Indonesia

Classification framework for sustainable finance activities, issued by OJK on 5 February 2026 with technical screening criteria for further sectors. OJK's page does not describe it as mandatory and says implementation will move towards a regulatory framework under Law 4 of 2023.

Governs the protection of witnesses, victims, cooperating witnesses, whistleblowers (pelapor), informants and experts, and sets up the LPSK as the protection body. A pelapor who reports in good faith may not be prosecuted or sued over the report and may not be discriminated against or sanctioned at work (Art. 10). BPK records it as in force from 20 May 2026 and as revoking Law 13 of 2006 and Law 31 of 2014.

Requires financial services institutions to adopt an anti-fraud strategy built on prevention, detection, investigation, reporting and sanctions, and monitoring and follow-up. Institutions must have a function to manage the strategy and report significant fraud incidents to OJK. It revokes POJK 39/POJK.03/2019 for commercial banks, among other provisions.

Requires financial services providers to apply an AML, CFT and proliferation-financing programme covering board oversight, written policies, internal controls, management information systems and training. It also sets customer due diligence and beneficial owner rules. Its preamble says it is meant to replace OJK Regulation 12/POJK.01/2017 (as amended by 23/POJK.01/2019); the formal revocation clause was not seen.

Sets out the national cybersecurity strategy and a framework for managing cyber crises, to guide state institutions and other stakeholders. Funding comes from national and regional budgets and other lawful sources.

Indonesia's personal data protection law, enacted 17 October 2022. It sets lawful bases for processing, data subject rights, breach notification, data protection officers and administrative sanctions, and provides for a data protection agency reporting to the President. Controllers had two years from promulgation to comply (Article 74).

Insurance business law that replaced Law 2 of 1992 on insurance business. The BPK database records that it was amended by Law 4 of 2023.

Main anti-money laundering statute. It defines reporting parties, requires know-your-customer rules, record keeping and reports on suspicious, cash and cross-border fund transfer transactions, and sets up PPATK. The BPK database notes that Articles 2(1), 3, 4 and 5 were partially revoked by the new Criminal Code (Law 1/2023).

Law on electronic information, electronic transactions and offences committed through electronic systems. The BPK database shows amendments by Law 19/2016 and Law 1/2024 (second amendment, enacted 2 January 2024) and partial revocation by Law 1/2023.

Company law whose Article 74 obliges companies operating in or related to natural resources to carry out social and environmental responsibility, budgeted as a company cost. Article 66 requires the annual report to include a social and environmental responsibility report. The law leaves further rules to a Government Regulation, recorded separately as id-pp-csr.

Sets Bank Indonesia's status as an independent state institution, its objectives (rupiah stability, payment system stability, support for financial system stability) and its duties of monetary, payment system and macroprudential policy. The consolidated text published by Bank Indonesia incorporates Laws 3/2004, 6/2009 and 4/2023.

Criminalises corruption, including acts harming state finances (Articles 2 and 3), and provides for corporate liability in Article 20. Article 2(1) carries life imprisonment or 4 to 20 years with a fine of Rp200 million to Rp1 billion.

Capital market statute that OJK cites in its sanction decisions, for example Article 27(1) on investment managers and Article 107 on misleading reports. The BPK database records that it was amended by Law 4 of 2023.

Base statute on banking in Indonesia, amended in 1998. The BPK database records further amendments by Law 11/2020, Government Regulation in Lieu of Law 2/2022, Law 4/2023 and Law 6/2023, so the current text must be read as amended.