MFA requirements in Indonesia are not consolidated in a single law, but the Financial Services Authority (OJK) and Bank Indonesia already set them out explicitly in their regulations. Outside the financial sector, the legal basis is the duty to protect personal data, which often leaves IT and legal teams unsure how far MFA is truly required.
MFA (multi-factor authentication) is a login method that asks for two or more verification factors, such as a password and a one-time code (OTP) sent to a phone. For commercial banks, OJK requires at least two authentication factors to verify financial transactions under OJK Regulation Number 21 of 2023 on Digital Services by Commercial Banks (POJK 21/2023).
This article maps the Indonesian rules that require MFA, their articles and sanctions, the international standard that complements them, and the steps to prepare compliance evidence.
MFA Requirements in Indonesia at a Glance
Whether MFA is mandatory in Indonesia depends on your business sector and the type of data you manage. Rules from OJK and Bank Indonesia, the central bank, address authentication directly, while other companies fall under a general duty to prevent unauthorized access to personal data.
| Regulation | Who is bound | Authentication obligation | Sanctions |
|---|---|---|---|
| POJK 21/2023 (OJK) | Conventional and sharia commercial banks, including branches of foreign banks and sharia business units | At least two authentication factors to verify customers and financial transactions | A written warning, then further sanctions up to a downgrade of the bank’s soundness rating |
| Bank Indonesia Board of Governors Member Regulation Number 24 of 2024 (PADG 24/2024) | Payment service providers, payment system infrastructure operators, money market and foreign exchange market players, and other parties supervised by Bank Indonesia | Authentication and authorization methods that fit the cyber risk profile | A warning, an obligation to pay, and suspension of activities, up to license revocation |
| Indonesia’s Personal Data Protection Law (UU PDP, Law Number 27 of 2022) | All personal data controllers and processors | Preventing unauthorized access with a reliable security system, without naming MFA | A written warning, up to an administrative fine of at most 2 percent of annual income or revenue, based on the violation variable |
Of these three rules, only POJK 21/2023 states the number of factors explicitly, while Bank Indonesia leaves the choice of method to a risk assessment. A bank that also operates as a payment service provider falls under both rules at once, so treat the stricter one as your baseline.
Although UU PDP does not mention MFA, a single password is hard to defend as a reliable security system if an account holding personal data is breached.
POJK 21/2023: Banks Must Use at Least Two Authentication Factors
POJK 21/2023 requires commercial banks to use at least two authentication factors at two points: when verifying customers or prospective customers, and when verifying financial transactions. The regulation took effect on December 22, 2023, and gave banks one year to adjust the IT infrastructure of services already in operation.
Verifying Customers and Prospective Customers
To verify customer data, Article 5(6) requires two authentication factors regardless of the mechanism. If verification takes place through an electronic face-to-face session or without face-to-face contact, Article 5(7) requires one of the factors to be biometric.
The elucidation of that article divides authentication factors into three groups:
- Something you know, meaning information only the customer knows, such as a username, password, PIN, or mother’s maiden name.
- Something you have, meaning an identity document combined with an OTP, an electronic signature, or another equivalent form.
- Something you are, meaning an inherent trait such as facial recognition, fingerprints, or the iris or retina.
Verifying Financial Transactions
Article 9(1) requires two authentication factors each time a bank verifies a financial transaction. Article 9(2) lets banks apply this per transaction or within set limits, as long as the approach rests on the bank’s risk analysis and the customer’s consent.
The regulator gives a concrete example in the elucidation of Article 9: a customer registers their phone and then enters a password as the two factors. After that, the bank may skip the password for transactions below IDR 500,000, provided a risk analysis sets the limit and the customer agrees.
Sanctions and Supporting Obligations
A bank that violates Article 5(6), Article 5(7), or Article 9(1) receives a written warning under Article 19. If the bank keeps violating the rules after the warning, OJK can freeze certain digital services, ban new digital services, or downgrade the bank’s soundness rating.
The same regulation requires banks to educate customers on using adequate authentication factors (Article 28). A license application for a new digital service must also detail each factor’s specifications, such as password length and the confidence threshold for facial recognition.
PADG 24/2024: Authentication Methods Based on Cyber Risk Profiles
Bank Indonesia sets no fixed number of factors, but Article 23(e) of PADG 24/2024 requires supervised entities to use authentication and authorization methods that fit their cyber risk profile. The elucidation of that article distinguishes single-factor, two-factor, and multi-factor authentication, with an example of each.
A password alone counts as single-factor, a password plus a token counts as two-factor, and a combination of password, token, and biometrics counts as multi-factor. With this classification, an entity needs to be able to explain why the method it chose for each system is proportionate to that system’s risk.
Entities that use third-party systems, or their own systems without a direct connection to Bank Indonesia, must still apply these authentication methods (Article 63 and Article 64(n)). Article 22(a) also requires logical access management, such as managing usernames and passwords.
For administrator access to payment systems and for remote access, choose MFA from the start. In the annual audit required by Article 12, a password alone is hard to defend as a proportionate method for high-risk access.
Legal Basis for MFA Outside the Financial Sector
Outside banking and payment systems, the legal basis for MFA is the duty to secure personal data under UU PDP. That duty binds every company that processes customer or employee data, whatever its sector.
Article 35 of UU PDP requires controllers to apply technical and operational measures and to set a security level that fits the nature and risk of the data. Article 39 adds a duty to prevent unauthorized access by using a security system and electronic systems that are reliable, secure, and responsible.
Both duties also apply to processors under Article 52, such as cloud providers or payroll vendors that process data on your behalf. Violations can lead to administrative sanctions under Article 57, which start with a written warning and go up to a fine.
The law does not prescribe an authentication method, but single passwords are easily stolen through phishing or reused across services. For that reason, enable MFA on admin accounts and on applications that store customer or employee data at a minimum.
A clinic that keeps medical records in a cloud application, for example, should require MFA for every doctor and admin account. Health data falls under specific personal data, the sensitive category in UU PDP, so a leak has a greater impact on patients.
An International Standard That Also Requires MFA
Beyond national regulations, the most relevant international standard for payment processing companies in Indonesia is PCI DSS, the Payment Card Industry Data Security Standard. It applies to merchants, payment processors, card issuers, and service providers that handle card data.
The obligation to comply with PCI DSS comes from the compliance programs of card networks and acquiring banks, not from legislation. Requirement 8.4.2 mandates MFA for all access into the cardholder data environment (CDE), meaning the systems that store, process, or transmit card data.
An official PCI Security Standards Council (PCI SSC) FAQ adds that access to other systems that can be used to reach the CDE also requires MFA. PCI DSS has a different focus from POJK 21/2023: it governs employee and admin access to systems, while the POJK centers on verifying customers and transactions.
Steps to Make Your MFA Audit-Ready
The safest way to meet MFA requirements is to treat them as a control you must be able to prove during an audit. The five steps below help you prepare that evidence before an auditor or payment partner asks for it.
- Map the rules that bind your business. Commercial banks refer to POJK 21/2023, payment system operators to PADG 24/2024, card data processors to PCI DSS, and every company to UU PDP.
- List your high-risk access points. Start with admin accounts, remote access such as VPN, company email, cloud consoles, and applications that store personal data or card data.
- Choose factors based on the level of risk. SMS OTPs can be hijacked through SIM swapping, so use an authenticator app or a FIDO2-based security key for admin accounts.
- Document every exception. If you exempt small transactions or certain systems from MFA, keep the risk analysis and approval on file, as the Article 9 example in POJK 21/2023 describes.
- Archive the evidence and run regular user education. Keep your authentication policy together with the list of systems that require MFA, and make sure login logs can be retrieved when an auditor asks. Schedule user education too, because POJK 21/2023 requires it and PADG 24/2024 asks for it at least once a year.
Read also: MFA Implementation: A Structured Strategy for Enterprise Access Security
Conclusion
Indonesia already sets MFA requirements, but so far they are explicit only in the financial sector. POJK 21/2023 requires commercial banks to use at least two authentication factors, while PADG 24/2024 calls for authentication methods that fit the cyber risk profile.
Businesses outside the financial sector must still prevent unauthorized access to personal data under UU PDP. If you process payment card data, PCI DSS adds an MFA requirement for every access into the CDE.
Start this week by mapping the rules that apply to your business, then list the admin accounts and remote access points still without MFA. After that, prioritize phishing-resistant factors and keep the evidence for your audit.
Ready to Manage Digital Identities as a Business Security Strategy?
Request a demo today and discover how IAM solutions centralize user logins through Single Sign-On (SSO), automate employee onboarding, and protect company data from unauthorized access without disrupting productivity with repeated logins.
FAQ
The elucidation of POJK 21/2023 treats OTP as part of the possession factor, so a password plus an OTP can count as two factors. For remote verification of customer data, this combination is not enough, because Article 5(7) requires one factor to be biometric.
No regulation specifically requires MFA for micro, small, and medium enterprises (MSMEs), but UU PDP applies to every personal data controller regardless of revenue. MSMEs that store customer data should therefore turn on MFA for business email and application admin accounts first.
UU ITE does not mention MFA directly. The law requires every electronic system operator to run its systems reliably and securely, and MFA is one of the easiest controls to prove for that duty.
Yes, if the incident counts as a cyber incident or a personal data protection failure. Entities supervised by Bank Indonesia must send an initial notification within one hour, while UU PDP requires written notice within 3 x 24 hours (72 hours).
PCI SSC accepts synced passkeys that meet FIDO2 requirements as a single factor for Requirement 8.4.2. For admin access to the CDE and for remote access, a passkey must still be combined with another factor, such as a PIN or biometrics.
