Indonesia Formalises BNPL: OJK Regulation 32/2025 and South-East Asia's Shift from Growth to Governance

For several years, Buy Now Pay Later was the fastest-growing corner of Indonesia’s consumer-finance market and one of its least formally governed. That ended on 15 December 2025, when the Financial Services Authority (OJK) brought Regulation No. 32 of 2025 on BNPL practices into effect. The regulation does not ban or throttle the product. It does something more consequential: it defines who may offer it, the duties they owe, and the standard of governance expected, turning a growth product into a regulated one. For any lender operating across the region, the direction of travel is the more important signal than the Indonesian detail.

What the regulation does

OJK issued the regulation to address risks arising from the rapid expansion of digital financing. It became effective on its promulgation date of 15 December 2025. The core elements:

• Provider eligibility. BNPL may be offered by commercial banks and by financing (multi-finance) companies. Banks operate under prevailing banking rules; financing companies must obtain OJK approval before offering BNPL services.
• Risk management and prudence. Providers must apply principles of prudence and sound risk management to their BNPL portfolios rather than treating the product as a lightly underwritten add-on.
• Consumer protection. Providers carry clear information-disclosure duties and must comply with OJK’s consumer-protection framework, so customers understand the obligation they are taking on.
• Data protection. Providers must apply personal-data-protection principles in line with Indonesia’s Personal Data Protection Law and related OJK rules.

Reporting around the regulation also indicates borrower-eligibility criteria, including a minimum age of 18 and a minimum monthly income threshold, designed to keep the product away from those least able to absorb it. As analysis from ABNR frames it, this is a move from rapid growth toward institutional maturity.

Crucially, the change is not overnight in operational terms. Banks and finance companies already offering BNPL have a transition period, reported to run to 15 June 2026, to bring their services into line with the new requirements. Existing financing and cooperation agreements signed before 15 December 2025 remain valid, though any amendments must comply with the new regime.

Growth to governance, across the region

The significance of OJK 32/2025 is less about Indonesia in isolation and more about what it signals. South-East Asian regulators broadly tolerated BNPL through its growth phase, watching adoption climb while the product sat outside the perimeter that governs mainstream credit. That posture is now shifting toward governance: bringing BNPL inside the perimeter, with provider eligibility, risk-management duties, consumer protection and data protection attached.

This mirrors a pattern playing out elsewhere in the region and beyond, the recognition that a credit product, however it is marketed, should be regulated as credit once it reaches scale. The practical implication for a regional lender is straightforward: the era of running BNPL on lighter underwriting than the rest of the book is closing. The defensible assumption now is that BNPL will be held to a standard close to mainstream credit, and operations should be built for that standard rather than retrofitted to it later.

What this means for BNPL underwriting

If BNPL is to be governed like credit, it has to be underwritten like credit, but at the speed and volume of a point-of-sale product. That tension is the real operational challenge the regulation surfaces. A few things follow for any provider in scope, or likely to come into scope as similar rules spread:

• Real-time creditworthiness assessment. A prudence-and-risk-management duty is hard to satisfy with a token check at checkout. It implies an actual creditworthiness assessment, made in the moment, against the borrower’s circumstances.
• Consistent risk policy at the point of sale. The same risk logic should apply whether a customer transacts in a store, in an app or through a partner merchant, so the provider can show a coherent policy rather than a patchwork.
• Identity verification. Eligibility criteria such as age and income only mean something if the applicant is verified. Onboarding has to establish who the customer is before extending the line.
• Auditable decisions. A regulated product invites supervision. Each approval and decline should leave a record of the inputs and the reasoning.

The transition period to mid-2026 is the window to put these in place deliberately, rather than scrambling once the grace period closes.

Where Credisense fits

Regulated BNPL is, structurally, a high-volume, low-latency decisioning and onboarding problem: real-time creditworthiness assessment, a consistent risk policy applied at every point of sale, and identity verification at the moment of origination, all captured in a defensible decision trail. That combination is what separates compliant BNPL from the lightly governed model it is replacing. Indonesia has set the marker; the lenders that treat BNPL underwriting with the same rigour as mainstream credit, before the rest of the region follows, will be the ones for whom the next regulation is a configuration exercise rather than a rebuild.