Fintech in Indonesia 2024

Fintech in Indonesia 2024

FINTECH 2024

INDONESIA

Winnie Yamashita Rolindrawan, Ruth M Ginting, Farrah Azizah Habibie

(SSEK Law Firm)

FINTECH LANDSCAPE AND INITIATIVES

General innovation climate

1. What is the general state of fintech innovation in your jurisdiction?

The use of and demand for financial technology and digital financial products in Indonesia continues to increase, with no signs of slowing. While many potential new players are considering or are in the process of entering the Indonesian market, with payment systems, digital banking, peer-to-peer lending and cryptocurrency trading areas of particular interest, we also see a growing trend of companies exploring the development of new digital finance solutions and services, including fintech software-as-a-service solutions.

The Indonesian government continues to find ways to accelerate and advance financial inclusion in Indonesia and has responded to the continued development and growth of financial technology in Indonesia by updating the regulatory framework for the sector, as the authorities seek to keep pace with fintech business players. On 12 January 2023, the Indonesian government enacted Law No. 4 of 2023 regarding the Development and Strengthening of the Financial Sector (the P2SK Law), which further strengthens the government’s efforts to facilitate and regulate the development of the fintech sector in Indonesia. Under the P2SK Law, Indonesia’s central bank, Bank Indonesia (BI), and the Financial Services Authority (OJK) are required to coordinate in regulating, supervising, and implementing technology innovations in the financial sector, including sandbox mechanisms.

Government and regulatory support

2. Do government bodies or regulators provide any support specific to financial innovation? If so, what are the key benefits of such support?

The Indonesian government, the Indonesian central bank, the BI and the OJK are the main authorities regulating the fintech sector and have remained committed to supporting financial innovation in Indonesia with the hope of strengthening the national digital economy. To achieve this, the authorities have taken steps to provide a more accommodating regulatory framework to stimulate financial innovation. An example of this is the recently introduced sandbox provisions in the P2SK Law, which designate the OJK and the BI as the relevant authorities tasked with keeping pace with financial innovation.

In addition to its efforts to accommodate financial innovation by updating the regulatory framework, the Indonesian government regularly organizes networking events for fintech players, the government, as the regulatory authority, investors, financial institutions and other stakeholders, both national and international. This includes the annual Indonesian Fintech Summit held every year since 2019, organized by the BI, the OJK and several nationwide fintech associations recognized by the Indonesian government. This summit brings together stakeholders to discuss recent developments and regulatory changes, and to strategize ways to expedite the digitalization of the financial services industry and push economic growth.

The Indonesian government is also attempting to balance support for fintech development and innovation with the protection of Indonesian consumers and the public, as evidenced by the recent issuance of the P2SK Law.

FINANCIAL REGULATION

Regulatory bodies

3. Which bodies regulate the provision of fintech products and services?

Fintech products and services in Indonesia are regulated mainly by two government bodies, the BI and the Financial Services Authority (OJK). The BI’s authority is primarily geared toward payment system operators, while the OJK oversees bank and non-bank financial institutions. In the case of certain entities such as banks, both the OJK and the BI have jurisdiction, over regulating their products and services. Specifically, fintech products relevant to payment systems come under the oversight of the BI.

Regulated activities

4. Which activities trigger a licensing requirement in your jurisdiction?

In general, all parties that conduct business activities in Indonesia are subject to licensing and registration requirements under the authority of the Ministry of Investment and the Indonesian Investment Coordinating Board. For businesses in the financial sector, there are additional specific licensing requirements under the authority of the BI or the OJK.

For business activities that fall under the authority of the BI, such as payment systems, whether licensing requirements are triggered depends on the scope of business activities in which a company engages. For example, business actors in the payment system sector engaged only in pre-transaction or post-transaction steps (namely, activities outside the authorization, clearing and final settlement stages) will be deemed as supporting providers, which would not trigger any licensing requirement from the BI. The same applies to business activities that fall under the authority of the OJK and whether they will trigger a licensing requirement.

Innovations within the fintech sector in Indonesia are subject to licensing requirements. Prior to the enactment of Law No. 4 of 2023 regarding the Development and Strengthening of the Financial Sector (the P2SK Law), these were solely regulated under OJK Regulation No. 13/POJK.02/2018, dated 16 August 2018, concerning Digital Financial Innovation in the Financial Services Sector (OJK Regulation 13). Activities considered as digital financial innovation under OJK Regulation 13 include transaction settlement, capital raising via equity crowdfunding and smart contracts, advanced algorithm-driven investment management, fundraising and fund disbursement activities like peer-to-peer lending, insurance provisions facilitated by the sharing economy and digital distribution, market support via artificial intelligence and big data, digital finance activities such as Islamic digital financing and robo-advisers, and other financial services like invoice trading and blockchain-based applications.

The P2SK Law broadens the scope of technology innovation and introduces the concept of the Technology Innovation in the Financial Sector (ITSK) cluster. In contrast to digital financial innovations, which were solely under the OJK’s supervision, the ITSK falls under the jurisdiction of both the OJK and the BI, whose supervision shall depend on the specific activities. This spectrum of activities includes payment systems, securities transaction settlement, capital raising, investment management, risk management, fund collection and (or) disbursement, market support, activities involving digital financial assets including cryptocurrencies, and other digital financial services.

Foreign organizers of trade through an electronic system (PPMSEs), which is any business practitioner that provides electronic communication facilities used in trade transactions and operates from outside Indonesia and fulfills certain criteria, shall be required to appoint a representative in Indonesia and consequently must have a foreign trade company representative office in the country.

Consumer lending

5. Is consumer lending regulated in your jurisdiction?

Consumer lending is regulated in Indonesia, with a particular focus on IT-based money lending services (peer-to-peer lending), as regulated under OJK Regulation No. 10/POJK.05/2022 regarding Information Technology-Based Co-Financing Services, dated 29 June 2022 (OJK Regulation 10/2022). This regulation requires providers of IT-based co-financing services to be a limited liability company and meet certain prerequisites.

The OJK has the authority to regulate, register and issue licenses, as well as supervise the fintech consumer lending industry. Pursuant to this regulation, a company engaging in the provision of peer-to-peer lending activities can have a maximum foreign ownership of 85 percent, which means at least 15 percent of the ownership must be in the hands of Indonesian parties.

Further, the provider must have at least 25 billion rupiahs (approximately US$1.7 million at current exchange rates) in issued capital during its establishment. The issued capital must be fully paid and placed in a time deposit (deposit berjangka). Providers must also have a minimum equity of 12.5 billion rupiahs (approximately US$850,000 at current exchange rates) at all times. The fulfillment of this minimum equity requirement can be done gradually, as follows:

• at least 2.5 billion rupiahs for one year as of the promulgation of OJK Regulation 10/2022;
• at least 7.5 billion rupiahs for two years as of the promulgation of OJK Regulation 10/2022; and
• at least 12.5 billion rupiahs beginning three years from the promulgation of OJK Regulation 10/2022.

Peer-to-peer providers shall directly apply to the OJK for a license. The OJK further requires providers to obtain an Electronic System Provider Certificate (ESP Registration Certificate) issued by the Ministry of Communication and Informatics, in addition to the license issued by the OJK. Providers are restricted from conducting any funding activity before obtaining an ESP Registration Certificate. Within 30 calendar days after obtaining a TDPSE, providers must begin funding activity. Failure to obtain a TDPSE or to conduct funding within the given timeline will result in the OJK canceling the provider’s existing license.

Secondary market loan trading

6. Are there restrictions on trading loans in the secondary market in your jurisdiction?

Currently, the trading of loans in the secondary market in Indonesia is not specifically regulated and there is no specific restriction on this activity.

Collective investment schemes

7. Describe the regulatory regime for collective investment schemes and whether fintech companies providing alternative finance products or services would fall within its scope.

Under Indonesian law, two types of collective investment schemes are recognized: Collective Investment Contracts (CIC) and Joint Investment Contracts (JIC). A CIC is a contract in which an investment manager and a custodian bank jointly bind investors. In this arrangement, the investment manager is authorized to manage the collective investment portfolio, while the custodian bank is responsible for implementing collective custody. This is often structured as a mutual fund.

A JIC is managed by a venture capital company with the approval of the OJK, even though a JIC is not considered a legal entity in Indonesia. However, entities established through venture fund JICs are deemed as legal entities.

It is important to note that alternative finance products or services, such as peer-to-peer lending, do not fall within the purview of these regulations. They are instead subject to their own specific regulations.

Alternative investment funds

8. Are managers of alternative investment funds regulated?

In general, investment managers are regulated by the OJK, pursuant to OJK Regulation No. 24/POJK.04/2014 regarding Implementation Guidelines for the Functions of Investment Managers, dated 19 November 2014. The roles of investment managers are also regulated under the following regulations:

• OJK Regulation No. 34/POJK.05/2015 regarding Business Licensing and Institutional Matters of Venture Capital Companies, dated 28 December 2015 (OJK Regulation 34/2015); and
• OJK Regulation No. 23/POJK.04/2016 regarding Mutual Funds in the Form of Investment Collective Contracts, dated 19 June 2016, as amended by OJK Regulation No. 4/POJK.04/2023, dated 31 March 2023 (OJK Regulation 23/2016).

Peer-to-peer and marketplace lending

9. Describe any specific regulation of peer-to-peer or marketplace lending in your jurisdiction.

While marketplace lending is not specifically regulated in Indonesia, peer-to-peer lending is. The activity of peer-to-peer lending is specifically regulated under OJK Regulation No. 10/POJK.05/2022 regarding Information Technology-Based Co-Financing Services, dated 4 July 2022. It provides the OJK with the right to regulate and supervise peer-to-peer lending activities, including handling the registration and licensing of peer-to-peer lending platform providers. Peer-to-peer lending in Indonesia is described as the provision of financial services, whereby the lender meets the borrower in conducting conventional funding or based on shariah principles directly through an electronic system using the internet.

Shareholders in peer-to-peer lending companies can be Indonesian individuals or legal entities or a combination of Indonesian and foreign individuals or legal entities. The funding limit is set at 2 billion rupiahs (approximately US$135,000 at current exchange rates) for both the funding receiver and provider. Members of the board and officials must have competency certification issued by a professional certification institution in the financial technology sector. Foreign board members must obtain Bahasa Indonesia certification within one year of approval. Primary parties, including controlling shareholders, board members and commissioners, must pass a fit-and-proper test before taking any actions. Additional requirements for peer-to-peer Providers include electronic system requirements, risk management and internal audit obligations, and controlling shareholder requirements.

Crowdfunding

10. Describe any specific regulation of crowdfunding in your jurisdiction.

Equity crowdfunding covers the provision of share-offering services conducted by issuers to sell shares directly to investors through an open electronic system network. Equity crowdfunding is regulated under OJK Regulation No. 57/POJK.04/2020 regarding Securities Offerings Through Information Technology-Based Crowdfunding Services, dated 11 December 2020, as amended by OJK Regulation No. 16/POJK.04/2021, dated 26 August 2021. Under this regulation, a licensed equity crowdfunding platform provider or organizer is able to provide issuers (Indonesian limited liability companies) access to sell their shares to investors that are also using the platform. An equity crowdfunding platform company is required to be an Indonesian limited liability company or an Indonesian cooperative and have registered with and received a license from the OJK to provide, manage and operate the equity crowdfunding platform.

Invoice trading

11. Describe any specific regulation of invoice trading in your jurisdiction.

The prevailing regulations do not specifically address invoice trading in Indonesia.

Payment services

12. Are payment services regulated in your jurisdiction?

Payment services in Indonesia are regulated mainly by Indonesia’s central bank, the BI, which is in charge of regulating payment system activities in Indonesia. Following the issuance of BI Regulation No. 22/23/PBI/2020 regarding Payment Systems (BI Regulation 22/23), dated 30 December 2020, the BI issued several additional regulations that contain more specific and robust provisions with respect to payment system providers (PSPs) and payment system infrastructure providers (PSIPs). These additional regulations are BI Regulation No. 23/6/PBI/2021 regarding Payment System Providers, dated 1 July 2021 (BI Regulation 23/6), and BI Regulation No. 23/7/PBI/2021 regarding Payment System Infrastructure Providers, dated 1 July 2021 (BI Regulation 23/7). PSPs are open to 85 percent foreign share ownership (with a maximum of 49 percent of shares with voting rights held by foreign shareholders), while PSIPs are open to 20 percent foreign share ownership (with a 20 percent maximum of shares with voting rights held by foreign shareholders).

Open banking

13. Are there any laws or regulations introduced to promote competition that require financial institutions to make customer or product data available to third parties?

In response to the evolving open banking activities within the payment system sector, the BI enacted Members of the BI Board of Governors Regulation No. 23/15/PADG/2021, which parties were required to comply with by 31 December 2022 at the latest. This regulation introduced the National Standard for Open Application Programming Interface (API) Payment, also known as the SNAP policy. The SNAP policy outlines a standardized approach to Open API Payment, aiming to ensure its effective and efficient operation.

One of the key objectives of the SNAP policy is to provide clarity regarding its scope and application, as well as to delineate the roles and responsibilities of various parties involved in the administration of Open API Payment connectivity.

The SNAP policy also aims to ensure a level playing field among different payment service providers, including both banks and non-bank institutions, as well as other parties that collaborate in Open API Payment connectivity. This is aligned with broader efforts to foster a cohesive and integrated Open API Payment ecosystem.

Robo-advice

14. Describe any specific regulation of robo-advisers or other companies that provide retail customers with automated access to investment products in your jurisdiction.

Robo-advisory services are mentioned in both OJK Regulation 13 and the P2SK Law as part of digital financial innovation and technological innovation in the financial sector that is considered other digital finance supporting activities. Thus, the use of robo-advisory services in financial products is allowed, subject to the limitations provided in OJK Regulation 13 and the P2SK Law, as well as any regulation specific to the financial product being offered.

Further, the Commodity Futures Trading Supervisory Body (Bappebti), under the Ministry of Trade, has issued Bappebti Regulation No. 12 of 2022 regarding the Organization of the Submission of Information Technology-Based Advice in the Form of an Expert Advisor in the Field of Commodity Futures Trading, dated 2 September 2022 (Bappebti Regulation 12/2022), which regulates IT-based advice in the form of an expert adviser. IT-based advice is defined as an IT-based tool that is structured based on algorithms that are implanted in the lines of its computer program, which are determined based on the characteristics, types, needs, and expectations of a client. This IT-based advice is capable of working automatically to conduct market monitoring, calculation of market entry or exit opportunities, placing reasonable transactions, and risk management by taking into account the needs of each client. IT-based advice may only be provided by futures advisers who have obtained approval from Bappebti and may only be in the form of information and (or) recommendations regarding the sale and purchase of commodities based on futures contracts, shariah derivative contracts, and (or) other derivative contracts.

Insurance products

15. Do fintech companies that sell or market insurance products in your jurisdiction need to be regulated?

The selling and marketing of insurance products in Indonesia by both insurance companies and fintech companies is regulated and licensed by the OJK. In practice, licensed insurance companies in Indonesia have been selling their products over the internet, through their own platforms or by cooperating with other parties (eg, e-commerce platforms or e-money platforms) to assist in facilitating the selling and marketing of their insurance products. However, it is important to note that fintech companies involved in the selling or marketing of insurance products face certain limitations, as specific rights are exclusively reserved for insurance companies.

Credit references

16. Are there any restrictions on providing credit references or credit information services in your jurisdiction?

There are restrictions on providing credit information services. In Indonesia, credit reports can only be issued by a credit bureau licensed by the OJK. A credit report is defined under OJK Regulation 5/POJK.03/2022 regarding Credit Information Management Agencies, dated 28 March 2022, and OJK Circular Letter No. 27/SEOJK.03/2022 of 2022regarding Credit Information Management Agencies, dated December 22, 2022 (together, the Credit Bureau Regulation), as a product or service generated by a credit bureau in writing, verbally or by some other method, sourced from credit data and other data owned by the credit bureau. A credit report generated by a credit bureau, among other things, contains information on:

• statistics for planning, business development and determining policies;
• information to measure the performance and supervise the risk profile of the debtor or customer;
• the ability of the debtor or customer to fulfil its fund provision obligations;
• the character of the debtor or customer; and
• other information that may be utilized to assess the abilities of the debtor or customer.

Pursuant to the Credit Bureau Regulation, a credit bureau engages in the business activities of collecting credit data and other data, and processing credit data and other data to generate credit information.

The Credit Bureau Regulation also specifically mentions that a credit bureau must be in the form of an Indonesian limited liability company and is subject to applicable foreign shareholding restrictions. In addition, a credit bureau must obtain a business license from the OJK to conduct its business activities. While the total ownership of one or more foreign parties in a credit bureau is limited to 20 percent, if one foreign party owns more than one credit bureau that foreign party’s total ownership in all the credit bureaus combined is limited to 20 percent.

In collecting and processing credit information, a licensed Indonesian credit bureau obtains credit data from the OJK. The credit data from the OJK consists of data submitted to it by financial institutions. A licensed Indonesian credit bureau may also cooperate with financial institutions to obtain credit data or with financial institutions and non-financial institutions for other data or both. A credit bureau must make an effort to ensure that the source of the data informs the relevant debtor or customer of how the credit data and other data will be utilized. Credit data is defined as data regarding the condition of the funding facility of the debtor or the customer.

Other data in relation to a credit bureau is defined as data other than credit data that can be used to describe the capability of a certain party in fulfilling the party’s financial obligations including the behavioral patterns of the debtor or customer.

In addition to traditional credit bureau scores, Indonesian law also regulates alternative credit scoring mechanisms, which fall under the scope of digital technology innovation under the supervision of the OJK. However, there are restrictions on the type of data that can be used to generate such credit scores. Obtaining a license from the OJK is a prerequisite to operate in this cluster.

CROSS-BORDER REGULATION

Passporting

17. Can regulated activities be passported into your jurisdiction?

The prevailing laws and regulations in Indonesia do not recognize the concept of passporting, and regulated activities cannot be passported into Indonesia.

Requirement for a local presence

18. Can fintech companies obtain a license to provide financial services in your jurisdiction without establishing a local presence?

In general, to obtain a license from the Indonesian government to provide financial services in Indonesia, a party must establish a local presence.

SALES AND MARKETING

Restrictions

19. What restrictions apply to the sales and marketing of financial services and products in your jurisdiction?

All activities with respect to the sale and marketing of financial services and products in Indonesia must be conducted by licensed entities. Further, generally, the people providing financial services to the public must meet certain competency standards, as evidenced by the obtainment of certification from a registered certification institution approved by the Financial Services Authority. The sectors that require competency certification include capital markets and banking.

Additionally, there are regulations for the sale and marketing of financial services and products in the traditional sense, such as conventional banking, investment and insurance. There is far less clarity regarding the organization of the sale and marketing of unconventional financial services, for example, investments related to cryptocurrency and initial coin offerings. The main principle of sales and marketing by financial and fintech businesses is a prohibition on misleading information and causing a loss for consumers.

CRYPTOASSETS AND TOKENS

Distributed ledger technology

20. Are there rules or regulations governing the use of distributed ledger technology or blockchains?

While there is no specific rule or regulation for blockchain or distributed ledger technology in Indonesia, it is referred to in regulations issued by the BI, the Financial Services Authority (OJK) and the Commodity Futures Trading Supervisory Body (Bappebti), which aim to support innovative industry players in the financial services and payment systems fields.

Blockchain technology is mentioned in BI Regulation 23/6, which provides that the use of blockchain technology or distributed ledger technology for fund transfers, electronic money, electronic wallets or mobile payments is considered as providing financial technology in the payment system sector. It is also mentioned in OJK Regulation 13 as an example of digital financial innovation related to other financial services activities, such as invoice trading, vouchers and tokens. Further, Bappebti Regulation No. 8 of 2021 regarding Guidelines for Organizing Crypto Asset Physical Trading Market on the Futures Exchange, as amended by Bappebti Regulation No. 13 of 2022, dated 9 November 2022 (together, Bappebti Regulation 8/2021), also mentions distributed ledgers in its description of cryptoassets.

Cryptoassets

21. Are there rules or regulations governing the promotion or use of cryptoassets, including digital currencies, stablecoins, utility tokens and non-fungible tokens (NFTs)?

The crypto industry in Indonesia falls under the auspices of Bappebti, under the Ministry of Trade (MOT) and in coordination with other institutions such as the OJK, the BI and the Ministry of Communication and Informatics. The MOT has acknowledged cryptoassets, including but not limited to digital coins (virtual currency or cryptocurrency), as tradable commodities for which Bappebti acts as the regulator and supervisor. Nevertheless, through the enactment of Law No. 4 of 2023 regarding the Development and Strengthening of the Financial Sector (the P2SK Law), the authority over cryptoassets shall be transferred from Bappebti to the OJK.

As regulated under Bappebti Regulation No. 8 of 2021 regarding Guidelines for Organizing Crypto Asset Physical Trading Market on the Futures Exchange, as amended by Bappebti Regulation No. 13 of 2022, dated 9 November 2022 (together, Bappebti Regulation 8/2021), the trade of cryptoassets shall be facilitated by crypto asset physical traders (crypto exchanges).

Bappebti Regulation 8/2021 defines cryptoassets as intangible commodities in digital form, using cryptography, IT networks and distributed ledgers to regulate the creation of new units, verify transactions and secure transactions without the intervention of other parties. In essence, cryptoassets may be traded if they have been approved by the head of Bappebti.

Applicable laws and regulations do not explicitly distinguish between security tokens, utility tokens, stablecoins and deposit coins, and the forgoing assets are generally treated the same as cryptoassets. The Indonesian government is also yet to issue a specific regulation regarding NFTs.

Token issuance

22. Are there rules or regulations governing the issuance of tokens, including security token offerings (STOs), initial coin offerings (ICOs) and other token generation events?

Currently, there are no specific laws or regulations surrounding STOs, ICOs and other token generation events. It is noteworthy that Bappebti has explicitly clarified that the current regulations concerning cryptocurrency do not encompass ICOs or initial token offerings.

According to Bappebti Regulation No. 11 of 2022 regarding the Determination of the List of Tradable Crypto Assets within the Crypto Asset Physical Market, as of August 8, 2022, cryptoassets (including tokens) can only be traded if they are listed in Bappebti Regulation 11/2022. Crypto exchanges wishing to list a cryptoasset can submit a proposal for its inclusion through the Crypto Asset Futures Exchange or Futures Exchange. The Futures Exchange and the Crypto Asset Committee will then assess the proposal before submitting a recommendation to Bappebti.

If, however, the Futures Exchange and the Crypto Asset Committee have not yet been established (which is currently the case), the proposal’s assessment and evaluation can be handled by the Crypto Asset List Assessment Team. This team is composed of representatives of Bappebti, crypto asset trading associations and registered business actors in the cryptoasset physical market.

In practice, it is not unusual for licensed crypto exchanges to trade cryptoassets that are not listed in Bappebti Regulation 11/2022, even though doing so may expose them to potential administrative sanctions from Bappebti.

ARTIFICIAL INTELLIGENCE

Artificial intelligence

23. Are there rules or regulations governing the use of artificial intelligence, including in relation to robo-advice?

Presently, there is no specific law or regulation that addresses the use of artificial intelligence (AI), including robo-advice. However, AI and robo-advice are mentioned in Financial Services Authority (OJK) Regulation 13 and Law No. 4 of 2023 regarding the Development and Strengthening of the Financial Sector (the P2SK Law) as part of digital financial innovation and technological innovation in the financial sector that is considered a market support activity and other digital finance supporting activities. This includes machine-readable news, social sentiment, big data, market information platforms and automated data collection and analysis. Thus, the use of artificial intelligence in financial products is allowed, subject to the limitations provided in OJK Regulation 13 and the P2SK Law, as well as any regulation specific to the financial product being offered.

CHANGE OF CONTROL

Notification and consent

24. Describe any rules relating to notification or consent requirements if a regulated business changes control.

The rules relating to notification or consent requirements in a change of control depend on the business activities and the specific license held by the entity. As a matter of general principle, entities holding a license in the financial services sector and the payment system services sector typically need to obtain prior approval from the central bank, the BI or the Financial Services Authority (OJK) if a change of control occurs. There are certain sectors that only require the submission of a notification and not approval. Additionally, change of control in all financial sectors shall also be notified to the Ministry of Law and Human Rights.

FINANCIAL CRIME

Anti-bribery and anti-money laundering procedures

25. Are fintech companies required by law or regulation to have procedures to combat bribery or money laundering?

In general, fintech companies are required to implement anti-money laundering (AML) procedures and need to conform to anti-bribery regulations in Indonesia. For example, players in the cryptocurrency sector in Indonesia, including cryptocurrency traders and futures exchanges, are required to have in place AML procedures and prevention of terrorism funding and proliferation of mass destruction weapons guidelines, pursuant to Commodity Futures Trading Supervisory Body (Bappebti) Regulation No. 8 of 2021 regarding Guidelines for Organizing Crypto Asset Physical Trading Market on the Futures Exchange, dated 29 October 2021, as amended by Bappebti Regulation No. 13 of 2022 dated 9 November 2022 (Bappebti Regulation 8/2021).

Guidance

26. Is there regulatory or industry anti-financial crime guidance for fintech companies?

Currently, there is no extensive regulatory or industry-wide anti-financial crime guidance aimed specifically at fintech companies. However, both the BI and the Financial Services Authority (OJK) have issued certain regulations applicable to financial sectors, including the financial service sector and payment system sector. These regulations cover the prevention of money laundering and terrorism financing. For the OJK, these issues are governed by OJK Regulation No. 12/POJK.01/2017, issued on 21 March 2017, and subsequently amended by OJK Regulation No. 23/POJK.01/2019, dated 30 September 2019. For the BI, they are regulated under BI Regulation Number 19/10/PBI/2017, which pertains to the Implementation of Anti-Money Laundering and Terrorism Financing Prevention for Non-Bank Payment System Service Providers and Non-Bank Foreign Exchange Business Activities, dated 11 September 2017.

DATA PROTECTION AND CYBERSECURITY

Data protection

27. What rules and regulations govern the processing and transfer (domestic and cross-border) of data relating to fintech products and services?

The main laws and regulations relevant to personal data protection and transfers are:

• Law No. 27 of 2022 regarding Data Protection (Indonesian PDP Law);
• Law No. 11 of 2008 regarding Electronic Information and Transactions, dated 21 April 2008, as amended by Law No. 19 of 2016, dated 25 November 2016;
• Government Regulation No. 71 of 2019 regarding the Provision of Electronic Systems and Transactions, dated 10 October 2019; and
• Ministry of Communication and Informatics Regulation No. 20 of 2016 regarding Personal Data Protection in Electronic Systems, dated 1 December 2016.

The Indonesian PDP Law permits domestic data transfers while imposing specific requirements for cross-border data transfers. Specifically, the receiving country must have a level of data protection that is either equivalent to or greater than that of Indonesia. If these conditions are not met, the data subject must provide explicit consent for the cross-border data transfer.

Cybersecurity

28. What cybersecurity regulations or standards apply to fintech businesses?

There are, to date, no specific cybersecurity regulations or standards applicable across the fintech sector in Indonesia. Different sectors may also have different cybersecurity requirements and standards for their respective business activities. However, the National Cyber and Encryption Agency (BSSN) has set out general regulations or standards for information security management, which includes cybersecurity under BSSN Regulation No. 8 of 2020 on Security Systems in the Operation of Electronic Systems, dated 14 July 2020. Fintech companies may be subject to the provisions of this regulation if they use an electronic system in the operation of their business. Under this regulation, certain security standards must be implemented by the electronic system operator, including SNI ISO/IEC 27001 and other cybersecurity standards required by the BSSN or other ministries or institutions.

OUTSOURCING AND CLOUD COMPUTING

Outsourcing

29. Are there legal requirements or regulatory guidance with respect to the outsourcing by a financial services company of a material aspect of its business?

There is no specific legal requirement or regulatory guidance with respect to the outsourcing by a financial services company of a material aspect of its business. However, different sectors may have different outsourcing requirements and standards for their respective business activities.

Cloud computing

30. Are there legal requirements or regulatory guidance with respect to the use of cloud computing in the financial services industry?

There are no specific legal requirements or regulatory guidance with respect to the use of cloud computing in the financial services industry. However, cloud computing is generally regulated under Ministry of Communication and Informatics (MOCI) Regulation No. 5 of 2020 regarding Electronic System Providers in the Private Sector, dated 24 November 2020, as amended by MOCI Regulation No. 10 of 2021, dated 21 May 2021.

INTELLECTUAL PROPERTY RIGHTS

IP protection for software

31. Which intellectual property rights are available to protect software, and how do you obtain those rights?

Under Indonesian laws and regulations on intellectual property rights, a computer program, which, consequently, includes software, is regulated under Law No. 28 of 2014 regarding Copyrights, dated 16 October 2014. Copyright protection for computer programs is automatically provided by this law, without requiring the registration of the computer program.

IP developed by employees and contractors

32. Who owns new intellectual property developed by an employee during the course of employment? Do the same rules apply to new intellectual property developed by contractors or consultants?

In principle, the IP rights will remain with the creators, which in this instance is the employee or contractor or consultant, unless stated otherwise in an agreement. To avoid any uncertainty, it is common practice in Indonesia for employers to include a clause in employment agreements with employees or contractors or consultants that clearly states that the IP rights of any creation will be solely owned by the employer.

Joint ownership

33. Are there any restrictions on a joint owner of intellectual property’s right to use, license, charge or assign its right in intellectual property?

There is no such restriction under Indonesian law.

Trade secrets

34. How are trade secrets protected? Are trade secrets kept confidential during court proceedings?

Law No. 30 of 2000, issued on 20 December 2000 (the Trade Secret Law), provides a very generic approach to the definition of a trade secret. A trade secret is defined as information that is not publicly known in the fields of technology or business, with an economic value owing to its usefulness in a business activity, and whose confidentiality is kept by the owner of the trade secret. The Trade Secret Law indicates that trade secrets are inherently protected without needing to undergo a specific procedure. Holders of trade secrets may bring a claim for compensation and a cease-and-desist action. Court proceedings involving trade secrets may be held confidentially upon the request of a party in the case.

Branding

35. What intellectual property rights are available to protect branding and how do you obtain those rights? How can fintech businesses ensure they do not infringe existing brands?

Under Law No. 20 of 2016 regarding Marks and Geographical Indications, dated 25 November 2016, as amended by Government Regulation in Lieu of Law No. 2 of 2022, dated 30 December 2022, a brand (mark) is protected once it is registered with the relevant government IP office in Indonesia. As a precautionary action, a fintech business can check with the government IP office to see if there are similar brands or trademarks already registered in Indonesia. It can also conduct market monitoring of known brands in its industry in Indonesia.

Remedies for infringement of IP

36. What remedies are available to individuals or companies whose intellectual property rights have been infringed?

Individuals or companies whose intellectual property rights have been infringed may bring claims to the counterparty for compensation and a cease-and-desist action. These claims can go through commercial court, arbitration, or alternative dispute settlement.

COMPETITION 

Sector-specific issues

37. Are there any specific competition issues that exist with respect to fintech companies in your jurisdiction?

To date, the prevailing regulations do not address competition issues particular to fintech companies. We have not identified any specific competition issues in the fintech industry.

TAX

Incentives

38. Are there any tax incentives available for fintech companies and investors to encourage innovation and investment in the fintech sector in your jurisdiction?

There are tax incentives available for certain fintech companies under Law No. 4 of 2023 regarding the Development and Strengthening of the Financial Sector (the P2SK Law), which is part of the government’s efforts to develop and strengthen the financial sector. The government may provide tax incentives for specific financial services and programs in accordance with tax regulations. Additionally, companies conducting business in a pioneer industry may receive tax facilities, such as a reduction in corporate income tax.

Increased tax burden

39. Are there any new or proposed tax laws or guidance that could significantly increase tax or administrative costs for fintech companies in your jurisdiction?

The Indonesian Minister of Finance (MOF) recently issued a regulation on income tax and value added tax (VAT) specifically for fintech businesses, namely, MOF Regulation No. 69/PMK.03/2022 regarding Income Tax and Value Added Tax for the Implementation of Financial Technology, dated 1 May 2022. For example, the income generated from a peer-to-peer lending business shall be subject to VAT and income tax. However, VAT collection is exempted for certain fund transfer transactions. The VAT rate for sectors subject to VAT collection is generally 11 percent.

The MOF also issued a regulation to impose income tax and VAT on cryptocurrency trade transactions, namely, MOF Regulation No. 68/PMK.03/2022 regarding Value Added Tax and Income Tax on Crypto Asset Trade Transactions, dated 1 May 2022. VAT in the amount of 0.1 percent will be imposed if the crypto trader is registered as a trader through electronic systems provider (PPMSE), or 0.2 percent if the PPMSE is not yet registered.

To qualify as a PPMSE VAT collector, a party must have a transaction value with Indonesian purchasers that exceeds a certain threshold within 12 months, a traffic volume or a number of persons who accessed the party’s platform that exceeds a certain threshold within 12 months, or both. These thresholds will be further set out by the Directorate of General Taxation. Indonesian government officials have been quoted in various media reports saying that they are targeting providers such as Netflix and Spotify that operate outside of Indonesia with a significant number of users in the country.

IMMIGRATION

Sector-specific schemes

40. What immigration schemes are available for fintech businesses to recruit skilled staff from abroad? Are there any special regimes specific to the technology or financial sectors?

There is no specific immigration scheme for fintech businesses, so the general immigration scheme is applicable. An Indonesian entity must act as the sponsor for any foreign national who will work in Indonesia, and foreign workers can only fill positions that are allowed for foreigners, as set out by the Ministry of Manpower.

UPDATE AND TRENDS IN FINTECH IN INDONESIA

Current developments

41. Are there any other current developments or emerging trends to note?

The enactment of Law No. 4 of 2023 regarding the Development and Strengthening of the Financial Sector (the P2SK Law) signifies a forthcoming shift in regulatory authority over several fintech-related sectors to either the Financial Services Authority or the Indonesian Central Bank (BI), with this shift expected to occur within the next two years. Further details regarding this transition will be addressed in a future government regulation that is currently pending.

The Indonesian government has additionally launched the central bank digital currency rupiah (digital rupiah), via the P2SK Law. The digital rupiah is officially accepted as a form of currency in Indonesia, on par with physical banknotes and coins. Despite the presently limited regulations concerning the digital rupiah, the BI’s vision for its implementation is detailed in the Project Garuda White Book. This document offers a roadmap for the utilization of digital rupiah in Indonesia, outlining the progressive stages of its application.

The issuance of the P2SK Law suggests that Indonesia is embracing technological progress while maintaining a prudent approach toward the integration of technology into the nation’s routine operations and activities.

* The information in this chapter was accurate as of June 2023.

If you need more consulting, please Contact Us at TNHH NT International Law Firm (ntpartnerlawfirm.com)

You can also download the .docx version here.

“The article’s content refers to the regulations that were applicable at the time of its creation and is intended solely for reference purposes. To obtain accurate information, it is advisable to seek the guidance of a consulting lawyer.”

LEGAL CONSULTING SERVICES

090.252.4567

HÃY CLICK ĐỂ LẠI SĐT CHÚNG TÔI SẼ GỌI NGAY CHO BẠN MIỄN PHÍ

NT INTERNATIONAL LAW FIRM

• Email: info@ntpartnerlawfirm.com – luatsu.toannguyen@gmail.com
• Phone: 090 252 4567
• Address: B23 Nam Long Residential Area, Phu Thuan Ward, District 7, Ho Chi Minh City, Vietnam