DeFi protocol frontend in Indonesia
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Indonesia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Mandatory customer identification and KYC on all users (AML/KYC integrated into operating procedures) — id.licensing.amlkyc-mandatory-robust-systems-including
- Transaction monitoring obligations for suspicious activity, with STR filing to PPATK within 3 working days — id.aml.receiving-and-analyzing-strs-within
- CTR reporting obligations to PPATK — id.aml.receiving-and-analyzing-strs-within
- Mandatory AML/CFT reporting under SEOJK No. 20/2024 — id.enforcement.regulatory-shift-ojk-assumed-crypto
- Must implement cryptographic protocols, security controls, and robust AML systems as part of operating procedures — id.licensing.amlkyc-mandatory-robust-systems-including
- Risk assessments and support for national AML strategies — id.aml.conducting-risk-assessments-and-supporting
Key Restrictions
- Must establish an Indonesian entity (PT/PT PMA) — id.licensing.vasp, id.licensing.local-presence-indonesian-incorporation-eg, id.licensing.register-company-ptpt-pma-via
- Crypto payments are prohibited under Currency Law — rupiah-only legal tender; may not accept crypto as payment — id.aml.currency-law-prohibits-crypto-payments, id.aml.bank-indonesia-bi-central-bank
- Must obtain VASP registration/license with OJK (post-Jan 2025 transition); sandbox process likely required — id.licensing.vasp, id.licensing.submit-to-ojk-sandbox-graduates
- Must comply with POJK 27/2024 (DFA trading, storage, risk, consumer protection) and POJK 23/2025 (whitelist of licensed platforms) — id.licensing.pojk-272024-ojk-rules-on, id.aml.ojk-regulation-no-232025-introduces
- Frontend likely falls under 'Digital Financial Asset' (DFA) trading/service provider classification, requiring licensing as a crypto trader/exchange — id.licensing.pojk-272024-ojk-rules-on
- Must register with national crypto bourse (Bursa Kripto Indonesia) — id.licensing.exchange
- All documentation must be translated to Indonesian and notarized — id.licensing.prepare-dossier-business-plan-beneficial
- NIB (Business ID) and KBLI code 62014 for blockchain activities required — id.licensing.other-risk-management-consumer-protection
Key Risks
- Regulatory ambiguity: DeFi protocol frontends are not explicitly addressed in current regulations — the 'same activity, same risk, same regulation' principle suggests OJK may treat frontends as VASPs if they take fees or control user interactions — id.aml.financial-services-authority-ojk-primary
- Fee-taking (e.g., frontend swap fees) likely triggers classification as a crypto asset trader/exchange, subjecting operator to full VASP licensing — no de minimis exemption for interface fees
- Enforcement risk: PPATK actively monitors on-chain transactions; blockchain evidence has been admitted in court (terrorism financing cases) — id.enforcement.case-context-indonesian-authorities-led, id.enforcement.significance-marked-southeast-asias-first
- Worldcoin data-privacy probe by Kominfo signals aggressive data protection enforcement for crypto/biometric projects — id.enforcement.case-context-kominfo-probed-worldcoins
- OJK review process is months-long with possible rejection; sandbox graduates may have faster path but new entrants face scrutiny — id.licensing.ojk-review-months-long-inspects-docs
- Transitional uncertainty: OJK requirements are still being finalized post-Jan 2025 transfer from Bappebti — id.licensing.vasp
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
OJK — Financial services authority — VASP oversight (from Jan 2025)
Bappebti — Former crypto commodity regulator (authority transferred to OJK Jan 2025)
Omnibus Financial Law (P2SK) (2023) — Transfer of crypto oversight from Bappebti to OJK
VASP: VASP Registration/License with OJK (post-Jan 2025 transfer). Previously IDR 50B (~$3.2M USD) minimum capital under Bappebti. OJK requirements being finalized. Must establish Indonesian entity (PT). 6-12 months.
AML/KYC: Mandatory robust systems, including customer identification, transaction monitoring, cryptographic protocols, and security controls; integrated into operating procedures.
Local Presence: Indonesian incorporation (e.g., via Ministry of Investments portal); local directors, business plans proving viability, and technical infrastructure readiness.
Register company (PT/PT PMA) via Ministry of Investments portal and obtain NIB.
Prepare dossier: Business plan, beneficial owner details, statutes, capital proof, AML/KYC/security schemas (translated to Indonesian, notarized).
Submit to OJK (sandbox graduates apply within letter validity; others directly).
OJK review (months-long): Inspects docs, reputation, operations; may reject/return for fixes.
POJK 27/2024: OJK rules on DFA trading, storage, risk, consumer protection (covers exchanges/custodians/traders). [https://www.legal500.com/guides/chapter/indonesia-blockchain-crypto-assets/?export-pdf]
POJK on ITSK Implementation (Article 23): Licensing for tech innovation/DFA providers via OJK. [https://ojk.go.id/en/fungsi-utama/itsk/perizinan-itsk-aset-keuangan-digital-aset-kripto/default.aspx]
EXCHANGE: Physical trader registration. National crypto bourse (Bursa Kripto Indonesia) launched 2023. Islam-related considerations (MUI halal debate) affect adoption.
Other: Risk management, consumer protection, periodic/incidental reporting to OJK; NIB (Business ID) and KBLI 62014 for blockchain activities.
Financial Services Authority (OJK): Primary regulator since January 10, 2025, supervising trading, exchanges, settlement, clearinghouses, custodians, and asset dealers. It enforces licensing, governance, capital requirements, KYC/AML, and a "same activity, same risk, same regulation" principle aligned with global standards.
Bank Indonesia (BI): Central bank enforcing the Currency Law, prohibiting crypto use for payments and upholding the rupiah as sole legal tender.
Currency Law: Prohibits crypto payments; rupiah-only legal tender (pre-2017 BI ban on payments).
OJK Regulation No. 23/2025: Introduces a whitelist of 29 licensed digital asset platforms/exchanges; restricts unlisted operators, requires segregated margin accounts, user knowledge tests for derivatives, and approved asset listings.
Receiving and analyzing STRs (within 3 working days) and CTRs.
Conducting risk assessments and supporting national AML strategies.
Regulatory Shift: OJK assumed crypto oversight from Bappebti in January 2025, mandating AML/CFT reporting (SEOJK No. 20/2024), which supported these investigations.
Case Context: Indonesian authorities, led by PPATK and Densus 88, analyzed on-chain data to trace funds from domestic sources (e.g., Indonesian exchanges) to foreign terrorism networks. One individual sent 15 transactions totaling over 49,000 USDT. Defendants acted as financiers, not direct attackers.
Significance: Marked Southeast Asia's first court acceptance of blockchain evidence in terrorism financing cases, setting a legal precedent. PPATK noted rising suspicious crypto transactions, including a 2023 joint action uncovering ISIS funding disguised as humanitarian aid.
Case Context: Kominfo probed Worldcoin's data practices amid global concerns (e.g., similar actions in Kenya, Germany). Emphasized protecting digital rights under Indonesian law.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A DeFi frontend serving Indonesian residents is likely regulated as a VASP/crypto trader under OJK's post-Jan 2025 regime (POJK 27/2024) and must establish an Indonesian PT entity, obtain OJK VASP licensing (6-12 mo, high capital burden), implement full KYC/AML, geofence Indonesian users from unlicensed operations, and cannot take crypto payments; significant ambiguity remains on whether non-fee-taking or fully non-custodial frontends fall under the regime, and fee-taking almost certainly triggers full VASP classification.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?