Indonesia
Payments

Indonesia is the most complex payments market in Southeast Asia and, by most measures, the most important. 277 million people, the region's largest e-commerce market, and a payment infrastructure that is actively being rebuilt in real time. Bank Indonesia has moved faster and more decisively on payments modernisation than almost any central bank in the region — QRIS and BI-FAST together represent a structural shift that operators cannot afford to ignore.

QRIS and BI-FAST — Indonesia's Payment Infrastructure

Bank Indonesia describes QRIS as its QR payment standard. Confirm the covered merchant QR product and participating provider. QR standardisation is not a rule that every business must offer every wallet, and a QR payment confirmation does not define the merchant's bank payout schedule.

Choose method coverage from actual customer needs and the provider's supported product. A QRIS merchant can accept participating payer applications through its eligible QRIS provider; other wallet, virtual-account or card products have separate integration and charging conditions. Ask for current bank/provider fees rather than assuming every rail is free.

E-Wallet Landscape

Indonesia has the most developed proprietary e-wallet ecosystem in Southeast Asia, and uniquely so: Indonesian wallets hold genuine stored-value float rather than being wrappers over a bank rail. Confirm the legal funds holder and permitted activities for the specific wallet product; do not infer them from a regional comparison.

GoPay (GoTo Financial / Gojek) is the dominant wallet for ride-hail, food delivery, and the broader Gojek super-app ecosystem. GoPay Coins and GoPay Later (BNPL) extend the value proposition. OVO, originally backed by Grab and Tokopedia, now operates in the broader Grab ecosystem with strong penetration in retail and e-commerce. Dana is the Ant Financial and Emtek joint venture, positioning as a financial services wallet with savings and insurance products. ShopeePay has grown rapidly on the back of Shopee's dominant e-commerce position and runs aggressive cashback promotions to drive adoption.

Payment-service and e-money permissions fall within Bank Indonesia's framework; OJK has separate financial-services responsibilities. Verify the legal entity and permitted activity in the appropriate current register. Select wallet/QR coverage using the actual customer and product evidence; integrating every wallet is not a universal requirement.

Bank virtual accounts (VAs) remain very widely used for e-commerce checkout. A customer selects their bank, receives a unique virtual account number, and completes a bank transfer within a defined window. VA checkout is declining as QRIS and BI-FAST mature but remains essential for full market coverage in 2026, particularly for higher-value transactions and older consumer segments.

Card Market

Card penetration in Indonesia sits at approximately 35%, concentrated in urban upper-middle-income consumers and the Jakarta-Surabaya-Bali corridor. Visa and Mastercard are present but primarily for mid-to-upper-income segments and cross-border transactions. BCA, Bank Mandiri, BNI, and BRI are the dominant domestic card issuers, and their card products carry strong brand trust.

Installment plans (cicilan) are culturally significant for electronics, appliances, and high-ticket purchases — 0% for 3, 6, or 12 months via bank credit cards drives meaningful card preference at checkout for those categories. Contactless NFC adoption is still developing and inconsistent outside major cities. 3DS2 deployment at Indonesian issuers is uneven — some major issuers remain on 3DS1, creating authentication friction in card-not-present flows.

Credit-card charges depend on the actual acquirer and contract. Debit and QRIS schedules have different regulatory/product scopes. Do not substitute an unsupported national MDR band for the relevant category, transaction route and current provider quote.

Cash and Vouchers

Alfamart (18,000+ stores) and Indomaret (20,000+ stores) are Indonesia's primary cash-at-retail payment networks for e-commerce. The consumer flow is standardised: select Alfamart or Indomaret at checkout, receive a unique barcode or payment code, pay cash at any branch within the payment window (typically 24–72 hours). Midtrans, Xendit, and DOKU all support both channels natively via their standard payment gateway integrations. This is not an optional channel for operators targeting national coverage — e-commerce conversion in tier-2 and tier-3 cities and rural markets depends materially on OTC availability.

Cash-on-delivery accounts for approximately 15–20% of e-commerce volume in provincial markets and remains significant across logistics-served areas. COD handling is a separate operational requirement from OTC checkout: it requires a logistics partner with COD acceptance, settlement reconciliation, and return-handling capability. Operators should build both OTC payment integration (via Midtrans, Xendit, or DOKU) and COD logistics capability into their Indonesia stack from day one — retrofitting either after launch creates fulfilment gaps that directly affect conversion in non-metro markets.

BNPL

Indonesia is the largest BNPL market in this SEA cluster at USD 8.59B in 2025, with OJK reporting IDR 37.44 trillion (~USD 2.2B) in outstanding BNPL balances as of November 2025. The market is forecast to reach USD 13.59B by 2030. Kredivo leads as the dominant pure-play BNPL operator — OJK licensed, 4,000+ merchant partners, credit limits up to IDR 50M. Akulaku PayLater covers 1,000+ merchants with 5-minute approval flows. SPayLater (Shopee/Sea) dominates e-commerce BNPL penetration; Atome provides regional omnichannel coverage.

Crypto and Digital Assets

Crypto assets are legal to trade in Indonesia as "digital financial assets" but are explicitly prohibited as a payment method — the Currency Law reserves the rupiah as the sole legal tender, and this restriction is actively enforced. Regulatory oversight transferred from BAPPEBTI to OJK effective January 10, 2025, with the transition period ending January 20, 2026 under OJK Regulation No. 27/2024 (digital financial assets framework, effective July 2025). All crypto asset trading platforms must now hold OJK authorisation under the new framework.

Operators cannot accept crypto for goods or services in any Indonesia deployment — there is no compliant integration pathway for merchant crypto payments. The regulatory intent is unambiguous: crypto is an investment and trading asset class, not a payment instrument. No stablecoin framework or retail CBDC pilot is active as of mid-2026. Build no crypto payment capability into Indonesia operations.

Regulatory Environment

Indonesia operates a dual regulatory structure for payments. Bank Indonesia (BI) licenses and oversees PJPs (Penyelenggara Jasa Pembayaran, Payment Service Providers) and PIPs (Penyelenggara Infrastruktur Pembayaran, Payment Infrastructure Providers) under BI Regulation No. 10/2025, in effect since 31 March 2026 — e-money issuers, payment gateways, and switching operators all fall under this framework. PIPs face a stricter domestic-control bar than PJPs: at least 80% domestic ownership and 80% domestic control, versus 51% domestic voting control for PJPs. OJK (Otoritas Jasa Keuangan) covers broader financial services regulation including consumer protection, lending-linked wallets, and the intersection with banking.

The SNAP (Standard National Open API Payment) initiative, launched by Bank Indonesia, is standardising API connectivity between banks, wallets, and payment service providers. SNAP compliance is becoming a licensing requirement, and operators building integrations should align with the SNAP specification rather than proprietary bank API variants.

Data localisation is strict and enforced. Payment transaction data must be stored and processed on servers physically located in Indonesia. This is a meaningful infrastructure cost for foreign operators and should be factored into architecture decisions from day one. OJK's consumer protection regulations are tightening, with increasing obligations on operators to manage fraud disputes and maintain customer service SLAs.

Fraud Landscape

Social engineering and account takeover fraud have grown significantly alongside digital payment adoption. Virtual account fraud — fraudsters sending fake VA numbers to buyers after order confirmation — is a recurring e-commerce threat. OTP interception via phishing and SIM swap is common. Marketplace fraud targeting both sellers (fake buyers) and buyers (fake sellers) is elevated compared to Singapore or Malaysia.

OJK's consumer protection framework is increasingly placing liability on payment operators and platforms for fraud losses, particularly where the operator's systems were implicated in the compromise. Operators should build robust fraud scoring, transaction monitoring, and dispute handling into their Indonesian stack from the outset.

Practical Notes for Operators

PSPs. Midtrans (GoTo Financial) is the dominant local payment gateway with deep wallet and VA integration. Xendit (YC-backed) offers a strong developer API and is widely used by regional startups. DOKU is bank-owned (Hana Bank) and well-connected with enterprise merchants. 2C2P has regional coverage including Indonesia. Adyen supports Indonesia for enterprise scale.

Entity. A local Indonesian entity (PT — Perseroan Terbatas) is strongly recommended and often required for PJP licensing under BI Regulation 10/2025. Foreign ownership rules vary by activity bundle — legal structuring is critical before market entry.

Tax. VAT is 11%. Digital services provided by foreign operators to Indonesian consumers are subject to VAT collection obligations under the Electronic Transaction VAT regulation (PMK 48/2020). Withholding tax on digital transaction fees adds compliance complexity.

Banking. BCA and Bank Mandiri are the standard merchant banking relationships. BCA's API infrastructure is the most mature among Indonesian commercial banks. Neobank options (Jenius, Jago) work for startup treasury but enterprise operators typically need a BCA or Mandiri relationship for direct QRIS settlement and VA issuance.