Urgent: New OJK Regulations on Digital Financial Services
The Financial Services Authority (OJK) has issued new regulations governing digital financial services, requiring compliance by March 2024. Companies must assess their digital platforms and update compliance frameworks.
New Regulatory Framework
The Financial Services Authority (OJK) has issued POJK No. 21 of 2023 on Digital Financial Services (“POJK 21/2023”), establishing a comprehensive regulatory framework for digital financial services in Indonesia. The regulation applies to banks, insurance companies, securities firms, and other financial institutions offering digital services.
Key Requirements
Licensing and Registration Financial institutions must obtain OJK approval before launching new digital financial services. Existing digital services must be registered within 6 months of the regulation’s effective date.
Consumer Protection Enhanced disclosure requirements for digital products, including standardized terms and conditions, risk warnings, and complaint handling procedures accessible through digital channels.
Data Security Mandatory implementation of:
- Multi-factor authentication for all transactions
- End-to-end encryption for data transmission
- Regular penetration testing and vulnerability assessments
- Incident response procedures with 24-hour notification to OJK
Operational Resilience Requirements for business continuity planning, disaster recovery capabilities, and minimum uptime standards for critical digital services.
Compliance Timeline
| Requirement | Deadline |
|---|---|
| Registration of existing services | March 2024 |
| Consumer protection updates | June 2024 |
| Data security implementation | September 2024 |
| Full compliance | December 2024 |
Action Items
Financial institutions should take immediate steps to:
- Conduct Gap Analysis - Assess current digital services against POJK 21/2023 requirements
- Prepare Registration Documents - Compile technical specifications, security protocols, and consumer protection measures
- Update Terms and Conditions - Revise digital service agreements to comply with disclosure requirements
- Enhance Security Measures - Implement required authentication and encryption standards
- Train Staff - Ensure relevant teams understand new compliance obligations
OJK Supervision
Non-compliance may result in administrative sanctions including written warnings, fines, suspension of digital services, or revocation of business licenses.
This alert is for general information purposes. For specific compliance guidance, please contact Towy Aryanosa at towy.aryanosa@b-av.co.