Crypto-funded debit card in Indonesia
A card program where customer fiat balances are funded from crypto holdings, typically through an off-ramp at point of sale or top-up.
Crypto debit card is conditionally permitted in Indonesia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Mandatory KYC/AML systems required under OJK supervision (POJK 27/2024), including customer identification and transaction monitoring (id.licensing.amlkyc-mandatory-robust-systems-including)
- STR/CTR filing to PPATK within 3 working days for suspicious transactions (id.aml.receiving-and-analyzing-strs-within)
- Compliance with OJK Regulation No. 27 of 2024 mandating AML/CFT compliance by July 2025 (id.aml.ojk-regulation-no-27-of)
- Transaction monitoring with cryptographic protocols and security controls integrated into operating procedures (id.licensing.amlkyc-mandatory-robust-systems-including)
- OJK Regulation No. 23/2025 whitelist: only approved digital asset platforms may be used; user knowledge tests and segregated accounts required (id.aml.ojk-regulation-no-232025-introduces)
- Risk assessments and support for national AML strategies (id.aml.conducting-risk-assessments-and-supporting)
Key Restrictions
- Crypto cannot be used for payments under Indonesian Currency Law; rupiah is the sole legal tender — this creates structural tension for a crypto-funded debit card model (id.aml.bank-indonesia-bi-central-bank)
- Crypto-to-fiat conversion required at point of sale/top-up must be executed through OJK-licensed VASP/exchange (id.licensing.vasp)
- Operator must establish an Indonesian entity (PT) with local directors and physical presence (id.licensing.local-presence-indonesian-incorporation-eg)
- Must obtain NIB (Business ID) and KBLI code 62014 for blockchain activities (id.licensing.other-risk-management-consumer-protection)
- Must graduate from OJK sandbox or apply directly through OJK licensing process (id.licensing.submit-to-ojk-sandbox-graduates)
- No explicit card/issuing license framework for crypto-funded cards identified; likely requires e-money license or partnership with an OJK-licensed bank/issuer
Key Risks
- Payment prohibition risk: Bank Indonesia prohibits use of crypto for payments; the conversion step may be structured as a separate off-ramp but faces regulatory scrutiny (id.aml.bank-indonesia-bi-central-bank)
- Regulatory transition ambiguity: crypto oversight moved from Bappebti to OJK in Jan 2025 — OJK licensing details for VASPs are still being finalized, creating uncertainty (id.licensing.regulator-ojk)
- No dedicated crypto-debit-card regulation exists; operator must navigate multiple overlapping frameworks (VASP license + e-money regulation + bank partnership + OJK sandbox)
- Tax complexity: each crypto-to-fiat conversion triggers 0.21% final income tax (PPh 22) collected by approved exchanges and possible VAT on fees — affects card top-up economics (id.tax.individualssellers-approved-exchanges-collectremit-021)
- Partner bank/BIN-sponsor required but no clear local precedent for crypto-funded card programs; Bappebti-era enforcement precedent exists on crypto payment prohibition
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
OJK — Financial services authority — VASP oversight (from Jan 2025)
Bappebti — Former crypto commodity regulator (authority transferred to OJK Jan 2025)
VASP: VASP Registration/License with OJK (post-Jan 2025 transfer). Previously IDR 50B (~$3.2M USD) minimum capital under Bappebti. OJK requirements being finalized. Must establish Indonesian entity (PT). 6-12 months.
AML/KYC: Mandatory robust systems, including customer identification, transaction monitoring, cryptographic protocols, and security controls; integrated into operating procedures.
Local Presence: Indonesian incorporation (e.g., via Ministry of Investments portal); local directors, business plans proving viability, and technical infrastructure readiness.
Other: Risk management, consumer protection, periodic/incidental reporting to OJK; NIB (Business ID) and KBLI 62014 for blockchain activities.
Submit to OJK (sandbox graduates apply within letter validity; others directly).
POJK 27/2024: OJK rules on DFA trading, storage, risk, consumer protection (covers exchanges/custodians/traders). [https://www.legal500.com/guides/chapter/indonesia-blockchain-crypto-assets/?export-pdf]
Receiving and analyzing STRs (within 3 working days) and CTRs.
Issuing guidelines for suspicious transactions and compliance.
Financial Services Authority (OJK): Primary regulator since January 10, 2025, supervising trading, exchanges, settlement, clearinghouses, custodians, and asset dealers. It enforces licensing, governance, capital requirements, KYC/AML, and a "same activity, same risk, same regulation" principle aligned with global standards.
Bank Indonesia (BI): Central bank enforcing the Currency Law, prohibiting crypto use for payments and upholding the rupiah as sole legal tender.
OJK Regulation No. 27 of 2024: Classifies crypto as digital financial assets; mandates compliance on capital, consumer protection, and AML by July 2025. Effective post-January 2025 transition.
OJK Regulation No. 23/2025: Introduces a whitelist of 29 licensed digital asset platforms/exchanges; restricts unlisted operators, requires segregated margin accounts, user knowledge tests for derivatives, and approved asset listings.
Currency Law: Prohibits crypto payments; rupiah-only legal tender (pre-2017 BI ban on payments).
Individuals/Sellers: Approved exchanges collect/remit 0.21% PPh; self-remit/report via Unification Monthly Income Tax Return if exchange fails or for limited-service/foreign platforms. Thresholds apply for foreign platforms with Indonesian users/transactions.
Case Context: Indonesian authorities, led by PPATK and Densus 88, analyzed on-chain data to trace funds from domestic sources (e.g., Indonesian exchanges) to foreign terrorism networks. One individual sent 15 transactions totaling over 49,000 USDT. Defendants acted as financiers, not direct attackers.
Regulatory Shift: OJK assumed crypto oversight from Bappebti in January 2025, mandating AML/CFT reporting (SEOJK No. 20/2024), which supported these investigations.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A crypto-funded debit card can operate in Indonesia only via an OJK-licensed VASP/exchange entity (PT), with a partnered bank or e-money issuer, and with strict separation of crypto-payment conversion to comply with the rupiah-only payment rule; the model faces significant structural ambiguity due to the recent OJK transition and lack of a dedicated crypto-card framework.
Questions this verdict aims to answer
- What e-money / payment-institution license is required?
- How is the crypto-to-fiat conversion regulated?
- What KYC and AML obligations apply to cardholders?
- What partner-bank or BIN-sponsor arrangements are required?