Remote VASP serving residents in Indonesia
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Indonesia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Mandatory KYC/AML systems including customer identification and transaction monitoring (id.licensing.amlkyc-mandatory-robust-systems-including)
- Obligation to report Suspicious Transaction Reports (STRs) to PPATK within 3 working days (id.aml.receiving-and-analyzing-strs-within)
- Currency Transaction Reports (CTRs) to PPATK (id.aml.receiving-and-analyzing-strs-within)
- Travel Rule compliance — threshold: IDR 100,000,000 (~USD 6,200) (id.travel-rule.status)
- Compliance with OJK Regulation No. 27/2024 on DFA trading, capital, consumer protection, and AML by July 2025 (id.aml.ojk-regulation-no-27-of)
- Compliance with SEOJK No. 20/2024 on AML/CFT reporting (id.enforcement.regulatory-shift-ojk-assumed-crypto)
- Risk assessments and national AML strategy support (id.aml.conducting-risk-assessments-and-supporting)
Key Restrictions
- Operator must establish an Indonesian-incorporated entity (PT/PT PMA) with local directors — no pure remote cross-border servicing permitted (id.licensing.local-presence-indonesian-incorporation-eg)
- Crypto payments prohibited — rupiah-only legal tender; Currency Law and BI ban apply (id.aml.currency-law-prohibits-crypto-payments)
- Must register on the national crypto bourse (Bursa Kripto Indonesia) (id.licensing.exchange)
- Must obtain NIB and KBLI 62014 for blockchain activities (id.licensing.other-risk-management-consumer-protection)
- Operator must comply with OJK whitelist of licensed platforms (OJK Regulation No. 23/2025) and cannot offer services unless listed (id.aml.ojk-regulation-no-232025-introduces)
- Minimum capital requirement — previously IDR 50B (~USD 3.2M) under Bappebti; OJK requirements being finalized (id.licensing.vasp)
- Sandbox or direct licensing pathway through OJK; 6-12 month process (id.licensing.vasp)
Key Risks
- Enforcement risk for unlicensed foreign remote operators is high — PPATK and Densus 88 actively trace on-chain transactions and have secured convictions for terrorist financing using blockchain evidence (id.enforcement.case-context-indonesian-authorities-led)
- Regulatory transition from Bappebti to OJK creates some uncertainty; OJK's final capital and licensing requirements are not yet fully settled (id.licensing.vasp)
- Data privacy scrutiny — Kominfo (Ministry of Communications and Informatics) has investigated crypto/biometric projects for data protection compliance (id.enforcement.case-context-kominfo-probed-worldcoins)
- MUI halal debate on crypto can affect adoption and regulatory posture (id.licensing.exchange)
- Ongoing equity maintenance requirements; OJK can demand additional capital (id.licensing.capital-as-above-ojk-enforces)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
VASP: VASP Registration/License with OJK (post-Jan 2025 transfer). Previously IDR 50B (~$3.2M USD) minimum capital under Bappebti. OJK requirements being finalized. Must establish Indonesian entity (PT). 6-12 months.
Local Presence: Indonesian incorporation (e.g., via Ministry of Investments portal); local directors, business plans proving viability, and technical infrastructure readiness.
AML/KYC: Mandatory robust systems, including customer identification, transaction monitoring, cryptographic protocols, and security controls; integrated into operating procedures.
Capital: As above; OJK enforces ongoing equity maintenance and can demand extras.
OJK — Financial services authority — VASP oversight (from Jan 2025)
Bappebti — Former crypto commodity regulator (authority transferred to OJK Jan 2025)
POJK 27/2024: OJK rules on DFA trading, storage, risk, consumer protection (covers exchanges/custodians/traders). [https://www.legal500.com/guides/chapter/indonesia-blockchain-crypto-assets/?export-pdf]
OJK review (months-long): Inspects docs, reputation, operations; may reject/return for fixes.
Submit to OJK (sandbox graduates apply within letter validity; others directly).
Register company (PT/PT PMA) via Ministry of Investments portal and obtain NIB.
Other: Risk management, consumer protection, periodic/incidental reporting to OJK; NIB (Business ID) and KBLI 62014 for blockchain activities.
EXCHANGE: Physical trader registration. National crypto bourse (Bursa Kripto Indonesia) launched 2023. Islam-related considerations (MUI halal debate) affect adoption.
Receiving and analyzing STRs (within 3 working days) and CTRs.
OJK Regulation No. 27 of 2024: Classifies crypto as digital financial assets; mandates compliance on capital, consumer protection, and AML by July 2025. Effective post-January 2025 transition.
OJK Regulation No. 23/2025: Introduces a whitelist of 29 licensed digital asset platforms/exchanges; restricts unlisted operators, requires segregated margin accounts, user knowledge tests for derivatives, and approved asset listings.
Currency Law: Prohibits crypto payments; rupiah-only legal tender (pre-2017 BI ban on payments).
Travel Rule adopted — threshold: IDR 100,000,000
Case Context: Indonesian authorities, led by PPATK and Densus 88, analyzed on-chain data to trace funds from domestic sources (e.g., Indonesian exchanges) to foreign terrorism networks. One individual sent 15 transactions totaling over 49,000 USDT. Defendants acted as financiers, not direct attackers.
Significance: Marked Southeast Asia's first court acceptance of blockchain evidence in terrorism financing cases, setting a legal precedent. PPATK noted rising suspicious crypto transactions, including a 2023 joint action uncovering ISIS funding disguised as humanitarian aid.
Regulatory Shift: OJK assumed crypto oversight from Bappebti in January 2025, mandating AML/CFT reporting (SEOJK No. 20/2024), which supported these investigations.
Case Context: Kominfo probed Worldcoin's data practices amid global concerns (e.g., similar actions in Kenya, Germany). Emphasized protecting digital rights under Indonesian law.
Financial Services Authority (OJK): Primary regulator since January 10, 2025, supervising trading, exchanges, settlement, clearinghouses, custodians, and asset dealers. It enforces licensing, governance, capital requirements, KYC/AML, and a "same activity, same risk, same regulation" principle aligned with global standards.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a remote VASP cannot serve Indonesian residents from abroad without establishing a locally incorporated entity (PT/PT PMA), obtaining OJK licensing (post-Jan 2025 transition), meeting high capital requirements (~IDR 50B), and complying with full AML/KYC/Travel Rule obligations under PPATK and OJK supervision.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?