Type "pinjol legal OJK" into Google. Do it now, on your phone, the way a borrower would.
Look at what comes back.
Cermati. CekAja. Then, in third place, OJK itself. Then Lifepal.
Somewhere around position thirty-four, if you scroll far enough, sits an actual licensed lender. It holds the licence the searcher is asking about. It has held it for years. And a comparison site that has never lent anyone a rupiah is answering the question on its behalf.
The Search That Happens Before Anyone Compares Rates
Indonesian borrowers do not begin with product research. They begin with a threat assessment.
OJK's Satgas PASTI has blocked 14,005 illegal financial entities since 2017. Illegal lenders, fraudulent investment schemes, unlicensed pawnshops. Fourteen thousand of them, taken down one by one, and each one had customers before it was taken down.
People know someone. A cousin, a colleague, a neighbour who borrowed from something that looked legitimate and then discovered it was not. That knowledge shapes the first query, and the first query is not about interest rates.
What Indonesians type before they borrow
Trust queries, roughly 3 in 4
"pinjol OJK berizin terdaftar 2026"
"cara cek pinjol legal atau ilegal"
"Bank Jago aman gak?"
Product queries, the rest
"KTA bunga rendah"
"simulasi kredit motor"
"limit paylater tertinggi"
Three of the four questions above are not about a product. They are about whether you are real, whether you are legal, and whether trusting you is safe.
That first category is where the money is. Someone asking whether a lender is licensed has already decided to borrow. They are choosing who to borrow from, and they are choosing based on legitimacy before they choose based on rate.
Which means the aggregators have taken the most valuable moment in the entire funnel.
What Cermati Does That Your Bank Does Not
It is worth being precise here, because the usual explanations are wrong.
This is not a domain authority problem. Many Indonesian banks have stronger domains than the aggregators ranking above them. It is not a budget problem either. A national bank spends more on marketing in a quarter than Cermati spends in a year.
It is a content decision, made once, years ago, and never revisited.
The same query, four results
The aggregator answered the question. The institution advertised a product. That is the whole difference.
Notice what the licensed lender's page does not contain. It does not mention the OJK licence number in text a crawler can read, because that number sits inside a badge image. It does not explain how to verify a licence. It does not acknowledge that illegal lending exists.
It sells a loan to someone who has not yet decided whether lending in general is safe.
The Number Nobody Publishes as Text
Walk through a typical Indonesian financial institution's website and count the ways the licence appears.
There is a badge in the footer. A trust seal near the application button. Perhaps a graphic on the About page. All of them images. All of them invisible to Google, to Google Lens, to every AI crawler deciding what to cite when someone asks whether a lender is legitimate.
The alt text usually reads "berizin" or "terdaftar". Not the number. Never the number.
Same licence, two levels of visibility
What most institutions publish
A badge image with alt text reading "berizin OJK". Legally sufficient. Visually reassuring. Machine-readable by nothing.
What makes it findable
The registration number as text, in body copy and in structured data, in the server-rendered HTML head where crawlers read before JavaScript runs.
One is decoration. The other is a fact a machine can quote when a borrower asks whether you are legal.
This matters more than it used to. When someone asks an AI engine which lenders are OJK-licensed, the engine needs a verifiable fact to cite. A registration number published as text can be checked against a government database. A badge image cannot be read at all.
The certification obtained for regulatory reasons turns out to be exactly the kind of hard, checkable data that both search engines and generative engines weight heavily. Most institutions have hidden it inside a JPEG.
The Rate Table Nobody Can Read
The same failure repeats one level deeper.
Interest rates change. Tenors change. Fees get revised. So institutions build their rate tables dynamically, pulling from an internal system and rendering them with JavaScript after the page loads.
It works beautifully. The customer sees current rates. Compliance sees correctly displayed disclosures. Nobody notices anything wrong.
Crawlers read the server-side HTML before JavaScript executes. They see an empty container.
Your rates are legally displayed and commercially invisible. The aggregator, which hardcodes its comparison table into the page because it updates monthly rather than continuously, gets indexed.
Why This Is Actually an Operations Problem
Here is the part that makes this genuinely hard, and it is not a technical constraint.
Cermati can publish a new article on Tuesday. Nobody at Cermati needs a lawyer to approve a sentence describing what OJK licensing means.
A bank cannot. An article explaining licence verification touches regulatory claims, and regulatory claims go through compliance, and compliance goes through legal.
One article, from brief to publication
Draft
Days, agency or in-house writer
SME review
Days, product specialist
Compliance
Days, verification against POJK
Legal
Days, sign-off and liability review
Publish
Day, and indexing begins
Fourteen to twenty-one business days for one article. The aggregator publishes weekly. That is the competitive gap, and it is structural.
Every content calendar built on the assumption of weekly publishing dies somewhere around month three, when the backlog of pending approvals exceeds the number of articles anyone can remember commissioning.
The answer is not to publish faster. It is to design a content system that survives the queue.
What that looks like in practice
Pre-cleared templates. A licence verification explainer follows the same structure every time. Approve the structure once. Update the numbers monthly without triggering another full legal review.
Modular disclosures. The same risk disclosure appears on forty pages. Approve it once, store it as a component, insert it everywhere. Change it once when regulation changes.
Rate data in structured markup. If interest rates live in schema rather than in prose, updating a number is a data operation rather than a content revision. Nobody needs to reread the paragraph.
Batch approval cycles. Ten articles reviewed together take barely longer than one article reviewed alone. The reviewing is not the bottleneck. The context-switching is.
What You Can Actually Take Back
The aggregators are not going to stop ranking. They have earned their positions with genuinely useful content, updated monthly, structured for the question being asked.
But they are answering a question about you, and you have information they do not.
You know your own licence number. You know exactly what your verification process involves. You know what happens when someone applies and gets rejected, and why. You know what an illegal lender does differently, because you compete with them.
None of that is on your website.
Content the aggregator cannot write
Your licence, in text
The registration number as machine-readable text, in body copy and structured data, with a link to verify it against OJK's directory.
Illegal lending education
How to recognise an unlicensed lender. Written by an institution that has watched them operate, not by a content marketer.
Rejection transparency
Why applications get declined. Nobody publishes this, everybody searches it, and it demonstrates exactly the honesty a borrower is looking for.
FAQ schema on trust queries
Structured answers to the legitimacy questions that precede every product decision. This is what CekAja does and you do not.
None of it requires outranking Cermati on Cermati's own terms. It requires answering the question that Cermati answers on your behalf.
The Layer Underneath All of This
There is a reason to fix this now rather than next year.
Increasingly, borrowers do not open Google at all. They ask an AI engine whether a lender is legitimate, and the engine answers from whatever it can find and verify.
It cannot verify a badge image. It cannot read a JavaScript-rendered rate table. It can read a registration number published as text, cross-check it against a government directory, and cite the institution that published it clearly.
Ninety-one percent of educational finance queries now trigger an AI Overview, according to BrightEdge. Educational content built the top of every financial funnel, and it is now the content most likely to be summarised without a click.
That surface has its own discipline, and it is not SEO. Generative Engine Optimization for financial services is the work of becoming the source the engines cite, and it runs on structured data, credentialed authorship, and verifiable facts. Precisely the things a licensed institution has and an aggregator does not.
Both disciplines rest on the same foundation. AI engines rely on search crawlers to reach your content in the first place. A site Google cannot index properly will not be cited well by ChatGPT either, however good the schema. Getting fintech SEO right is not optional groundwork. It is the groundwork.
I wrote Found Before They Search partly because international SEO frameworks kept skipping the regulatory layer entirely, treating OJK licensing as a local curiosity rather than as the query that decides whether anyone reads the rest of your page. The companion volume, Cited or Silent, covers how generative engines evaluate verifiable facts when deciding what to cite. Both are available as free gated editions, and both are published in paperback and hardcover and listed on Google Play Books and Apple Books.
What Doing Nothing Costs
Nothing that appears in a report.
Your paid campaigns keep performing. Your product pages keep converting the traffic they receive. Nobody notices that the traffic arriving is people who already knew your name, and that people discovering the category for the first time are meeting you through a comparison table on someone else's website.
The aggregator collects that borrower's email, retargets them, and eventually sends them to whichever lender pays the best commission.
You hold the licence. Somebody else is renting out your legitimacy.
Frequently Asked Questions
Why do comparison sites outrank licensed institutions for licensing queries?
Because they answer the question and the institution advertises a product. Cermati publishes the complete list of licensed lenders, updates it monthly when OJK revises its directory, and structures it as a direct answer. Most institutions display their registration number inside a badge image, invisible to crawlers, and publish nothing addressing the legitimacy question at all. It is a content decision, not a domain authority problem.
Is putting our OJK licence number in an image actually a problem?
Yes, and it is one of the most common failures in Indonesian financial SEO. Google cannot read it. Google Lens cannot read it. No AI crawler can read it. The alt text typically says "berizin" rather than the number itself. Publishing the registration number as text in body copy and in structured data makes it a verifiable fact that engines can cite, which is exactly what a borrower asking about legitimacy needs.
Why can't Google index our interest rate tables?
If the table is rendered by JavaScript after the page loads, crawlers reading the server-side HTML see an empty container. Your rates are legally displayed to a human and commercially invisible to every search engine and AI crawler. Aggregators typically hardcode their comparison tables because they update monthly rather than continuously, which is why theirs get indexed and yours do not.
How do we publish content when legal review takes three weeks?
By designing the content system around the queue rather than pretending it does not exist. Pre-cleared templates approved once and updated monthly. Modular disclosure blocks stored as components and reused across pages. Rate data in structured markup so updating a number is a data operation rather than a content revision. Batch approval cycles, because reviewing ten articles together takes barely longer than reviewing one alone.
What content can we publish that an aggregator cannot?
Your own licence number and verification process. Illegal lending education written by an institution that competes with illegal lenders rather than by a content marketer. Rejection transparency, explaining why applications get declined, which nobody publishes and everybody searches. FAQ schema on the trust queries that precede every product decision.
How many lenders are actually licensed by OJK?
Ninety-five as of the OJK LPBBTI directory in March 2026, down from 97 in January 2025 and 96 in April 2025. The direction matters more than the number. The list changes, aggregators republish it monthly, and most institutions leave their pages untouched for years.
Does this matter now that people ask AI instead of Google?
It matters more. An engine cannot verify a badge image or read a JavaScript-rendered rate table. It can read a registration number published as text, cross-check it against a government directory, and cite the institution that published it clearly. Roughly 91% of educational finance queries now trigger an AI Overview, so the content that built the top of your funnel is the content most exposed to zero-click summarisation.
Sources & References:
- Otoritas Jasa Keuangan - LPBBTI licensed operator directory, March 2026. Ninety-five licensed operators, down from 97 in January 2025.
- OJK Satgas PASTI - 14,005 illegal financial entities blocked since 2017, cumulative figure.
- BrightEdge Generative Parser - AI Overview trigger rate on educational finance queries. Note that other trackers report different figures for "finance keywords" because they measure different keyword sets.
- POJK 22/2023 - consumer protection provisions governing financial product marketing.
- Arfadia Digital Indonesia - State of SEO Indonesia 2026. arfadia.com/resources
- Arfadia Digital Indonesia - AI Citation Rate Report 2026. arfadia.com/resources