As OJK Expands Requirements on Anti-Money Laundering Program, What Must be Done and How?

On 14 June 2023, the Financial Services Authority (“OJK“) issued OJK Regulation No. 8 of 2023 on the Implementation of Anti-Money Laundering (“AML”) Programs, Prevention of Terrorism Financing, and Prevention of Financing for the Proliferation of Weapons of Mass Destruction (“WMD”) in the Financial Services Sector (“POJK 8“). POJK 8 repeals the previous regulation on the same subject, namely OJK Regulation No. 12/POJK.01/2017, as amended by OJK Regulation No. 23/POJK.01/2019.

In POJK 8, OJK widens its net so that it does not cover just banks and financial institutions. Indeed, with the enactment of POJK 8, more and more businesses are expected to comply with AML regulations to protect themselves and their customers. Moreover, POJK 8 covers not just AML programs, but also proliferation of WMD.

Below we discuss the changes introduced under POJK 8 and what businesses should do to comply.  

Introduction of requirements on proliferation of WMD

Besides covering AML and anti-terrorism funding, a business must now ensure that proliferation of WMD prevention is a separate component of their program, policy, supervision, and management.

This means that such business not only has an obligation to assess the proliferation of WMD risk of their customers, but also an obligation to put in place policies and procedures to implement programs that cover AML, terrorism financing prevention, and proliferation of WMD prevention (“Program”).

Previously, proliferation of WMD prevention was a small part of AML and terrorism financing prevention program and businesses were only required to examine whether a customer/prospective customer/walk-in customer is listed as a WMD entity.

Who needs to comply with POJK 8?

Generally, POJK 8 applies to financial service providers. In the previous regime, financial service providers only cover institutions in the banking, capital market, and non-bank financial industry sectors. Now, the definition of financial service providers has been expanded to include (institutions marked in red are additions under POJK 8):

• Banks, both commercial and sharia, and those performing custodian functions;

• Securities companies, securities brokers/dealers, and/or investment managers;

• Insurance companies;

• Pension fund management companies (DPLK);

• Financing companies, including infrastructure financing companies;

• Venture capital companies;

• Indonesia’s export financing institution (LPEI);

• Pawnshop companies;

• Microfinance institutions (LKM);

• Trustees;

• Providers of securities through technology-based investment platform, including equity crowdfunding;

• Providers of technology-based joint funding services (previously referred to as technology-based P2P lending services);

• Providers of technology-based financial transaction services or financial technology innovation providers in the financial sector; and

• any other financial service institutions/entities involved in fundraising, fund distribution, fund management in the financial services sector, and supervised by OJK based the law (for example, PT Permodalan Nasional Madani).

Any business that fits in a category on this list is expected to comply with POJK 8. This means that if you are a technology-based start-up, regardless of your size, you have to think about your AML responsibilities under POJK 8.

How to comply with POJK 8

First, besides conducting basic know-your-customer procedure, such as analysing their risk and checking their credibility, a business must ensure that its Program covers proliferation of WMD prevention as a separate component, as opposed to only being a part of its AML or anti-terrorism funding programs.

Then, there are certain aspects based on POJK 8 that all businesses should fulfil:

1. Active supervision by board of commissioners

   Article 9 of POJK 8 expands the scope of active supervision by the board of commissioners to include evaluating the policies and procedures for implementing the Program. Previously, the board of commissioners was only tasked to, among others, approve the Program as proposed by the board of directors and supervise the Program’s implementation. 

   Now, the board of commissioners is also required to be involved in giving suggestions on how to improve the Program.

2. Person in charge

   Depending on the type of the relevant financial service provider, the person in charge of implementing the Program in that provider will differ:

   Type of Financial Service Providers	Person in Charge
   Banks, securities companies, investment managers, insurance companies, infrastructure financing companies, Indonesia’s export financing institution, and technology-based joint funding service providers	A director who oversees the compliance function in the provider.
   Investment platform providers, insurance brokerage companies, financial institution pension funds, financing companies, venture capital companies, pawnshop companies, microfinance institutions, and financial technology innovation providers in the financial sector	A director
   Custodians, trustees, and/or financial institution pension funds that are business units of PJKs	An individual who oversees the implementation of the Program in that provider.

3. Verification of beneficial owner

   POJK 8 expands the requirement for financial service providers to verify the beneficial owner of state institutions or government agencies, companies in which the majority of the shares are owned by the state, and public companies or issuers. These entities were exempted from the beneficial owner requirement in the previous regime.

4. Reporting

   POJK 8 introduces several additional reporting obligations by financial service providers to government agencies. Therefore, the reporting obligations of providers now include (items marked in red are additions under POJK 8):

*PPATK is Pusat Pelaporan dan Analisis Transaksi Keuangan or the Indonesian Financial Transaction Report and Analysis Centre

**POLRI is the Indonesian National Police

POJK 8 also gives financial service providers some flexibility in allowing them to delay or temporarily suspend transactions where there is knowledge or reasonable suspicions that the customers or walk-in-customers are engaging in transactions involving assets derived from criminal activities, have accounts used to hold assets derived from criminal activities, or use counterfeit documents.

In our view, the point of all these measures is that a good Program must include the active involvement of the financial service providers.

Sanctions

POJK 8 introduces new administrative sanctions for violations of POJK 8. These sanctions apply specifically for violations of the obligations to:

• Implement the Program;

• Appoint compliance officers at the management level; and

• Identify and conduct risk assessments for money laundering, terrorism financing, and WMD

The administrative sanctions that OJK may impose range from warnings/written reprimands, fines, and restrictions and suspension of business activities. OJK may also announce the sanctions to the public.

Conclusion

POJK 8 became effective on 14 June 2023. Existing financial service providers will have a grace period of 6 months from 14 June 2023 to adjust its Program based on POJK 8. On the other hand, new financial service providers will have 12 months from the date when they are required to comply under the law to adjust their Program.

With such an expansive list of businesses under POJK 8, it is important to check where your business stands and how to make it compliant. Moreover, businesses should read the requirements under POJK 8 in detail to allow them to either establish or update their Program accordingly.

Yoga Baskara Yogyandi also contributed to this alert.