The Bank Indonesia Regulation on Payment Service Providers: Reporting Obligations
Introduction
Payment Services Providers (Penyedia Jasa Pembayaran – “PJP”) engage in activities related to the provision of payment services to end-users at the front end, commonly better known as payment gateway providers, e-wallet providers, e-money issuers, issuers and acquirers of debit cards and credit cards, and fund transfer remittance operators, advisories on which can be found at these links (The Implementing Regulation of the Payment Systems Regulation: Payment Services Providers) and (The New Indonesian Umbrella Regulation on Payment Systems: Key Points that Foreign Investors Should be Aware of) which provide comprehensive overviews of PJPs, such as the scope of their activities and the licensing requirements.
To perform its supervisory function in this industry, Bank Indonesia requires PJPs to among other things, submit various reports. Previously, Bank Indonesia issued a separate regulation on each type of payment system provider, such Bank Indonesia Regulation No. 20/6/PBI/2018 for e-Money operators, Bank Indonesia Regulation No. 14/2/PBI/2012 for Card-Based Payment Instrument Activities etc., under which providers had to comply with different reporting obligations. Now, Bank Indonesia Regulation No. 23/6/PBI/2021 on Payment Services Providers (“PBI PJP”) imposes the same reporting obligation on all providers categorized as PJPs.
For failing to submit or meet the deadline for the submission of the PJP reports, the PJP will face sanctions that we explain further below. It is therefore essential to know what reporting obligations PJPs must comply with under the PBI PJP as explained further in this Advisory.
General Aspects to be Reported on
The report PJPs must submit to Bank Indonesia on their payment system operations must cover the following aspects:
- institutional;
- capital and finance;
- governance and risk management;
- information system’s capabilities; and
- other aspects determined by Bank Indonesia.
This report must be submitted to Bank Indonesia periodically and incidentally as explained further in the next sections.
Periodic Reports
The periodic reports required to be submitted under the PBI PJP include but are not limited to the following:
| No. | Type of Periodic Report | Submission Time | Example of Periodic Report Coverage | |
| 1 | Daily report | By the end of the following day | The system’s availability and for a PJP with license category one, the floating funds managed | |
| 2 | Weekly report | The Wednesday of the following week | Weekly payment transactions | |
| 3 | Monthly report | The 15th of the following month | Monthly payment transactions, fraud events, interruptions and the availability of infrastructure | |
| 4 | Quarterly report | An unaudited financial statement | ||
| 5 | Annual reports | The payment system annual report | The 15th of December of the current year | Planned and realized payment system business activities, updating the PJP’s basic data, and a self-assessment of the information system |
| 6 | The management and supervision by the Board of Commissioners report | 4 (four) months after the end of the financial year | The supervision performed by the Board of Commissioners, as well as the PJP’s governance, risk management and information system security standards | |
| 7 | The Audited Financial Statement | 6 (six) months after the end of the financial year | ||
| 8 | Information system audits and security testing by internal or external independent auditors | 10 (ten) working days after the completion of the audit report | ||
| 9 | The payment system capital calculation report | 7 (seven) months after the end of the financial year | Calculations referring to the audited financial statements for the December position and transactions processed during the financial year | |
Incidental Reports
The PBI PJP requires incidental reports on the following events to be submitted:
| No. | Type of Incidental Report | Submission Time |
| 1 | Changes to the PJP’s capital, changes to its shareholdings and control and changes to the composition of its management | Within 20 (twenty) working days of the changes being made |
| 2 | Changes to the data and information provided in the documents submitted to Bank Indonesia when applying for a license, including among others, changes to the PJP’s name, address, amendments to cooperation agreements and the dispute settlement mechanism | |
| 3 | Interruptions to processing payment transactions and the action taken, including among others any data center or disaster recovery center malfunction, network failure or fraud event | 3 (three) days after the occurrence of the event, but to be reported to Bank Indonesia within 1 (one) hour of the occurrence of the event |
| 4 | The occurrence of a force majeure event affecting payment transaction processing | |
| 5 | The results of an information system audit conducted by an independent auditor in the event of a significant change | 10 (ten) working days after the completion of the audit report |
| 6 | Other reports required by Bank Indonesia |
If the deadline for the submission of a periodic report or incidental report above falls on a Saturday, Sunday, holiday or joint leave day determined by Bank Indonesia, the report must be submitted on the following working day.
Merger, Consolidation, Separation and Acquisition Reports
The PBI PJP also requires PJPs to report a merger, consolidation, separation or acquisition. However, a non-bank PJP requires prior approval from Bank Indonesia to undertake such a corporate action. The application for Bank Indonesia’s approval and the report must provide at least the background to the corporate action, the party that will conduct the corporate action, the corporate action’s target, the corporate structure after the corporate action (including the management and shareholding structure), and the business plan for the implementation of the payment system.
If the merger, consolidation or separation is followed by changes to the members of the Board of Directors responsible for the payment system, the PJP must report the plan and Bank Indonesia will then check on the administrative matters and interview the prospective members. If in Bank Indonesia’s assessment, they are not qualified, Bank Indonesia has the right to request their replacement.
In addition, in the event of a merger between PJPs, the surviving PJP must submit a written report to Bank Indonesia if it wishes to continue to engage in its activities as a PJP and in the event of the acquisition of a PJP, the acquired PJP must also submit a written report on the acquisition to Bank Indonesia.
SANCTIONS
A PJP’s failure to submit the above payment system operation reports to Bank Indonesia will result the following sanctions:
- warnings;
- a fine, for failing to submit reports on the management and supervision performed by the Board of Commissioners, information system audits and security testing by internal or external independent auditors, or interruptions to processing payment transactions, of IDR7,500,000.00 (seven million five hundred thousand Rupiah) per report;
- a temporary suspension of some or all of the PJP’s activities including its cooperation with other parties; and/or
- the revocation of its PJP license.
***
This M&T Advisory is a digital publication prepared by the Indonesian law firm, Makarim & Taira S. It informs generally about the topics covered and should not be treated as legal advice or relied upon when making investment or business decisions. If you have any questions about any matter contained in this M&T Advisory, or any comments in general, please contact us at Publication@makarim.com.
Authors:
Kaila Arinta Nazneen – kaila.nazneen@makarim.com
Rahel Olivia Manurung – rahel.manurung@makarim.com
Maria Sagrado – maria.sagrado@makarim.com
