Fintech Legal Guide – Indonesia

1. OVERVIEW

1.1. WHAT ARE THE MOST SIGNIFICANT LEGAL DEVELOPMENTS IN THE FINANCIAL TECHNOLOGY ("FINTECH") INDUSTRY IN YOUR JURISDICTION?

The most significant legal development in Indonesia's Fintech sector is the enactment of Law No. 4 of 2023 on Development and Strengthening of Financial Sector ("Law 4/2023"). This is an omnibus law of the financial service sector where one law amends up to 17 laws pertaining to the bank and financial services sector.

Law 4/2023 becomes the main legal basis of implementation of fintech as well as management of digital financial assets in Indonesia. Fintech is subject to the regulatory sandbox of licensing, monitoring and evaluation, financial education, consumer protection, consumer personal data protection, and other activities in support of technology innovation in the financial sector.

In Indonesia, the Fintech business has significantly penetrated the payment and financial ecosystem, relating to, among others, the (i) e-money/digital wallets through the increase of use of Quick Response Code Indonesia Standard ("QRIS"), (ii) Payment Gateway, (iii) Crowdfunding, (iii) Peer-to-Peer (P2P) Lending including Paylater, (iii) Digital Banking; and (iv) Crypto Trading with the Use of Cryptocurrency.

Law 4/2023 also expands the authority and responsibility of OJK as Indonesia's Financial Services Authority, to oversee the digital financial and crypto assets, resulting in a shift of authority from the Commodity Futures Trading Regulatory Agency (Badan Pengawas Perdagangan Berjangka Komoditi or "Bappebti") to OJK.

Moreover, Law 4/2023 also recognizes "Digital Rupiah" as one type of the lawful currencies of the Republic of Indonesia, which will be managed by Bank Indonesia. But in practice, Digital Rupiah has not been used by the Indonesian public.

1.2. IS FINTECH REGULATED IN YOUR JURISDICTION? WHAT IS THE REGULATORY APPROACH TOWARDS FINTECH IN YOUR JURISDICTION?

Yes, primarily Fintech is regulated and supervised by Bank Indonesia ("BI") and OJK. While BI is responsible for all payment-system-related financial technology, OJK is responsible for all financial technology matters other than the payment system, including: (i) Peer-to-Peer (P2P) Lending, (ii) Crypto Assets, (iii) Insurance, (iv) Capital Market, (v) Financing Institutions, (vi) Venture Capital, (vii) Micro Financing Institutions, and (viii) Carbon Trading.

In general, the regulatory landscape for Fintech in Indonesia is evolving. Both authorized entities are committed to keeping up with the innovations and development by issuing the relevant regulations to make sure the practices maintain the system stability, market integrity, and consumer protection, as well as the balance between the innovation and regulation to ensure the stringent regulations will not hinder the innovations.

In general, the regulatory landscape for Fintech in Indonesia is evolving. Both authorized entities are committed to keeping up with the innovations and development by issuing the relevant regulations to make sure the practices maintain the system stability, market integrity, and consumer protection, as well as the balance between the innovation and regulation to ensure the stringent regulations will not hinder the innovations. financial market infrastructure, data and digitalization, as well as regulatory, licensing, and supervisory reforms. OJK also issued Regulation No. 3 of 2024 on the Implementation of Technology Innovation in the Financial Technology Sector ("OJKR 3/2024") fostering the regulatory sandbox for licensing, monitoring and evaluation, financial literacy, consumer protection, and consumer's personal data protection.

These entities' initiatives aim to develop integrated, interoperable, and responsive digital payment and financial ecosystems to cater to the emerging needs of digital economy for the growth and increase of financial literacy and inclusion.

In addition, Fintech businesses in Indonesia are supervised by the formal associations appointed by OJK, which are the "Indonesia Fintech Association (AFTECH)" as the selfregulatory organization (SRO) for digital financial innovation providers, and AFPI (Asosiasi Fintech Pendanaan Bersama Indonesia) as the SRO for the peer-to-peer (P2P) lending business actors. The membership of these business associations are mandatory for the relevant license holders, and they must adhere to the code of conduct stipulated by the associations.

1.3. HAS YOUR JURISDICTION IMPLEMENTED ONE OR VARIOUS SANDBOXES FOR THE FINTECH INDUSTRY? IF SO, PLEASE EXPLAIN THE DETAILS AND SCOPE OF THE SANDBOX.

The sandbox exercise is first introduced by BI in 2017 with the issuance of BI Regulation No. 19/12/PBI/2017 on Organization of Financial Technologies, which was revoked under BI Regulation No. 23/6/PBI/2021 on Payment System Service Providers ("PBI 23/2021"). Later, OJK Regulation No. 13/POJK.02/2018 on Digital Financial Innovations in the Financial Services Sector was issued, but it was recently revoked by OJKR 3/2024. In addition, Law 4/2023 also regulates this sandbox requirement for the financial digital innovations.

Therefore, the sandbox exercise in Indonesia is mainly regulated based on Law 4/2023, PBI 23/2021, and OJKR 3/2024. Law 4/2023 defines the sandbox as the creation of space and/or facilities of trials or development as part of the financial technology innovations, subject to BI's and OJK's supervision in accordance with their respective authorities.

BI Sandbox

Since its first introduction, BI Sandbox has evolved. The latest version is known as Sandbox 2.0, which consists of the (i) innovation lab, developing innovations that have never been used or have been used in the payment system industry on a limited basis; (ii) regulatory sandbox, developing innovations to the payment system's policies or regulations; and (iii) industrial sandbox, developing innovations that have been used in the payment system industry and need to be encouraged to be used on a wider basis.

The mechanism and trial period of BI Sandbox is determined for a maximum period of 6 months and can be extended once for another 6 months. Following the completion of sandbox assessment, BI determines the status of the trial results as (i) successful (pass); or (ii) unsuccessful (fail).

OJK Sandbox

OJK initially introduced the regulatory sandbox in 2018. It is defined as the testing mechanism undertaken by OJK to assess the reliability of the provider's business processes, business models, financial instruments, and governance of the Fintech providers. The fintech products include those within the "digital financial innovation" (Inovasi Keuangan Digital). During its implementation, Fintech providers in the regulatory sandbox process may obtain OJK approval to be temporarily exempted from certain OJK regulations. 

In 2024, the definition of regulatory sandbox is expanded to include the mechanism to facilitate the testing and innovation development for the purpose of feasibility and reliability assessments of the Fintech products or services. These assessments will cover:

1. the platform's try out in a limited space and time;
2. explanations on the prevailing regulation in the finan
3. facilities to develop the early stages of fintech innovations; and
4. other facilities in connection with the development of fintech innovations.

The process of regulatory sandbox under OJKR 3/2024 regime also requires a license or approval issued by OJK. The previous regulation only required a registration. This licensing process requires applicants to fulfill the eligibility criteria for their participation, and submission of their testing plan to OJK.

The regulatory sandbox is conducted for a period of 1 year since the issuance of OJK approval for the regulatory sandbox participant. Upon the evaluation and further action of regulatory sandbox result, OJK will determine the status as (i) successful (pass); or (ii) unsuccessful (fail). For the successful/pass result, Fintech providers are required to apply for the business license within 6 months since the date of result determination.

1.4. ARE FINANCIAL ENTITIES IN YOUR JURISDICTION ALLOWED TO INVEST IN, OR ACQUIRE, FINTECH COMPANIES?

In general, a financial entity (i.e. Bank or financial services company) can invest in or acquire a Fintech company, provided that this bank or financial services company complies with the foreign ownership and certain other limitations. For instance, a foreign company can own a maximum of 85% of shares of a P2P company. In addition, the maximum foreign ownership of a Payment Service Provider is 85% with the maximum 49% voting rights.

Note that during the past few years, the investments and acquisitions of Fintech companies by Indonesian banks include the establishment of Bank Saqu by PT Bank Jasa Jakarta owned by Astra Financial and WeLab Ltd, the acquisition of Bank Jago by GoTo, the acquisition of PT Bank Kesejahteraan Ekonomi by Sea Group, the acquisition of Bank Neo by Akulaku, and the establishment of Superbank by KakaoBank, Singtel, and Grab.

Moreover, Gerbang Pembayaran Nasional (GPN), which is the main switching provider in Indonesia that also operates the QRIS system, is owned by several commercial banks together with Bank of Indonesia (or BI, the Indonesian central bank). GPN facilitates a seamless online and offline payment ecosystem including the operation of QRIS in Indonesia for the domestic digital-based payment.

1.5. IS THE DISTINCTION MADE BETWEEN CONSUMER AND FINANCIAL CONSUMER IN YOUR JURISDICTION? IF SO, PLEASE EXPLAIN IF THERE ARE SPECIAL REGULATIONS FOR THE PROTECTION OF FINANCIAL CONSUMER RIGHTS

Consumer protection is generally regulated under Law No. 8 of 1999 on Consumer Protection ("Consumer Protection Law"). The law stipulates general and basic provisions on consumer protection, which apply to all sectors. Meanwhile, there is a specific regulation for consumer protection in the financial sector. OJK has the authority to oversee consumer protection based on Law 4/2023, with the issuance of OJK Regulation No. 22 of 2023 on Consumer and Community Protection in the Financial Services Sector ("OJKR 22/2023"), which only applies to the financial services sector. OJKR 22/2023 mandates all financial service businesses to have a Consumer Protection Unit to receive consumer complaints and secure the information system and cyber resilience for consumer protection by implementing cybersecurity measures including cyber-attack detection, comprehensive security control, regular assessments, and cyber-attack incident remedy and response procedures.

2. LENDING AND FINANCING

2.1. IS LENDING CROWDFUNDING REGULATED IN YOUR JURISDICTION? ARE THERE, OR WILL THERE BE, ANY PARTICULAR REQUIREMENTS FOR A CONSUMER OR AN INVESTOR TO PARTICIPATE IN LENDING CROWDFUNDING?

Yes. In Indonesia, lending crowdfunding or generally known as P2P is regulated under OJK Regulation No. 40 of 2024 on Financial Technology Peer-to-Peer Lending ("OJKR 40/2024"). It is understood that there is no distinction between lending crowdfunding and P2P practices in Indonesia.

In general, OJKR 40/2024 specifies different requirements for each consumer and investor.

Investor

OJKR 40/2024 specifies that an investor or a lender can be local or foreign investor. An investor or a lender can be an individual person, a legal entity, a business entity, and/or an international agency.

A P2P provider is required to ensure that the investors or lenders understand all associated risks in the provision of P2P funding to the borrowers/customers by executing the letter of understanding of investor/lender.

Moreover, an investor or a lender must enter into two sets of agreements in connection with P2P funding, namely the (i) agreement between the P2P provider and the investor; and (ii) agreement between the investor and the customer drawn in electronic document. Additionally, the investors also have the right to conduct the general meeting of investors that is held by the P2P provider.

The general prohibition in P2P funding business is that the investor cannot also be the P2P provider at the same time.

Consumer

OJKR 40/2024 requires the customer to be an Indonesian individual person, or a legal entity, and/or business entity residing in Indonesia. In terms of risk analysis, the required minimum age and income of the prospective customers should be met prior to the issuance of approval for the proposed funding. Based on OJK Press Announcement No. SP-214/GKPB/OJK/XII/2024 dated 31 December 2024, OJK sets the minimum age for an investor or a customer of P2P lending at 18 years old. The minimum income of either an investor or a customer is set at IDR 3 million/month.

The general prohibition for a customer in the P2P funding business is, the customer cannot be the P2P provider at the same time. Additionally, the management and employees of P2P provider cannot be the customers of the same P2P provider.

Further, OJKR 40/2024 stipulates different funding limits for customers of productive funding and those of consumptive funding.

1. Productive Funding is provided to a customer in the amount between IDR 2 billion and the maximum IDR 5 billion with conditional requirement of a nonperforming loan ratio not exceeding 5% over the previous 6 months. And the prospective customer must not be subject to any OJK sanctions, including business restrictions or suspensions.
2. Consumptive Funding is provided to a customer in an amount of up to the maximum IDR 2 billion.

2.2. IS PEER TO PEER LENDING (P2P) REGULATED IN YOUR JURISDICTION? ARE THERE, OR WILL THERE BE, ANY PARTICULAR REQUIREMENTS FOR A CONSUMER OR AN INVESTOR TO PARTICIPATE IN P2P LENDING?

Yes. Please see our response above.

2.3. IS CONSUMER PROTECTION REGULATION APPLICABLE TO LENDING CROWDFUNDING OR P2P LENDING?

Yes. In general, they will be subject to the Consumer Protection Law under Law No. 8 of 1999 and specific consumer protection rules in the financial services sector under OJKR 22/2023.

Moreover, OJKR 40/2024 also requires any P2P provider in the P2P lending business to implement the consumer protection principles, based on the laws and regulations.

2.4. ARE DONATION AND REWARD BASED CROWDFUNDING REGULATED IN YOUR JURISDICTION?

Donation crowdfunding is generally regulated by Law No. 9 of 1961 on Collection of Funds or Goods, and Government Regulation No. 29 of 1980 on Implementation of Donation Collection, which is further implemented based on Ministry of Social Affairs ("MoSA") Regulation No. 8 of 2021 on Implementation of Money or Goods Collection as amended by MoSA Regulation No. 8 of 2024. The donation activities are supervised by the Ministry of Social Affairs.

Donation activities in Indonesia can be conducted by the community-based organizations, non-profit organizations, and non-governmental organizations (i.e., Organizations or Foundations). Each of them must obtain a license to collect the donation from the relevant Ministry, Governor, or Mayor according to the scope of the donation provision prior to commencing their fundraising activities.

If the collecting activity is conducted via online or electronic means, it must be registered as an Electronic System Operator to the Ministry of Communication and Digital Affairs ("MoD").

Reward-based crowdfunding is specifically regulated in Indonesia, but it may be subject to general crowdfunding regulation (see 2.5. below), or the digital finance technology innovations as set forth in OJKR 3/2024, where it must go through the sandbox process at OJK. 

2.5. IS CROWDFACTORING REGULATED IN YOUR JURISDICTION? IF SO, WHAT ARE THE REQUIREMENTS IN ORDER TO PROVIDE THIS TYPE OF SERVICE?

Yes. In general, factoring activities (anjak piutang) are regulated under OJKR No. 35/POJK.05/2018 on Implementation of Company Financing, as lastly amended by OJKR No.7/POJK.05/2022 ("OJKR 35/2018"). Additionally, it is regulated under the Ministry of Finance Regulation ("MoFR") No. 84/PMK.012/2006 on Company Financing ("MoFR 84/2006").

OJKR 35/2018 and MoFR 84/2006 can be provided with or without recourse. Under OJKR 35/2018, factoring is classified as investment financing.

However, crowd factoring activities are not specifically regulated in Indonesia. As such, they will be subject to the digital finance technology innovations as set forth in OJKR 3/2024, where they go through the sandbox process at OJK and apply for the OJK license accordingly, if they pass the process.

Similarly, if the crowdfunding activities are conducted via online or electronically, they must be registered to MoD as Electronic System Operators.

3. INVESTMENT AND CAPITAL MARKETS

3.1. IS EQUITY CROWDFUNDING (CROWDEQUITY) REGULATED IN YOUR JURISDICTION?

Yes. Equity crowdfunding is specifically regulated under OJKR No. 57/POJK.04/2020 on Securities Offering through Equity Crowdfunding as amended by OJKR No. 16/POJK.04/2021 ("OJKR 57/2020").

3.2. WHAT TYPES OF REQUIREMENTS ARE APPLICABLE TO CROWDEQUITY PLATFORMS?

OJKR 57/2020 specifies that the electronic system or platform of the Equity Crowdfunding must fulfil the list of readiness of electronic system infrastructure and operational data activities as attached in OJKR 57/2020. The list includes:

1. the use of a high level domain evidenced by the domain ownership documents;
2. the platform has two data centers that are synchronized with each other on a high availability basis;
3. the platform has the standard procedure of backup and recovery system and business continuity plan;
4. the platform has guidelines on customer data protection, including cybersecurity applications on cloud or on premises;
5. the platform has guidelines on the use of certified digital signature during the onboarding process; and
6. the platform has guidelines on the helpdesk service.

In addition to the above, providers of Equity Crowdfunding electronic systems must be registered to and licensed by MoD as an Electronic System Operator, as proven through further submission to the OJK.

3.3. ARE THERE ANY PARTICULAR REQUIREMENTS APPLICABLE TO INVESTORS OR SECURITIES IN CROWDEQUITY PROJECTS?

Pursuant to OJKR 57/2020, types of securities that can be offered through an Equity Crowdfunding can be (i) a type of equity securities in the form of shares or securities that can be converted into shares; (ii) a type of debt securities; (iii) Sukuk or sharia compliant bonds; (iv) any other form of securities as determined by OJK.

In particular, the debt-type security or Sukuk must fulfil the following requirements:

1. it is issued in Indonesian Rupiah;
2. it has a certain project, which serves as the basis of the issuance of such debttype securities or Sukuk;
3. it is non- tradeable;
4. the maturity period must not exceed 2 years;
5. it can be repaid early before the maturity, to the extent it has been agreed by the other bond holders at the bondholders meeting prior to its issuance; and
6. the payment of principal amount, interest, profit sharing, margin, rewards, or yields can be made periodically or on the maturity date; and
7. it has obtained the sharia compliant statement, in case of Sukuk issuance.

Within 12 months, the issuance of such Securities by each issuer must not exceed IDR 10 billion or any other amount as determined by OJK.

OJKR 57/2020 states that an investor of Equity Crowdfunding must fulfil the following minimum requirements:

1. the investor has a securities account at the custodian bank, specifically to hold the Securities and/or funds through the Equity Crowdfunding provider service;
2. the investor has the ability to purchase the Securities of the issuer; and
3. the investor meets the criteria of securities purchase limit.

The investor criteria and securities purchase limit as referred to in point (c) are as follows:

1. an investor with an annual income of up to IDR 500 million can purchase the Securities through the Equity Crowdfunding worth not more than 5% of their annual income; and
2. an investor with an annual income of more than IDR 500 million can purchase the Securities worth not more than 10% of their annual income.

Further, the investor criteria and securities purchase limit as mentioned above will not be applicable if the investor is an entity who has the experience in the investment of capital market as evidenced by the ownership of Securities account for, at least 2 consecutive years before the Securities offering.

3.4. IS THERE A SECONDARY MARKET?

OJKR 57/2020 generally facilitates the secondary market where the registered investors can trade the Securities sold through the Equity Crowdfunding to other fellow Investors who are registered as the Equity Crowdfunding providers with certain limitations, which include, among others: (i) it is an equity type securities that has been distributed for at least, 1 year before the trading; and (ii) the trade is done up to twice within 12 months.

The secondary market may provide a reasonable price as a reference for the seller and buyer and a communication system for the investor and issuer as users to sell and purchase the Securities.

To view the full article, click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.