OJK Regulates Digital Banking Services

OJK Regulates Digital Banking Services

30 October 2018

The Indonesian Financial Services Authority (the OJK) will now manage the provisions of digital banking services by commercial banks through its recently issued regulation POJK 12/2018, effective 8 August 2018. POJK 12/2018 was issued to increase operational efficiency, improve customer service quality, and to encourage responsible innovation. The regulation applies to any commercial bank providing digital banking services. Through this regulation, we recognise OJK's fortitude to ensure risk infrastructure is properly managed to support digital services in Indonesia.

The key provisions of POJK 12/2018 address:

Digital banking services

Digital banking services can either be provided directly by the banks or based on partnerships between the banks and financial services/non-financial services institutions. Banks are allowed to provide account administration/opening, transaction authorisation, financial management, and/or other financial services as permitted by the OJK. Digital banking services provided on the partnership basis are: information services (not followed by further interaction/financial transaction), transactional services, and/or other financial services as permitted by the OJK (collectively or separately referred to as, Services). Only third parties who are financial institutions may provide information services, however no such restriction applies to transactional services.

Services are provided through delivery channels such as automated teller machines (ATM), cash deposit machines (CDM), phone banking, short message service (SMS) banking, electronic data capture (EDC), point of sale (POS), internet banking, and mobile banking.

Know your customer (KYC) principles

Similar with traditional banking services, individuals who choose to open an account with the bank through the Services are subject to KYC principles. The bank shall be obliged to obtain customer identification information and run verification checks by (i) face-to-face dealings or (ii) using two-factor authentication methods (which must include the "what you are" factors, such as fingerprints and voice recognition).

Bank-Fintech cooperation

Banks are prohibited from becoming a marketplace when providing transactional services to its third-party partners and are limited to offering Services which are agreed to in writing between the bank and its third-party partners.

Banks are also prohibited from bearing any liability for the risks of its third-party partners when providing the Services.

OJK approvals

OJK approval is required where

  • banks are introducing Services,
  • the Services increase bank's risk exposure, or
  • the Services provided are unprecedented in the Indonesian market (new developments).

OJK approval may be applied for online. This approval will be provided where the bank provides evidence of its readiness to provide the Services (with documents such as Service policies, risk analysis, etc.) and a one-year business projection. The bank must have also obtained a ranking level one or a ranking level two risk rating.

Banks are required to apply for OJK approval at least two months before implementing the contemplated Services and must implement the Services within six months of OJK approval (or the bank will be required to reapply for approval). Notably, banks are required to submit a report on approved Services realization three months after approved Services implementation.

Consumer protection

Banks are required to secure customer data and transactions when providing the Services and are obligated to provide a service to handle customer queries and complaints 24 hours a day.


Banks failing to comply with POJK 12/2018 will be subject to the following sanctions:

  • warnings
  • bank's risk rating downgrade
  • prohibiting issuance of new Services
  • business suspension
  • inclusion of executive/management to be listed as unsuccessful in the fit and proper mechanism
  • fines

Implementation and Indonesia practice

It is encouraging to see the regulators take an active part in regulating the digital banking sector to better protect bank customers as digital banking services are increasingly prevalent. It remains to be seen exactly how OJK shall implement POJK 12/2018. We will provide further updates as they become available.

Our Indonesia Banking and Finance team has the capability to assist our clients in navigating through the ambiguities and complexities of the regulatory framework in Indonesia. We understand that commercially and legally viable solutions are important to our clients, and we strive to provide our best.

For further information on our Indonesia Banking and Finance practice, do not hesitate to contact us.

Noor Meurling - Senior Foreign Legal Consultant, Indonesia : noor.meurling@dnfp.com




Our practice areas

Our disputes practice is recognised by Legal 500 Asia Pacific – Indonesia 2018, and our highly skilled and experienced lawyers in our...

Our people

Our team at DNFP has a wide range of backgrounds and its members are well established leaders in the local market. We believe that diversity of...