Licenses and Regulatory Approvals Issued by BI, OJK, and Bappebti

Every financial license Indonesia issues, across Bank Indonesia, OJK, and Bappebti, banking, payments, insurance, capital markets, lending, gold, and a handful of categories most people don't know exist, traced back to what each one was actually built to stop.

Published by Sudhanshu on Mar 3, 2025

I've been in fintech long enough now that roughly once a month, someone new to Indonesia, usually building or backing something here for the first time, asks me some version of the same question: how does licensing actually work? It's different from India in ways that trip people up, there's no single regulator, no single license, and the mapping from "what my product does" to "what I'm legally required to hold" isn't obvious from outside. I finally sat down and compiled the whole thing, because in fintech here, you don't get to build first and figure out licensing later, the license is often the thing that determines whether you can build at all.

Here's the "no single regulator" part in full: three bodies split financial oversight in Indonesia. Bank Indonesia licenses payments, OJK licenses banks and every non-bank financial company, and Bappebti covers what's left of commodities. That split isn't one master plan, it's the accumulated result of specific companies failing in public and a regulator rewriting the rule that let it happen. Below is every license category that matters, grouped the way the industry actually talks about it, payments, banks, insurance, capital markets, lending, gold, crypto, and a few categories that don't fit neatly anywhere else.

A license proves a company raised enough capital and met the paperwork bar to exist. It says nothing about how that company behaves once something actually goes wrong, and almost every category below exists because one company found that gap the hard way and a regulator closed it afterward.

Payments (Bank Indonesia)

BI licenses everything downstream of a transaction moving. If you want the mechanics of how a payment actually routes across issuers, acquirers, and switches once it's moving, I wrote about that separately for QRIS; here's the license layer that sits underneath it. The core categories:

  • Payment Service Provider (PJP), classified by activity into Category One (fund-source administration, information, initiation and acquiring, remittance, all four), Category Two (initiation and acquiring only), and Category Three (remittance and whatever else BI approves), and separately by risk into Systemic, Critical, or General. GoPay, OVO, Doku, and Xendit hold Category One.
  • Payment System Infrastructure Provider (PIP), the ATM networks and clearing houses underneath PJPs, held by Artajasa (ATM Bersama), Rintis Sejahtera (BCA's ATM Prima), and Jalin Pembayaran Nusantara.
  • Money Changer (KUPVA BB), a non-bank foreign exchange license under BI Regulation No. 18/20/PBI/2016, held by long-running Bali operators like PT Central Kuta.
  • Fund Transfer Operator, domestic and international money transfer for non-bank companies under Law No. 3/2011, held by TranSwap and layered on top of Xendit's PJP license.
  • Credit Bureau (LPIP), under BI Regulation No. 14/1/PBI/2013, requiring IDR 50 billion minimum capital, held by PT Kredit Biro Indonesia Jaya and PT PEFINDO Biro Kredit.
  • Financial Technology Provider Registration, a lighter-weight registration rather than a full license, for anything fintech-adjacent that isn't already a PJP or covered by another regulator.

Banks (OJK)

Every bank has been licensed and supervised by OJK since January 1, 2014, when it took over from Bank Indonesia. Four license types:

  • Commercial Bank Business License, IDR 10 trillion minimum capital under current digital bank rules, held by Bank Mandiri, BRI, and BCA.
  • Sharia Commercial Bank License, held by Bank Syariah Indonesia, formed by merging three state Islamic banks into the country's largest.
  • Rural Bank License (BPR) and Sharia Rural Bank License (BPRS), capped to serve one province and barred from forex and payment-system activity, no single national player by design.

BI still gets consulted on macroprudential impact before a new bank license is granted, since a bank failure is still a systemic-risk question for BI even though it's no longer BI's license to issue.

None of that is about capital tiers though, that's a separate classification sitting on top of the license. From 2016 to 2021, every commercial bank was also sorted into a BUKU tier (Bank Umum berdasarkan Kegiatan Usaha), purely by core capital, under POJK No. 6/POJK.03/2016:

  • BUKU 1, core capital under Rp1 trillion, restricted to basic products in rupiah only, no foreign exchange activity.
  • BUKU 2, Rp1 to 5 trillion, allowed limited foreign exchange and treasury products.
  • BUKU 3, Rp5 to 30 trillion, allowed the full domestic product range plus limited overseas expansion, one branch per ASEAN country.
  • BUKU 4, above Rp30 trillion, allowed unrestricted foreign exchange, derivatives, and overseas expansion anywhere.

The tier determined what a bank was legally allowed to sell, not just a size ranking, a BUKU 1 bank couldn't touch forex products no matter how good its balance sheet otherwise looked. BUKU is obsolete terminology now. POJK No. 12/POJK.03/2021 replaced it with KBMI (Kelompok Bank berdasarkan Modal Inti), same core-capital logic, much higher thresholds to match a decade of consolidation and Rp3 trillion minimum capital rules pushing smaller banks to merge:

  • KBMI 1, core capital under Rp6 trillion.
  • KBMI 2, Rp6 to 14 trillion.
  • KBMI 3, Rp14 to 70 trillion.
  • KBMI 4, above Rp70 trillion, held by Bank Mandiri, BRI, BCA, and BNI.

The old BUKU 4 floor, Rp30 trillion, would only just clear KBMI 2 today.

If a source still cites "BUKU 4," it's describing pre-2021 regulation, current bank classification runs on KBMI.

Insurance (OJK)

Six license classes under POJK No. 23/2023:

  • General Insurance, property, motor, marine, and similar non-life products.
  • Life Insurance, life, health, and personal accident products.
  • Sharia General Insurance and Sharia Life Insurance, the same two, run under Islamic finance principles.
  • Reinsurance and Sharia Reinsurance, a separate, higher-capital tier that insures the insurers.

The reason this rulebook exists is three failures in a row. Jiwasraya, a state insurer, collapsed in 2019 with a roughly Rp16.8 trillion hole, built by propping up guaranteed-return products with fraudulent equity investments. Wanaartha Life and Kresna Life were then both stripped of their licenses within months of each other in late 2022 and early 2023, both for the same failure, risk-based capital that dropped below the required 120% and never recovered.

OJK's old test was a ratio, and a ratio can be gamed by a company with almost no capital behind it. POJK No. 23/2023 put a hard equity floor underneath it instead: Rp250 billion conventional, Rp100 billion Sharia, rising to as much as Rp1 trillion by 2028. As of July 2026, 118 of 145 licensed insurers had cleared the first threshold. The rest are running out of runway before the December deadline, and OJK built exit ramps in advance, merger, acquisition, or a capital-pooling structure called KUPA, rather than wait for another Wanaartha.

Capital Markets (OJK)

The umbrella is a Securities Company license under UU No. 8/1995, and everything else is a sub-license or a separate approval underneath it:

  • PPE (Perantara Pedagang Efek), the securities broker-dealer license, under POJK 20/POJK.04/2016, held by firms like Mirae Asset Sekuritas, Mandiri Sekuritas, and Stockbit Sekuritas.
  • PEE (Penjamin Emisi Efek), the underwriter license, same regulation, held by Mandiri Sekuritas, BNI Sekuritas, and RHB Sekuritas Indonesia.
  • Izin Manajer Investasi (Investment Manager), under POJK 5/2026, which introduced two operating tiers, MIKU 1 and MIKU 2, by scale and scope. Held by Manulife Aset Manajemen Indonesia, the country's largest at Rp124.3 trillion under management, which completed an acquisition of Schroder's Indonesian arm in March 2026.
  • APERD (Agen Penjual Efek Reksa Dana), the mutual fund selling agent registration, under POJK 39/POJK.04/2014, held by Bibit, Bareksa, and Tanamduit. A mutual fund itself isn't a license, it's a product a licensed investment manager runs, and there's no separate "robo-advisory" license in Indonesia, Bibit and Pluang's automated-advice features run on top of an APERD registration, not a distinct approval.
  • SBN Ritel selling agent, a Ministry of Finance distribution mechanism for retail government bonds (ORI, SR, ST, SBR), separate from APERD though most distributors, Bareksa, Bibit, Tanamduit, plus roughly 18 banks and 5 securities firms, hold both.
  • Margin trading approval, under POJK 6/2024, a separate approval a securities company needs before offering leveraged trading to retail investors, held by firms like Ajaib Sekuritas.
  • Derivatives trading approval, under POJK 1/2025, effective January 10, 2025. This one moved from Bappebti to OJK the same way crypto did: it implements UU P2SK's transfer of securities-based derivatives supervision, replacing an older Bappebti-adjacent framework, so a securities firm now clears equity derivatives with OJK, not the commodities regulator.

Lending: P2P, Multi-Finance, Venture Capital, and Guarantees

Four distinct license categories, not variations on the same rule, all under OJK's non-bank financial industry group.

  • P2P Lending (LPBBTI), under POJK No. 10/POJK.05/2022, Rp25 billion paid-up capital, foreign ownership capped at 85%. Investree, once one of the country's largest and most-established licensed platforms, had its license revoked by OJK on October 21, 2024, after its CEO, Adrian Gunadi, allegedly raised roughly Rp2.7 trillion from the public through vehicles run under Investree's name, diverted funds to his own accounts, and used the company to guarantee a personal business. He fled the country and was later repatriated and arrested.

Investree was licensed, established, and led by the head of Indonesia's own fintech lending association. None of that stopped its CEO from running a fraud out of the company for two years, it just meant OJK had the standing to revoke the license and pursue him once it surfaced.

  • Multi-Finance (Perusahaan Pembiayaan), leasing and consumer-installment lending under POJK No. 46/2024, held by Adira Finance, BFI Finance, and FIF. The health conditions attached to it aren't hypothetical: OJK revoked PT Varia Intra Finance's license on January 20, 2026, after placing it under special supervision and concluding it couldn't be rehabilitated, barring it from operating or even using "finance" in its name again.
  • Venture Capital (Modal Ventura), equity and profit-sharing financing for SMEs and startups, folded into the same POJK 46/2024 as multi-finance, Rp50 billion minimum capital, with a 6-month post-licensing deadline to actually start operating or lose the license.
  • Guarantee Companies (Perusahaan Penjaminan), credit guarantees mostly backing MSME and cooperative loans, under POJK 2/POJK.05/2017, held by Jamkrindo and Askrindo, both state-owned, alongside roughly 18 regional Jamkrida entities.

Gold

Gold has four separate licenses, not one, and each does something the others can't.

  • Digital Gold Trader (Pedagang Fisik Emas Digital), a Bappebti commodity-warehouse-receipt license, you own fractional ownership of gold bullion a licensed trader actually holds. What this license was built to stop happened years before crypto's regulatory rewrite was even law: PT Tamasia Global Sharia ran a digital gold platform flagged as unlicensed since 2018 and never once appeared on Bappebti's approved list, until it abruptly changed its terms in 2023 and forced customers to sell gold back below market price. Every legitimate platform today, Treasury and IndoGold, holds the license Tamasia never got.
  • Gold Vault Manager (Pengelola Tempat Penyimpanan Emas), the license that lets a company physically custody bullion on behalf of digital gold traders. Unlike crypto, this one wasn't touched by the 2025 Bappebti-to-OJK handover at all, custody of physical gold stayed with Bappebti since the handover only covered digital financial assets.
  • Bank Emas, a bullion bank license under POJK No. 17/2024, OJK's, not Bappebti's, and the only one of the four that can take gold deposits and offer gold-backed savings. Gold-backed financing itself isn't a separate license, it's a function bank emas and pergadaian licenses both already carry, roughly 95% of standard pawnshop lending is against gold. Pegadaian was first, followed by Bank Syariah Indonesia, which reported managing 22.5 tons of gold within a year.
  • Physical Bullion, not a trading or deposit-taking license at all, just mining and minerals regulation. ANTAM's Logam Mulia refinery, on the London Bullion Market Association's Good Delivery List since 1999, sells gold bars under that regime, and supplies both Pegadaian and BSI's bullion operations without holding a bank emas license itself.

Crypto

Crypto started under the same regulator as digital gold, Bappebti, the commodity futures agency inside the Ministry of Trade, built to police price manipulation in physical and derivatives trading, under a license called PFAK (Pedagang Fisik Aset Kripto). It outgrew that job description as exchanges started offering staking, lending, and custody of customer funds, activity that looks like financial services, not commodity trading. The 2023 Financial Sector Development and Strengthening Law, UU P2SK, made the reassignment law: POJK 27/2024, amended by POJK 23/2025, took effect January 10, 2025, formally moving crypto from Bappebti to OJK and reclassifying it from a commodity into a digital financial asset. OJK now licenses exchanges like Indodax, Pintu, and Tokocrypto that used to hold Bappebti's PFAK license.

Four months before that handover, Indodax, Indonesia's largest exchange, was hacked for roughly $22 million. Nothing ties that hack directly to the decision, the transfer had already been law for a year by then, but it's a clean illustration of exactly the gap the move was meant to close: a commodity regulator, not an investor-protection one, as the first line of response when an exchange loses customer funds.

Pension Funds

Two license types, both under POJK No. 35/2024:

  • DPPK (Dana Pensiun Pemberi Kerja), an employer's own pension fund, single-employer, closed to the public.
  • DPLK (Dana Pensiun Lembaga Keuangan), run by a bank, Sharia bank, life insurer, or a sufficiently large investment manager, open to multiple employers and the public as a defined-contribution vehicle. BNI, Manulife, and Allianz all run DPLK arms.

Pawnshops

Usaha Pergadaian, a standalone OJK license under POJK No. 31/POJK.05/2016, separate from the bank emas license above even though Pegadaian holds both. It's scoped by operating area, city, regency, province, or national, and OJK had issued 222 pawnshop licenses as of mid-2026, Pegadaian alongside a long tail of private operators.

One More Category: Warehouse Receipts

Sistem Resi Gudang, a Bappebti license letting a warehouse manager issue tradeable receipts against stored commodities, a financing tool for farmers and traders as much as a storage one, and the closest thing on this list to a license nobody outside commodities trading has heard of.

If you're building in any of these spaces, the license you need depends on exactly what you're touching, taking a deposit, running a fund, moving a payment, holding gold, or lending against it, and the rule you're licensed under almost always exists because an earlier company doing the same thing failed in a way regulators didn't catch in time.

Appendix: Ten Fintechs and What They're Actually Licensed For

"Fintech" in Indonesia isn't one license, it's whichever license matches whatever the company actually touches, payments, lending, investing, or crypto. Ten companies, spanning all four:

  • GoPay (PT Dompet Anak Bangsa) already appeared under Category One in the Payments section above, but its lending products sit on separate OJK licenses entirely, held by different legal entities: GoPayLater runs on PT Multifinance Anak Bangsa's Multi-Finance license (since August 2023), while GoPay Pinjam runs on PT Mapan Global Reksa's P2P Lending (LPBBTI) license, the same aggregate-license-vs-constituent-products pattern that shows up across most of this appendix.
  • ShopeePay (PT Airpay International Indonesia) splits the same way: SPayLater runs on PT Commerce Finance's Multi-Finance license, and SPinjam runs on PT Lentera Dana Nusantara's P2P Lending (LPBBTI) license, both entirely separate from ShopeePay's own e-money license.
  • OVO (PT Visionet Internasional) is a licensed non-bank e-money issuer and PJP under Bank Indonesia, though its exact PJP category tier isn't published anywhere specific enough to cite here.
  • DANA (PT Espay Debit Indonesia Koe), also Category One, same as GoPay.
  • Xendit, the same two-license stack described in the Payments section, Payment Gateway and Fund Transfer Operator layered together.
  • Kredivo (PT Kredivo Finance Indonesia, renamed from FinAccel Finance Indonesia in 2023) runs on a Multi-Finance (Perusahaan Pembiayaan) license from OJK, not the P2P lending license some other buy-now-pay-later apps use, a financing company and a P2P platform are two different regulatory boxes even when the product looks the same to a user.
  • Bibit (PT Bibit Tumbuh Bersama) holds an APERD registration, the mutual fund selling agent license described in the Capital Markets section, and is also a Ministry of Finance retail government bond (SBN Ritel) distribution partner.
  • Ajaib (PT Ajaib Sekuritas Asia) holds a PPE securities broker-dealer license and is a member of the Indonesia Stock Exchange, KSEI, and KPEI. Its crypto arm, PT Kagum Teknologi Indonesia, holds a separate Bappebti PFAK license under a different legal entity entirely, the stock brokerage and the crypto exchange aren't the same license or the same company, even sharing a brand.
  • Indodax (PT Indodax Nasional Indonesia), Indonesia's largest crypto exchange, holds a full PFAK license from Bappebti and is a member of the regulated crypto exchange, PT Bursa Komoditi Nusantara.
  • Pintu (PT Pintu Kemana Saja) was the first crypto company to receive the full PFAK license from Bappebti in 2024, and by early 2025 was also recognized by OJK as a digital financial asset trader, the same Bappebti-to-OJK crypto transition described above playing out for one specific company.

Same pattern as everywhere else in this piece: two companies that look identical from the outside, a broker and an exchange sharing a brand, a wallet and a payment gateway both moving money, can be running on entirely different rulebooks underneath.

The license tells you what a company is allowed to touch, not what it's actually good at.