How to Acquire a Fintech Company in Indonesia: Step‑by‑step M&A Process, Regulatory Approvals & Timeline (2026)

Understanding how to acquire a fintech company in Indonesia requires navigating a multi‑layered regulatory framework that touches corporate law, financial‑services supervision, competition rules, foreign‑investment screening and data protection. Indonesia’s fintech sector, spanning peer‑to‑peer (P2P) lending, e‑money issuance, payment switching, digital banking and crypto‑asset trading, is supervised by several regulators, each with distinct approval gates that must be cleared before, during or after closing. This guide sets out the complete fintech M&A process Indonesia buyers and sellers will encounter in 2026, from eligibility screening through to post‑close licence transfer and integration.

Overview of the Fintech Acquisition Process and Who It Applies To

A fintech acquisition in Indonesia can be structured as a share purchase (acquiring the majority or entirety of a target company’s equity) or, less commonly, as an asset purchase. Because most fintech businesses operate under regulated licences issued to a specific legal entity, a share purchase is the dominant structure, it preserves the licence‑holding entity and avoids the need to apply for an entirely new licence.

The regulators involved depend on the target’s licence type:

• Otoritas Jasa Keuangan (OJK), supervises P2P lending platforms, fintech innovation operators and other non‑bank financial institutions. OJK approval or notification is required when a change of controlling shareholder triggers licence re‑authorisation conditions.
• Bank Indonesia (BI), regulates e‑money issuers, payment‑system providers, payment switching operators and QRIS participants. BI must be notified of material changes in ownership.
• BKPM (Ministry of Investment), administers foreign‑investment (PMA) registrations. Any foreign acquirer must ensure the target activity is open to foreign ownership under Perpres No.10/2021 and update the PMA registration post‑close.
• KPPU (Indonesia Competition Commission), reviews mergers and acquisitions that meet specified asset or turnover thresholds. Notification is mandatory and must be filed within the prescribed window.

Each licence type, P2P lending, e‑money, payment switching, crypto‑asset trading, carries its own regulatory approval conditions. Acquirers must map these gates at the outset and build them into the transaction timeline as conditions precedent to closing.

Eligibility and Prerequisites for a Fintech Acquisition in Indonesia

Before issuing a letter of intent, buyers must confirm they are eligible to acquire the target and that the target itself is in a condition suitable for regulatory transfer. The fintech acquisition Indonesia requirements differ depending on whether the buyer is a domestic entity or a foreign investor.

Does the Fintech Hold a Regulated Licence?

The first screening question is whether the target operates under a licence that imposes change‑of‑control conditions. The main licence categories and their primary regulators are:

• P2P lending licence, OJK (under the OJK fintech innovation framework)
• E‑money issuer licence, Bank Indonesia
• Payment‑system / switching licence, Bank Indonesia
• Crypto‑asset trading platform registration, previously supervised by the Commodity Futures Trading Regulatory Agency (Bappebti), with supervisory authority transitioned to OJK
• Digital banking or multifinance licence, OJK

If the target holds any of these licences, the acquisition will require regulatory notification or prior approval as a condition of closing.

Foreign Investor Checklist

Foreign ownership of Indonesian fintech companies is governed by Perpres No.10/2021 on Investment Business Fields, which classifies business activities as open, conditionally open, or closed to foreign investment. Many fintech sub‑activities are open to majority or full foreign ownership, but certain categories, particularly those involving sensitive payment infrastructure, may carry conditions or caps. Acquirers must verify the target’s specific business classification (KBLI code) against the current Perpres list and register the investment through BKPM’s Online Single Submission (OSS) system.

Regulatory Risk Flags to Screen in Initial Due Diligence

Before committing resources to a full due‑diligence exercise, acquirers should screen for:

• Open investigations or enforcement proceedings by OJK, BI or other agencies
• Licence conditions, suspensions or restrictions imposed by regulators
• Compliance status under UU No.27/2022 (Personal Data Protection / PDP Law), including whether the target has conducted data protection impact assessments (DPIAs)
• Anti‑money‑laundering and counter‑terrorism financing (AML/CTF) compliance gaps

Step‑by‑Step Procedure to Acquire a Fintech Company in Indonesia

The fintech M&A process Indonesia acquirers must follow runs through seven principal stages. The timeline table at the end of this section consolidates typical durations for each stage.

Step 1, Pre‑Deal Planning and Regulatory Scoping (2–8 Weeks)

The acquirer’s legal and regulatory team, together with local Indonesian counsel, maps every licence held by the target and identifies which regulators must be notified or must grant approval. This stage includes:

• Classifying the target’s KBLI business codes and confirming foreign‑ownership eligibility via BKPM
• Requesting the target to open a preliminary (redacted) data room with copies of all regulatory licences, conditions and recent correspondence with OJK or BI
• Making informal inquiries with regulators where permitted, to understand current processing times and any heightened scrutiny areas
• Engaging specialist regulatory counsel to assess whether a change of majority shareholder triggers a mandatory licence re‑authorisation or a simple notification

Step 2, Letter of Intent and Regulatory Conditions (1–4 Weeks)

The LOI or term sheet should include:

• Conditions precedent (CPCs) tied to regulatory approvals, specifically, OJK/BI approval or non‑objection for licence continuity, KPPU clearance (if thresholds are met) and BKPM registration update
• Representations from the seller on the status and good standing of all regulated licences
• Escrow or holdback mechanisms triggered if regulatory re‑authorisation is delayed or conditions are imposed post‑close
• A clear break fee or walk‑away right if regulatory approval is refused

Step 3, Due Diligence (30–90 Days, Concurrent)

Due diligence for a regulated fintech acquisition must cover standard corporate and financial matters and an additional layer of regulatory diligence:

• Licence diligence: review all licence terms, conditions, renewal dates and any consent‑to‑transfer clauses embedded in OJK or BI approvals
• Regulatory correspondence: obtain and review all formal and informal communications between the target and its regulators over at least the prior 24 months
• AML/KYC review: assess the target’s AML/CTF programme, suspicious‑transaction reporting history and customer identification processes
• Data protection/PDP compliance: review the target’s compliance with UU No.27/2022, including data processing agreements, DPIAs, data‑localisation practices and cross‑border data‑transfer mechanisms
• Technology infrastructure: confirm ownership of and rights to core software, APIs, cloud‑hosting arrangements and data centres (particularly data‑localisation requirements)

Step 4, Signing the SPA and Preparing Regulatory Filing Packages (2–6 Weeks)

After diligence confirms no deal‑breaking issues, the parties negotiate and execute the share purchase agreement (SPA). In parallel, counsel prepares regulatory filing packages:

• KPPU merger notification, required if the combined entity’s asset value or annual turnover exceeds prescribed thresholds. KPPU filings are submitted electronically.
• OJK licence transfer or re‑authorisation application, the content of this package depends on the licence type. For P2P lending platforms, it typically includes the new shareholder structure, fit‑and‑proper documentation and updated business plans.
• BI notification or approval request, for e‑money issuers or payment‑service providers, BI requires notification of changes in controlling shareholders and may request supplementary documentation on the acquirer’s financial standing.
• BKPM / OSS update, for foreign acquirers, the PMA registration and OSS permit must be updated to reflect the new ownership structure.

Step 5, Regulatory Filings and Approvals (60–180+ Days)

Once filed, each regulator follows its own review process:

• KPPU: the review progresses through validation and document verification stages. Complex transactions may undergo an in‑depth review.
• OJK: review timelines vary by licence type; OJK may issue requests for additional information (RFIs) that pause the review clock. Industry observers expect processing to take 4–12 weeks for straightforward licence re‑authorisations.
• BI: payment‑system and e‑money licence reviews follow BI’s internal processing standards, which may include technical integration reviews (QRIS connectivity, system interoperability).
• BKPM: OSS updates for PMA ownership changes are generally processed within weeks, though delays can occur if the business classification is flagged for conditional review.

Step 6, Closing (Upon Regulatory Clearance)

Closing occurs once all CPCs are satisfied. Key closing actions include:

• Execution of share transfer deeds before a notary, as required under Law No.40/2007 (Company Law)
• Payment of consideration (via escrow release or direct transfer)
• Update of the company’s shareholders register and articles of association
• Filing of amended corporate documents with the Ministry of Law and Human Rights
• Post‑closing BKPM and OSS updates

Step 7, Post‑Close Licence Transfer and Integration (1–6 Months)

Even after closing, the acquirer must complete operational integration and confirm regulatory compliance:

• Finalise any remaining OJK or BI re‑authorisation conditions
• Migrate AML/KYC systems to the acquirer’s group standards
• Conduct a post‑close data‑protection audit under UU No.27/2022, including issuing customer notices if required
• Complete technology systems integration and confirm data‑localisation compliance

Required Documents for a Fintech Acquisition in Indonesia

The documents needed for regulatory filings, due diligence and closing form an extensive checklist. The table below sets out the core documents, who issues them and practical notes on format and validity.

Acquisition Timeline and Key Deadlines

The overall acquisition timeline for a fintech company in Indonesia typically ranges from 6 to 12 months, measured from initial regulatory scoping to completion of post‑close integration. The main variable is the speed of regulatory approvals: a simple share purchase of an unlicensed fintech entity may close in 3–4 months, while a transaction involving an OJK‑licensed P2P platform and a KPPU filing may extend to 12 months or longer.

Key deadline considerations that shape the acquisition timeline include:

• KPPU notification timing: the notification must be filed within the statutory window. Late filing can result in administrative sanctions. Acquirers should engage competition counsel early to assess whether thresholds are met and to prepare the filing in parallel with SPA negotiation.
• OJK processing windows: OJK review timelines are not published as fixed statutory deadlines but are influenced by the completeness of the application package. Incomplete submissions trigger RFIs that pause the review.
• BI processing for payment licences: BI’s review of e‑money and payment‑system provider ownership changes may include technical assessments (QRIS integration, system security audits) that extend timelines beyond standard administrative processing.
• BKPM / OSS updates: foreign‑investment registration updates through OSS are generally faster (weeks rather than months) but depend on correct KBLI classification and clean documentation.

Costs, Fees and Tax Considerations

Transaction costs for acquiring a fintech company in Indonesia span regulatory filing fees, professional advisory fees and potential tax liabilities. The table below provides illustrative ranges, all figures should be verified with the relevant regulator or adviser before being relied upon for budgeting purposes.

Tax considerations that affect the overall cost of the transaction include stamp duty on share transfer documents, potential withholding tax on cross‑border payments to foreign sellers, and corporate income tax implications arising from any gain on the sale. Value‑added tax may apply to advisory services. Acquirers should obtain a tax opinion from Indonesian tax counsel before finalising the transaction structure.

What Changes in 2026 for Fintech Acquisitions in Indonesia

Several regulatory developments in the 2024–2026 period directly affect how fintech acquisitions are structured, approved and integrated:

• OJK fintech innovation framework updates. OJK has continued refining its regulatory instruments for fintech operators, expanding reporting obligations and prudential conditions for P2P lending and other licensed entities. Industry observers expect these changes to increase the documentation and compliance burden during licence re‑authorisation following a change of control.
• Bank Indonesia payments regulation. BI’s accelerated payments regulation, covering QRIS expansion, e‑money clarification and Digital Rupiah initiatives, means that payment licence transfers now incorporate additional technical integration and AML/CTF compliance requirements. Acquirers of e‑money issuers or payment‑switching providers should budget additional time and resources for BI’s technical review.
• BKPM and Perpres FDI clarity. Perpres No.10/2021 and subsequent amendments have opened many fintech business fields to full foreign ownership, but specific sub‑activities remain conditional. The Perpres list should be checked at the outset of every transaction, as classifications can change between the date of LOI and closing.
• Personal Data Protection Law enforcement. UU No.27/2022 continues to be enforced, and its implementing regulations impose concrete obligations on data controllers and processors. Fintech acquirers must conduct DPIAs, verify data‑localisation compliance and plan for customer re‑consent where the acquisition changes the data controller’s identity or processing purposes.

Common Pitfalls in Fintech Acquisitions and How to Avoid Them

• Assuming licences automatically transfer on a share sale. A share purchase preserves the licence‑holding entity, but many OJK and BI licences include conditions triggered by a change of controlling shareholder. Always include licence re‑authorisation as a CPC and pre‑agree a transitional regulatory filing plan with the seller.
• Missing KPPU notification thresholds or filing late. Failing to assess whether the transaction meets KPPU’s asset or turnover thresholds, or filing the notification outside the prescribed window, can result in administrative penalties and remedial conditions. Engage competition counsel at the regulatory‑scoping stage.
• Underestimating data‑protection obligations. Fintech companies hold large volumes of customer personal data. Acquirers who fail to conduct a DPIA or plan for re‑consent obligations risk post‑close enforcement action under UU No.27/2022. Build a data‑migration and compliance plan into the integration workstream and fund it through an escrowed remediation reserve.
• Incomplete AML/KYC files. Gaps in the target’s customer identification records can force costly re‑onboarding exercises after closing. Screen AML/KYC completeness during diligence and negotiate an indemnity or escrow holdback for remediation costs.
• Overlooking technology dependencies. Cloud‑hosting arrangements, API licences and third‑party software dependencies can create operational risk if contracts contain change‑of‑control termination rights. Review all material technology contracts during diligence and obtain consents or waivers before closing.

Sources

1. Otoritas Jasa Keuangan (OJK), Regulations and POJK Repository
2. Bank Indonesia (BI), Payment System and E‑Money Regulations
3. Ministry of Investment / BKPM, Foreign Investment Rules
4. Peraturan.go.id, Law No.40/2007 (Company Law) and Perpres No.10/2021
5. KPPU (Indonesia Competition Commission), Merger Notification Guidance
6. Peraturan BPK, Undang‑Undang No.27/2022 (Personal Data Protection)