Indonesia Payments Operator Guide: QRIS, BI-FAST, and the Wallet Stack

Indonesia’s payment market is Southeast Asia’s most structurally complex for foreign operators — not because the technology is difficult, but because the market stack is deliberately different from card-dominated Western markets. Wallets are the primary consumer payment rail. A mandated QR standard unifies them. A government-built real-time rail handles account-to-account flows. And direct licensing is structurally constrained in ways that make local intermediaries the standard entry path.

This guide covers what that actually means in practice: QRIS adoption and economics, the wallet landscape, BI-FAST, virtual accounts, licensing under the current framework, and what foreign operators need to do on day one.

Market Context: Why Indonesia Is Different

Indonesia’s financial inclusion picture is improving but still significant: approximately 56% of Indonesian adults had a financial account in 2024, meaning roughly 92 million adults remain unbanked (World Bank Global Findex 2024). As recently as 2021, account ownership was approximately 52%. Approximately 69% of Indonesians owned a mobile phone and 73% accessed the internet in 2024 (BPS Telecommunication Statistics 2024).

These figures explain the structural shape of Indonesian digital payments: a large mobile-first population with significant unbanked headroom, and a central bank that has treated QR payments and real-time rails as explicit financial-inclusion tools — not merely convenience features. Bank Indonesia’s active promotion of QRIS and BI-FAST, alongside the GPN domestic card scheme, has produced a payment stack that looks fundamentally different from Singapore or Thailand.

The result is that operators building for Indonesia cannot default to a card-first stack. QRIS and wallets are where the volume is.

QRIS: One QR Code, Every Wallet

QRIS (Quick Response Code Indonesian Standard) is Bank Indonesia’s interoperability mandate: a single merchant QR code accepted by every participating payment provider — GoPay, OVO, DANA, ShopeePay, LinkAja, and bank apps.

Bank Indonesia reported the following full-year 2025 figures at its December 2025 Board of Governors Meeting:

• Approximately 42 million merchants registered for QRIS (exceeding the 40M annual target; approximately 90% MSMEs)
• Approximately 59 million users
• 13.66 billion transactions for full-year 2025 (significantly exceeding the 6.5B annual target)

These FY2025 figures supersede earlier mid-year data. The pace of growth is notable: 10.31 billion transactions were recorded through September 2025 alone, meaning the December quarter added significant volume.

MDR structure (effective 1 December 2024, per Bank Indonesia):

• Micro-business merchants (UMI), transactions ≤ IDR 500,000 (~US$32): 0% MDR
• Micro-business merchants (UMI), transactions > IDR 500,000: 0.3% MDR
• Regular merchants (UKE / UME / UBE): 0.7% MDR
• Public services, G2P disbursements, donations: 0%

This tiered structure makes QRIS one of the cheapest acceptance methods available to Indonesian merchants — the 0% waiver for small UMI transactions is an explicit Bank Indonesia policy to drive micro-merchant adoption.

How foreign operators access QRIS: QRIS requires a BI licence or sub-merchant registration under a licensed PSP. Foreign operators without a direct licence access QRIS through licensed aggregators — Xendit, Midtrans, DOKU, Faspay — who hold the licence and handle SNAP API compliance. You connect via their API.

The Wallet Landscape

All major e-wallets are QRIS-integrated, so a single QRIS QR code captures payment from all of them. Direct per-wallet integration buttons are still common for UX reasons, but QRIS is the convergence layer operationally.

The four leading digital wallets and their backers:

• GoPay — GoTo ecosystem (Gojek ride-hail and Tokopedia marketplace)
• OVO — Grab-backed; broad merchant network across retail categories
• DANA — Ant Group technology, Emtek distribution; positioned toward financial-services features (savings, insurance integration)
• ShopeePay — Sea Group (Shopee e-commerce); strong cashback promotions driving adoption

LinkAja (state-linked, Telkomsel and state bank consortium) plays a supporting role — more relevant for government disbursements than consumer retail.

Bank Indonesia does not publish wallet market share by brand, and survey-based penetration studies measure usage frequency rather than transaction-value share — the figures reported in vendor research vary too widely by methodology to cite reliably. The qualitative picture is consistent: GoPay, OVO, DANA, and ShopeePay are the dominant set for consumer e-commerce; no single wallet has captured the market alone.

Most wallets do not offer direct B2B API agreements to foreign PSPs. Foreign operators access wallet acceptance through licensed local aggregators who hold the bilateral wallet partnerships. For a broader view of how these wallets compete across Southeast Asia, see GoPay, OVO, DANA: SEA’s Wallet Wars.

BI-FAST: The Real-Time Interbank Rail

BI-FAST is Bank Indonesia’s 24/7 real-time interbank transfer infrastructure, launched December 2021.

Core specifications:

• Transfer limit: IDR 250 million per transaction
• Max customer fee: IDR 2,500 per transfer (Bank Indonesia charges participant banks IDR 19; they pass up to IDR 2,500 to customers)
• Settlement: real-time

Scale: From launch through September 2025, BI-FAST processed more than 9.61 billion transactions with a cumulative value exceeding IDR 25 quadrillion (~US$1.5 trillion) (Bank Indonesia via ANTARA, September 2025). More than 135 banks and payment providers participate. For context on how BI-FAST compares to other real-time rails across the region, see the Real-Time Payment Rails Comparison Matrix and the PromptPay and SEA real-time payments guide.

BI-FAST versus QRIS: QRIS is consumer QR payment — high-frequency, typically small amounts, merchant-initiated scan. BI-FAST is account-to-account interbank transfer — payroll disbursement, B2B supplier payments, bulk refunds, marketplace seller payouts. The two are complementary, not competing.

For operators, BI-FAST matters most for bulk payouts: marketplace seller settlements, affiliate commissions, and refunds. Xendit and Midtrans both offer disbursement via BI-FAST as standard products. PSPs without direct BI-FAST access route via participating bank APIs.

Virtual Accounts: The Bank-Transfer Method

Virtual accounts (VAs) remain a significant online payment method in Indonesia, complementing QRIS for consumers who prefer bank-backed transfers over e-wallets — particularly for higher-value transactions.

How they work:

1. Merchant generates a unique VA number per order via aggregator API
2. Customer receives the VA number with an expiry window (typically 24 hours)
3. Customer pays via internet banking, mobile app, or ATM
4. Settlement: D+0 to D+1, with automatic reconciliation (unique VA = unique order)

Banks offering VA: BCA, Mandiri, BNI, BRI, CIMB Niaga, and others. All major aggregators bundle multi-bank VA as a standard product.

The unique-per-order structure means reconciliation is automatic and reliable — an operational advantage for high-volume merchants. VAs also serve consumers who hold a bank account but not a preferred e-wallet, or who simply trust a bank transfer for larger purchases.

Cards in Indonesia

Cards are secondary to QRIS and virtual accounts in Indonesian e-commerce — concentrated in urban upper-middle-income segments and cross-border transactions.

• Acquiring banks: BCA, Mandiri, BNI, BRI (dominant); also CIMB Niaga, Danamon, Permata, BTN
• Card MDR rates: Publicly undisclosed, negotiated with the acquiring bank; approximately 2.0–3.0% for credit cards and 0.5–1.5% for debit (approximate ranges, per industry reference)
• 3DS: International Visa/Mastercard cards follow card-scheme 3DS authentication; GPN domestic cards use a proprietary implementation. 3DS is not universally mandated but is best practice for online fraud mitigation
• GPN (Gerbang Pembayaran Nasional): Indonesia’s national domestic card scheme; growing but limited use outside Indonesia. Support Visa/Mastercard for foreign cards, GPN for local debit

Licensing: What Foreign Operators Actually Face

The current payment licensing framework is BI Regulation No. 10/2025, which came into effect on 31 March 2026. PBI 10/2025 consolidates and supersedes PBI 22/23/2020 while preserving the ownership and capital requirements established in PBI 23/6/2021.

Two licensing tracks: PJP (Payment Service Provider) and PIP (Payment System Infrastructure Provider).

Foreign ownership and control: Under the framework carried forward from PBI 23/6/2021 and preserved under PBI 10/2025, foreign investors may hold up to approximately 85% economic interest in a PJP. However, Indonesian parties must retain domestic control — at least 51% of voting rights plus board-appointment and veto rights. A minimum 15% of total shares must be held by Indonesian parties. This is the operative position today; the “49% foreign cap” was a prior-era figure and no longer reflects the current rules.

Minimum capital: IDR 15 billion for Category 1 (the top activity bundle), per PBI 23/6/2021. PBI 10/2025 introduces a new capital adequacy framework — minimum paid-up capital plus an ongoing buffer based on risk-weighted transactions — with specific amounts to be set in implementing regulations (PADG).

Compliance transition: PJPs not yet meeting PBI 10/2025 requirements have approximately three years to comply (to ~March 2029), with a possible two-year extension subject to Bank Indonesia approval.

Practical entry paths for foreign operators:

1. Use a licensed local aggregator — Xendit, Midtrans, DOKU, or Faspay hold a BI PJP licence; you integrate via their API. Best path for most foreign merchants and SaaS companies.
2. Acquire or partner with a licensed Indonesian PSP — structure the equity arrangement with 51% Indonesian voting control.
3. Become a service user under a licensed PJP — a reseller or sub-merchant arrangement.

PSP licensing snapshot (as of mid-2026):

• Xendit — BI Payment Gateway licence (2020)
• Midtrans (GoTo Financial) — BI-licensed PJP
• DOKU — BI-licensed PJP Category 1
• Faspay — BI Payment Gateway licence (2017), Fund Transfer licence (2018)
• Razer/E2Pay (now operating as Fiuu) — BI Payment Gateway licence (2019)
• Stripe, PayPal, Adyen — no publicly confirmed direct BI PJP licence; operate cross-border or via locally licensed partners

SNAP: The Open API Standard

SNAP (Standar Nasional Open API Pembayaran) is Bank Indonesia’s national standard for payment API connectivity — covering architecture, data formats, authentication, and encryption. Established in August 2021, SNAP governance transferred to ASPI (Indonesian Payment Systems Association) effective 1 September 2023.

Compliance deadlines: Service Providers by 30 June 2024; MSME/non-profit Service Users by 30 June 2025. SNAP is the mandatory standard for PSPs offering Open API payment services. Any foreign PSP building Indonesian infrastructure must budget for SNAP-compliant API development.

What This Means for Operators

For merchants and SaaS accepting payments from Indonesian consumers

• Route through a licensed aggregator — Xendit or Midtrans cover QRIS, all major wallets, multi-bank VA, cards, and BI-FAST disbursements in one integration.
• Enable QRIS first: one integration captures GoPay, OVO, DANA, ShopeePay, and LinkAja.
• Add multi-bank VA (BCA, Mandiri, BNI, BRI minimum) for consumers who prefer bank transfers.
• Add card acceptance for higher-value transactions and international consumers.
• Document AML/KYC from day one — OJK and PPATK enforcement is intensifying.

For PSPs building Indonesian infrastructure

• Direct BI licensing is technically available but structurally constrained: Indonesian parties must retain voting control, the Category 1 capital minimum is IDR 15 billion, and PBI 10/2025 adds new capital adequacy requirements.
• More practical for most foreign PSPs: acquire or partner with a licensed Indonesian PSP (structuring for 51% Indonesian voting control), or enter as a service user under an existing licensee.
• Any infrastructure you build must be SNAP-compliant for interoperability with banks and wallets.
• Data-localisation and infrastructure requirements can create real operating costs; confirm hosting, processing, and reporting obligations with your licensed Indonesian PSP.

Non-obvious requirements

• QRIS is MSME-first: the 0% MDR waiver (UMI, ≤IDR 500K) is a Bank Indonesia policy subsidy to drive micro-merchant adoption. Factor this into pricing models for small-merchant segments.
• VA expiry: VAs typically expire in 24 hours. For B2B flows or high-value purchases with longer consideration windows, ask your aggregator about fixed/persistent VA options.
• BI-FAST for disbursements: the flat IDR 2,500 fee makes BI-FAST cheaper than wallet payouts for bulk seller settlements, commissions, and refunds at scale.
• Licensing regime is live: PBI 10/2025 has been in effect since 31 March 2026. Verify your Indonesian PSP partner’s compliance roadmap under the new framework before committing.

Regulatory watch

• OJK consumer protection requirements are tightening — fraud liability is increasingly placed on payment operators and platforms. Build fraud scoring and dispute handling from the outset.
• SNAP compliance deadlines have passed (June 2024 for Service Providers, June 2025 for Service Users). Verify your aggregator’s compliance status before signing.
• Crypto assets are supervised as tradable digital financial assets, not payment instruments. They remain prohibited as a payment method in Indonesia, and no compliant merchant crypto-payment path exists.

None of these fundamentally change the entry mechanics for foreign operators, but they raise the compliance bar for intermediaries — verify your aggregator’s regulatory standing before committing.