What is Indonesia's AML regulatory framework, and why does it matter?
Picture the question a PPATK or OJK audit team puts to a reporting party: which reports went to PPATK last year, and on which clock?
Law 8 of 2010 on the Prevention and Eradication of Money Laundering sets who reports what to PPATK. The offense, tindak pidana pencucian uang (TPPU), has sat in art. 607 of the new Criminal Code (KUHP, Law 1 of 2023) since 2 January 2026, when the Code replaced arts. 3 to 5 of Law 8 of 2010. Law 9 of 2013 covers terrorism financing, the CFT side. Law 4 of 2023 (P2SK), dated 12 January 2023, moved crypto asset supervision to OJK. OJK and Bank Indonesia write the AML and CFT program rules for the firms they supervise, as POJK and PBI, and Presidential Regulation 13 of 2018 governs beneficial ownership.
Locally the whole regime goes by APU PPT, short for anti pencucian uang dan pencegahan pendanaan terorisme.
PPATK received 43,723,386 reports in 2025, 25.5 percent more than in 2024 (PPATK, 28 January 2026). Indonesia's anti money laundering (AML) regime follows the FATF pattern that AML rules in other jurisdictions share. What sets it apart are the rupiah lines and the PPATK clocks.
Which authorities regulate AML in Indonesia?
PPATK (Pusat Pelaporan dan Analisis Transaksi Keuangan, INTRAC in English) receives every report and analyzes it for investigators. It can temporarily stop transactions on accounts, and it supervises reporting parties that have no other supervisor. The sector supervisors cover the rest:
- OJK (Financial Services Authority). Banks, insurers, capital markets, fintech lenders and, since January 2025, crypto asset traders, a role Bappebti held before. Its AML rules come as POJK.
- Bank Indonesia. Payment service providers and money changers, under PBI.
- Ministry of Law (AHU). Keeps the beneficial ownership register.
- Police, prosecutors and KPK. Investigate laundering and the crimes behind it.
Audit requirements in Indonesia come from both sides. In 2025 PPATK and the supervisors ran joint audits of 33 financial service providers and 100 goods and service providers and professions, and PPATK then recommended sanctions.
Picture an illustrative Jakarta payment firm licensed by Bank Indonesia to onboard QRIS merchants. Bank Indonesia examines its AML program. Its STRs, cash reports and transfer reports go to PPATK.
Who must comply, and what are the sector-specific requirements?
Law 8 of 2010 calls them reporting parties (pihak pelapor): financial institutions and other financial service providers, goods and service providers, and professions added by government regulation. PPATK's reporting system counted 46,101 registered reporting parties in January 2026.
- Banks, finance companies, insurers, pension funds, securities firms, fintech lenders, pawnshops. OJK supervises them, so the full POJK program applies.
- Payment service providers, electronic money issuers, money changers, remittance firms. Bank Indonesia supervision. QRIS merchant onboarding sits here.
- Crypto asset traders. OJK has licensed them since January 2025, so a Bappebti registration from before then no longer counts.
- Property agents, car dealers, jewelers, art dealers, auction houses. PPATK supervision. They report transactions of IDR 500 million or more, in rupiah or foreign currency (art. 27).
- Notaries, lawyers, accountants. PPATK supervision, with suspicious transactions reported to PPATK.
What are the core AML compliance requirements in Indonesia?
Each row is one obligation, its legal basis as of 3 November 2026, and the record that shows it was met. POJK stands for OJK's AML and CFT regulation; PBI for Bank Indonesia's PBI 10 of 2024, in force since 31 December 2024. complead, formerly Sanction Scanner, fills the last column.
| Obligation | Legal basis (in force, November 2026) | What the firm must do | How complead covers it |
|---|---|---|---|
| AML program | OJK regulation (POJK) and Bank Indonesia regulation (PBI) on AML and CFT | Board oversight, written policies, internal control, a compliance unit and a risk assessment of customers, products, channels and countries. | Rules and every edit to them carry a version, the editor's name, the time and the reason, and one click rolls an edit back. |
| Customer due diligence (PMPJ) | Law 8 of 2010 art. 18; POJK; PBI | Identify and verify customers and act on what the profile shows; keep customer profiles current. | One engine runs onboarding, screening and monitoring, which leaves each customer with one risk score across them. |
| Beneficial owners | Presidential Regulation 13 of 2018 | Identify the natural persons who own more than 25 percent or control the customer; check the AHU register. | KYB and UBO verification traces owners upward to the natural persons at the top, and a layer it cannot resolve is reported as unresolved. |
| Politically exposed persons | POJK; PBI | Identify PEPs, their family members and close associates; get senior approval and establish the source of funds. | Screening coverage includes PEP lists, and the fuzzy match threshold can be set for PEP lists on their own. |
| Enhanced due diligence | POJK; PBI | Enhanced measures for higher risk customers and for countries the FATF lists. | A rule can add risk score for customers tied to countries the FATF lists; the analyst decides the EDD step. |
| Suspicious transaction report (STR) | Law 8 of 2010 arts. 23 and 25; art. 12 | Report to PPATK as soon as possible and within three working days of knowing; no tipping off. | Agents assemble the evidence, a narrative and the work log for the case, backed by reporting support within case management; the compliance officer makes the call and files. |
| Cash transaction report (CTR) | Law 8 of 2010 arts. 23 and 25 | Report cash of IDR 500 million or more, in one transaction or in one working day, within 14 working days. | A no code rule holds the IDR 500 million daily line, backtested first against 30, 60 or 90 days of past transactions. |
| International funds transfer report | Law 8 of 2010 arts. 23 and 25 | Report incoming and outgoing transfers abroad to PPATK within 14 working days. | During processing, transaction screening runs both the payer and the payee through the API. |
| Targeted financial sanctions | Law 9 of 2013; PPATK's DTTOT list | Screen against the domestic list of suspected terrorists and terrorist organizations (DTTOT) and UN lists; freeze without delay. | Name screening spanning 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. |
| Ongoing monitoring | POJK; PBI | Monitor transactions against the customer profile and update the profile. | API triggers start and stop ongoing monitoring per name, so names that no longer matter drop out of screening. |
| Record keeping | Law 8 of 2010 art. 21 | Keep the records and documents on the identity of each transaction's parties at least five years after the relationship ends. | The search audit trail stores who searched, for what, when and with which result, no match searches included. |
| Training | POJK; PBI | Train staff on AML, CFT and red flags. | Training stays with the firm; alerts that name the rule fired and the signals matched make usable teaching cases. |
KYC in Indonesia goes by PMPJ, Prinsip Mengenali Pengguna Jasa, and PPATK counts updating the customer profile as part of it. For the beneficial owner row, a company customer names everyone above 25 percent or in control, and a beneficial ownership declaration gathers those names on one form before the AHU check.
Suspicious transaction reporting: what is the three working day clock?
A suspicious transaction report, LTKM in Indonesian, reaches PPATK within three working days of the firm knowing (art. 25). Filing runs through goAML, PPATK's reporting application, and the LTKM is Indonesia's form of a suspicious activity report. Telling the customer is a crime (art. 12). Reporting parties also file transaction postponement reports, and PPATK received 14,204 of those in 2025. At the illustrative payment firm, a new merchant taking hundreds of small QRIS payments overnight starts the clock once the analyst concludes the pattern is suspicious.
Threshold transaction reporting: when is cash of IDR 500 million reportable?
The line is IDR 500 million in cash, in one transaction or added up over one working day (art. 23). Picture an illustrative bank customer who deposits IDR 180 million, IDR 150 million and IDR 200 million in cash on one working day. No single deposit crosses the line. The day's total of IDR 530 million does, so a CTR goes to PPATK within 14 working days, and if the split looks designed to stay under the line, the facts may also support an STR.
| Report | Trigger | Clock (in force, November 2026) | Channel |
|---|---|---|---|
| Suspicious transaction report (LTKM) | A transaction that departs from the customer's profile, seems meant to avoid a report, involves assets suspected to come from crime, or that PPATK asks to be reported (Law 8 of 2010 arts. 1(5) and 23) | 3 working days after knowing (art. 25) | goAML to PPATK |
| Cash transaction report (LTKT) | Cash of IDR 500 million or more, single or in one working day (art. 23) | 14 working days (art. 25) | goAML to PPATK |
| International funds transfer report (LTKL) | Transfers to or from abroad, above the amount PPATK sets (art. 23) | 14 working days (art. 25) | goAML to PPATK |
| Goods and service provider report | A transaction of IDR 500 million or more, in rupiah or foreign currency (art. 27) | 14 working days (art. 27) | goAML to PPATK |
| Cross border cash | Carrying IDR 100 million or more into or out of Indonesia (art. 34) | At the border | Declaration at entry or exit |
In 2025 PPATK received 183,281 STRs, 3,557,473 CTRs and 39,835,917 international transfer reports.
What are the penalties for money laundering in Indonesia?
| Offense or breach | Basis | Maximum (in force, November 2026) |
|---|---|---|
| Active laundering (placing, transferring, spending or concealing proceeds) | KUHP art. 607(1)(a), replacing Law 8 of 2010 art. 3 from 2 January 2026 | 15 years in prison and a fine of IDR 5 billion (category VII) |
| Concealing origin, location or ownership | KUHP art. 607(1)(b), replacing art. 4 | 15 years and IDR 2 billion (category VI) |
| Passive laundering (receiving or using proceeds) | KUHP art. 607(1)(c), replacing art. 5 | 5 years and IDR 2 billion (category VI) |
| Laundering by a corporation | Law 8 of 2010 art. 7 | Fine of IDR 100 billion; further measures up to license revocation and dissolution |
| Tipping off | Law 8 of 2010 art. 12 | 5 years and IDR 1 billion |
| Reporting failures | Law 8 of 2010 art. 25; POJK; PBI | Administrative sanctions from PPATK, OJK or Bank Indonesia |
The criminal ceilings sit in the KUHP and Law 8 of 2010, and KUHP art. 607(1)(c) reaches a person who only receives or uses criminal money. For a firm, the everyday exposure is the last row. PPATK and the supervisors sanction missed or late reports, and the 2025 joint audits ended in sanction recommendations.
Major money laundering cases and PPATK enforcement in Indonesia
Gambling was the suspected predicate crime in 47.49 percent of 2025 STRs, ahead of fraud at 18.71 percent and corruption at 5.73 percent.
Online gambling is a high risk payment pattern PPATK tracks in Indonesian payments. In the first half of 2026, gambling turnover reached IDR 86.82 trillion and deposits IDR 22.05 trillion. QRIS carried 56.04 percent of deposit value and 87.66 percent of deposit count. Around the 2026 World Cup, PPATK traced IDR 1.02 trillion of deposits in 6,001,352 transactions and suspended 2,815 accounts holding IDR 325.43 billion (PPATK, H1 2026 gambling release). It also asks the public never to hand over accounts, identity or payment access to anyone else.
Indonesia's gambling money moves in millions of small payments, a different shape from most of the biggest money laundering scandals.
Is Indonesia a FATF member? International compliance alignment
Yes. Indonesia became a full FATF member in October 2023 and also belongs to the Asia/Pacific Group on Money Laundering (APG). The FATF follow up report of June 2026 rated 7 of the 40 FATF Recommendations compliant, 30 largely compliant and 3 partially compliant (FATF, June 2026).
On 27 August 2026 PPATK launched three National Risk Assessments (NRA) for 2026, covering money laundering, terrorism financing and proliferation financing (PPATK, 27 August 2026). The money laundering NRA is the fourth update since the first assessment in 2015 and follows the FATF's 2025 methodology. It rates corruption, narcotics and IT based fraud as high domestic risks, and it warns that people who use financial services without understanding them are easier to recruit as nominees or money mules. A firm's own risk assessment can start from those findings.
The APG fifth round schedule lists Indonesia as a joint FATF and APG member in the 2030 plenary group, with its technical compliance submission due on 1 March 2029; PPATK speaks of a Mutual Evaluation Review in 2029. For sanctions, PPATK publishes the DTTOT list, the domestic list of suspected terrorists and terrorist organizations that screening must cover beside UN lists.
How screening and monitoring apply to AML compliance in Indonesia
Take the illustrative Jakarta payment firm again. PPATK's stated answer to gambling deposits through QRIS is stronger merchant verification and acceptance and closer monitoring of transaction behavior, while QRIS stays open for lawful payments.
complead is an AI native platform for AML, KYC and fraud, and Sanction Scanner, the screening product, is part of complead. On the merchant side, client screening and ongoing monitoring checks each new merchant and its owners with fuzzy matching thresholds set per list type and per list, and it logs every search, including the ones that return no match.
Under transaction monitoring sits a rules engine. There a team writes the IDR 500 million daily cash rule, or one for bursts of small QRIS payments, without code, then backtests and versions it before it goes live. Each alert shows its triggering rule and the matched signals. Agents work through the routine cases and attach the evidence, a narrative and the work log to each one. The compliance officer decides on an STR and files it on goAML, and the record shows who decided.
How often are Indonesia's AML rules updated? What changed in 2025 and 2026
There is no fixed cycle. The law changes by statute, POJK and PBI change by regulator, and the money laundering NRA has been updated four times since 2015. The last two years brought these changes:
- January 2025. OJK took over crypto asset supervision from Bappebti under Law 4 of 2023.
- 2 January 2026. The new Criminal Code (KUHP) took effect; its art. 607 replaced arts. 3 to 5 of Law 8 of 2010, with a 15 year ceiling for active laundering.
- June 2026. The FATF follow up report put 37 of the 40 Recommendations at compliant or largely compliant.
- 28 January 2026. PPATK published its 2025 figures: 43,723,386 reports and 46,101 registered reporting parties.
- 4 August 2026. PPATK's first half figures put QRIS at 87.66 percent of gambling deposit transactions.
- 27 August 2026. Three NRA 2026 assessments launched, the money laundering one on the FATF's 2025 methodology.
Next on the calendar are the technical compliance submission on 1 March 2029 and the 2030 APG plenary.
Back to the audit team's question. A file that answers it lists each LTKM with the day the analyst concluded and the day PPATK received it, each CTR with the working day's total, and the screening log for every name, no match results included.
What the Indonesia PDF adds
The guide above is free to read in full. The PDF is the paper version for a compliance file, 16 pages in the 2026 edition, with a 14 point checklist for an Indonesian AML program, a risk factor template for Indonesian customers, and an LTKM decision record where the analyst writes the detection date that opens PPATK's three working day window.
