Indonesia Payments

Indonesia is the most complex payments market in Southeast Asia and, by most measures, the most important. 277 million people, the region’s largest e-commerce market, and a payment infrastructure that is actively being rebuilt in real time. Bank Indonesia has moved faster and more decisively on payments modernisation than almost any central bank in the region — QRIS and BI-FAST together represent a structural shift that operators cannot afford to ignore.

QRIS and BI-FAST — Indonesia’s Payment Infrastructure

QRIS (Quick Response Code Indonesian Standard) is Bank Indonesia’s unified QR standard, mandated since 2019 and enforced with full compliance required by 2023. Every wallet, bank app, and payment provider operating in Indonesia must use QRIS for QR-based merchant payments. A single QRIS code at any merchant accepts payment from any connected wallet or bank app — there is no proprietary QR fragmentation. This is a more aggressive unification than anything Singapore or Thailand has achieved on QR.

BI-FAST launched in December 2021 as Indonesia’s real-time account-to-account interbank rail. It operates 24/7, settles in under 25 seconds, and has a per-transaction limit of IDR 250 million. The flat fee cap is IDR 2,500 per transaction — near-zero cost for merchants. All major Indonesian banks are connected. BI-FAST is rapidly displacing both cash and virtual accounts for fund transfers and will increasingly displace wallet-to-wallet flows as interoperability matures.

Together, QRIS and BI-FAST are the two structural pillars of Indonesian digital payments. Operators building here need both: QRIS for merchant acceptance at physical points of sale and in-app QR flows, BI-FAST for account-linked disbursements and high-value transfers.

E-Wallet Landscape

Indonesia has the most developed proprietary e-wallet ecosystem in Southeast Asia, and uniquely so: Indonesian wallets hold genuine stored-value float rather than being wrappers over a bank rail. This is structurally different from Singapore or Malaysia and creates both opportunities and complexity.

GoPay (GoTo Financial / Gojek) is the dominant wallet for ride-hail, food delivery, and the broader Gojek super-app ecosystem. GoPay Coins and GoPay Later (BNPL) extend the value proposition. OVO, originally backed by Grab and Tokopedia, now operates in the broader Grab ecosystem with strong penetration in retail and e-commerce. Dana is the Ant Financial and Emtek joint venture, positioning as a financial services wallet with savings and insurance products. ShopeePay has grown rapidly on the back of Shopee’s dominant e-commerce position and runs aggressive cashback promotions to drive adoption.

All four are licensed as e-money issuers under OJK. Each runs independent consumer loyalty programs and cashback campaigns. For operators in consumer e-commerce, integrating multiple wallets is not optional — no single wallet covers the market, and wallet preference varies meaningfully by consumer segment, geography, and transaction category.

Bank virtual accounts (VAs) remain very widely used for e-commerce checkout. A customer selects their bank, receives a unique virtual account number, and completes a bank transfer within a defined window. VA checkout is declining as QRIS and BI-FAST mature but remains essential for full market coverage in 2026, particularly for higher-value transactions and older consumer segments.

Card Market

Card penetration in Indonesia sits at approximately 35%, concentrated in urban upper-middle-income consumers and the Jakarta-Surabaya-Bali corridor. Visa and Mastercard are present but primarily for mid-to-upper-income segments and cross-border transactions. BCA, Bank Mandiri, BNI, and BRI are the dominant domestic card issuers, and their card products carry strong brand trust.

Installment plans (cicilan) are culturally significant for electronics, appliances, and high-ticket purchases — 0% for 3, 6, or 12 months via bank credit cards drives meaningful card preference at checkout for those categories. Contactless NFC adoption is still developing and inconsistent outside major cities. 3DS2 deployment at Indonesian issuers is uneven — some major issuers remain on 3DS1, creating authentication friction in card-not-present flows.

MDR for credit cards runs 2.0–3.0%, higher than Malaysia or Singapore, reflecting a less competitive acquiring market and higher fraud base rates. Debit card MDR is 0.5–1.5%.

Cash and Vouchers

Alfamart (18,000+ stores) and Indomaret (20,000+ stores) are Indonesia’s primary cash-at-retail payment networks for e-commerce. The consumer flow is standardised: select Alfamart or Indomaret at checkout, receive a unique barcode or payment code, pay cash at any branch within the payment window (typically 24–72 hours). Midtrans, Xendit, and DOKU all support both channels natively via their standard payment gateway integrations. This is not an optional channel for operators targeting national coverage — e-commerce conversion in tier-2 and tier-3 cities and rural markets depends materially on OTC availability.

Cash-on-delivery accounts for approximately 15–20% of e-commerce volume in provincial markets and remains significant across logistics-served areas. COD handling is a separate operational requirement from OTC checkout: it requires a logistics partner with COD acceptance, settlement reconciliation, and return-handling capability. Operators should build both OTC payment integration (via Midtrans, Xendit, or DOKU) and COD logistics capability into their Indonesia stack from day one — retrofitting either after launch creates fulfilment gaps that directly affect conversion in non-metro markets.

BNPL

Indonesia is the largest BNPL market in this SEA cluster at USD 8.59B in 2025, with OJK reporting IDR 37.44 trillion (~USD 2.2B) in outstanding BNPL balances as of November 2025. The market is forecast to reach USD 13.59B by 2030. Kredivo leads as the dominant pure-play BNPL operator — OJK licensed, 4,000+ merchant partners, credit limits up to IDR 50M. Akulaku PayLater covers 1,000+ merchants with 5-minute approval flows. SPayLater (Shopee/Sea) dominates e-commerce BNPL penetration; Atome provides regional omnichannel coverage.

OJK licensing is mandatory for BNPL operators in Indonesia — the regulatory framework is established and enforced, with no grace period for unlicensed operators. Merchant discount rates typically run 2–5% depending on operator and category. Operators in consumer e-commerce must integrate Kredivo and SPayLater at minimum; Akulaku is additive for broader credit coverage. Verify OJK licence status for any BNPL partner before integration — operating with an unlicensed provider creates compliance exposure.

Crypto and Digital Assets

Crypto assets are legal to trade in Indonesia as “digital financial assets” but are explicitly prohibited as a payment method — the Currency Law reserves the rupiah as the sole legal tender, and this restriction is actively enforced. Regulatory oversight transferred from BAPPEBTI to OJK effective January 10, 2025, with the transition period ending January 20, 2026 under OJK Regulation No. 27/2024 (digital financial assets framework, effective July 2025). All crypto asset trading platforms must now hold OJK authorisation under the new framework.

Operators cannot accept crypto for goods or services in any Indonesia deployment — there is no compliant integration pathway for merchant crypto payments. The regulatory intent is unambiguous: crypto is an investment and trading asset class, not a payment instrument. No stablecoin framework or retail CBDC pilot is active as of mid-2026. Build no crypto payment capability into Indonesia operations.

Regulatory Environment

Indonesia operates a dual regulatory structure for payments. Bank Indonesia (BI) licenses and oversees payment system service providers (PJSP) — the infrastructure layer, including e-money issuers, payment gateways, and switching operators. OJK (Otoritas Jasa Keuangan) covers broader financial services regulation including consumer protection, lending-linked wallets, and the intersection with banking.

The SNAP (Standard National Open API Payment) initiative, launched by Bank Indonesia, is standardising API connectivity between banks, wallets, and payment service providers. SNAP compliance is becoming a licensing requirement, and operators building integrations should align with the SNAP specification rather than proprietary bank API variants.

Data localisation is strict and enforced. Payment transaction data must be stored and processed on servers physically located in Indonesia. This is a meaningful infrastructure cost for foreign operators and should be factored into architecture decisions from day one. OJK’s consumer protection regulations are tightening, with increasing obligations on operators to manage fraud disputes and maintain customer service SLAs.

Fraud Landscape

Social engineering and account takeover fraud have grown significantly alongside digital payment adoption. Virtual account fraud — fraudsters sending fake VA numbers to buyers after order confirmation — is a recurring e-commerce threat. OTP interception via phishing and SIM swap is common. Marketplace fraud targeting both sellers (fake buyers) and buyers (fake sellers) is elevated compared to Singapore or Malaysia.

OJK’s consumer protection framework is increasingly placing liability on payment operators and platforms for fraud losses, particularly where the operator’s systems were implicated in the compromise. Operators should build robust fraud scoring, transaction monitoring, and dispute handling into their Indonesian stack from the outset.

Practical Notes for Operators

PSPs. Midtrans (GoTo Financial) is the dominant local payment gateway with deep wallet and VA integration. Xendit (YC-backed) offers a strong developer API and is widely used by regional startups. DOKU is bank-owned (Hana Bank) and well-connected with enterprise merchants. 2C2P has regional coverage including Indonesia. Adyen supports Indonesia for enterprise scale.

Entity. A local Indonesian entity (PT — Perseroan Terbatas) is strongly recommended and often required for PJSP licensing. Foreign ownership rules vary by licence category — legal structuring is critical before market entry.

Tax. VAT is 11%. Digital services provided by foreign operators to Indonesian consumers are subject to VAT collection obligations under the Electronic Transaction VAT regulation (PMK 48/2020). Withholding tax on digital transaction fees adds compliance complexity.

Banking. BCA and Bank Mandiri are the standard merchant banking relationships. BCA’s API infrastructure is the most mature among Indonesian commercial banks. Neobank options (Jenius, Jago) work for startup treasury but enterprise operators typically need a BCA or Mandiri relationship for direct QRIS settlement and VA issuance.

Localisation. Bahasa Indonesia localisation is essential for consumer-facing products. English is acceptable for B2B and developer tools. Multi-wallet integration is not optional — operators who launch with only one or two wallets will miss significant transaction volume.