Crypto ATM / kiosk operator in Indonesia
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Indonesia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Mandatory KYC/AML systems including customer identification, transaction monitoring, cryptographic protocols, and security controls, integrated into operating procedures (id.licensing.amlkyc-mandatory-robust-systems-including)
- CTR (Currency Transaction Report) filings to PPATK; STR filings within 3 working days of suspicion (id.aml.receiving-and-analyzing-strs-within)
- OJK Regulation No. 27 of 2024 mandates AML compliance, capital requirements, and consumer protection; full compliance required by July 2025 (id.aml.ojk-regulation-no-27-of)
- OJK Regulation No. 23/2025 restricts operations to whitelisted digital asset platforms; requires segregated accounts and user knowledge tests (id.aml.ojk-regulation-no-232025-introduces)
- SEOJK No. 20/2024 mandates AML/CFT reporting obligations under OJK oversight (id.enforcement.regulatory-shift-ojk-assumed-crypto)
- Risk assessments and supporting national AML strategies conducted through PPATK (id.aml.conducting-risk-assessments-and-supporting)
Key Restrictions
- Must establish an Indonesian entity (PT/PT PMA) via the Ministry of Investments portal (id.licensing.local-presence-indonesian-incorporation-eg)
- Crypto cannot be used as a means of payment — rupiah is sole legal tender; cash-to-crypto ATM may risk payment law violation if structured as a payment mechanism (id.aml.currency-law-prohibits-crypto-payments, id.aml.bank-indonesia-bi-central-bank)
- Must be licensed as a VASP/DFA trader under OJK (post-Jan 2025); previously Bappebti regime applied (id.licensing.vasp)
- Must operate within the national crypto bourse (Bursa Kripto Indonesia) framework (id.licensing.exchange)
- Must obtain NIB (Business ID) and KBLI 62014 classification for blockchain activities (id.licensing.other-risk-management-consumer-protection)
- OJK sandbox participation may be required before full licensing (id.licensing.submit-to-ojk-sandbox-graduates)
- Dossier must be translated to Indonesian and notarized (id.licensing.prepare-dossier-business-plan-beneficial)
Key Risks
- Cash-intensive ATM model directly triggers Indonesia's strict cash-transaction reporting regime and heightened AML scrutiny under PPATK and OJK — high risk of enforcement for non-reporting (id.aml.receiving-and-analyzing-strs-within, id.enforcement.case-context-indonesian-authorities-led)
- Crypto-for-cash ATMs could be interpreted as facilitating crypto payments (prohibited by Currency Law), creating legal exposure (id.aml.currency-law-prohibits-crypto-payments)
- Regulatory transition from Bappebti to OJK (Jan 2025) creates ambiguity: final OJK rules for kiosk/ATM-specific operations are still being finalized (id.licensing.vasp)
- MUI halal status debate around crypto affects consumer adoption and reputational risk (id.licensing.exchange)
- Indonesian authorities have demonstrated willingness to use blockchain tracing and pursue enforcement — precedent set in terrorism financing cases (id.enforcement.significance-marked-southeast-asias-first)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
VASP: VASP Registration/License with OJK (post-Jan 2025 transfer). Previously IDR 50B (~$3.2M USD) minimum capital under Bappebti. OJK requirements being finalized. Must establish Indonesian entity (PT). 6-12 months.
Local Presence: Indonesian incorporation (e.g., via Ministry of Investments portal); local directors, business plans proving viability, and technical infrastructure readiness.
AML/KYC: Mandatory robust systems, including customer identification, transaction monitoring, cryptographic protocols, and security controls; integrated into operating procedures.
Other: Risk management, consumer protection, periodic/incidental reporting to OJK; NIB (Business ID) and KBLI 62014 for blockchain activities.
Register company (PT/PT PMA) via Ministry of Investments portal and obtain NIB.
Submit to OJK (sandbox graduates apply within letter validity; others directly).
OJK review (months-long): Inspects docs, reputation, operations; may reject/return for fixes.
POJK 27/2024: OJK rules on DFA trading, storage, risk, consumer protection (covers exchanges/custodians/traders). [https://www.legal500.com/guides/chapter/indonesia-blockchain-crypto-assets/?export-pdf]
POJK on ITSK Implementation (Article 23): Licensing for tech innovation/DFA providers via OJK. [https://ojk.go.id/en/fungsi-utama/itsk/perizinan-itsk-aset-keuangan-digital-aset-kripto/default.aspx]
Receiving and analyzing STRs (within 3 working days) and CTRs.
OJK Regulation No. 27 of 2024: Classifies crypto as digital financial assets; mandates compliance on capital, consumer protection, and AML by July 2025. Effective post-January 2025 transition.
OJK Regulation No. 23/2025: Introduces a whitelist of 29 licensed digital asset platforms/exchanges; restricts unlisted operators, requires segregated margin accounts, user knowledge tests for derivatives, and approved asset listings.
Currency Law: Prohibits crypto payments; rupiah-only legal tender (pre-2017 BI ban on payments).
Bank Indonesia (BI): Central bank enforcing the Currency Law, prohibiting crypto use for payments and upholding the rupiah as sole legal tender.
Conducting risk assessments and supporting national AML strategies.
Regulatory Shift: OJK assumed crypto oversight from Bappebti in January 2025, mandating AML/CFT reporting (SEOJK No. 20/2024), which supported these investigations.
Case Context: Indonesian authorities, led by PPATK and Densus 88, analyzed on-chain data to trace funds from domestic sources (e.g., Indonesian exchanges) to foreign terrorism networks. One individual sent 15 transactions totaling over 49,000 USDT. Defendants acted as financiers, not direct attackers.
Significance: Marked Southeast Asia's first court acceptance of blockchain evidence in terrorism financing cases, setting a legal precedent. PPATK noted rising suspicious crypto transactions, including a 2023 joint action uncovering ISIS funding disguised as humanitarian aid.
EXCHANGE: Physical trader registration. National crypto bourse (Bursa Kripto Indonesia) launched 2023. Islam-related considerations (MUI halal debate) affect adoption.
Prepare dossier: Business plan, beneficial owner details, statutes, capital proof, AML/KYC/security schemas (translated to Indonesian, notarized).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators may operate in Indonesia only after establishing a local PT entity, obtaining a VASP license from OJK (post-Jan 2025), implementing robust AML/KYC/CTR/STR systems, and complying with the rupiah-only payment rule which creates structural risk for cash-in/cash-out kiosk models.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?