A gambling deposit can pass through an ordinary Indonesian bank account, e-wallet or QRIS merchant code. The payment may succeed even though gambling is prohibited in Indonesia. What matters is who receives the money, where it goes next and whether the bank or payment provider identifies misuse. A working payment channel is not proof that the recipient operates legally.
Legal payment systems can carry unlawful transactions
Indonesia’s financial ecosystem includes commercial banks, digital banking applications, electronic-money issuers, payment service providers (Penyedia Jasa Pembayaran or PJP), merchant acquirers and payment aggregators. Transfers and QR payments move value between accounts or wallets; they do not independently certify that the purchase or activity behind the payment is lawful. The risk emerges when a gambling operator or intermediary obtains access to accounts or merchant acceptance intended for legitimate commerce.
Online-gambling payment figures in Indonesia
PPATK’s national turnover and deposit totals are summarized in the crackdown results timeline. This article focuses on what its channel-level data can tell banks and payment providers; turnover, deposits and transaction counts describe different measures and should not be treated as interchangeable.
PPATK’s 2025 breakdown attributed approximately Rp19.35 trillion of deposits to QRIS and Rp16.67 trillion to bank and e-wallet channels combined. Its January–June 2026 analysis recorded Rp22.05 trillion in deposits across 226.76 million transactions, including Rp12.36 trillion through QRIS (56.04% by value) and Rp9.69 trillion through bank accounts and e-wallets. QRIS represented 87.66% of identified deposit transaction count in that six-month period. These figures describe detected activity, not the entire population of illicit payments, and changes in detection can influence comparisons.
Repeated small QR payments can be suspicious, but transaction frequency alone cannot distinguish gambling collections from a busy legitimate merchant.
How bank transfers, QRIS and e-wallets differ
Bank transfers and virtual accounts
A bank transfer moves money between deposit accounts, sometimes through mobile banking or interbank infrastructure such as BI-FAST. A virtual account is an account-identification or collection arrangement used by businesses to reconcile incoming payments. Neither is a gambling-specific product. Where criminals control the beneficiary or collection arrangement, transfers may be used to gather deposits before funds are redistributed. The relevant checks are beneficiary identity, purpose, account activity and downstream flows—not the mere presence of a transfer reference.
QRIS merchant payments
Quick Response Code Indonesian Standard (QRIS) is Indonesia’s standardised QR-payment framework under Bank Indonesia. It enables interoperable payments across participating applications and providers. PPATK explicitly cautions against treating QRIS itself as problematic: the abuse concerns merchant identity, onboarding and transaction purpose. A QRIS transaction may involve a merchant presented as a normal seller while the actual economic activity is different. That creates a merchant-verification problem as much as a payments-technology problem.
E-wallets and electronic money
E-wallet providers check customers and transaction patterns, but they may see only one part of a payment chain. A linked bank may hold other records. Tracing the full flow can require lawful cooperation between institutions.
Payment aggregators and gateways
Payment gateways and aggregators let merchants accept several payment methods. Weak onboarding can leave the real merchant or settlement beneficiary unclear. Providers need to verify who is selling what, where receipts settle and whether the business changes after approval.
What happens after a gambling deposit?
A deposit may reach a merchant settlement account, then move again. Investigators trace the initial collection and later transfers, including possible layering that conceals the beneficiary. Several transfers alone do not establish money laundering.
PPATK has described tracing not just deposit destinations but also depositors, transaction values, frequency and onward flows. It has also discussed account trading and the use of cryptocurrency in parts of the broader transaction chain. Such findings justify looking beyond a single payment screenshot, but they do not imply that all crypto transfers, dormant accounts or payment aggregators are connected to gambling.
Who regulates which part of the system?
| Institution | Primary role | Why it matters for gambling-related payments |
|---|---|---|
| Bank Indonesia (BI) | Payment-system policy and oversight | QRIS, BI-FAST, SNAP and payment-system risk management |
| Otoritas Jasa Keuangan (OJK) | Financial-services supervision, including banks | Bank governance, customer due diligence and supervisory instructions |
| PPATK | Financial intelligence and analysis | Suspicious-transaction analysis, tracing and information sharing |
| Ministry of Communication and Digital Affairs (Komdigi) | Digital-space governance and coordination | Information about suspected online-gambling services and accounts |
| Police and other competent authorities | Investigation and enforcement | Criminal investigations and actions under applicable law |
PPATK supplies financial intelligence; courts determine criminal liability. Banks restrict accounts under their own compliance duties or lawful instructions. Bank Indonesia oversees QRIS as a payment standard, not as a gambling service.
Why an account may be blocked or reviewed
OJK has described bank-account measures based on information from Komdigi, including enhanced due diligence and possible restrictions. EDD is a review; a freeze is a separate action, and neither amounts to a criminal finding. The crackdown timeline lists the dates and counts for each measure.
Banks can apply Know Your Customer (KYC), customer due diligence (CDD), EDD and anti-money-laundering/counter-terrorist-financing (AML/CFT) controls. Depending on the circumstances and legal basis, a provider may request supporting documents, investigate a transaction, temporarily restrict services, close an account or act on a lawful order. The precise process depends on the institution, the account and the authority involved.
What if a legitimate customer’s account is restricted?
First, verify the restriction through the bank’s official app, branch or customer-service channel rather than a link sent by an unknown party. Ask whether the issue concerns identity verification, a compliance review, a transaction dispute or an instruction from an authority. Keep the account number, relevant transaction dates, receipts and any case reference available. Submit accurate documents through the bank’s approved process and request the available complaint or escalation procedure. Do not pay a third party who promises to “unlock” a bank account, and do not transfer funds to an unknown account to resolve the restriction.
How banks and payment providers can detect misuse without penalising ordinary merchants
Banks can compare the registered merchant and beneficial owner with actual sales, payment times, counterparties, settlement accounts and changes in normal turnover. Lawfully collected device or account-linkage data may add context. One small payment, or a merchant label on a QR code, proves little.
Bank Indonesia has researched AI and machine-learning methods for detecting illegal payment patterns. A model can flag linked accounts or unusual flows, but people still need to validate the findings. Flag counts alone are a poor success measure if legitimate merchants lose access.
A practical control sequence
- Verify the participant: confirm the real merchant, account owner, beneficial owner and legitimate business purpose.
- Understand the payment flow: distinguish customer funding, merchant acceptance, settlement and subsequent transfers.
- Compare behaviour with context: assess frequency, value, timing and counterparty relationships against the customer’s normal activity.
- Escalate proportionately: review suspicious patterns, apply EDD where warranted and follow reporting or restriction requirements.
- Record and revisit decisions: retain evidence, provide appropriate complaint routes and monitor false positives.
Check the recipient behind a familiar payment app
The app name is not the recipient. A checkout screen may show a merchant or intermediary unrelated to the advertised casino. Keep the payment confirmation: it records the transfer, but does not create a right to withdraw, obtain a refund or receive legal protection.
Another risk is allowing someone else to use a personal bank account, wallet, SIM-linked identity or NIK for collections. Account renting, nominee arrangements and account trading can expose the registered owner to compliance scrutiny and potential legal consequences. Anyone asked to receive and forward money for an unfamiliar “online business” should verify the business and refuse arrangements that obscure the real beneficiary.
What should businesses and customers verify?
| Situation | Check | Safer response |
|---|---|---|
| A website asks for a QRIS or wallet deposit to gamble | Legal status of the underlying activity, not just the payment brand | Do not assume the payment method makes the activity lawful |
| A merchant receives an unexpected surge of small payments | Actual goods/services, payer patterns and settlement records | Contact the acquiring provider and preserve records |
| A person offers payment to borrow your account | Who owns the funds and who benefits | Decline account lending and report suspected misuse |
| A bank freezes access or requests EDD | Official reason, documentation request and complaint process | Respond through verified bank channels |
| A payment provider onboards a new merchant | Identity, beneficial ownership and actual business model | Apply risk-based due diligence and ongoing monitoring |
Payment monitoring as Indonesia’s digital network expands
Blueprint Sistem Pembayaran Indonesia (BSPI), SNAP, QRIS and BI-FAST support a more connected payment network. Banks, e-money providers, acquirers and aggregators still need controls that catch illicit collection without slowing legitimate purchases.
Changes in payment-channel shares may reflect displacement rather than a reduction in gambling. Useful measures include verified illicit receipts, accuracy of beneficiary identification and wrongful account restrictions.
Frequently asked questions
Does a QRIS payment mean a gambling website is approved by Bank Indonesia?
No. QRIS standardises payment acceptance. It is not a certification of a merchant’s products, business model or legal entitlement to offer gambling.
Can banks identify gambling transactions?
Banks and other reporting institutions can detect suspicious patterns using account information, transaction records and risk indicators, while PPATK can analyse reported financial intelligence. Detection is probabilistic and should be supported by review and evidence.
Can a bank block an account suspected of gambling activity?
Accounts may be reviewed, restricted or blocked under applicable legal and supervisory processes. OJK has publicly directed banks to conduct EDD and take action on identified accounts. The specific remedy for an affected customer depends on the reason and legal basis for the restriction.
Are e-wallets and BI-FAST themselves illegal?
No. They are legitimate parts of Indonesia’s financial and payment infrastructure. Misuse by an individual or merchant does not make the underlying payment system unlawful.
What is the difference between gambling turnover and deposits?
Deposits measure funds paid into gambling activity. Turnover is a broader flow measure and may count multiple movements of money. Comparing the two as though they were the same measure is misleading.