Indonesia Payments: QRIS, Local Acquiring and BI-FAST

Indonesia's payment market is Southeast Asia's most structurally complex for foreign operators — not because the technology is difficult, but because the market stack is deliberately different from card-dominated Western markets. Wallets are the primary consumer payment rail. A mandated QR standard unifies them. A government-built real-time rail handles account-to-account flows. And direct licensing is structurally constrained in ways that make local intermediaries the standard entry path.

For local merchant acceptance, foreign operators generally use a BI-licensed payment service provider to connect QRIS, wallets and virtual accounts. BI-FAST answers a different job: interbank transfers and payouts. This guide covers the acceptance routes, current QRIS fee threshold, BI-FAST and the licensing choices behind them.

Market Context: Why Indonesia Is Different

Indonesia's financial inclusion picture is improving but still significant: approximately 56% of Indonesian adults had a financial account in 2024, meaning roughly 92 million adults remain unbanked (World Bank Global Findex 2024). As recently as 2021, account ownership was approximately 52%. Approximately 69% of Indonesians owned a mobile phone and 73% accessed the internet in 2024 (BPS Telecommunication Statistics 2024).

These figures explain the structural shape of Indonesian digital payments: a large mobile-first population with significant unbanked headroom, and a central bank that has treated QR payments and real-time rails as explicit financial-inclusion tools — not merely convenience features. Bank Indonesia's active promotion of QRIS and BI-FAST, alongside the GPN domestic card scheme, has produced a payment stack that looks fundamentally different from Singapore or Thailand.

The result is that operators building for Indonesia cannot default to a card-first stack. QRIS and wallets are where the volume is.

QRIS: One QR Code, Every Wallet

QRIS (Quick Response Code Indonesian Standard) is Bank Indonesia's interoperability mandate: a single merchant QR code accepted by every participating payment provider — GoPay, OVO, DANA, ShopeePay, LinkAja, and bank apps.

Bank Indonesia reported the following full-year 2025 figures at its December 2025 Board of Governors Meeting:

• Approximately 42 million merchants registered for QRIS (exceeding the 40M annual target; approximately 90% MSMEs)
• Approximately 59 million users
• 13.66 billion transactions for full-year 2025 (significantly exceeding the 6.5B annual target)

These FY2025 figures supersede earlier mid-year data. The pace of growth is notable: 10.31 billion transactions were recorded through September 2025 alone, meaning the December quarter added significant volume.

Effective since 1 October 2026: Bank Indonesia extended 0% QRIS MDR to every merchant category on transactions up to IDR 100,000. The existing 0% rate for micro-business merchants (UMI) continues on transactions up to IDR 500,000. A merchant's settlement can therefore contain zero-rated and charged tickets on the same day: ticket size now matters alongside merchant category.

BI's existing published category table lists these rates outside the new universal IDR 100,000 band:

The August expansion announcement establishes the 0% threshold but does not republish the full schedule above it. The BI QRIS category table still displays the earlier bands without that overlay. Confirm the full schedule and your acquirer's billing before re-pricing. If you operate a school or a fuel retailer, confirm the merchant classification as well; the regular 0.7% category rate is not its published rate.

View the earlier Indonesia payments infographic — QRIS rates shown are historical

The infographic explains the payment stack, but its MDR panel predates the universal 0% band effective 1 October 2026. Use the current threshold and category table above when assessing fees.

This tiered structure makes QRIS one of the cheapest acceptance methods available to Indonesian merchants — the 0% and reduced-rate tiers are explicit Bank Indonesia policy subsidies to drive adoption among micro-merchants and specific public-interest categories.

How foreign operators access QRIS: QRIS requires a BI licence or sub-merchant registration under a licensed PSP. Foreign operators without a direct licence access QRIS through licensed aggregators — Xendit, Midtrans, DOKU, Faspay — who hold the licence and handle SNAP API compliance. You connect via their API.

The Wallet Landscape

All major e-wallets are QRIS-integrated, so a single QRIS QR code captures payment from all of them. Direct per-wallet integration buttons are still common for UX reasons, but QRIS is the convergence layer operationally.

The four leading digital wallets and their backers:

• GoPay — GoTo ecosystem (Gojek ride-hail and Tokopedia marketplace)
• OVO — Grab-backed; broad merchant network across retail categories
• DANA — Ant Group technology, Emtek distribution; positioned toward financial-services features (savings, insurance integration)
• ShopeePay — Sea Group (Shopee e-commerce); strong cashback promotions driving adoption

LinkAja (state-linked, Telkomsel and state bank consortium) plays a supporting role — more relevant for government disbursements than consumer retail.

Bank Indonesia does not publish wallet market share by brand, and survey-based penetration studies measure usage frequency rather than transaction-value share — the figures reported in vendor research vary too widely by methodology to cite reliably. The qualitative picture is consistent: GoPay, OVO, DANA, and ShopeePay are the dominant set for consumer e-commerce; no single wallet has captured the market alone.

Most wallets do not offer direct B2B API agreements to foreign PSPs. Foreign operators access wallet acceptance through licensed local aggregators who hold the bilateral wallet partnerships. For a broader view of how these wallets compete across Southeast Asia, see GoPay, OVO, DANA: SEA's Wallet Wars.

BI-FAST: The Real-Time Interbank Rail

BI-FAST is Bank Indonesia's 24/7 real-time interbank transfer infrastructure, launched December 2021.

Core specifications:

• Transfer limit: IDR 250 million per transaction
• Max customer fee: IDR 2,500 per transfer (Bank Indonesia charges participant banks IDR 19; they pass up to IDR 2,500 to customers)
• Settlement: real-time

Scale: In Q2 2026 (April–June) alone, BI-FAST processed 1.529 billion transactions worth IDR 3,777 trillion — up 38.09% year-on-year — per Bank Indonesia Governor Perry Warjiyo's 22 July 2026 Board of Governors Meeting briefing. More than 135 banks and payment providers participate. For context on how BI-FAST compares to other real-time rails across the region, see the Real-Time Payment Rails Comparison Matrix and the PromptPay and SEA real-time payments guide.

BI-FAST versus QRIS: QRIS is consumer QR payment — high-frequency, typically small amounts, merchant-initiated scan. BI-FAST is account-to-account interbank transfer — payroll disbursement, B2B supplier payments, bulk refunds, marketplace seller payouts. The two are complementary, not competing.

Participant structure — direct vs. indirect: BI-FAST participants fall into two tiers. Direct Participants manage their own BI-FAST settlement-account liquidity and must be members of the BI-RTGS system; a commercial bank seeking direct-participant status needs core capital exceeding IDR 6 trillion plus adequate liquidity to process BI-FAST volume. Indirect Participants connect to BI-FAST but manage settlement liquidity through a designated sponsor bank rather than directly — this is how smaller banks, and until recently all non-bank PSPs, have accessed the rail.

PADG 3/2026 — non-bank PSPs gain formal participant status: Effective 31 March 2026, PADG No. 3/2026 (amending PADG 17/2023) formally admits non-bank PJPs — payment-account issuers, i.e., e-wallets and similar LSB entities — as Indirect Participants, provided they conduct payment-account custody activities, maintain a BI-FAST-specific strategic business plan, and hold minimum paid-up capital of IDR 100 billion. The regulation also introduces a Financial Institution Credit Transfer (FICT) settlement service, currently scoped to settling PIP (infrastructure-operator) transactions. The practical nuance: Indirect Participant status doesn't remove the bank relationship — a non-bank PSP still settles liquidity through its sponsor bank, exactly as a smaller bank does. What changes is that the PSP itself becomes a recognized BI-FAST participant with direct connector/API access, rather than operating purely as a downstream customer riding a bank's own BI-FAST connection. For a large-volume e-wallet or aggregator, that's a meaningful reduction in dependency on a bank partner's technical roadmap — though it does not eliminate the need for a banking relationship entirely.

For operators, BI-FAST matters most for bulk payouts: marketplace seller settlements, affiliate commissions, and refunds. Xendit and Midtrans both offer disbursement via BI-FAST as standard products. PSPs without direct or indirect BI-FAST access route via participating bank APIs.

Virtual Accounts: The Bank-Transfer Method

Virtual accounts (VAs) remain a significant online payment method in Indonesia, complementing QRIS for consumers who prefer bank-backed transfers over e-wallets — particularly for higher-value transactions.

How they work:

1. Merchant generates a unique VA number per order via aggregator API
2. Customer receives the VA number with an expiry window (typically 24 hours)
3. Customer pays via internet banking, mobile app, or ATM
4. Settlement: D+0 to D+1, with automatic reconciliation (unique VA = unique order)

Banks offering VA: BCA, Mandiri, BNI, BRI, CIMB Niaga, and others. All major aggregators bundle multi-bank VA as a standard product.

The unique-per-order structure means reconciliation is automatic and reliable — an operational advantage for high-volume merchants. VAs also serve consumers who hold a bank account but not a preferred e-wallet, or who simply trust a bank transfer for larger purchases.

Cards in Indonesia

Cards are secondary to QRIS and virtual accounts in Indonesian e-commerce — concentrated in urban upper-middle-income segments and cross-border transactions.

• Acquiring banks: BCA, Mandiri, BNI, BRI (dominant); also CIMB Niaga, Danamon, Permata, BTN
• Card MDR rates: Publicly undisclosed, negotiated with the acquiring bank; approximately 2.0–3.0% for credit cards and 0.5–1.5% for debit (approximate ranges, per industry reference)
• 3DS: International Visa/Mastercard cards follow card-scheme 3DS authentication; GPN domestic cards use a proprietary implementation. 3DS is not universally mandated but is best practice for online fraud mitigation
• GPN (Gerbang Pembayaran Nasional): Indonesia's national domestic card scheme; growing but limited use outside Indonesia. Support Visa/Mastercard for foreign cards, GPN for local debit

Local Acquiring in Indonesia

The GPN line above is really a local acquiring rule in disguise. Bank Indonesia's GPN framework requires domestically issued payment instruments used within Indonesian territory to route through domestic switching institutions — making local acquiring a regulatory precondition for that slice of card volume, not an optional upgrade. Foreign-issued Visa and Mastercard transactions fall outside that mandate and continue to route cross-border as usual. That's the Indonesia-specific rule; for the general decision framework — when local acquiring is required, optional, or scheme-reach-driven, and how Indonesia's mandate compares with Brazil, South Korea, the US, and Singapore — see the local acquiring vs cross-border operator reference.

Licensing: What Foreign Operators Actually Face

The current payment licensing framework is BI Regulation No. 10/2025 (PBI PISP), issued 24 December 2025 and in effect since 31 March 2026. It repeals PBI 22/23/2020 outright. PBI 23/6/2021 (payment service providers) and PBI 23/7/2021 (infrastructure providers) technically remain on the books, but PBI 10/2025 now carries its own ownership, control, and capital rules directly in its own text — it is no longer simply "preserving" the 2021 regulations by reference.

Two licensing tracks and two entity forms: PJP (Penyelenggara Jasa Pembayaran / Payment Service Provider) is the front-end layer — account and wallet issuance, payment-transaction forwarding, fund transfers. PIP (Penyelenggara Infrastruktur Pembayaran / Payment Infrastructure Provider) is the back-end layer — switching, clearing, and settlement infrastructure. Either can be structured as a commercial bank (Bank Umum) or a non-bank institution (Lembaga Selain Bank, LSB); the ownership and control rules below apply specifically to the LSB form — banks follow OJK's banking-ownership rules instead.

Foreign ownership and control — confirmed directly in PBI 10/2025's own text: Article 44(1)(a) of PBI 10/2025 restates the same ratios PBI 23/6/2021 (Articles 19–20) established in 2021: a non-bank PJP must have at least 15% of shares domestically held (in practice, this is the basis for the commonly cited "foreign investors can hold up to ~85% economic interest") and at least 51% of voting-carrying shares domestically held, plus domestic board-nomination-majority and veto rights over decisions material to the company. This applies uniformly across every PJP activity bundle — the regulation's text draws no category-specific carve-out for acquiring or payment-initiation activities, so treat the 85/51 split as a blanket PJP-LSB rule. PBI 10/2025 also sets a materially stricter bar for non-bank PIPs — at least 80% domestic ownership and 80% domestic control — which effectively rules out majority-foreign ownership of Indonesian payment infrastructure operators, even though PJPs retain the more foreign-friendly 85% ratio. (Infrastructure providers were separately regulated under PBI 23/7/2021; if you were licensed as a PIP before 2026, verify how your prior obligations compare.) The old "49% foreign cap" framing is obsolete. Verify current thresholds directly against PBI 10/2025 Article 44 before structuring an entity — Bank Indonesia can adjust these percentages by further regulation, and this article reflects the text as it stands at the time of writing.

Minimum capital: PBI 10/2025 replaces the old "Category 1/2/3" language with three activity bundles: Bundle 1 (split into 1A/1B — fund-account custody plus transaction forwarding, the broadest, with 1A reserved for principal-classified PSPs), Bundle 2 (transaction forwarding only), and Bundle 3 (non-digital fund-transfer forwarding only, the narrowest). Initial paid-up capital for a PJP ranges from IDR 500 million to IDR 15 billion depending on which bundle it holds; a PIP needs IDR 100 billion minimum, though a PIP with an existing global network operating in Indonesia can be exempted from that minimum if its majority shareholder provides a written capital-adequacy guarantee and it confines itself to BI-designated PIP activities. PBI 10/2025 also layers on an ongoing risk-weighted-transaction capital buffer on top of this initial-capital floor — the specific buffer amounts are still pending PADG implementing regulations, so budget for this as a known unknown rather than a fixed number.

Compliance transition: Existing licensees keep their PJP/PIP status under Article 179. Article 183 grandfathers entities further: a PJP or PIP with no change in foreign ownership or control composition since before 31 March 2026 is not required to newly satisfy Article 44's ownership/control thresholds — the rule targets new entrants and ownership changes, not a retroactive clawback of existing structures. For entities that do need to come into compliance, the transition window is approximately three years (to ~March 2029), with a possible two-year extension subject to Bank Indonesia approval.

Practical entry paths for foreign operators:

1. Use a licensed local aggregator — Xendit, Midtrans, DOKU, or Faspay hold a BI PJP licence; you integrate via their API. Best path for most foreign merchants and SaaS companies.
2. Acquire or partner with a licensed Indonesian PSP — structure the equity arrangement with 51% Indonesian voting control.
3. Become a service user under a licensed PJP — a reseller or sub-merchant arrangement.

These map onto the general routes any operator weighs when deciding between local and cross-border acquiring in a given market — see the local acquiring vs cross-border operator reference above for the underlying framework and how it plays out in four other markets.

PSP licensing snapshot (as of mid-2026):

• Xendit — BI Payment Gateway licence (2020)
• Midtrans (GoTo Financial) — BI-licensed PJP
• DOKU — BI-licensed PJP Category 1
• Faspay — BI Payment Gateway licence (2017), Fund Transfer licence (2018)
• Razer/E2Pay (now operating as Fiuu) — BI Payment Gateway licence (2019)
• Stripe, PayPal, Adyen — no publicly confirmed direct BI PJP licence; operate cross-border or via locally licensed partners

SNAP: The Open API Standard

SNAP (Standar Nasional Open API Pembayaran) is Bank Indonesia's national standard for payment API connectivity — covering architecture, data formats, authentication, and encryption. Established in August 2021, SNAP governance transferred to ASPI (Indonesian Payment Systems Association) effective 1 September 2023.

Compliance deadlines: Service Providers by 30 June 2024; MSME/non-profit Service Users by 30 June 2025. SNAP is the mandatory standard for PSPs offering Open API payment services. Any foreign PSP building Indonesian infrastructure must budget for SNAP-compliant API development.

What This Means for Operators

For merchants and SaaS accepting payments from Indonesian consumers

• Route through a licensed aggregator — Xendit or Midtrans cover QRIS, all major wallets, multi-bank VA, cards, and BI-FAST disbursements in one integration.
• Enable QRIS first: one integration captures GoPay, OVO, DANA, ShopeePay, and LinkAja.
• Add multi-bank VA (BCA, Mandiri, BNI, BRI minimum) for consumers who prefer bank transfers.
• Add card acceptance for higher-value transactions and international consumers.
• Document AML/KYC from day one — OJK and PPATK enforcement is intensifying.

For PSPs building Indonesian infrastructure

• Direct BI licensing is technically available but structurally constrained: Indonesian parties must retain voting control (51% minimum), initial PJP capital runs IDR 500 million to IDR 15 billion depending on activity bundle, and PBI 10/2025 adds a new risk-weighted capital-adequacy buffer with amounts still pending PADG implementing rules.
• More practical for most foreign PSPs: acquire or partner with a licensed Indonesian PSP (structuring for 51% Indonesian voting control), or enter as a service user under an existing licensee.
• Any infrastructure you build must be SNAP-compliant for interoperability with banks and wallets.
• Data-localisation and infrastructure requirements can create real operating costs; confirm hosting, processing, and reporting obligations with your licensed Indonesian PSP.

Non-obvious requirements

• QRIS is MSME-first, and from 1 October 2026 small tickets are zero-rated for everyone: the 0% MDR waiver covers UMI transactions up to IDR 500K and, from 1 October 2026, every merchant category on transactions up to IDR 100K. Pricing models and settlement reconciliation need a ticket-size threshold, not only a merchant-category rate.
• VA expiry: VAs typically expire in 24 hours. For B2B flows or high-value purchases with longer consideration windows, ask your aggregator about fixed/persistent VA options.
• BI-FAST for disbursements: the flat IDR 2,500 fee makes BI-FAST cheaper than wallet payouts for bulk seller settlements, commissions, and refunds at scale.
• BI-FAST direct participation is newly possible for large PSPs: since PADG 3/2026 (31 March 2026), a non-bank PSP with IDR 100 billion+ paid-up capital can become a BI-FAST Indirect Participant rather than riding entirely on a bank partner's connection — worth evaluating if your Indonesian entity is scaling toward that capital threshold.
• Licensing regime is live: PBI 10/2025 has been in effect since 31 March 2026. Verify your Indonesian PSP partner's compliance roadmap under the new framework before committing.

Regulatory watch

• OJK consumer protection requirements are tightening — fraud liability is increasingly placed on payment operators and platforms. Build fraud scoring and dispute handling from the outset.
• SNAP compliance deadlines have passed (June 2024 for Service Providers, June 2025 for Service Users). Verify your aggregator's compliance status before signing.
• Crypto assets are supervised as tradable digital financial assets, not payment instruments. They remain prohibited as a payment method in Indonesia, and no compliant merchant crypto-payment path exists.

None of these fundamentally change the entry mechanics for foreign operators, but they raise the compliance bar for intermediaries — verify your aggregator's regulatory standing before committing.