1. What kind of institution is the Financial Services Authority of Indonesia (OJK)?
The Financial Services Authority of Indonesia (OJK) is a financial supervisory authority. In Korean terms, it performs both the policy and rulemaking role of the Financial Services Commission and the enforcement role of the Financial Supervisory Service, and it has strong authority to supervise the entire financial industry in an integrated manner.
2. What are the key points of POJK 30/2024?
In December 2024, OJK enacted the “Regulation on Financial Conglomerates and Financial Holding Companies,” which requires groups that meet a certain scale and operate in multiple financial sectors to establish a PIKK (a financial conglomerate holding company)—the equivalent of a financial holding company in Korea—and provides for supervision at the PIKK level.
When entering Indonesia, it is important to check in advance whether an entity falls within the PIKK scope and whether a holding-company structure must be established.
3. What laws and regulations must be considered when building an information system?
If an entity is subject to PIKK, what must be considered when the Indonesian holding company builds an information system is not simply the construction of an IT system. Because PIKK requirements, personal data processing regulations, and financial data regulations must be considered together, the following legal and regulatory framework must be understood in layers.
- Financial supervisory regulations of OJK (Otoritas Jasa Keuangan)
- Personal Data Protection Law (personal information protection law)
- Electronic system and data regulations of the Ministry of Communication and Informatics (Kominfo)
- Cybersecurity and national security regulations of the National Cyber and Crypto Agency (BSSN)
4. What must be considered when building an information system?
A. Related financial supervisory regulations
- Integrated risk management, integrated internal control, group data management, and related matters under POJK 20/2024 (PIKK regulation)
- Mandatory IT risk management, information security, assurance of system safety, and related matters under POJK 38/2016 (IT Risk Management)
- Security, reliability, and auditability of financial data processing systems, Incident Response, and related matters under POJK 11/2022 (Digital Banking / IT Governance)
B. Personal Data Protection Law
- Consent for personal data collection, protection of sensitive information, guarantee of Data Subject rights, Data Breach notification obligations, designation of a Data Protection Officer (DPO), and related requirements under the Personal Data Protection Law (2022), which is at a level comparable to the European GDPR
C. Electronic system regulations of the Ministry of Communication and Informatics (IT regulations)
- Mandatory electronic system registration (PSE registration), data storage location requirements, assurance of system reliability, and related requirements under Government Regulation 71/2019 (GR71) on electronic systems and transactions
- Requirements for technical safeguards for personal data processing, encryption, access control, logging, and related measures under Minister Regulation 20/2016, which governs personal data protection in ICT
D. Cybersecurity regulations of the National Cyber and Crypto Agency (BSSN)
- Because financial institution systems are regarded as national critical information infrastructure, meet requirements such as security architecture and network separation, access control and account security, encryption and key management, logs and security monitoring, vulnerability management and security testing, incident response, and data protection and leakage prevention
5. Key points of POJK 38/2016
POJK 38/2016 consists of five pillars (IT Goverance, IT Risk Management, IT Control, IT Operations, Business Continuity), and the main points of IT Control and IT Development & Acquisition, which are directly related to information security, are as follows.
- The requirements in the access control area include user authentication and privilege management, application of the principle of least privilege, and monitoring of user activity. Examples of application include applying RBAC, separating administrator accounts, and applying MFA.
- The requirements in the data security area include ensuring data integrity, confidentiality, and availability, and establishing a data protection policy. Examples of application include DB encryption, data backup, and management of data change logs.
- The requirements in the encryption area include encryption of sensitive information and establishment of a cryptographic key management system. Examples of application include applying TLS and using an HSM/KMS.
- The requirements in the log and audit area include recording all major activities and ensuring auditability. Examples of application include building an Audit Trail and preventing log tampering.
- The requirements in the security testing area are to perform vulnerability checks and tests. Examples of application include regular vulnerability checks and penetration tests.
- The requirements in the IT system development and acquisition area include applying a Secure SDLC, verification when a new system is introduced, and evaluation of external solutions. Examples of application include source-code vulnerability checks, vulnerability checks and penetration tests, and vendor security assessments.