which flows directly into capital deployment and investor timeline pressures. And leaving compliance infrastructure until after licensing creates its own problems, because OJK’s sandbox evaluation looks at your consumer protection mechanisms and data governance frameworks as part of the review itself.

The Foundation Comes First

Indonesia is not a market you can enter informally and regularise later, particularly in fintech. The regulatory framework is specific, the licensing process is structured, and the requirements around entity type, capital, and ownership are enforced.

The foreign companies that establish themselves here successfully tend to share one characteristic: they treat the setup phase as seriously as the product phase. They incorporate the right entity, plan their capital correctly, and build their compliance infrastructure before they need it rather than in response to a regulator’s request.

At XPND, this is the part of the journey we are built for. We are not a law firm, and we do not position ourselves as one. We are a business expansion partner that handles the incorporation, immigration, and compliance operations that foreign companies need to function in Indonesia, so that your team can stay focused on the business itself. If you are mapping out a fintech entry and want to understand what the setup process looks like for your specific situation, reach out to the XPND team for an initial consultation. We respond within 24 hours.