Financial Information Access and Crypto Assets Under PMK 108/2025

PMK 108/2025 took effect on 1 January 2026 and revoked PMK 70/PMK.03/2017. Its preamble cites Indonesia’s commitment to the amended Common Reporting Standard and the Crypto-Asset Reporting Framework (CARF), with exchange starting in 2027 for data year 2026.

Article 2(1) now names two sources of information: financial institutions and reporting crypto-asset service providers. Article 12(3) adds central bank digital currencies and certain electronic money products to identification procedures from 1 January 2026.

Who is covered

Attachment II goes well beyond banks. It lists rural banks, securities companies, investment managers, certain insurers, microfinance institutions, savings and loan cooperatives, non-bank payment providers, venture capital firms managing venture funds, peer-to-peer lending platforms, and futures traders and brokers.

Article 4(4) also covers institutions with activities outside Attachment II if they meet the criteria in Attachment I. The list needs to be read with those criteria.

Dates to note

For crypto-asset service providers, Article 25(3) requires existing users to be identified by 31 December 2026. The first report covers data year 2026, and Article 24(4) sets a deadline of 30 April, so the first report is due on 30 April 2027. Registration follows Article 19(7): by the end of the second month of the year after the criteria are met.

For financial institutions, Articles 9 and 11 set two routes. Financial services institutions report to the Financial Services Authority (OJK) by 1 August, and it passes reports to the tax office by 31 August. Other financial institutions and other reporting entities report through the Taxpayer Portal by 30 April. Reports under domestic tax law are also due on 30 April under Article 37(1).

Article 59 covers the transition. Reports and corrections filed up to 30 September 2026 follow the old rule. From 1 October 2026, reports for data year 2025 and earlier, and their corrections, follow PMK 108/2025.

What this means for company accounts

Article 35(8) sets the balance thresholds for domestic reports. At depository institutions, individual accounts are reported from an aggregate of Rp1 billion, while entity accounts have no threshold.

When a new account is opened, Article 12(4) requires the institution to ask for a valid self-certification. Article 48 prohibits false statements by any person, and Article 48(2) names entity account holders and controlling persons. Articles 52 and 53 let the tax office ask them for clarification, with 14 calendar days before a compliance request follows.

What to do

Financial institutions, cooperatives and payment providers should check their activities against Attachments I and II and confirm their registration status. Nil reports remain mandatory under Article 35(9).

Crypto-asset service providers need to finish identifying existing users before year-end. Other companies should make sure their self-certifications, including controlling persons, match company documents and tax records.