Indonesia ID

Indonesia entry into the Financial Integrity Monitor baseline this cycle centres on a genuine, if partial, sanctions-architecture upgrade. The FATF June 2026 follow-up report re-rated Indonesia performance against Recommendation 6, covering terrorism-financing targeted financial sanctions, from Partially Compliant to Compliant, a change that closes the fourth-round enhanced follow-up reporting obligation held by Indonesia to the FATF Plenary. The upgrade rests on a specific structural correction rather than a general improvement claim: PPATK Decree 670 of 2025, enacted 12 December 2025, introduced a reasonable basis evidentiary standard for nominations to the DTTOT domestic terrorist list, replacing a previously implicit nomination practice that the 2023 FATF mutual evaluation report had flagged as a technical deficiency. Read architecturally, this is the kind of finding the sanctions-architecture filter is designed to surface: a domestic listing-evidentiary mechanism was tightened, and a formal multilateral compliance rating changed as a direct, traceable consequence, rather than a designation or asset freeze functioning as the unit of analysis.

A second, related upgrade sits alongside this one. Recommendation 7, covering proliferation-financing targeted financial sanctions, was separately upgraded from Partially Compliant to Largely Compliant in the May 2025 follow-up report, reflecting amendments to the proliferation-financing Joint Regulation that extended prohibitions on funding persons designated on weapons of mass destruction lists. Taken together, the two upgrades describe a jurisdiction narrowing its administrative-listing divergence from the direct United Nations Security Council designation flow-through model, even though Indonesia retains three Recommendations rated Partially Compliant of the 40 under FATF methodology, and a residual gap between formal technical compliance and demonstrated effectiveness remains characteristic of the broader profile.

The architecture-over-incident principle cuts the other way, however, on the question of Russia-sanctions alignment. Indonesia has not adopted an autonomous Russia-sanctions regime and continues to sit outside the coordinated EU, US and UK sanctions architecture as a non-adopting third country, maintaining non-aligned trade relationships including energy and agriculture with Russia. This is treated here as an enabler-jurisdiction signal in its own right, under the enablement-as-signal principle: the absence of an autonomous regime, rather than any single enforcement gap, is what creates background compliance friction for correspondent banks and trade-finance counterparties with Russia exposure operating through or with Indonesian institutions. No OFAC, OFSI or EU designations of Indonesia-domiciled entities were identified in the review window, which is consistent with, rather than a contradiction of, the non-adopting-third-country characterisation.

Consistent with this reading, the December 2025 update to the EU high-risk third-country list, made through Delegated Regulations (EU) 2026/46 and 2026/83, added Bolivia and the British Virgin Islands and delisted six African jurisdictions without adding Indonesia. The non-listed status of Indonesia is convergent across both the EU high-risk mechanism and the FATF grey list as of the June 2026 Plenary, a specific point of alignment for this jurisdiction rather than a general divergence signal between the two regimes.

Outlook

The principal forward marker for this domain is procedural rather than substantive: whether the three residual Partially Compliant ratings held by Indonesia are resolved through further ad hoc follow-up reporting or are instead folded into scheduling for the FATF fifth-round mutual evaluation cycle, a determination that remains unsettled and is tracked here as a multi-year uncertainty band item with an estimated impact date around mid-2028. Firms with Indonesian counterparty exposure should treat the current improving trajectory as a technical-compliance signal rather than an effectiveness guarantee, particularly given that the residual gaps concentrated in this baseline, beneficial-ownership verification, DNFBP supervision and forestry-crime investigation volume, sit outside the Recommendation 6 and 7 scope that improved this cycle. The non-adoption of an autonomous Russia-sanctions regime is not itself expected to change in the near term and should be read as a standing architectural feature of the sanctions posture of Indonesia rather than a pending development.

The central structural finding in this domain for Indonesia is a compliance gap rather than a legislative gap. Presidential Regulation 13 of 2018 established a central beneficial-ownership registry administered by the Ministry of Law and Human Rights, requiring all corporate forms, including PT companies, Yayasan foundations, cooperatives and partnerships, to self-report beneficial-ownership data annually. Registry existence, however, outpaces practical transparency utility: fewer than 30 percent of registered corporations have complied with the mandatory reporting requirement, and the data that has been submitted is not independently verified. This is treated here as a structural enabler condition for PT and Yayasan opacity rather than an isolated compliance lapse, consistent with the architecture-over-incident framing applied throughout this baseline. This condition is treated as a stable structural feature of the Indonesian corporate-registry environment rather than a recent deterioration, since no baseline evidence indicates the compliance rate is moving in either direction this cycle.

A related scheme surfaced this cycle illustrates how registry-level opacity can combine with payment-system and crypto-rail layering. A shell-company network centred on PT A2Z Solusindo Teknologi laundered illegal-gambling proceeds through the Indonesian QRIS instant-payment system and cryptocurrency, moving funds through 4,656 bank accounts across 22 banks before disruption by Bareskrim, which seized roughly 32.1 million dollars. The underlying corporate-opacity and layering architecture behind the disrupted network is assessed as reproducible, since the beneficial-ownership verification gap that allowed shell entities to be established and operated with limited scrutiny has not itself been addressed by this single disruption.

Standing architecture context frames how this Indonesia-specific finding should be read against the European transparency regime, even though Indonesia sits outside that regime perimeter. The EU AML Package now comprises three distinct instruments: the AML Regulation, known as the AMLR, under Regulation (EU) 2024/1624, which is directly applicable across member states without national transposition; the sixth AML Directive, known as 6AMLD, which each member state transposes individually into domestic law; and the AMLA Regulation under Regulation (EU) 2024/1620, which establishes the Anti-Money Laundering Authority. Together these instruments are shifting the EU beneficial-ownership and corporate-transparency supervisory perimeter from a purely national-authority model toward a hybrid regime in which AMLA holds direct supervisory authority over a defined set of higher-risk cross-border obliged entities, with indirect supervisory influence over the remainder through coordination with national supervisors. Indonesia, as a non-EEA jurisdiction, sits outside this AMLR, 6AMLD and AMLA Regulation perimeter entirely; its only EU-facing exposure channel is the high-risk third-country listing mechanism, under which it was neither added nor previously listed in the December 2025 update. This durable architectural backdrop is standing context for reading beneficial-ownership findings generally, not a Indonesia-specific development this cycle. This structural distinction between direct EU applicability and indirect national transposition is the backdrop against which any future Indonesia-specific high-risk-listing determination, positive or negative, would need to be read.

Outlook

No structural registry reform for Indonesia was identified this cycle, and the sub-30-percent compliance rate with unverified self-declared data is assessed as a stable, rather than improving or deteriorating, condition absent a dedicated verification mandate. The comparative claim that Indonesia operates the only central beneficial-ownership registry in Southeast Asia was noted in this baseline research pass but lacks independent regional comparative verification, and is flagged here as an open item for the next research cycle rather than an established regional-uniqueness finding. Firms onboarding Indonesian corporate or fund-structure counterparties should continue to treat self-declared beneficial-ownership filings on PT structures as unverified data points rather than assured records, pending either a domestic verification-capacity build-out or, at the EU-facing margin, any future change to the non-listed status of Indonesia under the high-risk third-country mechanism. Operations and Compliance teams handling Indonesian corporate onboarding should factor the absence of independent verification directly into their own beneficial-ownership confidence scoring rather than treating registry submission alone as a completed control.

The defining finding for Indonesia in this domain is a supervision-intensity gap concentrated in the designated non-financial businesses and professions sector, rather than in the banking sector proper. Notaries, lawyers and real-estate agents are legally obliged reporting entities under Government Regulation 61 of 2021, yet FATF assessment found that, taken overall, this DNFBP sector has not effectively implemented AML/CFT preventive measures. Remedial action taken against non-compliant DNFBPs has been overwhelmingly limited to warnings rather than licence-level penalties such as suspension or revocation. Under the enabler-jurisdiction filter, this combination, a legal obligation that exists on paper alongside an enforcement posture that stops short of penalties with real market consequence, is the structurally significant finding: it leaves the professional-enabler gatekeeper layer under-supervised relative to the own risk profile of Indonesia and relative to the banking sector, where supervisory intensity is comparatively higher.

This gatekeeper gap sits alongside, and plausibly compounds, the beneficial-ownership verification weakness addressed in the D2 domain. Notaries and lawyers are frequently the professionals of first contact in establishing PT and Yayasan corporate structures and administering the transactions, including real estate, in which laundered proceeds are placed; a gatekeeper layer that is under-supervised at the point of warnings-only enforcement compounds a registry layer where self-declared beneficial-ownership data is not independently verified. Neither condition alone fully explains observed laundering typologies in Indonesia, such as the extractive-industry and gambling-proceeds schemes addressed elsewhere in this baseline, but together they describe an enabler architecture in which professional facilitators face limited downside for inadequate implementation of preventive measures.

Enablement as signal applies directly here: the absence of licence-level enforcement action against the DNFBP sector, despite a FATF assessment finding ineffective implementation, is itself analytically significant, distinct from and additional to any single enforcement episode that might occur in a future cycle. This baseline records no DNFBP licence suspension or revocation action in the research window, consistent with the warnings-only characterisation.

Within the broader D3 coverage of FIM, spanning enabler ecosystems such as the United Kingdom professional-services sector, Dubai and the UAE, Singapore and the Swiss reform trajectory, this Indonesia baseline contributes a comparably structured enabler-jurisdiction assessment: a domestic legal obligation exists, but supervisory follow-through is thin. No comparative enforcement-intensity claim between Indonesia and these other standing D3 jurisdictions is made here; the finding is confined to what the evidence base of this cycle supports for Indonesia specifically.

Outlook

No legislative or supervisory reform to DNFBP oversight was identified as pending in this cycle research window, and the enforcement posture is assessed as structurally stable rather than actively evolving. The most likely channel through which this gap becomes visible in a future cycle is either a FATF fifth-round mutual evaluation assessment of the effectiveness of Indonesia DNFBP framework, tracked here alongside the broader mutual-evaluation-scheduling uncertainty in the D1 domain, or an individual enforcement escalation beyond the warnings-only pattern that would itself constitute a notable departure from the baseline finding. Firms relying on Indonesian notaries, lawyers or real-estate agents as introducers or transaction facilitators for higher-net-worth or corporate customers should weight this supervision-intensity gap into their own enhanced due-diligence posture rather than relying on the existence of a domestic reporting obligation as a proxy for effective gatekeeping.

This domain baseline for Indonesia records a mixed trajectory: a substantial asset-recovery enforcement action in the extractive-industry corruption space, set against a persistent, structural under-investigation gap in a comparably significant proceeds-generating sector. In October 2025, six tin smelters and associated raw minerals, seized in the course of the Bangka Belitung tin-mining corruption probe and valued at roughly 362 to 422 million dollars, were formally handed over to state miner PT Timah. This is a significant enforcement episode against a standing extractive-industry money-laundering architecture that, per the active scheme inventory carried in this baseline, involves proceeds from corrupt allocation and under-reporting in the tin sector being laundered through banking, capital markets and real estate, at times routed offshore before repatriation. Read under the architecture-over-incident principle, the asset-recovery action updates the status of this scheme toward partial resolution without resolving the underlying laundering architecture itself, which remains only partially addressed.

Set against this, forestry and palm-oil predicate crime presents the inverse pattern: substantial proceeds generation without a commensurate enforcement response. The FATF 2023 mutual evaluation report flagged forestry crime as a major generator of criminal proceeds in Indonesia, yet money-laundering investigation and prosecution volume tied to forestry and palm-oil predicate crime remains persistently low relative to the scale of proceeds generated. A recent expansion of the Ministry of Environment and Forestry mandate to include money-laundering investigation authority has not yet closed this gap, per this baseline evidence. Under the three-pillar balance principle, this forestry gap deserves comparable analytical weight to the higher-profile tin-mining enforcement action, precisely because enforcement volume in the tin-mining case risks crowding out attention to the comparatively under-enforced forestry channel.

The extractive-industry laundering architecture identified here also carries a corporate-transparency dimension: the active scheme inventory records this scheme as spanning both the D4 conflict-finance and extractive-industry domain and the D2 beneficial-ownership domain, reflecting the role that opaque corporate vehicles play in receiving and layering extractive-sector proceeds before any repatriation. This overlap reinforces the reading that domain-siloed enforcement reporting, an asset-recovery action recorded in isolation, understates the multi-domain nature of the underlying architecture. This baseline carries a preliminary severity assessment of HIGH for both the tin-mining and forestry-related schemes, reflecting the scale of proceeds and the enforcement gap respectively, though this remains a preliminary rather than final rating.

Both findings carry direct cross-monitor relevance. The persistently low investigation volume for forestry and palm-oil proceeds is flagged as relevant to SCEM commodity-flow governance tracking, even absent an established direct armed-conflict financing linkage in this baseline evidence, while the PT Timah asset-recovery action and the PEP-adjacent extractive-sector allocation dynamics it surfaces warrant a state-capture-lens review under WDM, given the complicity of state officials in corrupt resource allocation implied by the underlying corruption probe.

Outlook

The near-term marker in this domain is whether asset-recovery momentum in the tin-mining case extends to the broader laundering architecture, banking, capital markets, real estate and offshore routing channels, that facilitated the underlying corruption, or whether the October 2025 handover represents the primary enforcement outcome of this particular episode. Separately, forestry and palm-oil money-laundering investigation volume is assessed as unlikely to shift materially without a dedicated capacity or mandate change beyond the recent Ministry of Environment and Forestry authority expansion; this baseline treats the investigation-volume gap as structurally stable rather than actively narrowing. Both threads should be read by Board and Risk audiences as extractive-industry integrity exposure that enforcement-episode reporting alone tends to understate.

The lead structural correction in this baseline sits squarely in this domain. Regulatory and supervisory authority over crypto assets in Indonesia transferred fully from the commodities regulator, Bappebti, and its successor CoFTRA, to the financial-sector regulator OJK, effective 10 January 2025, under Government Regulation Number 49 of 2024 and OJK Regulation Number 27 of 2024, with a mandatory regulatory sandbox requirement for new licensees. An automated challenge review of this baseline flagged, as a hard factual error, the continued listing of CoFTRA in the standing profile alongside OJK and Bank Indonesia as a current sectoral supervisor; that reference is stale as of the January 2025 transfer and is corrected in this baseline. CoFTRA no longer holds sectoral supervisory authority over crypto assets as of this baseline date. This correction matters beyond a single data-quality point: OJK now holding sole current sectoral crypto-supervisory authority changes which regulator obliged entities interfacing with Indonesian crypto-asset operators should treat as their primary supervisory counterparty.

Alongside this structural correction, two enforcement-capability findings illustrate the three-pillar balance of this domain in practice. PPATK and Special Detachment 88 secured three convictions between 2024 and 2025 of individuals financing Syria-based terrorist networks via cryptocurrency, with on-chain wallet evidence admitted at trial, a CTF-pillar outcome that reflects growing state capacity to build prosecution-ready cases from blockchain data rather than relying solely on designation or asset-freezing tools. Separately, an AML-pillar finding: Bareskrim disrupted a shell-company network, centred on PT A2Z Solusindo Teknologi, that laundered illegal-gambling proceeds through the Indonesian QRIS instant-payment system and cryptocurrency, seizing roughly 32.1 million dollars across 4,656 bank accounts at 22 banks. The underlying QRIS and crypto shell-company layering architecture is assessed as reproducible despite this disruption, since the scheme had operated since 2007 and had been laundering proceeds through this method since 2019 before detection.

A third, more speculative thread concerns the continued development by Bank Indonesia of a digital rupiah central bank digital currency, alongside the OJK crypto-licensing regime buildout. This finding rests on thin, single-vendor sourcing and a forward-looking characterisation, and the interaction between a state-backed digital currency and private virtual-asset-service-provider infrastructure has not yet been operationally defined in the available evidence base.

Outlook

The regulatory horizon carries one primary near-term marker for this domain: completion of the OJK crypto-licensing regime transition, expected by the end of 2026, including finalisation of Travel Rule implementation for crypto-asset operators, an event this baseline assesses as improving the AML/CFT coverage of the sector on implementation. The CBDC-VASP interoperability question remains an uncertain-direction item on a similar one-year horizon, reflecting its consultation-stage status and thin sourcing. Crypto-asset operators domiciled in or serving Indonesian customers should treat the current period as one of continued transitional supervisory uncertainty, notwithstanding the completed authority transfer to OJK, pending finalised licensing and Travel Rule rules.

The defining finding in this domain is a demonstrated translation of RegTech and SupTech capability into prosecution-ready evidentiary outcomes, rather than a compliance-technology deployment assessed only on adoption grounds. The PPATK SIPENDAR platform provides near-real-time data-sharing between financial institutions and law enforcement, and has been paired with blockchain-tracing tools built with UNODC support since March 2024. This combined capability underpins the three 2024 to 2025 convictions of individuals financing Syria-based terrorism through cryptocurrency, in which on-chain wallet evidence was admitted at trial, a concrete instance of active-defence technology functioning as an enforcement input rather than a reporting-compliance checkbox.

This baseline also surfaces two evidentiary-quality findings that qualify how the Indonesia profile as a whole should be read by downstream users. First, this baseline relies heavily on FATF, UNODC and international-vendor English-language reporting; no direct Bahasa Indonesia primary PPATK, OJK or Bank Indonesia publication was independently retrieved during this research cycle. This creates a downstream reasoning risk of over-relying on FATF or vendor characterisations of Indonesian regulatory text rather than the underlying primary Indonesian-language sources themselves, a gap flagged for prioritisation in future research cycles. Second, and more immediately consequential for publication readiness, an automated challenge review of this baseline returned a hold-for-review verdict: one hard flag, concerning the stale CoFTRA sectoral-supervisor reference corrected elsewhere in this baseline; two soft flags, concerning the omission of the June 2026 FATF follow-up report outcome from the profile summary narrative fields, and an unverified claim that Indonesia operates the only Southeast Asian beneficial-ownership registry of its kind; and one information finding. This verdict means the standing Indonesia baseline profile record is pending correction rather than fully clean, and downstream Composer and Reviewer stages should treat it accordingly.

Read together, these two findings, a genuine compliance-technology capability success and an unresolved evidentiary-quality hold, illustrate why active-defence assessment in this domain must track both the sophistication of the detection and disruption tooling of a jurisdiction and the reliability of the evidentiary base underpinning the assessment of that jurisdiction more broadly.

Outlook

The most direct near-term marker in this domain is procedural: whether the hard-flag and soft-flag findings of the automated challenge review are resolved through a re-issued, source-verified baseline synthesis pass before this Indonesia profile is relied upon downstream without qualification. Absent that correction, the CoFTRA sectoral-supervisor reference and the FATF follow-up report summary-field omission remain live data-quality gaps in the standing profile even though the corrected facts are already available in the structured claims for this cycle. On the capability side, SIPENDAR and blockchain-tracing capability are assessed as a stable, functioning enforcement input rather than a pending development, and no further RegTech or SupTech capability expansion was identified as scheduled in this cycle research window. Future research cycles prioritising direct Bahasa Indonesia primary-source retrieval would meaningfully strengthen the evidentiary tier of this domain assessment.