Centralized exchange in Indonesia
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in Indonesia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Mandatory KYC/CDD with customer identification and transaction monitoring (integrated into operating procedures) — id.licensing.amlkyc-mandatory-robust-systems-including
- Suspicious Transaction Report (STR) filing — must receive and analyze within 3 working days — id.aml.receiving-and-analyzing-strs-within
- Currency Transaction Report (CTR) filing — id.aml.receiving-and-analyzing-strs-within
- Travel Rule compliance — threshold of IDR 100,000,000 (~$6,200 USD) for beneficiary VASP information on withdrawals — id.travel-rule.status
- AML/CFT reporting under SEOJK No. 20/2024 — id.enforcement.regulatory-shift-ojk-assumed-crypto
- Compliance with OJK Regulation No. 27/2024 (capital, consumer protection, AML mandates by July 2025) — id.aml.ojk-regulation-no-27-of
- Risk assessment obligations supporting national AML strategies — id.aml.conducting-risk-assessments-and-supporting
- Ongoing AML program subject to PPATK (FIU) oversight and OJK supervision — id.aml.financial-services-authority-ojk-primary
Key Restrictions
- Must be incorporated as an Indonesian entity (PT/PT PMA) with local directors and a physical technical infrastructure in Indonesia — id.licensing.local-presence-indonesian-incorporation-eg
- Must register on the national crypto bourse (Bursa Kripto Indonesia) — id.licensing.exchange
- Crypto cannot be used as a means of payment; rupiah-only legal tender — Currency Law / BI ban — id.aml.currency-law-prohibits-crypto-payments
- Assets listed for trading must comply with OJK-approved whitelist under OJK Regulation No. 23/2025 — id.aml.ojk-regulation-no-232025-introduces
- Derivatives trading requires user knowledge tests and segregated margin accounts — id.aml.ojk-regulation-no-232025-introduces
- Must operate within OJK's DFA regulatory framework under POJK 27/2024 covering trading, storage, risk, and consumer protection — id.licensing.pojk-272024-ojk-rules-on
- Must have completed OJK sandbox or apply directly with full dossier (business plan, beneficial ownership, capital proof, AML/KYC/security schemas translated to Indonesian and notarized) — id.licensing.submit-to-ojk-sandbox-graduates
Key Risks
- Regulatory transition risk: oversight moved from Bappebti to OJK in Jan 2025 — detailed OJK licensing requirements still being finalized, creating implementation uncertainty — id.licensing.regulator-ojk, id.licensing.legislation-omnibus-financial-law-p2sk
- Enforcement precedent exists: blockchain evidence accepted in terrorism-financing cases; PPATK actively investigates crypto-related suspicious transactions — id.enforcement.case-context-indonesian-authorities-led, id.enforcement.significance-marked-southeast-asias-first
- Data privacy risk: Kominfo (communications ministry) has probed crypto/biometric projects like Worldcoin, indicating heightened scrutiny on data handling — id.enforcement.case-context-kominfo-probed-worldcoins
- Halal compliance uncertainty: MUI halal debate affects adoption and may create reputational/PR risk for exchange operators — id.licensing.exchange
- Multi-regulator exposure: OJK (primary), PPATK (AML), BI (currency law), and Kominfo (data privacy) each have enforcement powers — overlapping compliance burden
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
OJK — Financial services authority — VASP oversight (from Jan 2025)
Omnibus Financial Law (P2SK) (2023) — Transfer of crypto oversight from Bappebti to OJK
VASP: VASP Registration/License with OJK (post-Jan 2025 transfer). Previously IDR 50B (~$3.2M USD) minimum capital under Bappebti. OJK requirements being finalized. Must establish Indonesian entity (PT). 6-12 months.
CUSTODY: Included under VASP license; customer asset segregation required
EXCHANGE: Physical trader registration. National crypto bourse (Bursa Kripto Indonesia) launched 2023. Islam-related considerations (MUI halal debate) affect adoption.
Local Presence: Indonesian incorporation (e.g., via Ministry of Investments portal); local directors, business plans proving viability, and technical infrastructure readiness.
Submit to OJK (sandbox graduates apply within letter validity; others directly).
POJK 27/2024: OJK rules on DFA trading, storage, risk, consumer protection (covers exchanges/custodians/traders). [https://www.legal500.com/guides/chapter/indonesia-blockchain-crypto-assets/?export-pdf]
POJK on ITSK Implementation (Article 23): Licensing for tech innovation/DFA providers via OJK. [https://ojk.go.id/en/fungsi-utama/itsk/perizinan-itsk-aset-keuangan-digital-aset-kripto/default.aspx]
Financial Services Authority (OJK): Primary regulator since January 10, 2025, supervising trading, exchanges, settlement, clearinghouses, custodians, and asset dealers. It enforces licensing, governance, capital requirements, KYC/AML, and a "same activity, same risk, same regulation" principle aligned with global standards.
OJK Regulation No. 27 of 2024: Classifies crypto as digital financial assets; mandates compliance on capital, consumer protection, and AML by July 2025. Effective post-January 2025 transition.
OJK Regulation No. 23/2025: Introduces a whitelist of 29 licensed digital asset platforms/exchanges; restricts unlisted operators, requires segregated margin accounts, user knowledge tests for derivatives, and approved asset listings.
Receiving and analyzing STRs (within 3 working days) and CTRs.
Currency Law: Prohibits crypto payments; rupiah-only legal tender (pre-2017 BI ban on payments).
Travel Rule adopted — threshold: IDR 100,000,000
Case Context: Indonesian authorities, led by PPATK and Densus 88, analyzed on-chain data to trace funds from domestic sources (e.g., Indonesian exchanges) to foreign terrorism networks. One individual sent 15 transactions totaling over 49,000 USDT. Defendants acted as financiers, not direct attackers.
Regulatory Shift: OJK assumed crypto oversight from Bappebti in January 2025, mandating AML/CFT reporting (SEOJK No. 20/2024), which supported these investigations.
Case Context: Kominfo probed Worldcoin's data practices amid global concerns (e.g., similar actions in Kenya, Germany). Emphasized protecting digital rights under Indonesian law.
AML/KYC: Mandatory robust systems, including customer identification, transaction monitoring, cryptographic protocols, and security controls; integrated into operating procedures.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — centralized exchanges may operate in Indonesia only as an OJK-licensed VASP using an Indonesian-incorporated entity (PT/PT PMA), with mandatory AML/KYC/CTF/TR compliance, customer asset segregation, access to the national crypto bourse, and adherence to OJK's DFA regulatory framework (POJK 27/2024, OJK Reg 23/2025), but the regime is in transition from Bappebti to OJK, creating some implementation uncertainty.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?