Guidelines for the Implementation of Anti-Money Laundering and Counter-Terrorism Financing Programs in the Non-Bank Financial Industry Sector

To:

The Board of Directors of Life Insurance Companies and General Insurance Companies;
The Board of Directors of Sharia Life Insurance Companies and Sharia General Insurance Companies;
The Board of Directors of Insurance Brokers;
The Management of Financial Institution Pension Funds;
The Board of Directors of Financing Companies and Sharia Financing Companies;
The Board of Directors of Venture Capital Companies and Sharia Venture Capital Companies;
The Board of Directors of Infrastructure Financing Companies;
The Board of Directors of Pawnshop Companies; and
The Board of Directors of the Indonesian Export Financing Institution,

at their respective locations.

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 37 /SEOJK.05/2017

CONCERNING

GUIDELINES FOR THE IMPLEMENTATION OF ANTI-MONEY LAUNDERING AND COUNTER-TERRORISM FINANCING PROGRAMS IN THE NON-BANK FINANCIAL INDUSTRY SECTOR

In relation to the mandate of Article 68 of Financial Services Authority Regulation Number 12/POJK.01/2017 concerning the Implementation of Anti-Money Laundering and Counter-Terrorism Financing Programs in the Financial Services Sector (State Gazette of the Republic of Indonesia Year 2017 Number 57, Supplement to the State Gazette of the Republic of Indonesia Number 6035), it is necessary to regulate further regarding the guidelines for the implementation of anti-money laundering and counter-terrorism financing programs in the non-bank financial industry sector as follows:

I. GENERAL PROVISIONS

In this Financial Services Authority Circular Letter, the following terms are defined as:

a. Insurance Company is an insurance company as referred to in Law Number 40 of 2014 concerning Insurance. b. Sharia Insurance Company is a Sharia insurance company as referred to in Law Number 40 of 2014 concerning Insurance.
c. Insurance Broker Company is a company that conducts insurance brokerage business as referred to in Law Number 40 of 2014 concerning Insurance.
d. Financial Institution Pension Fund, hereinafter abbreviated as DPLK, is a financial institution pension fund as referred to in Law Number 11 of 1992 concerning Pension Funds. e. Financing Company is a business entity that conducts financing activities for the procurement of goods and/or services, including those that conduct all or part of their business based on Sharia principles. f. Venture Capital Company, hereinafter abbreviated as PMV, is a business entity that conducts venture capital business activities, venture fund management, fee-based service activities, and other activities with the approval of the Financial Services Authority, including those that conduct all or part of their business based on Sharia principles. g. Infrastructure Financing Company is a business entity established specifically to conduct financing in the form of providing funds for infrastructure projects. h. Indonesian Export Financing Institution, hereinafter abbreviated as LPEI, is the Indonesian export financing institution as referred to in Law Number 2 of 2009 concerning the Indonesian Export Financing Institution.
i. Pawnshop Company is a private pawnshop company and a government pawnshop company regulated and supervised by the Financial Services Authority.
j. Non-Bank Financial Industry Financial Service Provider, hereinafter referred to as PJK IKNB, is an Insurance Company, Sharia Insurance Company, Insurance Broker Company, DPLK, Financing Company, PMV, Infrastructure Financing Company, LPEI, and Pawnshop Company. k. Board of Directors:

for PJK IKNB in the form of a limited liability company is the board of directors as referred to in the law regulating limited liability companies;
for Insurance Companies, Sharia Insurance Companies, Insurance Broker Companies, Financing Companies, PMV, Infrastructure Financing Companies, and Pawnshop Companies in the form of a cooperative legal entity is the management as referred to in the law regulating cooperatives;
for Insurance Companies, Sharia Insurance Companies, or Insurance Broker Companies in the form of a joint venture legal entity is the board of directors as referred to in the company's articles of association;
for PMV in the form of a limited partnership business entity is the equivalent of the board of directors as referred to in the company's articles of association;
for DPLK is the management as referred to in the law regulating pension funds; and
for LPEI is the executive director as referred to in the law regulating LPEI.
l. Board of Commissioners:
for PJK IKNB in the form of a limited liability company is the board of commissioners as referred to in the law regulating limited liability companies;
for Insurance Companies, Sharia Insurance Companies, Insurance Broker Companies, Financing Companies, PMV, Infrastructure Financing Companies, and Pawnshop Companies in the form of a cooperative legal entity is the supervisor as referred to in the law regulating cooperatives;
for Insurance Companies, Sharia Insurance Companies, or Insurance Broker Companies in the form of a joint venture legal entity is the board of commissioners as referred to in the company's articles of association;
for PMV in the form of a limited partnership business entity is the equivalent of the board of commissioners as referred to in the company's articles of association;
for DPLK is the supervisory board as referred to in the law regulating pension funds; and
for LPEI is the board of directors as referred to in the law regulating LPEI.
m. Money Laundering is money laundering as referred to in the law regulating the prevention and eradication of Money Laundering criminal acts. n. Terrorism Financing is terrorism financing as referred to in the law regulating the prevention and eradication of Terrorism Financing criminal acts. o. Anti-Money Laundering and Counter-Terrorism Financing, hereinafter abbreviated as APU and PPT, are efforts to prevent and eradicate Money Laundering and Terrorism Financing criminal acts.

PJK IKNB is highly vulnerable to the possibility of being used as a medium for Money Laundering and Terrorism Financing. PJK IKNB may become an entry point for assets that are the proceeds of Money Laundering criminal acts or are financing for terrorist activities into the financial system, which can subsequently be utilized for the benefit of criminals. For example, for Money Laundering perpetrators, these assets can be withdrawn again as seemingly legitimate assets that can no longer be traced to their origin. Whereas for Terrorism Financing perpetrators, these assets can be used to finance terrorist activities.
The increasing complexity of financial service products and services, including their marketing (multi-channel marketing), and the increasing use of information technology in the financial services industry, result in a higher risk of PJK IKNB being used as a means for Money Laundering and/or Terrorism Financing.
In this regard, there is a need to improve the quality of the implementation of the APU and PPT program based on a risk-based approach in accordance with general principles applicable internationally and in line with the national risk assessment (NRA) and sectoral risk assessment (SRA).
The implementation of a risk-based APU and PPT program must at least include:
a. active supervision by the Board of Directors and Board of Commissioners; b. policies and procedures;
c. internal controls;
d. information management systems; and e. human resources and training.
Overview of Money Laundering Criminal Acts

a. Money Laundering Criminal Acts (TPPU) are acts of placing, transferring, paying, spending, donating, entrusting, taking abroad, exchanging, or other acts over assets known or reasonably suspected to be the proceeds of criminal acts with the intent to hide or disguise the origin of the assets so that they appear to be legitimate assets. b. Generally, the Money Laundering process can be grouped into 3 (three) stages of activities, including:

placement, which is the effort to place cash money originating from criminal acts into the financial system, or the effort to place giro money (checks, bank drafts, deposit certificates, and others) back into the financial system;
layering, which is the effort to obscure the origin of assets originating from criminal acts (dirty money) that have been successfully placed with financial service providers. In this activity, there is a process of transferring assets originating from criminal acts from several accounts or specific locations as a result of placement to other places through a series of complex transactions designed to disguise and eliminate the trail of the source of the assets; and/or
integration, which is the effort to combine or use assets that appear legitimate, either to enjoy directly, invest in various types of financial products and other material forms, use to finance legitimate business activities, or to re-finance criminal activities.
c. Some methods, techniques, schemes, and instruments in Money Laundering, including:
currency exchange/cash conversion, which is a technique used to help smuggle to another jurisdiction or to exploit the low reporting requirements of currency exchange service providers to minimize the risk of detection, for example, by purchasing traveler's checks to carry the value of money to other jurisdictions;
cash smuggling, which is a technique used to obscure the origin of assets by moving a certain amount of cash across national borders or bringing assets from criminal acts to countries that do not have strict currency regulations;
structuring, which is an effort to avoid reporting by breaking down transactions so that the transaction amount becomes smaller but with high frequency;
smurfing, which is a method carried out by using several accounts under the names of different individuals for the benefit of a specific person;
underground banking or alternative money transfer services, which is the activity of sending money through informal channel mechanisms based on trust. Often this mechanism works in parallel with the traditional banking sector and may violate the law in some jurisdictions. This technique is utilized by Money Laundering and Terrorism Financing perpetrators to transfer money value without detection and to obscure the identity of the person controlling the money;
Trade-Based Money Laundering and Terrorism Financing, which is a technique that includes invoice manipulation and using financial and commodity route channels to avoid legal and financial transparency;
mingling, which is a technique using the method of mixing or combining crime proceeds with proceeds from legitimate business activities with the aim of obscuring the source of funds;
use of professional services, which is a technique using third parties, namely professional services such as lawyers, notaries, financial planners, accountants, and public accountants. This is done with the aim of obscuring the identity of the beneficial owner and the source of crime proceeds;
use of shell companies, which is a technique carried out by formally establishing a company based on applicable legal rules. However, in practice, the company is not used to conduct business activities. Shell companies are established only to conduct fictitious transactions or store assets of the founder or others. In addition, this technique aims to obscure the identity of the person controlling the funds and exploit relatively low reporting requirements;
use of wire transfers, which is a technique aimed at transferring funds electronically between financial institutions and often to other jurisdictions to avoid detection and asset seizure;
new payment technologies, which is a technique using newly emerged payment technologies for Money Laundering and Terrorism Financing, for example, including payment and money transfer systems based on mobile phones;
use of false identities, which is a transaction carried out using false identities as an effort to make it difficult to trace identities and detect the presence of Money Laundering perpetrators. In its development, the trend of using false identities shows a fairly significant increase through various ways, including fraud through the use of false identities in the account opening process;
use of other people's names (nominees), trustees, family members, and third parties, which is a technique commonly used to obscure the identity of the person controlling crime proceeds;
purchase of assets or luxury goods (property, vehicles, and others), which is investing crime proceeds into the form of assets/goods that have high bargaining value. This aims to take advantage of reducing reporting requirements with the intent of obscuring the source of crime proceeds;
barter, which is avoiding the use of cash funds or financial instruments so that they cannot be detected by the financial system. In relation to Money Laundering and Terrorism Financing risk assessment, examples of barter include direct exchange between heroin and gold bars;
u-turn, which is an effort to obscure the origin of crime proceeds by reversing transactions and then returning them to the original account; and/or
cuckoo smurfing, which is an effort to obscure the origin of the source of funds by sending funds from crime proceeds through a third-party account waiting for funds from abroad and unaware that the funds received are proceeds of crime; and/or
use of third parties, which is a transaction carried out using the identity of a third party with the aim of avoiding the detection of the identity of the party that is actually the owner of the criminal proceeds.

Overview of Terrorism Financing Criminal Acts

a. Every terrorist act carried out in Indonesia essentially requires support, both in the form of armaments (firearms, sharp weapons, and explosives), housing, vehicles for mobilization, war facilities, and provision of needs for members, all of which can be interpreted as financing based on the definition of funds in Law Number 9 of 2013 concerning the Prevention and Eradication of Terrorism Financing Criminal Acts. In terrorist crime acts, money or funds are intended as a means to carry out actions and not as a target to be sought, so various methods will be used by perpetrators to obtain funds, both legitimately such as selling mobile credit, asking for donations, selling computer equipment, selling herbal products, opening internet cafe services, or through criminal acts such as robbery, fraud, up to hacking online investment sites. The collected funds are used to obtain armaments, buy explosives, build networks or recruit members, conduct war training, and mobilize members to or from a place for the implementation of terrorist actions. b. Terrorism Financing Criminal Acts (TPPT) are the direct or indirect use of assets for terrorist activities, terrorist organizations, or terrorists. Terrorism Financing is essentially a type of criminal act different from TPPU, however, both contain similarities in that they use financial services as a means to commit a criminal act.
c. Unlike TPPU, whose purpose is to disguise the origin of assets, the purpose of TPPT is to assist terrorist activities, whether with assets that are the proceeds of a criminal act or with assets obtained legitimately. To prevent PJK IKNB from being used as a means for TPPT, PJK IKNB needs to implement an adequate APU and PPT program.
d. Some Terrorism Financing modus operandi include:

domestic financing through donations to foundations using cash instruments used for terrorist network management;
domestic financing through the misuse of foundation funds using cash instruments used for terrorist network management;
domestic financing through trading/business (goods/services) using cash instruments used for terrorist network management;
domestic financing through criminal acts using cash instruments used for terrorist network management; and/or
domestic financing through the misuse of foundation funds to open new business activities (goods/services) the results of which are for terrorist network management.
These modus operandi are high-risk Terrorism Financing modus operandi.

II. IMPLEMENTATION OF RISK-BASED APU AND PPT PROGRAM (RISK-BASED APPROACH)

Obligations for the Implementation of Risk-Based APU and PPT Program

a. The APU and PPT program is a program that PJK IKNB must implement in conducting business relationships with service users. This program includes matters required in the Financial Action Task Force (FATF) Recommendations as an effort to protect PJK IKNB from being used as a means or target for crime, whether carried out directly or indirectly by criminals. FATF Recommendation 1 affirms that PJK IKNB is obligated to identify, assess, and understand the risks of Money Laundering criminal acts and/or Terrorism Financing criminal acts related to customers, countries/geographic areas/jurisdictions, products, services, transactions, or distribution networks (delivery channels). PJK IKNB conducts its own assessment and implements an effective risk management framework process. PJK IKNB is obligated to update data related to the implementation of the APU and PPT program and be responsive in order to support national risk assessment. b. The implementation of a risk-based APU and PPT program supports PJK IKNB in implementing prevention and risk mitigation measures commensurate with the identified TPPU and TPPT risks. PJK IKNB can subsequently allocate its resources according to the risk profile faced by PJK IKNB, manage internal controls, internal structure, and implement policies and procedures to prevent and detect Money Laundering and Terrorism Financing.
c. In the implementation of a risk-based APU and PPT program, PJK IKNB must refer to and consider risks of national concern listed in the NRA and SRA. The risks listed in the NRA and SRA can develop and change; therefore, the APU and PPT program implemented by PJK IKNB must be responsive to changes in those risks.

Risk Concept

a. Definition of Risk
Risk can be defined as the likelihood of an event and its consequences. Simply put, risk can be seen as a combination of the probability of occurrence and the level of damage or loss that may result from an event. In the context of Money Laundering and Terrorism Financing, risk is interpreted as:

at the national level, it is a threat and vulnerability caused by Money Laundering and Terrorism Financing that endangers the national financial system and national security;
at the PJK IKNB level, it is a threat and vulnerability that places PJK IKNB at risk of being used as a means for Money Laundering and Terrorism Financing.
Threats can be parties or objects that can cause loss. In the context of Money Laundering and Terrorism Financing, threats can be perpetrators of criminal acts, facilitators (parties that assist in the execution of criminal acts), funds of criminals, or even terrorist groups. Vulnerability is an element of business activities that can be exploited by identified threats. In the context of TPPU and TPPT, vulnerability can be interpreted as weak internal controls of PJK IKNB or the offering of high-risk products/services/transactions. Impact refers to the level of serious damage and loss that arises if TPPU and TPPT occur. b. Risk Management Risk management is a process widely used in the public and private sectors to assist in decision-making. In relation to Money Laundering and Terrorism Financing, the process includes understanding the risks of Money Laundering and Terrorism Financing, assessing these two risks, and developing methods to manage and mitigate identified risks. In implementing risk management for Money Laundering and Terrorism Financing risks, PJK IKNB can develop risk management methods in accordance with the characteristics of PJK IKNB while still referring to regulations regarding APU and PPT.
c. Inherent Risk and Residual Risk
In conducting risk assessment, it is important to distinguish between inherent risk and residual risk. Inherent risk is the risk attached to an event or condition that exists prior to the implementation of control measures. This inherent risk is related to the business activities and customers of PJK IKNB. On the other hand, residual risk is the level of risk remaining after the implementation of risk mitigation steps and controls. d. Risk-Based Approach In the context of Money Laundering and Terrorism Financing, the risk-based approach is a process that includes the following:
Risk assessment covering 4 (four) risk factors, namely:
a) customers; b) countries/geographic areas/jurisdictions; c) products/services/transactions; or d) distribution networks (delivery channels); and
PJK IKNB considers all relevant risk factors.
PJK IKNB manages and mitigates risks through the implementation of internal controls and steps appropriate to the identified risks, and monitors transactions and business relationships according to the assessed risk level.
In conducting the assessment, management, and mitigation of Money Laundering and Terrorism Financing risks, PJK IKNB needs to understand that these activities are not static. Identified risks can change over time in line with the development of new products or new threats entering business activities. PJK IKNB must conduct periodic risk assessment updates according to needs and PJK IKNB's risk assessment.

Risk-Based Approach Cycle

a. In conducting a risk-based approach, PJK IKNB must carry out 6 (six) activity steps as follows:

identify inherent risks;
determine risk tolerance;
formulate risk reduction and control measures;
evaluate residual risk;
apply a risk-based approach; and
review and evaluate the existing risk-based approach.
b. The cycle flow of the risk-based approach is as set forth in Appendix I, which forms an integral part of this Financial Services Authority Circular.

Steps of the Risk-Based Approach
a. Identification of Inherent Risk

In identifying inherent risk, Non-Bank Financial Institutions (PJK IKNB) must consider the vulnerability of the PJK IKNB to be used as a vehicle for Money Laundering and Terrorism Financing. The initial step in risk assessment is to understand the overall business activities of the PJK IKNB from a broad perspective. This understanding will enable the PJK IKNB to consider where risks occur, whether risks occur in business activities, customers, or specific products.
The actual amount of risk inventoried by the PJK IKNB will vary depending on business activities, as well as the products/services/transactions offered.
PJK IKNB must consider elements that trigger the emergence of risk for the PJK IKNB from the customer side, country/geographic area/jurisdiction, product/service/transaction, or distribution network (delivery channels). PJK IKNB understands what elements constitute inherent risk and residual risk.
Customer Risk
PJK IKNB must pay attention to risks that may arise from customers. Therefore, PJK IKNB needs to categorize customers based on risk levels. This categorization can refer to the risk classification established by the PJK IKNB, in accordance with applicable regulations and international standards. Some customer categories whose activities may indicate high risk include among others:
a) customers who conduct business relationships or transactions that are unnatural or inconsistent with the customer profile, including:
i. significant and unexplainable geographical distance between the customer's residence or business location and the location where the transaction is conducted;
ii. unexplainable frequency and movement of transactions related to financial transactions with other financial service providers, both in the non-bank financial sector and in other financial service sectors; and/or
iii. unexplainable frequency and movement of funds occurring between financial service institutions in various geographical regions;
b) corporate customers whose ownership structure is complex and makes it difficult to identify the beneficial owner, ultimate owner, or ultimate controller of the corporation; c) customers who seek or receive PJK IKNB products/services/transactions that are not in line with their needs or are not beneficial to the customer; d) charitable organizations or other non-profit organizations that are not regulated and supervised; e) gatekeepers such as accountants, lawyers, or other professions acting on behalf of customers in relation to accounts/contracts at the PJK IKNB, where the PJK IKNB relies on the existence of such gatekeepers; f) customers who fall into the category of politically exposed persons (PEP), including family members or close associates of PEPs; g) customers whose beneficial owner is unknown; h) customers whose verification process is non-face-to-face; i) customers using unusual payment methods such as cash or cash equivalents (when payment using cash or cash equivalents is not commonly used) or structured monetary instruments; j) customers seeking products that can be paid off early, particularly at the customer's expense, or where payment is made by a third party that appears unrelated, or where repayment is directly given to another third party who appears unrelated to the customer; k) customers who transfer the benefits of PJK IKNB products/services/transactions to third parties who have no relationship with the customer; l) customers who are not interested in the performance of PJK IKNB investment products but are more concerned with early repayment of the product; and m) customers who are unwilling to provide data and information in the identification process, or customers who provide very minimal information or information that is suspected to be fictitious.
Country/Geographic Area/Jurisdiction Risk
Country risk, geographic area risk, or jurisdiction risk, along with other risk factors, provide very useful information for Money Laundering and Terrorism Financing risk assessment. In conducting risk assessment, PJK IKNB must identify high-risk elements related to geographical locations, both the geographical location of the PJK IKNB and the geographical location of customers, or the location where the business relationship occurs, and its impact on overall risk. Money Laundering and Terrorism Financing risks in PJK IKNB business activities increase if:
a) funds are received from or sent to a high-risk country or jurisdiction; or b) customers have a significant relationship with a high-risk country or jurisdiction.
Risks related to domicile, nationality, or transactions must be assessed as part of the inherent risk of PJK IKNB customers.
Indicators determining that a country/geographic area/jurisdiction is high-risk for Money Laundering and Terrorism Financing include among others:
a) jurisdictions identified by organizations conducting mutual assessments of a country (such as: Financial Action Task Force (FATF) on Money Laundering, Asia Pacific Group on Money Laundering (APG), Caribbean Financial Action Task Force (CFATF), Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism (MONEYVAL), Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), The Eurasian Group on Combating Money Laundering and Financing of Terrorism (EAG), The Grupo de Accion Financiera de Sudamerica (GAFISUD), Intergovernmental Anti-Money Laundering Group in Africa (GIABA), or Middle East & North Africa Financial Action Task Force (MENAFATF)) as not adequately implementing FATF recommendations; b) countries identified as non-cooperative or tax havens by the Organization for Economic Cooperation and Development (OECD); c) countries with low levels of good governance as determined by the World Bank; d) countries with high corruption risk levels as identified in the Transparency International Corruption Perception Index; e) countries widely known as drug production and trading centers; f) countries subject to sanctions, embargoes, or similar measures, for example by the United Nations; or g) countries or jurisdictions identified by trusted institutions as funders or supporters of terrorist activities, or that allow terrorist organization activities in their country.
Product/Service/Transaction Risk
Overall risk assessment must include determining risks that may occur on various products/services/transactions offered. PJK IKNB must pay attention to risks related to specific products/services/transactions that are not specifically offered by the PJK IKNB, but utilize the infrastructure owned by the PJK IKNB in providing products/services/transactions. The following tend to increase the risk profile of products/services/transactions, including among others:
a) receipt of payments or receipt of money from third parties; b) receipt of payments with very high or unlimited nominal values, or large receipts from payments with small nominal values; c) receipt of payments in the form of cash, money orders, or cashier's checks; d) frequent receipts of payments, which are outside normal/reasonable premium policies or outside normal payment schedules; e) receipt of money from withdrawals made at any time subject to certain service charges/fees; f) receipts used as loan collateral and/or recorded in discretionary financial assets or other financial assets that always carry increased risk; g) products that receive full (lump-sum) high-value payments, which also have good liquidity features; and h) products that allow the transfer of beneficiaries, conducted without the knowledge of the PJK IKNB until a claim occurs.
Distribution Network (Delivery Channels) Risk
Distribution networks (delivery channels) are media used to obtain a product/service/transaction, or media used to conduct a transaction.
Distribution networks (delivery channels) must be considered as transaction risks. Distribution networks (delivery channels) that allow non-face-to-face transactions have higher inherent risk.
Distribution networks (delivery channels) conducted without face-to-face interaction, for example marketing using the internet or telephone, and accessible 24 (twenty-four) hours a day, 7 (seven) days a week, from anywhere, are very likely to be used to obscure the true identity of customers or beneficial owners, thus carrying higher risk. Although some distribution networks (delivery channels) have become common (e.g., internet banking usage), these must still be considered as part of factors that can cause customer risk or product risk to be higher. Some indicators that can cause distribution networks (delivery channels) to be high-risk include among others:
a) non-face-to-face transactions; b) use of agents; and/or c) online purchase of products/services/transactions.
Other Relevant Risks
Other relevant factors that can impact Money Laundering and Terrorism Financing risks include among others:
a) typology trends, methods, techniques, and schemes of Money Laundering and Terrorism Financing; and b) the business model of the PJK IKNB.
PJK IKNB needs to consider the business model, scale of business, number of branches, and number of employees as inherent risk factors internally within the PJK IKNB.
Determination of Risk Scale
a) After identifying and documenting inherent risk, PJK IKNB needs to assign a scale to each risk. b) Risk scales are formulated considering the characteristics and complexity of business activities. c) For business activities with low characteristics and complexity, PJK IKNB may categorize risks into 2 (two) categories, namely low and high. d) For business activities with high characteristics and complexity, it is expected that risks can be categorized into several levels, for example medium, medium-high, or high. e) To determine the risk scale for each business activity, PJK IKNB can use the example risk separation as set forth in Appendix II, which forms an integral part of this Financial Services Authority Circular.
Every risk element identified as high risk must be mitigated and documented. PJK IKNB must be able to explain to the Financial Services Authority the mitigation steps for high-risk elements, for example steps in policies and procedures or training programs.
PJK IKNB must also be able to demonstrate to the Financial Services Authority that these risk mitigation steps have been implemented effectively, for example shown through internal audit results or independent audit results.
To assist PJK IKNB in conducting risk assessment evaluation, PJK IKNB can use the likelihood and impact matrix as set forth in Appendix III, which forms an integral part of this Financial Services Authority Circular.
In conducting the identification stage of inherent risk, PJK IKNB must be able to explain the entire risk identification process conducted by the PJK IKNB and the reasons or considerations.
PJK IKNB must provide documented information showing that the PJK IKNB has specifically paid attention to high-risk indicators in its risk assessment.
b. Determining Risk Tolerance
Risk tolerance is the maximum level and type of risk established by the PJK IKNB. Risk tolerance is an elaboration of the level of risk to be taken (risk appetite).
Risk tolerance is an important component of effective risk management.
Before considering risk mitigation, PJK IKNB must establish risk tolerance.
When considering threats, the concept of risk tolerance will enable the PJK IKNB to determine the level of risk threat that can be tolerated by the PJK IKNB.
In establishing risk tolerance, PJK IKNB needs to consider the following risk categories that can affect the PJK IKNB, including among others:
a) regulatory risk; b) reputational risk; c) legal risk; and d) financial risk.
c. Risk Reduction and Control Measures
Risk mitigation is the application of internal controls to limit Money Laundering and Terrorism Financing risks identified in conducting risk assessment. Risk mitigation will help ensure that PJK IKNB business activities remain within the risk tolerance limits established by the PJK IKNB. In cases where risk assessment results show that the PJK IKNB has a high risk level, the PJK IKNB must develop written risk mitigation strategies (consisting of policies and procedures to mitigate high risk) and apply them to high-risk areas or business relationships as identified.
Internal controls and risk mitigation in high-risk areas or business relationships are based on risk tolerance and risk acceptance (risk appetite). It is expected that internal controls and risk mitigation will be commensurate with the risks identified by the PJK IKNB.
In all situations, PJK IKNB business activities must consider internal controls that will influence the mitigation of all identified risks.
In risk assessment, all high-risk areas identified as part of the risk assessment must be mitigated with internal controls or other steps, and well documented.
For all customers and business relationships, PJK IKNB must:
a) monitor all business relationships; and b) document related information and steps taken.
For high-risk customers and business relationships, PJK IKNB must:
a) conduct more frequent monitoring of those business relationships; and b) take stricter steps in identification and data updating.
With risk mitigation activities, PJK IKNB is expected to:
a) update and maintain customer and beneficial owner information; b) establish and conduct continuous monitoring activities at every level of PJK IKNB business relationships (for low-risk customers conducted periodically and for high-risk customers conducted more frequently); c) implement mitigation for high-risk areas. This risk mitigation strategy must be stated in policies and procedures; and d) consistently apply internal control procedures. d. Evaluation of Residual Risk
Residual risk is the risk remaining after the application of internal controls and risk mitigation. PJK IKNB needs to pay attention that no matter how tight the risk mitigation and risk management of the PJK IKNB are, the PJK IKNB will still have residual risk that must be managed well.
Residual risk must be in accordance with the established risk tolerance. PJK IKNB must ensure that residual risk is not greater than the risk tolerance established by the PJK IKNB. In the event that residual risk is still greater than risk tolerance, or in the event that internal controls and mitigation for high-risk areas are inadequate, the PJK IKNB is required to repeat risk reduction and control measures, as referred to in letter c, and increase the level or quantity of established mitigation steps.
Characteristics of residual risk are:
a) risk has been tolerated/accepted:
In this risk, the risk remains even though it has been tolerated. Acceptance of tolerated risk means there is no benefit in reducing the risk. However, the tolerated risk can increase over time. For example, when there is a new product or when a new Money Laundering and Terrorism Financing threat occurs. b) risk has been mitigated:
In this risk, the risk remains even though it has been mitigated. This risk has been reduced, but cannot be eliminated. In practice, established internal controls may not be applicable (for example, monitoring systems or transaction monitoring processes fail, causing some transactions not to be reported).
With evaluation activities regarding residual risk, PJK IKNB is expected to:
a) evaluate the residual risk owned; and b) adjust the level of risk owned to the tolerated/accepted risk. e. Implementation of the Risk-Based Approach
After the PJK IKNB conducts risk assessment, the PJK IKNB must apply the risk-based approach to daily business activities/operations. Even with the risk-based approach, existing obligations, such as identification, verification, and monitoring, must still be performed as minimum requirements.
The risk-based approach owned by the PJK IKNB must be documented to demonstrate the compliance level of the PJK IKNB. Policies and procedures related to the risk-based approach must be communicated, understood, and complied with by all employees, particularly employees conducting customer data and information identification and maintenance, as well as transaction reporting to relevant authorities. PJK IKNB must provide sufficient information to process and complete transactions, in accordance with the identification and maintenance of customer data and information as required.
Procedures and policies of the risk-based approach must meet the following minimum requirements:
a) customer identification; b) risk assessment; c) special actions for high-risk areas; d) record keeping; and e) reporting.
Policies and procedures in the risk-based approach also cover matters related to the detection of suspicious transactions and the determination of monitoring types adjusted to the risk level of customers or business relationships, as well as monitoring aspects from the frequency, implementation methods, and evaluation of monitoring results.
PJK IKNB needs to conduct periodic monitoring of all business relationships conducted, and of high-risk business relationships regarding Money Laundering and Terrorism Financing. PJK IKNB applies stricter special steps for high-risk customers or business relationships.
PJK IKNB needs to pay attention that in risk management and risk mitigation, leadership and involvement of senior officials are required. Senior officials are responsible for decision-making related to policies, procedures, and internal control processes and risk mitigation for Money Laundering and Terrorism Financing in the business activities/operations owned by the PJK IKNB.
With the risk-based approach, PJK IKNB is expected to:
a) ensure that the risk assessment conducted describes the risk-based approach process, the frequency of monitoring low-risk and high-risk customers, and also describes the internal control steps implemented to reduce identified high risks; b) apply the risk-based approach; c) update data and information for customers and beneficial owners; d) monitor all owned business relationships; e) conduct more frequent monitoring of high-risk business relationships related to Money Laundering and Terrorism Financing; f) take specific steps for high-risk customers; and/or g) involve senior officials in facing situations or high-risk areas (for example, for PEPs, approval to conduct business relationships is given by senior officials). f. Review and Evaluation of the Risk-Based Approach
The risk assessment owned by the PJK IKNB must be reviewed based on the need to test the effectiveness of the implementation compliance of the AML/CFT program, which includes:
a) policies and procedures, b) risk assessment related to Money Laundering and Terrorism Financing; and c) human resource training programs (for employees and senior officials).
In the event of changes in business activity structure and the offering of new products and services, updates to the risk assessment must be conducted for

policies and procedures, mitigation steps, and internal controls.

Review of risk assessments related to Money Laundering and Terrorism Financing must cover all elements including policies and procedures regarding risk assessment, risk mitigation, and more intensive continuous monitoring. Reviews can help Non-Bank Financial Institutions (PJK IKNB) in evaluating the refinement of existing policies and procedures, or for the formation of new policies and procedures. Identified risks may change or develop alongside the development of new products or the emergence of new threats to business activities. Ultimately, the review procedures mentioned will affect the effectiveness of the implementation of the risk-based approach.
With the review of the risk-based approach, PJK IKNB is expected to:

a) conduct reviews according to the needs of the PJK IKNB or in the event of changes in business models, new portfolio acquisitions, and so on;

b) produce reviews that cover compliance with policies and procedures, risk assessments for Money Laundering and Terrorism Financing, and training programs to test the effectiveness of the risk-based approach;

c) document the review process and report to senior officials; and

d) document the results of the review along with the establishment of corrective measures to be followed up.

III. ACTIVE OVERSIGHT BY THE BOARD OF DIRECTORS AND BOARD OF COMMISSIONERS

Active Oversight by the Board of Directors

Active oversight by the Board of Directors must at least include:

a. ensuring that the PJK IKNB has policies and procedures for the implementation of the APU and PPT program;

b. proposing written strategic policies and procedures regarding the implementation of the APU and PPT program to the Board of Commissioners, which must at least contain:

background for the formulation of written policies and procedures;
structure, duties, authorities, and responsibilities of the working unit or person in charge of implementing the APU and PPT program;
policies and procedures for the implementation of the APU and PPT program;
oversight of the implementation of the APU and PPT program; and
internal control plan based on oversight results;

c. ensuring that the APU and PPT program is implemented in accordance with the established written policies and procedures;

d. forming a special working unit and/or appointing officials responsible for the implementation of the APU and PPT program;

e. conducting oversight on the compliance of working units in implementing the APU and PPT program, including monitoring the execution of duties by the Special Working Unit (UKK) and/or officials responsible for the implementation of the APU and PPT program;

f. ensuring that written policies and procedures regarding the implementation of the APU and PPT program align with changes and developments in products, services, and technology in the financial services sector and are in accordance with the development of Money Laundering and/or Terrorism Financing modus operandi, and can be applied in various situations;

g. ensuring that all employees, particularly employees from relevant working units and new employees, have participated in periodic training related to the implementation of the APU and PPT program, including scheduling training;

h. being responsible for policies, oversight, and procedures for the management and mitigation of Money Laundering and Terrorism Financing risks;

i. providing technical approval for policies, oversight, and procedures for the management and mitigation of Money Laundering and Terrorism Financing risks related to the technical execution of the Board of Directors' duties; and

j. in supporting the effectiveness of the implementation of the APU and PPT program, the Board of Directors must:

have adequate understanding of the Money Laundering and Terrorism Financing risks inherent in all operational activities of the PJK IKNB so that the Board of Directors is able to take necessary actions according to the PJK IKNB's risk profile;
provide clear direction on policies, oversight, and procedures for the management and mitigation of Money Laundering and Terrorism Financing risks; and
actively conduct oversight and risk mitigation, specifically customer risk, country/geographic area/jurisdiction risk, product/service/transaction risk, and distribution network (delivery channels) risk.

Active Oversight by the Board of Commissioners

Active oversight by the Board of Commissioners must at least include:

a. providing approval for policies and procedures for the implementation of the APU and PPT program proposed by the Board of Directors;

b. conducting oversight on the Board of Directors' execution of responsibilities regarding the implementation of the APU and PPT program;

c. ensuring that discussions related to Money Laundering and/or Terrorism Financing take place in Board of Directors and Board of Commissioners meetings by agenda-setting the discussion of the APU and PPT implementation program in Board of Commissioners meetings with the Board of Directors;

d. being responsible for policies, oversight, and procedures for the management and mitigation of Money Laundering and Terrorism Financing risks;

e. providing strategic approval for policies, oversight, and procedures for the management and mitigation of Money Laundering and Terrorism Financing risks related to policies, oversight, and procedures that are significant and fundamental in the implementation of the APU and PPT program; and

f. in supporting the effectiveness of the implementation of the APU and PPT program, the Board of Commissioners must:

have understanding regarding the risks faced by the PJK IKNB, especially customer risk, country/geographic area/jurisdiction risk, product/service/transaction risk, and distribution network (delivery channels) risk; and
ensure that the organizational structure is adequate for the implementation of the APU and PPT program.

Person in Charge of Implementing the APU and PPT Program

a. Based on considerations of operational workload and business complexity, the PJK IKNB forms a Special Working Unit (UKK) and/or appoints an official responsible for the implementation of the APU and PPT program at the headquarters and at branches or offices outside the headquarters.

b. In carrying out their duties, the UKK and/or the official responsible for the implementation of the APU and PPT program reports to and is responsible to the Board of Directors that oversees the compliance function, risk management function, or one of the Board of Directors members related to the implementation of the APU and PPT program.

c. So that the duties of the UKK and/or the official responsible for the implementation of the APU and PPT program can be carried out well, the PJK IKNB must have adequate working mechanisms, and be carried out by each relevant working unit while paying attention to regulations regarding anti-tipping off and information confidentiality.

d. The UKK and/or the official responsible for the implementation of the APU and PPT program must meet the following criteria:

independent from the activities being monitored;
able to provide information needed by the Board of Directors to obtain a picture of the PJK IKNB's condition regarding risk management and compliance; and
have appropriate and unrestricted access to customer identification documents, registered accounts, other accounting records, and other related information.

e. The UKK must consist of at least 1 (one) person acting as the leader and 1 (one) person acting as the executor.

f. In the event that the PJK IKNB appoints an official responsible for the implementation of the APU and PPT program at the headquarters, the official responsible must be an official or employee at the lowest level below the Board of Directors.

g. In the event that the PJK IKNB appoints an official responsible for the implementation of the APU and PPT program at a branch or office outside the headquarters, the official responsible must be an official or employee at the lowest level equivalent to a supervisor.

h. For branches or offices outside the headquarters, with high business complexity and containing only working units related to customers, the official or employee responsible for the implementation of the APU and PPT program may:

originate from the headquarters or regional office with special duties and responsibilities to oversee the implementation of the APU and PPT program at several specific branches; or
be held concurrently by an employee from a working unit not related to customers (non-operational) at other branches, such as the risk management working unit. Concurrent holding of positions is permitted considering that the working unit implementing the APU and PPT program's policies and procedures is separate from the working unit overseeing its implementation.

i. For branches or offices outside the headquarters, with low business complexity, the official or employee responsible for the implementation of the APU and PPT program may be held concurrently by an employee from a working unit related to customers (operational), provided that such operational duties do not affect the independence and professionalism of the employee in carrying out their duties.

j. The UKK and/or the official responsible for the implementation of the APU and PPT program at branches or offices outside the headquarters for the PJK IKNB is assisted by the head of the office in the implementation of the APU and PPT program at offices outside the headquarters.

IV. POLICIES AND PROCEDURES

PJK IKNB is required to have policies and procedures to manage and mitigate Money Laundering and/or Terrorism Financing risks identified according to risk assessments.
The policies and procedures for the implementation of the APU and PPT program must at least include:

a. customer identification and verification;

b. beneficial owner identification and verification;

c. termination of business relationships or rejection of transactions;

d. continuous management of Money Laundering and/or Terrorism Financing risks related to customers, countries/geographic areas/jurisdictions, products/services/transactions, or distribution networks (delivery channels);

e. maintenance of accurate data related to transactions, documentation of the customer due diligence process, and documentation of policies and procedures;

f. updating and monitoring;

g. reporting to senior officials, the Board of Directors, and the Board of Commissioners regarding the implementation of policies and procedures for the APU and PPT program; and

h. reporting to the Financial Transaction Reports and Analysis Center (PPATK).

Identification and verification of prospective customers, customers, and beneficial owners consists of:

a. Customer Due Diligence (CDD) Policy

Customer Due Diligence (CDD) is an activity involving identification, verification, and monitoring conducted by the PJK IKNB to ensure transactions align with the profile, characteristics, and/or transaction patterns of prospective customers or customers.
PJK IKNB is required to conduct CDD procedures at the time:

a) establishing a business relationship with a prospective customer;

b) there is a financial transaction in Rupiah and/or foreign currency with a value of at least or equivalent to Rp100,000,000.00 (one hundred million Rupiah);

c) there are indications of suspicious financial transactions related to Money Laundering and/or Terrorism Financing; or

d) the PJK IKNB doubts the accuracy of information provided by prospective customers, customers, authorized representatives, and/or beneficial owners.

CDD with a risk-based approach is intended to obtain up-to-date information regarding customer profiles to ensure alignment between customer profiles and transactions conducted. CDD can be conducted on all information or only on part of the information.
In the event that the PJK IKNB assesses that there is a change in the customer's risk level, CDD based on the risk-based approach can be conducted again if:

a) there is a significant increase in transaction value;

b) there is a significant change in the customer's profile;

c) information in the available customer identification file (CIF) is not yet supplemented with documents for verification; and/or

d) using anonymous accounts or accounts using fictitious names.

b. Prospective Customer Acceptance and Identification Procedures

PJK IKNB must have policies regarding the acceptance and identification of prospective customers that must at least cover the following:

requests for information regarding prospective customers;
requests for identity proof and supporting information from prospective customers;
investigation into the authenticity of supporting identity documents for prospective customers;
requests for more than one identity card for prospective customers issued by competent authorities, if there is doubt about the existing identity card;
if necessary, interviews with prospective customers may be conducted to obtain assurance regarding the accuracy of information, identity proof, and supporting documents for prospective customers;
prohibition on opening or maintaining anonymous accounts or accounts using fictitious names;
face-to-face meetings with prospective customers at the beginning of establishing a business relationship to assure the authenticity of the prospective customer's identity;
caution regarding transactions or business relationships with prospective customers originating from or related to countries that are not adequate in implementing FATF recommendations; and
the process of verifying the identity of prospective customers must be completed before establishing a business relationship with prospective customers.

c. Beneficial Owner Identification Procedures

If a prospective customer represents a beneficial owner to establish a business relationship or conduct a transaction, the PJK IKNB must conduct CDD procedures on the beneficial owner with the same strictness as CDD procedures for prospective customers.
In the event that the beneficial owner is classified as a Politically Exposed Person (PEP), the procedure applied is stricter CDD procedures or Enhanced Due Diligence (EDD).
In identifying prospective corporate customers, the PJK IKNB must determine the beneficial owner.
For beneficial owners that are state institutions or government agencies, companies with majority state-owned shares, or public companies/issuers, there is no requirement to submit documents and/or identity of the ultimate controller.
Exceptions to the requirement to submit documents and/or identity of the beneficial owner's ultimate controller must be documented.
If the PJK IKNB doubts or cannot verify the identity of the beneficial owner, the PJK IKNB must refuse to establish a business relationship or conduct transactions with the prospective customer.
For prospective customers or beneficial owners whose business relationships or transactions are rejected, the PJK IKNB must obtain at least the name, identity number, address, and place and date of birth according to copies of identity documents obtained by the PJK IKNB for the purpose of reporting Suspicious Financial Transaction Reports (LTKM).

d. Verification of Prospective Customers, Customers, and Beneficial Owners

PJK IKNB must investigate the accuracy of information provided by prospective customers by verifying supporting documents based on documents and/or other independent sources and ensuring the currency of such information.
In order to assure the authenticity of the prospective customer's identity, verification is conducted by:

a) face-to-face meetings with prospective customers at the beginning of establishing a business relationship;

b) conducting interviews with prospective customers if necessary;

c) matching the prospective customer's profile with the self-photo contained in the identity card;

d) matching signatures, thumbprints, or fingerprints with identity documents or other documents containing signatures, thumbprints, or fingerprints. Other documents include, among others, prospective customer declaration letters, family cards, or credit cards;

e) requesting prospective customers to provide more than one identity document issued by competent authorities if there is doubt about the existing identity card;

f) documenting copies of identity cards after matching with original valid documents;

g) conducting cross-checks to ensure consistency of various information provided by prospective customers. Cross-checks are conducted by methods including:

i. contacting prospective customers via telephone (home or office);

ii. contacting human resources officials at the place where the prospective customer works if the prospective customer is an employee of a company or agency;

iii. confirming the prospective customer's income by requiring bank statements from banks or other financial service providers; or

iv. conducting geographic information analysis to view forest conditions through remote sensing technology for prospective corporate customers operating in the forestry sector;

h) ensuring that prospective customers do not have negative records by verifying the identity of prospective customers using other independent sources including:

i. terrorist lists and/or suspected terrorist lists and terrorist organizations issued by the Indonesian National Police;

ii. national blacklists (DHN); or

iii. other data owned by the PJK IKNB, prospective customer employer identities, telephone accounts, and electricity accounts; and/or

i) ensuring the possibility of unusual or suspicious circumstances.

Verification through face-to-face meetings, as referred to in item 2 letter a), can be replaced with verification via electronic means, with the following requirements:

a) what you have, namely identity documents owned by the prospective customer, namely the Electronic Identity Card (KTP);

b) what you are, namely biometric data such as the prospective customer's fingerprints.

The process of verifying the identity of prospective customers and beneficial owners must be completed before establishing a business relationship with prospective customers.
In certain conditions, the verification process can be completed after the business relationship has been established.

Certain conditions as referred to in item 5) are:

a) document completeness cannot be met at the time the business relationship is to be established, for example because documents are still being processed. Therefore, prospective customers may submit documents after establishing a business relationship, within the timeframe established by the PJK IKNB; and/or

b) if the risk level of individual prospective customers is classified as low.

e. Simplified Customer Due Diligence (Simplified CDD)

In the event that the PJK IKNB assesses that the risk of prospective customers or customers is very low or for transactions where the risk of Money Laundering or Terrorism Financing occurrence is low, the PJK IKNB may apply Simplified CDD.
PJK IKNB must document customers receiving Simplified CDD treatment in a list containing information regarding the reasons for risk determination so that they are classified as low risk.
Customers who have received Simplified CDD treatment must be removed from the Simplified CDD customer list if they meet the following criteria:

a) indicated to be related to Money Laundering or Terrorism Financing; or

b) inconsistent with the initial purpose of account opening, such as for payment or salary receipt.

Customers removed from the Simplified CDD customer list as referred to in item 3) must:

a) undergo CDD or EDD according to the customer's current risk level; and/or

b) be reported in Suspicious Financial Transaction Reports (LTKM) if transactions are indicated to be related to Money Laundering or Terrorism Financing.

f. Third-Party Customer Due Diligence

PJK IKNB may use the results of CDD conducted by third parties on prospective customers who have already become customers of that third party.
In the event that the PJK IKNB uses the results of third-party CDD as referred to in paragraph (1), the PJK IKNB is required to:

a. understand the purpose and intent of the business relationship; and

b. identify and verify customers and beneficial owners.

In the event that the PJK IKNB uses the results of CDD conducted by third parties, the responsibility for CDD remains with the PJK IKNB.
In the event that the PJK IKNB uses third-party CDD:

a. PJK IKNB is required to obtain the necessary information related to CDD procedures as soon as possible;

b. PJK IKNB is required to have cooperation with third parties in the form of written agreements;

c. PJK IKNB is required to take adequate steps to ensure that third parties are willing to fulfill information requests and copies of supporting documents immediately if needed by the PJK IKNB in the implementation of the APU and PPT program;

d. PJK IKNB is required to ensure that the third party is a financial institution and provider of goods and/or services and specific professions that have CDD procedures and are subject to oversight by competent authorities in accordance with applicable laws and regulations; and

e. PJK IKNB is required to pay attention to information regarding the country risk where the third party originates.

PJK IKNB ensures that the third party is in a country that complies with FATF standards; and
Third-party CDD does not apply to agency relationships or outsourcing.

g. Enhanced Due Diligence (EDD)

PJK IKNB is required to conduct assessments to determine if prospective customers, customers, or beneficial owners are PEPs.
In the event that the PJK IKNB assesses that prospective customers, customers, and beneficial owners are high-risk, including PEPs, then the PJK IKNB applies EDD.
EDD as referred to in item 2) is implemented by verifying information on prospective customers, customers, or beneficial owners, including PEPs, based on the accuracy of information, accuracy of information sources, and types of information related.
Verification of information in the implementation of EDD as referred to in item 3) can be conducted by methods including:

a) searching for additional information about the relevant customer and updating customer or beneficial owner identity data;

b) searching for additional information regarding the nature and purpose of the business relationship;

c) searching for additional information regarding the source of funds or customer wealth;

d) searching for additional information regarding the reasons for the intended or conducted transactions;

e) request approval from senior officials to initiate or continue such business relationships; and/or f) conduct increasingly stringent monitoring of such business relationships, namely by increasing the number and duration of supervision used, and having transaction patterns that require further examination.

Non-Bank Financial Institutions (PJK IKNB) must account for documents related to Enhanced Due Diligence (EDD) and periodically update customer data according to the needs and complexity of the PJK IKNB.
In carrying out business relationships with prospective customers, customers, or beneficial owners, including Politically Exposed Persons (PEPs), who receive EDD treatment, PJK IKNB must appoint a senior official as the person responsible for such business relationship.

Rejection of Transactions and Closure of Business Relationships

PJK IKNB shall reject transactions or close business relationships with prospective customers or customers in the event:
a) the prospective customer or customer is unwilling to provide information and/or complete documents required by PJK IKNB; b) the prospective customer or customer provides information and/or documents that are inconsistent or reasonably suspected to be forged documents or information whose truthfulness is doubtful; and/or c) the source of funds for the transaction held by the prospective customer or customer is known and/or reasonably suspected to originate from the proceeds of crime; and/or d) the prospective customer or customer is listed in the terrorist list and/or the list of suspected terrorists and terrorist organizations.
PJK IKNB is required to notify the customer in writing regarding the closure of the business relationship.
Written notification can be done by sending a letter addressed to the customer according to the address recorded in the PJK IKNB database or announced through print media, electronic media, or other media.
In the event that written notification has been carried out and the customer does not withdraw the remaining funds stored at PJK IKNB, then the settlement of the customer's remaining funds is carried out in accordance with applicable legislation, including by handing over the remaining funds to the Estate Administration Office (Balai Harta Peninggalan).
PJK IKNB must document prospective customers or customers subject to transaction rejection or business relationship closure as referred to in item 1) in a separate list.

Management of Ongoing Money Laundering and/or Terrorism Financing Risks Related to Customers, Countries/Geographical Areas/Jurisdictions, Products/Services/Transactions, or Distribution Networks (Delivery Channels)

a. PJK IKNB implements policies, procedures, and controls to reduce the potential for Money Laundering and Terrorism Financing, especially related to customers, countries/geographical areas/jurisdictions, products/services/transactions, or distribution networks (delivery channels) that may pose higher risks.

b. Controls and mitigations that can be applied include at least:

developing systems to identify and monitor higher customer risks and transactions throughout all business activities of PJK IKNB;
upgrading Customer Due Diligence (CDD) to EDD carried out in conjunction with the PJK IKNB's increasing understanding of the customer, the source of funds used to purchase products/services/transactions, and customer behavior in purchasing products and services;
escalation or hierarchical approval for opening business relationships or transactions through senior official approval;
increased transaction monitoring (frequency, thresholds, volume, etc.); and
increasing the frequency of supervision and conducting continuous reviews of business relationships.

Maintenance of Accurate Data Related to Transactions, Accounting of the CDD Process, and Accounting of Policies and Procedures

a. PJK IKNB must account for all transaction data or documents obtained through CDD steps conducted both domestically and internationally for at least 5 (five) years. This is an effort to assist authorities in conducting investigations into funds indicated to originate from criminal proceeds or to assist in the execution of duties by competent authorities. Thus, documents owned or stored by PJK IKNB must be sufficient as aids for reconstructing individual transactions (including the amount and type of currency used, if any) so that they can serve as evidence (if necessary) in prosecuting criminal activities.

b. The retention period for documents is as follows:

documents related to customer data for a period of at least 5 (five) years from:
a) the end of the business relationship with the customer; and/or b) the discovery of transaction inconsistencies with economic purposes and/or business purposes;
documents related to customer financial transactions for a period as regulated in laws regarding corporate documents; and
documents accounted for must at least include:
a) customer identity including supporting documents, such as copies or recordings of customer identity documents in the form of identity cards, driver's licenses, passports, or other documents; b) transaction information including but not limited to the type and amount of currency used, the date of the transaction order, the origin and destination of the transaction, and the account number related to the transaction; c) the results of analysis that have been conducted; and d) correspondence with customers, including account files and business correspondence, including the results of analysis conducted through investigations carried out to ensure the background and purpose of large, complex, and unusual transactions.

c. PJK IKNB is required to provide data, information, and/or documents that have been accounted for when requested by the Financial Services Authority (OJK) and/or other competent authorities.

Monitoring and Updating

a. Monitoring

The level and nature of monitoring conducted by PJK IKNB will depend on the characteristics of PJK IKNB, business complexity, and the level of Money Laundering and Terrorism Financing risk held by PJK IKNB.
PJK IKNB must conduct monitoring activities at least:
a) conducted continuously to identify the consistency between customer transactions and customer profiles and account for such documents, especially regarding business relationships or transactions with customers and/or PJK IKNB from countries with inadequate AML/CFT programs; b) conducting analysis of all transactions that are inconsistent with customer profiles; and c) if necessary, requesting information about the background and purpose of transactions that are inconsistent with customer profiles, paying attention to anti-tipping off regulations as regulated in laws regarding the prevention and eradication of Money Laundering.
Continuous monitoring of customer profiles and transactions includes activities:
a) ensuring the completeness of customer information and documents; b) examining the consistency between transaction profiles and customer profiles; and c) examining name similarities or matches with names recorded in:
i. terrorist database;
ii. lists of suspected terrorists and terrorist organizations;
iii. names of suspects or defendants published in mass media or by competent authorities; and
iv. national blacklist (DHN).
Information sources that can be used to monitor customers designated as suspects or defendants can be obtained from, among others:
a) databases issued by competent authorities such as the Center for Reporting and Analysis of Financial Transactions (PPATK); or b) mass media, such as newspapers, magazines, television, and the internet.
PJK IKNB must classify transactions and customers requiring special monitoring. Monitoring of customer accounts must be stricter if there are high-risk customers.
All monitoring activities must be well documented in written form through formal documents such as memos, notes, or records, as well as through informal documents such as email correspondence.

b. Data Updating

PJK IKNB must apply CDD procedures to its customers for data updating, to update data materiality and risk. CDD can be conducted by considering the timing of previous CDD implementation and the adequacy of data obtained.
PJK IKNB must update data regarding information and documents as referred to in Financial Services Authority regulations regarding the implementation of AML/CFT programs in the financial services sector and account for them.
PJK IKNB must ensure that documents, data, or information collected in the CDD process are always updated and relevant by re-examining existing data, especially those related to high-risk customers.
PJK IKNB must update customer data so that the identification and monitoring of suspicious financial transactions can run effectively.
Customer data updating is conducted using a risk-based approach. In the event that PJK IKNB's resources are limited, data updating activities are conducted on a priority scale.
Parameters for determining priority scales as referred to in item 5) include, among others:
a) high customer risk level; b) transactions with significant amounts and/or deviating from transaction profiles or customer profiles (red flag); c) significant changes in balance values; and/or d) information in the Customer Identification File (CIF) is not in accordance with Financial Services Authority regulations regarding the implementation of AML/CFT programs in the financial services sector.
Data updating is conducted periodically according to the characteristics and complexity of PJK IKNB's business activities.
Implementation of data updating for customers listed in the data updating plan can be conducted, among others, at:
a) the opening of additional business relationships; b) the extension of the use of PJK IKNB products/services/transactions; c) the replacement of customer data and identity documents; or d) the closure of business relationships.
All data updating activities must be administered.
In the event that a customer to be updated was a customer before the Financial Services Authority regulations regarding the implementation of AML/CFT programs in the financial services sector took effect, PJK IKNB must notify the customer in writing regarding PJK IKNB's obligation to reject transactions and/or close business relationships as stated in Section IV item 4.

Reporting to Senior Officials, Board of Directors, and Board of Commissioners Regarding the Implementation of AML/CFT Program Policies and Procedures

a. In the event that the CDD process shows prospective customers or customers categorized as high-risk, PJK IKNB employees conducting CDD must report to Senior Officials. Senior Officials are responsible for the acceptance and/or rejection of business relationships with high-risk prospective customers or customers.

b. In the event that senior officials approve business relationships with high-risk customers, senior officials are responsible for monitoring the transactions of high-risk customers.

c. Senior Officials must report to the Board of Directors overseeing the AML/CFT program implementation regarding the number of high-risk prospective customers or customers, including the number of high-risk customers rejected, accepted, or having their business relationships closed.

d. The Board of Directors must provide guidance on reports submitted by senior officials and establish risk mitigation steps.

e. The Board of Directors reports to the Board of Commissioners regarding the results of monitoring the overall implementation of the AML/CFT program as per the written policies and procedures established by PJK IKNB.

f. The Board of Directors may propose updates to policies and procedures in the event of risk developments that need to be mitigated by PJK IKNB, which are not yet included in the written policies and procedures.

Reporting to the Center for Reporting and Analysis of Financial Transactions (PPATK)

a. PJK IKNB is required to submit Suspicious Financial Transaction Reports (LTKM), Cash Financial Transaction Reports (LTKT), and other reports to the Center for Reporting and Analysis of Financial Transactions (PPATK) as regulated in legislation governing the prevention and eradication of Money Laundering crimes.

b. In the event that PJK IKNB finds indications of cash financial transactions involving the carrying of cash and other payment instruments into or out of the territory of the Republic of Indonesia, including land, waters, and airspace above it, as well as specific zones that are exclusive economic zones and continental shelves where customs laws apply.

c. PJK IKNB must submit other reports regarding the implementation of the AML/CFT program in the event of information requests from the Center for Reporting and Analysis of Financial Transactions (PPATK).

V. INTERNAL CONTROL

Effective risk-based AML/CFT program implementation must be implemented in internal control and internalized into the PJK IKNB culture.
Senior officials are responsible for ensuring that PJK IKNB has an effective internal control structure, including for monitoring and reporting suspicious financial transactions.
Senior officials must create a risk management and compliance culture, ensuring that employees comply with policies and procedures aimed at limiting and controlling risks.
In addition to internal control compliance, the implementation of the AML/CFT program is also influenced by the following factors:
a. the scale and complexity of PJK IKNB; b. the diversity of business or operational activities of PJK IKNB, including the diversity of countries/geographical areas/jurisdictions, customers, products/services/transactions, and PJK IKNB's overall transaction activities;
c. distribution networks (delivery channels) used;
d. transaction volume and scale; e. the level of risk assessment for each business activity of PJK IKNB; and/or f. the relationship between PJK IKNB and customers, either directly or through intermediaries, third parties, correspondents, or non-face-to-face communication.
PJK IKNB must have an internal control framework including:
a. the appointment of a Unit of Compliance (UKK) and/or officials responsible for managing the implementation of the AML/CFT program; b. special monitoring of operational activities with potential high risks, including monitoring of areas deemed vulnerable and potentially related to suspicious transactions or requiring special attention based on suggestions and information from industry associations, regulators, or law enforcement;
c. providing regular reviews of risk assessments and management processes considering the location where PJK IKNB operates;
d. ensuring adequate controls before offering new products/services/transactions or when there are offers of modified products/services/transactions that potentially increase Money Laundering and Terrorism Financing risks; e. the rapid and accurate dissemination of information in the event of indications and/or suspicions related to Money Laundering and Terrorism Financing risks, improvement steps taken, results of identifying weaknesses in existing regulations, action plans for improvement, and reports submitted to competent authorities; f. focusing on the collection of information regarding legal regulations, reporting requirements, and recommendations regarding compliance with the implementation of the AML/CFT program and updating changes in regulations; g. implementing policies, procedures, and controls over Customer Due Diligence (CDD); h. providing adequate controls for high-risk customers, transactions, and products, such as transaction limits or management approval;
i. providing adequate supervision of PJK IKNB employees who complete reports, receive grants, monitor suspicious activities, or are involved in other activities that are part of the AML/CFT program implementation;
j. integrating compliance with the implementation of the AML/CFT program into job descriptions and appropriate performance evaluations; k. providing appropriate and relevant training related to the AML/CFT program for all employees;
l. for business groups, having a joint control framework; and
m. testing the effectiveness of the AML/CFT program implementation by taking random samples and documenting the tests conducted.

VI. MANAGEMENT INFORMATION SYSTEM

The implementation of the AML/CFT program must be supported by a management information system that can effectively identify, analyze, monitor, and provide reports on customer transaction characteristics using parameters adjusted periodically and considering business complexity, transaction volume, and PJK IKNB's risks.
Written policies and procedures owned by PJK IKNB must consider information technology factors that have the potential to be abused by Money Laundering or Terrorism Financing perpetrators, such as account opening via the internet, drafts, or fund transfer orders via fax or telephone, and other electronic transactions.
The owned information system must allow PJK IKNB to trace each individual transaction, both for internal and/or Financial Services Authority purposes, as well as in relation to judicial cases.
To facilitate monitoring for the analysis of suspicious financial transactions, PJK IKNB is required to have and maintain an integrated customer profile (single customer identification file/single CIF).
Information contained in the single CIF covers all products and services used by customers at a PJK IKNB, such as vehicle insurance, life insurance, home ownership insurance, and unit link insurance.
For joint accounts, the CIF is created for each party owning the joint account. For example, a joint account in the names of A and B, the CIF created is 2 (two) CIFs, namely CIFs in the names of A and B, informing that both A and B have a joint account.
For the maintenance of the single CIF, PJK IKNB must establish a policy that for every addition of accounts and/or services or products of PJK IKNB by existing customers, PJK IKNB must link the additional accounts, services, or products to the customer information number of the respective customer.

VII. HUMAN RESOURCES AND TRAINING

Human Resources
To prevent the use of PJK IKNB as a medium or goal for Money Laundering and/or Terrorism Financing involving internal parties, PJK IKNB is required to conduct:
a. screening procedures for the acceptance of new employees (pre-employee screening) as part of the implementation of Know Your Employee (KYE), with the following provisions:

screening methods are adjusted to the needs, business complexity of PJK IKNB, and PJK IKNB's risk profile;
screening methods must at least ensure that the prospective employee's profile has no criminal records, including requiring prospective employees to make statements and/or submit police record certificates (SKCK);
verifying the identity and education obtained by prospective employees;
ensuring whether prospective employees have bad debts;
ensuring the track record of prospective employees over a certain period, for example, the last 5 (five) years; and/or
conducting research through other information media.
b. introduction and monitoring of employee profiles, including employee behavior and lifestyle, including:
ensuring employees do not have bad debts;
conducting research via the internet;
verifying employees who have undergone significant lifestyle changes;
monitoring employee accounts;
ensuring that employees have understood and complied with the employee code of conduct; and/or
evaluating employees responsible for high-risk activities, including having access to PJK IKNB data, facing prospective customers or customers, and being involved in the procurement of goods and services.
c. Screening procedures (pre-employee screening), introduction, and monitoring of employee profiles must be written in the KYE policy guided by regulations governing the implementation of anti-fraud strategies.

Training
a. Training Participants

PJK IKNB is required to conduct continuous training on policies and procedures for the implementation of the AML/CFT program and the roles and responsibilities of employees in preventing and eradicating Money Laundering and/or Terrorism Financing crimes to all employees.
In determining training participants, PJK IKNB prioritizes employees whose daily tasks meet the following criteria:
a) direct interaction with customers (customer service); b) conducting supervision of the implementation of the AML/CFT program; or c) related to the preparation of reports to the Center for Reporting and Analysis of Financial Transactions (PPATK) and the Financial Services Authority.
Employees conducting supervision of the implementation of the AML/CFT program must receive continuous training, while other employees must receive training at least 1 (one) time during their employment. Employees who interact directly with customers (front liners) must receive training before placement.
b. Training Methods
Training can be conducted electronically (online based) or in person.
Electronic training (online based) can use e-learning media provided by competent authorities such as the Center for Reporting and Analysis of Financial Transactions (PPATK) or provided independently by PJK IKNB.
In-person training is conducted using approaches including:
a) interactive in-person (e.g., workshops) with training topics adjusted to participant needs. This approach is used for priority employees and conducted continuously, for example, every year; and/or b) one-way in-person (e.g., seminars) with training topics being general overviews of

Implementation of AML and CTF programs. This approach is provided to employees who do not receive priority and is conducted when there are significant changes in regulations.

c. Training Materials and Evaluation

Non-Bank Financial Institutions (PJK IKNB) may develop training materials related to the implementation of AML and CTF programs according to needs. Some topics that can be included in training materials include:

a) training on the implementation of regulations related to AML and CTF programs; b) trends and developments in the risk profile of financial sector products for training on techniques, methods, and typologies of Money Laundering or Terrorism Financing criminal offenses; and/or c) consequences if employees engage in tipping off, for training on policies and procedures for implementing AML and CTF programs, as well as the role and responsibilities of employees in preventing and eradicating Money Laundering or Terrorism Financing criminal offenses.

The depth of training materials is adjusted to the needs of employees and their suitability with their tasks and responsibilities.
To determine the level of employee understanding and the suitability of training materials, PJK IKNB must conduct an evaluation of each training session held.
Evaluations can be conducted directly through interviews or indirectly through tests.
PJK IKNB must take follow-up actions based on the results of training evaluations through the refinement of training materials and methods.

VIII. REPORTING

Action Plan Report

a. The action plan report must at least contain steps for the implementation of the AML and CTF program in order to comply with regulations of the Financial Services Authority (OJK) regarding the implementation of AML and CTF programs in the financial services sector, which must be implemented by PJK IKNB according to the time targets set for a specific period as established in the action plan, including among others:

adjustment of systems, agreements for opening business relationships, and risk mitigation related to the implementation of simplified CDD;
grouping of customers based on a risk-based approach;
improvement of infrastructure related to information technology;
preparation for building a single customer identification file (single CIF);
appointment of officials/employees to perform UKK functions in branches with high business complexity;
preparation of adequate human resources; and/or
adjustment of information technology for the implementation of the customer and beneficial owner data update program.

b. The action plan report must be approved and submitted by a Board Member who oversees the compliance function or one of the Board Members responsible for the implementation of the AML and CTF program.

c. In the event of changes to the action plan, policies, and procedures for implementing the AML and CTF program, PJK IKNB is required to submit changes to the data update activity plan previously submitted to the Financial Services Authority no later than 7 (seven) working days from the date the changes were made.

Report on Adjustments to Policies and Procedures for Implementing AML and CTF Programs

PJK IKNB that already has policies and procedures for implementing AML and CTF programs must submit a report on adjustments to these policies and procedures in accordance with the Financial Services Authority Regulation regarding the implementation of Anti-Money Laundering and Counter-Terrorism Financing Programs in the financial services sector no later than September 16, 2017.

Report on Data Update Activity Plan and Report on Data Update Activity Realization

a. The report on the data update activity plan and the report on data update activity realization must be approved and submitted by the Director overseeing the compliance function or one of the Board Members responsible for the implementation of the AML and CTF program.

b. Submission of the data update plan report in accordance with Financial Services Authority regulations regarding the implementation of Anti-Money Laundering and Counter-Terrorism Financing Programs in the financial services sector is conducted by the Director overseeing the compliance function or one of the Board Members responsible for the implementation of the AML and CTF program annually no later than the end of December.

c. Submission of the data update realization report in accordance with Financial Services Authority regulations regarding the implementation of Anti-Money Laundering and Counter-Terrorism Financing Programs in the financial services sector is conducted by the Director overseeing the compliance function or one of the Board Members responsible for the implementation of the AML and CTF program annually no later than the end of December.

d. Submission of the data update plan report as referred to in letter b for the first time must be submitted no later than the end of September 2017. Meanwhile, submission of the data update realization report as referred to in letter c for the first time must be submitted annually no later than the end of December 2017.

e. Changes to the data update activity plan report can be made as long as changes occur outside the control of PJK IKNB and must be submitted to the Financial Services Authority no later than 7 (seven) working days from the date the changes were made.

Procedure for Submitting Reports on the Implementation of AML and CTF Programs

a. PJK IKNB must submit reports on the implementation of AML and CTF programs signed by the Board, with the following conditions:

the cover letter for submitting the AML and CTF program implementation report signed by the Board must be submitted in computer printout form (hardcopy); and
the content of the AML and CTF program implementation report must be submitted in electronic form (softcopy).

b. Submission address for reports to DPLK:

Head of Executive Supervisor for Insurance, Pension Funds, Financing Institutions, and Other Financial Service Institutions Financial Services Authority attn: Director of Pension Fund Supervision Merdeka Tower Building, 22nd Floor Jl. Budi Kemuliaan I No. 2 Jakarta 10110

c. Submission address for reports for Financing Companies, PMV, and Infrastructure Financing Companies:

Head of Executive Supervisor for Insurance, Pension Funds, Financing Institutions, and Other Financial Service Institutions Financial Services Authority attn: Director of Financing Institution Supervision Merdeka Tower Building, 19th Floor Jl. Budi Kemuliaan I No. 2 Jakarta 10110

and for Financing Companies and PMV that have Sharia business units, submitted to:

Director of Sharia Non-Bank Financial Institutions Merdeka Tower Building, 23rd Floor Jl. Budi Kemuliaan I No. 2 Jakarta 10110

d. Submission address for reports for Pawnshop Companies and LPEI:

Head of Executive Supervisor for Insurance, Pension Funds, Financing Institutions, and Other Financial Service Institutions Financial Services Authority attn: Director of Special Financial Service Institution Supervision Merdeka Tower Building, 26th Floor Jl. Budi Kemuliaan I No. 2 Jakarta 10110

and for Pawnshop Companies that have Sharia business units, submitted to:

Director of Sharia Non-Bank Financial Institutions Merdeka Tower Building, 23rd Floor Jl. Budi Kemuliaan I No. 2 Jakarta 10110

e. Submission address for reports for Financing Companies, PMV, and Pawnshop Companies that conduct all business activities based on Sharia principles:

Head of Executive Supervisor for Insurance, Pension Funds, Financing Institutions, and Other Financial Service Institutions attn: Director of Sharia Non-Bank Financial Institutions Merdeka Tower Building, 23rd Floor Jl. Budi Kemuliaan I No. 2 Jakarta 10110

In the event of changes to the address of the Financial Services Authority Office for report submission as referred to in item 4, the Financial Services Authority will convey notification regarding the address change via letter or announcement.
Submission of reports for Insurance Companies, Sharia Insurance Companies, Insurance Brokerage Companies, and Insurance Companies that have Sharia business units is the submission of reports as referred to in the Financial Services Authority regulation regarding periodic reports of insurance companies.

This copy is in accordance with the original
Legal Director 1
Legal Department signed
Yuliana

IX. CLOSING

The provisions in this Circular Letter of the Financial Services Authority shall take effect on the date of determination.

Determined in Jakarta on July 17, 2017

HEAD OF EXECUTIVE SUPERVISOR
FOR INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY,

signed
FIRDAUS DJAELANI