What Is Fraud Under POJK 12/2024: OJK Codes, Deadlines and Fines

What is fraud for an Indonesian bank, insurer or multifinance company? Since 31 October 2024 the answer is a legal one, not a textbook one. Article 1 point 4 of POJK 12 of 2024 defines Fraud as a deliberate deviation and/or omission meant to deceive, trick or manipulate the financial services institution (LJK), a Konsumen or another party, occurring inside the LJK and/or using the LJK's facilities ("menggunakan sarana LJK"). The regulation was promulgated on 31 July 2024 and took effect three months later. Once an incident falls inside that definition, the institution has to code it, fill a nine-cell loss block, and report significant cases to OJK within 3 or 6 working days.

Every quotation below comes from OJK's official copy, which we downloaded on 28 October 2026. Regulation wording is quoted in the original Indonesian, with our translation alongside.

The legal definition of fraud, against the ACFE one

Most English pages that answer "what is fraud" give the auditor's version. The Association of Certified Fraud Examiners puts it in one line: fraud is "any activity that relies on deception in order to achieve a gain" (ACFE, Fraud 101). Then come the ACFE fraud tree and Cressey's triangle of pressure, opportunity and rationalisation. OJK doesn't reject that lineage. Item 2(a) of OJK's FAQ on POJK 12/2024 says the definition "merujuk pada Fraud Tree ACFE" (refers to the ACFE Fraud Tree).

Same tree, wider canopy. Article 2 lists the three ACFE branches (corruption, asset misappropriation, financial statement fraud) and adds three more: deception (penipuan), leaking confidential information, and "tindakan lain yang dapat dipersamakan dengan Fraud" (other acts equivalent to Fraud). For a compliance officer, two phrases in the definition matter more than the list:

"…mengelabui, menipu, atau memanipulasi LJK, Konsumen atau pihak lain, yang terjadi di lingkungan LJK dan/atau menggunakan sarana LJK…" (Article 1 point 4)

• The victim needn't be the institution. Consumers and other parties sit alongside the LJK, and the party who gains can be "pelaku Fraud dan/atau pihak lain" (the perpetrator and/or another party).
• The act needn't happen on the premises. "And/or using the LJK's facilities" reaches incidents outside the institution, as long as its facilities were used.

Our reading, not the article's text: a social-engineering scam that drains an account through a bank's mobile app most likely falls inside the definition through "menggunakan sarana LJK". Two passages back that reading. The Elucidation of Article 4(2) names "penipuan online termasuk kegiatan investasi online fiktif" (online fraud, including fictitious online investment) and online gambling as misuse of accounts for crime. The Elucidation of Article 13(b) says reported perpetrators include "pelaku internal dan/atau eksternal". One trap for English readers: "pihak lain" in Article 4(3)(c) doesn't mean the scammer. Its Elucidation lists consultants, vendors, public accountants, appraisers, notaries, authorities and government.

POJK 12/2024 revokes POJK 39/POJK.03/2019 on anti-fraud strategy for commercial banks (Article 24), together with the fraud provisions in POJK 10/POJK.05/2019, 35/POJK.05/2018, 55/POJK.05/2017 and 69/POJK.05/2016. Against the 2019 definition, "Bank, nasabah" became "LJK, Konsumen", "deviation or omission" became "deviation and/or omission", and "keuntungan keuangan" (financial gain) became plain "keuntungan" (gain). An AI summary or vendor deck that still cites POJK 39/2019 is quoting a revoked rule.

Is fraud the same as corruption? No. In the ACFE tree, and in Article 2 letter a of POJK 12/2024, corruption is one branch of fraud.

How OJK classifies an incident: from attack pattern to report code

Annex II of POJK 12/2024 is the periodic report format, 47 columns wide. Three of its code tables decide how one incident is recorded: Section III (Jenis Fraud, type of fraud), Section IV (28 Aktivitas Terkait Fraud codes, 301 to 327 plus 399) and Section XI (16 Kelemahan Penyebab Fraud codes, the weakness that caused it). The table below is our mapping of the patterns compliance teams ask about most. The codes are from the text; the pairings are our reading.

Code 305 is defined as fraud "dengan menggunakan komputer, jaringan komputer, dan/atau media elektronik untuk mengelabui LJK, nasabah, orang, atau pihak lain agar memperoleh informasi dan data pribadi nasabah" (using computers, networks or electronic media to deceive in order to obtain customers' information and personal data). That's phishing, though the word never appears in the regulation. Code 303 covers transacting with another person's identity and data "tanpa sepengetahuan dan/atau persetujuan" (without the owner's knowledge and/or consent).

One number, three meanings

Codes aren't unique across tables. "501" means Penipuan in Section III and Kelalaian Konsumen (consumer negligence) in Section XI. "303" means other asset misappropriation in Section III and identity misuse in Section IV. A case-management system that stores the number without its table name will produce wrong entries, and Article 21 fines each wrong entry.

Four of the weakness codes are external: 501 Kelalaian Konsumen (consumer negligence), 502 Pemahaman Konsumen menjaga Kerahasiaan Data Pribadi (consumer understanding of keeping personal data confidential), 503 Kecurangan Konsumen (consumer fraud) and 504 Kecurangan Pihak Lain (third-party fraud). Annex II allows more than one weakness per incident, entered on the next row under the same incident ID. So filing 501 doesn't put the whole blame on the customer; 301 Teknologi Informasi can sit on the same incident.

After a customer loses money: what the institution must record

Article 13 sets 12 minimum fields for the report, from fraud type and perpetrator through to "j. pihak yang dirugikan; k. waktu kejadian Fraud; dan l. jumlah kerugian" (the injured party, the time of the fraud, and the amount of loss). In the Annex II format, a customer who was scammed is recorded roughly in this order:

1. Injured party (Section VIII): 001 LJK, 002 Konsumen, 003 Pihak Lain.
2. Timing (Section IX): the date the fraud started and ended, and the date it was discovered, all as YYYYMMDD. The discovery date starts the significant-fraud clock.
3. Loss (Section X): in full rupiah, across nine cells.
4. Response (Section XII, 14 codes): among them 06 card block, 07 account block, 08 card replacement, 09 police report, 10 compensation (ganti rugi), 13 report to an association, regulator or agency.
5. External perpetrator (Section XVIII): 001 Konsumen, 002 a party working with the LJK, 003 "Pihak yang tidak berhubungan langsung dengan LJK" (a party with no direct relationship to the LJK).

The loss cells are three measures for three victims (LJK, Konsumen, Pihak Lain), hence nine cells, filled for "baik kerugian yang dialami oleh LJK, Konsumen, dan/atau pihak lain" (losses suffered by the LJK, the consumer and/or other parties). The example column is our reading. The word "diganti" (compensated) matters: compensation the institution pays also reduces the After Recovery figure, not only funds clawed back.

The significant-fraud report (Annex III, 32 columns) is leaner: one "Jumlah Kerugian Potensial" column with no split by victim, and one free-text "Tindakan Lanjut LJK" column of up to 4,000 characters. We found one mismatch. Annex II and FAQ item 6 ask for a significant fraud to be re-reported in the periodic report "dengan menggunakan ID kejadian Fraud yang sama" (using the same incident ID). But periodic-report IDs are 12 characters (for example A12024000001) and significant-report IDs are 13 (AS12024000001). The text doesn't say how to reconcile them. Ask your supervisor at OJK before the reporting system is built, not after.

Deadlines and late-filing fines by institution type

Two reports run on two clocks. The periodic report (Article 14) is semi-annual only for commercial banks and BPR (rural banks): positions at end-June and end-December, due by the 31st of the following month. Every other institution reports annually, position at end-December, due by 31 January. The significant-fraud report (Article 15) counts from the day the fraud is discovered.

The Article 20(2) fine runs per working day per report and applies to breaches of Articles 11, 12, 14, 15, 16 and 18(1). Paying it doesn't discharge the duty to report (paragraph 4). Article 21 adds a separate fine for wrong entries: Rp50,000 per error, capped at Rp5 million per report, for BPR with core capital of at least Rp50 billion, pension funds with assets of at least Rp500 billion and other LJK above that size; Rp10,000 per error, capped at Rp1 million, for smaller ones. Commercial banks fall back to the commercial-bank reporting POJK.

The details that get missed:

• "Significant" has no number. The Elucidation of Article 10(2) gives only qualitative examples: a significant breach of regulation, fraud that could threaten business continuity, or fraud likely to attract public attention. The word "signifikan" appears 0 times in Annex I. Our reading: each LJK has to set its own threshold in its anti-fraud strategy, and that threshold is what an OJK examiner will test.
• Weekends. A deadline that falls on a Saturday, Sunday or public holiday moves to the next working day (Article 17(1)). The Elucidation of Article 17(2) names "serangan siber" (a cyber attack) as a force majeure that can justify a delay.
• Nil returns are still filed. FAQ item 8: with no incidents, the periodic report is still submitted, marked nil.
• Corrections. Within 15 working days of discovering the error (Article 18(2)).
• Strategy document. Article 11: within 3 months of the effective date for commercial banks, insurers, reinsurers and multifinance companies, 6 months for the rest. Counting from 31 October 2024, our arithmetic gives 31 January 2025 and 30 April 2025. Changes to the strategy are reported within 7 working days (Article 12).

What isn't written: "fraud detection system"

The phrase "fraud detection" appears 0 times in the body, the elucidation and the three annexes of POJK 12/2024. The detection pillar (Article 5 letter b) must contain at least "kebijakan dan mekanisme whistleblowing, pemeriksaan mendadak, dan sistem pengawasan" (whistleblowing, surprise audits and a surveillance system), and Annex I defines that surveillance system as testing "yang dilakukan secara rahasia tanpa diketahui atau disadari oleh pihak yang diuji" (carried out covertly, without the tested party knowing). The prevention pillar includes "kebijakan mengenal pegawai", a know-your-employee policy.

Yet OJK's FAQ item 2(d) summarises the regulation as "Kewajiban penerapan Fraud Detection System" (an obligation to implement a Fraud Detection System). So here's the position we think holds up in an examination: the regulation doesn't use the term, OJK itself reads it in that direction, and a vendor selling a detection product as the whole compliance answer skips the whistleblowing and surprise audits that are actually written down.

The soft spot is customer education. Article 7(2)(b) says the LJK "harus" (should), not "wajib" (must), educate or brief external parties on its anti-fraud policy at least once a year. The sanction in Article 9(1) names only Article 7(1). Article 9's sanctions themselves escalate as far as a ban on launching new products, suspension of specific business activities (paragraph 3) and a ban on serving as a principal party of an LJK (paragraph 4).

Three searches turned up no SEOJK (implementing circular) for POJK 12/2024, but we haven't combed jdih.ojk.go.id directly.

Where phishing lands: code 305

Google's AI Overview for the Indonesian query "fraud adalah" (checked 28 October 2026) files phishing, skimming, card theft and social engineering under external or digital fraud. In a POJK 12 report, a phishing incident is recorded as Type 501 Penipuan with Activity 305 Penggunaan siber. Which parts of the attack the channel owner actually controls, we measured in what phishing is for a bank's channel, with DMARC data from 20 Indonesian financial institutions.

Where POJK 12 stops: who bears the loss

POJK 12/2024 governs recording and reporting, not compensation. Article 22 leaves liability for consumer losses to other rules, and its Elucidation points to consumer-protection regulation. That's POJK 22/2023 (promulgated 22 December 2023). Its Article 10(1) makes the PUJK (financial services provider) liable for consumer losses caused by the error, negligence or breach of its directors, commissioners, employees or third parties working on its behalf. Paragraph (2) is a defence: the PUJK isn't liable if it can prove the consumer's involvement, fault or negligence. So a duty to compensate doesn't arise automatically from every phishing incident. It arises when the loss was caused on the PUJK's side. The detail, including Article 24 on cyber resilience and fines of up to Rp15 billion, is in our screen-by-screen reading of POJK 22/2023, OJK's consumer protection regulation.

What the Head of Compliance should check this week

• The "significant" threshold is written into the anti-fraud guideline, with rupiah examples, so the 3- or 6-working-day clock doesn't wait on an internal debate.
• Code fields in the case-management system store the table name (Type, Activity, Weakness), not just the number.
• The "fraud discovered" date is stamped automatically when a customer complaint arrives, because that date starts the deadline.
• The nine loss cells can be filled from complaint and compensation data without a manual spreadsheet.
• The annual external education is documented, even though Article 9 doesn't name Article 7(2).

For the Head of Digital, items two to four are system requirements: complaint forms in the app and on the website that capture date, channel and rupiah amount from the first screen. That's part of website development and mobile app development for financial institutions; 42 of the 214 clients in WEBARQ's portfolio are banks and financial services firms. The full regulation is on OJK's POJK 12/2024 page.