Accepting payments in Indonesia and Thailand. 6 chapters and a final quiz.

Chapter 1. Scoping market entry: two markets, two pricing models.

An Indonesian or Thai payments project starts with a structural decision, not an API choice. The two markets look alike from a distance, but they diverge as soon as you look at pricing. Bank Indonesia publishes an acceptance fee schedule and imposes it on the entire chain. The Bank of Thailand capped the price of PromptPay transfers, and since 2018 most banks no longer charge for them (Bank of Thailand). That difference shapes your margin model, your choice of provider, and your timeline.

Decide how you will be present in the market before you pick a provider, because the three possible setups do not unlock the same payment methods. In the first, you collect from abroad through a local aggregator. In the second, you set up a local entity. In the third, you sell through a marketplace that collects payments for you. Each comes with a different lead time, tax treatment, and regulatory exposure.

• *Which issuing banks are covered for virtual account payments?* In Indonesia, coverage drives the conversion rate. A buyer whose bank is not covered abandons the purchase.
• Is the QR code dynamic? A static code collects payment but cannot be reconciled. Make it a contractual requirement and verify it during acceptance testing.
• Which settlement file, at what level of detail? One line per transaction with your order reference, or nothing. A daily total cannot be reconciled.
• In what currency does the payout arrive, and within what contractual time frame? IDR, THB, USD, or euro: the rate applied and its date are a cost item in their own right.
• What exactly is the provider’s regulatory status? License number, authority, category. An unlicensed intermediary holding your funds is a counterparty risk, not a supplier.
• What happens with refunds? These rails have no chargebacks. A refund is an outbound transaction with its own fees and its own timing.

Chapter 2. QRIS and PromptPay: two QR codes, two economic models.

The two standards share the same technical grammar, EMVCo’s merchant-presented mode encoded in TLV, so a developer can move from one to the other without relearning anything. The trap lies elsewhere. What differs is who sets the price, and what you have to register to get it. In Indonesia, your merchant category sets your rate. In Thailand, no such category exists, and the price comes out of a negotiation with the acquirer.

In Indonesia, the category recorded at onboarding decides everything. It separates micro businesses from organized retail, and the rate gap ranges from zero to 0.7 percentage points. Reclassification is generally not retroactive, so a misclassified merchant pays the higher rate on its entire history. Check that line before the first settlement, not at the first statement.

QRIS MDR SCHEDULE (Bank Indonesia, “MDR QRIS bagi Merchant” page)

  UMI, transaction <= IDR 500,000 ............. 0.0%
  UMI, transaction >  IDR 500,000 ............. 0.3%
  UKE / UME / UBE ............................. 0.7%
  Education ................................... 0.6%
  Gas stations (SPBU) ......................... 0.4%
  Public services, G2P, taxes, donations ...... 0.0%

CALCULATION: average order IDR 350,000, 1,000 orders per month

  Monthly volume V = 350,000 x 1,000 = IDR 350,000,000

  UMI class (> IDR 500,000 not reached at this order size):
      order stays below IDR 500,000  ->  0.0%   =          IDR 0

  UKE / UME / UBE class:
      350,000,000 x 0.007                        =  IDR 2,450,000 / month
                                                 = IDR 29,400,000 / year

  ANNUAL GAP BETWEEN THE TWO CLASSIFICATIONS ... IDR 29,400,000

WHAT THIS CALCULATION TELLS YOU
  · merchant category matters more than the choice of provider
  · it is set at onboarding, based on documents, and is hard to correct
  · an order above IDR 500,000 moves a UMI merchant
    from 0.0% to 0.3%: the threshold is PER TRANSACTION, not per month
  · this cost cannot be passed on to the customer: Bank Indonesia prohibits it

In Thailand, the logic is reversed. The Bank of Thailand has not published a merchant fee schedule, but it has made retail transfers virtually free. The official price cap is modest. Transfers up to THB 5,000 are free, then cost less than THB 2 up to THB 30,000, less than THB 5 up to THB 100,000, and less than THB 10 above that (Bank of Thailand). Since 2018, most banks no longer charge for digital transactions, and that zero floor sets the price of everything else.

• PromptPay is addressed by alias, never by account number. A mobile number, national ID number, corporate tax ID, or e-wallet ID.
• The merchant alias must show the name the customer knows. The payer’s app displays it before confirmation. A mismatch between the legal name and the trading name causes abandonment on the last screen.
• A mobile number can be linked to only one account (Bank of Thailand). A national ID number can be linked to several. This rule determines how you register multiple entities.
• Free P2P does not mean free P2M. Merchant acceptance is contracted with an acquirer, which charges for its service. Ask for the fee schedule in writing; it does not appear in any regulation.
• The rail settles in baht, on the BAHTNET calendar. The payment is final for the payer the moment the code is scanned. Funds reach you on the RTGS schedule, in business days.

BEFORE THE FIRST LIVE PAYMENT

  [ ] initiation mode = DYNAMIC (single-use code), verified
      on a real payload, not on a sales promise
  [ ] order reference present in the payload AND returned
      in the credit notification AND present in the settlement file
  [ ] code lifetime set server-side, and code invalidated
      on the first credit notification
  [ ] second credit with the same reference: REJECTED, logged, alerted
  [ ] merchant name displayed matches the trading name the customer knows
  [ ] amount above the rail limit rejected with a clear message
      + switch to the fallback channel, without re-entering the cart

INDONESIA, ALSO

  [ ] merchant category (UMI / UKE / UME / UBE) confirmed in writing
  [ ] MDR applied matches the Bank Indonesia schedule
  [ ] no surcharge charged to the customer, including by the provider
  [ ] IDR 10,000,000 limit handled in the checkout flow

THAILAND, ALSO

  [ ] PromptPay alias registered under the trading name the customer knows
  [ ] merchant acceptance fee schedule obtained IN WRITING from the acquirer
  [ ] settlement value date aligned with the BAHTNET calendar

Chapter 3. The bank channel: virtual accounts, manual transfers, and BI-FAST.

In Indonesia, bank payments almost never take the form of a free-form transfer. They take the form of a virtual account: a unique account reference, generated for each order, which the buyer pays from a banking app or an ATM. The reference is the order. Reconciliation becomes exact with no human intervention, and this setup solves the problem that static QR codes leave untouched.

Manual bank transfers persist alongside it, especially among small sellers. The buyer sends money to a displayed account, then uploads a screenshot of the confirmation, and the seller releases the order on that basis. This practice is the most exploited entry point for e-commerce fraud in Indonesia and Thailand. A screenshot can be faked in seconds.

• The virtual account, whenever possible. The bank allocates the reference, it is unique to the order, and it comes back in the notification. Nothing to guess.
• A fixed amount rather than an open one. An amount the payer can change opens the door to partial payments, and every partial payment becomes a line to handle by hand.
• A unique amount as a fallback. On a free-form transfer, adding an order-specific suffix of a few units to the total creates a reconciliation key. The technique works, but it does not replace a reference: two simultaneous orders can end up with the same suffix if the generator does not lock it.
• A short, displayed validity period. A reference left open indefinitely produces orphan credits that arrive after the order has been canceled.
• A queue of unreconciled credits, worked daily. It will exist. The question is not how to avoid it, but who clears it and how quickly.

These markets long lacked recurring payments, because push transfer rails always start with the payer, which rules out subscriptions. Bank Indonesia closed the gap on December 21, 2024, by adding direct debit and request to pay to BI-FAST. Each is capped at IDR 2,500 charged to the customer, the same cap that already applies to a standard transfer. Nine participants have launched the service.

Chapter 4. GoPay, OVO, DANA: connecting wallets without multiplying integrations.

The costliest mistake is treating Indonesian wallets as four separate integrations. In person, QRIS has settled the question: all four pay the same code. So the useful question is a different one. It concerns the QRIS acquirer that routes your payments, its fee schedule, and the level of detail in its settlement file. Online, the logic differs: each wallet keeps its own flow, its own redirect, and its own conversion rate.

A wallet’s online flow always follows the same pattern, and it always breaks at the same point. Your server creates the order, the customer switches to the wallet app and authorizes, then is redirected to your page. That return is not the payment. It does not always happen, it can be forged, and it sometimes arrives before the actual confirmation.

Buy now, pay later arrives through the same apps, but it answers to a different regulator. Kredivo makes lending decisions in real time and is distributed through the major marketplaces. Akulaku claims 33 million customers and more than 90,000 listed sellers (Akulaku, official website, 2026). These products are credit, supervised by the OJK, not payment services under Bank Indonesia. The distinction determines the applicable regime, the disclosure obligations, and how missed payments are handled.

Chapter 5. Cash on delivery: managing the return loop.

Cash on delivery runs on a logistics chain. The carrier collects payment on your behalf, and it sends some of your parcels back. The visible cost is the carrier’s commission. The real cost lies in the return loop. A refused parcel travels twice, comes back damaged or late, and has collected nothing. Either you manage that loop with metrics, or it eats your margin.

Two clocks run in parallel, and mixing up their timing distorts your entire cash position. The cash clock runs from delivery to the bank credit. The stock clock runs from shipment to the item going back on sale. A 10-point refusal rate therefore ties up both inventory and working capital. Measure the two separately.

TRACK MONTHLY, BY MARKET AND BY CARRIER

  1  Refusal rate at the door
       parcels refused / parcels presented        measured BY YOUR SYSTEMS,
                                                  never self-reported by the
                                                  carrier

  2  Average attempts per delivered parcel        every attempt is billed

  3  Cash remittance lead time (days)             contractual, then ACTUAL;
                                                  the gap between the two is
                                                  free financing you are
                                                  giving away

  4  Cash held on your behalf                     to be capped in the contract,
       at any given time                          with a guarantee mechanism

  5  Time to return to sellable stock             from shipment back to
                                                  available-to-sell

  6  Share of returns marked down or lost         as % of returned value

  7  Conversion rate to a prepaid rail            share of orders switched
                                                  to QRIS, virtual account, or
                                                  PromptPay, month by month

HOW TO READ IT
  Metrics 1, 5, and 6 measure LOST MARGIN.
  Metrics 3 and 4 measure RISK AND FINANCING.
  Metric 7 is the only one that measures your progress.

• A remittance file itemized by order. An aggregated remittance cannot be reconciled. You negotiate this point with logistics, not payments.
• A written remittance deadline, with a penalty. Until it is in the contract, it floats, and it finances the carrier with your money.
• A cap on the cash held on your behalf, with a matching guarantee. The carrier is not a supervised payment institution.
• Rules for refusals. Who pays for the return, how quickly the product becomes sellable again, and at what refusal rate the price gets renegotiated.
• The number of attempts included. A second and third delivery attempt raise the delivery rate, and the bill. Make the trade-off on data, zone by zone.

Chapter 6. The right to collect payments: GPN and licensing by Bank Indonesia and the Bank of Thailand.

A successful technical integration does not give you the right to collect payments: two checks come before the first live transaction. The first concerns routing, since in Indonesia a domestic card transaction must stay in the country. The second concerns you. Do you hold funds on behalf of a third party at any point? The answer determines your licensing regime, and the question comes up before the letter of intent.

The Gerbang Pembayaran Nasional (National Payment Gateway) is the compliance point that international overviews overlook. It was established by PBI No. 19/8/PBI/2017 and PADG No. 19/10/PADG/2017, then launched on December 4, 2017. It requires domestic card transactions to be routed through one of four licensed switches: Artajasa, Rintis, Alto, and Jalin. An Indonesian card used at an Indonesian merchant no longer leaves the country. The domestic debit MDR is capped at 0.15% on-us and 1% off-us, and at 0% on payments to the government. This is the cheapest acceptance channel in the market, but it does not cover foreign cardholders.

• The license number of every counterparty, its authority, and its category. An unlicensed intermediary holding your funds is a risk, not a supplier.
• Proof of domestic routing for Indonesian cards: which licensed switch, which acquirer, and since when.
• Read the SNAP specifications before the provider’s documentation. Doing it the other way around means rewriting the integration.
• Credit kept separate in an OJK-licensed entity, never stacked inside the PJP.
• The actual review timeline, with milestones. In Thailand, the 60-business-day clock only starts once the application is complete and verified.