By the end of June 2026, 65.77 million Indonesians were paying with QRIS and 44.86 million merchants accepted it, according to Bank Indonesia (BI). The national QR standard processed 12.55 billion transactions in the first half of the year, double the figure for the same period of 2025.
QRIS also carries most of the deposits for illegal online gambling in Indonesia. PPATK, Indonesia's financial intelligence unit, found that QRIS handled 87.66% of the online gambling deposit transactions it detected in the first half of 2026. By value, its share was 56.04%.
For a payment service provider (PSP), the gap between count and value shows how gambling money enters the system and where monitoring should look.
How a QRIS payment reaches a merchant
Bank Indonesia sets the QRIS standard, but a merchant cannot get a code from BI directly. It applies to a licensed payment service provider (PJP), which checks its documents and issues a National Merchant ID (NMID) and QR code. Every NMID sits in a national merchant repository run by PTEN. Every merchant ID sits in a national merchant repository run by PTEN. Transactions between the payer's app and the merchant's provider are routed through one of four switching companies. In mid-2026, the system connected 96 banks and 60 non-bank institutions.
Two features of the merchant base matter for gambling risk. Micro, small and medium businesses make up 96.68% of QRIS merchants, so a small shop receiving many low-value payments looks entirely normal. BI's target of 47 million merchants by the end of 2026 also keeps onboarding volumes high.
The acquiring PJP is the point where a fake merchant either gets in or gets stopped.
What PPATK's deposit data shows
PPATK traced Rp22.05 trillion in online gambling deposits in the first half of 2026, spread over 226.76 million transactions. QRIS carried 198.77 million of them, worth Rp12.36 trillion.
Divide value by count and the averages separate sharply. A QRIS gambling deposit averaged about Rp62,000. Deposits through bank transfers and e-wallets averaged roughly Rp346,000, more than five times as much. These averages are our calculation from PPATK's totals; PPATK did not publish them.
QRIS's share has grown quickly:
Total gambling turnover fell 12.9% year on year in the first half of 2026, to Rp86.82 trillion, while the number of transactions rose. PPATK gives two reasons. Its detection has improved, and gambling networks are splitting payments into smaller amounts sent more often.
These percentages describe detected gambling deposits only. They say nothing about QRIS traffic as a whole, where gambling is a small fraction of 12.55 billion payments.
How gambling networks disguise QRIS deposits
PPATK has named the vehicles: shell companies, fake micro-business and digital merchants (merchant fiktif), and merchant aggregators. Each one makes a gambling deposit, known locally as deposit judol, look like a purchase.
The fake merchant is the simplest version. A network registers what looks like a small shop or online seller, gets a QRIS code, and shows that code on a gambling site's deposit page. The player scans it and sees a merchant name that has nothing to do with gambling. On the acquirer's side the payment arrives as an ordinary sale.
Small amounts make this harder to spot. In parliament, legislator Junico Siahaan cited sites accepting QRIS deposits from Rp5,000. A stream of Rp20,000 to Rp100,000 payments is what a food stall or phone-credit reseller would expect to receive.
Aggregators add a layer. When one intermediary onboards many sub-merchants, the acquiring provider may see only the aggregator's name and settlement account. A gambling site hidden among hundreds of legitimate sellers is easy to miss.
PPATK has also asked the public not to hand over bank accounts, identity documents or access to payment instruments. Borrowed or bought accounts let a network open new merchants after old ones are frozen.
How regulators monitor QRIS today
BI's rules put the first check on providers. PJPs must apply know-your-merchant checks and cut off merchants serving gambling, and BI can order PTEN to freeze the merchant's ID in the national repository. Providers that fail can be sanctioned under BI Regulation 23/6/2021, from a warning to suspension or loss of licence.
In November 2024, BI Deputy Governor Juda Agung described two lines of defence. Banks and non-bank PJPs must run fraud detection systems that flag accounts used for gambling. Accounts found this way are reported to BI, shared with the industry and loaded into BI-FAST, which then rejects transfers involving them. At that point about 7,500 accounts had been identified, almost all of them frozen.
The Financial Services Authority (OJK) works on the banking side. By 14 July 2026, banks had blocked 32,453 gambling-linked accounts after enhanced due diligence. In October 2026 OJK said it had instructed banks to block 38,796 accounts from Komdigi's lists, and to close other accounts belonging to the same people, matched by national ID number (NIK), so they cannot move to a fresh account at the same bank.
What the ML study found
A preprint posted to SSRN in April 2026, with a Bank Indonesia contact author, tested a hybrid machine-learning system on payment data. It combined clustering, classification and graph machine learning to map how accounts connect. The authors report that it identified more than 90% of syndicate accounts linked to gamblers. Flagging 1,000 suspect accounts took 30 minutes instead of a week of manual review, and the system caught three times as much fraud.
The paper is not peer reviewed or an official BI publication, and it does not say BI runs the system. Its method is still useful to PSPs: the network of accounts revealed the syndicates, which single transactions could not.
What PSPs need to know
QRIS merchant onboarding
The cheapest place to stop a gambling merchant is before its code goes live. Check that the business exists at the stated address or URL and that its website or app matches what it says it sells. Expected volume should fit the business. A new stall projecting thousands of payments a day needs an explanation.
Settlement accounts deserve the same scrutiny. The account should belong to the merchant or its owner. Several unrelated merchants settling to one account, or to accounts held by the same NIK, is a strong signal.
Ongoing monitoring signals
Rules that judge each transaction alone will pass most gambling deposits, because each one looks like a small sale. Look at merchant-level behaviour instead:
- payment frequency far above what the declared business would see, especially around major sports events;
- many distinct payers sending similar small amounts, with few repeat purchases of the kind a real shop gets;
- money swept out of the settlement account soon after it arrives;
- one payer paying several unrelated merchants that share a settlement account or owner.
PPATK linked Rp1.02 trillion in deposits from mid-June to July 2026 to World Cup betting.
Aggregators and sub-merchants
If an aggregator brings sub-merchants onto your acquiring service, contract for visibility of each one: identity, business type, URL and settlement destination. Without that data a provider cannot apply its own controls, and it carries the regulatory risk anyway.
When a merchant is frozen
Keep the reason attached to the merchant record and share it with connected partners. A merchant cut off by one acquirer can apply to another under a new name with the same owner or account.
FAQ
Why do gambling networks prefer QRIS?
One code accepts payment from any Indonesian bank or wallet app. Small payments also blend into the normal traffic of micro merchants.
What share of gambling deposits goes through QRIS?
PPATK counted 87.66% of detected gambling deposit transactions in the first half of 2026, or 56.04% by value.
Does Bank Indonesia use machine learning to find gambling accounts?
A 2026 preprint by BI-affiliated authors reports an ML system that found over 90% of syndicate accounts. The paper does not say the system is deployed.
What happens to a merchant caught taking gambling deposits?
The PJP must end the relationship, BI can have the merchant ID frozen in the national QRIS repository, and linked bank accounts can be blocked.