Blog Payment Systems
Bank Indonesia's Payment ID Starts: What Banks Must Prepare
On this page· 7 sections
Bank Indonesia’s Payment ID went live on November 9, 2026, at 14 payment system service providers (PSPs). It is the first piece of the Payment System Data Infrastructure (Infrastruktur Data Sistem Pembayaran, or IDSP), which the central bank is building to help banks and fintech firms detect payment fraud.
The legal basis is Bank Indonesia Regulation No. 10 of 2026, Peraturan Bank Indonesia Nomor 10 Tahun 2026 tentang Pengaturan Data Sistem Pembayaran (on payment system data), which took effect on October 29, 2026. The regulation covers how payment data is classified, processed and exchanged, how providers manage fraud, and how IDSP operates.
The regulation and the first IDSP phase
According to Bank Indonesia’s FAQ on the regulation, the first phase applies to PSPs the central bank designated as first movers. There are 14 of them, and the phase covers two things: creating Payment IDs and building a database on payment transaction integrity. The FAQ does not name the 14 providers.
The next stage, which Bank Indonesia calls the full-fledged rollout, is scheduled for January 5, 2027. Timing for providers outside the first group will be set later, and technical details will follow in a Board of Governors Member Regulation (PADG).
Bank Indonesia outlined the plan two days after the first phase began. Ryan Rizaldy, head of the central bank’s Payment System Policy Department, spoke at the launch of National Fintech Month 2026 in Jakarta on November 11, 2026. According to Liputan6, he said IDSP would be introduced in stages from November 2026 through 2028 so that the industry and the public have time to adjust.
Rizaldy said fraud data is currently scattered across institutions and that banks and developers need a single point where they can share it. IDX Channel reported that the initial focus of IDSP is stronger fraud detection and better use of transaction data.
The volume of payments explains the urgency. Bank Indonesia recorded growth in digital economic and financial transactions from 8 billion in 2020 to 63.8 billion in 2026, and it projects 266.1 billion by 2032. Rizaldy added that IDSP on its own will not solve every digital crime risk.
Three IDSP services and how they work
IDSP has three core services. Each has a different job, and all of them run in the background, so customers do not deal with the system directly.
Payment ID
Payment ID is a unique identifier for every payment service user, whether an individual or a business. For individuals it is derived from the national identity number (NIK). For businesses it is based on the taxpayer number (NPWP).
In principle, each person has one Payment ID. Bank accounts and e-wallet accounts registered under the same NIK are linked to it, even when they sit with different providers. Payment ID is separate from account numbers, NIK and NPWP, and it cannot be used as a password, a PIN or a way to make payments.
Customers do not need to apply to Bank Indonesia. The ID is created through providers already connected to IDSP, and the central bank says it does not change how people transfer money or pay day to day.
Payment Clear
Payment Clear identifies and measures transaction integrity based on Payment ID. Providers must submit data on users they have determined committed fraud. That data forms a shared database inside IDSP, and connected providers must not process transactions for users listed there as fraud perpetrators.
Bank Indonesia defines four types of payment fraud, including unauthorized transactions and manipulation of payers into sending money. Examples include mule accounts, card skimming and social engineering that leads victims to push payments themselves. The central bank says the service is an administrative measure and does not limit the powers of law enforcement.
Payment Info
Payment Info handles the exchange of payment data between parties with access rights. Over time it could supply payment histories that help lenders assess creditworthiness. We covered the idea of using transaction data for lending decisions in our piece on QRIS data as a credit scoring reference for small businesses, written while this regulation was still being drafted.
Payment holds and limits on data use
The rule customers will notice most concerns transactions flagged for possible fraud. Providers must check the integrity of those transactions. During the check, a provider may delay crediting the funds, or stop all transactions to and from the recipient’s account, except for debits of fees the account holder owes.
The hold can last up to 5 business days from the date of the check. The provider must notify the customer in writing, by letter or electronically, at least once. On the fifth business day, the transaction proceeds if the user has not been found to have committed fraud, and it is stopped if fraud is confirmed.
Customers whose transactions are stopped are entitled to know why, what they can do next, and which provider made the fraud determination. Objections go to that provider with supporting documents and are handled under consumer protection rules. Further details will be set out in the PADG.
On privacy, Bank Indonesia says Payment ID is not meant to monitor people’s transactions. The regulation references Indonesia’s personal data protection law, Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi. Data classified as private can only be exchanged with the user’s consent, and connected providers cannot automatically see all customer data. Access depends on data classification, access rights, processing purpose and legal basis.
Data subjects also have four rights: to know who is requesting their data and why, to withdraw consent, to object to fully automated decisions with significant effects, and to sue and receive compensation for violations.
What this means for banks and fintech companies
The regulation sets clear deadlines. Providers must submit a fraud management policy to Bank Indonesia within one year of the rule taking effect. For the 14 first movers, the deadline is three months. Providers must also submit a data processing impact assessment within one year. For banks, rural banks, e-money issuers and other financial services providers, several tasks can start now.
- Write a complete fraud policy. Bank Indonesia expects it to cover prevention, detection, investigation and reporting, monitoring and evaluation, and education. Map past cases to the central bank’s four fraud types.
- Clean up customer identity data. Payment ID is built from NIK and NPWP. Accounts with mistyped, duplicate or missing NIKs will be hard to link. Early checks for duplicates and formatting errors are a good fit for data analytics.
- Complete the impact assessment. At a minimum it must describe the processing, its necessity and purpose, the risks, and the mitigation steps.
- Design the hold flow in your app. Product teams need written notifications, a visible status for held transactions, and an objection channel customers can find easily. The 5-business-day limit should be tracked automatically.
- Train customer service. Customers whose funds are held will call the contact center first. Agents need a script that explains the reason, the time limit and how to object.
This work also fits the security climate in the sector this month. Indonesia’s financial regulator OJK recently asked banks to stay on 24-hour alert against a wave of cyberattacks, so a new fraud policy should connect to existing incident response plans.
Frequently asked questions
Do I need to register to get a Payment ID?
No. According to Bank Indonesia, the ID is created through the bank or fintech provider where you hold an account, once that provider is connected to IDSP. The way you transfer and pay stays the same.
Can someone else use my Payment ID to make payments?
Bank Indonesia says Payment ID is not an authentication tool like a password or PIN and cannot be used to make payments. It links your account data across providers for risk management.
What can I do if my transaction is held?
The provider must notify you in writing, and the hold lasts no more than 5 business days. If the transaction is ultimately stopped, you can file an objection with the provider that made the decision, along with supporting documents.
Closing thoughts
Payment ID connects fraud data that until now has been kept separately by each bank and fintech company. Its success will depend on the quality of identity data, how carefully providers make fraud determinations, and how clear the objection process is for customers. If your team is preparing a fraud policy or redesigning transaction flows in your app, Merakit’s financial services team can help map out what is needed.
Sources
- Bank Indonesia Regulation No. 10 of 2026 on Payment System Data, Bank Indonesia, in force October 29, 2026
- Frequently Asked Questions on Regulation No. 10 of 2026 (PDF), Bank Indonesia, accessed November 13, 2026
- BI Punya Senjata Baru Perangi Fraud, Berlaku November 2026, Liputan6, November 11, 2026
- Hadapi Ancaman Siber, BI Siapkan Infrastruktur Sistem Pembayaran Baru, IDX Channel, November 11, 2026
