If your business sells online in Indonesia, the customer at checkout might scan a QRIS code, pay through a digital wallet, transfer funds through a bank, or use a card. Those are different payment journeys, but they all end with the same question: Can your payment infrastructure turn an intent to buy into a completed transaction?
That makes choosing a payment gateway in Indonesia more than an integration decision. It affects which customers you can serve, how reliably their payments go through and how much work your team takes on when you add new payment methods or enter another market.
Here are six criteria to consider when selecting a payment gateway in Indonesia:
1. Coverage of the payment methods Indonesians actually use
Coverage determines how many of your customers can actually complete a purchase.
Indonesia has a broad payment ecosystem spanning QR payments, bank transfers, digital wallets, cards and alternative payment methods. For businesses, the important question is not how many payment methods a provider supports on paper, but whether it supports the methods your customers actually choose.
Bank Indonesia’s latest published figures show just how quickly digital payments are growing. In the first quarter of 2026, digital payment transaction volume reached 14.82 billion, and was still growing 37.69% year on year. QRIS transaction volume grew 116.43%, while BI-FAST processed 1.4 billion retail transactions, up 30.82%.
QRIS is particularly important to the Indonesian market. Bank Indonesia defines QRIS as Indonesia’s national QR payment standard, allowing participating payment applications to make payments through a common QR infrastructure rather than requiring businesses to support a separate QR standard for every provider.
As cross-border payments grow, QRIS has also become an increasingly important part of the corresponding infrastructure. Bank Indonesia currently lists QRIS cross-border linkages with Thailand, Malaysia, Singapore and Japan, allowing eligible Indonesian users to make QR payments at participating merchants in those markets and international visitors to scan QRIS codes and pay with their home market’s system at participating Indonesian merchants.
Bank transfers remain another crucial payment method. BI-FAST enables real-time retail payments, and its transaction volumes continue to grow rapidly. Digital wallets such as GoPay, DANA, OVO, LinkAja and ShopeePay also form part of the wider payment ecosystem.
For some merchants, cards remain important, particularly for higher-value transactions and for catering to international customers. BNPL and other alternative payment methods may also matter depending on your customer profile, average order value, and industry.
If you are choosing a payment gateway for ecommerce, the right payment method mix will depend on your customers rather than on a generic list of popular methods.
What this means for merchants:
Start from your own customer and transaction data rather than market averages. Segment it by order value, customer type and whether the purchase is one-off or recurring. Those splits are usually where a payment method gap becomes visible.
Ask each provider to show coverage against that map rather than giving you a generic list or count of available payment methods. In Indonesia, that often means looking beyond cards to QRIS, bank transfers, digital wallets, BNPL and any alternative or offline methods relevant to your customers.
Our guide to popular payment methods in Indonesia breaks down the country’s payment landscape method by method.
It is also worth asking what is on the provider’s roadmap for the next twelve months. Check if the payment methods of interest to your business are in their plans; otherwise, you may be looking at months of integration work before enabling those payment methods can even be an option.
2. Regulatory standing under Bank Indonesia’s payment-system framework
Payment service providers operating in Indonesia are subject to Bank Indonesia’s payment-system framework. Bank Indonesia’s current framework covers payment-system providers, including Payment Service Providers (Penyedia Jasa Pembayaran or PJP), Payment Infrastructure Providers and other supporting parties.
The regulatory framework was updated through Bank Indonesia Regulation No. 10 of 2025 on the Payment System Industry, which came into force on 31 March 2026. The regulation covers areas including payment-system activities, products, pricing, industry structure, infrastructure, governance, risk management, market conduct and data.
Bank Indonesia also specifically identifies payment gateway providers as payment-system service providers that require licensing.
Before the commercial conversation, these four checks can help clarify what you need:
- Verify the provider’s current regulatory status and relevant payment-system authorisations through Bank Indonesia’s official licensing and payment-system resources
- Confirm which regulated payment activities the provider is authorised to perform
- Understand how merchant funds are handled and safeguarded
- Clarify settlement arrangements and any third-party acquiring relationships
It is also worth asking whether the provider acquires directly or works through third-party acquiring, since that can affect settlement timelines and where accountability sits when something goes wrong.
What this means for merchants:
Regulatory verification helps confirm a provider’s status and the activities it is authorised to perform. What matters commercially is scope, so check the provider’s relevant authorisations against your expansion plan on top of your current operations.
Ask upfront how the provider would support you once you sell into other markets such as Malaysia or Thailand. Providers structure regional operations differently, and that arrangement can affect the relationships and settlement processes your team manages later.
3. Integration model and operational fit
The integration model determines how much work your own team carries, both at launch and afterwards.
The choice between a hosted payment page and a direct API integration is a genuine trade-off. A hosted payment page can be launched faster and may reduce the amount of payment-security work your team needs to manage, although you have less control over the checkout experience.
A direct integration gives you more control over the customer journey, but it also places more technical and security responsibility on your team.
Our guide to optimising the online checkout process covers this in more detail. Which approach suits you depends on your engineering capacity and how much of the checkout experience you need to own.
Operational fit also includes how well a provider can support your expansion across payment methods and markets.
TransNusa Airlines, an Indonesian airline serving international routes across Southeast Asia and Asia-Pacific, needed to support customers paying in different currencies and through different local payment methods as it expanded beyond Indonesia. 2C2P’s payment gateway enabled TransNusa to accept local and international cards, digital wallets and bank transfers through Indonesia’s QRIS system, alongside alternative payment methods such as direct debit, over-the-counter and kiosk payments. In Malaysia, the airline could also accept local and international cards, digital wallets and bank transfers, giving it a more consistent payment infrastructure across both markets.
“2C2P has significantly enhanced TransNusa’s airline payment systems. Apart from offering competitive pricing in the Southeast Asian region, 2C2P has also been prompt in providing support and escalation, and on top of this, they abide by the most current security standards. We also had the pleasure of a seamless onboarding process with them!”
Dato Bernard Francis, Aviation Group CEO, TransNusa
Before anything goes live, a provider assesses your business and sets up your account. How long that takes can determine whether you hit a target launch date.
Ask for the expected onboarding and risk review timeline early, since it shapes everything that follows.
Operational questions that often surface later include:
- Settlement timelines, and in which currencies
- Refund and chargeback handling, and through what interface
- Reconciliation reporting available as standard
What this means for merchants:
Shortlist based on reach and security, then decide based on operational capabilities. Operations is where the relationship actually lives.
Before you commit, get clear answers to a few questions:
- Who owns the integration work on the provider’s side, and does that support continue after go-live?
- How long do onboarding and risk review take?
- What reconciliation output do you receive, in what format, and does it map to your finance system without manual work?
- Which Indonesian payment methods are supported, and do settlement timelines differ between cards, wallets, QRIS and bank transfers?
The quality of the provider’s operational support will matter long after integration is complete.
4. Security and compliance credentials
Security claims can run broad, so make sure to dig into the evidence behind those claims.
The baseline is PCI DSS, and the current active standard is v4.0.1. Version 4.0 was retired on 31 December 2024. Ask which version a provider is certified against, at what level and by which qualified assessor. A Level 1 Service Provider assessment is the most rigorous tier.
Beyond PCI DSS, request PCI 3DS, ISO/IEC 27001, ISO/IEC 27701 and SOC 2 Type 2. 2C2P holds all of these, and the certificates can be accessed from our security page.
Then there is authentication. EMV 3D Secure can strengthen cardholder authentication and may affect liability treatment under applicable card-scheme rules.
The mechanism that matters commercially is risk-based authentication. It allows lower-risk transactions to proceed through a frictionless flow while challenging transactions that warrant additional verification. Ask how a provider determines which transactions to challenge, because a setup that challenges everything can add friction for genuine customers as well as reducing some fraud.
Tokenisation is another security control worth asking about. Replacing card details with tokens reduces the exposure and usefulness of compromised card data. Network tokenisation can also keep stored credentials current when a card is reissued, which can protect subscription and repeat-purchase revenue.
What this means for merchants:
Security credentials are not only a risk question. They are also a cost and conversion question. The integration model you choose determines how much of your own environment falls into PCI scope, which can affect your audit burden over time.
For businesses operating in Indonesia, it is also worth understanding the country’s broader personal data protection requirements. Law No. 27 of 2022 on Personal Data Protection establishes Indonesia’s personal data protection framework, including obligations around the processing and protection of personal data.
Ask where payment-related data is processed and stored, what security controls apply and which party is responsible for relevant compliance obligations.
Authentication settings also determine how many genuine customers face additional friction at checkout. Ask what proportion of transactions pass through the frictionless flow, how tokens are maintained when cards are reissued and which party carries liability under each authentication outcome.
If an answer affects security, compliance or the customer experience, make sure it can be supported by current documentation.
5. Payment success rates and fraud management, not just transaction fees
When evaluating payment service providers, many businesses naturally focus on the Merchant Discount Rate (MDR) because it is the easiest figure to compare. Pricing matters, though, it is only one part of the equation.
A provider’s ability to help genuine customer payments go through successfully can also have a large impact on revenue.
If your business processes Rp150 billion in card payments, reducing the MDR by 0.10% saves around Rp150 million. At the same time, if more genuine customer payments are approved instead of being mistakenly declined, the sales generated can match or outweigh those savings.
Approval outcomes depend on many factors beyond any single provider’s control. A capable provider should nevertheless give you the tools and visibility to pursue both competitive pricing and strong payment performance.
The sensible approach is to weigh price and payment success rates together rather than prioritising one over the other.
Ask how the provider can help you maximise successful payments while keeping fraud under control. Reputable providers may offer features such as customer authentication, fraud screening and transaction monitoring. These should protect the business without making genuine customers work unnecessarily hard to complete a purchase.
Some providers also offer more advanced fraud management solutions. For example, through 2C2P, eligible merchants can use Visa Cybersource Decision Manager, which analyses transactions in real time to identify suspicious activity while allowing genuine customers complete payments with minimal disruption.
Ultimately, effective fraud management is not about blocking more transactions. It is about making smarter decisions. The goal is to stop fraudulent payments while minimising friction for genuine customers.
What this means for merchants:
When evaluating payment providers, do not base your decision on fees alone. Consider the overall value they bring to the business.
Ask questions such as:
- How do you help increase successful payment approvals?
- What measures do you have in place to protect against fraud without creating unnecessary friction?
- Can you share payment approval rates across different card types or markets?
- How do you support merchants when payment issues or fraud trends arise?
A provider with slightly higher transaction fees may still deliver better overall value if it helps more customers complete their purchases successfully while keeping fraud at manageable levels.
The real cost of accepting payments is not just what you pay in fees. It is also the sales you could lose when genuine customers are unable to complete a transaction.
6. The path into the rest of Southeast Asia
Many companies that choose a payment gateway in Indonesia eventually expand into neighbouring Southeast Asian markets, making regional capability worth assessing from day one.
Payment behaviour varies considerably across the region. Indonesia has a strong mix of QRIS, bank transfers and digital wallets, while Malaysia has DuitNow and other digital payment methods, Thailand has PromptPay and mobile wallets, the Philippines has wallets and domestic real-time payments, and Vietnam has a strong mix of bank payments, QR payments and digital wallets.
A payment gateway that performs well in Indonesia but lacks depth elsewhere can mean a separate integration, contract and reconciliation process for every market you enter.
Currency is another expansion cost. Selling across the region means accepting and settling different currencies while managing foreign-exchange spreads and settlement requirements.
The ability to settle in the currencies you need can help manage foreign exchange costs. Multi-currency pricing can also allow customers to pay in a familiar currency, creating a smoother checkout experience. 2C2P’s multi-currency pricing (MCP) is built for this.
What this means for merchants:
Evaluate the payment gateway against your two-year expansion map, not just your current market.
Assess:
- Which local payment methods the provider supports in each market you intend to enter
- Whether those methods can run through the same integration and commercial relationship
- How settlement works across currencies
- Whether the provider can support local acquiring and payment acceptance requirements
- What entering a new market requires from your team
Ask whether expansion means fresh onboarding, a separate reconciliation process or simply enabling additional methods on an existing setup.
That answer is the real cost of expansion, and it is considerably easier to understand before you sign than after.
A short payment gateway due diligence list
Before signing anything, ask for the following in writing.
- Bank Indonesia regulatory status, relevant payment-system authorisations and local operating structure
- PCI DSS version, level and assessor, plus PCI 3DS, ISO/IEC 27001, ISO/IEC 27701 and SOC 2 Type 2 certificates
- How the provider manages declines, and what fraud, risk and authentication tools contribute to payment success
- The full local method list for Indonesia, including QRIS, bank transfers, digital wallets, cards and relevant alternative payment methods
- Settlement timelines and currencies, refund and chargeback handling, and standard reporting
- Onboarding timeline, including risk review
- Uptime history and support coverage during your trading hours
Where online payments in Indonesia go next
Indonesia’s digital payment infrastructure continues to expand, but the story is increasingly about scale as well as adoption.
According to Bank Indonesia, digital payment transaction volume reached 14.82 billion in Q1 2026, up 37.69% year on year. QRIS transaction volume grew 116.43%, while BI-FAST processed 1.4 billion retail transactions during the quarter. Growth continued in July, when digital payment transaction volume reached 5.50 billion, up 28.69% year on year. QRIS transactions grew 82.42%, while BI-FAST processed 546 million retail transactions.
QRIS is also extending beyond domestic payments. Bank Indonesia currently lists QRIS Cross-Border connectivity with Thailand, Malaysia, Singapore, Japan, South Korea and China. By June 2026, there were 65.77 million QRIS users and 44.86 million merchants, with 96.68% of merchants classified as MSMEs. During the first half of 2026, QRIS recorded 12.55 billion transactions.
For merchants, the implication is straightforward: payment infrastructure is becoming increasingly important to how customers discover, pay and transact across Indonesia and the wider region.
Agentic commerce sits further out, but points in the same direction. As more purchasing decisions are assisted or initiated by software, payment infrastructure will need to establish not only whether a payment method is valid, but whether the transaction is properly authorised.
If you are looking for the best payment gateway in Indonesia, the honest answer is that there is no single name to recommend. It is the provider that fits your payment method mix, regulatory requirements and regional plans, and has the capabilities to keep up with your ambitions.
Take your business further in Southeast Asia
The best payment gateway for your business should work well in Indonesia today while giving you room to expand into markets such as Malaysia, Singapore, Thailand, Vietnam and the Philippines.
2C2P is a full-suite payments platform that helps businesses securely accept payments across online, mobile and offline channels, while also supporting issuing, payouts, remittances and digital goods. With over 400 payment options ranging from credit cards to mobile wallets, 2C2P helps businesses serve customers across Indonesia and the wider region.
Ready to take your business further in Indonesia and across Southeast Asia? Talk to our team today.
Fintech
Indonesia
Knowledge Guide
Payment Gateway
Login
