QRIS vs Virtual Accounts for High Risk Deposits in Indonesia

Indonesia is the largest consumer market in Southeast Asia, and it pays online almost entirely through two local rails: QR codes and bank transfers. International cards are a small slice of checkouts, and for a merchant in a higher risk category they are often not an option at all. The real decision is which domestic rail to put first on the payment page: QRIS, the national QR standard run under Bank Indonesia, or virtual accounts, the bank-transfer method Indonesian checkouts have relied on for a decade. This article compares the two for deposits: limits, cost, reconciliation and risk.

What QRIS is

QRIS (Quick Response Code Indonesian Standard) is the single QR format that every Indonesian bank app and licensed e-wallet must support. A customer opens their banking app, DANA, OVO, GoPay or ShopeePay, scans or taps the code, confirms the amount and the money reaches the merchant's acquirer in seconds. No account number is typed, and the wallet choice does not matter because all of them read the same code.

The scale is hard to ignore. Bank Indonesia figures reported by Kontan put 2025 QRIS volume at about 15.5 billion transactions worth roughly Rp1,420 trillion, with close to 60 million users and 43 million merchants registered by January 2026. The per-transaction ceiling set by Bank Indonesia has been Rp20 million since March 2022 (Katadata), although individual banks and wallets apply their own, often lower, limits. BCA, for example, announced that its own QRIS payment limit rose to Rp10 million per transaction from 3 September 2025. For regular merchants the merchant discount rate is 0.3 percent, while micro merchants pay 0 percent on transactions up to Rp500,000 (Bank Indonesia statements reported by CNBC Indonesia).

What a virtual account is

A virtual account (VA) is a temporary or permanent account number issued by a bank on behalf of the merchant. The customer sees a bank name and a long number, transfers the exact amount from their bank app, ATM or e-wallet, and the bank reports the credit with the VA number attached. Every customer gets a unique number, so reconciliation is automatic: the VA tells you who paid.

Indonesians have used VAs for utility bills and e-commerce for years, so the behaviour is familiar. Since Bank Indonesia launched BI-FAST in December 2021, interbank transfers into a VA settle in around 25 seconds, 24 hours a day, with a consumer fee capped at Rp2,500 and an initial per-transaction limit of Rp250 million (DailySocial, reporting the launch). That ceiling is more than ten times the QRIS maximum, which matters for VIP deposits and B2B settlements.

Side by side for deposits

The pattern will be familiar from Vietnam or the Philippines: the QR rail wins on mobile conversion and small tickets, the bank transfer rail wins on large tickets and desktop sessions. Most Indonesian checkouts offer both.

The compliance picture you cannot ignore

Indonesia prohibits online gambling, and enforcement against payment flows has become aggressive. Katadata reported in July 2026 that the Ministry of Communications and Digital Affairs (Komdigi) had flagged around 38,000 bank accounts suspected of receiving online gambling funds, with about 32,500 closed, plus thousands of e-wallet accounts reported to Bank Indonesia. In the same report PPATK, the financial intelligence unit, said that in the first quarter of 2026 the large majority of flagged deposit transactions ran through QRIS, and it called on payment providers to tighten merchant verification and transaction monitoring.

For a high risk merchant this has two consequences. A QRIS merchant ID onboarded under a misleading business description can be frozen without warning, with the funds inside the acquirer account. A VA on a corporate bank account carries the same exposure, because the same blocking lists apply to banks. Whichever rail you choose, the business behind it has to be lawful for the Indonesian market, with a merchant category that matches what is actually sold. Operators in verticals that are not permitted in Indonesia should take legal advice before accepting rupiah at all.

Which to lead with

If your traffic is mobile first and your average deposit is under Rp2 million, lead with QRIS. The customer stays inside a wallet they already trust, there is no number to copy, and the 0.3 percent MDR is predictable. Insist on a dynamic QR with the amount embedded, so the customer cannot edit it, and a callback that carries the acquirer reference for matching.

If your average ticket is high, or many sessions come from desktop, lead with virtual accounts and keep QRIS second. Ask the PSP which banks issue the VAs (Mandiri, BCA, BNI, BRI and Permata are common), whether BI-FAST is used for interbank credits, and whether the VA is closed amount. Closed amount VAs reject any transfer that does not match the expected figure, which removes a whole class of reconciliation problems.

In both cases ask about payouts separately. Withdrawals in Indonesia usually run as bank transfers to the customer's account, so check cut off times and the fee per disbursement. Also ask how settlement to you is timed (T+0, T+1 or weekly), whether it is paid in IDR or USDT, and how the provider handles a frozen merchant account. A provider that cannot explain its onboarding checks is one whose merchant IDs are likely to be short lived, and that risk is yours as much as theirs.

FAQ

Can a customer pay a QRIS code from a bank app, or only from an e-wallet? Both. Every Indonesian bank's mobile app and every licensed e-wallet supports QRIS, so one code covers the whole market.

Why do some virtual account payments take longer to confirm? If the paying bank does not route the transfer through BI-FAST, the credit may go through older batch rails and take longer. Ask your PSP which banks are connected over BI-FAST.

Is there any chargeback risk on QRIS or virtual accounts? No. Both are push payments initiated by the customer. The real risk in Indonesia is account freezing by the authorities, not disputes.

Working with BestPay24

BestPay24 connects high risk merchants to local payment methods across Asia, including QRIS and virtual account collection in Indonesia, with settlement terms agreed up front. There is no setup fee and no prepayment, and onboarding starts with a short conversation about your volumes and verticals. Reach the team on Telegram at @Bestpay24SalesSupport.