Fintech, unlike many other sectors, faces stringent regulations globally, and Indonesia is no exception (Tech in Asia, 2024). In Indonesia, these regulations are particularly rigorous due to the government’s commitment to maintaining financial stability and ensuring consumer protection. For fintech founders, this means they must focus not only on finding product-market fit but also on navigating a complex regulatory landscape designed to foster responsible growth and mitigate risks to the financial system.

Komunal Indonesia, through its product DepositoBPR—the country’s first digitized rural bank marketplace—has successfully met these regulatory challenges. The company holds a “recommended” status from the Financial Services Authority (OJK) and is registered with Kominfo and the Fintech Indonesia association (AFTECH).

Founded in 2018 by Hendry Lieviant, Kendrick Winoto, and Rico Tedyono, Komunal has emerged as a success story in navigating Indonesia’s regulatory landscape. Based in Surabaya, Komunal has supported over 376 rural banks across 24 provinces, facilitating deposits of Rp 14.48 trillion (approximately US$ 934 million). 

Annora Niendy, a key member of Komunal’s legal team, shares the critical steps that have enabled Komunal to meet regulatory requirements, offering valuable insights for other fintech founders striving to do the same.

Prepare sufficient capital and establish a PT (Perseroan Terbatas)

Nora emphasizes that founders should only begin their fintech operations once they have secured the proper licenses. Operating without a license could lead to serious legal and financial consequences. “One example is getting blacklisted by OJK. When that happens, it can severely impact business trust in the long run,” Nora explains.

The first step is to establish a legal entity—a PT (private limited liability company). In Indonesia, all fintech companies must operate as a PT to formally register as a business entity and apply for the necessary licenses. With complete documents, it typically takes up to four weeks to establish a PT.

During this process, Nora advises founders to ensure compliance with the Articles of Association (anggaran dasar) relevant to their business model. This compliance will be essential during the registration with regulatory bodies, helping founders meet requirements efficiently from the beginning.

For instance, fintech firms operating a lending model need to comply with OJK regulations. This includes meeting specific requirements, such as maximum foreign ownership of 85% and minimum capital of IDR 25 billion (around US$1.6 million), as specified by POJK No. 10/POJK.05/2022. 

In contrast, payment fintech companies follow regulations from Bank Indonesia (BI), which set a foreign ownership cap of 49%. Firms offering e-wallet services must meet minimum paid-up capital requirements of Rp 15 billion (approximately US$1 million) under PBI No. 23/4/PBI/2021.

“OJK and BI seem to be tightening regulatory standards for new fintech firms over the years, aiming to make the financial ecosystem safer and more stable,” adds Nora.

Given the high capital requirements, it is common for early-stage founders to seek funding before launching their business. Hiro Kiga, co-founder of the cross-border payment platform Wallex, mentioned in a separate interview that they had to raise funds without having a product in place to meet licensing requirements.

Registering on OJK

After establishing a PT, the next step for fintech firms is to register with the appropriate regulatory body in Indonesia, either OJK or BI, based on the business model. For Komunal’s DepositoBPR, the governing body is OJK, as it operates under the Financial Sector Technological Innovation (ITSK) framework, specified in OJK Regulation No. 3 of 2024 (POJK 3/2024).

Nora emphasizes the importance of thorough document preparation during this phase. Based on her experience, OJK takes about one month to review the documents and decide if they are complete. If they are found incomplete, the entire process restarts, leading to delays. Maintaining consistent communication with the assigned point of contact (PIC) at OJK or BI is essential. “The review process is often where the back-and-forth communication starts,” Nora says, highlighting that misinterpretations can cause significant delays. Close contact with the PIC ensures the process stays on track.

Nora also suggests aligning the fintech startup’s mission with OJK’s goals to improve approval chances. For example, if a startup contributes to financial inclusion, it may receive better consideration during the registration process. Under the ITSK framework, fintech innovations like DepositoBPR must complete a two-stage process:

1. Regulatory sandbox process 

Innovative fintech companies introducing new business models must first go through OJK’s regulatory sandbox. This stage assesses the viability, risks, and compliance of the product in a controlled environment. Founders must present a working prototype for evaluation by regulators. Komunal’s DepositoBPR needed to register to participate in this sandbox, a process that can take up to 12 months. During this phase, fintech firms that qualify are allowed to operate on a limited scale, for example, with restrictions on transaction volumes.

It took DepositoBPR another three years to clear this phase, largely because OJK was also drafting new regulations to govern emerging business models during this period, which added time to the process. “If startups haven’t passed the sandbox regulatory process, it doesn’t necessarily mean they are not ready to operate—it could also mean the government is still drafting the governing regulations,” Nora explains.

Once DepositoBPR successfully completed this phase, they received the status of “recommended to apply for a full permit with OJK,” giving them a six-month window to start the next stage of applying for full registration.

2. Registered and authorized by OJK (terdaftar dan diizinkan oleh OJK)

In this stage, fintech companies formally register with OJK by meeting the essential regulatory requirements. This includes submitting a comprehensive business plan detailing services, platform operations, compliance measures, and consumer data protection protocols. Companies must also register as a PSE (Electronic System Provider) with the Ministry of Communication and Information Technology (Kominfo). Nora notes that this process may take up to 6 months. Once completed, DepositoBPR will be able to operate fully.

Different Business Models Require Different Licenses

Nora explains that Komunal’s peer-to-peer (P2P) lending business, regulated by OJK under the Non-Bank Financial Industry (IKNB) sector, did not need to go through the regulatory sandbox as it wasn’t considered an innovative model. However, the P2P lending service still had to complete two licensing stages with OJK: “registered with OJK” (terdaftar di OJK) and “authorized by OJK” (diizinkan oleh OJK), each potentially taking up to 12 months.

To officially operate, P2P lending firms must first obtain the “registered by OJK” license. They are then given one year to apply for the “authorized by OJK” license. During this stage, the company must demonstrate adherence to OJK’s standards, such as financial stability, risk management, and consumer protection.

In addition, key figures within the company, including directors and commissioners, are required to pass a “fit and proper test.” This test evaluates their experience, integrity, and competence in managing a financial institution responsibly. “To move from registration to approval, you have to show compliance beyond the basics—including audits, transparent business operations, and proper consumer safeguards,” Nora says.

Each stage in this process—sandbox, registration, approval, and recommendation—acts as a safeguard to ensure fintech platforms, like Komunal’s DepositoBPR, operate legally, meet all regulatory standards, and contribute positively to Indonesia’s financial stability.

 

“Though it can be a lengthy process, these certifications are crucial for building trust with stakeholders and ensuring the company is recognized as a reliable and compliant entity,” Nora adds.

Other tips for fintech founders

Nora recommends that fintech founders join official fintech associations, such as AFTECH, which DepositoBPR is a member of. Being part of an association gives access to shared knowledge and experiences, which can be crucial during regulatory processes.During the sandbox regulatory phase, for instance, OJK may not directly notify all registrants about upcoming regulatory updates. Instead, these updates are discussed with fintech associations. Founders who are members of such associations will have the advantage of staying informed about these changes.

Beyond knowledge-sharing, these associations can also offer formal support, including recommendation letters to strengthen a company’s registration with OJK or Bank Indonesia. “It’s like a signal that your company is legitimate and worth being considered by OJK or BI. Being acknowledged by the community often gives you an edge,” she explains.

“These recommendations are just an overview,” says Nora. “I recommend founders work alongside consultants, especially during the early registration process, to ensure everything is covered thoroughly.”

Hiro from Wallex also recommends working with a legal firm to navigate the regulatory landscape effectively. “The process is slow, so you need to be talking to the right people. If you’re not knocking on the right door from day one, it just prolongs everything,” he advises.

As a final tip, Nora advises founders to create a detailed checklist from the outset. This checklist should cover all required documents, roles, and team members to ensure that every aspect of the registration process is accounted for. Proper preparation helps startups navigate the registration more effectively and minimizes the risk of common errors.

Indonesia’s fintech landscape is being shaped by rigorous regulations designed to maintain security, transparency, and stability in the financial system. Companies like Komunal exemplify the journey through these regulatory demands, showing that with careful preparation and compliance, fintech firms can successfully build trust and credibility. By setting a standard for responsible growth, Komunal and other fintech firms contribute to a safer financial ecosystem, paving the way for future innovation in Indonesia’s fintech sector.

At Skystar Capital, we take pride in being the first to back visionary founders. With our deep local roots and extensive network in the Indonesian market, we are eager to support visionaries with innovative solutions and drive Indonesia’s growth forward. Let’s build the future together!

Submit your business proposal here. Follow our social media accounts on LinkedIn, YouTube, and Instagram to stay updated! 

Glossary

Key regulations to consider based on Komunal’s experience:

  • General Business Law (UUPT No. 40 of 2007): Governs corporate practices and establishes the legal framework for companies operating in Indonesia.
  • Financial Sector Technological Innovation (ITSK, POJK 3 of 2024): Covers technology-based innovations that impact products, services, and business models within the digital financial ecosystem, focusing on areas that do not fall directly under OJK or BI regulations.
  • Non-Bank Financial Industry (IKNB, POJK No. 10/POJK.05/2022): Regulates peer-to-peer (P2P) lending and other non-bank financial services under the oversight of OJK, outlining licensing requirements, ownership regulations, and compliance standards for fintech companies.

Regulated by OJK:

  • Neo Banking and Digital Finance (POJK 10 of 2023): Covers non-payment fintech companies, such as digital banking services. It outlines requirements for financial services, including lending, capital requirements, and compliance standards.
  • Anti-Money Laundering and Terrorism Financing (APU-PPT and POJK PUPPT): Focuses on anti-money laundering compliance and the assessment of national risks.

Regulated by BI:

  • Payment systems: Fintech products related to payment services are governed by BI under PBI 23 of 2021, which details legal requirements for payment systems to ensure secure and efficient transactions.

Cross-cutting regulations:

  • Data protection (UUPDP): Indonesia’s personal data protection law mandates privacy and security across sectors, including fintech, regulating how companies collect, store, and process user data.

Official government sources for reference: