POJK 8/2023 is the OJK regulation that sets the anti-money laundering, counter-terrorist financing and counter-proliferation financing program for financial services providers. It replaced the 2017 regulation, widened the set of covered providers, and requires an individual risk assessment, beneficial ownership due diligence for all customer types, and a proliferation financing risk assessment.
The summary below follows OJK's English press release of June 2023. The article-level text is in Bahasa Indonesia, so a compliance reader should confirm the specific articles, thresholds and filing procedures against the primary regulation before applying them.
This guide is written for CCOs and compliance heads at OJK-regulated institutions and for regional teams with Indonesian exposure who need a reference point for what the program requires.
What is POJK 8/2023?
It is OJK Regulation No. 8 of 2023 on implementing the AML, CFT and CPF program in the financial services sector, announced in June 2023.
OJK's press release is dated 16 June 2023. The regulation replaces POJK 12/POJK.01/2017 on the AML and CFT program, as amended by POJK 23/POJK.01/2019, and allows institutions a transition period of up to six months to make the necessary adjustments. The Indonesian abbreviation for the program is APU PPT PPPSPM, which stands for anti-money laundering, prevention of terrorism financing and prevention of proliferation financing of weapons of mass destruction. The 2017 program covered money laundering and terrorism financing. Proliferation financing is now part of the program's name and scope.
Who does it cover?
All providers under OJK's remit, with the scope widened to include trusts, securities crowdfunding providers and fintech and digital financial innovation firms.
OJK says the regulation covers providers in the financial services sector and expands the coverage to include trusts, securities crowdfunding providers, fintech and digital financial innovation firms, and other financial institutions required by law and under OJK's jurisdiction. For a lean team at a digital lender, a payment-adjacent fintech or a crowdfunding platform, that is the change that matters. Those providers now carry program obligations of the same kind as a bank's, scaled by risk. The risk-based logic is the same one that runs through our guide to the enterprise-wide risk assessment.
What does it require on risk assessment?
An individual risk assessment that institutions prepare and submit, and a mandatory proliferation financing risk assessment with policies and mitigation.
The regulation requires institutions to prepare and submit an Individual Risk Assessment, which places the institution's own risk picture in front of the supervisor and not only on file. It also makes a proliferation financing risk assessment mandatory, together with the related policies, procedures and risk mitigation, and covers mitigation of sanctions-evasion risk. A document that exists only in a binder does not meet that standard. The assessment has to drive the customer risk rating, the monitoring scenarios and the screening configuration, which is the point we develop in sanctions screening and targeted financial sanctions.
What changes in customer due diligence?
Beneficial ownership due diligence applies to all customer types, simplified due diligence is limited to low-risk cases, and non-face-to-face verification rules were revised.
According to OJK, customer due diligence applies to the beneficial owners of every customer type, including listed companies and state institutions. Simplified due diligence is allowed only for low-risk cases based on the institution's own assessment. The rules for face-to-face and non-face-to-face verification through electronic means were revised, including the use of third-party electronic KYC providers. The press release also confirms the acceptable identity documents for Indonesians overseas. The practical consequence is that remote onboarding has to be backed by a decision record, and that identity verification does not complete the due diligence, a distinction developed in why identity verification is not KYC.
What are the reporting and proliferation financing duties?
Suspicious transaction reports go to PPATK and now cover attempted proliferation financing transactions, with freezing without delay and without prior notice reaffirmed.
OJK states that suspicious financial transaction reports include attempted transactions related to proliferation financing. Institutions must ensure that the supporting professionals they engage have implemented their own AML, CFT and CPF programs and are registered in PPATK's reporting system. The regulation reaffirms freezing without delay and without prior notice, and OJK's authority to impose sanctions for proliferation financing violations. It also provides for postponing or suspending a transaction that is known or suspected to involve money laundering, terrorism financing or proliferation financing. The reporting and freezing workflow is where speed and evidence matter, and regulatory reporting automation shows how a team keeps both.
What does it require on governance and enforcement?
A stronger compliance function, an independent internal audit and pre-employment screening, with higher maximum administrative fines for most violations.
OJK revised the rules on the compliance function, on independent internal audit and on pre-employment screening of staff. It also raised the maximum administrative fines for AML, CFT and CPF violations other than reporting violations, and revised the arrangements for reporting violations. The press release does not give the amounts, so this guide does not either. Independent assurance is the part a lean team can underinvest in; our guide to what examiners look for in independent testing describes the evidence that holds up.
Where does Indonesia stand with the FATF?
Indonesia became a FATF member in October 2023, and the FATF's June 2026 follow-up report shows good technical progress with a few remaining gaps.
Indonesia was admitted as the FATF's 40th member at the October 2023 plenary, as reported by Kontan. The FATF's third enhanced follow-up report, published on 3 June 2026, re-rated Recommendation 6 on terrorism-related targeted financial sanctions from partially compliant to compliant. Indonesia now holds seven compliant, thirty largely compliant and three partially compliant ratings. The remaining partially compliant ratings cover non-profit organisations, the transparency of legal arrangements and the supervision of designated non-financial businesses and professions. Beneficial ownership transparency remains a live theme, which is why the due diligence change above carries weight.
What should a regional team do with POJK 8/2023?
Map the program to the institution's own controls, confirm the primary text, and run one operating model with local reporting adapters.
For an institution operating across several markets, the sensible approach is one operating model with local adapters, not a separate rulebook for each regulator. Start with the individual risk assessment and the proliferation financing assessment, because they drive the rest. Then map beneficial ownership checks, remote onboarding and reporting to existing controls, and note the gaps. The regional comparison of due diligence expectations sits in our Southeast Asia benchmark.
How does Fyscal ARCX support an AML, CFT and CPF program?
Fyscal ARCX gives a provider the screening, monitoring, case and reporting controls the program depends on, configured to its own rules. Named parties are screened against sanctions, PEP and watchlists, a compliance team defines its own variables and scenarios and tests them before activation, and Case Management holds one case per customer with a timestamped trail. Regulatory Reporting prepares and tracks the filings a regime requires, configured to the jurisdiction.