Best Payment Gateway in Indonesia 2026: Ten Checked, None Ranked

No payment gateway is the "best" one for an Indonesian bank, insurer or multifinance company. What exists is a gateway that clears three checks you can verify yourself: a licence row in Bank Indonesia's register of licensed institutions, settlement terms written into the contract (because PADG No. 32 of 2025 sets no T+ figure at all), and the integration load of the SNAP Open API standard. On 11 September 2026 we checked the ten gateways that surface for this search against BI's register. Seven have a row under the legal entity their own website prints. One resolves to an entity whose registered website is a different product, one has no row under its name, and one we haven't yet been able to check under its legal name.

This is a matrix, not a ranking. It's written for the Head of IT or procurement lead cutting a longlist to two to four finalists, and for the Compliance, internal audit (SKAI) and CISO reviewers who will veto those finalists. For the rails and licensing underneath all of this, start with our guide to Indonesia payment gateways, BI-FAST and QRIS.

Why the "best payment gateway" lists don't survive procurement

We read the 11 top organic results for the Indonesian form of this query, payment gateway indonesia terbaik (for Finpay, its homepage rather than the ranking URL). Ten are written by gateway vendors. The exception is Exabytes, a hosting company writing for small online shops. DOKU, Pivot and Intracs each put themselves at number one in their own listicles.

None of the 11 cites a PBI, PADG or POJK by number, or the Personal Data Protection Law (UU PDP). None states a PCI DSS version; Pivot says only "Level 1", which is a merchant or service-provider level, not a version. None links BI's payment-system licence register. Only Xendit's footer links a BI register at all: its list of licensed QRIS operators at bi.go.id/PJSPQRIS. The only numbers anyone prints are a Kominfo electronic-system (PSE) registration (iPaymu) and a BI licence letter number (GDCPay). And not one mentions PBI No. 10 of 2025, which took effect on 31 March 2026, revoked PBI 22/23/PBI/2020 and changed how gateways are licensed.

Searching the English phrase from Indonesia doesn't help much. On 11 September 2026 Google returned the same vendor pages, plus three English listicles written outside Indonesia: inai.io (served through Google Translate), devathon.com and a Hong Kong blog from photonpay.com. We haven't read those three. The AI Overview on that query cites five sources: midtrans.com, iPaymu's English homepage, and the DOKU, Pivot and Intracs listicles. All five are vendors, and three are the pages that rank their own author first. That's the answer an English-speaking regional procurement team gets by default.

The matrix: BI licence register, checked 11 September 2026

Method. We searched BI's register for each gateway using the legal entity name printed on the vendor's own site. Searching by brand doesn't work: "Xendit" returns no rows, while "Sinar Digital Terdepan" returns three. The register filter calls licensees Penyedia Jasa Pembayaran (PJP, payment service provider). The "SNAP" and "Settlement" columns record what the pages we read publish. They aren't the results of endpoint tests.

Gateway (legal entity)	BI register row (category, letter number, date)	What the vendor page claims	Published settlement	Claimed SNAP support
Midtrans (PT Midtrans)	PJP licence category 2, 23/666/DKSP/Srt/B, 1 Jul 2021	BI, Kominfo, PCI DSS and ISO 27001 badges, with no numbers or versions	In its documentation; see our line-by-line QRIS merchant discount rate and settlement costs	Not published on the page read
Xendit (PT Sinar Digital Terdepan)	Category 1, 25/651/DKSP/Srt/B, 15 Dec 2023; Category 2, 23/582/DKSP/Srt/B, 1 Jul 2021; QRIS, 26/295/DKSP/Srt/B, 20 Aug 2024	"Full licence", with no licence named	"Varies" by method, with paid early settlement	Not published on the page read
DOKU (PT Nusa Satu Inti Artha)	Category 1, 23/673/DKSP/Srt/B, 1 Jul 2021; QRIS, 22/171/DKSP/Srt/B, 5 Mar 2020	"Five licences" and "6 licences" on the same page; links to third-party certificates	Not published	Not published on the page read
Finpay (PT Finnet Indonesia)	Category 1, 23/573/DKSP/Srt/B, 1 Jul 2021; QRIS, 22/184/DKSP/Srt/B, 12 Mar 2020; also a BI-RTGS participant	"PJP Kategori I", PCI DSS, ISO/IEC 27001, ISO 9001:2015	Not published	Not published on the page read
GDCPay (PT GDC Multi Sarana)	Category 1, 24/18/DKSP/Srt/B, 28 Jan 2022; QRIS, 25/191A/DKSP/Srt/B, 17 Apr 2023	Licence number 24/18/DKSP/Srt/B in the footer, matching the register	Lists real-time, same-day and T+1 as questions a buyer should ask	Not published on the page read
Paylabs (PT Wahana Pembayaran Digital)	Category 2, 24/143/DKSP/Srt/B, 30 May 2022; QRIS, 26/276/DKSP/Srt/B, 8 Aug 2024	ISO/IEC 27001 and PCI DSS, no versions	Not published	Not published on the page read
LinkQu (PT Tri Usaha Berkat)	Category 3, 21/250/Sb/7, 4 Jul 2019	"Officially verified by BI", no number	Not published	Not published on the page read
Espay	The keyword "Espay" returns PT Espay Debit Indonesia Koe, Category 1, 23/571/DKSP/Srt/B, 1 Jul 2021, with dana.id as its registered website [GAP: confirm which entity signs Espay's gateway contracts]	Not read	Not published	Not read
iPaymu (PT Inti Prima Mandiri Utama)	No row under this name	Kominfo PSE registration 004433.01/DJAI.PSE/07/2022 and "PCIDSS certified"; describes itself as a link to licensed PJPs	"Realtime Settlement", no figure	Not published on the page read
Pivot (PT Harsya Remitindo, renamed Pivot in June 2025)	Not yet confirmed under PT Harsya Remitindo. Searches for "Pivot" and "pivot-payment" return nothing, which is what a legal-name index would return either way. Kontan (17 June 2025) describes it as a "Penyedia Jasa Pembayaran (PJP) berizin dari Bank Indonesia" [GAP: licence category and letter number for PT Harsya Remitindo]	Its own listicle (19 Jan 2026) claims a "Penyedia Sistem Pembayaran Level 1" licence from BI. "Level 1" is Pivot's wording; the register uses licence categories	Not published	"API berstandar SNAP", the only SNAP claim across the 11 pages

Three rows need a careful reading, and none of them says a vendor is unlicensed. iPaymu's legal entity has no row, but iPaymu calls itself a link to licensed PJPs, so the licence that matters may belong to a partner. Espay's brand search lands on an entity whose registered website is dana.id. And the Pivot gap is ours, not theirs: we haven't yet managed to pull a row for PT Harsya Remitindo from the register. For Compliance, all three raise the same first question. Whose account does your money actually pass through?

The register still uses the old labels

The register's filter still reads "Penyedia Jasa Pembayaran - Kategori Izin 1/2/3", the licence categories of PBI 22/23/PBI/2020, which has been revoked. Article 179 of PBI 10/2025 says holders of the old licences "tetap dinyatakan sebagai PJP" (remain designated as PJPs). The new bundled activity packages (1A, 1B, 2, 3) are assigned only after BI completes its evaluation, no later than one year from 31 March 2026 (Article 32(3) and Article 176(3)). So a "Category I" badge on a vendor's page today is a legacy status. It doesn't tell you which package that vendor will sit in after 31 March 2027.

The package decides what a firm may do. Article 35(2) limits package 1A to PJPs classified as a "PSP utama" (main payment system provider). Under Article 102(1) of PADG 32/2025, minimum paid-up capital is Rp15 billion for package 1 and Rp5 billion for package 2. The elucidation of Article 123(1) of the same PADG gives payment gateways as an example of package 2. The PBI, though, also mentions gateways under package 1, so a gateway's package depends on what else it does. The Indonesia payment gateway anchor article walks through the full mapping.

Settlement: BI does not mandate T+1

Neither PBI 10/2025 nor PADG 32/2025 sets a settlement deadline in days. Article 182 of PADG 32/2025 requires a gateway that facilitates fund receipt to do two things:

• hold those funds "pada rekening yang terpisah dari rekening operasional" (in an account separate from its operating accounts); and
• disburse them "dalam jangka waktu memadai dan tidak bertentangan dengan ketentuan Bank Indonesia" (within an adequate period, consistent with BI rules).

Any blog telling you "BI requires T+1" is claiming more than its source says. Settlement timing is a contract term. Article 186 of the same PADG requires PJPs to meet minimum contractual standards that include a "service level agreement". Article 138(2) requires the agreement with the goods or services provider to be in writing, in Bahasa Indonesia, with a confidentiality clause covering transaction data. Get the T+ figure for each payment method written into the SLA, not a marketing page. The cost side, including float and per-settlement fees, is in our QRIS merchant discount rate breakdown.

Aggregator or facilitator: BI weights them 10 to 1

Article 166(2) of PADG 32/2025 counts "seluruh transaksi" (all transactions) processed under the merchant-aggregator model toward a firm's capital weighting, but only "10% (sepuluh persen)" of facilitator-model transactions. In its regulator's eyes, a gateway that holds your money carries ten times the risk weight. A bank or insurer that can take funds straight into its own account shortens the chain of custody by choosing the facilitator model. Ask which model the vendor will use for your contract.

Integration burden: SNAP is an obligation, not a feature

Article 14(1) of PADG No. 23/15/PADG/2021 on implementing SNAP (enacted and effective 16 August 2021) requires service providers to implement the SNAP-based Payment Open API. Article 14(2) makes them responsible for making sure non-PJP users (your institution) implement it too. Article 23(4) bars a new user from connecting before a recommendation letter is issued. Management of SNAP moved from BI to the payment system association ASPI on 1 September 2023.

Of the 11 pages in the results, only Pivot mentions SNAP. [GAP: a conformance test of each gateway's published SNAP endpoints against the SNAP specification, the original-measurement candidate in the cluster brief, has not been run.] For the evidence an examiner will ask for, see the nine SNAP BI Open API compliance files. For the choice between file transfer, bank APIs and SNAP, see bank host to host versus payment gateway integration.

We haven't integrated any of the gateways in this table. We work on the institution's side. For MSIG, the site links "directly with core financial systems to streamline policy sales, premium collections", and the recorded challenge was connecting those core systems to the site without disrupting existing services. For CGS International, online securities account opening connects four systems: banks, CGS-CIMB, KSEI (the central securities depository) and DUKCAPIL (the civil registry). Our view from that kind of work: the heaviest integration job is reconciliation into the core system, not the gateway's API. The API is the part that gets demoed. Reconciliation is the part that sets the go-live date.

Mapping gateways to institution types

Institution	The veto that comes up most	What the finalist's file must contain
Commercial bank	Article 39(1) of POJK No. 11/POJK.03/2022 (enacted 6 July 2022) requires IT-based transaction processing to happen in Indonesia; processing abroad needs OJK approval (Article 39(4))	Processing location; a contractual commitment to periodic independent IT audits and OJK examination access (Article 30(3)); whether the bank could use a facilitator instead
Insurer	Article 23(3) of POJK No. 4/POJK.05/2021 bars a data centre outside Indonesia without OJK approval	Premium collection and claims payment: check that the gateway's licence covers onward fund transfer, not only acceptance
Multifinance	The same POJK 4/POJK.05/2021; non-bank financial institutions with assets above Rp1 trillion must run a data centre and a disaster recovery centre (Article 22(4))	Loan disbursement and instalment collection: confirm both directions of money flow fall inside the vendor's licensed activities
Listed company	Law No. 27 of 2022 (17 October 2022): notice of a personal data protection failure within 3 x 24 hours (Article 46(1))	An incident-notification path from the gateway to you that fits inside 72 hours; confidentiality terms matching Article 138(2) of PADG 32/2025

If your group already has a gateway

Regional procurement teams in Singapore or Tokyo often assume an Indonesian subsidiary can join the group's existing gateway contract. Two provisions above get in the way. The merchant agreement has to exist in writing in Bahasa Indonesia (Article 138(2), PADG 32/2025), so an English-only master agreement signed at group level doesn't satisfy it on its own. And an Indonesian bank processing transactions offshore needs OJK approval first (Article 39(4), POJK 11/POJK.03/2022). MSIG, one of the clients above, sits inside Japan's MS&AD group, and that's the typical shape: the group standard lives overseas while the regulator, the licence register and the contract language are local.

Eight due-diligence questions, each with its document

1. The BI licence letter in the name of the legal entity that signs the contract. Match the number and date against the register, searching by legal name, not brand.
2. BI's package and classification decision, due no later than 31 March 2027. If it hasn't been issued, ask for a written statement of which package the vendor has applied for.
3. A PCI DSS v4.0.1 service-provider AOC (Attestation of Compliance) dated after 31 March 2025. The PCI Security Standards Council retired v4.0 on 31 December 2024, and the future-dated requirements have applied since 31 March 2025.
4. The scope of the ISO/IEC 27001 certificate, not the badge. For example, one Certipedia entry linked by DOKU shows ISO/IEC 27001:2022 scoped to Dukcapil verification for KYB/KYC, payment initiation and acquiring, account issuance, remittance and billing. Another link reads "Currently no valid certificates are attached". DOKU is still the only vendor in the results you can check that far.
5. Settlement figures per payment method in the SLA, as Article 186 of PADG 32/2025 requires, with the daily cut-off times.
6. Evidence of a segregated account for merchant funds (Article 182(a)).
7. The vendor's list of supporting providers (Penyelenggara Penunjang). BI classifies them as critical, important or standard, and the first two provide services at the transaction-processing stage.
8. The SNAP functionality test report (Article 18(3), PADG 23/15/PADG/2021) and the recommendation letter, before go-live.

What this means for the committee

For Compliance and SKAI: don't accept "licensed by BI" without a letter number. Seven of the ten gateways here have one you can match in a single register search, so a vendor that can't produce theirs is telling you something. For the CISO: ask for the AOC and the certificate scope, then match that scope to the service you're actually buying. For the Head of IT: weigh the reconciliation load into your core system, not the count of payment methods. For the board: settlement is a contract figure, and float sitting in a vendor's account has a price.

If we could keep only one of the three checks, we'd keep the register row under the name of the entity that signs. Settlement terms and SNAP scope can still be negotiated after signature. The licence can't.

If your checkout, premium portal or disbursement flow has to connect to a gateway and your core system at the same time, WEBARQ's website development team builds that institution-side layer. This article was prepared with AI assistance. The register checks were done directly on BI's website on 11 September 2026.