Implementation of Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing Programs for Digital Financial Asset Traders

To:
The Board of Directors of Digital Financial Asset Traders,

ATTACHED

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY OF THE REPUBLIC OF INDONESIA NUMBER 16/SEOJK.07/2025

CONCERNING

THE IMPLEMENTATION OF ANTI-MONEY LAUNDERING, COUNTER-TERRORISM FINANCING, AND COUNTER-PROLIFERATION FINANCING PROGRAMS FOR DIGITAL FINANCIAL ASSET TRADERS

In light of the implementation of Financial Services Authority Regulation Number 27 of 2024 concerning the Conduct of Digital Financial Asset Trading Including Crypto Assets (State Gazette of the Republic of Indonesia Year 2024 Number 38/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 108/OJK) and to implement the provisions of Financial Services Authority Regulation Number 8 of 2023 concerning the Implementation of Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing Programs in the Financial Services Sector (State Gazette of the Republic of Indonesia Year 2023 Number 11/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 36/OJK), it is necessary to further regulate the implementation provisions regarding the procedures, reporting, and mechanisms for implementing anti-money laundering, counter-terrorism financing, and counter-proliferation financing programs for Digital Financial Asset Traders in this Financial Services Authority Circular as follows:

I. GENERAL PROVISIONS

In this Financial Services Authority Circular, the following terms are defined as:
a. Digital Financial Asset is a financial asset that is stored or represented digitally, including crypto assets. b. Crypto Asset is a digital representation of value that can be stored and transferred using technology that enables the use of distributed ledgers such as blockchain to verify transactions and ensure the security and validity of stored information, is not guaranteed by a central authority such as a central bank but is issued by private parties, can be traded, stored, and transferred or assigned electronically, and can be in the form of digital coins, tokens, or other asset representations including backed crypto-assets and unbacked crypto-assets.
c. Digital Financial Asset Trader, hereinafter referred to as Trader, is a business entity that conducts trading of Digital Financial Assets, either on its own behalf and/or facilitating consumers.
d. Board of Directors is the Trader's organ authorized and fully responsible for managing the Trader for the interests of the Trader, in accordance with the purpose and objectives of the Trader, and representing the Trader, both inside and outside of court, in accordance with the provisions of the articles of association. e. Board of Commissioners is the Trader's organ tasked with conducting general and/or specific supervision in accordance with the articles of association and providing advice to the Board of Directors. f. Senior Official is an official at the level of division head or section head at the headquarters who has knowledge and/or experience regarding anti-money laundering, counter-terrorism financing, and counter-proliferation financing. g. Consumer is any person who owns and/or utilizes products and/or services provided by the Trader. h. Customer is a Consumer as referred to in letter g.
i. Beneficial Owner is an individual who is entitled to and/or receives certain benefits related to the Customer's account, is the actual owner of funds and/or Digital Financial Assets including Crypto Assets placed with the Trader (ultimately own account), controls the Customer's transactions, grants power of attorney to conduct transactions, controls corporations or other legal arrangements, and/or is the ultimate controller of transactions conducted through a legal entity or based on an agreement.
j. Travel Rule is the obligation to obtain, store, and submit sender and recipient information required regarding digital financial asset transfer or transfer services to identify and report suspicious transactions, freeze, and prohibit transactions. k. Politically Exposed Person, hereinafter abbreviated as PEP, is a person given authority to perform important functions (prominent function), which is not intended for middle-level or lower-level positions.
l. Customer Due Diligence, hereinafter abbreviated as CDD, is an activity consisting of identification, verification, and monitoring conducted by the Trader to ensure transactions are in accordance with the profile, characteristics, and/or transaction patterns of prospective Customers or Customers.
m. Enhanced Due Diligence, hereinafter abbreviated as EDD, is more in-depth CDD actions conducted by the Trader against prospective Customers or Customers with high risk, including PEPs and/or in high-risk areas. n. Money Laundering Crime, hereinafter abbreviated as TPPU, is TPPU as referred to in laws concerning the prevention and eradication of money laundering crimes. o. Terrorism Financing Crime, hereinafter abbreviated as TPPT, is TPPT as referred to in laws concerning the prevention and eradication of terrorism financing crimes. p. Proliferation Financing of Weapons of Mass Destruction, hereinafter abbreviated as PPSPM, is PPSPM as regulated in regulations concerning proliferation financing of weapons of mass destruction. q. Suspicious Financial Transaction is a suspicious financial transaction related to TPPU, TPPT, and/or PPSPM. r. List of Suspected Terrorists and Terrorist Organizations, hereinafter abbreviated as DTTOT, is a list of names of suspected terrorists and terrorist organizations as referred to in legislation concerning the prevention and eradication of TPPT. s. List of Proliferation Financing of Weapons of Mass Destruction, hereinafter abbreviated as DPPSPM, is a list of names of suspected perpetrators of PPSPM as referred to in legislation concerning the prevention and eradication of PPSPM. t. Blocking is blocking as regulated in legislation concerning the prevention and eradication of TPPU, TPPT, and/or PPSPM. u. High-Risk Customer is a Customer who, based on background, identity, history, and/or the results of risk assessments conducted by the Trader, has a high risk of engaging in activities related to TPPU, TPPT, and/or PPSPM.
v. Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing of Weapons of Mass Destruction, hereinafter abbreviated as APU, PPT, and PPPSPM, are efforts to prevent and eradicate TPPU, TPPT, and/or PPSPM.
w. Financial Action Task Force Recommendations, hereinafter referred to as FATF Recommendations, are standards for the prevention and eradication of TPPU, TPPT, and/or PPSPM issued by FATF.
x. Electronic System is a series of electronic devices and procedures that function to prepare, collect, process, analyze, store, display, announce, transmit, and/or disseminate electronic information.
Traders are highly vulnerable to the possibility of being used as a medium for TPPU, TPPT, and PPSPM. Traders may become an entry point for wealth resulting from TPPU, TPPT, and PPSPM into the financial system, which can subsequently be utilized for criminal interests. For example, for TPPU perpetrators, such wealth can be withdrawn as if it were legitimate wealth and no longer traceable to its origin. For TPPT perpetrators, such wealth can be used to finance terrorist activities. For PPSPM perpetrators, such wealth can be used to finance weapons of mass destruction proliferation activities.
The increasing complexity of financial service products and services, including their marketing (multichannel marketing), and the increasing use of information technology in the financial services industry, result in a higher risk of Traders being used as a means for TPPU, TPPT, and PPSPM.
In this regard, there is a need to improve the quality of implementing APU, PPT, and PPPSPM programs based on a risk-based approach in accordance with general principles applicable internationally, as well as in line with the national risk assessment (NRA) and sectoral risk assessment (SRA).
On principle, the TPPU process can be grouped into 3 (three) stages of activities, including:
a. placement, which is the effort to place cash money derived from criminal acts into the financial system; b. layering, which is the effort to obscure the origin of wealth derived from criminal acts (dirty money) involving the Trader; and/or
c. integration, which is the effort to combine or use wealth that appears legitimate, either to enjoy directly, invest in various types of financial products/services, or other material forms, used to finance legitimate business activities, or to re-fund criminal activities.
Some money laundering modus operandi and typologies that may occur through Traders include:
a. structuring, which is the effort to break down transactions into several transactions with relatively small transaction values intended to avoid reporting; b. smurfing, which is the effort to break down transactions with funds derived from criminal proceeds through several accounts under different individuals, whether affiliated or not, for the benefit of one person or a specific Beneficial Owner;
c. mingling, which is a technique of mixing or combining criminal proceeds with legitimate business proceeds to obscure the source of criminal funds;
d. misuse of professional services such as legal consultants, notaries, and accountants including public accountants, with the intention of obscuring the identity of the beneficiary and the source of criminal funds; e. use of other people's names (nominees), family members, and/or third parties by parties within the Customer's management structure who will represent the Customer in the process of establishing a business relationship with the Trader, intended to obscure the identity of those committing crimes by using the legitimate identity of others; f. use of false identities by parties within the Customer's management structure who will represent the Customer in the process of establishing a business relationship with the Trader, intended to obscure the identity of those committing crimes, thereby generating a new identity that appears genuine by using the legitimate identity of others. The forms of false identity use include impersonation identities (mimicking identity) and synthetic identities (combining real and false identities). Impersonation identities are done by stealing another person's identity, while synthetic identities use identity forgery by combining real and false identities to generate a new identity that appears genuine; and g. use or cooperation with companies in tax haven countries/jurisdictions that do not have real business (paper companies), as classified by competent international organizations, including countries/jurisdictions categorized as high-risk and other monitored jurisdictions by FATF.
Unlike TPPU, whose purpose is to disguise the origin of wealth, the purpose of TPPT is to assist terrorist activities, whether with wealth that is the result of a criminal act or with wealth obtained legitimately.
On principle, the TPPT process can be grouped into 3 (three) stages of activities, including:
a. collecting/raising funds, which is the activity of collecting funds conducted by terrorists, terrorist organizations, and/or other parties who are the funders of TPPT, where the funds are obtained in a lawful or unlawful manner. b. moving/storing/transferring funds, which is the activity of providing, giving, and/or lending funds from the fund owner to terrorists and/or terrorist organizations.
c. using, which is the activity of using or utilizing funds that have been collected or received by terrorists and/or terrorist organizations for terrorist criminal activities.
Some terrorism financing modus operandi and typologies that may occur through Traders include:
a. misuse of investment funds by Customers, where investment funds are provided, collected, given, and/or lent to terrorists and/or terrorist organizations, directly or indirectly, with the intention that they be used wholly or partially to commit terrorist crimes; and b. parties within the Customer's management structure who will represent the Customer and/or parties who are the Beneficial Owners of the Customer are listed in the DTTOT.
PPSPM has a critical point where crime is not limited to the process of creating a weapon of mass destruction such as nuclear, but also covers various other supporting structures, such as the provision of raw material logistics, the use of certain shipping lines to distribute logistics or even other military hardware, up to the formation of front companies to cover transactions used as an effort to support PPSPM.

II. IMPLEMENTATION OF APU, PPT, PPPSPM PROGRAMS BASED ON RISK (RISK BASED APPROACH)

Traders are required to implement APU, PPT, and PPPSPM programs effectively by considering the risks of TPPU, TPPT, and/or PPSPM, as well as the scale, complexity, and/or characteristics of the Trader's business, which include:
a. active supervision by the Board of Directors and Board of Commissioners; b. policies and procedures;
c. internal controls;
d. information management systems; and e. human resources and training.
The implementation of the APU, PPT, and PPPSPM program as referred to in number 1 is conducted by the Trader using a risk-based approach based on the results of the application of APU, PPT, and PPPSPM risks.
In conducting business relationships and transactions with Customers, Traders must implement a risk-based APU, PPT, and PPPSPM program. This program includes, among other things, what is mandated in the FATF Recommendations as an effort to protect Traders from being used as a means for TPPU, TPPT, and/or PPSPM. The FATF Recommendations state that Traders are obligated to identify, assess, and understand TPPU, TPPT, and/or PPSPM risks related to Customers, countries/geographic areas/jurisdictions, products/services/transactions, or distribution networks (delivery channels). The implementation of a risk-based APU, PPT, and PPPSPM program supports Traders in implementing preventive and risk mitigation measures commensurate with the identified TPPU, TPPT, and/or PPSPM risks. Traders can subsequently allocate their resources according to their risk profile, manage internal controls, internal structure, and implement policies and procedures to prevent and detect TPPU, TPPT, and/or PPSPM. In implementing a risk-based APU, PPT, and PPPSPM program, Traders must refer to the risks listed in the NRA and SRA. The risks listed in the NRA and SRA can develop and change, so Traders must be responsive and consider these risk changes.
Risk Concept
a. Risk Definition
Risk is defined as the likelihood of an event and its impact. Simply put, risk is seen as a combination of the probability of occurrence and the level of damage or loss that may result from an event.
In the context of TPPU, TPPT, and PPSPM, risk is interpreted as:

at the national level, as a threat and vulnerability caused by TPPU, TPPT, and PPSPM that endanger the national financial system and national security; and
at the Trader level, as a threat and vulnerability that places the Trader at risk of being used as a means by TPPU, TPPT, and PPSPM.
An example of a Likelihood and Impact Matrix is contained in Appendix Part A, which is an integral part of this Financial Services Authority Circular.
Threats can be parties or objects that can cause loss. In the context of TPPU, TPPT, and PPSPM, threats can be criminal actors, facilitators (parties assisting in the commission of criminal acts), criminal funds, or even terrorist groups. Vulnerability is an element of business activity that can be exploited by identified threats. In the context of TPPU, TPPT, and/or PPSPM, vulnerability is interpreted as weak internal controls of the Trader or the offering of high-risk products/services/transactions.

b. Risk Management
Risk management is a process widely used in the public and private sectors to assist in decision-making. In relation to TPPU, TPPT, and/or PPSPM, this process includes understanding TPPU, TPPT, and/or PPSPM risks, assessing these risks, and developing methods to manage and mitigate identified risks. In implementing risk management for TPPU, TPPT, and/or PPSPM, Traders can develop risk management methods according to the Trader's needs based on TPPU, TPPT, and/or PPSPM risk assessments, business models, business activities, business scale, business complexity, business characteristics, and/or major events or developments in Trader management and operations, while still referring to legislation regulating APU, PPT, and PPPSPM.

c. Inherent Risk and Residual Risk
In conducting risk assessments, it is important to distinguish between inherent risk and residual risk.
Inherent risk is the risk attached to an event or condition that exists prior to the application of control measures. This inherent risk is related to the TPPU, TPPT, and/or PPSPM risk profile of prospective Customers or Customers, which includes at least 4 (four) risk factors, namely Customers, countries/geographic areas/jurisdictions, products/services/transactions, or distribution networks (delivery channels). On the other hand, residual risk is the level of risk remaining after the implementation of risk mitigation steps and controls.

d. Risk-Based Approach
In the context of TPPU, TPPT, and PPSPM, the risk-based approach is a process that includes the following:

risk assessment covering at least 4 (four) risk factors, namely:
a) Customers; b) countries/geographic areas/jurisdictions; c) products/services/transactions; and d) distribution networks (delivery channels).
Traders must consider all relevant risk factors, including the risk of using information technology and Electronic Systems.
Traders must manage and mitigate TPPU, TPPT, and/or PPSPM risks through the implementation of internal controls and taking steps appropriate to the identified risks, as well as monitoring transactions according to the assessed level of TPPU, TPPT, and/or PPSPM risk.
An example of risk levels related to trader business activities is contained in Appendix Part B, which is an integral part of this Financial Services Authority Circular.
In conducting risk assessment, management, and mitigation of TPPU, TPPT, and PPSPM, Traders need to understand that these assessment and mitigation activities are not static. Identified risks can change along with the development of new products or new threats, so risk assessments must be updated periodically according to the Trader's needs and risk assessments.

Traders must periodically update TPPU, TPPT, and/or PPSPM risk assessments according to the Trader's needs based on TPPU, TPPT, and/or PPSPM risk assessments, activities, business scale, business complexity, business characteristics, and/or major events or developments in Trader management and operations.
The update of TPPU, TPPT, and/or PPSPM risk assessments consists of:
a. Identification, Understanding, and Assessment of Inherent Risks

In conducting inherent risk identification, Traders must consider the Trader's vulnerability to being used as a means for TPPU, TPPT, and/or PPSPM. The first step in conducting risk assessment is to understand the Trader's overall business activities from a broad perspective. This understanding enables Traders to consider TPPU, TPPT, and/or PPSPM risks that may occur, whether the risk occurs on the Customer side, countries/geographic areas/jurisdictions, products/services/transactions, or distribution networks (delivery channels).
Traders must consider elements that trigger the emergence of risks for the Trader, from the Customer side, countries/geographic areas/jurisdictions, products/services/transactions, and/or distribution networks (delivery channels). Traders must understand what elements constitute inherent risk and residual risk.
Customer Risk
Traders must pay attention to TPPU, TPPT, and/or PPSPM risks related to the profile of prospective Customers or Customers. Traders need to categorize Customers based on the level of TPPU, TPPT, and/or PPSPM risk, referring to the risk classification established by the Trader.

https://jdih.ojk.go.id/

Customer Risks Related to Business Specifics
Customer risks related to the specific nature of the Trader's business increase when meeting the following factors:
a) Customer is a Politically Exposed Person (PEP), including family members or close associates of the PEP; b) Customer is detected using a virtual private network intended to mask the IP address when accessing the Trader's website/application; c) The transaction value of the Customer has a nominal amount that is not commensurate with the Customer's profile (exceeding reasonable limits); d) The intensity of transactions by the Customer exceeds reasonable limits, including those outside normal/reasonable policies or habits; e) The Customer acts on behalf of the Beneficial Owner; f) The Customer uses the Trader's products and/or services or conducts Digital Financial Asset transactions, including Crypto Assets, through the Trader in a manner inconsistent with the Customer's needs or not beneficial to the Customer; g) The Customer or Beneficial Owner provides very minimal information or information that is suspected to be fictitious; h) The Customer or Beneficial Owner obscures or fails to disclose their true identity; i) Gatekeepers, such as supporting professions including accountants, legal consultants, appraisers, notaries, or other professions, acting on behalf of the Customer regarding accounts/accounts at the Trader; j) The Customer is a corporation with a complex ownership structure that makes it difficult to identify the Beneficial Owner, ultimate owner, or ultimate controller of the corporation; k) The Customer is an institution supervised by other regulatory/supervisory authorities that has not effectively implemented Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs; l) The Customer changes the account number recorded with the Trader; m) Risks of using false identities in the form of identity forgery, namely impersonation identities (impersonating another's identity) and synthetic identities (combining real and fake identities). Impersonation identities are done by stealing another person's identity, while synthetic identities use forgery by combining real identities with fake identities to generate a new identity that appears real; and/or n) There is a discrepancy between the identity or personal data of the Customer held by the Crypto Asset Trader and the identity or personal data of the Customer held by payment service providers and/or fiat storage bank accounts.
Country/Geographic Area/Jurisdiction Risks
In conducting risk assessments, Traders must identify risks related to geographic locations, whether the Trader's geographic location, the Customer's geographic location, or the location where the business relationship occurs, and their impact on overall risk. TPPU, TPPT, and/or PPSPM risks related to countries/geographic areas/jurisdictions increase when meeting the following provisions:
a) Issuers of Digital Financial Assets, including Crypto Assets, from high-risk countries or jurisdictions; b) Funds or Digital Financial Assets, including Crypto Assets, from or sent to high-risk countries or jurisdictions; c) The Customer has significant connections with high-risk countries or jurisdictions; d) The Customer resides in high-risk areas; e) The Customer is detected accessing the Trader's application/website while in high-risk areas or border regions; f) The Customer resides in high-risk international border areas; g) The Customer's original residence area is unknown (using fake IP addresses); and/or h) The Customer is detected conducting transactions with Customers from high-risk countries or transactions connected to Crypto Asset Traders in high-risk countries.

Indicators determining a high-risk country/geographic area/jurisdiction regarding TPPU, TPPT, and/or PPSPM include:
a) Jurisdictions identified by organizations conducting mutual assessments of countries (such as: Financial Action Task Force (FATF) on Money Laundering, Asia Pacific Group on Money Laundering (APG), Caribbean Financial Action Task Force (CFATF), Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism (MONEYVAL), Eastern and Southern Africa Anti Money Laundering Group (ESAAMLG), The Eurasian Group on Combating Money Laundering and Financing of Terrorism (EAG), Grupo de Accion Financiera de Sudamerica (GAFISUD), Inter Governmental Action Group Against Money Laundering in West Africa (GIABA), or Middle East & North Africa Financial Action Task Force (MENAFATF)) as not adequately implementing FATF Recommendations; b) Countries identified as non-cooperative or tax havens by the Organization for Economic Cooperation and Development (OECD); c) Countries with low levels of good governance as determined by the World Bank; d) Countries with high corruption risk levels as identified in the Transparency International Corruption Perception Index; e) Countries widely known as places of production and trade centers for narcotics; f) Countries subject to sanctions, embargoes, or similar measures by, for example, the United Nations (UN); or g) Countries or jurisdictions identified by trusted institutions as funding or supporting terrorist activities, or allowing terrorist organization activities in their country.

Product/Service/Transaction Risks (Including Transactions)
Overall risk assessments must include determining risks that may occur regarding various products/services (including transactions) offered. Factors that can increase product/transaction risks include:
a) Digital Financial Asset products or services, including Crypto Assets, that enable increased anonymity, reduced transparency, and blurred financial flows, examples: anonymity-enhanced cryptocurrencies (AECs), mixers and tumblers, decentralized platforms and exchanges, privacy wallets; b) Digital Financial Asset products or services, including Crypto Assets, related to illegal activities such as darknet marketplace transactions, ransomware, and hacking; c) Products or services that enable payments, distribution, or management of funds from unknown third parties or parties with no relationship to the Customer; and/or d) Transactions originating from financing and/or wallets owned by suspected parties and/or designated by authorities as affiliated with specific crimes.
Distribution Network Risks (Delivery Channels)
Distribution networks (delivery channels) are media used to obtain a product/service/transaction, or media used to conduct a transaction.
One of the Trader's business characteristics is the distribution network (delivery channels) process conducted without direct meetings (non-face to face). For example, the use of mobile phone applications (mobile apps) and websites, accessible 24 (twenty-four) hours a day, 7 (seven) days a week, and from anywhere. Additionally, Traders must also consider borderless risks as part of what can increase distribution network (delivery channels) risks, where media used for borderless transactions carry higher risks compared to non-borderless transactions. With these specific characteristics, Traders may likely be used to obscure the true identity of the Customer or Beneficial Owner, thereby carrying higher risks. Although some distribution networks (delivery channels) using mobile phone applications or internet websites are common, these must still be considered as part of the factors that can cause TPPU, TPPT, and/or PPSPM risks to become higher. Some indicators causing high-risk distribution networks (delivery channels) include untested online applications regarding reliability and security, particularly concerning Customer data confidentiality.
Other Relevant Risks
Other relevant factors that can impact TPPU, TPPT, and/or PPSPM risks include:
a) developments in TPPU, TPPT, and/or PPSPM risk modes and typologies; b) business models, business scale, and number of employees as inherent risk factors for Traders; c) high total value and intensity of transactions requiring adequate risk mitigation; d) the use of information technology throughout the Trader's entire business process chain; e) data security from cyberattack risks, where Traders heavily rely on the use of open communication networks (internet), thus carrying significant risks against cyberattacks during internet usage; f) personal data protection covering protection against the acquisition, collection, processing, analysis, storage, presentation, announcement, delivery, dissemination, and destruction of personal data in accordance with applicable laws and regulations. The greatest risk for Traders relates to poor personal data protection management; g) transaction and customer acceptance records, where Traders are required to provide transaction and customer acceptance records for all activities within the Trader's Electronic System. Transaction and customer acceptance records are crucial as they are used for supervision, law enforcement, dispute resolution, verification, testing, and other examinations; and/or h) data storage centers (data centers) and disaster recovery centers, where the existence of data centers and disaster recovery centers aims to facilitate personal data protection processes and to restore data, information, and important functions of the Electronic System disrupted or damaged by natural and/or human-caused disasters. Through data storage centers (data centers) and disaster recovery centers, Traders maintain backup data so as not to repeat the data collection process.
Traders must consider that risk factors as referred to in numbers 3) through 8) above may be interrelated between 1 (one) risk factor and other risk factors.
Indicators that can increase risks are not limited to those referred to in numbers 3) through 8). Indicators that can increase risks may develop according to the complexity of the Trader's business activities.
After identifying and documenting inherent risks, Traders must provide assessments regarding the level of each risk for prospective Customers, such as low, medium, and high.
In conducting the inherent risk identification stage, Traders must be able to explain the entire risk identification process conducted by the Trader and the reasons or considerations.
Each risk element identified as high risk must be mitigated and documented. Traders must be able to explain to the Financial Services Authority (OJK) the mitigation steps for high-risk elements, for example, steps in policies and procedures or training programs.
Traders must also be able to demonstrate to the Financial Services Authority (OJK) that risk mitigation steps have been implemented effectively, for example, shown through internal audit results or independent audits.
Traders must provide documented information showing that Traders have specifically considered high-risk indicators in their risk assessments.
In order to identify TPPU, TPPT, and/or PPSPM risks and establish risk scales for prospective Customers when opening business relationships or Customers when conducting transactions, Traders may use regulatory technology such as big data analytics, artificial intelligence, and/or machine learning.
The utilization of regulatory technology in implementing Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs by Traders can also be done by Traders during electronic verification, transaction monitoring, and red flag alert determination, while considering Customer data and information security.

b. Establishing Risk Tolerance

Risk tolerance is the level and type of risk that can be maximally tolerated or executed and established by the Trader, where this risk covers at least the fulfillment of provisions as referred to in Financial Services Authority Regulations regarding the implementation of anti-money laundering, counter-terrorism financing, and counter-proliferation financing programs in the financial services sector and its implementing regulations. Risk tolerance is an elaboration of the risk level to be taken (risk appetite).
Meanwhile, risk appetite is the risk the Trader wishes to take, whether in the form of risk taker or non-risk taker.
Traders must establish risk tolerance before considering risk mitigation.
When considering threats, the concept of risk tolerance will give Traders the ability to determine the level of risk threats that can be tolerated by the Trader.
In establishing risk tolerance, Traders need to consider risk categories that can affect Traders, at least:
a) operational risk; and b) TPPU, TPPT, and/or according to applicable laws and regulations.

c. Implementation of Risk-Based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing Programs (Risk-Based Approach)

Traders are obligated to implement risk-based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs based on the results of TPPU, TPPT, and/or PPSPM risk assessments.
The implementation of risk-based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs owned by Traders must be documented to demonstrate the Trader's compliance level. Policies and procedures regarding the implementation of risk-based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs must be communicated, understood, and complied with by all employees, particularly employees conducting identification and management of Customer data and information, as well as reporting transactions to relevant authorities.
Procedures and policies for implementing risk-based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs must meet the following minimum requirements:
a) Customer identification based on risk levels; b) Detection of Suspicious Financial Transactions; c) Determination of monitoring intensity adjusted to Customer risk levels, including aspects of frequency, implementation methods, and evaluation of monitoring results; d) Risk assessment; e) Special actions against high-risk areas; f) Record keeping; g) Planning and implementation of updates to Customer and Beneficial Owner data and information based on risk levels; and h) Reporting.
Policies and procedures in implementing risk-based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs also cover matters related to the detection of suspicious transactions and determination of monitoring types adjusted to Customer risk levels or business relationships, as well as monitoring aspects including frequency, implementation methods, and evaluation of monitoring results.
Traders must conduct periodic monitoring of all business relationships conducted, and of business relationships with high risks regarding TPPU, TPPT, and PPSPM. Traders must apply stricter special steps for Customers or business relationships with high risks.
Traders must note that risk management and risk mitigation require leadership and involvement of Senior Officials. Senior Officials are responsible for decision-making regarding policies, procedures, internal control processes, and risk mitigation regarding TPPU, TPPT, and PPSPM in the business activities owned by the Trader.
With the implementation of risk-based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs, Traders must:
a) ensure that risk assessments conducted reflect the implementation of risk-based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs, the frequency of monitoring low-risk and high-risk Customers, and also describe internal control steps implemented to reduce identified high risks; b) implement risk-based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs; c) update data and information regarding Customers and Beneficial Owners; d) monitor all business relationships owned; e) conduct more frequent monitoring of business relationships with high risks regarding TPPU, TPPT, and/or PPSPM; f) take specific steps for High-Risk Customers; and g) involve Senior Officials in facing situations or high-risk areas (for example, approval to conduct business relationships is granted by Senior Officials).

d. Risk Mitigation and Control Steps

Risk mitigation is the application of internal controls to limit TPPU, TPPT, and/or PPSPM risks identified in risk assessments. Risk mitigation helps Traders ensure their business activities remain within the established risk tolerance limits. In cases where risk assessment results show that Traders have high risk levels, Traders must develop written risk mitigation strategies (consisting of policies and procedures to mitigate high risks) and apply them to high-risk areas or business relationships as previously identified.
Risk mitigation is conducted in the implementation of 5 (five) pillars of Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing programs effectively and adequately as referred to in number 1.
Traders report to the Financial Services Authority (OJK) that risk mitigation has been implemented effectively in the document of TPPU, TPPT, and/or PPSPM risk assessments that have been prepared individually (Individual Risk Assessment/IRA).
Internal controls and risk mitigation in high-risk areas or business relationships are based on risk acceptance (risk appetite) and risk tolerance (risk tolerance).
In all situations, Traders' business activities must consider internal controls that influence the mitigation of all identified risks.
In risk assessments, all high-risk areas identified as part of the risk assessment must be mitigated with adequate internal controls and well-documented.
For all Customers and business relationships, Traders must:
a) monitor all business relationships; and b) document relevant information and steps taken.
For Customers and business relationships with high risks, Traders must:
a) conduct more frequent monitoring of these business relationships; and b) take stricter steps in identification, verification, and data updating.
With risk mitigation activities, Traders must:
a) update and manage Customer and Beneficial Owner information; b) establish and implement continuous monitoring activities at every level of the Trader's business relationships proportionally based on Customer risk levels; for low-risk Customers, monitoring is conducted periodically, and for High-Risk Customers, monitoring is conducted more frequently and/or more deeply compared to low-risk and medium-risk Customers. Example:
Low-risk Customers are monitored annually with general know your transaction depth, medium-risk Customers are monitored every 3 (three) months, or semi-annually with general know your transaction depth, and High-Risk Customers are monitored daily, weekly, or monthly with customized parameter depth (customized rules adjusting to risk). c) implement mitigation against high-risk areas. This risk mitigation strategy must be stated in policies and procedures; and d) consistently apply internal control procedures.

e. Evaluation of Residual Risks (Residual Risk)

Residual risk is the risk remaining after the implementation of internal controls and risk mitigation. Traders must note that no matter how tight the risk mitigation and risk management owned, Traders will still have residual risk (residual risk) that must be managed well.
Residual risk (residual risk) must be consistent with the established risk tolerance. Traders must ensure that residual risk (residual risk) is not greater than the established risk tolerance. In cases where residual risk (residual risk) is still greater than risk tolerance, or in cases where internal controls and mitigation against high-risk areas are inadequate, Traders must return to risk reduction and control steps, and increase the level or quantity of established risk mitigation steps.
Characteristics of residual risk (residual risk) are:
a) risk tolerated/accepted:
In this risk, the risk remains even though risk mitigation has been conducted according to the Trader's risk tolerance. Tolerated risks can increase over time. For example, when new TPPU, TPPT, and/or PPSPM threats arise. b) risk mitigated:
In this risk, the risk remains even though it has been mitigated. This risk has been reduced but cannot be eliminated. In practice, established internal controls may not be applicable. For example, monitoring systems or transaction monitoring processes fail, causing some transactions not to be reported.
With residual risk (residual risk) evaluation activities, Traders must:
a) evaluate the residual risks owned; and b) adjust the risk levels owned to the tolerated/accepted risks.

f. Review and Evaluation of Risk-Based Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing Programs (Risk Based Approach) Implementation https://jdih.ojk.go.id/

The Money Laundering, Terrorism Financing, and Proliferation Financing Risk Assessment held by the Trader must be evaluated based on the need to test the effectiveness of the implementation of the AML, CTF, and CPF programs, which includes:
a) active supervision by the Board of Directors and Board of Commissioners; b) policies and procedures; c) management information systems; d) internal controls; e) human resource needs possessing knowledge and capabilities in the field of information technology and the Trader's business processes; f) human resource training programs for employees, Senior Officials, as well as the Board of Directors and Board of Commissioners regarding the implementation of the AML, CTF, and CPF programs; and/or g) employee profiles including the creation of (profiling) identity data and employee competencies.
In the event of changes in business activity structure, the offering of new products and services, and new technologies, updates to the risk assessment must be conducted for policies and procedures, mitigation steps, and internal controls.
Review of the Money Laundering, Terrorism Financing, and/or Proliferation Financing Risk Assessment must cover all elements including policies and procedures regarding risk assessment, risk mitigation, and more intensive continuous monitoring. The review of the risk assessment can help the Trader in evaluating the improvement of existing policies and procedures or the formation of new policies and procedures. Identified risks may change or develop along with the development of new products or the emergence of new threats to the Trader's business activities. Ultimately, the review procedures for the aforementioned risk assessment will affect the effectiveness of the implementation of the risk-based AML, CTF, and CPF programs in applying the AML, CTF, and CPF programs.
With the review of the implementation of the risk-based AML, CTF, and CPF programs (risk based approach), the Trader must:
a) conduct reviews according to the Trader's needs; b) produce reviews that cover compliance with policies and procedures, risk assessments regarding Money Laundering, Terrorism Financing, and Proliferation Financing, as well as training programs to test the effectiveness of the implementation of the risk-based AML, CTF, and CPF programs (risk based approach); c) conduct accounting of the review process and report to the Senior Official; and d) conduct accounting of the review results and establish corrective steps to be followed up.

https://jdih.ojk.go.id/

III. ACTIVE SUPERVISION BY THE BOARD OF DIRECTORS AND BOARD OF COMMISSIONERS

Active Supervision by the Board of Directors
Active supervision by the Board of Directors includes:
a. proposing written policies and procedures regarding the implementation of the AML, CTF, and CPF programs to the Board of Commissioners, including mitigation of Money Laundering, Terrorism Financing, and/or Proliferation Financing risks, containing at least:

identification and verification of prospective Customers or Customers;
identification and verification of Beneficial Owners;
termination of business relationships;
continuous management of Money Laundering, Terrorism Financing, and/or Proliferation Financing risks regarding Customers, geographic areas (including countries/jurisdictions), products/services/services, and/or distribution networks (delivery channels);
maintenance of accurate data related to Transactions, accounting of the CDD process, and accounting of policies and procedures;
updating and monitoring;
reporting to Senior Officials, the Board of Directors, and the Board of Commissioners regarding the implementation of policies and procedures for the AML, CTF, and CPF programs; and
reporting to the Financial Transaction Reports and Analysis Center (PPATK).
b. ensuring the implementation of the AML, CTF, and CPF programs is carried out in accordance with the established written policies and procedures;
c. forming a special work unit and/or appointing officials responsible for the implementation of the AML, CTF, and CPF programs;
d. supervising the compliance of work units in implementing the AML, CTF, and CPF programs; e. ensuring that written policies and procedures regarding the implementation of the AML, CTF, and CPF programs align with changes and the development of products, services, and technology in the financial services sector and are in accordance with the development of Money Laundering, Terrorism Financing, and/or Proliferation Financing modus operandi; f. ensuring that officials and/or employees, particularly employees from relevant work units (for example, work units that have direct or indirect relations with prospective Customers, such as customer service officers, officers related to the management and development of information technology, and internal auditors) and new employees, have undergone training related to the implementation of the AML, CTF, and CPF programs once (1) in one (1) year; g. ensuring that discussions regarding the implementation of the AML, CTF, and CPF programs take place in Board of Directors meetings. The results of the discussion meetings must be recorded in meeting minutes (minute meeting) signed by the Board of Directors and the parties attending the discussion meetings; h. providing clear directives regarding policies, supervision, and procedures for the management and mitigation of Money Laundering, Terrorism Financing, and/or Proliferation Financing risks;
i. In the event that the Trader has needs based on Money Laundering, Terrorism Financing, and/or Proliferation Financing risk assessments, business activities, business scale, business complexity, business characteristics, and/or major events or developments in the management and operations of the Trader, training as referred to in letter f can be conducted more than once (1) in one (1) year; and
j. ensuring the confidentiality of data/information managed by the Trader.

Active Supervision by the Board of Commissioners.
In conducting active supervision, the Board of Commissioners must at least:
a. ensure the Trader has policies and procedures for the implementation of the AML, CTF, and CPF programs; b. approve the written policies and procedures for the implementation of the AML, CTF, and CPF programs proposed by the Board of Directors;
c. evaluate the policies and procedures for the implementation of the AML, CTF, and CPF programs;
d. supervise the implementation of the duties and responsibilities of the Board of Directors regarding the implementation of the AML, CTF, and CPF programs; and e. ensure that discussions regarding the implementation of the AML, CTF, and CPF programs take place in Board of Directors and Board of Commissioners meetings. The results of the discussion meetings must be recorded in meeting minutes (minute meeting) signed by the Board of Directors and Board of Commissioners attending the discussion meetings.
In supporting the effectiveness of the implementation of the AML, CTF, and CPF programs, the Board of Directors and Board of Commissioners must:
a. have adequate understanding of the inherent Money Laundering, Terrorism Financing, and/or Proliferation Financing risks associated with all operational activities of the Trader so that the Board of Directors and Board of Commissioners are able to manage and mitigate such risks adequately in accordance with applicable laws and regulations; b. have understanding regarding inherent risks including Customer risk, country/geographic area/jurisdiction risk, product/service/transaction risk, distribution network (delivery channels) risk, and other relevant risks;
c. ensure an adequate organizational structure for the implementation of the AML, CTF, and CPF programs, including ensuring that the AML, CTF, and CPF program responsible party is within the organizational structure; and
d. be responsible for policies and procedures, implementation, and supervision of the implementation of the AML, CTF, and CPF programs, including the management and mitigation of Money Laundering, Terrorism Financing, and/or Proliferation Financing risks in all operational activities of the Trader.
Responsible Party for the Implementation of the AML, CTF, and CPF Programs
a. The Trader must have a responsible party for the implementation of the AML, CTF, and CPF programs. b. The responsible party for the implementation of the AML, CTF, and CPF programs must be within the Trader's organizational structure.
c. The determination and existence of the responsible party for the implementation of the AML, CTF, and CPF programs is based on the needs and complexity of the Trader's business, meaning the Trader can have a special work unit and a responsible official, or only have a special work unit, or only have a responsible official.
d. In the event that the responsible party for the implementation of the AML, CTF, and CPF programs is a special work unit, it must meet the following provisions:

consisting of at least 2 (two) people, namely 1 (one) leader and 1 (one) executor;
the leader and executor of the special work unit do not hold other functions concurrently;
the leader of the special work unit is determined and appointed by the Board of Directors;
is within the Trader's organizational structure;
is under the direct coordination of the Board of Directors within the Trader's organizational structure; and
is independent of other functions.
e. In the event that the responsible party for the implementation of the AML, CTF, and CPF programs is a responsible official, the responsible official must be determined and appointed by the Board of Directors and can only hold concurrent functions of compliance and/or risk management. f. The responsible party for the implementation of the AML, CTF, and CPF programs can be carried out by one of the Board of Directors members. In the event that a Board of Directors member is designated as the responsible party for the implementation of the AML, CTF, and CPF programs, that Board of Directors member cannot perform other functions and can only perform compliance and/or risk management functions. g. The responsible party for the implementation of the AML, CTF, and CPF programs reports to and is responsible to the Board of Directors which has the task of supervising the implementation of the AML, CTF, and CPF programs. h. The responsible party for the implementation of the AML, CTF, and CPF programs at the Trader has the following duties, namely:
periodically analyze Money Laundering, Terrorism Financing, and/or Proliferation Financing risk assessments related to Customers, geographic areas (including countries/jurisdictions), products/services/services, and/or Transaction methods/distribution networks (delivery channels), once (1) in one (1) year;
formulate, update, and propose policies and procedures for the implementation of the AML, CTF, and CPF programs that have been formulated to manage and mitigate risks based on the risk assessment as referred to in number 1), to be considered by the Board of Directors;
ensure the existence of a system that can effectively identify, analyze, monitor, and provide reports on Suspicious Financial Transactions based on deviations in profiles, characteristics, or habitual transaction patterns of Customers, such as:
a) Based on financial statements, the Customer does not have the financial capability to make transactions for the purchase of Digital Financial Assets above the amount of income, yet the Customer can make transactions with amounts far exceeding income; b) The Customer makes transactions with unreasonable volume; c) The Board of Directors, Board of Commissioners, shareholders, and/or Beneficial Owners of the Customer are suspected to be involved in predicate crimes, Money Laundering, Terrorism Financing, and/or Proliferation Financing; d) The Customer is suspected to be involved in Money Laundering, Terrorism Financing, and/or Proliferation Financing; e) assets used as the basis for issuing Digital Financial Assets are suspected to be involved in predicate crimes, Money Laundering, Terrorism Financing, and/or Proliferation Financing; and f) The Customer makes Digital Financial Asset transactions with Traders originating from high-risk countries.
ensure that the formulated policies and procedures are in accordance with changes and/or the development of products/services/services, technology, and/or modus operandi and typologies of Money Laundering, Terrorism Financing, and/or Proliferation Financing in the financial services sector, and/or in accordance with the Trader's needs based on Money Laundering, Terrorism Financing, and/or Proliferation Financing risk assessments, business models, business activities, business scale, business complexity, business characteristics, and/or major events or developments in the management and operations of the Trader;
ensure that forms related to Customers have accommodated the data required in the implementation of the AML, CTF, and CPF programs;
monitor indications of Suspicious Financial Transactions as referred to in number 3);
conduct evaluations of the results of monitoring and analysis of Customer transactions to ensure the existence or non-existence of Suspicious Financial Transactions;
account for the results of monitoring and evaluation;
ensure the updating of Customer data and profiles;
ensure that business activities that pose high risks regarding Money Laundering, Terrorism Financing, and/or Proliferation Financing are effectively identified in accordance with the Trader's policies and procedures and provisions as referred to in the Financial Services Authority Regulation regarding the implementation of AML, CTF, and CPF programs in the financial services sector;
ensure good communication mechanisms from each relevant work unit to the special work unit or official responsible for the implementation of the AML, CTF, and CPF programs while maintaining information confidentiality and observing anti-tipping-off provisions;
supervise the implementation of the AML, CTF, and CPF programs regarding relevant work units, including supervising whether relevant work units have performed their functions and duties to prepare reports regarding suspected Suspicious Financial Transactions before submitting them to the special work unit or official responsible for the implementation of the AML, CTF, and CPF programs;
ensure the identification of high-risk areas related to the implementation of the AML, CTF, and CPF programs by referring to applicable laws and regulations and adequate information sources;
receive, analyze, and formulate reports on Suspicious Financial Transactions submitted by work units;
formulate reports on Suspicious Financial Transactions;
periodically monitor and ensure follow-up on Terrorism Financing Prevention and Proliferation Financing Prevention Reports (DTTOT and DPPSPM) are in accordance with applicable laws and regulations regarding the prevention and eradication of Terrorism Financing and regulations regarding the prevention and eradication of Proliferation Financing;
monitor, analyze, and recommend training needs regarding the implementation of the AML, CTF, and CPF programs for the Trader's employees;
ensure that all activities for the implementation of the AML, CTF, and CPF programs are carried out well; and
perform other tasks for the implementation of the AML, CTF, and CPF programs.
Example:
Ensuring compliance with requests for data and information regarding each party reported by PPATK to investigators, suspects, or defendants to law enforcement agencies.
i. The responsible party for the implementation of the AML, CTF, and CPF programs has the following authorities:
obtain access to necessary information available in all organizational units of the Trader;
coordinate and monitor the implementation of the AML, CTF, and CPF programs by relevant work units;
propose officials and/or employees of relevant work units to assist in the implementation of the AML, CTF, and CPF programs;
report Suspicious Financial Transactions, including those made by the Board of Directors, Board of Commissioners, and/or parties affiliated with the Board of Directors or Board of Commissioners, directly to the Financial Transaction Reports and Analysis Center (PPATK); and
perform other authorities for the implementation of the AML, CTF, and CPF programs.
Example:
Proposing additional programs to support the implementation of the AML, CTF, and CPF programs to relevant work units or the Board of Directors.

IV. POLICIES AND PROCEDURES

Policies and procedures for the implementation of the AML, CTF, and CPF programs based on a risk-based approach include:
a. identification and verification of prospective Customers or Customers; b. identification and verification of Beneficial Owners;
c. termination of business relationships or rejection of transactions;
d. continuous management of Money Laundering, Terrorism Financing, and Proliferation Financing risks regarding Customers, countries/geographic areas/jurisdictions, products/services/transactions, or distribution networks (delivery channels); e. maintenance of accurate data related to transactions, accounting of the CDD process, and accounting of policies and procedures; f. updating and monitoring; g. reporting to Senior Officials, the Board of Directors, and the Board of Commissioners; and h. reporting to the Financial Transaction Reports and Analysis Center (PPATK) and the Police.
The Trader must review policies and procedures once (1) in one (1) year. In accordance with the Trader's needs based on Money Laundering, Terrorism Financing, and/or Proliferation Financing risk assessments, business activities, business scale, business complexity, business characteristics, and/or major events or developments in the management and operations of the Trader, reviews of policies and procedures can be conducted more than once (1) in one (1) year.
If based on the review conducted, the Trader deems it necessary to change the existing policies and procedures, such changes must be formulated within a maximum of 6 (six) months from the review results.
The policies and procedures as referred to in number 1 must observe the principle of knowing the service user (Know Your Customer (KYC)).
PMPJ/KYC as referred to in number 1 consists of CDD and EDD, through CDD or EDD:
a. The Trader can obtain detailed information regarding prospective Customers, Customers, Customer transactions, including Suspicious Financial Transactions; b. The Trader can protect the Trader's reputation and integrity, facilitate compliance with provisions, and protect the Trader from external threats, namely being used as a means of Money Laundering, Terrorism Financing, and/or Proliferation Financing; and
c. The Trader must always be careful in accepting prospective Customers and continue to monitor Customer transactions using the Trader's services. If transactions made are not in accordance with the profile, characteristics, or habitual transaction patterns of the respective Customer, the Trader is obligated to submit a Suspicious Financial Transaction report to PPATK.
CDD is conducted by the Trader at the time:
a. establishing business relationships with prospective Customers or transactions with Customers; b. there are financial transactions in Indonesian Rupiah and/or foreign currency with a value of at least or equivalent to IDR 100,000,000.00 (one hundred million Rupiah);
c. there are indications of Suspicious Financial Transactions related to Money Laundering, Terrorism Financing, and/or Proliferation Financing; or
d. the Trader doubts the truthfulness of information provided by prospective Customers, Customers, authorized recipients, and/or Beneficial Owners (Beneficial Owner).
Repeated CDD can be conducted by the Trader if the Trader assesses that there are changes in risk levels caused by, among others:
a. significant increase in transaction values; b. significant changes in Customer profiles; and/or
c. information in the Customer profiles available in the integrated Customer profile (single customer identification file) has not been completed with supporting documents for verification purposes.
Before the development of new products/services/services and business practices including transaction methods/distribution networks (delivery channels) and/or the use of new technology or development of technology for existing products/services/services that have been launched or used, the Trader is required to identify and conduct risk assessments regarding Money Laundering, Terrorism Financing, and/or Proliferation Financing, and take adequate actions to manage and mitigate risks.
Identification of Prospective Customers and Customers;
a. The Trader is obligated to identify and classify prospective Customers or Customers into groups of individuals (natural person), corporations (legal person), and other legal arrangements (legal arrangement). b. The Trader must have policies regarding the acceptance and identification of prospective Customers or Customers.
c. The acceptance and identification policies for prospective Customers as referred to in letter b must at least cover the following:

requests for information regarding prospective Customers, identity documents, and information and/or supporting documents from prospective Customers as referred to in Article 25, Article 26, Article 27, Article 28, and Article 29 of the Financial Services Authority Regulation regarding the implementation of AML, CTF, and CPF programs in the financial services sector;
research on the truthfulness of supporting identity documents for prospective Customers as referred to in number 1);
requests for more than one type of identity document for prospective Customers issued by competent authorities, if there is doubt about the existing identity cards;
if necessary, interviews can be conducted with prospective Customers to obtain certainty regarding the truthfulness of information, identity documents, and supporting documents for prospective Customers;
prohibition on opening or maintaining anonymous user names or fictitious names; and
identification of transactions or business relationships with prospective Customers originating from or related to countries that are inadequate in implementing FATF Recommendations, which can be seen from official releases on the FATF website published periodically.
d. The Trader can conduct acceptance and identification of prospective Customers or Customers electronically as long as the Trader's Electronic System is able to identify the identity of prospective Customers or Customers. e. In the implementation of acceptance and identification of prospective Customers or Customers electronically, the Trader must still observe the guidelines for acceptance and identification of prospective Customers or Customers as referred to in letter a, letter b, and letter c. f. In the event that acceptance and identification of prospective Customers is conducted electronically, it can be carried out, among others, through the filling of electronic forms and

https://jdih.ojk.go.id/

submission of copies of documents as referred to in Article 25, Article 26, Article 27, Article 28, and Article 29 of the Financial Services Authority Regulation regarding the implementation of AML, CFT, and CPF programs in the financial services sector in softcopy format through the Trader's website or application.

g. In addition to copies of documents as referred to in letter f, the Trader may request additional data, documents, and information needed in identifying and verifying prospective Customers or Customers, the submission of which is carried out through the Trader's website or application. Examples of such additional data, documents, and information include:

prospective Customers or individual Customers, including but not limited to email addresses, softcopy copies of additional identity documents issued by relevant parties or authorities, and facial photos (selfies);
prospective Customers or corporate Customers, including but not limited to:
a) email addresses and corporate telephone numbers; and b) names, email addresses, telephone numbers, facial photos (selfies), and identity documents of individuals appointed to have the authority to act on behalf of the corporate entity in conducting business relationships with the Trader;
prospective Customers or other legal arrangements, including but not limited to:
a) other legal arrangements in the form of trusts, data and information related to the names, email addresses, telephone numbers, facial photos (selfies), and identity documents of individuals appointed to have the authority to act on behalf of the other legal arrangement, settlors, beneficiaries, trustees, guarantors/protectors (if any), beneficiaries, and individuals who are the ultimate controllers of the trust in conducting business relationships with the Trader; and b) other legal arrangements in forms other than trusts, namely data and information related to the names, email addresses, telephone numbers, facial photos (selfies), and identity documents of individuals holding positions equivalent to those in a trust as referred to in letter a);
prospective Customers that are state institutions, government agencies, international organizations, or foreign state representations, including but not limited to names, email addresses, telephone numbers, facial photos (selfies), and identity documents of individuals appointed to have the authority to act on behalf of the state institution, government agency, international organization, or foreign state representation in conducting business relationships with the Trader.

Verification of Prospective Customers or Customers

a. In order to conduct business relationships with prospective Customers or transactions with Customers, the Trader must verify the information provided during identification through supporting documents of the prospective Customers or Customers.

https://jdih.ojk.go.id/

b. In order to ensure the truthfulness of the identity of prospective Customers, verification is carried out by:

direct meeting (face to face) with the prospective Customer at the beginning of the business relationship;
matching the consistency of the prospective Customer's profile, facial photos (selfies), and identity photos;
matching the consistency of fingerprint identity documents, and/or facial photos (selfies) with identity documents or other documents containing signatures, electronic signatures, fingerprints, and/or facial photos (selfies);
requesting the prospective Customer to provide more than one identity document issued by the relevant party if there is doubt regarding the existing identity documents;
In cases where necessary, conducting cross-checks to ensure consistency of various information provided. Cross-checks are carried out by methods including but not limited to:
a) contacting the prospective Customer via landline or office telephone; b) contacting the human resources official at the prospective Customer's workplace if the prospective Customer is an employee of a company or agency; c) confirming the prospective Customer's income by requiring bank statements from banks or other financial service providers; or d) conducting geographic information analysis to view forest conditions through remote sensing technology for prospective Customers who are companies operating in the forestry sector; and/or
ensuring that the prospective Customer does not have a negative track record by verifying the identity of the prospective Customer using other independent sources including but not limited to:
a) DTTOT issued by the National Police of the Republic of Indonesia; b) DPPSPM; or c) other data such as the prospective Customer's employer identity, telephone accounts, and electricity accounts.

c. The completion of the identity verification process for prospective Customers or Customers must be done before opening a business relationship with the prospective Customer or conducting transactions with the Customer.

d. In certain conditions, the verification process may be completed after the business relationship or transaction has been conducted.

Example: Identity documents required are still being processed and cannot be fulfilled at the time of conducting a business relationship with the prospective Customer or Customer.

e. In the event that the verification process is completed after the business relationship or transaction has been conducted as referred to in letter d, the Trader must carry out adequate risk mitigation, for example by doing the following:

requesting documents that can prove that the completeness of the required documents is still being processed;

Example:
a) for corporate Customers and other legal arrangements, in the form of documents proving the processing of business permits issued by the relevant authority, and/or documents proving the processing of tax identification numbers from the relevant government agency administering tax affairs; or b) for individual Customers, in the form of documents proving that inheritance deeds or sales deeds as source of funds documents are being processed by a notary/land deed official;
2) imposing service and/or transaction restrictions provided by the Trader; and/or
3) the Trader requests the prospective Customer to complete the required documents within a certain period.

f. The Trader may conduct the verification process for prospective Customers or Customers electronically as long as the Electronic System used by the Trader is capable of verifying the truthfulness of the identity of the prospective Customers or Customers.

g. In the event that the Trader carries out the verification process electronically, the Trader must pay attention to the following matters:

The Trader may conduct verification electronically via direct face-to-face verification (face to face) with the following provisions:
a) electronic face-to-face verification can be conducted through electronic facilities owned by the Trader or third parties; b) in the event that face-to-face verification is conducted through electronic facilities owned by the Trader, the implementation uses software owned by the Trader with hardware owned by the Trader or the Customer or prospective Customer; c) in the event that face-to-face verification is conducted using electronic facilities owned by a third party, the third party is required to obtain approval from the Financial Services Authority in accordance with the Financial Services Authority Regulation regarding the implementation of AML, CFT, and CPF programs in the financial services sector; d) face-to-face verification through electronic facilities owned by the Trader is conducted in the form of electronic facilities equivalent to real-time and online video banking, electronically connecting the Trader's employees/officials with the prospective Customer or Customer.

Example: Video call features on the Trader's application that are connected directly in real-time and online with the Trader's employees/officials via smartphones, computers, and/or tablets owned by the prospective Customer or Customer;

e) face-to-face verification through electronic facilities owned by a third party is conducted in a form equivalent to real-time and online video banking, electronically connecting the Trader's employees/officials with the prospective Customer or Customer;

f) electronic face-to-face verification owned by the Trader or third parties must not be conducted using providers that generally provide electronic facilities, such as WhatsApp calls, Line calls, and Skype;

g) to provide additional assurance for the Trader in carrying out the face-to-face verification process through electronic facilities owned by the Trader or third parties, the Trader may add the use of motion detection mechanisms and/or technologies to ensure that the prospective Customer or Customer is a living subject and there is no identity fraud attempt.

Example: Motion detection mechanisms in the electronic face-to-face verification process include the Trader's officials/employees requesting the prospective Customer or Customer to move randomly in various directions (e.g., moving the face 45 degrees or 90 degrees left or right), requesting the prospective Customer or Customer to show the area around them during verification, and/or asking questions to confirm the truthfulness of information or identity to the prospective Customer or Customer.

The face-to-face verification process may be exempted with a non-face-to-face verification process (non-face to face verification) with the following provisions:

a) non-face-to-face verification is conducted using software owned by the Trader with hardware owned by the Trader or the Customer or prospective Customer.

Example: Software owned by the Trader and hardware owned by the Customer or prospective Customer used for non-face-to-face verification include but are not limited to:
(1) applications owned by the Trader that can be accessed via mobile devices (mobile devices) such as smartphones and/or tablet computers; and/or (2) the Trader's website that can be accessed via electronic devices of the prospective Customer or Customer such as computers and/or laptops.

The Trader must ensure that the hardware owned by the prospective Customer or Customer is equipped with supporting verification features such as cameras, scanners, recorders, and/or location trackers;

b) non-face-to-face verification is required to utilize population data that meets 2 (two) authentication factors covering:
(1) what you have, namely identity documents owned by the prospective Customer, namely the Electronic Identity Card (KTP Elektronik); and (2) what you are, namely biometric data such as fingerprints, iris data of the prospective Customer, and/or facial recognition technology.

Access to population data can be obtained by referring to legislation regulating the granting of access rights and utilization of population data, which can be accessed via web services, web portals, and card readers.

Examples of population data access via web services and web portals include the Trader cooperating with the Ministry administering population and civil registration affairs to obtain access rights to population data and not storing individual data.

Other examples of population data access are through parties that utilize population administrative data meeting 2 (two) authentication factors as referred to in items (1) and (2), where such parties obtain certification from the Ministry administering communication and information affairs;

c) to provide additional assurance for the Trader in the non-face-to-face verification process as referred to in letter b), the Trader may:
(1) add other authentication factors, namely what you know, which can include personal identification numbers (PIN), passwords, one-time passwords (OTP), verification emails, and/or challenge-response; and/or (2) add the use of motion detection technology to ensure that the prospective Customer or Customer is a living subject and there is no identity fraud attempt;

To provide additional assurance for the Trader, verification conducted electronically by the Trader may utilize artificial intelligence technology or other algorithms matched with the Trader's database.

Identification and Verification of High-Risk Prospective Customers and Customers or PEPs

a. Identification of High-Risk Prospective Customers and Customers or PEPs

https://jdih.ojk.go.id/

In the event that the Trader assesses that a prospective Customer or Customer is High-Risk or a PEP, the Trader is obligated to apply Enhanced Due Diligence (EDD).
The Trader must have policies and procedures for the identification of Customers or High-Risk Customers or PEPs.
The policies and procedures for the identification of Customers or High-Risk Customers or PEPs as referred to in item 2) must at least cover the provisions as referred to in the identification provisions for prospective Customers or Customers as referred to in item 8.
The identification of High-Risk prospective Customers and Customers or PEPs can be conducted electronically, as long as the Trader's Electronic System is capable of identifying the official identity of the High-Risk prospective Customers and Customers or PEPs.
In the event that the identification of High-Risk prospective Customers and Customers or PEPs is conducted electronically, the implementation can be carried out, among others, through the filling out of electronic forms and the submission of copies of documents as referred to in Article 25, Article 26, Article 27, Article 28, and Article 29 of the Financial Services Authority Regulation regarding the implementation of AML, CFT, and CPF programs in the financial services sector electronically (softcopy) through the Trader's website or application.
In addition to copies of documents as referred to in item 5), the Trader may request additional data, documents, and information needed in electronically identifying and verifying prospective Customers, the submission of which is carried out through the Trader's website or application. Examples of such additional data, documents, and information can include data and information as referred to in item 8 letter g regarding the identification of prospective Customers or Customers.

b. Verification of High-Risk Prospective Customers and Customers or PEPs

Verification of High-Risk prospective Customers and Customers or PEPs is carried out by paying attention to the provisions as referred to in item 9 letter a, letter b, letter c, letter d, and letter e.
In addition to paying attention to the provisions as referred to in item 1), the Trader may conduct verification of High-Risk prospective Customers and Customers or PEPs in the implementation of EDD by methods including but not limited to:

a) requesting or seeking additional information regarding the Customer's profile, such as occupation, source of funds, source of wealth; b) updating Customer identity data; c) requesting or seeking additional information regarding the reasons or basis for transactions conducted by the Customer; d) obtaining approval from Senior Officials to initiate and/or continue business relationships and/or transactions; and/or

https://jdih.ojk.go.id/

e) conducting stricter monitoring of transactions conducted by the Customer.

Verification of High-Risk prospective Customers and Customers or PEPs as referred to in item 1) can be conducted electronically.
In the event that the Trader conducts verification of High-Risk prospective Customers and Customers or PEPs electronically, the Trader must pay attention to the provisions as referred to in item 9 letter g.

Identification and Verification of Beneficial Owners

a. Identification of Beneficial Owners

The Trader must ensure whether the business relationship with prospective Customers or transactions with Customers are conducted for the benefit of:
a) prospective Customers or Customers; or b) other parties or Beneficial Owners.
If prospective Customers represent Beneficial Owners to open business relationships or conduct transactions, the Trader must conduct CDD procedures against Beneficial Owners that are equally strict as CDD procedures for prospective Customers.
In the event that Beneficial Owners are classified as High-Risk Customers or PEPs, the procedure applied is stricter CDD procedures or Enhanced Due Diligence (EDD).
The Trader must examine the truthfulness of information provided by prospective Customers by verifying supporting documents based on documents and/or other independent sources and ensuring the currency of such information.
In identifying corporate prospective Customers, the Trader must determine Beneficial Owners based on data and/or information provided by prospective Customers.
Identification of Beneficial Owners from corporations in the form of limited liability companies can be conducted, among others, through tracing information as follows:

a) individuals who have a majority share ownership percentage. Majority share ownership depends on the ownership structure of the limited liability company, which can be based on a threshold, for example, parties owning shares with a percentage of more than 25% (twenty-five percent).

b) in the event that no majority share ownership is found (shareholders have equal ownership percentages), the identification of the shareholder who most controls the corporation is conducted through other means, for example, individuals who have the ability to determine or appoint members of the Board of Directors.

c) in the event that no shareholder who most controls the corporation is found, for example, decisions are taken collectively by all shareholders of the corporation, the identification of Beneficial Owners is based on members of the Board of Commissioners or Board of Directors who most control the limited liability company.

The steps of tracing information for the identification of Beneficial Owners as referred to in letters a), b), and c) above are not optional alternative steps, but are hierarchical steps that will each be used if the previous steps have been applied by the Trader. However, the Trader has not yet been able to identify Beneficial Owners through these steps.

For Beneficial Owners that are state institutions or government agencies, companies with majority state-owned shares, or public companies or issuers, prospective Customers are not required to submit documents and/or identity documents of ultimate controllers. Nevertheless, the Trader must still conduct identification and verification of Beneficial Owners using data and information available in the public domain.
Exceptions to the requirement to submit documents and/or identity documents of Beneficial Owners as referred to in item 7) must be documented by the Trader.
If the Trader doubts or cannot verify the identity of Beneficial Owners, the Trader is obligated to refuse to conduct business relationships with prospective Customers or transactions with Customers.
Against prospective Customers or Beneficial Owners whose business relationships are rejected, the Trader must obtain at least name, identity number, address, and place and date of birth information in accordance with copies of identity documents obtained by the Trader for the purpose of reporting Suspicious Financial Transactions.
Identification of Beneficial Owners can be conducted electronically as long as the Trader's Electronic System is capable of identifying the official identity of Beneficial Owners.
To determine whether prospective Customers or Customers are acting for the benefit of Beneficial Owners, the implementation can be conducted, among others, by adding questions as to whether prospective Customers or Customers are acting for the benefit of Beneficial Owners in the filling out of electronic forms filled out through the Trader's website or application.
In the event that the identification of Beneficial Owners is conducted electronically, the implementation can be carried out, among others, through the filling out of electronic forms and uploading copies of identity documents in accordance with the provisions regarding the obligation to conduct identification and verification of Beneficial Owners as referred to in the Financial Services Authority Regulation regarding the implementation of AML, CFT, and CPF programs in the financial services sector, electronically (softcopy) through the Trader's website or application.

b. Verification of Beneficial Owners

In order to ensure the truthfulness of the identity of Beneficial Owners, verification can be conducted by:

a) conducting interviews via telephone or video conference with Beneficial Owners if necessary; b) matching the consistency of thumbprints, fingerprints, or facial photos (selfies) with identity documents or other documents containing signatures, electronic signatures, thumbprints, fingerprints, or facial photos (selfies) of Beneficial Owners; c) requesting the provision of more than one identity document of Beneficial Owners issued by the relevant party if there is doubt regarding the existing identity documents; d) In cases where necessary, conducting cross-checks to ensure consistency of various information provided. Cross-checks are carried out by methods including but not limited to:
(1) contacting prospective Customers via landline or office telephone; (2) contacting the human resources official at the prospective Customer's workplace if the prospective Customer is an employee of a company or agency; (3) confirming the prospective Customer's income by requiring bank statements from banks or other financial service providers; or (4) conducting geographic information analysis to view forest conditions through remote sensing technology for prospective Customers who are companies operating in the forestry sector; and/or e) ensuring that prospective Customers do not have a negative track record by verifying the identity of prospective Customers using other independent sources including but not limited to:
(1) DTTOT issued by the National Police of the Republic of Indonesia; (2) DPPSPM; or (3) other data such as the prospective Customer's employer identity, telephone accounts, and electricity accounts.
The completion of the identity verification process for Beneficial Owners must be done before opening a business relationship with prospective Customers or conducting transactions

https://jdih.ojk.go.id/

with Customers acting for and on behalf of the interests of the Beneficial Owner.

Under certain conditions, the verification process may be completed after the business relationship or transaction has been established. Certain conditions include situations where:

a) document completeness cannot be met at the time the business relationship or transaction is to be conducted, for example, because documents are still being processed. In this case, the Beneficial Owner may submit documents after establishing the business relationship, within the timeframe set by the Trader, followed by adequate risk mitigation; and/or

b) the risk level of the individual Beneficial Owner is classified as low.

Verification of the Beneficial Owner may be conducted electronically as long as the Trader's Electronic System is capable of verifying the authenticity of the official identity of the Beneficial Owner.
In the event that the Trader conducts electronic verification of the Beneficial Owner, the Trader must observe the provisions as referred to in item 9 letter g.

Simplified CDD (Simplified CDD)

a. In the event that the Trader assesses that a prospective Customer or Customer, based on the results of the risk assessment of Money Laundering, Terrorism Financing, and/or Proliferation Financing, has a low risk profile or the transaction conducted by the Customer is low risk and meets the criteria for a prospective Customer or Customer with a simple profile and characteristics, the Trader may apply Simplified CDD.

b. In the event that the Trader implements Simplified CDD, the Trader must at least:

ensure that the information and supporting documents for Simplified CDD contain at least identity, source of funds, and purpose of the transaction;
establish criteria for Customers with simple profiles and characteristics eligible for Simplified CDD, accompanied by clear reasons or basis for the determination that are consistent with the risk assessment conducted by the Trader, for example, High-Risk Customers or PEPs are not included as prospective Customers or Customers eligible for Simplified CDD;
ensure that Simplified CDD requirements are capable of managing and mitigating the threat level of Money Laundering, Terrorism Financing, and/or Proliferation Financing;
ensure that Simplified CDD requirements do not include Customers who are categorized as High-Risk Customers or PEPs based on legislation;
notify the Financial Services Authority (OJK) of the plan to implement Simplified CDD procedures, including the criteria for Customers with simple profiles and characteristics eligible for Simplified CDD and the start date of the implementation of the Simplified CDD procedures. Example: After conducting a customer risk analysis, the Trader decides to apply Simplified CDD to a specific group of Customers by changing the existing AML, CFT, and CPF policies and procedures. Based on the changes to the AML and CFT policies and procedures, if Simplified CDD will be applied starting March 30, the Trader may submit the notification to the Financial Services Authority regarding the plan to implement Simplified CDD before March 30;
document Customers eligible for Simplified CDD in a list that also contains information regarding the reasons for classifying the Customer as low-risk and eligible for Simplified CDD; and
ensure information security measures to maintain the confidentiality of managed data and information.

c. Customers who have received Simplified CDD must be removed from the Simplified CDD Customer list if they meet the following criteria:

identified in connection with suspected Money Laundering, Terrorism Financing, and/or Proliferation Financing;
have an increased risk level; and/or
do not align with the initial purpose at the time of registration as a Customer.

d. The Trader may conduct identification and verification of prospective Customers or Customers for the purpose of Simplified CDD electronically as long as the Trader's Electronic System is capable of identifying the official identity of low-risk prospective Customers or Customers and meeting the criteria for prospective Customers or Customers with simple profiles and characteristics, as well as being capable of verifying the authenticity of the official identity of the prospective Customers or Customers in question.

e. In the event that the Trader conducts identification and verification of prospective Customers or Customers for the purpose of Simplified CDD electronically, the implementation must observe the provisions as referred to in item 8 letter d, letter e, letter f, and letter g, as well as item 9 letter g.

Third-Party CDD

a. The Trader may use the results of CDD conducted by a third party against prospective Customers who have become Customers of that third party.

b. Third-party CDD does not apply to agency relationships or outsourcing. This is because in agency or outsourcing relationships, CDD is conducted for the interests of the Trader in accordance with the Trader's procedures and subject to the control of the Trader who delegates the application of those procedures.

c. In the event that results of CDD conducted by a third party against prospective Customers are available, the Trader may use the results of CDD conducted by the third party against those prospective Customers.

d. In the event that the Trader uses the results of Third-Party CDD:

CDD responsibility remains with the Trader.
The Trader must understand the purpose and intent of the business relationship and identify and verify the Customer and Beneficial Owner.
The Trader must obtain the necessary information related to CDD procedures as soon as possible.
The Trader must have cooperation with the third party in the form of a written agreement, wherein the written agreement must contain clauses confirming that the Trader has the right to obtain information, data, or copies of Customer supporting documents from the third party that has conducted CDD on the Customer, provided that the information, data, or copies of Customer supporting documents are needed solely for the implementation of the AML, CFT, and CPF programs, and not for other interests such as marketing. Example: The interest in implementing the AML, CFT, and CPF programs is the fulfillment of requests for information, data, and copies of Customer supporting documents from the Financial Services Authority, PPATK, or law enforcement officials.
The Trader must take adequate steps to ensure that the third party is willing to fulfill requests for information and copies of supporting documents immediately at the first opportunity when needed by the Trader in the implementation of the AML, CFT, and CPF programs.
The Trader must ensure that the third party is a financial institution and/or provider of goods and/or services and specific professions that have CDD procedures and are subject to supervision by the competent authority in accordance with applicable regulations. For example, the Trader may use the results of CDD conducted by:

a) financial service providers in the banking, capital market, and/or non-bank financial industry sectors, where the financial service provider has CDD procedures established by the competent supervisory authority, namely the Financial Services Authority; or

b) commodity futures brokerage companies, where the commodity futures brokerage company has CDD procedures established by the competent supervisory authority, namely the Commodity Futures Trading Regulatory Agency (BAPPEBTI).

The Trader must pay attention to information regarding the country risk where the third party originates.
In the event that the Trader intends to use the results of third-party CDD from a third party located in a high-risk country, this may be done if:

a) the third party is in the same financial group as the Trader;

b) the financial group has effectively implemented CDD, document management, and AML, CFT, and CPF programs in accordance with FATF Recommendations;

c) adequate risk mitigation has been conducted by the AML, CFT, and CPF unit against the high-risk country based on the AML, CFT, and CPF program policies at the financial group level; and

d) the financial group is supervised by a competent authority.

The Trader ensures that the third party is in a country that complies with FATF Recommendation standards.

Travel Rule

In providing digital financial asset transfer or transfer services, the Trader is required to apply the Travel Rule principle as follows:

a. in the transfer or transfer of Digital Financial Assets with a value in Rupiah equivalent to or greater than USD 1,000.00 (one thousand US dollars), the following details and/or information must be obtained:

the sender includes:

a) sender's name, sender's Wallet address, and sender's address;

b) ID card is mandatory for Indonesian citizens; and

c) passport, identity card issued by the Customer's country of origin, permanent residence permit card, or limited residence permit card for foreign citizens, if possible to obtain;

the recipient includes:

a) recipient's name;

b) recipient's wallet address; and

c) recipient's address; and

b. in the transfer or transfer of Digital Financial Assets with a value in Rupiah equivalent to less than USD 1,000.00 (one thousand US dollars), the following details and/or information must be obtained:

the sender includes:

a) sender's name; and

b) sender's wallet address; and

the recipient includes:

a) recipient's name; and

b) recipient's wallet address.

Rejection of Business Relationship or Freezing of Transactions and Closure/Termination of Business Relationship

a. The Trader is obligated to have a system for recognizing and monitoring Digital Financial Asset transactions, using a regulatory technology-based system, to monitor and review current transaction recognition and monitoring and past records to determine if there are any suspicious transactions involving Digital Financial Assets. Example: Blockchain analytic tools are applications that can collect, process, and analyze data from the blockchain, whether paid or publicly provided (open source).

b. The Digital Financial Asset transaction recognition and monitoring system as referred to in letter a must be capable of detecting at least the following:

Digital Financial Asset transactions indicated to be conducted by High-Risk Customers;
Digital Financial Asset transactions related to Money Laundering, Terrorism Financing, and/or Proliferation Financing;
red flag transaction indicators based on FATF Recommendations; and
Digital Financial Asset transactions indicated to use methods, techniques, or efforts to enhance anonymity, reduce transparency, and obscure financial flows, for example: anonymity-enhanced cryptocurrencies (AECs), mixers and tumblers, decentralized platforms and exchanges, privacy wallets.

c. In the event that the monitoring system as referred to in letter a indicates the presence of Suspicious Financial Transactions, the Trader must:

reject the transfer of the Customer's Digital Financial Assets from the Trader's wallet to a recipient wallet indicated to be involved in Money Laundering, Terrorism Financing, and/or Proliferation Financing;
freeze the account of the Customer receiving the transfer of Digital Financial Assets from a wallet indicated to be involved in Money Laundering, Terrorism Financing, and/or Proliferation Financing; and/or
close/terminate the business relationship with the Customer.

d. The Trader is prohibited from opening or maintaining anonymous accounts or accounts using fictitious names.

e. The Trader must reject the business relationship or transaction or close/terminate the business relationship with a prospective Customer or Customer in the event that:

they are unwilling to provide information and/or complete documents required by the Trader;
the Trader cannot verify the authenticity of the identity and completeness of documents;
incoming transfers to the Customer's account occur, but after the Customer receives and conducts re-CDD, and based on the sender, it is known that the recipient Customer's account is an account for harboring criminal proceeds as referred to in legislation governing the prevention and eradication of Money Laundering;
providing information and/or documents that are inconsistent or reasonably suspected to be fake documents or information whose authenticity is doubtful;
the source of transaction funds is known and/or reasonably suspected to originate from criminal proceeds;
they are recorded in the DTTOT; and/or
they are recorded in the DPPSPM.

f. The Trader is obligated to notify the Customer in writing regarding the closure of the business relationship.

g. Written notification may be conducted by sending a letter addressed to the Customer according to the address recorded in the Trader's database or announced through print media, electronic media, or other media.

h. In the event that the Trader rejects the business relationship with a prospective Customer or rejects a transaction or closes/terminates the business relationship with a Customer, the Trader is obligated to report this to PPATK regarding the action of rejecting the business relationship or transaction or closing/terminating the business relationship as a Suspicious Financial Transaction.

i. In the event that written notification has been conducted and the Customer does not withdraw the remaining funds stored with the Trader, the settlement of the Customer's remaining funds is conducted in accordance with applicable legislation, including by handing over the remaining funds to the Estate Management Office (Balai Harta Peninggalan).

j. The Trader must document prospective Customers or Customers affected by transaction rejection or business relationship closure as referred to in letter c and letter e in a separate list.

Continuous Management of Money Laundering, Terrorism Financing, and/or Proliferation Financing Risks

a. The Trader must have policies and procedures to manage continuous risks related to Money Laundering, Terrorism Financing, and/or Proliferation Financing risks, where risk management is not only conducted when the Trader establishes a business relationship with a prospective Customer or conducts transactions with a Customer.

b. Policies and procedures for continuously managing Money Laundering, Terrorism Financing, and/or Proliferation Financing risks include:

Risk Identification

In conducting risk identification, the Trader must assess Money Laundering, Terrorism Financing, and/or Proliferation Financing risks inherent in its business by considering inherent risks such as Customer risk, country/area/geographical/jurisdiction risk, product/service/transaction risk, and distribution network (delivery channels).

Risk Control and Mitigation

Risk control and mitigation that can be applied include:

a) identifying and verifying prospective Customers and monitoring Customer transactions;

b) increasing the frequency of supervision and conducting continuous review of business relationships;

c) upgrading CDD to Enhanced Due Diligence (EDD) conducted by the Trader in response to increased Money Laundering, Terrorism Financing, and/or Proliferation Financing risks present in the Customer, the source of funds used to purchase products/services/transactions, and the Customer's transaction patterns in purchasing products and services; and

d) escalation or hierarchical approval for establishing business relationships or transactions through Senior Official approval.

Maintenance of Accurate Data Related to Customers and Customer Transactions

a. Maintenance of accurate data related to Customers and Customer transactions is not only useful for the Trader in risk management and business development, but is also necessary as an effort to assist competent authorities in conducting compliance supervision, examinations of suspected Money Laundering, Terrorism Financing, and/or Proliferation Financing, as well as investigations and inquiries into funds indicated to originate from crime, so that documents stored by the Trader must be sufficient to be used as evidence (if necessary) by law enforcement officials.

b. The Trader must manage or document Customer data, including data obtained from the identification and verification process of prospective Customers or monitoring of Customer transactions, including those with high risks or PEPs in the context of EDD, Beneficial Owners, or those classified as low-risk and meeting the criteria for prospective Customers or Customers with simple profiles and characteristics in the context of Simplified CDD.

c. The Trader must have policies and procedures for document management timeframes covering:

documents related to Customer data must be managed for a period of at least 5 (five) years from:

a) the end of the business relationship with the Customer; and/or

b) the discovery of transaction inconsistencies with economic purposes and/or business purposes.

documents related to Customer financial transactions must be managed for the period as regulated in legislation regarding corporate documents.
managed documents must include at least:

a) Customer identity and supporting documents;

b) transaction information conducted;

c) results of analysis conducted;

d) correspondence with Customers; and

e) other documents related to the reporting of Suspicious Financial Transactions.

d. Documents as mentioned in letter b and letter c may be stored through electronic data or document formats in the Trader's database while still observing data or electronic document security systems.

e. In the event that documents as mentioned in letter b and letter c are stored through electronic data or document formats in the Trader's database, the Trader must be capable of displaying the electronic data or documents in full in accordance with legislation, when requested by the Financial Services Authority and/or other competent authorities such as PPATK and/or law enforcement officials.

Updating Customer Data

a. The Trader must update Customer data in accordance with the provisions as referred to in the Financial Services Authority Regulation regarding the implementation of AML, CFT, and CPF programs in the financial services sector continuously and ensure that data, information, and/or documents collected through the CDD and/or EDD process are the most recent data intended to identify the consistency between Customer transactions and the Customer's profile.

b. Data, information, and/or Customer supporting document updating activities are based on the Money Laundering, Terrorism Financing, and/or Proliferation Financing risk level of the Customer and are focused on higher-risk Customers first.

c. Data updating based on Customer risk level as referred to in letter b is obtained from the results of Customer risk assessment manifested in Customer classification based on risk level, taking into account business capacity, business complexity, business characteristics, and/or significant events or developments in Trader management and operations, for example:

Traders with automated data updating capacity capable of reporting all risk levels in real time are updated annually.
Traders with limited data updating capacity are updated as follows:

a) High-Risk Customers are updated at least once a year;

b) Medium-Risk Customers are updated at least once every 2 (two) years; and

c) Low-Risk Customers are updated at least once every 3 (three) years.

d. In conducting data, information, and/or Customer supporting document updating (Customer data updating), the Trader must document Customer updating efforts in the form of worksheets containing the Customer's name, Customer updating date, Customer updating method (for example, via email, phone, letter, news in print and electronic media including the internet or other trusted sources), Customer data updating results, and follow-up on updating results, specifically regarding Customer data that could not be successfully updated.

e. In the event that the Trader's resources are limited, Customer updating activities are conducted on a priority scale, based on:

Customer risk level classified as High-Risk Customer;
transactions with significant amounts and/or deviating from transaction profiles or Customer profiles;
significant changes in balance values; and
information in the integrated Customer profile (single customer identification file) is inconsistent with the Customer profile.

f. High-Risk Customer criteria can be seen from:

background or profile of High-Risk Customers;
high-risk financial services sector products used as a means for Money Laundering, Terrorism Financing, and/or Proliferation Financing;
transactions with parties from high-risk countries or Customers having significant relationships with high-risk countries;
transactions inconsistent with Customer profiles;
inclusion in the PEP category;
business field included in high-risk business;

https://jdih.ojk.go.id/

country or territory of origin, domicile, or place of transaction, including high-risk countries;
listed in the DTTOT;
listed in the DPPSPM; and/or
transactions suspected to be related to the proceeds of crime (TPPU), terrorism financing (TPPT), and/or proliferation financing (PPSPM).

g. The implementation of customer data updates as outlined in the data update plan can be carried out, among others, at the following times:

replacement of customer identity documents and data; or
closure of the business relationship.

h. Traders must ensure that documents, data, or information gathered during the Customer Due Diligence (CDD) process are always updated and remain relevant by re-examining existing data, particularly regarding High-Risk Customers or Politically Exposed Persons (PEP).

i. Regarding the updating of DTTOT and DPPSPM, Traders:

must maintain DTTOT and DPPSPM;
must match the consistency of customer names and information held by the Trader with the names and information contained in the DTTOT and DPPSPM submitted by the Financial Services Authority (OJK);
must match the consistency of prospective customer names and information intended to become the Trader's customers with the names and information contained in the DTTOT and DPPSPM received by the Trader; and
may use the updated DTTOT and DPPSPM as a screening tool when establishing a business relationship with prospective customers.

j. Traders may update customer data electronically. In the event that Traders perform data updates electronically, then:

Traders must still observe the matters referred to in letters a through j.
Traders may perform updates through automation connected to big data with reliable sources.
Customer data updates are performed based on periodic risk assessment results using the following methods:
a) sending notifications via email so that Customers update their data and information; b) in accordance with risk assessment results, if there are Customers whose data update time has arrived, the Trader displays a notification in the application or website so that Customers update their data and information; c) in accordance with risk assessment results, if there are Customers whose data update time has arrived, before the Customer conducts a transaction, the Trader displays a special pop-up feature for Customers to update their data and information, whereby the transaction can continue after the data update process has been completed by the Customer; and/or d) in accordance with risk assessment results, if there are Customers whose data update time has arrived, the Trader displays a special pop-up feature for Customers to update their data when the Customer opens the Trader's application and/or website, where the application will only open after the data update has been completed by the Customer.

k. Traders must account for and document the customer data update process.

l. The accounting and documentation of customer data updates can be done manually in written form through formal documents such as memos, notes, or records, which can also be stored in electronic data or document formats in the Trader's database.

Follow-up on DTTOT and/or DPPSPM
a. Traders must maintain and update the DTTOT and/or DPPSPM submitted by the Financial Services Authority (OJK) through the system provided by the Financial Services Authority (OJK). This maintenance aims to ensure that Traders do not establish business relationships with prospective customers or conduct transactions with Customers who have identities and information matching those contained in the DTTOT and DPPSPM.

b. Traders are prohibited from providing, giving, or lending funds to or for the benefit of persons or corporations whose identities are listed in the DTTOT and/or DPPSPM. The term "funds" refers to all assets or tangible or intangible movable or immovable property, whether tangible or intangible, obtained by any means and in any form, including in digital or electronic formats, proof of ownership, or connection to all such assets or property, including but not limited to bank credits, traveler's checks, bank-issued checks, money transfer orders, shares, securities, bonds, bank drafts, debt acknowledgments, and Digital Financial Assets.

c. Traders must:

identify and ensure the consistency of identities and other information (including place and date of birth and Customer address) regarding Customers with identities and other information listed in the DTTOT and/or DPPSPM; and
mitigate the risk of potential false positives or false negatives, since the Trader received the DTTOT and/or DPPSPM.

The term "false positive" refers to errors in the immediate blocking implementation carried out by the Trader due to the Trader's customer information system finding partial consistency between Customer information in the Trader's database and the identity of individuals or corporations listed in the DTTOT and/or DPPSPM.

The term "false negative" refers to errors in not implementing immediate blocking by the Trader due to the Trader's customer information system finding partial consistency between Customer information in the Trader's database and the identity of individuals or corporations listed in the DTTOT and/or DPPSPM, while failing to pay sufficient attention to the consistency of all information.

d. In the event that there is consistency of identities and other information regarding Customers or Beneficial Owners with identities and other information listed in the DTTOT and/or DPPSPM, Traders must implement immediate blocking without delay and without prior notification to the Customer or Beneficial Owner, while also referring to other applicable laws and regulations.

In the event that immediate blocking without delay is implemented, the rights of blocked Customers remain provided according to the applicable regulations of the Trader, but these rights remain subject to the blocking.

e. Blocking is implemented against funds owned or controlled, directly or indirectly, obtained by any means and in any manner, by Customers or Beneficial Owners, either fully or jointly with other parties.

f. In the event that there is consistency of identities and other information regarding prospective customers, Customers, and/or Beneficial Owners with identities and other information listed in the DTTOT and/or DPPSPM, Traders must report this as a Suspicious Transaction Report to PPATK.

g. Traders who implement immediate blocking without delay regarding DTTOT must:

create minutes of immediate blocking without delay; and
submit a report of such immediate blocking by attaching the minutes of immediate blocking without delay to the Indonesian National Police (Polri) with a copy to the Financial Services Authority (OJK).

h. Traders who implement immediate blocking without delay regarding DPPSPM must:

create minutes of immediate blocking without delay; and
submit a report of such immediate blocking by attaching the minutes of immediate blocking without delay to PPATK with a copy to the Financial Services Authority (OJK).

i. In the event that no consistency of identities and other information regarding Customers with identities and other information listed in the DTTOT is found, Traders must create and submit a null report to the Indonesian National Police (Polri) with a copy to the Financial Services Authority (OJK).

j. In the event that no consistency of identities and other information regarding Customers with identities and other information listed in the DPPSPM is found, Traders must create and submit a null report to PPATK with a copy to the Financial Services Authority (OJK).

k. Traders must identify, assess, understand, and mitigate the risk of sanction evasion regarding DTTOT and/or DPPSPM conducted by prospective customers, Customers, and/or Beneficial Owners.

l. The term "sanction evasion" refers to efforts to evade sanctions by parties whose identities are listed in the DTTOT and/or DPPSPM who conduct business relationships and/or financial transactions with or on behalf of other parties to avoid the detection of Suspicious Transactions.

Examples include prospective customers, Customers, and/or Beneficial Owners conducting business relationships and/or transactions through the following modes:

conducted for the benefit of and/or under the direction, directly or indirectly, of parties whose identities are listed in the DTTOT and/or DPPSPM;
controlled by parties whose identities are listed in the DTTOT and/or DPPSPM; and/or
conducted to assist parties whose identities are listed in the DTTOT and/or DPPSPM in the context of sanction evasion.

Monitoring of Customers and Customer Transactions
a. Traders must conduct monitoring activities that at minimum include:

Customer information and documents;
Customer transactions; and
business relationships/transactions with High-Risk Customers or PEPs.

b. Monitoring conducted by Traders as referred to in letter a must observe the following:

monitoring is conducted continuously to identify consistency between Customer transactions and Customer risk profiles;
monitoring includes analysis of all transactions that do not match the Customer's risk profile;
if necessary, Traders may request information regarding the background and purpose of transactions for transactions that do not match the Customer's profile, while observing anti-tipping-off regulations; and
Anti-tipping-off regulations are regulations that prohibit Traders from informing Customers or any other parties, directly or indirectly, in any manner, regarding Suspicious Transaction Reports that are being prepared or have been submitted to PPATK.

c. Customer profile and transaction monitoring activities are conducted continuously and include:

ensuring the completeness of Customer information and documents;
examining the consistency between transaction profiles and Customer profiles; and
examining the similarity or consistency of names and information with names and information listed in:
a) DTTOT; b) DPPSPM; and c) documents or information containing the names of suspects or defendants published in the mass media or by competent authorities.

d. Information sources that can be used to monitor Customers designated as suspects or defendants can be obtained, among others, from:

data issued by competent authorities such as PPATK;
public data issued by Ministries/Agencies managing government affairs in relevant fields; or
public data listed in mass media such as newspapers, magazines, television, and the internet.

e. Traders must classify transactions and Customers requiring special monitoring. Monitoring of Customer transactions must be stricter if there are High-Risk Customers.

f. In the event that Traders monitor Customer profiles and transactions electronically, Traders must ensure that the Electronic Systems used can:

identify, analyze, monitor, and effectively provide reports on profiles, characteristics, and/or transaction pattern habits conducted by Customers; and
trace each transaction, if necessary, including among others tracing Customer identities, transaction forms, transaction dates, amounts, and denominations, as well as transaction funding sources.

g. Traders may monitor profiles and transactions electronically using regulatory technology, including by utilizing algorithms, specific parameters, artificial intelligence, and machine learning.

h. Traders must account for and document the process of monitoring Customer profiles and transactions.

i. The accounting and documentation of monitoring Customer profiles and transactions can be done manually in written form through formal documents such as memos, notes, or records, or through electronic data or document formats in the Trader's database.

Transaction and Customer Reception Trail
a. Traders must maintain a trail of transaction activities and customer reception.

b. The trail of transaction activities and customer reception is used for supervision, law enforcement, dispute resolution, verification, testing, and other examinations.

c. The implementation of transaction and customer reception trails includes at minimum:

maintaining transaction logs according to the Trader's data retention policy, in accordance with applicable laws and regulations. Transaction logs contain complete and real-time transaction activities;
notifying Customers when a transaction has been successfully completed;
ensuring the availability of audit trail functions to detect attempts and/or occurrences of intrusion, which must be analyzed or evaluated periodically; and
in the event that transaction processing and customer reception trail systems are conducted by third parties, the trail process of transaction activities and customer reception must comply with the standards established for Traders as referred to in numbers 1), 2), and 3).

d. Transaction and customer reception trail processes can be conducted electronically, including:

electronic transaction logs or records in the Trader's database;
notifications via email, short message service (SMS), pages, or Trader applications to Customers when a transaction has been successfully completed; and
early warning systems to detect attempts and/or occurrences of intrusion.

Reporting to Senior Officials, the Board of Directors, and the Board of Commissioners
a. Senior Officials, the Board of Directors, and/or the Board of Commissioners must be involved hierarchically in the approval and supervision of special conditions including:

the presence of high-risk prospective customers or PEPs wishing to establish business relationships with Traders;
the presence of prospective customers from high-risk countries; and/or
transactions conducted by High-Risk Customers or PEPs.

b. Reports on the progress of approval and supervision regarding these special conditions are reported hierarchically from Senior Officials, the Board of Directors, and the Board of Commissioners.

c. Reporting policies and procedures to Senior Officials, the Board of Directors, and the Board of Commissioners include:

in the event that the CDD process shows the presence of prospective customers or Customers categorized as high-risk or PEPs, the Trader's employees conducting CDD report to Senior Officials. Senior Officials are responsible for the acceptance and/or rejection of business relationships with prospective customers or Customers who are high-risk or PEPs;
in the event that Senior Officials approve business relationships with High-Risk Customers or PEPs, Senior Officials are responsible for monitoring transactions of High-Risk Customers or PEPs;
Senior Officials must report to the Board of Directors overseeing the implementation of the APU, PPT, and PPPSPM programs regarding the number of prospective customers or High-Risk Customers or PEPs, including the number of High-Risk Customers or PEPs rejected, accepted, or having their business relationships closed;
the Board of Directors must provide directives on reports submitted by Senior Officials and establish risk mitigation steps;
the Board of Directors reports to the Board of Commissioners regarding the results of monitoring the implementation of the APU, PPT, and PPPSPM programs as a whole according to the written policies and procedures established by the Trader; and
the Board of Directors may propose updates to policies and procedures in the event of risk developments that need to be mitigated by the Trader and are not yet listed in the written policies and procedures.

Reporting Policies and Procedures to PPATK
a. Traders must have policies and procedures for reporting obligations to PPATK in accordance with regulations and reporting procedures as referred to in applicable laws and regulations regarding the prevention and eradication of TPPU, TPPT, and/or PPSPM, including implementing regulations such as the PPATK Head Regulation.

b. Reporting policies and procedures as referred to in letter a include at minimum policies and procedures for reporting Suspicious Transactions, reports related to DPPSPM, and other reports related to the implementation of APU, PPT, and PPPSPM programs in the event of information requests from PPATK.

Reporting Policies and Procedures to the Indonesian National Police (Polri)
Traders must have policies and procedures for reporting obligations to the Indonesian National Police (Polri) regarding reports related to DTTOT, and other reports related to the implementation of APU, PPT, and PPPSPM programs in the event of information requests from the Indonesian National Police (Polri).

V. INTERNAL CONTROL

General Internal Control
a. The implementation of risk-based APU, PPT, and PPPSPM programs (risk-based approach) that are effective must be implemented in internal control and internalized in the Trader's business processes.

b. Traders are required to have effective and independent internal control systems. The aforementioned systems aim to ensure Trader compliance in effectively implementing APU, PPT, and PPPSPM programs and to minimize the TPPU, TPPT, and/or PPSPM risks faced by Traders.

c. In internal control, Traders must observe the following:

the scale and complexity of the Trader;
the business or operational activities of the Trader, including geographic area/country aspects, Customer profiles, products or services, and overall transaction activities of the Trader;
distribution channels used;
transaction volume and intensity;
the level of risk assessment for each of the Trader's business activities; and/or
business relationships between Traders and Customers, whether directly, correspondent, or non-face-to-face.

d. Traders must have effective and independent internal control systems to ensure that all functions implementing APU, PPT, and PPPSPM programs run according to established policies and procedures. Effective and independent control systems can be demonstrated by:

adequate policies, procedures, and internal monitoring capable of timely detecting weaknesses and deviations occurring in the implementation of APU, PPT, and PPPSPM programs;
limits of authority and responsibilities of work units related to the implementation of APU, PPT, and PPPSPM programs, where Traders must ensure clear separation of duties, authorities, and responsibilities between special internal control units, functions, or officials designated to perform internal control functions and other Trader business units;
the appointment of special work units and/or officials responsible for implementing APU, PPT, and PPPSPM programs;
updating compliance standards for implementing APU, PPT, and PPPSPM programs;
policies, procedures, and monitoring related to Trader employee screening/recruitment, to ensure that Trader employees are not used as a means of TPPU, TPPT, and PPSPM through the Trader's business processes;
monitoring of Customers, Customer transactions, and/or the use of Electronic Systems in the Trader's business processes, particularly those with high TPPU, TPPT, and PPSPM risks, including monitoring of specific matters requiring special attention based on suggestions and information from industry associations, regulators, or law enforcement agencies;
providing systems capable of accurately identifying, monitoring, and reporting Suspicious Transactions;
conducting reviews of risk assessments and management processes;
adequate supervision before the offering of Digital Financial Assets, Crypto Assets, new products or services, use of new technologies, or offering of modified products/services that have the potential to increase TPPU, TPPT, and/or PPSPM risks;
the prompt and accurate submission of information in the event of indications and/or suspicions regarding TPPU, TPPT, and/or PPSPM risks, improvement steps taken, results of weakness identification regarding existing regulations, follow-up plans for improvements, and

reporting submitted to the competent authorities;
11) compliance with legal regulations, reporting requirements, and recommendations regarding the implementation of AML, CFT, and CPF programs, and updating changes in legal regulations;
12) implementation of policies, procedures, and controls regarding CDD and EDD;
13) adequate supervision regarding high-risk customers, transactions, and products, such as transaction limits or management approval;
14) adequate supervision of Trader employees who prepare reports, receive grants, monitor suspicious activities, or are involved in other activities that are part of the implementation of AML, CFT, and CPF programs;
15) integration of compliance with the implementation of AML, CFT, and CPF programs into appropriate job descriptions and performance evaluations;
16) appropriate and relevant training regarding the implementation of AML, CFT, and CPF programs for all employees;
17) testing of the effectiveness of the implementation of AML, CFT, and CPF programs through random sampling and documenting the tests conducted; and
18) independent examination to ensure compliance and effectiveness of AML, CFT, and CPF implementation, carried out in accordance with the needs and complexity of the Trader's business.
e. In conducting internal controls, Traders may use regulatory technology such as algorithms, artificial intelligence technology, and/or machine learning. f. In the event that Traders conduct internal controls using regulatory technology as referred to in letter e, Traders must ensure that the regulatory technology used in the internal control system:

is based on the results of risk assessments, which include how Traders manage and mitigate risks related to the Electronic Systems used;
is reliable and has been certified by the ministry responsible for communication and information affairs; and
ensures data and information security, including the use of security tools such as encryption technology, antivirus, and firewalls.
g. The person responsible for implementing internal controls in the context of implementing AML, CFT, and CPF programs may be carried out by the person responsible for compliance functions or internal audit functions. h. Traders may have a system for reporting suspected violations (whistleblowing system/WBS) intended to maintain professional integrity, and the Trader's accountability. The system allows internal company parties (employees) or external parties such as prospective customers, customers, or the general public to report suspected violations of ethics, behavior, work procedures, and/or legal regulations committed by human resources (including Directors and the Board of Commissioners) of the Trader.
i. The system for reporting suspected violations (whistleblowing system/WBS) must at least include:
an independent, free, and confidential reporting system;
protection of the reporter's identity confidentiality;
protection for the reporter from pressure, dismissal, legal lawsuits, up to physical actions. Protection is not only for the reporter but can also be extended to the reporter's family members; and
information on the implementation of follow-up actions, including when, how, and to which institution the WBS follow-up is directed.
j. An independent work unit managing the system for reporting suspected violations (whistleblowing system/WBS) may be held concurrently by the official appointed as the person responsible for the implementation of the AML, CFT, and CPF programs as referred to in letter d number 3.

Internal Controls over Electronic Systems in Trader Business Processes
a. Traders must ensure that internal controls over Electronic Systems in Trader business processes are sufficiently adequate and effective in implementing AML, CFT, and CPF programs, and are capable of anticipating the possibility that the Electronic Systems used by Traders are not utilized as means of TPPU, TPPT, and/or PPSPM. b. Traders must ensure the continuity and stability of Electronic Systems operations and conduct risk mitigation that could potentially disrupt Trader operations.
c. In the event that Traders use third-party information technology service providers used in implementing AML, CFT, and CPF programs, Traders must ensure that such third-party information technology service providers have implemented electronic system usage risk management. For example, the service provider has obtained certification from an official institution.
VI. MANAGEMENT INFORMATION SYSTEM
Traders are required to have a management information system capable of effectively identifying, analyzing, monitoring, and providing reports regarding the characteristics or transaction pattern habits of Customers.
The management information system as referred to in number 1 is intended to effectively identify, analyze, monitor, and provide reports regarding Customer transaction characteristics using parameters adjusted periodically and considering business complexity, transaction volume, and risks held by Traders, covering at least:
a. financial transactions deviating from the profile, characteristics, or transaction pattern habits of the respective Customer; b. financial transactions by Customers suspected to be conducted with the intention of avoiding reporting of the relevant transactions required to be reported by reporters in accordance with legal regulations;
c. financial transactions conducted or cancelled using assets suspected to originate from criminal acts;
d. financial transactions requested by PPATK to be reported by reporters because they involve assets suspected to originate from criminal acts; e. Customer transactions that do not meet CDD requirements; and f. Customer transactions whose information truthfulness is doubted by Traders.
Traders must ensure that electronic systems used in management information systems are reliable and based on risk assessment results, which include how Traders manage and mitigate risks related to the electronic systems used.
Written policies and procedures owned by Traders are required to consider electronic system factors that could potentially be abused by TPPU, TPPT, and/or PPSPM perpetrators, such as opening accounts via the internet, or fund transfer orders via facsimile or telephone, and other electronic transactions.
Traders must have a management information system capable of tracing each transaction (individual transaction) and responding fully, quickly, and accurately to information, data, and document requests for internal purposes and/or the Financial Services Authority, as well as in relation to law enforcement efforts and judicial interests.
Traders must maintain databases (databases) of PEP, DTTOT, and DPPSPM.
To facilitate monitoring in the context of analyzing suspicious financial transactions, Traders must have and maintain a unified Customer profile (single customer identification file).
Information contained in the unified Customer profile (single customer identification file) covers all Digital Financial Assets, Crypto Assets, products and/or other services provided by Traders owned by Customers.
To ensure that management information systems continue to operate well and effectively, Traders must conduct risk mitigation, including against:
a. data security from cyberattacks and digital identity usage, which can be done by:

conducting identification and risk assessment related to Electronic Systems;
using Electronic Systems that are certified in accordance with legal regulations;
having Electronic Systems that are interconnected and mutually supportive;
using legal software;
having internal policies and procedures related to Electronic Systems, including the use of security tools such as encryption technology, anti-virus, and firewalls, including updates referring to regulations issued by ministries or institutions responsible for cyber and national cryptography affairs;
increasing human resource awareness in their environment to provide data privacy protection and prevent cyberattacks in the Electronic Systems they manage;
conducting training on preventing data protection failures in the Electronic Systems they manage;
conducting periodic IT audits of Electronic Systems and/or as needed according to Trader needs, intended to ensure the reliability of Electronic Systems used and to ensure that Electronic Systems are not used/exploited by TPPU, TPPT, and PPSPM perpetrators; and/or
educating Customers regarding personal data security and preventing cyberattacks.
b. personal data protection, which can be done as follows:
stored personal data has been verified for truthfulness;
personal data is stored in encrypted form;
personal data storage is conducted in accordance with legal regulations governing the duration of personal data storage; and
personal data access by Traders through Customer-owned hardware (e.g., smartphones) is limited in accordance with legal regulations.
c. If the personal data owner is no longer a Customer, Traders must store such personal data according to the time limit referred to in letter b number 3), calculated from the date the personal data owner last became a Customer.
d. data centers and disaster recovery centers used by Traders are operated in accordance with legal regulations.
VII. HUMAN RESOURCES AND TRAINING

Human Resources
a. To prevent Traders from being used as media or objectives for TPPU, TPPT, and PPSPM involving internal parties, Traders are obligated to conduct:

screening procedures for new employee recruitment (pre-employee screening) for both permanent and non-permanent employees (employees on probation before becoming permanent, employees in training before becoming permanent, and/or contract employees), including Senior Officials and experts, from the lowest level up to 1 (one) level below the Board of Directors and Board of Commissioners; and
introduction and monitoring of employee profiles (know your employee), for both permanent and non-permanent employees, including experts, from the lowest level up to the Board of Directors and Board of Commissioners. Introduction and monitoring of employee profiles (know your employee) covers character, behavior, and lifestyle of employees.
b. Screening procedures for new employee recruitment (pre-employee screening) are conducted in the form of:
screening methods intended to ensure that prospective employee profiles have no criminal records, including requiring prospective employees to create declaration letters and/or submit police record certificates;
conducting identity and education verification obtained by prospective employees, including through face-to-face or virtual interviews intended to further ensure the truthfulness of information and data from prospective employees;
conducting research through media or other information regarding the background of prospective employees, including work history and/or work experience of prospective employees;
ensuring good track records of prospective employees, including requesting recommendation letters from previous companies where prospective employees have worked; and
ensuring that prospective employees' credit quality is not classified as non-performing loans.
c. Introduction and monitoring of employee profiles, covering employee behavior and lifestyle, include:
conducting verification of employees who have undergone significant lifestyle changes;
ensuring that employees have understood and obeyed employee codes of conduct (code of conduct);
evaluating employees responsible for high-risk activities, including those with access to Trader data and/or dealing with prospective Customers or Customers.
d. Screening procedures (pre-employee screening), introduction, and monitoring of employee profiles are formulated in the know your employee policy, guided by regulations governing the implementation of anti-fraud strategies.

Training
a. Traders are required to provide training on AML, CFT, and CPF to officials and/or employees according to needs, continuously and periodically, at least 1 (one) time in 1 (one) year. b. Continuous and periodic training regarding the implementation of AML, CFT, and CPF programs must be provided to employees, particularly employees from relevant work units (e.g., work units directly or indirectly related to prospective Customers, such as Customer service officers, officers related to information technology management and development, and internal auditors) and new employees. In the event that, according to Trader needs based on TPPU, TPPT, and/or PPSPM risk assessments, business activities, business scale, business complexity, business characteristics, and/or significant events or developments in Trader management and operations, training can be conducted more than 1 (one) time in 1 (one) year.
c. In conducting continuous training as referred to in letter a, Traders may:

conduct it independently;
cooperate with other parties such as PPATK Trader associations, and/or relevant competent authorities;
and/or
involve their employees in training conducted by associations, PPATK, Financial Services Authority, and/or other competent authorities.
d. In determining training participants, Traders prioritize employees whose daily tasks meet the following criteria:
conducting supervision of AML, CFT, and CPF program implementation; and/or
related to reporting preparation to PPATK and the Financial Services Authority.
e. Other employees besides those referred to in letter d must receive training at least 1 (one) time during their employment period, where such training must have been conducted at the latest 1 (one) year since the employee first started working as a Trader employee. f. Training methods can be conducted by:
Training can be conducted virtually (online) or face-to-face.
Virtual (online) training as referred to in number 1) can use e-learning media provided by competent authorities such as PPATK or provided independently by Traders.
Face-to-face training is conducted using approaches including:
a) interactive face-to-face (e.g., workshops) with training topics adjusted to participant needs. This approach is used for priority employees and conducted continuously, e.g., every year; and/or b) one-way face-to-face (e.g., seminars) with training topics being general overviews of AML, CFT, and CPF program implementation. This approach is given to non-priority employees and conducted when there are significant regulatory changes. g. Training materials and evaluations are conducted by:
Traders can develop training materials regarding AML, CFT, and CPF program implementation according to needs. Some topics that can be training materials include:
a) implementation of legal regulations related to AML, CFT, and CPF programs; b) TPPU, TPPT, and/or PPSPM modus operandi and typologies; c) AML, CFT, and CPF program implementation policies and procedures, as well as employee roles and responsibilities in preventing and combating TPPU, TPPT, and/or PPSPM; d) information technology usage in implementing AML, CFT, and CPF programs, and risk mitigation regarding the use of such information technology; e) risk assessment and risk-based AML, CFT, and CPF program implementation; and f) employee roles and responsibilities in preventing and combating TPPU, TPPT, and/or PPSPM.
Training material depth is adjusted to employee needs and suitability with employee duties and responsibilities.
To determine employee understanding levels and training material suitability, Traders must conduct evaluations for each training session conducted.
Evaluations can be conducted directly through interviews or indirectly through tests.
Traders must conduct follow-up actions based on training evaluation results through training material and method improvements.
VIII. REPORTING

Reports to the Financial Services Authority
a. Traders must submit reports on AML, CFT, and CPF program implementation to the Financial Services Authority, at least consisting of:

Individual Risk Assessment/IRA; and
Data updating plan reports and data updating activity realization reports.
b. Individual Risk Assessment/IRA
Individual Risk Assessment/IRA is prepared in the following format:
a) Part I: introduction, consisting of at least:
(1) background; and
(2) objectives; b) Part II: theoretical basis, consisting of at least:
(1) methodology;
(2) framework; and
(3) scope limitations; c) Part III: Trader profile, containing descriptions of general Trader aspects, both institutional and operational; d) Part IV: risk assessment results, consisting of at least:
(1) risk maps/criteria for TPPU in general, mapped from the perspective of source criminal acts, Corporate Customer business fields, geographical areas (which may be countries as well as provinces and/or cities/regencies in Indonesia), products/services/services, and Transaction methods/distribution networks (delivery channels); (2) risk maps/criteria for TPPT in general, mapped from the perspective of Corporate Customer business fields, geographical areas (which may be countries as well as provinces and/or cities/regencies in Indonesia), products/services/services, and Transaction methods/distribution networks (delivery channels); (3) risk maps/criteria for PPSPM in general, mapped from the perspective of Corporate Customer business fields, geographical areas (which may be countries as well as provinces and/or cities/regencies in Indonesia), products/services/services, and Transaction methods/distribution networks (delivery channels); (4) risk maps of all Customers, i.e., Customer mapping based on risk levels; and (5) aggregate final risk of Traders; e) Part V: risk mitigation, containing at least matters already undertaken by Traders in mitigating TPPU, TPPT, and/or PPSPM risks; and f) Part VI: conclusions and follow-up, which is a summary of risk assessment results and risk mitigation to be undertaken.
IRA documents are submitted for the first time at the latest 12 (twelve) months after this Financial Services Authority Circular is issued.
Updates to IRA documents are submitted annually at the latest by the end of June.
In the event that the IRA reporting date falls on a holiday, the report submission is conducted on the next working day.
IRA document submissions are submitted online through electronic systems operated by the Financial Services Authority. In the event that such electronic systems are not yet available or experience disruptions, IRA document submissions are submitted physically or via email to the Financial Services Authority addressed to the head of the supervisory work unit.
c. Data Updating Plan Reports and Data Updating Activity Realization Reports
Customer Data Updating Plan Reports and Changes;
a) Customer data updating plan reports must receive Board of Directors approval. b) Customer data updating plan reports contain quantitative data (statistics of Customer numbers) and qualitative data (including obstacles, efforts already undertaken by Traders, and progress of such efforts). c) Data updating plan reports include Customer numbers and TPPU, TPPT, and/or PPSPM risk levels of Customers to be updated, information to be updated, updating methods or strategies, and the percentage of Customer fulfillment to be updated in a specific period. Example format of Customer data updating plan reports is contained in Appendix Part C, which is an integral part of this Financial Services Authority Circular. d) Customer data updating plan reports must be submitted to the Financial Services Authority annually at the latest by the end of December before the data updating period. For example, for Customer data updating for the period January to December 2026, Traders submit Customer data updating plan reports at the latest by December 31, 2025. e) Customer data updating plan reports are submitted online through electronic systems operated by the Financial Services Authority. In the event that such electronic systems are not yet available or experience disruptions, Customer data updating plan reports are submitted physically or via email to the Financial Services Authority addressed to the head of the supervisory work unit. f) In the event that the Customer data updating plan reporting date falls on a holiday, report submission is conducted on the next working day. g) In the event of changes to Customer data updating plan reports already submitted to the Financial Services Authority, Traders must submit such changes at the latest 7 (seven) working days since the changes were made.
Data Updating Realization Reports;
a) Customer data updating realization reports must receive Board of Directors approval. b) Customer data updating realization reports to the Financial Services Authority contain Customer updating results, including the number of target Customers to be updated, the number of Customers successfully updated, the number of Customers unsuccessfully updated reflected in the difference between targets and realization, obstacles faced, and follow-up efforts to be undertaken for Customers unsuccessfully updated. Example format of Customer data updating realization reports is contained in Appendix Part D, which is an integral part of this Financial Services Authority Circular. c) Data updating realization reports must be submitted to the Financial Services Authority annually at the latest by the end of January after the data updating period ends.

For example, for customer data updates carried out during the period from January to December 2026, Traders must submit reports on the realization of customer data updates no later than January 31, 2027. d) Reports on the realization of customer data updates are submitted online through the electronic system managed by the Financial Services Authority (OJK). In the event that the electronic system is not yet available or experiences technical difficulties, the report on the realization of customer data updates is submitted physically or via electronic mail to the OJK addressed to the head of the supervisory work unit. In the event that the reporting date for the realization of customer data updates falls on a holiday, the report submission is carried out on the next working day.

Procedures for submitting reports on the implementation of AML, CFT, and CCPF programs
a. Submission of reports on the implementation of AML, CFT, and CCPF programs is carried out online through the reporting system determined by the Financial Services Authority (OJK). b. In the event that the OJK Reporting System as referred to in letter a is not yet available or experiences technical difficulties, Traders submit reports in the form of electronic documents via electronic mail through the address:

mailingroomsumitro@ojk.go.id, in the event that the OJK Reporting System is not yet available;
mailingroommrp@ojk.go.id, in the event that the OJK Reporting System experiences technical difficulties; or
other addresses determined by the Financial Services Authority (OJK).
c. Submission of reports in the form of electronic documents via electronic mail as referred to in letter b is addressed to:
Head of the Department of Supervision of Financial Sector Technology Innovation, Digital Financial Assets and Crypto Assets, in the event that the OJK Reporting System is not yet available; or
Head of the International Department and Anti-Money Laundering and Counter-Terrorism Financing Department with a copy to the Head of the Department of Supervision of Financial Sector Technology Innovation, Digital Financial Assets and Crypto Assets, in the event that the OJK Reporting System experiences technical difficulties.
d. In the event that the OJK electronic mail as referred to in letter b experiences technical difficulties, the report submission is submitted to the Financial Services Authority (OJK) offline by:
direct handover; or
sending through a courier service company.
e. Physical submission of reports as referred to in letter d is addressed to:
Head of the Department of Supervision of Financial Sector Technology Innovation, Digital Financial Assets and Crypto Assets
Soemitro Djojohadikusumo Building https://jdih.ojk.go.id/

East Banteng Field Street 2-4
Jakarta 10710, Indonesia, in the event that the OJK Reporting System is not yet available; or
2) Head of the International Department and Anti-Money Laundering and Counter-Terrorism Financing Department
Soemitro Djojohadikusumo Building
East Banteng Field Street 2-4
Jakarta 10710, Indonesia, with a copy to:
Head of the Department of Supervision of Financial Sector Technology Innovation, Digital Financial Assets and Crypto Assets in the event that the OJK Reporting System experiences technical difficulties. f. Traders are deemed to have submitted reports with the following provisions:

submission through the OJK reporting system is proven by an acceptance receipt from the OJK Reporting System;
submission via electronic mail is proven by an electronic mail receipt from the OJK; or
offline submission is proven by a receipt from the Financial Services Authority (OJK).

Copies of Immediate Blocking Reports related to DTTOT and/or DPPSPM;
a. In the event that there is identity and other information matching between Customers or Beneficial Owners with the identity and other information listed in DTTOT and/or DPPSPM, Traders must submit Immediate Blocking reports without delay and without prior notification to the Customer or Beneficial Owner, and report them to the Indonesian National Police (for DTTOT) or to PPATK (for DPPSPM) with a copy to the Financial Services Authority (OJK) no later than 3 (three) working days since the Traders received the DTTOT and/or DPPSPM. b. Submission of copies of Immediate Blocking reports related to DTTOT and/or DPPSPM must be accompanied by attaching the minutes of Immediate Blocking.
c. Submission of copies of Immediate Blocking reports related to DTTOT and/or DPPSPM is submitted online through the electronic system managed by the Financial Services Authority (OJK), namely the AML CFT Program Information System (SIGAP).
d. In the event that the electronic system as referred to in letter c is not yet available or experiences technical difficulties, the copies of Immediate Blocking reports related to DTTOT and/or DPPSPM are submitted in the form of electronic documents via electronic mail through the addresses as referred to in item 2 letter b, addressed to the head of the supervisory work unit as referred to in item 2 letter c. e. In the event that the OJK electronic mail as referred to in letter d experiences technical difficulties, the report submission is submitted to the https://jdih.ojk.go.id/

Financial Services Authority (OJK) physically as referred to in item 2 letter e. f. Traders must ensure that they are registered as users (user) of SIGAP by accessing https://sigap.ojk.go.id. g. For Traders who have never registered on SIGAP, they can choose the Register button to register. In the registration process, information regarding the SIPO account (OJK Reception Information System) is required, to ensure that only Traders licensed under the authority of the Financial Services Authority (OJK) can access the SIGAP system. h. In more detail, the SIGAP registration procedure and the mechanism for submitting copies of Immediate Blocking reports related to DTTOT and/or DPPSPM through SIGAP, can refer to the Circular Letter of the Financial Services Authority (OJK) regarding guidelines for Immediate Blocking of Customer funds whose identities are listed in DTTOT or DPPSPM.

Copies of Nil Reports related to DTTOT and/or DPPSPM;
a. In the event that no identity and other information matching between Customers or Beneficial Owners with the identity and other information listed in DTTOT and/or DPPSPM is found, Traders must submit a nil report to the Indonesian National Police (for DTTOT) or to PPATK (for DPPSPM) with a copy to the Financial Services Authority (OJK) no later than 3 (three) working days since the Traders received the DTTOT and/or DPPSPM. b. Submission of copies of nil reports related to DTTOT and/or DPPSPM is submitted online through the electronic system managed by the Financial Services Authority (OJK), namely the AML CFT Program Information System (SIGAP).
c. In the event that the electronic system as referred to in letter b is not yet available or experiences technical difficulties, the copies of nil reports related to DTTOT and/or DPPSPM are submitted in the form of electronic documents via electronic mail through the addresses as referred to in item 2 letter b, addressed to the head of the supervisory work unit as referred to in item 2 letter c.
d. In the event that the OJK electronic mail as referred to in letter c experiences technical difficulties, the submission of nil reports related to DTTOT and/or DPPSPM is submitted to the Financial Services Authority (OJK) physically as referred to in item 2 letter e. e. Traders must ensure that they are registered as users (user) of SIGAP by accessing https://sigap.ojk.go.id. f. For Traders who have never registered on SIGAP, they can choose the Register button to register. In the registration process, information regarding the SIPO account (OJK Reception Information System) is required, to ensure that only Traders https://jdih.ojk.go.id/

licensed under the authority of the Financial Services Authority (OJK) can access the SIGAP system. g. In more detail, the SIGAP registration procedure and the mechanism for submitting copies of nil reports related to DTTOT and/or DPPSPM through SIGAP, can refer to the Circular Letter of the Financial Services Authority (OJK) regarding guidelines for Immediate Blocking of Customer funds whose identities are listed in DTTOT or DPPSPM.

Reports to PPATK.
Traders must submit reports to PPATK in accordance with the provisions referred to in legislation regarding the prevention and eradication of TPPU, TPPT, and/or PPSPM, including its implementing regulations, including the Regulation of the Head of the Center for Reporting and Financial Transaction Analysis (PPATK). Some reports that must be submitted to PPATK according to the business model and characteristics of the Traders' business, including:
a. Suspicious Financial Transaction Reports;

Traders must submit Suspicious Financial Transaction Reports, including Transactions and/or attempted transactions suspected to be related to predicate crimes, TPPU, TPPT, and/or PPSPM, including in the event that there is identity and other information matching between prospective Customers, Customers, and/or Beneficial Owners with the identity and other information listed in DTTOT and/or DPPSPM.
Suspicious Financial Transaction Reports related to the submission of correction reports for Suspicious Financial Transaction Reports that were previously submitted.
Examples of criteria for Suspicious Financial Transactions are contained in Appendix Part E which is an integral part of this Circular Letter of the Financial Services Authority (OJK). b. Immediate Blocking Reports related to DPPSPM;
In the event that there is identity and other information matching between Customers or Beneficial Owners with the identity and other information listed in DPPSPM, Traders must submit Immediate Blocking reports without delay and without prior notification to the Customer or Beneficial Owner to PPATK no later than 3 (three) working days since the Traders received the DPPSPM.
Submission of Immediate Blocking reports related to DPPSPM must be accompanied by attaching the minutes of Immediate Blocking.
Submission of Immediate Blocking reports related to DPPSPM is submitted physically to the Head of the Center for Reporting and Financial Transaction Analysis (PPATK) u.p. Director of Domestic Strategy and Cooperation with the address Jalan Ir. H. Juanda Number 35 Central Jakarta 10120 or via electronic mail
pemblokiran.wmd@ppatk.go.id, or through other mechanisms regulated by the Center for Reporting and Financial Transaction Analysis (PPATK). https://jdih.ojk.go.id/

c. Nil DPPSPM Reports;

In the event that no identity and other information matching between Customers or Beneficial Owners with the identity and other information listed in DTTOT and/or DPPSPM is found, Traders must submit a nil report to PPATK no later than 3 (three) working days since the Traders received the DPPSPM.
Submission of Immediate Blocking reports related to DPPSPM is submitted physically to the Head of the Center for Reporting and Financial Transaction Analysis (PPATK) u.p. Director of Domestic Strategy and Cooperation with the address Jalan Ir. H. Juanda Number 35 Central Jakarta 10120 or via electronic mail
pemblokiran.wmd@ppatk.go.id, or through other mechanisms regulated by the Center for Reporting and Financial Transaction Analysis (PPATK).

Reports to the Indonesian National Police.
a. Immediate Blocking Reports related to DTTOT;

In the event that there is identity and other information matching between Customers or Beneficial Owners with the identity and other information listed in DTTOT, Traders must submit Immediate Blocking reports without delay and without prior notification to the Customer or Beneficial Owner to the Indonesian National Police no later than 3 (three) working days since the Traders received the DTTOT.
Submission of Immediate Blocking reports related to DTTOT must be accompanied by attaching the minutes of Immediate Blocking.
Submission of Immediate Blocking reports related to DTTOT is submitted physically to the Indonesian National Police with the address Jl. Trunojoyo No.3, RT.2/RW.1, Selong, Kec. Kby. Baru, South Jakarta City, Special Capital Region of Jakarta 12110 or via electronic mail dttot.report@gmail.com/
dttot.report.2@gmail.com or through other mechanisms regulated by the Indonesian National Police. b. Nil DTTOT Reports;
In the event that no identity and other information matching between Customers or Beneficial Owners with the identity and other information listed in DTTOT is found, Traders must submit a nil report to the Indonesian National Police no later than 3 (three) working days since the Traders received the DTTOT.
Submission of Immediate Blocking reports related to DTTOT is submitted physically to the Indonesian National Police with the address Jl. Trunojoyo No.3, RT.2/RW.1, Selong, Kebayoran Baru District, South Jakarta City, Special Capital Region of Jakarta 12110 or via electronic mail dttot.report@gmail.com and
dttot.report.2@gmail.com or through other mechanisms regulated by the Indonesian National Police. https://jdih.ojk.go.id/

IX. Action Plan and Policies and Procedures
Submission of Action Plans and Policies and Procedures for the Implementation of AML, CFT, and CCPF Programs and Their Amendments

The action plan and policies and procedures for the implementation of AML, CFT, and CCPF programs are proposed by the Board of Directors and approved by the Board of Commissioners.
Example format of the action plan and policies and procedures is contained in Appendix Part F which is an integral part of this Circular Letter of the Financial Services Authority (OJK).
Traders must submit the action plan and policies and procedures no later than July 9, 2025.
The action plan and policies and procedures are submitted through the electronic system managed by the Financial Services Authority (OJK).
In the event that the electronic system as referred to in item 3 is not yet available or experiences technical difficulties, the action plan and policies and procedures are submitted in the form of electronic documents via electronic mail through the addresses as referred to in Roman VIII item 2 letter b, addressed to the head of the supervisory work unit as referred to in Roman VIII item 2 letter c.
In the event that the OJK electronic mail as referred to in item 4 experiences technical difficulties, the submission of the action plan and policies and procedures is submitted to the Financial Services Authority (OJK) physically as referred to in Roman VIII item 2 letter e.
In the event that the submission date for the action plan and policies and procedures falls on a holiday, the submission of the action plan and policies and procedures is carried out on the next working day.
In the event that there are changes to the policies and procedures that have been submitted to the Financial Services Authority (OJK), Traders must submit such changes no later than 7 (seven) working days since the changes were made.

X. OTHER PROVISIONS

Traders using supporting professional services who are reporting parties in the AML, CFT, and CCPF regime in Indonesia, are required to ensure that such supporting professions implement AML, CFT, and CCPF programs and are registered in the AML, CFT, and CCPF reporting information system managed by PPATK, proven by showing:
a. electronic mail confirmation from PPATK submitted to the supporting profession regarding the acceptance of the registration application; and/or b. other forms as referred to in legislation regarding the AML, CFT, and CCPF reporting information system to PPATK.
Traders must cooperate with law enforcement officials and competent authorities in the prevention and eradication of TPPU, TPPT, and/or PPSPM.
https://jdih.ojk.go.id/

This copy is consistent with the original
Head of the Legal Development Directorate
Legal Department signed
Aat Windradi

XI. CLOSING
This Circular Letter of the Financial Services Authority (OJK) takes effect on the date of establishment.
Established in Jakarta on July 3, 2025
EXECUTIVE HEAD OF SUPERVISION OF FINANCIAL SECTOR TECHNOLOGY INNOVATION, DIGITAL FINANCIAL ASSETS AND CRYPTO ASSETS FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA,

HASAN FAWZI signed https://jdih.ojk.go.id/

APPENDIX
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY (OJK) NUMBER 16/SEOJK.07/2025 REGARDING IMPLEMENTATION OF ANTI-MONEY LAUNDERING, COUNTER-TERRORISM FINANCING, AND COUNTER-PROLIFERATION FINANCING PROGRAMS FOR DIGITAL FINANCIAL ASSET TRADERS

A. LIKELIHOOD AND IMPACT MATRIX

In conducting risk identification, one of the tools that can be used by Traders is the likelihood and impact matrix. This matrix helps Traders determine the extent of efforts or monitoring that need to be carried out to identify inherent risks. It should be noted that this matrix is only an example. Traders can use other tools or other forms of matrices that are appropriate to the scale of business, needs, characteristics, and complexity of the Traders' business activities so that it truly reflects the risks faced by the Traders.
Likelihood
Likelihood refers to the potential for money laundering and terrorism financing risks to occur for each specific risk assessed.
In this regard, Traders can use commonly used risk scales, namely:
Risk Rating for TPPU, TPPT, and PPPSPM Likelihood High High probability of TPPU, TPPT, and PPPSPM risks occurring Medium Probability of risk occurrence is acceptable Low No probability of risk occurrence
Impact
Impact in this context refers to the level of seriousness or consequences of damage or loss that occurs if a risk occurs.
The emergence of impact depends on the internal conditions of the Traders. The impact of TPPU, TPPT, and PPPSPM risks can be viewed from various perspectives, including:
a. reputational risk and its impact on the Traders' business activities; b. regulatory impact;
c. financial losses for the Traders; and/or
d. legal risk.
The impact of TPPU, TPPT, and PPPSPM risks will be very specific for each Trader, making it difficult to calculate the impact. Therefore, only the Traders can determine the impact of the risks that occur.
The scale used to calculate impact is not much different from the scale in calculating likelihood.
Consequence Rating for TPPU, TPPT, and PPSPM Risks High Risks have heavy consequences Medium Risks have moderate consequences Low Risks have small or insignificant consequences.
The likelihood and impact matrix will help Traders decide what needs to be done by considering the overall risk. As mentioned earlier, the risk-based approach is a process that allows Traders to implement steps commensurate with identified risks as part of risk assessment.
Likelihood and Impact Matrix
Each box in the matrix indicates the resources needed to perform:

Action (e.g., risk needs immediate follow-up)
Effort (e.g., level of effort in risk mitigation)
Monitoring (e.g., level of monitoring that needs to be carried out by the Traders)

How to read the priority matrix
Box 6
The condition in box 6 indicates that the likelihood and impact of TPPU, TPPT, and PPSPM risks are low, so Traders do not need to take special action, effort, or monitoring.
Box 5
The condition in box 5 indicates that the likelihood and impact of TPPU, TPPT, and PPSPM risks are relatively low but have the potential to increase to a medium scale. For the condition in box 5, effort and monitoring are required to prevent risk escalation (not changing to box 4 or box 3).
Box 4
The condition in box 4 indicates that the likelihood and impact of TPPU, TPPT, and PPSPM risks are medium.
In this condition, Traders need to take action, effort, or monitoring. Adequate action, effort, or monitoring will reduce the likelihood and impact of TPPU, TPPT, and PPSPM risks; conversely, if action, effort, or monitoring is inadequate, it will increase the risk to high risk.
Box 3
The condition in box 3 indicates that Traders need to allocate resources to take action, effort, and monitoring. There is a possibility of TPPU, TPPT, and PPSPM risks occurring with consequences that can be categorized as moderate. Therefore, Traders need to pay attention to all existing business activities and business relationships, so as not to cause risk escalation (not changing to box 2 or box 1).
Box 2
The condition in box 2 indicates that the likelihood of TPPU, TPPT, and PPSPM risks is relatively high. In this condition, Traders need to pay attention to all business activities and business relationships and deploy resources to suppress the likelihood and impact of risks. Traders need to apply stricter mitigation steps to prevent risk escalation to very high, or to the condition in box 1.
Box 1
The condition in box 1 indicates that the likelihood of TPPU, TPPT, and PPSPM risks is very high, including the magnitude of the impact of such risks. In such conditions, more resources, special actions, special efforts, and periodic monitoring are required to minimize such risks.

B. EXAMPLES OF RISK LEVELS ASSOCIATED WITH TRADER ACTIVITIES a. As an example, the following table presents several examples of risk factors that Traders may face as part of the risk assessment related to Trader business activities. The table also outlines the rational reasons that can help Traders differentiate each risk level. b. Traders may decide on the risk scale used by the Trader. This Guideline does not require Traders to determine high, medium, and low risk scales. Traders may use only high and low scales according to the business activity, needs, and complexity of the Trader.

EXAMPLE RISK LEVEL TABLE

FACTOR
RISK LEVEL
LOW MEDIUM HIGH

Customer Profile
Identified and verified customer profile has low potential for engaging in ML/TF/CPF Customer requires further verification to ensure the customer is not involved in ML/TF/CPF Customer meets criteria associated with engaging in ML/TF/CPF

Digital Financial Asset Distribution Network
Digital Financial Asset distribution network is conducted via electronic medium meeting at least: cybersecurity maturity test showing level 5, transparent, traceable, cybersecurity in accordance with best practices, data encryption, personal data protection, consumer protection, and licensed according to statutory regulations. Digital Financial Asset distribution network is conducted via electronic medium that is still transparent and traceable, but cybersecurity maturity test shows level 4 or below. Digital Financial Asset distribution network allows increased anonymity and obscures traceability, thereby complicating the identification of ML/TF/CPF.

Digital Financial Asset Products or Services
Digital Financial Asset Products or Services are in accordance with the crypto asset list and have product/activity/service licenses.
Digital Financial Asset Products or Services have characteristics that have the potential to be exploited by ML/TF/CPF perpetrators.
Digital Financial Asset Products or Services allow increased anonymity, reduced transparency, and obscure financial flows.

Geography of High-Risk Countries
Trader does not have business relations with high-risk country customers.
Customer or Trader partner is located in a geographic area/border area that has the potential for ML/TF/CPF.
Trader has high-frequency business relations and significant transaction values with high-risk countries.

C. EXAMPLE FORMAT FOR CUSTOMER DATA UPDATE PLAN REPORT

CUSTOMER DATA UPDATE PLAN REPORT
(TRADER NAME)
YEAR ……

No.
Customer Type and Risk Level
Number of Single Customer Identification Files Information to be Updated Method or Strategy Target Fulfillment Percentage Single Customer Identification Files to be Updated in a Specific Period Single Customer Identification Files to be Updated % of Total Single Customer Identification Files

(a) (b) (c) (d) (e) (f) (g)

Individual Customers
a. High Risk b. Medium Risk
c. Low Risk
Corporate Customers
a. High Risk b. Medium Risk
c. Low Risk
Other Legal Arrangement Customers
a. Trust

High Risk
Medium Risk
Low Risk
b. Other than Trust
High Risk
Medium Risk
Low Risk

State Institutions, Government Agencies, International Institutions, and Foreign State Representatives
a. High Risk b. Medium Risk
c. Low Risk
Column Notes:
(a) Filled with number.
(b) According to column.
(c) Filled with the planned number to be updated for the next 1 (one) year.
(d) Filled in percentage.
(e) Information can be filled with more than one, such as updating residential address or work address.
(f) Method or strategy can be filled with more than one, such as correspondence via mail or email.
(g) Filled with the target fulfillment percentage of single customer identification file updates in a specific period. The period is determined by adjusting to the ability and conditions of each Trader, for example, quarterly. Example: Quarter I = 30%, Quarter II = 60%, Quarter III = 90%, Quarter IV = 100%.
The number of risk levels can be adjusted according to policies established by the Trader.

D. EXAMPLE FORMAT FOR CUSTOMER DATA UPDATE REALIZATION REPORT

CUSTOMER DATA UPDATE REALIZATION REPORT
(TRADER NAME)
YEAR ……

No.
Customer Type and Risk Level
Development
Obstacles
Efforts to be Made
Target
Realization
Deviation (%)

(a) (b) (c) (d) (e) (f) (g)

Individual Customers
a. High Risk b. Medium Risk
c. Low Risk
Corporate Customers
a. High Risk b. Medium Risk
c. Low Risk
Other Legal Arrangement Customers
a. Trust

High Risk
Medium Risk
Low Risk
b. Other than Trust
High Risk
Medium Risk
Low Risk

State Institutions, Government Agencies, International Institutions, and Foreign State Representatives
a. High Risk b. Medium Risk
c. Low Risk
Column Notes:
(a) Filled with number.
(b) According to column.
(c) Filled with the target number of single customer identification files to be updated.
(d) Filled with the realized number of single customer identification files to be updated.
(e) Filled with the percentage difference between the target single customer identification files to be updated (c) and (d) realized single customer identification files to be updated.
(f) Obstacles can be filled with more than one.
(g) Filled with efforts to overcome obstacles and can be filled with more than one.
The number of risk levels can be adjusted according to policies established by the Trader.

E. EXAMPLE CRITERIA FOR SUSPICIOUS FINANCIAL TRANSACTIONS

A. GENERAL

Financial Transactions that deviate from the profile, characteristics, or habitual transaction patterns of the relevant Customer;
Financial Transactions by Customers that are suspected to be conducted with the purpose of avoiding reporting of the relevant Transaction that must be reported by the Trader in accordance with statutory regulations regarding the prevention and eradication of ML, TF, and/or CPF;
Financial Transactions conducted or cancelled using assets suspected to originate from the proceeds of crime; or
Financial Transactions requested by PPATK to be reported by the Reporting Party because they involve Assets suspected to originate from the proceeds of crime.

B. CRITERIA FOR SUSPICIOUS DIGITAL FINANCIAL ASSET TRANSACTIONS

Transaction Size and Frequency indicate suspicious financial transactions, for example, transactions, exchanges, or transfers in small amounts, or amounts below the Travel Rule threshold. Transactions are conducted several times with high values: in a short time (e.g., 24 hours), in a gradual and regular pattern followed by a period of no transactions, or to newly created/inactive accounts.
Transferring Digital Financial Assets immediately to multiple Traders, especially those registered/operating in other jurisdictions not relevant to the Customer profile or to Traders in jurisdictions with weak AML/CFT/CPF program regulations.
Depositing Digital Financial Assets at a Trader and then immediately withdrawing them without additional exchange activity, or converting Digital Financial Assets into several other types of Digital Financial Assets without a logical business explanation.
Receiving funds suspected to be the proceeds of theft or fraud from an identified wallet address storing stolen funds.
New Customers making a large initial deposit to open a new account with a Trader, while the amount of funds is inconsistent with the Customer profile.
Depositing the entire deposit on the first day the account is opened and immediately trading/withdrawing the entire amount.
New Customers attempting to trade or withdraw the entire balance of Digital Financial Assets from the Trader platform.
Conducting frequent transfers within a certain period to the same Customer account by more than one person, from the same IP address, or involving large amounts.
Incoming transactions from many unrelated wallets in relatively small amounts (fund accumulation) with subsequent transfers to other wallets or full exchange into fiat currency.
Exchanging Digital Financial Assets and fiat at a potential loss (e.g., regardless of very high commission costs) without a logical business explanation.
Converting a large amount of fiat currency into Digital Financial Assets, or a large amount of one type of Digital Financial Asset into another type of Digital Financial Asset, without a logical business explanation.
Transactions involving more than one type of Digital Financial Asset, despite additional costs, especially Digital Financial Assets that provide higher anonymity such as anonymity-enhanced cryptocurrency (AEC) or privacy coins.
Transferring Digital Financial Assets operating on a public, transparent blockchain (such as Bitcoin) to a centralized Trader and then immediately trading them for anonymity-enhanced cryptocurrency (AEC) or privacy coins.
Abnormal transaction activity (rate and volume) of Digital Financial Assets cashed out at a Trader from wallets related to the Trader platform without a logical business explanation.
Digital Financial Assets are transferred to or from wallets that show previous activity patterns related to the use of Traders operating mixing or tumbling services or P2P platforms.
Transactions using mixing and tumbling services, indicating an intent to obscure the flow of illicit funds between known wallet addresses and darknet marketplaces.
Funds are deposited or withdrawn from Digital Financial Asset addresses or wallets with direct and indirect links to known suspicious sources (darknet markets, mixing/tumbling services, questionable gambling sites, illegal activities such as ransomware, and theft reports).
Use of decentralized/non-hosted wallets, hardware, or paper wallets to transport Digital Financial Assets across borders from high-risk countries.
Customers registering Internet domain names via proxy or using DNS that suppresses/hides the domain name owner.
Customers entering the Trader platform using IP addresses associated with darknet or similar software that allows anonymous communication (encrypted email, VPN).
A large number of seemingly unrelated Digital Financial Asset wallets are controlled from the same IP address, which may involve the use of shell wallets.
Use of Digital Financial Assets whose design is not adequately documented, or related to possible fraud or fraud schemes (e.g., Ponzi schemes).
Receiving or sending funds to Traders whose CDD/KYC process is proven to be weak or non-existent.
Customers have provided fake documents or have edited photos and/or identification documents as part of the on-boarding process.
Customers provide identification or account credentials shared by other accounts.
Discrepancies arise between the IP address associated with the Customer profile and the IP address from which the transaction originates.
Customers purchase Digital Financial Assets in large amounts not supported by available wealth or inconsistent with their historical financial profile, which may indicate money laundering, money mules, or scam victims.
Customers repeatedly conduct transactions with organized or affiliated groups of individuals with significant profit or loss, which may indicate account takeover or ML schemes.
Transacting with wallet addresses or bank cards linked to known fraud, extortion, or ransomware schemes, sanctioned addresses, darknet markets, or other illegal websites.
Digital Financial Asset transactions originating from or directed to online gambling services.
Deposits to accounts or Digital Financial Asset addresses are significantly higher than usual with unknown fund sources, followed by conversion to fiat currency, which may indicate fund theft.
Lack of transparency or inadequate information about the origin and owner of funds (e.g., use of shell companies, funds placed in Digital Financial Asset issuances where investor personal data may not be available, or incoming transactions from online payment systems via credit/prepaid cards followed by instant withdrawals).
Most of the Customer's wealth sources come directly from third-party mixing services or tumbler wallets.
The Customer's wealth sources disproportionately originate from Digital Financial Assets from other Traders that do not have AML/CFT/CPF controls.
Customers utilize Traders located abroad in high-risk jurisdictions that do not have, or are known to have inadequate, AML/CFT/CPF program regulations including inadequate CDD or KYC measures.
Customers send funds to Traders operating in jurisdictions that do not have Digital Financial Asset regulations, or have not yet implemented AML/CFT/CPF program controls.

F. EXAMPLE FORMAT FOR ACTION PLAN AND POLICIES AND PROCEDURES

ACTION PLAN AND POLICIES AND PROCEDURES
(TRADER NAME)
DATE : ……

TRADER AML/CFT/CPF PROGRAM ACTION PLAN

Item
Action
Things to be Done
Required Resources
Person in Charge
Start Date
Deadline
Expected Performance Results
Supervisory Issues

Board of Directors and Board of Commissioners
Internal control
Information systems
Human resource management and training

POLICIES AND PROCEDURES

Policies and Procedures
Things to be Done
Required Resources
Person in Charge
Start Date
Deadline
Expected Performance Results
Supervisory Issues

Identification and verification of prospective Customers or Customers Identification and verification of Beneficial Owners - Closure of business relations or rejection of transactions Travel Rule Sustainable ML, TF, and CPF risk management related to Customers, countries/geographic areas/jurisdictions, products/services/transactions, or distribution networks (delivery channels); Maintenance of accurate data related to transactions, documentation of the CDD process, and documentation of policies and procedures for updating and monitoring Reporting to senior officials, Board of Directors, and Board of Commissioners regarding the implementation of AML, CFT, and CPF program policies and procedures

This copy is in accordance with the original
Head of Legal Development Directorate
Legal Department signed
Aat Windradi

Issued in Jakarta on July 3, 2025
EXECUTIVE HEAD OF THE FINANCIAL SECTOR TECHNOLOGY INNOVATION SUPERVISOR, DIGITAL FINANCIAL ASSETS AND CRYPTO ASSETS FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA,

HASAN FAWZI signed

Implementation of Anti-Money Laundering, Counter-Terrorism Financing, and Counter-Proliferation Financing Programs for Digital Financial Asset Traders

Lineage: In force