KYC.IO

Global Regulations and Requirements for KYC Onboarding
(powered by KYC-Chain)

KYC to onboard domestic persons

namedate of birthpassportplace of birthphotographidentity carddriving licenseaddress

KYC to onboard international persons

nameaddressdate of birthplace of birthidentity cardpassportdriving licensephotograph

corporate requirements

nameregistration numberregistration office in country of incorporationtax registry numberbusiness addressidentity of personnel

National ID card name

Kartu Tanda Penduduk (KTP)

National ID Photo

back of national id photo back

Does the country have Esignature Laws?

LAW OF THE REPUBLIC OF INDONESIA NUMBER 11 OF 2008 CONCERNING ELECTRONIC INFORMATION AND TRANSACTIONS

E-sig law files

What year did the relevant AML laws and regulations become effective?

2002

Further details on AML regime

2002 (amended through Law of Republic of Indonesia No 8 year 2010).

Who is the regulator for AML controls for Banking

Bank of Indonesia

Link to site

http://www.bi.go.id/web/en

Other financial Services

Otoritas Jasa Keuangan (“OJK” or Indonesian Financial Services Authority)

Website of Regulator

http://www.ojk.go.id/id/Default.aspx

Financial Sector regulator

http://www.ppatk.go.id/

Practical Guidance for AML

Frequently Asked Questions (FAQ) Appendix of Bank Indonesia Regulation No 14/27/PBI/2012 (http://www.bi.go.id/en/peraturan/perbankan/Documents/bcde3006bbe64dd991ba14f41af57d31FAQ1427_REVMB.pdf); b) Bank Indonesia Circular Letter No. 3/29/DPNP concerning Standard Guidelines for Application of KYC Principles for All Commercial Banks (http://www.bi.go.id/en/perbankan/prinsip-mengenalnasabah/Documents/StandardGuidelinesforApplicationofKnowYourCustomer.pdf); and c) Decree of Director General of Financial Institutions (Bapepam-LK) No. Kep-2833/LK/2003 on Direction of Drafting on KYC Implementation for Non-Bank Financial Services Sector.

Is there a requirement to verify the identity of customers retroactively?

Retroactive details

Yes

Has the country been the subject of FATF mutal evaluation in the last 3 years?

Yes

PDF of FATF review

mutualevalationreportofindonesia.html

Are there minimum transaction thresholds (Y/N)

Yes

More details on minimum transaction thresholds.

Yes, simplified CDD is allowed for walk-in customers (“WIC”) with transactions less than or amounting to IDR100m (approx. USD7,179).

What are the requirements for customer identification information for individuals

Obtain and cross reference: name, address, place and date of birth and verification documentation from a regulatory body authorized to issue documents which includes customer's full name and photograph, and either address or date of birth, for example an identity card, passport or driving license.

Details to be Collected on Corporates

Obtain and cross reference: name, registration number, registration office in country of incorporation, tax registry number, business address, and identity of personnel who have the legal authority to represent the company.

What are the high level requirements around beneficial ownership (identification and verification)?

All beneficial owners must be identified. Local regulation does not specify a minimum threshold of ownership as means of identifying beneficial ownership.

What circumstances are enhanced customer due diligence measures required?

Enhanced due diligence (“EDD”) should be performed when: a) engaging with a high-risk Customer (as classified by considering the customer’s citizenship, occupation/industry, risk profile and relationship with Politically Exposed Person (“PEP”); b) engaging with a customer who performs transactions with high-risk countries; c) engaging with a customer who performs transactions inconsistent with its risk profiles; and d) engaging with a customer who performs transactions using high-risk products and services

How should FI's deal with Politically exposed persons

PEPs are considered high-risk customers and both banks and non-bank financial institutions should always perform EDD when engaging with a PEP.

What enhanced due diligence must be performed for correspondent banking relationships?

There are two conditions for correspondent banking relationships: if the correspondent bank is regulated by a territory which has the equivalent standard of KYC implementation to Indonesia, then a formal letter should be written stating that the bank has implemented KYC in relation to the customer properly; and if the correspondent bank is regulated by a territory which has lower KYC standards than Indonesia, then the bank/NBFI entering into a customer relationship with the correspondent bank shall also perform KYC procedures on the customer of that bank as well and the correspondent bank.

Are relationships with banks who might be considered a 'shell' and without substance permitted?

Yes

In what circumstances is additional due diligence required for non face-to-face transactions and/or relationships?

Face-to-face meetings should be performed at least once in the account opening process. The only exception to this requirement is for NBFIs where OJK allows the meetings the meetings to be conducted via video link.

To whom are SAR's made? (suspicious activity reports)

FIU, the Pusat Pelaporan dan Transaksi Analisis Transaksi Keuangan (“PPATK”) by both banks and non-banks.

Link to website of SAR reporting

http://jdih.ppatk.go.id/peraturan-pemerintah-nomor-43-tahun-2015-tentang-pihak-pelapor-dalam-pencegahan-dan-pemberantasan-tindak-pidana-pencucian-uarng/

Other Suspicious or unusual transactions obligations.

Yes, there is an obligation to make cash transaction reports (“CTR”) and international funds transfer reports (“IFTs”). The former is a requirement after a certain threshold value for transactions has been

Are there any de-minimis thresholds below which transactions do not need to be reported?

IDR100m

Are there any penalties for non compliance with reporting requirements e.g. tipping off?

Yes. Tipping off is a criminal offence and other penalties apply for non-compliance with AML obligations (including reporting requirements).

Are there any requirements (legal or regulatory) to use automated Suspicious Transaction monitoring technology?

Is there a requirement to obtain authority to proceed with a current/ongoing transaction that is identified as suspicious?

Authority to proceed with suspicious transaction may be obtained, on a case by case basis, from Regulator. Authority to proceed internally could form part of the escalation and governance matters within

Does the local legislation allow transactions to be monitored outside the jurisdiction?

No.

Is there a legal requirement for a bank’s external auditor/other external organisation to report on the bank’s AML systems and controls?

No, reviews are conducted by AML specialists and are not a part of annual statutory audits. There is no statutory requirement for independent review but financial institutions can undertake such reviews

If an external report on the bank’s AML systems and controls is required: a) how frequently must the report be provided?

N/A

To whom should the report on AML systems be submitted?

N/A

Is an AML system part of the financial statement audit?

N/A

What are the requirements for the content of this external report on a bank’s AML systems and controls? Does it require: a) sample testing of KYC files? b) sample testing of SAR reports? c) examination of risk assessments?

N/A

Data Protection Laws And Personal Data

banking privacy is in place. This is different to broader data protection, which is still emerging. Customer financial data is “protected” under Banking Privacy legislation;

Data Protection for Corporate Data

Banking Privacy act.

Data protection for "sensitive Data" and additional protections.

Do any restrictions on the transfer of credit reports exist?

Different legislation and regulations govern different data restrictions. Advice should be sought on a case-by-case basis.

Regulator Acronym

OJK

Year of last FATF mutual evaluation

2013, 2014,

Verification of docs (domestic individual)

Cross-referencing the available documentation which may include other sources of information

Field 67

face to face required

National ID card details

Possession of KTP is compulsory for residents whose age is 17 or older, and residents who is married before the age of 17.

Compulsory?

National ID source

https://en.wikipedia.org/wiki/Indonesian_identity_card

Passport Photo

practical Guidance yes / no

Is there a risk based approach

Legal Requirement

Requirement to proceed

Yes

requirement to use automated suspicious transaction tools

Who are SARS made to?

PPATK

shell banks

Yes

EDD for correspondent banking

Yes

PDF of case law

Minimum transactions

IDR 100m

Min transaction USD

7179

Personal Data protection

Data Protection for Corporates

key restrictions

Notarial deeds, letters of court summons and bond certificates are excluded from the law

Summary

Yes, but only digital signatures that have been created using a digital certificate provider that has been registered Ministry of Communication and Information Technology and that has servers located in Indonesia are enforceable. Summary of law All forms of electronic signature must meet the requirements under Law of Number 11 of 2008, which includes the registration and certification of public electronic systems, registration of software for services and electronic agents and certification of all hardware,as well as the requirements that all data centers and disasters recovery centers be located in Indonesia. Any digital certificates must be issued by a certification provider approved by government agencies.

Are e-signatures acceptable

If the AML laws and/or regulations became effective in the last 2 years, what were the requirements of the previous AML regime?

N/A

Non financial sector (e.g. casinos, high value goods etc.)

Pusat Pelaporan dan Analisa Transaksi Keuangan (“PPATK” or Indonesian Financial Transaction Reports and Analysis Center/INTRAC)

Does the country have a risk based approach?

Yes

Where copies of identification documentation are provided, what are the requirements around independent verification or authentication?

The 3 regulators require the firm to scrutinize the information provided by cross-referencing the available documentation which may include other sources of information beyond what is provided by the prospective customers that are deemed to be reliable and independent.

Is there case law, other constitutional law or any other laws or regulations that may impact upon the transfer of information to this jurisdiction?

Refer to A29 and A30 above.

List of case law, constitutional law or any other laws or regulations that may impact upon the transfer of information.

Yes. Refer to A29 above.