Anti-Fraud Strategy under OJK Regulation 12/2024: Scope, 4 Pillars, Reporting, and Sanctions

Photo by Stephen Dawson on Unsplash

Since OJK Regulation 12/2024 took effect, anti-fraud strategy is no longer only a concern for commercial banks. The regulation requires all financial services institutions (LJK) under OJK supervision, from banks, BPR, securities companies, insurers, pension funds, and financing companies to technology-based collective funding operators, to prepare, implement, and report an anti-fraud strategy.

Regulatory changes in 2025 to 2026 that affect this topic are summarized in the article audit and oversight regulation update 2026.

This article summarizes OJK Regulation 12/2024 from its official text: who is required to comply, types of fraud, the four pillars of the strategy, the responsibilities of the Board of Directors and Board of Commissioners, the reporting schedule, sanctions, and how it differs from the old rules. References checked as of 23 October 2026. A general guide to banking internal audit is in the article banking internal audit.

What Is the Anti-Fraud Strategy under OJK Regulation 12/2024?

Article 1 point 4 defines fraud as a deviation and or omission committed intentionally to deceive, cheat, or manipulate an LJK, consumers, or other parties, which occurs within the LJK and or uses LJK facilities, so that a party suffers a loss and or the perpetrator or another party gains a benefit, directly or indirectly.

The anti-fraud strategy (Article 1 point 5) is an LJK's strategy for controlling fraud, designed by referring to how fraud occurs, taking into account the characteristics of potential fraud comprehensively, and implemented in the form of a fraud control system. The basic concept of the causes of fraud is discussed in the article fraud triangle.

What Is the Legal Basis and Status of OJK Regulation 12/2024?

In our check up to 23 October 2026, we found no implementing OJK circular letter and no amendment to OJK Regulation 12/2024. That is a search result, not absolute proof, so check the OJK regulation portal before drafting policy.

Who Is Required to Implement It?

Article 3 paragraph (1) requires the following LJK, both conventional and sharia, to prepare and implement an anti-fraud strategy:

• commercial banks and people's economic banks (BPR);
• securities companies;
• insurance companies, reinsurance companies, insurance brokers, reinsurance brokers, and insurance loss adjusters;
• pension funds, financing companies, venture capital companies, infrastructure financing companies, microfinance institutions, pawnshop companies, and guarantee institutions;
• other LJK, including operators of information technology-based collective funding services (P2P lending).

Several notes. Article 3 paragraph (3) asks LJK to ensure that organizations they control, such as subsidiaries or foundations, also implement an anti-fraud strategy. Implementation covers three groups: consumers, LJK internal parties, and other parties such as consultants, vendors, public accountants, and notaries (Article 4 paragraph 3). For the capital market, only securities companies are named explicitly. The term BPRS does not appear, but it is covered through the phrase BPR operating on sharia principles.

The regulation applies the principle of proportionality: the form of implementation must take into account the internal and external environment, business complexity, types of fraud, risk, and adequacy of resources (Article 4 paragraph 1).

What Are the Types of Fraud under OJK Regulation 12/2024?

Article 4 paragraph (2) also requires prevention so that an LJK's business activities are not used for criminal acts. The elucidation gives examples such as accounts used for online gambling, online fraud including fictitious investments, and online prostitution. The audit approach to fraud is discussed in the article fraud audit and fraud investigation.

What Are the Four Pillars of the Anti-Fraud Strategy?

Article 5 sets out four pillars. The minimum content of each pillar is detailed in Annex I part IV.

Article 7 adds an obligation for education, competency development, and socialization of the anti-fraud policy to internal and external parties at least once a year. Article 4 paragraph (4) requires LJK to set implementation targets and a work program to achieve them.

Who Is Responsible Within an LJK?

• Board of Directors and Board of Commissioners: Article 3 paragraph (2) requires both to ensure that the anti-fraud strategy runs effectively. Annex I details their active oversight, including an anti-fraud declaration, an integrity pact for all levels, a code of ethics, and monitoring of fraud incidents.
• Anti-fraud unit or function: Article 8 requires LJK to have one. The unit is accountable to a member of the Board of Directors and communicates and reports directly to the Board of Commissioners. Its head holds an anti-fraud expertise certificate, anti-fraud experience, and or adequate experience in the relevant LJK sector.
• Compliance or risk management function: for LJK required to implement risk management, the elucidation of Article 8 allows the anti-fraud function to be carried out by the compliance and or risk management unit, and the director overseeing it must not be the one overseeing operations, finance, and accounting.

Where Does Internal Audit Fit?

The text of OJK Regulation 12/2024 does not use the term SKAI or internal audit unit. The only reference is in Annex I part III point 4 letter a: control through an operational review of the anti-fraud strategy's implementation may be performed by the internal audit unit or function or another party appointed by the LJK. So internal audit is one of the parties that may perform the review, not the owner of the anti-fraud unit.

The OJK FAQ adds that where other rules require the independence of a certain function, for example internal audit, combining functions is not allowed. In other words, do not appoint internal audit to also serve as the anti-fraud unit.

Note for BPR (rural banks) and BPRS (sharia rural banks): OJK Circular Letter 9/SEOJK.03/2025 item III.A.6 states that the SKAI (internal audit unit) or the Executive Officer for Internal Audit may be assigned to handle implementation of the anti-fraud strategy while maintaining independence. These two provisions are not entirely aligned, so a BPR should confirm the interpretation with its OJK supervisor. The discussion of the BPR internal audit function is in the article BPR internal audit.

What Are the Reporting Obligations to OJK?

Submission is made online through the OJK reporting system (Article 19). Article 10 paragraph (3) requires reports to be complete, accurate, current, and whole. The elucidation of Article 10 paragraph (2) gives examples of significant-impact fraud: significant violations of regulations, fraud that endangers business continuity, and fraud that could attract public attention or damage reputation.

According to the OJK FAQ, periodic reports must still be submitted even when there is no fraud incident, marked as nil.

What Are the Sanctions for LJK That Violate the Regulation?

• Violation of the implementation obligation (Article 9): a written reprimand or warning. If the violation continues, the LJK may be prohibited from issuing new products or activities, have part of its operations temporarily suspended, face restrictions on business activities, and or have certain business activities frozen. The Board of Directors and Board of Commissioners may be barred from serving as key parties of an LJK.
• Reporting violation (Article 20): a written reprimand or warning, plus a fine per working day of delay per report. Insurance and reinsurance: Rp1,000,000 per day, capped at Rp30,000,000 per report. Groups such as BPR, securities companies, pension funds, and financing companies: Rp100,000 per day, capped at Rp3,000,000. Venture capital, infrastructure financing, and P2P: Rp50,000 per day, capped at Rp1,500,000. Microfinance institutions and pawnshops operating at regency, city, or province level are exempt from fines.
• Errors in report content (Article 21): a fine per erroneous entry with a cap per report, which differs for large and small LJK.

Significant violations, for example intentional or repeated errors, may be subject directly to heavier sanctions without a prior reprimand.

What Is New Compared with OJK Regulation 39/POJK.03/2019?

1. Broader scope. The old rule applied only to commercial banks; the new rule applies to all LJK and the organizations they control.
2. Fraud taxonomy changed. From cheating (kecurangan), fraud by deception, asset embezzlement, information leakage, banking crimes, and other acts, to corruption, asset misappropriation, financial statement fraud, fraud by deception, confidential information disclosure, and other acts.
3. Anti-fraud unit. Accountable to a member of the Board of Directors, not the president director, and may be carried out by the compliance or risk management function.
4. Reporting. Commercial banks report semiannually no later than the 31st of the following month, previously the 15th. Other sectors report annually.
5. New: education at least once a year, a focus on preventing the use of LJK for criminal acts, as well as tiered sanctions and fines by type of LJK.

What Are the Practical Steps to Prepare for Compliance?

The following steps are an example of a working approach, not a provision of the OJK regulation.

1. Map the gaps against the four pillars. Match existing policies, procedures, and practices against the minimum content of Annex I part IV.
2. Prepare a fraud vulnerability assessment. The equivalent in the text is vulnerability identification. The risk assessment method is discussed in the article risk assessment.
3. Build a fraud incident database with the 15 elements required by the fourth pillar, so that periodic reports can be prepared without re-collecting data.
4. Set up a reporting calendar. Record the semiannual or annual deadlines, 3 or 6 working days for significant fraud, 7 working days for strategy changes, and 15 working days for corrections.
5. Plan annual education for internal and external parties, along with evidence.
6. Plan the operational review by internal audit of the strategy's implementation, while making sure internal audit does not also serve as the anti-fraud unit.
7. Monitor follow-up. Recommendations from the review and investigations must be tracked until completion, as discussed in the article follow-up on internal audit findings.

What Is Not in the OJK Regulation Text?

• Terms fraud detection system does not appear in the body, elucidation, or annexes. The term appears only in the abstract and the OJK FAQ, so do not cite it as an obligation of a specific article.
• Terms fraud risk assessment is not used. The equivalent is vulnerability identification.
• The term SKAI is not used, as discussed above.

How Does Internal Audit Software Help?

Audithink is not a fraud detection system, does not submit reports to OJK, and does not replace the anti-fraud unit. Audithink is internal audit management software with six main features: risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. For LJK, these features support the internal audit and follow-up side: preparing risk-based review plans, using uniform work programs, reminding teams of deadlines, and monitoring the follow-up status of recommendations. An overview of its use for banking and OJK compliance is in the article Audithink for banking and OJK compliance audit software.

FAQ on Anti-Fraud Strategy under OJK Regulation 12/2024

Conclusion

OJK Regulation 12/2024 shifts anti-fraud from the project of a particular unit to a control system that must be demonstrable: there are policies, incident data, timely reports, and follow-up. For internal audit teams, the main task is to independently review its implementation and ensure that findings are resolved.

If your team wants to tidy up its review plans, work programs, and follow-up monitoring, schedule an Audithink demo.