Indonesia

ID · IDN · Asia-Pacific

3 regulators · 14 laws & regulations · 7 obligations · 40 enforcement actions

Obligation	Timing	Regulator	Arises from	Source
All industries
Corporate social and environmental responsibility	Ongoing; reported in the annual report	—	Undang-Undang Nomor 40 Tahun 2007 tentang Perseroan Terbatas (Law Number 40 of 2007 on Limited Liability Companies)	source
Art. 74(1) requires companies operating in or related to natural resources to carry out social and environmental responsibility; Art. 74(2) makes it a budgeted company cost; Art. 74(3) provides for sanctions under other laws. Art. 66(2)(c) requires the annual report to include a report on its implementation.
Lawful basis, notice and data subject rights	Ongoing	—	Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (Law Number 27 of 2022 on Personal Data Protection)	source
Art. 20 requires a controller to have a lawful basis for processing, and Art. 21 requires notice of purpose, data types, retention period and rights when processing relies on consent. Arts. 5 to 15 give data subjects rights to information, correction, access, deletion, withdrawal of consent, objection to automated decisions, restriction, compensation and portability.
Sustainability report	Frequency Annually; 30 April if filed separately from the annual report	—	—	official
Art. 10 requires financial services institutions, issuers and public companies to prepare a sustainability report each year, filed no later than the annual report deadline that applies to each entity. If filed separately from the annual report, the deadline is 30 April of the following year (Art. 10(4)), and the report must be published on the entity's website by the same date (Art. 12(2)).
Banking
AML record retention	Retention period At least 5 years (Art. 21(2))	PPATK	Undang-Undang Nomor 8 Tahun 2010 tentang Pencegahan dan Pemberantasan Tindak Pidana Pencucian Uang (Law Number 8 of 2010 on the Prevention and Eradication of the Crime of Money Laundering)	source
Art. 21(2) requires reporting parties to keep records and documents on the identity of transaction parties for at least 5 years, counted from the end of the business relationship.
AML/CFT/CPF compliance programme and compliance officer	Ongoing programme; staff training at least once a year	—	Peraturan Otoritas Jasa Keuangan Nomor 8 Tahun 2023 tentang Penerapan Program Anti Pencucian Uang, Pencegahan Pendanaan Terorisme, dan Pencegahan Pendanaan Proliferasi Senjata Pemusnah Massal di Sektor Jasa Keuangan (OJK Regulation 8 of 2023 on the AML, CFT and Counter-Proliferation Financing Programme in the Financial Services Sector)	official
Art. 3 requires providers to apply the AML, CFT and proliferation-financing programme effectively, with board oversight, written policies and procedures, internal controls, information systems and training. Art. 10 requires compliance management arrangements and a special unit or responsible officer; Art. 8(1) has directors arrange staff training at least once a year.
Customer due diligence (KYC/CDD) and beneficial owner identification	At onboarding + ongoing	—	Peraturan Otoritas Jasa Keuangan Nomor 8 Tahun 2023 tentang Penerapan Program Anti Pencucian Uang, Pencegahan Pendanaan Terorisme, dan Pencegahan Pendanaan Proliferasi Senjata Pemusnah Massal di Sektor Jasa Keuangan (OJK Regulation 8 of 2023 on the AML, CFT and Counter-Proliferation Financing Programme in the Financial Services Sector)	official
Law 8/2010 Art. 18 requires reporting parties to apply know-your-customer rules at the start of a business relationship, for transactions of Rp100,000,000 or more, for suspected money laundering or terrorism financing, and where customer data is in doubt. POJK 8/2023 Art. 19 sets the CDD triggers (including wire transfers), Art. 21 requires data collection and verification, and Art. 33 requires identification and verification of beneficial owners and refusal where they cannot be confirmed.
Suspicious transaction reporting to PPATK	Deadline Within 3 working days after the provider learns of the suspicious element (Art. 25(1))	PPATK	Undang-Undang Nomor 8 Tahun 2010 tentang Pencegahan dan Pemberantasan Tindak Pidana Pencucian Uang (Law Number 8 of 2010 on the Prevention and Eradication of the Crime of Money Laundering)	source
Art. 23(1)(a) requires financial service providers to report suspicious financial transactions to PPATK. Art. 25(1) sets the deadline at no more than 3 working days after the provider learns of the suspicious element, sent as soon as possible. Cash transactions of Rp500,000,000 or more (Art. 23(1)(b)) and fund transfers into or out of the country (Art. 23(1)(c)) are also reportable, within 14 working days of the transaction (Art. 25(2)-(3)).
No obligations match these filters.