Indonesia Payment Gateway, BI-FAST and QRIS: Who Can Connect

In Indonesia the choice of payment rail is settled by Bank Indonesia's classification of your counterparty, not by a vendor feature matrix. Since 31 March 2026, PBI No. 10 Tahun 2025 on Payment System Industry Regulation has been in force, revoking PBI 22/23/PBI/2020 through Pasal 185. The sharpest consequence for anyone building on top of it: a non-bank payment service provider cannot join BI-FAST as a direct participant. Under PADG 17/2023 Pasal 8 ayat (2) huruf d — as amended by PADG No. 3 Tahun 2026 Pasal I angka 5, in force the same day — "PJP berupa LSB sebagai PTL": a PJP that is a non-bank institution participates only as a Peserta Tidak Langsung, behind a Bank Sponsor.

So the question a steering committee should be asking isn't which Indonesia payment gateway is best. It's which rail is permitted to carry which payment, and what obligations attach to your institution the moment the connection goes live.

Four names, three rails

BI-FAST, QRIS, payment gateway and virtual account turn up together in every tender document in Jakarta. They aren't four comparable things.

Option	Legal basis	Who may participate	Settlement finality	Transaction cap	Who sets the price
BI-FAST	PADG 17/2023, as amended by PADG 3/2026	Direct participant (must also be a BI-RTGS participant) or indirect participant via a Bank Sponsor	Immediate, per transaction, "final dan tidak dapat dibatalkan" (Pasal 2)	Rp250 million per transaction	The operator, i.e. Bank Indonesia (Pasal 4 huruf f)
QRIS	PADG 21/18/PADG/2019 and its amendments	A licensed payment system service provider, plus separate BI approval	Whatever the rail underneath provides. QRIS is a QR standard, not a settlement engine	Rp10,000,000.00 per transaction	Bank Indonesia (Pasal 9 ayat (1))
Payment gateway	PBI 10/2025 Pasal 34; PADG 32/2025 Pasal 102	A licensed PJP; the activity is payment transaction forwarding	None. Forwarding is not clearing and settlement	Inherited from the rail being forwarded to	BI sets the pricing scheme; a PJP may set its own only where BI has not
Virtual account	Named in no payment system regulation at all	Attaches to payment-account administration, a package-1 activity	Inherited	Inherited	The account issuer

BI-FAST: finality is the only reason to choose it

Pasal 2 of PADG No. 17 Tahun 2023, enacted 28 November 2023, states the operating principle in one clause that determines your entire reconciliation design: fund settlement happens "secara seketika per transaksi" and is "final dan tidak dapat dibatalkan". No cancellation window, no chargeback, no reversal at rail level. If your product needs a refund, you build it as a fresh transaction in the application layer. Don't expect it from Bank Indonesia.

The volume is well past pilot: in Q1 2026 BI recorded 1.4 billion BI-FAST transactions, up 30.82% year on year, worth Rp3,519 trillion (Press Release No. 28/84/DKom, 22 April 2026). Pricing isn't yours either. For the phase-two services BI set Rp16 per bulk transfer and Rp19 per request-for-payment or direct debit charged to the participant, capped at Rp2,100 and Rp2,500 on what the participant may charge its customer (Press Release No. 26/279/DKom, 21 December 2024). Pasal 4 huruf f as amended hands nominal limits, services, operating hours, liquidity and pricing to the operator, so those figures can move without any regulation changing.

The test is an activity test, not a package test

PADG 3/2026 does open BI-FAST to non-bank PJPs, but the door is narrow and bundling package isn't what opens it. Pasal 10 ayat (3) huruf a requires a prospective non-bank PJP participant to be "PJP yang melakukan aktivitas penatausahaan sumber dana berupa penatausahaan akun untuk pembayaran (payment account)". That points at PBI 10/2025 Pasal 34 ayat (3) huruf a angka 1 — one of the two limbs of source-of-funds administration. The other limb, "penerbitan dan/atau penyediaan akses ke Sumber Dana", isn't enough: a pure e-money issuer fails even though it holds a package-1 licence.

And payment gateway isn't exclusively a package-2 activity. Across all 116 pages of PBI 10/2025 the phrase "payment gateway" appears exactly once — in the elucidation of Pasal 34 ayat (3) huruf b angka 1, which elucidates package one, where BI gives "penyelenggaraan acquirer dan penyelenggaraan payment gateway" as examples of transaction forwarding. Package 1 comprises source-of-funds administration and forwarding; package 2 comprises forwarding alone. Nested, not mutually exclusive. The "payment gateway is package 2" mapping that circulates in vendor summaries comes from a table of worksheet codes at Juknis 1/2026 §8.3 Perhitungan Ongoing Capital, whose own column heading reads "Cakupan Layanan (Contoh)" — examples. That table selects a capital worksheet. It never mentions BI-FAST.

So for a provider that only forwards transactions, the barrier isn't balance-sheet size. The Rp100,000,000,000.00 at Pasal 10 ayat (3) huruf c is cumulative with the activity test, not a substitute for it — and that figure deserves notice, because PBI 10/2025 Pasal 44 sets PJP licensing capital at only "Rp500.000.000,00 sampai dengan Rp15.000.000.000,00" by activity bundle. The participation threshold sits up to 200 times above the licensing threshold. We read a gap that size as deliberate policy rather than drafting accident: BI-FAST is settlement infrastructure, and the central bank plainly doesn't want its liquidity risk held by an institution licensed at package-3 scale. Two routes still stay open: Pasal 9 ayat (1) and Pasal 8 ayat (2) huruf c both admit "pihak lain yang disetujui atau ditetapkan oleh Penyelenggara", and Pasal 10 ayat (10) reserves BI's power to set "kebijakan tertentu sehubungan dengan kepesertaan dalam BI-FAST".

One repeated claim is wrong: confining non-banks to indirect participation isn't new. Original PADG 17/2023 already read, at huruf c, "lembaga selain bank sebagai PTL". What changed on 31 March 2026 is narrower scope — the rule now reaches only PJPs — plus a new huruf b making a PIP a direct participant outright, so a non-bank infrastructure operator is no longer pushed into indirect participation. The surviving huruf c still says "PJP, Bank Umum, dan pihak lain yang disetujui atau ditetapkan oleh Penyelenggara dapat menjadi PL atau PTL", so huruf d confines a non-bank PJP only if read as the specific rule overriding the general one — almost certainly right, since otherwise huruf d does nothing.

If a vendor says it's "connected to BI-FAST", ask two things: direct or indirect, and who's the Bank Sponsor. The sponsorship agreement is regulated rather than negotiated — Pasal 13 ayat (1) mandates the Sub-RSD liquidity mechanism, confidentiality of the indirect participant's account and settlement data, dispute resolution, and allocation of every liability, cost and administrative sanction. Timings are fixed too: approval in principle within 7 working days of a complete filing, 30 working days of operational preparation, then operational approval within 5 working days (Pasal 15 ayat (3)–(5)).

QRIS is an obligation, not an option

Plenty of architecture documents still file QRIS under "candidate channels". Pasal 6 ayat (1) of PADG No. 21/18/PADG/2019 leaves no room: "QRIS wajib digunakan dalam setiap transaksi pembayaran di Indonesia yang difasilitasi dengan QR Code Pembayaran."

What matters more to a committee is Pasal 9 ayat (1): "Skema dan biaya pemrosesan Transaksi QRIS ditetapkan oleh Bank Indonesia." Merchant discount rate is therefore a regulated tariff, not a line you negotiate with an acquirer. BI's own QRIS page publishes it at finer grain than the figure usually quoted: micro merchants at 0% up to Rp500,000.00 and 0.3% above it, with small, medium and large merchants all at 0.7%.

That last number changes three weeks after this article publishes. Through Press Release No. 28/159/DKom of 17 August 2026, BI extends 0% MDR from 1 October 2026: "Pemberlakuan MDR 0% juga diperluas pada seluruh merchant kategori lainnya (kecil, menengah, dan besar) untuk transaksi sampai dengan Rp100.000, dari yang sebelumnya sebesar 0,7%." The micro-merchant 0% band up to Rp500,000 continues. If your acquiring model assumes a flat 0.7%, it's already stale. The arithmetic is in the true cost of accepting payments in Indonesia.

What a payment gateway licence actually costs to hold

Get the capital figures from the implementing PADG rather than from a summary. PADG No. 32 Tahun 2025 Pasal 102 ayat (1) huruf b — enacted 24 December 2025, in force 31 March 2026 — sets minimum paid-up capital for a licence application:

• Bundling package 1 — at least Rp15,000,000,000.00
• Bundling package 2 — at least Rp5,000,000,000.00
• Package 3 that provides a system usable by other package-3 PJPs — at least Rp1,000,000,000.00
• Package 3 that doesn't — at least Rp500,000,000.00
• A prospective PIP — at least Rp100,000,000,000.00, except that a PIP with a global network in Indonesia is exempt if it produces written assurance of capital adequacy from its majority shareholder or controller and conducts only BI-designated PIP activities

The word "other" on the third line isn't decoration. A package-3 provider supplying a system to a package-1 or package-2 licensee doesn't fall into the Rp1 billion bracket; the test is whether fellow package-3 PJPs use it. Two more qualifications drop out of most summary tables. Where the applicant is a commercial bank or a rural bank, Pasal 102 ayat (2) defers to the financial services authority's capital rules. And these are entry figures only: Pasal 162 imposes a separate, continuing ongoing-capital obligation of at least 10% of risk-weighted transactions, plus a surcharge of 1.5% for a PJP rated moderate to high on transactions and interconnection and 2.5% for one rated high. Quoting the initial-capital line alone materially understates the burden — which is exactly the number a group CFO acts on.

The technical minimums, and the scope nobody states

Petunjuk Teknis No. 1/JUKNIS/EKSTERNAL/DKSP/2026, in force 31 March 2026, carries the technical table at §2.11.3 (printed pp. 36–46). Its scope is conditional and almost always reported wrongly. §2.11 is headed "Persyaratan Minimum Dalam Rangka Pengembangan Produk, Dalam Hal PSP Belum Mendapatkan Rating TIKMI", and citing Pasal 68 PADG 32/2025 it bites only where an operator hasn't yet been assigned a TIKMI rating and wants to launch a new activity, product or partnership, in which case it applies to BI and attests to the minimums. First ratings are due by 31 March 2027 at the latest (§2.6 point 4), after which the rating replaces the checklist. This is an interim licensing gate, not the standing operating rule for every provider.

Bundle	Data centre and DRC	BCP / DRP testing	Capacity planning
1A	Tier III equivalent, with redundant distribution paths and maintenance or replacement without affecting operations	BCP once a year; DRP twice a year for specified services, or once a year across all payment services end-to-end	Twice a year
1B	Tier II equivalent, but carrying the same redundant-path and concurrent-maintainability wording as 1A	Same conditional rule as 1A	Twice a year
2	Tier II equivalent "(redundansi komponen untuk daya dan pendinginan)" — component redundancy for power and cooling	BCP and DRP "Minimal 1 kali dalam tahun"	Once a year, or as needed
3	Minimum Tier 2, and only where infrastructure complexity is medium to high	No frequency stated in that row	Not stated
PIP	Tier II equivalent with the stricter 1A wording	Same conditional rule as 1A	Twice a year

Three things worth knowing before you cite that table, all found by opening the PDF. Its opening sentence reads "Pemenuhan persyaratan minimum sebagaimana poin 2.6.2…" when it means 2.11.2 — a stale cross-reference in BI's own drafting, and the only occurrence of "2.6.2" in all 135 pages, since §2.6 is a flat numbered list with no decimal subsections. Lampiran 4, the worked example at printed p. 116, prints the short power-and-cooling gloss for bundle 1B, contradicting §2.11.3 where 1B carries the longer one. And the frequency actually doubled for 1A, 1B and PIP is capacity planning, not DRP. The document your due diligence rests on isn't entirely consistent with itself. That's not a reason to ignore it. It's a reason to quote the article rather than the summary.

On security standards, the widely repeated claim that BI names ISO 27001 and NIST CSF as reference frameworks doesn't survive the text. BI's binding cyber instruments are PBI No. 2 Tahun 2024 and PADG No. 24 Tahun 2024 on information security and cyber resilience — that's what the Juknis calls a framework and what TIKMI scores you against (§2.2.4). ISO 27001 and NIST CSF appear once in 135 pages, on p. 38, as optional drafting guidance: a procedure "dapat disusun" — may be drawn up — against ISO 27001, with NIST CSF offered as a "kerangka pelengkap". Certification alone buys nothing. Two-factor authentication sits in the same conditional table, where the applicant's security procedure must document a "kewajiban penerapan two-factor authentication" — binding bundles 1A, 1B, 2 and PIP, not bundle 3. It surfaces again in BAB VI §6.4.1 as one of five principles an IT audit report must evidence. All of it is a documentation obligation, not a control BI tests directly, which makes it a writing problem as much as an engineering one.

Virtual account doesn't exist in payment system law

We searched nine regulations in full text for "virtual account", "virtual akun" and "rekening virtual", case-insensitively: PBI 10/2025, PADG 17/2023, PADG 3/2026, PADG 21/18/PADG/2019, PADG 23/15/PADG/2021 on SNAP, the SNAP governance guidance, POJK 11/POJK.03/2022, PADK 1/2026 and UU 27/2022. Zero matches in all nine. While we were counting, one more: "BI-FAST" appears zero times across the 135 pages of Juknis 1/2026, so treat any citation of that document as authority on BI-FAST participation as broken on its face.

The nearest construct BI names is sub account, at PBI 10/2025 Pasal 34 ayat (3) huruf b angka 1 and its elucidation — an identification number for a merchant held inside a payment account, whose parent activity is package-one payment-account administration. A virtual account is a reconciliation identifier issued on top of an existing rail, not a rail with its own licence, participation tier and settlement finality. The "which tier" question never arises for it, and your choice is really three-way.

If your group sits outside Indonesia

This is the part that decides more shortlists than price does, and it's barely covered in English.

• Data placement. PBI 10/2025 Pasal 122 ayat (3) requires the systems processing transactions at initiation, authorisation, clearing and final settlement to sit in data centres and disaster recovery centres within Indonesian territory; Pasal 122 ayat (5) allows offshore processing where BI approves it — a carve-out worth applying for early rather than assuming late. POJK No. 11/POJK.03/2022 Pasal 35 ayat (1) repeats it for banks, and Pasal 36 ayat (1) huruf f demands a no-objection letter from the home supervisor of any IT provider outside Indonesia confirming OJK may examine it. That clause, not price, is what usually eliminates an offshore vendor.
• Vendor agreements. PBI 10/2025 Pasal 58 ayat (3) fixes ten mandatory clauses — service levels, cooperation monitoring, supervisory access and choice of law among them — Pasal 59 ayat (1) requires pre-contract due diligence, and Pasal 106 puts partner governance on the payment system operator. PADK No. 1 Tahun 2026, effective 1 March 2026, requires at Pasal 2 that banks already using IT providers "menyesuaikan perjanjian yang telah dibuat" — adjust agreements already signed. The integrator contract your group legal team executed last year is inside that sentence.

And the register hasn't caught up. We read BI's licensed institutions register page by page on 1 September 2026, five months after PBI 10/2025 took effect. The category dropdown still offers "Penyedia Jasa Pembayaran – Kategori Izin 1 / 2 / 3", the taxonomy that pre-dates 31 March 2026, and 35 PJPs sit under Kategori Izin 2 — including PT Midtrans, licence 23/666/DKSP/Srt/B dated 1 July 2021. The same read confirms nine licensed payment system infrastructure operators in Indonesia — four domestic switchers and five international card networks, all licensed in 2021, none added since. Your vendor's certificate still speaks the old vocabulary; the obligations you'll be examined against speak the new one. PBI 10/2025 Pasal 32 ayat (3) and Pasal 176 give BI until 31 March 2027 to finish the conversion, so until then no gateway can tell you with certainty which package it will hold. For a foreign network there's one more line worth reading: the Rp100 billion PIP floor carries that global-network carve-out at PADG 32/2025 Pasal 102 ayat (1) huruf b angka 2.

Three incident clocks, running at once

One incident at a bank that is also a payment system operator and a personal-data controller starts three separate counts.

Trigger	Regulation	Article	Deadline
Cyber incident, to Bank Indonesia	PBI No. 2 Tahun 2024	Pasal 40 huruf b angka 1	Initial notification within 1 hour of discovery
Cyber incident report, to BI	PBI No. 2 Tahun 2024	Pasal 40 huruf b angka 2	Report within 3 calendar days
IT incident, to OJK	POJK No. 11/POJK.03/2022	Pasal 60 ayat (1)	Notification 24 hours, report 5 working days
Personal data breach	UU No. 27 Tahun 2022	Pasal 46 ayat (1)	Written notification within 3 x 24 hours

One hour is the binding constraint. If your runbook places escalation to BI after the crisis management call, the runbook is already in breach before the call starts. What has to be documented to survive an examination is in this week's regulation article.

The layer above the rail, where schedules actually slip

The integration work we can show sits above the rail — identity, connections into core systems, and policy and premium flows. WEBARQ has 214 clients, 42 of them in banking and financial services, and nothing in our public record says we have ever connected a payment rail. We're not claiming it.

For CGS International we built online securities account opening with OCR on the web form plus video call and self-verification, connected to banks, CGS-CIMB, KSEI and DUKCAPIL for real-time data accuracy and regulatory compliance. The case study names the project's central tension plainly: compliance against ease of access. An identity gate like that stands before a single rupiah moves, and it's usually where the schedule goes.

For MSIG, the system links directly to core financial systems for policy sales and premium collection, with automated e-policy issuance. For PFI Mega Life the architecture decision went the other way, deliberately: the system does not support auto-renewal. That's a larger decision than it looks. No auto-renewal means no stored mandate, no stored card, and every payment-data retention obligation that follows drops out of scope.

Five questions to put to a vendor before signing

1. Which activity bundle will you hold after the Pasal 176 conversion, and has BI notified you in writing? Until 31 March 2027 the honest answer is probably "not yet". What you're testing is whether they know the question exists.
2. On BI-FAST: direct or indirect, and who is the Bank Sponsor? Read the sponsorship agreement against Pasal 13 ayat (1), especially the allocation of administrative sanctions.
3. Where are the data centre and DRC, what tier, and when was the last DRP test? Bundle 2 owes tier II and one test a year. If your risk appetite demands more, that's a contract clause, not an assumption.
4. Does the agreement carry the ten clauses of Pasal 58 ayat (3) and OJK examination access? If any component sits outside Indonesia, get the foreign supervisor's no-objection letter under POJK 11/2022 Pasal 36 ayat (1) huruf f now, not during an examination.
5. Who starts the one-hour clock to BI, and how are we told? The notification chain from vendor to your incident team has to be faster than the tightest deadline, not equal to it.

How the connection gets built — host-to-host, SNAP Open API, and where implementations break — is covered in the integration article, and the vendor mapping by licence tier in payment gateways ranked by BI licence. If it's the integration layer you're designing, our cloud native application development and e-commerce development practices are the entry point.

Method note: every quotation is taken from the full-text PDFs published by Bank Indonesia, OJK and peraturan.bpk.go.id, and every word-occurrence count was run over the complete text of the document named. The licence register counts come from paging through BI's official register on 1 September 2026. Written with AI assistance, with every figure and article number verified against the issuing body.