Custodial wallet / SaaS in Indonesia
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Indonesia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VASP license (post-Jan 2025 OJK regime) requires robust AML/KYC systems including customer identification, transaction monitoring, cryptographic protocols, and security controls integrated into operating procedures (id.licensing.amlkyc-mandatory-robust-systems-including)
- Mandatory STR (Suspicious Transaction Report) filing via PPATK — STRs must be analyzed within 3 working days (id.aml.receiving-and-analyzing-strs-within)
- Mandatory CTR (Cash Transaction Report) filing via PPATK (id.aml.receiving-and-analyzing-strs-within)
- Compliance with PPATK AML/CFT guidelines and risk assessment participation (id.aml.conducting-risk-assessments-and-supporting, id.aml.issuing-guidelines-for-suspicious-transactions)
- OJK Regulation No. 27/2024 mandates AML/CFT compliance by July 2025, covering capital, consumer protection, and reporting obligations (id.aml.ojk-regulation-no-27-of)
- SEOJK No. 20/2024 mandates AML/CFT reporting to OJK, supporting enforcement (id.enforcement.regulatory-shift-ojk-assumed-crypto)
- OJK Regulation No. 23/2025 restricts operators to a whitelist of 29 licensed platforms; unlisted operators may not serve residents (id.aml.ojk-regulation-no-232025-introduces)
Key Restrictions
- Must establish an Indonesian entity (PT/PT PMA) via Ministry of Investments portal (id.licensing.local-presence-indonesian-incorporation-eg, id.licensing.register-company-ptpt-pma-via)
- Crypto payments are prohibited under Indonesia's Currency Law — rupiah is sole legal tender; custodial wallet may not facilitate crypto payments to merchants (id.aml.currency-law-prohibits-crypto-payments, id.aml.bank-indonesia-bi-central-bank)
- Must register under KBLI 62014 for blockchain activities and obtain NIB (Business ID) (id.licensing.other-risk-management-consumer-protection)
- Dossier must be translated to Indonesian and notarized — includes business plan, beneficial ownership, AML/KYC/security schemas (id.licensing.prepare-dossier-business-plan-beneficial)
- Must complete OJK sandbox process or apply directly; OJK review takes months and may reject/request fixes (id.licensing.submit-to-ojk-sandbox-graduates, id.licensing.ojk-review-months-long-inspects-docs)
- Whitelist-only regime under OJK Reg. 23/2025 — only operators on the 29-entity whitelist may serve residents (id.aml.ojk-regulation-no-232025-introduces)
- Customer asset segregation is required under the VASP/custody license (id.licensing.custody)
- Ongoing equity maintenance (minimum capital under Bappebti was IDR 50B/~$3.2M; OJK enforces ongoing requirements) (id.licensing.capital-as-above-ojk-enforces)
Key Risks
- Regulatory transition risk — OJK assumed authority from Bappebti in January 2025; final OJK custody-specific rules and capital requirements are still being formalized, creating licensing uncertainty (id.licensing.regulator-ojk, id.licensing.regulator-bappebti, id.licensing.vasp)
- Whitelist bottleneck — OJK Reg. 23/2025 restricts licensed operators to 29 entities; new entrants may face delays or inability to obtain whitelist status (id.aml.ojk-regulation-no-232025-introduces)
- Enforcement risk — PPATK and Densus 88 actively monitor crypto transactions; blockchain evidence has been accepted in court for terrorism financing cases, signaling robust enforcement (id.enforcement.case-context-indonesian-authorities-led, id.enforcement.significance-marked-southeast-asias-first)
- Data privacy scrutiny — Kominfo has probed crypto/biometric projects (e.g., Worldcoin) over data practices; custodial wallets handling personal data face similar exposure (id.enforcement.case-context-kominfo-probed-worldcoins, id.enforcement.significance-highlights-indonesias-focus-on)
- SaaS vs client AML allocation ambiguity — the facts do not clearly delineate AML obligations between the custodial SaaS provider and its white-label clients; OJK's 'same activity, same risk, same regulation' principle may make both parties liable (id.aml.financial-services-authority-ojk-primary)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
OJK — Financial services authority — VASP oversight (from Jan 2025)
Bappebti — Former crypto commodity regulator (authority transferred to OJK Jan 2025)
Omnibus Financial Law (P2SK) (2023) — Transfer of crypto oversight from Bappebti to OJK
Bappebti Regulation 5/2019 (amended) (2019) — Crypto asset trading as commodity futures
VASP: VASP Registration/License with OJK (post-Jan 2025 transfer). Previously IDR 50B (~$3.2M USD) minimum capital under Bappebti. OJK requirements being finalized. Must establish Indonesian entity (PT). 6-12 months.
CUSTODY: Included under VASP license; customer asset segregation required
Capital: As above; OJK enforces ongoing equity maintenance and can demand extras.
AML/KYC: Mandatory robust systems, including customer identification, transaction monitoring, cryptographic protocols, and security controls; integrated into operating procedures.
Local Presence: Indonesian incorporation (e.g., via Ministry of Investments portal); local directors, business plans proving viability, and technical infrastructure readiness.
Other: Risk management, consumer protection, periodic/incidental reporting to OJK; NIB (Business ID) and KBLI 62014 for blockchain activities.
Register company (PT/PT PMA) via Ministry of Investments portal and obtain NIB.
Prepare dossier: Business plan, beneficial owner details, statutes, capital proof, AML/KYC/security schemas (translated to Indonesian, notarized).
Submit to OJK (sandbox graduates apply within letter validity; others directly).
OJK review (months-long): Inspects docs, reputation, operations; may reject/return for fixes.
POJK 27/2024: OJK rules on DFA trading, storage, risk, consumer protection (covers exchanges/custodians/traders). [https://www.legal500.com/guides/chapter/indonesia-blockchain-crypto-assets/?export-pdf]
POJK on ITSK Implementation (Article 23): Licensing for tech innovation/DFA providers via OJK. [https://ojk.go.id/en/fungsi-utama/itsk/perizinan-itsk-aset-keuangan-digital-aset-kripto/default.aspx]
Receiving and analyzing STRs (within 3 working days) and CTRs.
Issuing guidelines for suspicious transactions and compliance.
Providing financial intelligence to law enforcement.
Conducting risk assessments and supporting national AML strategies.
Financial Services Authority (OJK): Primary regulator since January 10, 2025, supervising trading, exchanges, settlement, clearinghouses, custodians, and asset dealers. It enforces licensing, governance, capital requirements, KYC/AML, and a "same activity, same risk, same regulation" principle aligned with global standards.
Bank Indonesia (BI): Central bank enforcing the Currency Law, prohibiting crypto use for payments and upholding the rupiah as sole legal tender.
OJK Regulation No. 27 of 2024: Classifies crypto as digital financial assets; mandates compliance on capital, consumer protection, and AML by July 2025. Effective post-January 2025 transition.
OJK Regulation No. 23/2025: Introduces a whitelist of 29 licensed digital asset platforms/exchanges; restricts unlisted operators, requires segregated margin accounts, user knowledge tests for derivatives, and approved asset listings.
Law No. 4 of 2023 on Financial Sector Development and Strengthening (UU PPSK): Passed December 15, 2022 (effective January 12, 2023); transfers crypto oversight from BAPPEBTI to OJK by January 10, 2025, to enhance investor safety and align with international standards.
Currency Law: Prohibits crypto payments; rupiah-only legal tender (pre-2017 BI ban on payments).
Case Context: Indonesian authorities, led by PPATK and Densus 88, analyzed on-chain data to trace funds from domestic sources (e.g., Indonesian exchanges) to foreign terrorism networks. One individual sent 15 transactions totaling over 49,000 USDT. Defendants acted as financiers, not direct attackers.
Significance: Marked Southeast Asia's first court acceptance of blockchain evidence in terrorism financing cases, setting a legal precedent. PPATK noted rising suspicious crypto transactions, including a 2023 joint action uncovering ISIS funding disguised as humanitarian aid.
Regulatory Shift: OJK assumed crypto oversight from Bappebti in January 2025, mandating AML/CFT reporting (SEOJK No. 20/2024), which supported these investigations.
Case Context: Kominfo probed Worldcoin's data practices amid global concerns (e.g., similar actions in Kenya, Germany). Emphasized protecting digital rights under Indonesian law.
Significance: Highlights Indonesia's focus on data privacy in crypto/biometric projects, aligning with OJK's consumer protection rules (e.g., OJK No. 27/2024).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet / SaaS operators may serve Indonesian residents only after obtaining a VASP license from OJK (post-Jan 2025 regime), establishing a local PT entity, meeting minimum capital requirements (~IDR 50B / ~$3.2M under transitional rules), complying with PPATK/OJK AML/CFT reporting obligations, and being listed on the OJK whitelist of licensed platforms.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?