How to Acquire a Fintech or Digital Payments Company in Indonesia (2026): OJK & BI Approvals, Data Rules, Tax and M&A Checklist

Acquire fintech Indonesia transactions have entered a decisive new phase in 2026, driven by tighter supervision from both the Financial Services Authority (OJK) and Bank Indonesia (BI), a maturing data protection regime, and an evolving tax framework reshaping the arithmetic of deals. For in-house counsel, private equity sponsors and strategic buyers, the practical challenge is no longer whether Indonesia’s digital finance market is attractive, it plainly is, but how to structure, document and close an acquisition that satisfies overlapping regulatory, tax and data obligations without derailing timelines. This guide sets out a transaction-focused playbook: the licensing routes, ownership rules, tax consequences, data localisation duties and a working due diligence and closing checklist.

The aim is to give buyers a single, Indonesia-specific reference for planning a fintech or digital payments acquisition in the current year.

Executive summary, quick take for buyers

Buying a regulated fintech in Indonesia is a multi-regulator exercise. Whoever you are acquiring, you will almost certainly interact with at least two supervisory authorities: the OJK for non-bank financial services such as peer-to-peer (P2P) lending and investment-related fintech, and Bank Indonesia for payment system operators, electronic money and switching. On top of that sit the Ministry of Communication and Digital Affairs (Komdigi) for data and electronic system registration, and the tax authorities for transaction taxation.

A recurring theme for 2026 is that the tax framework, administered by the Ministry of Finance and the Directorate General of Taxes, bears directly on how share sales and asset sales are taxed. Buyers should model the tax outcome of each deal structure early, because the right structure often turns on tax efficiency as much as regulatory transferability. The practical reality is that licence transferability, not price, is frequently the critical path item in a fintech deal.

The recommended first steps before you commit capital are straightforward: engage local counsel and a tax adviser at the term-sheet stage, map the target’s exact licence classes against the correct regulator, and request a regulatory pre-meeting where the transaction involves a change of control in a licensed entity. Doing this before signing avoids the most common cause of delay, discovering mid-deal that a licence cannot simply follow the business.

Why 2026 is different, the current regulatory context

Three forces make 2026 a distinct moment to acquire fintech Indonesia assets. First, the tax treatment of transactions continues to evolve, which changes the comparative economics of asset versus share deals and feeds directly into valuation and structuring. Buyers who priced a deal on older assumptions may find the post-tax return materially different under current rules, so tax modelling should be refreshed against the latest regulations published by the Ministry of Finance and the guidance of the Directorate General of Taxes.

Second, the OJK and Bank Indonesia have both sharpened their scrutiny of ownership changes in licensed entities. Change of control in a licensed fintech is not a private commercial matter; it is a regulated event that typically requires notification to, or prior approval from, the relevant supervisor. The supervisory posture in recent cycles has emphasised fit-and-proper assessment of incoming controllers, capital adequacy, and continuity of consumer protection. Note that the supervision of certain fintech activities, including crypto assets, has progressively transferred to the OJK under the broader financial-sector reform legislation.

Third, the data environment has hardened. Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) and the electronic-system rules administered by the Ministry of Communication and Digital Affairs impose obligations that survive a change of ownership and that must be diligenced before closing. A buyer that ignores data and localisation exposure can inherit liabilities that outlast the acquisition.

Timeline of recent regulatory developments

• Personal Data Protection Law implementation. Law No. 27 of 2022 established the statutory framework for personal data, cross-border transfers and controller obligations, which has moved from enactment into active application, raising the stakes for data-heavy fintech targets.
• Financial-sector reform. Law No. 4 of 2023 on the Development and Strengthening of the Financial Sector (P2SK Law) reshaped the mandates of the OJK and Bank Indonesia and has driven subsequent implementing regulations relevant to fintech supervision.
• Continued OJK and Bank Indonesia supervisory consolidation. Both regulators have reinforced licensing discipline and change-of-control review for non-bank financial institutions and payment system operators.
• Evolving tax rules. Ministry of Finance regulations must be read alongside existing withholding, value-added tax (VAT) and transaction-tax rules when structuring a deal; confirm the current text and implementation guidance before signing.

Pre-deal planning, strategic and M&A commercial issues

Before any term sheet is signed, buyers who want to acquire fintech Indonesia businesses efficiently should resolve four strategic questions. The first is deal structure: asset sale or share sale. In regulated fintech, the answer is rarely driven by preference alone. A share sale keeps the licensed entity, and, crucially, its licences, intact, but inherits all historic liabilities. An asset sale can ring-fence liabilities but usually cannot carry a licence across to the buyer without a fresh application or regulatory consent. The tension between clean liability and licence continuity is the single most important commercial decision in a fintech acquisition.

The second question is competition screening. Larger transactions may trigger merger control thresholds supervised by the Business Competition Supervisory Commission (KPPU), and buyers should assess whether notification is required and build any clearance into the conditions precedent and timetable. The third is foreign investor pre-clearance: where the buyer is foreign, sector-specific ownership rules and investment approvals must be confirmed before the structure is locked. The fourth is valuation adjustment. Licences, data assets and outstanding regulatory remediation all affect value. A target carrying an unresolved enforcement matter, a non-transferable licence, or an undercapitalised payment entity should be priced accordingly, and the purchase agreement should allocate that risk explicitly.

Commercial warranties and indemnities to prioritise

In a fintech deal, generic warranties are not enough. Prioritise bespoke protections covering licence validity and transferability, regulatory compliance and absence of enforcement, foreign ownership compliance, capital adequacy, data protection and localisation compliance, and tax. Where a specific risk is identified in diligence, for example, a historic data incident or an ambiguous ownership chain, convert it from a warranty into a specific indemnity, ideally backed by an escrow holdback. The indemnity should survive long enough to cover the regulatory and tax statute-of-limitation horizons relevant to the identified risk.

Licensing and regulator approvals (OJK, Bank Indonesia and others)

Mapping the correct regulator to the target’s activities is the foundation of any plan to acquire fintech Indonesia assets. Indonesia’s supervisory architecture divides fintech oversight by function, and a single target may sit under more than one regulator if it offers multiple services.

• OJK (Otoritas Jasa Keuangan). Supervises non-bank financial services, including P2P lending platforms (information-technology-based co-funding services) and investment-oriented fintech. OJK rules govern licensing, fit-and-proper assessment of controllers, change-of-control notification or approval, and ongoing reporting.
• Bank Indonesia (BI). Supervises the payment system, including payment service providers, electronic money, switching and gateway services. BI’s framework governs who may operate payment infrastructure and the conditions under which ownership and control may change.
• Ministry of Communication and Digital Affairs (Komdigi). Administers electronic system operator (PSE) registration and the data and localisation rules that apply to digital platforms.
• Investment and corporate approvals. The Ministry of Investment / BKPM (which operates the Online Single Submission system) and the Ministry of Finance are relevant for foreign investment registration and tax matters respectively.

OJK fintech acquisition approvals for transfers and changes of control

For OJK-licensed entities, a change of control is a regulated trigger. Depending on the licence class, this can require prior notification or affirmative approval, and the incoming controller will typically be subject to a fit-and-proper review covering integrity, financial capacity and competence. Practically, buyers should expect to supply detailed information about the acquiring group’s ownership structure, ultimate beneficial owners, source of funds and business plan for the licensed entity. Build the OJK process into the deal’s conditions precedent; closing should not occur until the required approval or acknowledgment is in hand.

The timetable for OJK review varies with the completeness of the submission and the complexity of the acquirer’s structure, and it is prudent to treat it as a matter of months rather than weeks.

Bank Indonesia payment licence transferability and approvals

For payment-related targets, Bank Indonesia’s consent regime is central to whether you can acquire a digital payments company in Indonesia and keep its licence operational. Payment licences are not freely transferable; a change in ownership or control of a licensed payment system operator generally requires BI involvement, and in many cases prior approval. This is why the share-versus-asset decision is so consequential in payments: a share deal preserves the licensed entity, but BI must still be satisfied as to the new controller; an asset deal will usually not carry the licence across at all, forcing a fresh application.

Buyers should confirm, early in diligence, the exact licence category the target holds and the specific BI consent pathway that applies, then condition closing on obtaining it.

Other agencies, investment registration, Ministry of Finance and Komdigi

Beyond the two principal financial regulators, a transaction to acquire fintech Indonesia businesses will usually touch investment registration for foreign buyers, the Ministry of Finance for tax, and Komdigi for electronic system registration and data compliance. Each of these should be sequenced into the regulatory workstream with a clear owner on the deal team, because a bottleneck in any one can hold up closing even where the financial regulator has cleared the deal.

Ownership, foreign investment rules and structuring options

A recurring question from international acquirers is whether foreign investors can fully own an Indonesian fintech or digital payments business. The honest answer is that it depends on the sub-sector. Indonesia’s investment framework, reflected in the Positive Investment List under Presidential Regulation No. 10 of 2021 (as amended) and in sector-specific rules, applies different treatment across activities, and payment and e-money businesses in particular have historically attracted ownership and control conditions that differ from more liberalised sectors. Buyers must verify the current position for the precise activity the target conducts, because the rules are activity-specific and change over time.

Where a direct 100% foreign holding is restricted or conditioned, structuring options come into play. Common approaches include a local joint venture with an Indonesian partner, a holding company structure that satisfies ownership thresholds while giving the foreign investor economic and governance rights within permitted limits, and phased acquisition structures that align with regulatory approvals. Each approach has trade-offs in control, tax and regulatory acceptability, and none should be adopted without confirming that it will pass regulatory scrutiny, regulators look through nominee or artificial arrangements designed to evade ownership limits, and nominee shareholdings to disguise foreign ownership are prohibited under Indonesian investment law.

Practical structuring options and foreign ownership in fintech Indonesia deals

• Direct acquisition. Simplest where the sub-sector permits full or majority foreign ownership; confirm the applicable cap before committing.
• Local joint venture. Pairs a foreign investor with an Indonesian partner to meet ownership requirements while sharing governance.
• Holding company structure. Uses an intermediate holding vehicle to organise ownership and, where relevant, to optimise treaty and tax outcomes, subject to anti-avoidance scrutiny.
• Phased or staged acquisition. Aligns the transfer of control with the grant of regulatory approvals, reducing the risk of a completed deal sitting in regulatory limbo.

Data protection, localisation and cybersecurity requirements

Data is both an asset and a liability in fintech, and the data dimension can make or break a plan to acquire fintech Indonesia businesses. The Personal Data Protection Law (Law No. 27 of 2022) establishes controller and processor obligations, lawful bases for processing, data subject rights, cross-border transfer rules and breach-notification duties. These obligations attach to the business and survive a change in ownership, so the buyer inherits the target’s compliance posture, and its gaps.

Separately, the Ministry of Communication and Digital Affairs administers the registration of private-scope electronic system operators (PSE), and fintech platforms generally fall within that regime. Financial-sector data can be subject to specific storage and processing requirements set by the sectoral regulators (OJK and Bank Indonesia), and cross-border transfers of personal data are regulated. A buyer must therefore understand where the target’s data is stored and processed, which third parties touch it, whether cross-border flows are compliant, and whether the target’s PSE registration is current and accurate. Cybersecurity practices, encryption standards and incident history all feed into the risk assessment.

Due diligence checklist items for technology and data

• PSE registration. Confirm the target is registered as a private electronic system operator and that the registration reflects its actual activities.
• Data mapping. Obtain a map of where personal and financial data is stored and processed, including cloud providers and offshore locations.
• Cross-border transfers. Verify that any transfer of personal data outside Indonesia meets the Personal Data Protection Law’s conditions.
• Third-party processors. Review processor contracts for adequate data protection terms and audit rights.
• Security controls. Assess encryption, access controls, logging and the target’s breach history and notification record.
• Consents. Check that customer consents cover the intended post-closing data use and any data transfer resulting from the deal.

Tax implications, asset vs share sale analysis

Tax is where the structure of a deal to acquire fintech Indonesia assets is often won or lost, and current Ministry of Finance regulations make refreshing the analysis essential rather than optional. The applicable regulations must be read alongside the existing income tax, VAT and transaction-tax framework administered by the Directorate General of Taxes. Buyers should model the full tax cost of each structure before fixing the deal, because headline price and post-tax cost can diverge significantly.

The two structures generate different tax profiles. In broad terms, an asset sale can trigger VAT on the transfer of certain assets and gains taxation at the level of the selling entity, while leaving the buyer with a potential step-up in the tax base of acquired assets. A share sale shifts the taxable event to the shareholders’ disposal of shares, typically engaging withholding or capital-gains mechanics depending on the seller’s residence and any applicable tax treaty, but it does not refresh the asset base inside the company. Stamp duty and other transaction taxes apply to transaction documents and should be budgeted.

For foreign sellers and buyers, the interaction with tax treaties and the rules on repatriation of proceeds is important. Treaty relief may reduce withholding on certain payments, but access to relief depends on substance and documentation (including a valid certificate of domicile), and anti-avoidance principles apply to structures lacking commercial substance. Because the tax rules continue to change, the only safe approach is to run worked numbers against the current regulation text and the Directorate General of Taxes’ implementation guidance.

• Model both structures early. Compute the post-tax outcome of asset and share deals before signing the term sheet.
• Confirm VAT treatment. Establish which assets attract VAT in an asset sale and who bears it, noting the prevailing VAT rate set by law.
• Check withholding and treaty relief. For cross-border deals, confirm the withholding position and whether treaty relief is available and substantiated.
• Budget transaction taxes. Include stamp duty and other document-related taxes in the cost model.
• Seek clearances where available. Where a ruling or confirmation can reduce uncertainty, pursue it before closing.

Fintech M&A due diligence checklist (legal, regulatory, tech and commercial)

Due diligence in a fintech deal is where red flags surface, and a disciplined checklist is the difference between a clean closing and an inherited problem. Treat diligence as a priority matrix: some findings are deal-breakers, others are price or indemnity issues, and others are merely remediation items.

The most serious red flags are licence non-transferability, unresolved regulatory enforcement, breaches of foreign ownership limits, and material unaddressed data breaches. Any of these can justify restructuring the deal, repricing it, or walking away. Below the deal-breaker tier sit the many issues that a well-drafted agreement can manage through warranties, indemnities, escrow and conditions precedent.

Documents to request, interviews to run and disclosures to obtain

• Licences and correspondence. All OJK and Bank Indonesia licences, approvals, conditions and correspondence, including any enforcement or warning letters.
• Corporate and ownership records. Cap table, shareholder agreements, ultimate beneficial ownership and any nominee arrangements.
• Regulatory compliance files. Capital adequacy records, consumer protection documentation and periodic regulatory reports.
• Data and technology. PSE registration, data maps, processor contracts, security policies and incident logs.
• Tax records. Returns, assessments, disputes and transfer-pricing documentation.
• Material contracts. Customer terms, merchant and partner agreements, and key supplier contracts.
• Management interviews. Sessions with compliance, technology and finance leads to test the documentary record against operational reality.

For identified risks, a short clause bank helps: an escrow holdback sized to the quantified exposure, a specific indemnity for the identified matter, and a condition precedent requiring remediation or regulatory sign-off before closing. A structured due-diligence and closing checklist can operationalise this for the deal team.

Deal mechanics, SPA issues, conditions precedent and closing

The share or asset purchase agreement must do more than record a price. In a transaction to acquire fintech Indonesia assets, the agreement carries the regulatory and tax risk allocation that diligence has identified. The most important drafting points cluster around conditions precedent, licence continuity and risk allocation.

• Regulatory consents as conditions precedent. Make closing conditional on obtaining the required OJK and/or Bank Indonesia approvals or acknowledgments, and on any investment and competition clearances.
• Licence transfer or continuity. Address expressly how the target’s licences will survive the deal, and include fallback mechanisms if a required consent is delayed or refused.
• Employees and consumer contracts. Provide for the treatment of employees under the prevailing manpower law and the continuity of customer and merchant relationships.
• Data transfer consents. Ensure customer consents and data arrangements support the intended post-closing data handling.
• Tax closing adjustments. Include mechanisms for tax indemnities and purchase-price adjustments reflecting the agreed tax position.
• Holdbacks and escrow. Use escrow to secure indemnities and to bridge the gap between signing, regulatory approval and post-closing remediation.

Typical timeline and who leads each regulatory interaction

A regulated fintech acquisition is typically measured in months, not weeks, with the critical path running through the financial regulator’s change-of-control review. Assign a clear owner to each regulatory interaction: local counsel usually leads the OJK and Bank Indonesia submissions, the tax adviser leads the Ministry of Finance and tax-authority engagement, and a data or technology lead handles Komdigi and PSE matters. Running these workstreams in parallel, rather than sequentially, is the single most effective way to compress the overall timetable.

Post-closing integration and licence migration checklist

Closing is not the finish line. Post-closing, the buyer must execute a compliance and integration plan to bed the acquisition down.

• Regulatory notifications. File any post-completion notifications required by OJK, Bank Indonesia or Komdigi, and any competition notification to the KPPU where applicable.
• Licence novation or reapplication. Complete any licence migration steps, including fresh applications where a licence could not transfer.
• Customer and merchant notices. Issue required notices to customers and counterparties about the change of ownership.
• Data transfer and localisation plan. Execute the agreed data integration and transfer plan consistent with the Personal Data Protection Law and sectoral data rules.
• Remediation calendar. Track and complete the remediation items identified in diligence against a compliance calendar with accountable owners.

Asset sale vs share sale, comparison table

Key takeaways and recommended next steps

For buyers planning to acquire fintech Indonesia businesses in 2026, the path to a clean closing runs through early, parallel planning across regulatory, tax and data workstreams.

• Map the target’s exact licence classes to the correct regulator, OJK, Bank Indonesia or both, at the outset.
• Decide asset versus share structure on the basis of licence transferability and the current tax outcome, not preference.
• Confirm the current foreign ownership position for the specific sub-sector before fixing the structure.
• Diligence data and localisation compliance thoroughly; these liabilities survive the deal.
• Engage local counsel, a tax adviser and, where appropriate, request regulator pre-meetings before signing.

Handled in this sequence, a transaction to acquire fintech Indonesia assets becomes a managed process rather than a series of surprises.

Sources

1. Otoritas Jasa Keuangan (OJK)
2. Bank Indonesia
3. Ministry of Finance (Kementerian Keuangan)
4. Directorate General of Taxes (DJP)
5. Kementerian Komunikasi dan Digital (Komdigi)
6. Peraturan.go.id, State Regulation Repository
7. Mahkamah Agung / JDIH (Supreme Court Legal Database)