Fintech

Fintech innovation in Indonesia is generally growing positively. This can be seen from the increasing number of registered and licensed peer-to-peer (P2P) lending operators under the authority of the Financial Services Authority (OJK), as well as fintech companies offering payment services that are licensed by the Central Bank of Indonesia (Bank Indonesia or BI). More recently, there has also been growing interest in the shariah fintech sector to capitalise on the very large Muslim population in Indonesia. Further, to encourage innovations, support the establishment of the financial technology ecosystem, and cover previously unregulated information technology-based services, BI and the OJK have respectively issued regulations that introduced the ‘regulatory sandbox’, which will serve as a testing mechanism to assess the reliability of business processes, business models, financial instruments, and governance.

With high rates of internet penetration and mobile phone usage as well as quite a large unbanked and underbanked population, Indonesia is set to become a hotbed of fintech innovation in South East Asia.

Back to top

Yes, the OJK specifically issued OJK Regulation No. 13/POJK.02/2018 on Digital Financial Innovation in the Financial Services Sector (POJK 13/2018). One of the highlights of this regulation is the existence of a regulatory sandbox that allows innovative fintech companies to test their business models for no longer than one year, extendable for another six months if necessary, without having to abide by certain OJK regulations. In April 2019, PT Avatec Services Indonesia (Avatec) was chosen by the OJK to participate in its regulatory sandbox programme in order to provide credit-scoring solutions. Avatec claims to leverage artificial intelligence and machine-learning technologies to provide digital credit assessment solutions.

Back to top

In Indonesia, there are two bodies that regulate the provision of fintech products and services: the OJK and BI. The OJK regulates provision of fintech products and services other than those related to payment services, while BI regulates all fintech products and services related to payment services.

Back to top

The Indonesian financial services sector is primarily under the authority of both the OJK and BI. The following are the main activities that trigger licensing requirements in Indonesia:

Extending loans

Generally, entities wanting to provide a platform for lending require a licence. Lending (in various forms) is typically carried out by banking institutions, multi-finance companies, venture capital companies and microfinance institutions, subject to different licences from the OJK. Savings and loan cooperatives may also engage in lending under licence from the Ministry of Cooperatives and Small Business Enterprises (MOCSBE). P2P lending companies, which use an off-balance sheet lending system, are regulated by the OJK and are subject to certain registration and licensing requirements.

Deposit-taking

Acceptance of deposits from the public in the form of demand deposits, time deposits, deposit certificates, savings or any other equivalent forms may only be conducted by banking and microfinance institutions licensed by the OJK. Savings and lending cooperatives may also engage in deposit-taking, based on a licence issued by the MOCSBE.

Factoring

Factoring may be carried out by banks and licensed multi-finance companies, with or without recourse. A factoring platform may trigger an OJK licensing requirement.

Payment and transaction processing services

Banks may perform certain fund transfer and payment services. However, non-bank entities may also provide payment and transaction processing services, such as e-money, card-based payment instruments, e-wallet, payment gateways, fund transfer and switching operations, subject to relevant licences from BI.

Dealing in investments or advising on investments (in the framework of financial services)

These activities fall mainly within the scope of capital markets. Securities companies operating as securities underwriters, securities trading brokers, or investment managers are required to hold a licence from the OJK. Individuals representing securities companies must also be licensed by the OJK. Parties that provide advisory services on the sale or purchase of securities must obtain a licence from the OJK as an investment adviser. General investment advisory services, such as financial advisory services for M&A transactions, do not fall under this licensing requirement.

Other financial services by non-bank institutions

Platforms providing other financial services, such as equity crowdfunding, insurance and reinsurance companies and intermediaries, and pension fund institutions, also require specific licences from the OJK.

Back to top

Yes, consumer lending is a regulated activity in Indonesia. Consumer lending can be provided by banking institutions and multi-finance companies and is generally regulated under the prevailing laws and regulations on the relevant sectors.

Back to top

Under Indonesian law, loans are generally transferable unless agreed otherwise by the parties. Notification to, or acknowledgment from, the borrower is required in transferring the loan. However, depending on the structure of the loan being traded, it may fall under the scope of securities subject to Law No. 8 of 1995 on Capital Market (the Capital Market Law) or commercial paper supervised by BI.

Back to top

The Capital Market Law and its implementing regulations recognise several categories of collective investment schemes, such as mutual funds, limited participation collective investments, asset-backed securities, and real estate investment trusts. Companies managing collective investment schemes must hold a licence from the OJK.

P2P lending and equity crowdfunding schemes are not within the scope of the regulatory regime for collective investment schemes, as they are subject to the respective OJK regulations on P2P lending and equity crowdfunding.

Back to top

Yes, investment managers are generally regulated under the Decree of the Head of the Capital Market and Financial Institutions Supervisory Board (Bapepam-LK) No. KEP-479/BL/2009 as amended by Decree KEP-26/BL/2010 on Licensing of Securities Companies Conducting Business as Investment Managers.

A party wishing to operate as an investment manager needs to obtain a business licence from the OJK. Upon issuance of the business licence, the investment manager may carry out the following activities:

• management of securities portfolios for the interest of a particular investor, based on an individual or bilateral fund management agreement;
• management of collective investment portfolios through vehicles or products regulated by the OJK, such as mutual funds, limited participation collective investments, asset-backed securities, and real estate investment trusts; and
• other activities in accordance with provisions set by the OJK.

Back to top

The OJK issued OJK Regulation No. 77/POJK.01/2016 on Information Technology-Based Lending Services (POJK 77/2016), which came into force on 29 December 2016. Parties wanting to offer P2P lending services must be in the form of a limited liability company (PT) or a cooperative. Foreign shareholders can only hold shares in operators formed as a PT, with direct or indirect foreign shareholding limited to 85 per cent. The operator must register with the OJK and apply for a licence within one year after being registered. At the time of registration, the minimum capital requirement (issued and paid-up capital for PTs, or owner’s equity for cooperatives) for an operator shall be 1 billion rupiah, which must be increased to 2.5 billion rupiah by the time of the licence application.

In offering P2P lending services, operators are prohibited from:

• conducting any activities other than P2P lending services as governed in POJK 77/2016;
• acting as a lender or borrower in their P2P lending platform;
• giving any forms of assurance;
• issuing bonds;
• giving recommendations (eg, recommending certain loans, investments or investors);
• publicising false information;
• giving offers through personal communication without the consent of the user; and
• imposing any fees on users for complaints.

In P2P lending, the borrower must be an Indonesian individual or legal entity, while the lender may be domestic or domiciled abroad.

P2P lending is off balance sheet, meaning that an operator may only provide an online platform that matches and passes third-party lenders to potential borrowers.

In addition to POJK 77/2016, the Indonesia Fintech Lending Association (AFPI) has issued a Code of Conduct in which P2P lending companies are, among other matters, prohibited from imposing interest higher than 0.8 per cent per day and from imposing total fees, late fees and other fees that are higher than 100 per cent of the principal amount of loan as well as misusing consumers’ data for debt collection purposes.

Back to top

OJK Regulation No. 37/POJK.04/2018 dated 31 December 2018 on Information Technology-Based Crowdfunding Services Via Public Offerings (Equity Crowdfunding) defines equity crowdfunding as a share-issue service that is conducted by issuers to sell shares directly to investors via an open electronic system network.

In principle, there are three parties involved in an equity crowdfunding scheme: the issuer, the operator and the investor. An issuer shall be a limited liability company issuing shares via an operator. An issuer shall not be under either direct or indirect control of a business group or conglomerate, a publicly listed company, or a subsidiary of a publicly listed company, and shall not have assets of more than 10 billion rupiah, not including land and building. However, the OJK may have discretion with regard to the requirements to qualify as an issuer.

An operator is a legal entity (either a limited liability company or a service cooperative) that provides, manages and operates equity crowdfunding. In order for an operator to obtain a business licence from the OJK, an operator must fulfil, among other matters, a minimum paid-up capital of at least 2.5 billion rupiah and have sufficient personnel who have capability or background in information technology as well as the expertise to conduct a review on the operator. An operator shall refrain from doing the following:

• performing business activities other than those stipulated in OJK Regulation 37/2018 except for activities as underwriters, broker-dealers or investment managers if such operators are securities companies, and licensed and registered operators of information-technology-based services;
• providing any financial assistance to investors to invest in the shares of any issuer;
• providing any investment advice or recommendation to investors or prospective investors;
• receiving or holding funds from any investor; treating any issuers and investors in a different manner;
• publishing any incorrect information regarding any equity crowdfunding activity;
• offering any equity crowdfunding service to any issuer, investor or the public via private communication means without consent of the relevant issuers and investors; or
• charging a fee to any investor and issuer for any complaint submitted.

An investor is defined as a party that purchases shares of an issuer via an operator. An investor having an annual turnover of at least 500 million rupiah may purchase shares via equity crowdfunding at not more than 5 per cent of its annual turnover. Meanwhile, an investor that has annual turnover of more than 500 billion rupiah may purchase shares via equity crowdfunding at not more than 10 per cent of its annual turnover. However, these requirements do not apply if an investor is a legal entity and has investment experience in the capital market, as proven by owning a securities account for at least two years prior to the share issue.

It must be noted that share issuance via equity crowdfunding is different from share issuance via an IPO.

Back to top

There is no specific regulation on invoice trading, although it may be recognised as a transfer of receivables pursuant to the Indonesian Civil Code (ICC), which does not specifically trigger a licensing requirement. Nevertheless, depending on the business structure, companies carrying out sale and purchase of receivables (eg, factoring businesses) may fall under a regulated activity that requires a specific licence.

Back to top

Yes. Payment services are primarily regulated under PBI (Bank Indonesia Regulation) No. 18/40/PBI/2016 on the Operation of Payment Transaction Processing (PBI on Payment Processing), and the recently introduced PBI No. 20/6/PBI/2018 on Electronic Money (PBI on E-Money), and PBI No. 14/23/PBI/2012 on Transfer of Funds. The scope of regulated activities covers pre-transaction, authorisation, clearing, settlement, and post-transaction activities.

The following payment service providers are generally required to obtain a licence from BI:

• principals;
• switching operators;
• card-based payment instruments and e-money issuers;
• acquirers;
• payment gateway operators;
• clearing operators;
• final settlement operators;
• fund transfer operators;
• e-wallet operators; and
• other payment service providers as determined by BI.

In providing payment services, the above-listed providers may cooperate with supporting operators (eg, companies that engage in payment personalisation, providing data centres or disaster recovery centres, terminal provision, technology support for contactless transactions and card printing).

Back to top

No, currently, there is no specific law or regulation that requires financial institutions to make customer or product data available to third parties such as via API. However, on 27 May 2019, Bank Indonesia introduced its Indonesia Payment System 2025 Visions, in which one of the visions is to assure the interlink between fintech and banks to contain the escalation of shadow banking risk through regulation of the use of digital technology (eg, API) business relationships and business ownership. Thus it can be seen that BI is aware of the importance that API has and it is expected that BI will issue a regulation sooner or later to regulate the use of API.

Back to top

Marketing of insurance products is generally regulated under OJK Regulation No. 23/POJK.05/2015 on Insurance Products and Marketing of Insurance Products, which allows insurance companies to sell and market insurance products through insurance agents, banks or non-bank institutions. Currently, there is no specific regulation governing the selling or marketing of insurance products specifically through fintech companies. Depending on the services offered, the licensing treatment may be the same as for non-fintech companies. Micro insurance products, however, are allowed to be marketed and sold using information technology (eg, through websites).

Back to top

Based on OJK Regulation No. 18/POJK.03/2017 on Reporting and Requesting of Debtor Information through the Financial Information Services System (SLIK), credit information services are currently managed by the OJK through the SLIK, which fully replaced Bank Indonesia’s Debtor Information System as of January 2018. The SLIK collects and records credit or loan facility data submitted to the OJK in order to generate the credit information status of a person. The scope of reporting companies covers not only banks and other financial services institutions (FSIs), but also non-FSIs subject to approval from the OJK. Fintech companies, specifically P2P lending companies, may become reporting companies upon obtaining approval from the OJK.

Back to top

Unlike in the European Union, regulated activities cannot be passported into Indonesia.

Back to top

No. Any company planning to provide financial services in Indonesia must have legal entity status in Indonesia, which requires a presence in Indonesia. Currently, three types of fintech activities have been regulated: payment system services, regulated by BI, and P2P lending services and equity crowdfunding, regulated by the OJK. All of these activities require legal entity status, a licence and a presence in Indonesia. Notwithstanding the foregoing, PBI No. 19/12/PBI/2017 on the Operation of Fintech (PBI on Fintech) does recognise offshore fintech companies in that they are required to register with BI and may be subject to the regulatory sandbox requirement.

Back to top

In general, the provisions of Law No. 8 of 1999 on Consumer Protection apply to the sales and marketing of financial services and products in Indonesia.

Under OJK Regulation No. 1/POJK.07/2013 on Consumer Protection in the Financial Services Sector, the OJK prohibits financial services companies from:

• sharing any information about their consumers with third parties unless mandated by law or the consumers have given their consent in writing;
• forcing consumers to buy other products or services in a product or services package when selling in bundles;
• offering products or services to consumers via personal communication means without the consumers’ consent;
• misusing standard contracts; and
• imposing a fee on consumers for filing any complaint.

Furthermore, the OJK has also issued Guidelines for Financial Services Advertisements to ensure that financial service companies do not produce any inaccurate, unclear and misleading advertisements of any financial products or services.

Back to top

Pursuant to the PBI on E-Money and the PBI on Payment Processing, an entity that acquires a licensed payment system service operator shall notify BI if such operator is in the form of a bank or shall obtain prior approval from BI if such operator is a non-bank institution. Furthermore, non-bank institutions carrying out e-money operation are prohibited from taking any corporate action that results in a change of controlling shareholder within five years from the issuance of their licences, except where approved by BI under certain circumstances.

For P2P lending companies, POJK 77/2016 provides that a change of ownership requires prior approval from the OJK.

In general, a change of control of a company that constitutes an acquisition needs to be approved by its general meeting of shareholders (GMS). Further, prior to the passing of the GMS resolution approving the change of control, the company is required to carry out a newspaper announcement and notification to its employees. Upon completion of the acquisition, the company must notify the Minister of Law and Human Rights (MOLHR) for the change of company data and carry out another newspaper announcement.

Back to top

There is no specific regulation that obliges fintech companies to have procedures to combat bribery. However, in 2016 the Supreme Court issued Supreme Court Regulation No. 13 of 2016 on Procedures for Handling Crimes by Corporations, which stipulates that in assessing whether a corporation is guilty of corruption, judges may evaluate whether the corporation has implemented necessary steps to prevent corrupt acts from happening. Based on this provision, the Corruption Eradication Commission (KPK) has issued Guidelines for Corruption Prevention for Businesses whereby companies are encouraged to have internal procedures to combat corrupt acts.

See question 21 for more information on money laundering.

Back to top

In 2017, the OJK issued OJK Regulation No. 12/POJK.01/2017 on Implementation of Anti-Money Laundering and Counter-Terrorism Financing Programme in the Financial Services Sector, which outlines the obligations for financial services companies to implement anti-money laundering and counter-terrorism financing programmes through:

• active supervision by the board of directors and board of commissioners;
• policies and procedures;
• internal control;
• management information systems; and
• human resources and training.

P2P lending companies are required to abide by this regulation starting from the 2021, four years after the entry into force of this regulation.

Back to top

POJK 77/2016 specifically requires loan agreements entered into on a P2P lending platform to be executed electronically using electronic signature. On the other hand, execution of security agreements shall abide by the relevant laws and regulations, depending on the type of security.

In practice, a P2P lending company will be the party executing loan agreements for and on behalf of the lenders, whereby it received power of attorney from the lenders to act on their behalf, including executing any loan agreement or security agreement. The power of attorney clause is usually stipulated in the agreement between the P2P lending service operator and the lender.

Back to top

There is no specific regulation on assignment of loans originated on a P2P lending platform. Any assignment of loans shall be in accordance with article 613 of the ICC regarding assignment.

In order to perfect an assignment of loans, the borrower shall be notified of the assignment. The implication for the purchaser if the assignment is not perfected is that the purchaser has no right to request repayment of the loan from the borrower.

It is not possible not to inform the borrower regarding the assignment of loans, as this is stipulated under article 613 of the ICC.

Back to top

There are no such requirements under the current regulatory framework on P2P lending.

Back to top

Yes, a special purpose company in this case is subject to the rules on data protection. Based on Minister of Communication and Informatics Regulation No. 20 of 2016 on Personal Data Protection in Electronic Systems (MOCI Regulation 20/2016), any party that obtains protected data or information from an electronic system operator (P2P lending operator) relating to its users (borrowers) is subject to the rules on data protection.

Back to top

Yes, POJK 13/2018 allows the use of artificial intelligence and robo-advice in the financial services sector, whereby artificial intelligence is recognised within the market support group while robo-advice is recognised as part of the other digital finance support group.

Back to top

Yes, POJK 13/2018 recognises the use of blockchain in the financial services sector; the OJK acknowledges the use of blockchain technology in the other financial services activities group.

Back to top

No, there are no rules or regulations specifically governing the use of cryptoassets as digital currencies, as BI does not allow cryptoassets to be recognised as legal tender. In accordance with Law No. 7 of 2011 on Currency, Indonesia recognises only rupiah as its legal tender. Accordingly, cryptoassets are also prohibited to be used as digital currencies, including in digital wallets or e-money.

Back to top

Yes, Commodity Futures Trading Supervisory Authority (Bappepti) Regulation No. 5 of 2019 on Technical Provisions Governing Physical Futures Trading of Crypto Assets, which implements Minister of Trade Regulation No. 99 of 2018 on General Policies on Futures Trading of Crypto Assets, governs the operation of digital currency exchanges.

Back to top

There are no legal or regulatory framework or guidelines in relation to ICOs or token generating events at this point in time.

Back to top

The laws and regulations that govern the processing and transfer of data (both domestic and cross-border) to fintech products and services are Law No. 11 of 2008 as amended by Law No. 19 of 2016 on Electronic Information and Transaction, GR 82/2012 and MOCI Regulation 20/2016 and POJK 77/2016.

Specifically, prior to transferring data, MOCI Regulation 20/2016 requires the transferring entity to obtain consent given in writing either manually or electronically and to implement the principles of accuracy and compatibility with regard to the purpose of transferring and processing such data.

Back to top

Cybersecurity regulations that are enforceable to fintech businesses are, among others, the Indonesian Criminal Code, Law No. 11 of 2008 as amended by Law No. 19 of 2016 on Electronic Information and Transactions, POJK 77/2016 and the Licensing Checklist for P2P lending companies, in which one of the requirements to be fulfilled by P2P lending companies wishing to be licensed is to obtain the ISO 27001 standard.

Back to top

There is no specific regulation governing this matter. Under Law No. 13 of 2003 on Manpower, any company in general, including a financial services company, may not outsource its core businesses, or activities that have a direct relation to its production process. Works that may be outsourced are limited to supporting services, namely cleaning, catering, security, oil and gas, mining and labour transportation.

Back to top

At present, there are no specific legal requirements for such use. However, the OJK has issued Guidelines for the Use of Cloud Computing Services by Financial Services Institutions to serve as a guidance for FSIs in facing legal and operational issues arising from the use of cloud computing.

Every FSI should comply with the following:

• competence and reputation of the service provider;
• review, monitoring and control;
• audit;
• confidentiality and security standards;
• resilience and continuity of business;
• transparency of data location;
• restrictions on use of data;
• separation or isolation of data;
• outsourcing requirements; and
• data termination requirements.

Back to top

Software is mainly protected by copyright under Law No. 28 of 2014 on Copyright (the Copyright Law). Although, in principle, copyright arises automatically when a work is realised in a tangible form, the Copyright Law provides procedures for voluntary registration. Registration is not required for a work to be recognised as copyrighted; it merely confers on the registrant the legal presumption that it is the creator of the work in the event of a dispute.

Back to top

Ownership of intellectual property depends on the nature of the intellectual property. With regard to copyright, in the absence of express contractual provisions between the employer and the employee that provide otherwise, the employee owns the copyright because he or she is deemed the creator. However, if the work is designed by the employer, and the employee merely realises and performs his or her work under the guidance and direction of the employer that initially designed the copyrighted work, the employer will be regarded as the creator.

In relation to patents, intellectual property rights over inventions made by an employee in the course of employment will be owned by the employer, unless otherwise agreed by both parties. This also applies to inventions developed by employees using data or facilities that are available owing to their employment. In both cases, the employee, as the inventor, has the right to a reward based on the agreement of the parties, taking into account the economic benefits obtained from the invention.

With regard to intellectual property rights developed by contractors or consultants in the course of an engagement, contractors or consultants generally own the intellectual property developed by them, as, according to the Copyright Law, the work developed based on the order of others will be owned by the party that developed such work. Despite these rules, both parties may agree otherwise in a contract. The Patent Law is silent on the case where the invention is made by a contractor or consultant. In practice, this scenario is commonly governed under a contract executed by the parties.

Back to top

Although, in general, the Indonesian laws related to intellectual property recognise joint ownership, limitations related to the rights of use, licence, charge or assign specifically under such a joint ownership are not expressly provided. In practice, the parties under a joint ownership usually enter into an agreement to govern in detail the terms on the use, licensing and assignment of rights by them.

Back to top

In Indonesia, trade secrets are protected under Law No. 30 of 2000 on Trade Secrets (the Trade Secrets Law). The scope of protection covers methods of production, processing or sale, or any other information in the field of technology or business. To obtain protection, a trade secret must have economic value, must be unknown to the public, and its owner must take the necessary steps to maintain the confidentiality of the information. By holding the right of a trade secret, the holder is entitled to exclusive rights to use the trade secret, grant a licence to or prohibit others from using the trade secret, and disclose the trade secret to third parties for commercial purposes.

Disclosing, or breaching an agreed obligation to maintain the confidentiality of, trade secrets, constitutes an infringement of trade secrets. Unlike the general rules of intellectual property that designate the commercial court as the relevant forum for dispute settlement, the Trade Secrets Law specifically provides that disputes related to trade secrets will be settled by the district court. District courts allow closed proceedings in order to prevent the disclosure of trade secrets.

Back to top

Brands are largely protected as trademarks under Law No. 20 of 2016 on Trademark and Geographical Indications (the Trademark Law). Trademarks not only cover conventional marks, such as words, letters, numbers, pictures and logos, but also non-conventional marks, such as three-dimensional objects, sounds and holograms. The rights of trademarks are obtained upon registration with the MOLHR.

The Trademark Law allows applications to be submitted with priority rights. With priority rights, an applicant may submit an application originating from any member state of the Paris Convention for the Protection of Industrial Property, or the Agreement Establishing the World Trade Organization, in order to obtain recognition that the filing date of the country of origin is the priority date in Indonesia, provided that the filing date of the application is made during the period prescribed in the treaty.

Back to top

In general, the owner of intellectual property rights (IPR) may file a civil lawsuit to claim for compensation or to force the termination of all actions related to the use of such IPR, or both. Such civil lawsuits will be submitted to the commercial court for trademarks, copyrights and patents, or the district court in case of trade secrets. Alternatively, the parties may settle disputes via arbitration or other alternative dispute settlement mechanism.

Criminal penalties are also applicable for the infringement of IPR.

Back to top

In recent years, we have seen relatively large and more established fintech companies having the advantage over smaller fintech companies in accumulating data. A potential competition issue that may arise in the future is the fact that these big fintech companies holding a large amount of data may hinder other entrants to the fintech market because smaller players or newer players do not have the same amount of data compared with the incumbents and therefore these new entrants have difficulties in competing with larger companies.

Back to top

No, there is no tax incentive available for fintech companies and investors engaging in the fintech sector.

Back to top

There is no specific tax regulation that could significantly increase tax administrative costs for fintech companies in Indonesia.

Back to top

No, there is no special regime specific to the technology or financial sectors.

Back to top

Current developments

45 Are there any other current developments or emerging trends to note?

On 27 May 2019, Bank Indonesia followed in the footsteps of central banks in India, Singapore and Thailand by unveiling the long-awaited Quick Response Indonesia Standard (QRIS), which allows users of a payment service to transfer funds to any other payment service provider within BI’s ecosystem. The QRIS allows QR code-facilitated payments to be interoperable and interconnected. According to the latest news, four state banks are currently in talks with We Chat and Alipay and it is expected that these Chinese companies will enter the Indonesian market by accommodating the QRIS. Through the QRIS, Bank Indonesia aims to accelerate the digital transformation of the Indonesian economy.

The authors would like to thank Glenn Wijaya for his assistance during the preparation of this chapter.

Back to top