In response to the current challenges of Information Technology-Based Peer-to-Peer Lending Services ("P2P Lending") business activities in Indonesia (e.g., illegal P2P providers, personal data breach, unethical debt collection practices, and high percentages of bad debts or non performing loans), as well as the advancement of information technology within the financial sector as mandated in Law No. 4 of 2023 concerning the Development and Strengthening of the Financial Sector, Indonesia Financial Services Authority (Otoritas Jasa Keuangan or "OJK") recently issued Regulation No. 40 of 2024 regarding Information Technology-Based Co-Funding Services ("OJKR 40/2024"), replacing the previous regulation, OJK Regulation No. 10/POJK.05/2022.
This legal insight provides a brief of the changes and relevant requirements introduced by OJKR 40/2024, as well as target timeline that come in handy for P2P lending providers and other stakeholders (i.e., investors and customers for having better understanding on the new landscape of P2P lending activity in Indonesia and complying with the requirements in accordance with their target timelines).
Changes on Legal Entity Structure, Foreign Ownership Limitations, Controlling Shareholders
OJKR 40/2024 introduces a defined legal structure and stringent ownership limitations for P2P providers. A P2P provider must be established as a Limited Liability Company (Perseroan Terbatas) or a Cooperative (Koperasi). Even though cooperatives were recognized as P2P providers in 2016, they are reintroduced in OJKR 40/2024.
The regulation adopts a relatively open approach to ownership by allowing participation of domestic and foreign entities, including Indonesian citizens and legal entities, foreign individuals, foreign legal entities, even the central and local governments. However, this openness is counterbalanced by detailed restrictions aimed at maintaining the state oversight and regulatory control over the financial technology services. For foreign ownership, several constraints are imposed to protect the domestic financial system and encourage local participation:
a. the foreign ownership can be made if it is conducted under a "partnership" scheme with the Indonesian government, a local government, an Indonesian Individual or legal entity;
b. foreign individuals can invest through the capital market mechanism;
c. until the enactment of further implementing government regulations, a foreign ownership is capped at 85% of the P2P provider's paid-up capital; and
d. any existing P2P provider with a foreign ownership already exceeding the 85% cap prior to the enactment of OJKR 40/2024 is exempted from this limitation, provided no change of control has occurred.
Moreover, OJKR 40/2024 also introduces the 'single presence policy" in P2P Lending activities, where one party cannot become the controlling shareholder of more than one P2P providers with the same principle. A controlling shareholder can own only one conventional or Sharia-based P2P provider, except in cases where the shareholder is the Republic of Indonesia. This is to avoid market concentration and encourage diverse ownerships in the fintech ecosystem.
Additionally, OJKR 40/2024 requires controlling shareholders to commercially operate for, at least, two years before they can invest in P2P lending business. The maximum participation is the maximum shareholders' equity. This requirement does not apply if the P2P lending company is formed through merger, consolidation, or spin-off.
Higher Capitalization, Equity, Liquidity, and Financial Soundness Requirements
Based on OJKR 40/2024, the minimum paid-up capital of IDR 25 billion must be provided when a P2P provider company is established. This requirement serves both as the entry barrier and financial buffer to support the early operations and obligations of the P2P provider. Further, an existing P2P provider not yet meeting this requirement, should gradually comply with the minimum equity requirement: (a) by providing, at least, IDR7,5 billion on the issuance date of the regulation; and (b) following that, providing, at least, IDR12,5 billion by 4 July 2025. This capital requirement must be fulfilled when a change of control would occur, except if it is due to inheritance.
OJKR 40/2024 also introduces new requirements for a P2P provider to maintain its equity ratio to paid-up capital of, at least, 50%, and liquidity ratio of, at least, 120%, calculated by comparing current assets to current liabilities. A P2P provider must maintain a maximum non-performing funding ratio of 5%, and, additionally, maintain a financial soundness level with a minimum composite rating of 3 out of 5. This financial level of soundness is determined based on capital, funding quality, profitability, liquidity, and management.
These requirements must be fulfilled within one year after the issuance date of regulation, or 28 December 2025.
Direct Investment Participation
It is a new provision under OJKR 40/2024. The previous regulation did not prohibit P2P providers from making any direct investment participation, except that in (i) other financial services companies; and/or (ii) other companies engaged in related activities of P2P business activities for the maximum 20% of the P2P provider's total equity. If the direct investment participation is made within the group companies, the maximum participation will be limited to 10% of the P2P provider's total equity.
Any existing direct investment participation not complying with these new requirements, must comply within one year after the date of the issuance of OJKR 40/2024, or 28 December 2025.
New OJK Supervision Mechanism on P2P providers' Change of Ownership
In contrast to the previous OJK supervision mechanism where OJK approved any change of ownership whether or not it involved a change of control, this new regulation requires OJK to approve a change of ownership involving the change of (i) controlling shareholder of the P2P provider; or (ii) controller of such controlling shareholders of the P2P provider.
A P2P provider only reports to OJK, if the change of ownership does not change its controlling shareholder. Additionally, OJKR 40/2024 also specifies that any change of ownership via subscription of additional capital, can be made in the form of (i) cash subscription; (ii) conversion/transfer of retained earnings; (iii) conversion/transfer of loan; and/or (iv) bonus shares.
Expansion of Scope Business Activities and Introduction of Sharia Business Unit
In addition to P2P Lending core activities, such as the provisions, management, and operation of a P2P lending platform, OJKR 40/2024 allows a P2P provider to engage in other activities, such as: (i) acting as a distribution partner for government securities to support government programs (only sales offering, not any other forms of offering within the primary market); (ii) cooperating in informative service initiatives; and (iii) other activities as approved by OJK, to the extent that these activities have been included in the P2P Provider's business plan having a minimum health rating of composite 2, having an equity of, at least, of IDR 12.5 billion, and not being subject to administrative sanctions, such as business restrictions or suspensions. Further, these other business activities must be included in the articles of association of the P2P provider.
To foster the growth of P2P Lending activities through sharia financing, OJKR 40/2024 adopts new options for a P2P provider operating lending activities based on Sharia principle, through (i) a business unit led by a Head of Sharia unit and supervised by a director who is responsible for the Sharia business unit under the specific OJK license, or (ii) a separate entity established for engaging in Sharia-based P2P Lending activity. If we compare these two business models, the Sharia-based P2P lending business conducted through a business unit has less requirements, with the minimum working capital of only IDR 10 billion, establishment of the Sharia Supervisory Board, and having a separate bookkeeping.
Higher Financing Limits for Productive Funding
OJKR 40/2024 also introduces significant restrictions regarding the scope and size of financing. In a move aimed at reducing the systemic risk and protecting the consumers, the regulation caps a consumptive or productive loan at IDR 2 billion per borrower. However, a productive loan may reach up to IDR 5 billion under specific conditions that include the P2P provider maintaining the non-performing loan (NPL) ratio below 5% over a six-month period, and being free of OJK sanctions.
Other Funding Economy Benefit
It is a new provision under OJKR 40/2024. "Other Fees", which can be a new fee streams is introduced to P2P providers. OJKR 40/2024 expressly provides that the funding economy benefit may consist of: (i) interest/margin/ result distribution; (ii) administrative fees/commission fees/platform fees; and (iii) "fees", other than the penalties, stamp duty, electronic signature fees, and taxes.
Risk Mitigation and Credit Scoring
Risk management forms another pillar of OJKR 40/2024. P2P providers are mandated to carry out a range of preventive and verification activities, including thorough risk analyses on loan applications, identity verification, and collection optimization. OJKR 40/2024 introduces new approach of screening processes that must include age and minimum income levels to ensure responsible lending practices. In this case, OJK would issue regulations or guidelines on the minimum age and income limits of the prospective fund receivers/customers.
Credit scoring is a new provision under OJKR 40/2024. In the effort to mitigate the risks of nonperforming loan, P2P providers are required to do Credit Scoring of the feasibility and capability of prospective fund receivers/customers, based on the Credit Scoring Guideline, which includes:
a. Verification on the accuracy of documents based on Credit Scoring Guideline;
b. Clarification and Confirmation on the compliance with the regulations on anti-money laundering and terrorism funding, and prevention of proliferation funding weapons of mass destruction;
c. Data processing; and
d. Analysis on the prospective fund receivers/customers.
Further, the credit scoring can be assessed, based on capital, economic prospect; and/or collateral object. These requirements must be fulfilled within 6 months after the issuance date of the regulation, or 28 June 2025.
Requirement on Customers' Risk Understanding
To ensure the customers and investors understand the associated risks of P2P Lending activities, OJKR 40/2024 requires a P2P provider to conduct the following steps:
a. annotate the risk of funding alert on its electronic system;
b. annotate the risk of funding alert on its websites and platform application; and
c. understand the risk of users.
These requirements must be fulfilled within 3 months after the issuance date of the regulation, or 28 March 2025.
Additionally, a P2P provider is required to ensure that the investors or lenders understand all associated risks in providing the P2P funding to the borrowers/customers by executing the letter of understanding of investor/lender.
General Meeting of Fund Providers/Investor
As part of additional governance in carrying out the P2P Lending activity, P2P providers are also required to facilitate the "General Meeting of Fund Providers" and establish the related guidelines. This is required when there is an amendment to the funding agreement. P2P providers must establish this General Meeting of Fund Providers/Investor Guidelines within 6 months after the date of issuance of the regulation, or 28 June 2025.
Other Requirements In addition to the above, OJKR 40/2024 stipulates new requirements to provide higher legal certainty and supervision of P2P Lending activities. They are as follows:
a. Beneficial Ownership Reporting Obligation: A P2P provider must report its "Beneficial Ownership" information within 10 working days after the decision or change of beneficial owner.
b. Employment of Foreign Workers: A P2P provider must obtain prior OJK approval for the employment of foreign workers, and include them in the business plan. The maximum employment of a foreign worker is two years and it can be extended for another two years. Further, these foreigners cannot work in fields other than information technology, and they would be treated as experts at one level below the Board of Directors.
c. Change of Articles of Association: A P2P provider should report any change in its articles of association relating to the (i) name; (ii) line of business (purpose and goal); and/or (iii) domicile of the head office within 15 working days.
d. Mandatory Association Registration: A P2P provider must be registered as a member of a relevant association within 6 months after the issuance date of the license. The relevant association, in this case, is Asosiasi Fintech Pendanaan Bersama Indonesia (AFPI).
e. Expansion of Third-Party Outsourcing: A P2P provider may outsource the information technology work to a third party with the following conditions: (i) the resources code of application and server production are owned by the P2P provider; (ii) the IT is developed on behalf of the P2P provider; and (iii) it is not carried out in the deployment stage and maintenance production.
f. Use of Certified Electronic Signature: A P2P provider is required to apply for certified electronic signature in any funding documentation.
g. Additional Compliance Requirements: A P2P provider must apply the following additional compliance and prepare the same guideline on-: (i) anti-money laundering, (ii) anti-terrorism funding and prevention of proliferation funding weapons of mass destruction; and (iii) antifraud.
h. Additional Disclosure on the Primary Audit: A P2P provider is also required to disclose the primary audit on the audited annual report to OJK, except when there is general prohibition on public disclosure and it biases the public interest. In this case, the provider must first prepare the audited annual report for the financial year by 31 December 2025.
i. Additional Prohibitions: in addition to existing prohibitions, OJKR 40/2024 prohibits the P2P providers to conduct the following activities: (i) public fund collection via check accounts, savings, deposits, or similar instruments; (ii) using third-party services to manage the fund from fund providers/investors; and (iii) engaging in unhealthy practices of P2P Lending business activities.
Concluding Remarks
OJKR 40/2024 reflects comprehensive and robust efforts by the regulator to shape a wellgoverned, transparent, and resilient P2P lending ecosystem. By stipulating detailed provisions across various dimensions, ranging from requiring higher capitals, maintaining the financial soundness level, and conducting business and risk controls on data governance, the regulation seeks to strike a balance between the financial system stability and the market integrity; protecting public interest in the form of customer and personal data protection, while facilitating the economic growth through this P2P Lending activities.
These new requirements must be observed by the business actors planning to engage in P2P Lending business activities in Indonesia, in addition to the existing actors already in the business. These existing P2P providers must take into account the target timeline of compliance with OJKR 40/2024.
Additionally, all P2P providers must closely focus their attention on further guidelines relating to OJKR 40/2024. OJK would typically provide further guidance in the form of OJK circular letters.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
