.jpg)
6 November, 2018
The Indonesian Financial Services Authority (the OJK) will now manage the provisions of digital banking services by commercial banks through its recently issued regulation POJK 12/2018, effective 8 August 2018. POJK 12/2018 was issued to increase operational efficiency, improve customer service quality, and to encourage responsible innovation. The regulation applies to any commercial bank providing digital banking services. Through this regulation, we recognize OJK's fortitude to ensure risk infrastructure is properly managed to support digital services in Indonesia.
The key provisions of POJK 12/2018 address: Digital banking services
Digital banking services can either be provided directly by the banks or based on partnerships between the banks and financial services/non-financial services institutions. Banks are allowed to provide account administration/opening, transaction authorization, financial management, and/or other financial services as permitted by the OJK. Digital banking services provided on the partnership basis are: information services (not followed by further interaction/financial transaction), transactional services, and/or other financial services as permitted by the OJK (collectively or separately referred to as, Services). Only third parties who are financial institutions may provide information services, however no such restriction applies to transactional services.
Services are provided through delivery channels such as automated teller machines (ATM), cash deposit machines (CDM), phone banking, short message service (SMS) banking, electronic data capture (EDC), point of sale (POS), internet banking, and mobile banking.
Know your customer (KYC) principles
Similar with traditional banking services, individuals who choose to open an account with the bank through the Services are subject to KYC principles. The bank shall be obliged to obtain customer identification information and run verification checks by (i) face-to-face dealings or (ii)
using two-factor authentication methods (which must include the "what you are" factors, such as fingerprints and voice recognition).
Bank-Fintech cooperation
Banks are prohibited from becoming a marketplace when providing transactional services to its third-party partners and are limited to offering Services which are agreed to in writing between the bank and its third-party partners.
Banks are also prohibited from bearing any liability for the risks of its third-party partners when providing the Services.
OJK approvals
OJK approval is required where
- banks are introducing Services,
- the Services increase bank's risk exposure, or
- the Services provided are unprecedented in the Indonesian market (new developments).
OJK approval may be applied for online. This approval will be provided where the bank provides evidence of its readiness to provide the Services (with documents such as Service policies, risk analysis, etc.) and a one-year business projection. The bank must have also obtained a ranking level one or a ranking level two risk rating.
Banks are required to apply for OJK approval at least two months before implementing the contemplated Services and must implement the Services within six months of OJK approval (or the bank will be required to reapply for approval). Notably, banks are required to submit a report on approved Services realization three months after approved Services implementation.
Consumer protection
Banks are required to secure customer data and transactions when providing the Services and are obligated to provide a service to handle customer queries and complaints 24 hours a day.
Sanctions
Banks failing to comply with POJK 12/2018 will be subject to the following sanctions:
- warnings
- bank's risk rating downgrade
- prohibiting issuance of new Services
- business suspension
- inclusion of executive/management to be listed as unsuccessful in the fit and proper
- mechanism
- fines
Implementation and Indonesia practice
It is encouraging to see the regulators take an active part in regulating the digital banking sector to better protect bank customers as digital banking services are increasingly prevalent. It remains to be seen exactly how OJK shall implement POJK 12/2018. We will provide further updates as they become available.
