How to Obtain a Payment Gateway (PSP) License in Indonesia (2026): Capital, Foreign Ownership & Bank Indonesia Approval Steps

A payment gateway license Indonesia application is one of the most consequential regulatory undertakings a fintech, aggregator, or e-commerce platform can face when entering the Indonesian market. Bank Indonesia (BI) is the central regulator of the national payment system, and in 2026 its supervisory posture has sharpened around capital adequacy, governance, technology controls, and cross-border ownership. For founders, CFOs, in-house counsel, and investors, the practical challenge is translating a complex web of regulations into a sequenced, fileable application. This guide walks through the end-to-end process, licence classification, capital thresholds, foreign ownership structuring, the Bank Indonesia approval steps, and post-licence obligations, so you can plan a credible submission with realistic timing.

Executive summary: who should read this and the quick takeaway

This guide is written for founders, CFOs, in-house counsel, investors, and M&A advisers assessing or applying for a payment gateway license Indonesia under Bank Indonesia’s payment system framework. The core takeaway: payment service provider licensing for payment system activities is regulated by Bank Indonesia, not the Financial Services Authority (OJK), and a successful application depends on correctly classifying your activities, meeting minimum capital and governance thresholds, structuring foreign ownership within permitted limits, and passing BI’s documentary review and technology assessment.

The sections below set out the licence categories, a pre-application decision framework, capital and financial resource requirements, foreign ownership and corporate structuring options, the Bank Indonesia approval steps with a timeline, governance and technology controls BI will test, a documentation checklist, fees and ongoing compliance, common pitfalls, a comparison table, and an FAQ.

• Licensing type. Payment service provider (PSP) licence from Bank Indonesia for payment gateway activity.
• Capital. Minimum paid-up capital varies by licence category and the range of services requested, confirm the current threshold against the applicable BI regulation.
• Bank Indonesia timeframe. Expect pre-application engagement followed by a formal documentary and operational review measured in months rather than weeks.

Overview: payment gateway (PSP) in Indonesia, regulator and licence types

Understanding who regulates what is the first step to a defensible payment gateway license Indonesia strategy. Indonesia splits financial supervision between two principal authorities, and misidentifying the correct regulator is a common and costly early error.

Who regulates PSPs? Bank Indonesia’s role versus OJK

Bank Indonesia is the primary regulator for the national payment system, including payment service providers, payment gateways, electronic money, and payment system infrastructure providers that handle switching, clearing, and settlement activity. Its mandate covers licence issuance, supervision, and conduct standards for entities that move payment instructions or funds between payers, payees, and the banking rails. The Bank Indonesia framework defines the licence categories and the application procedure applicable to payment service providers.

The Otoritas Jasa Keuangan (OJK), by contrast, supervises banks, capital markets, insurance, and much of the lending-based fintech sector, for example, licensed peer-to-peer lending platforms. For a payment gateway operator, BI is the licensing authority, but boundary questions frequently arise where a business model combines payment processing with lending, wallets, or investment features. In those hybrid cases, the Otoritas Jasa Keuangan framework may also apply, and applicants should map each product feature to the correct regulator before filing.

Licence types explained: PSP versus payment infrastructure provider

Not every business that touches a payment needs the same authorisation. Bank Indonesia’s framework distinguishes between categories of activity, and the licence you need depends on what you actually do with funds and data. Under BI’s current payment system framework, participants are broadly organised into payment service providers and payment system infrastructure operators, with licences granted by activity rather than by a single fixed label:

• Payment service provider (payment gateway). Routes and processes transaction data between merchants, acquirers, and the payment rails. A pure gateway facilitates authorisation and settlement messaging; whether it also holds funds determines the depth of regulatory obligation.
• Electronic money issuance / fund management activity. Issues stored-value instruments and holds customer float. This triggers heightened prudential requirements because the operator custodies client money.
• Payment system infrastructure operator (switching, clearing, and settlement). Provides the infrastructure that interconnects issuers and acquirers. These are systemically important roles with the most demanding capital and governance expectations.

Correctly answering “which licence do you need?” is the single most important classification decision in any payment service provider license Indonesia project. It determines capital thresholds, custody obligations, foreign ownership treatment, and the documentary package BI will expect.

Pre-application checks: business model, services and classification

Before engaging Bank Indonesia, you must be able to describe precisely what your platform does. BI’s reviewers assess substance over labels, so an honest functional analysis of your money and data flows is essential groundwork for any payment gateway license Indonesia filing.

Do you process funds, hold float, or issue e-money?

Three questions drive classification. First, do you merely transmit transaction instructions, or do funds pass through accounts you control? Second, if funds pass through, how long do you hold them before settlement, are they genuinely in transit or parked as float? Third, do you issue a stored-value instrument that customers top up and spend? If you hold float or issue stored value, you move toward electronic money territory with stronger prudential and custody requirements. If you route authorisation and settlement data without taking custody of client money, you sit closer to a pure payment gateway classification.

Aggregator versus direct PSP, implications for licence type

Payment aggregators consolidate many small merchants under a single acquiring relationship, often collecting settlement proceeds before disbursing to sub-merchants. That collection-and-disbursement step can introduce custody and float characteristics that alter licence classification and capital requirements. A direct PSP that passes funds straight through to merchant bank accounts carries a different risk profile. Map your merchant onboarding, settlement, and disbursement flows early, because the aggregation model frequently pushes an applicant into a higher-obligation category than founders initially assume.

Contractual scopes: merchant onboarding, settlement, and refund flows

BI expects the legal and operational architecture to match the licence requested. That means documented merchant onboarding and know-your-customer procedures, clear settlement timetables, defined refund and chargeback handling, and contracts with acquiring banks that allocate risk and liability. Drafting these contractual scopes before application does double duty: it clarifies your own classification and it produces evidence BI will require. A short internal decision flow, “do we hold funds? for how long? do we issue stored value?”, resolves most classification ambiguity before the first regulator meeting.

Capital and financial resource requirements for a payment gateway license Indonesia

Capital is where many applications stall. Bank Indonesia sets minimum paid-up capital by licence category, and the figure scales with the breadth of services and the systemic importance of the activity. A pure payment gateway typically faces a lower threshold than an electronic money issuer that custodies float or a payment infrastructure operator that underpins the national system.

Current minimum capital thresholds (2026)

Minimum paid-up capital for a payment service provider is fixed by the applicable Bank Indonesia regulation, and the precise amount depends on the category of payment services you are licensed to provide. Because these thresholds are set by regulation and can be revised, applicants must verify the current figure against the governing instrument rather than relying on historical numbers. Bank Indonesia’s payment system regulations and related instruments are accessible through BI’s own regulatory pages and the national legislation repository, and the controlling threshold should be confirmed against the specific Bank Indonesia regulation applicable to your licence class before you capitalise the company.

A practical illustration helps. Consider a venture seeking a pure payment gateway authorisation that does not custody client funds. It will aim to meet the gateway-category paid-up capital floor. A second venture bundling a stored-value wallet into the same platform will need to satisfy the higher electronic money threshold because it holds customer float. The lesson is that scope expansion, adding wallet, lending, or settlement features, raises your capital obligation, so the business plan and the capitalisation plan must be designed together.

Financial projections and liquidity buffers

Beyond the headline paid-up capital figure, Bank Indonesia assesses whether the company can sustain operations and absorb shocks. Expect to submit multi-year financial projections, a funding plan that demonstrates runway beyond launch, and liquidity buffers appropriate to transaction volumes. Where an applicant custodies or temporarily holds settlement funds, BI will scrutinise segregation arrangements and the adequacy of liquid resources to meet settlement obligations under stress. Thin capitalisation plans that just clear the statutory minimum but show no buffer frequently attract objections.

Shareholder guarantees and restricted assets

Capital must be real, traceable, and available. BI examines the source of funds, the standing of shareholders, and whether capital is encumbered. Shareholder support, in the form of capital commitment letters or guarantees, can strengthen an application, while restricted or pledged assets masquerading as free capital will not satisfy the paid-up requirement. On capital requirements payment gateway Indonesia reviews, the recurring practical point is that reviewers trace capital to its ultimate source, so opaque funding chains should be resolved before filing.

Foreign ownership and structuring options

Foreign investors regularly ask whether they can own a payment gateway outright. The answer is nuanced and depends on the licence category and the prevailing foreign investment rules administered through Indonesia’s investment coordination framework.

Can a foreign entity obtain a PSP licence?

Foreign participation in Indonesian payment services is permitted but constrained. Foreign ownership payment gateway Indonesia limits are governed by the investment regime and by sector-specific rules for payment system entities, which can include both foreign shareholding caps and minimum domestic shareholding or control requirements for certain payment system activities. In practice this means a foreign investor almost always operates through a locally incorporated foreign investment company (PMA) rather than a branch, and the permitted foreign shareholding percentage depends on the activity and the applicable rules at the time of application.

The controlling guidance on foreign investment and the investment list is administered through the investment regime and the online single submission system operated by the Ministry of Investment / BKPM (Indonesia’s investment coordinating authority), and the exact percentage a foreign investor may hold must be confirmed against that guidance and the applicable BI rules for the specific payment licence sought.

Local entity versus branch versus joint venture, pros and cons

Three structures dominate market-entry planning:

• Local PMA entity. The standard vehicle for foreign-backed PSPs. It establishes a regulated Indonesian company that BI can supervise directly, satisfies local presence expectations, and can hold the licence. It requires local incorporation, directors, and compliance infrastructure.
• Branch of a foreign company. Generally impractical for payment licensing because BI supervises locally incorporated and capitalised entities; a branch does not provide the separate, locally capitalised legal person the framework contemplates.
• Joint venture with a local partner. Combines foreign capital and technology with local shareholding to satisfy ownership limits and bring market knowledge. The trade-off is shared control, governance negotiation, and alignment of exit expectations.

Investment list, sectoral limitations and practical structuring

Two worked structures illustrate the choice. A foreign investor permitted to hold up to the sector cap might structure as a PMA holding the maximum allowed foreign percentage, with a local shareholder or shareholders holding the balance, for example an arrangement that leaves the majority with domestic shareholders where that reflects the permitted ceiling and any domestic control requirement. Alternatively, where the activity permits fuller foreign participation, a more heavily foreign-owned PMA may be viable. Applicants sometimes consider nominee arrangements to circumvent ownership caps; this carries serious legal risk, is prohibited under Indonesian company and investment law, and can invalidate the shareholding structure. A compliant joint venture or a correctly capitalised PMA at the permitted cap is the durable route.

When designing the structure, cross-check the sectoral limitation applicable to your precise licence category, because caps and control requirements can differ across payment activities.

Bank Indonesia approval steps: from application to grant

The Bank Indonesia approval steps proceed in sequenced stages, and understanding what BI expects at each stage is what separates a smooth grant from a stalled file. The payment gateway license Indonesia process rewards early engagement and meticulous documentation.

Pre-application engagement with Bank Indonesia

Before formal submission, applicants typically engage BI to outline the business model, confirm the correct licence category, and understand documentary expectations. This stage is where classification questions are resolved and where BI signals the governance and technology standards it will test. Treating pre-application engagement as a formality is a mistake; it is the opportunity to align your application with BI’s expectations before committing to a filing and to surface any structural issues, such as ownership or capital source concerns, while they are still fixable.

Formal submission: forms, documents, and affidavits

The formal application comprises BI’s prescribed forms together with corporate, financial, operational, and technology documentation. This package includes constitutional documents, evidence of paid-up capital, the business plan, governance and organisational charts, risk and compliance manuals, IT architecture, security policies, and the contracts underpinning merchant and bank relationships. Corporate documents frequently require notarisation and legalisation; in Indonesia, company deeds and many corporate instruments must be executed before a notary (notaris), whose profession is regulated under the law on the office of notary and overseen by the Ministry of Law and the Indonesian Notaries Association. Applicants should ensure corporate instruments are properly executed and legalised before submission.

Operational assessment and IT/security review

Bank Indonesia does not grant a payment licence on paper alone. It assesses operational readiness, which can include review and testing of the applicant’s technology, security controls, and operational procedures. The reviewer wants to see that the systems described in the application actually exist, function, and meet security expectations, including resilience, access controls, transaction monitoring, and incident response. Applicants should have a production-ready or demonstrable environment and be prepared to evidence controls rather than merely describe them.

Grant, licence conditions, and post-grant reporting

On a successful review, BI issues the licence, frequently subject to conditions, for example remediation items, reporting commitments, or scope limitations. The licence is the beginning of a supervisory relationship, not the end of the process. Post-grant obligations include periodic reporting, maintenance of capital and governance standards, and notification of material changes. These Bank Indonesia approval steps culminate in an ongoing compliance regime discussed further below.

Timeline milestones

Timing depends on application quality and responsiveness, but the following milestone structure helps planning. Pre-application engagement runs for several weeks as the model and classification are confirmed. Formal documentary review then proceeds over a period measured in months, during which BI raises queries the applicant must resolve. Operational and technology review follows, and the grant comes after BI is satisfied on both documentary and operational dimensions.

Because published timelines can change, confirm current indicative review periods against Bank Indonesia’s own procedural guidance at the time you file.

Governance, risk management and technology controls BI will test

Bank Indonesia’s 2026 supervisory focus places governance and technology controls at the centre of licensing decisions. A strong business plan with weak controls will not secure a payment gateway license Indonesia grant.

Required governance: board, compliance officer, and AML/CFT

BI expects a fit-and-proper board and management, a clearly designated compliance function, and a documented anti-money-laundering and counter-terrorist-financing programme. This includes customer due diligence, transaction monitoring, suspicious transaction reporting to the Indonesian financial intelligence unit (PPATK), sanctions screening, and record-keeping. The compliance officer must have genuine authority and resources, and the organisational chart should show independent risk and compliance reporting lines rather than nominal roles.

IT security and outsourcing: cloud, third-party processors, and cross-border data

Technology controls are a recurring supervisory priority. BI scrutinises IT security architecture, resilience, and the use of outsourcing, including cloud hosting, third-party processors, and any cross-border data flows. Where data is hosted offshore or processing is outsourced, the applicant must demonstrate control, oversight, and compliance with Indonesian requirements for electronic system operators and with personal data protection obligations under Law No. 27 of 2022 on Personal Data Protection. Registration and electronic system operator obligations are administered by the Ministry of Communication and Digital Affairs (formerly the Ministry of Communication and Informatics), and PSPs operating electronic systems must address those registration and data-handling obligations alongside BI’s requirements.

QRIS, SNAP/Open API, and transaction monitoring standards

Operators processing QR payments must comply with the national QR standard, QRIS, and the national open API payment standard (SNAP) shapes how PSPs interoperate with banks and other providers. Payment card data handling brings industry security standards such as PCI DSS into scope. Robust, real-time transaction monitoring is expected both for fraud control and for AML/CFT purposes. Applicants should demonstrate concrete implementation of these standards, not merely an intention to adopt them.

Documentation checklist and sample application package

A well-organised application package materially shortens review. The following checklist captures the core documents BI reviewers expect for a payment service provider license Indonesia submission:

• Corporate documents. Deed of establishment, articles of association, shareholder register, evidence of foreign investment approval and business identification number where applicable, and management appointments.
• Financials. Evidence of paid-up capital, audited or opening financial statements, multi-year financial projections, and a funding plan.
• Business plan / prospectus. Detailed description of services, money flows, settlement model, target merchants, and risk profile aligned to the licence category requested.
• IT architecture diagram. System topology, hosting arrangements, outsourcing map, and data flow diagrams including any cross-border elements.
• Security policies. Information security policy, access controls, incident response plan, business continuity and disaster recovery documentation.
• Contracts. Agreements with acquiring/partner banks, template merchant agreements, and processor or technology vendor contracts.
• KYC/AML manuals. Customer due diligence, transaction monitoring, suspicious transaction reporting, and sanctions screening procedures.

Prepare a master index mapping each document to the relevant BI requirement. This both demonstrates completeness and accelerates the reviewer’s assessment. Treat the package as a single coherent narrative in which the business plan, financials, controls, and contracts all describe the same business.

Fees, ongoing compliance, and enforcement trends in 2026

Securing a payment gateway license Indonesia is the start of an enduring compliance obligation, and 2026 supervisory trends reward applicants who build for the long term.

One-time application and setup costs

Applicants should budget for regulatory application costs together with corporate setup expenses, notary fees for incorporation and document execution, legal and advisory fees, and the cost of building the technology and compliance infrastructure required to pass review. The largest practical cost is often not the official fee but the investment needed to reach operational and security readiness.

Ongoing BI reporting, audit expectations, and supervisory focus

Post-licence, PSPs file periodic reports to Bank Indonesia, maintain capital and governance standards, submit to supervision, and notify material changes. In 2026, BI’s supervisory priorities emphasise capital adequacy, governance quality, and oversight of outsourcing and technology arrangements. Operators relying on cloud and third-party processors should expect sustained scrutiny of their outsourcing governance, and should maintain audit trails and control documentation that can withstand examination.

Common pitfalls and mitigation: practical tips from counsel

Experience advising PSP applicants surfaces recurring mistakes that are entirely avoidable with early planning.

Typical Bank Indonesia objections and how to avoid them

• Misclassified licence category. Applying for a pure gateway licence when the model holds float. Mitigation: run the functional money-flow analysis before engaging BI.
• Thin or opaque capital. Clearing the minimum with no buffer, or capital from untraceable sources. Mitigation: capitalise with a buffer and document the source of funds end to end.
• Controls described but not demonstrable. A security policy on paper but no working environment. Mitigation: have a production-ready system before review.
• Ownership structure that stretches the rules. Nominee or opaque foreign-control arrangements. Mitigation: structure to the permitted cap through a compliant PMA or joint venture.

Planning for a BI review and sandbox transition

Prepare for the operational assessment as rigorously as for the documentary review. Rehearse the assessment, assemble evidence of each control, and ensure technical and compliance staff can demonstrate the systems. Where a regulatory sandbox or pilot has been used, plan the transition to full licensed operation carefully so that the production environment matches what was tested. A practical counsel tip: assign a single accountable owner for the application who maintains the document index and manages BI queries, because fragmented responses are a frequent cause of delay.

Comparison table: payment gateway (PSP) versus e-money issuer versus payment infrastructure licences

Because capital figures and ownership caps are fixed by regulation and periodically revised, verify each cell against the current Bank Indonesia instrument and investment guidance before relying on it.

Next steps and where to get help

Obtaining a payment gateway license Indonesia is achievable with disciplined preparation: classify your activities correctly, capitalise with a buffer, structure foreign ownership within the permitted caps, build demonstrable governance and technology controls, and assemble a coherent, well-indexed application. The Bank Indonesia approval steps reward applicants who engage early and evidence substance over labels. For a structured start, review our guidance on how to choose a technology lawyer in Indonesia (2026), and explore supporting resources on payment gateway versus e-money licensing in Indonesia, QRIS and SNAP compliance for PSPs, and Indonesia fintech licensing as they are published. You can also find a technology lawyer in Indonesia through the GLE lawyer directory.

This article is general information and is not legal advice. Regulatory thresholds, foreign ownership caps, and timelines are set by regulation and may change; confirm current requirements against primary Bank Indonesia sources and seek tailored advice before filing a payment gateway license Indonesia application.

Sources

1. Bank Indonesia (BI), official website
2. Otoritas Jasa Keuangan (OJK), official website
3. Peraturan.go.id, National legislation repository
4. Ministry of Investment / BKPM, official site
5. Supreme Court of the Republic of Indonesia (Mahkamah Agung), decisions database