Digital Marketing for Banks in Indonesia: A Customer-Acquisition Playbook That Stays Compliant

By Bagas · Updated November 7, 2026

Good digital marketing for banks is measured by cost per customer who completes KYC, not by impressions. Four stages sit between the first ad and an active account, each with a checkpoint from OJK, Indonesia's Personal Data Protection (PDP) Law, and Google and Meta policy. The rulebook has also moved. Financial-product ad criteria now sit in PADK 37/PADK.08/2025, in force since December 2, 2025, which revoked circular SEOJK 12/SEOJK.07/2014.

Key takeaways

• Bank ad criteria now sit in PADK 37/PADK.08/2025, Appendix I part C, issued under POJK 22/2023. Its six-month transition ended around June 2, 2026.
• Every bank ad must show the bank's name or logo and state that it is licensed and supervised by OJK, without the OJK logo (Article 35, POJK 22/2023).
• In Google Ads estimates as of November 7, 2026, "kta online" costs about Rp 50,760 per click and "simulasi kpr" about Rp 2,360.
• Report cost per completed KYC and drop-off per step to the board. Keep KYC and customer financial data away from ad platforms.

How is digital marketing for banks different from other sectors?

Banks sell products that touch people's money, so every ad, tracking tag and WhatsApp follow-up falls under three layers of rules: OJK for marketing material, the PDP Law for data, and platform financial-services policies. Elsewhere, a bad ad gets rejected. At a bank, it can mean fines of up to Rp 15 billion.

Financial content is also YMYL (Your Money or Your Life), so thin product pages struggle in organic search. According to SNLIK 2026 by OJK, LPS and BPS (75,000 respondents, 38 provinces), banking literacy stands at 66.46% and banking inclusion at 70.64%. Some people use bank products they don't fully understand, and jargon-heavy ads lose them.

Reach isn't the problem. DataReportal's Digital 2027: Indonesia counts 231 million internet users (80.2% of the population) as of October 2026. The problem is what happens after the click.

What does the bank customer-acquisition funnel look like, stage by stage?

A bank's acquisition funnel has four stages: awareness, consideration, app install or account start, and completed KYC. Each needs its own KPI. Mix them and a report can look healthy while acquisition stays unproven.

KYC (Know Your Customer) is the identification and verification of a prospect before the business relationship opens. For the legal basis, see KYC in Indonesia: legal basis and digital onboarding.

This playbook is a WEBARQ Promote analysis, November 7, 2026. The stages and KPIs are our recommendation, not an official standard. Checkpoints come from primary OJK and PDP texts and Google and Meta policy pages read that day.

Stage	Typical channels	KPIs to report (our recommendation)	Compliance checkpoint
Awareness	Google GDN, YouTube, Meta reach, creators	Reach, frequency, CPM, views (not installs)	Bank identity and "licensed and supervised by OJK", no OJK logo (POJK 22/2023 Art. 35; PADK 37); no unproven superlatives; creators disclose their bank tie (POJK 6/2026 Art. 7); Google Ads verification; 18+ on Meta for credit card and loan ads
Consideration	Search ads, product pages, calculators, remarketing	CTR, CPC, conversion to calculator, cost per qualified lead	Benefits, costs and risks provable (PADK 37); asterisks point to a link or QR code; personal-loan disclosures on the landing page (Google Ads); remarketing tags need a legal basis (PDP Law Art. 20–22)
App install or account start	App install campaigns, deep links, WhatsApp follow-up	Cost per install, install-to-registration rate	General product information summary (PADK 37); minimal data; privacy notice (PDP Law Art. 21); contact only with consent, Mon–Sat 08:00–18:00 (POJK 22/2023 Art. 39)
Completed KYC	In-app flow, email, push notifications, staff	KYC completion rate, drop-off per step, cost per completed KYC	Verification before the relationship opens (POJK 8/2023 Art. 21, 30); personal product summary confirmed (PADK 37); suitability assessment documented (POJK 22/2023 Art. 37); no KYC data to ad platforms

Awareness

This stage builds brand recall, and the risk sits in creative and creators. For influencers, POJK 6/2026 took effect on promulgation, June 4, 2026. Partnerships already in place before that date must be adjusted within six months (Article 16), which by our count falls on December 4, 2026. On Meta, the financial products ad standards (read November 7, 2026) limit credit card, loan and insurance ads to people aged 18 and over.

Consideration

Prospects compare rates, fees and terms via Search and calculators. Google Ads' financial products policy (read November 7, 2026) requires verification for financial-services advertisers in Indonesia, a physical address, and fees visible without a click. Personal-loan landing pages must show minimum and maximum repayment periods, maximum APR and a representative example, and loans repayable in under 61 days can't be advertised. Check yours against our lead generation landing page checklist.

App install or account start

Once a prospect installs the app or fills in the first form, the bank holds personal data. Ask for as little as possible. Follow-up by WhatsApp, SMS or phone falls under Article 39 of POJK 22/2023: only with consent, Monday to Saturday 08:00 to 18:00 local time, and the bank must name the source of third-party data.

Completed KYC

This stage decides whether ad spend became a customer. Article 30 of POJK 8/2023 requires verification before the relationship opens, or within three working days after if the bank has a risk-management procedure. Marketing doesn't own this flow, but it must read the numbers.

Which OJK and PDP rules affect ads and tracking?

Four documents bear on bank campaigns: POJK 22/2023 on consumer protection, PADK 37/PADK.08/2025 with the detailed ad criteria, POJK 6/2026 for influencers, and Law 27/2022 on Personal Data Protection. PADK 37 implements Articles 29(7) and 33(9) of POJK 22/2023, so cite them together. See our screen-by-screen reading of POJK 22/2023.

Promotional material

PADK 37 Appendix I part C groups ad requirements into five: clear, accurate, honest, easy to access and not misleading. For bank promo copy, check:

• "Paling" (most), "nomor satu" (number one) or any "ter-" superlative needs independent evidence and a stated assessment period.
• "Gratis" (free) holds only if the benefit needs no effort or extra cost, and filling in identity details counts as effort.
• "Pasti aman" (guaranteed safe) or "bebas risiko" (risk-free) needs an explanation the bank can defend.
• A deposit rate above the LPS guarantee rate must note that LPS doesn't cover it.
• Research data must be independent and at most two years old, and paid testimonials must be labeled as promotion.

Influencers and POJK 6/2026

Influencers may market bank products only under a partnership with the bank. Article 7 gives the bank eight duties, and a breach can cost up to Rp 15 billion. OJK doesn't take content down itself; under Article 12, it asks the communications minister to cut access. Details are in our post on the OJK financial influencer regulation.

Audience data and consent

Article 4(2) of the PDP Law classes personal financial data as specific personal data, and its elucidation gives savings and deposit amounts and credit card data as examples. Processing it needs a legal basis (Article 20). Consent bundled with other purposes without clear separation is void by law (Article 22). Specific data also triggers an impact assessment (Article 34), covered in our note on data protection impact assessments.

The PDP Law doesn't mention pixels, lookalikes or custom audiences. Applying its consent and purpose-limitation articles to them is our reading, not the law's wording. Platform policies are more explicit. Section 1.h of the Meta Business Tools Terms bars sending data based on financial information, including event names that imply it. Google's Customer Match policy accepts first-party data only.

Katadata reports that PP 33/2026, the PDP implementing regulation, was signed on July 16, 2026 and takes effect on January 16, 2027, requiring a consent mechanism and proof of consent. We couldn't find the official text, so treat those details as reported.

Data checkpoints before any tag goes live:

• A privacy notice on every page that runs a pixel.
• Legal reviews the Google and Meta event list: no balances, limits, credit status or KYC data.
• The agency contract requires data confidentiality, in line with Article 19(4) of POJK 22/2023.

How much do banking keywords cost per click in Indonesia?

In Google Ads estimates as of November 7, 2026, the average CPC for 21 banking keywords runs from about Rp 2,360 ("simulasi kpr", mortgage calculator) to Rp 50,760 ("kta online", online unsecured loan). These are keyword estimates, not actual campaign costs.

Method, WEBARQ Promote analysis, November 7, 2026, DataForSEO (Google Ads, Indonesia, Indonesian): 23 candidate keywords; "buka rekening online" returned no data. We left out a subsidized small-business loan keyword containing a bank's brand (60,500 searches a month, CPC USD 0.67). Volume is the monthly average, October 2025 to September 2026. USD values are converted at Bank Indonesia's JISDOR rate for November 6, 2026, Rp 18,130 per USD.

Keyword	Volume/month	Competition (index)	Low bid (USD)	High bid (USD)	CPC (USD)	CPC (Rp)
kartu kredit	40,500	Low (30)	0.19	1.20	0.91	16,500
deposito (time deposit)	27,100	Low (5)	0.12	0.34	0.34	6,160
bank syariah	22,200	Low (1)	0.11	0.58	0.24	4,350
kpr (mortgage)	12,100	Low (7)	0.10	0.33	0.34	6,160
asuransi jiwa	8,100	Medium (36)	0.12	0.68	0.66	11,970
bank digital	6,600	Low (31)	0.32	1.68	1.16	21,030
simulasi kpr (mortgage calculator)	5,400	Medium (43)	0.05	0.15	0.13	2,360
pinjaman bank	4,400	Medium (56)	0.18	2.70	0.95	17,220
kta online (online unsecured loan)	3,600	Medium (56)	0.43	6.08	2.80	50,760
kredit tanpa agunan	2,400	Medium (55)	0.27	4.38	1.89	34,270
pinjaman modal usaha (business loan)	1,300	Medium (56)	0.12	2.18	1.07	19,400
kartu kredit online	1,000	High (71)	0.32	2.46	1.49	27,010
pengajuan kartu kredit	880	High (70)	0.27	2.17	1.09	19,760
aplikasi mobile banking	720	Low (30)	0.09	0.33	0.36	6,530
kredit multiguna (multipurpose loan)	720	Low (30)	0.15	3.11	0.74	13,420
rekening tabungan	590	Low (2)	0.15	0.49	0.18	3,260
tabungan online	320	Medium (35)	0.12	0.42	0.46	8,340
kpr online	140	Medium (37)	0.10	0.19	0.27	4,900
deposito online	140	Medium (33)	0.18	0.92	0.61	11,060
pembukaan rekening online	110	Medium (43)	0.47	1.62	0.77	13,960
kredit kendaraan	90	Low (27)	0.13	0.68	0.35	6,350

Unsecured loans cost the most: the high bid for "kta online" reaches USD 6.08, so fix the landing page's Google disclosures before raising bids. The two credit card terms with "online" and "pengajuan" are the only high-competition rows, at up to 1.6 times the CPC of plain "kartu kredit" on 40 to 46 times less volume. "Simulasi kpr" is cheap because the searcher is still running numbers. Use it to fill remarketing audiences, not to judge acquisition cost.

Volume swings hard: "kartu kredit" logged 90,500 searches in August 2026 and 27,100 in September. CPC can sit above the high bid ("kpr") because they're separate estimates, and "asuransi jiwa" stays only as a bancassurance reference. Without conversion rates, none of this becomes a cost per customer.

What can the Bank BTN case study prove, and what can't it?

The Bank BTN case study shows that a multi-platform awareness campaign for a new app can reach a large audience. It doesn't prove installs, account openings, KYC or cost per customer, since those weren't published.

Published results: approximately 60 million impressions, around 200,000 clicks and about 7 million views across the campaign. It ran on Google GDN, YouTube and Meta Ads with Reach and Website Visit objectives, plus A/B testing of targeting and creative. Its goal was awareness for a new app and tactical campaigns, so it belongs in the funnel's first stage. If an agency offers an awareness case study as proof of acquisition, ask for the KYC numbers.

Which metrics should go to the board?

Report cost per completed KYC as the headline, alongside drop-off at each step and cost per activated account. Impressions, CTR and cost per install matter to the team, but for the board they only explain upstream cost.

There's no credible public benchmark for onboarding drop-off in Indonesian banking, so build your own baseline. Fire an event at each step, from registration and ID card upload to face verification and an active account. Those events stay in the bank's analytics; only legal-approved signals reach ad platforms.

Splitting monthly cost by stage shows the board which channels deserve more budget. For Search structure and reporting down to this stage, the WEBARQ Promote paid search team can help. For lead quality in a neighboring sector, see our post on insurance and multifinance lead quality.

How do you prepare the brief and checklist before a campaign goes live?

A good bank campaign brief sets the goal per funnel stage, the agreed KPIs, and who signs off the material for compliance. A bank marketing strategy that looks tidy on paper still trips if these questions have no answer.

Pre-flight question	Owner	Basis
Bank identity and OJK licence statement on every asset?	Marketing, compliance	POJK 22/2023 Art. 35
Any superlative, "free" or "risk-free" claim without evidence?	Compliance	PADK 37 Appendix I C
Google Ads account verified for financial services?	Digital team	Google Ads policy
Existing influencer deals adjusted before December 4, 2026 (our count)?	Marketing, legal	POJK 6/2026 Art. 16
Events and audiences free of financial and KYC data?	Legal, data	PDP Law Art. 4, 20–22
WhatsApp follow-up only to people who consented?	CRM	POJK 22/2023 Art. 39
Headline dashboard KPI is cost per completed KYC?	Marketing	Our recommendation

If the first two rows aren't settled, hold the campaign. If the fifth isn't, run without conversion tags for now rather than send the wrong data.

Frequently asked questions

What does a compliant bank marketing strategy look like in Indonesia?

Split the funnel into four stages, from awareness to completed KYC, each with a KPI and a regulatory checkpoint. Check ad material against PADK 37/PADK.08/2025 and Article 35 of POJK 22/2023, and audience data against Law 27/2022. Judge budget by cost per completed KYC, not impressions.

Can a bank work with influencers?

Yes, through a cooperation agreement with the bank. Article 7 of POJK 6/2026 requires the influencer to disclose their identity and tie to the bank and to promote only the agreed licensed products. The bank stays responsible for the content, and PADK 37 requires paid testimonials to be labeled as promotion.

What data can a bank use for retargeting?

First-party data collected directly from customers, with a clear legal basis and a privacy notice that covers sharing with service providers. Balances and credit card data are personal financial data under the PDP Law. Keep them, and KYC results, out of Google and Meta audience lists and event names.

Which KPIs measure customer acquisition?

Cost per completed KYC is the board's headline number, followed by cost per activated account. Under it, report drop-off at each step from install to face or document verification. Impressions, clicks and installs matter to the team, but they don't prove a new customer.

Which funnel stage loses the most prospects?

We haven't found a credible public benchmark for Indonesian banking, so be wary of generic figures. Fire an event at every registration and verification step in the app, then compare by channel and campaign. Fix the steepest drop before raising the ad budget.

Want your acquisition funnel measured to completed KYC, not just impressions? Our Performance Marketing team can map where it leaks, alongside your compliance team.

Note: this piece is general information, not legal advice. OJK rules, the PDP Law and platform policies change; confirm how they apply with your legal and compliance teams.