Bank Indonesia Regulation on Payment System Infrastructure Providers

BANK INDONESIA REGULATION NOMOR 23/ 7 /PBI/2021 ON PAYMENT SYSTEM INFRASTRUCTURE PROVIDERS BY THE BLESSINGS OF THE ALMIGHTY GOD GOVERNOR OF BANK INDONESIA, Considering : a. that payment system regulation reform aims to seek balance between efforts to optimize digital innovation opportunities to create a fast, easy, affordable, safe, and reliable payment system by observing stability, access expansion, consumer protection, sound business practices, and application of best practices; b. that payment system regulation reform needs to accommodate regulation requirements based on business model and innovation development in payment system and adjustment to the currently applicable payment system provisions; c. that development of activities in operation of payment system infrastructures demands reinforcement of infrastructure operation function performed by the authority and industry, regulation of access to industry,

-2- implementation, termination of activity operation, supervision, and processing of data and/or information on payment system; d. that based on the foregoing considerations as referred to in point a, point b, and point c, it is necessary to establish Bank Indonesia Regulation on Payment System Infrastructure Providers; Observing : 1. Law Number 23 of 1999 on Bank Indonesia (State Gazette of the Republic of Indonesia of 1999 Number 66, Supplement to State Gazette of the Republic of Indonesia Number 3843) as amended several times and last by Law Number 6 of 2009 on Establishment of Government Regulation in Lieu of Law Number 2 of 2008 on the Second Amendment to Law Number 23 of 1999 on Bank Indonesia as a Law (State Gazette of the Republic of Indonesia of 2009 Number 7, Supplement to State Gazette of the Republic of Indonesia Number 4962); 2. Bank Indonesia Regulation Number 22/23/PBI/2020 on Payment System (State Gazette of the Republic of Indonesia of 2020 Number 311, Supplement to State Gazette of the Republic of Indonesia Number 6610);

-3- HAS DECIDED: To establish : BANK INDONESIA REGULATION ON PAYMENT SYSTEM INFRASTRUCTURE PROVIDERS. CHAPTER I GENERAL PROVISIONS Article 1 In this Bank Indonesia Regulation:

1. Payment System means a system including a set of regulation, institution, mechanism, infrastructure, source of fund for payment, and access to source of fund for payment, which are used to execute fund transfer to meet an obligation arising from an economic activity.
2. Bank means any commercial bank and people’s credit bank as referred to in the Law on banking, including branch office of foreign bank in Indonesia, and sharia commercial bank and sharia rural bank as referred to in the Law on sharia banking.
3. Non-Bank Institution means non-Bank business entity lawfully established in Indonesia.
4. Payment Service Provider, hereinafter referred to as PJP, means any Bank or Non-Bank Institution providing

-4- services to facilitate payment transactions to service users. 5. Payment System Infrastructure Provider, hereinafter referred to as PIP, means a party operating infrastructures which may be used for fund transfer for the interest of its members. 6. Supporting Provider means a party cooperating with PJP and PIP to support operation of Payment System service activities. 7. Bank Indonesia-Real Time Gross Settlement, hereinafter referred to as Sistem BI-RTGS, means an infrastructure used as a means of electronic fund transfer which settlement is conducted on transaction-by-transaction basis in real-time. 8. Bank Indonesia National Clearing System, hereinafter referred to as SKNBI, means an infrastructure used by Bank Indonesia in administering fund transfers and scheduled clearing to process electronic financial data in fund transfer service, paper-based debit clearing, regular credit services, and regular debit services. 9. National Payment Gateway, hereinafter referred to as NPG, means a system which consists of the standard, switching, and services built through some arrangements to integrate different payment instruments and channels nationwide.

-5- 10. Standard Agency means an agency which prepares and manages standards in NPG. 11. Switching Agency means an agency which implements switching in NPG. 12. Services Agency means an agency which manages services function in NPG. 13. Self-Regulatory Organization in Payment System Sector, hereinafter referred to as SRO, means a forum or institution lawfully established in Indonesia which represents the industry and is determined by Bank Indonesia to support Payment System operation. 14. Systemically Payment System Provider, hereinafter referred to as PSPS, means PIP having systemic impacts on Payment System and/or financial system in the event the PIP experiences disruption or failure. 15. Critical Payment System Operator, hereinafter referred to as PSPK, means PIP having critical impacts on Payment System and/or financial system in the event the PIP experiences disruption or failure. 16. General Payment System Operator, hereinafter referred to as PSPU, means PIP which not having significant impacts on Payment System and/or financial system in the event that the PIP experiences disruption or failure. 17. Source of Fund for Payment, hereinafter referred to as Source of Fund, means Source of Fund used to meet

-6- obligations in payment transactions and administered in an account for payment. 18. Pre-transaction means an initial activity conducted to commence payment transaction processing. 19. Initiation means activity to initiate fund transfer order or instruction through device, medium, and/or a set of procedures by using certain method or technology in payment transactions, continued with forwarding payment and authorization transaction data. 20. Authorization means approval for transaction after forwarding payment transaction data by verifying or authenticating of the identity of Source of Fund owners conducting the payment transaction, validating access to Sources of Fund and the executed payment transaction, and ensuring Source of Fund adequacy. 21. Clearing means a process after a payment transaction takes place, which includes activities to reconcile, confirm, and calculate the rights and obligations of parties, indicating the final position of the rights and obligations of the parties prior to the settlement. 22. Settlement means final and binding settlement activities through debiting and crediting of accounts of the parties against the financial rights and obligations of the parties involved in the payment transaction processing based on clearing result.

-7- 23. Post-transaction means activity after settlement of payment transaction is completed. CHAPTER II ACTIVITIES AND DESIGNATION OF PAYMENT SYSTEM INFRASTRUCTURE PROVIDERS Part One Scope of Activities Section 1 PIP Activities Article 2 (1) In payment transaction processing phase, PIP conducts activities including: a. Clearing; and/or b. Settlement, for the interest of PIP members. (2) PIP members as referred to in paragraph (1) includes: a. PJP; b. other PIP; and/or c. any other parties designated by Bank Indonesia.

-8- Article 3 The Clearing Activities as referred to in Article 2 paragraph (1) point a include reconciliation, confirmation, and calculation of financial rights and obligations of PIP members prior to Settlement activities. Article 4 The Settlement activities as referred to in Article 2 paragraph (1) point b include final and binding settlement through issuance and crediting of accounts of the parties against financial rights and obligations of PIP members based on Clearing result. Article 5 To conduct the activities as referred to in Article 2 paragraph (1), PIP may conduct activities to forward payment transaction data and other tasks related to Clearing and Settlement activities.

-9- Section 2 Cooperation between PIP and Supporting Provider Article 6 PIP in Payment System operation, may cooperate with Supporting Provider. Section 3 Activities of Supporting Provider Article 7 To support PIP activities, Supporting Provider conduct activities provided that: a. payment transaction processing control remains on PIP; b. Supporting Provider may only provide technical or resolving supporting services; and c. Supporting Provider may not access and/or administering Sources of Fund. Article 8 Activities of Supporting Provider in payment transaction processing include provision of: a. technology for payment transaction processing in the following forms:

-10-

1. provision of technology for payment transaction processing including provision of technology, system, and/or platform services used by PIP in the implementation of payment transaction processing in the phases of Clearing and/or Settlement; and/or
2. provision of technology service for payment transaction processing including provision of technology for fraud management system, cloud computing, and card management system; and/or b. other supporting services activities in Payment System operation including:
3. operation services in Pre-transaction and Post￾transaction;
4. activities of product marketing and/or payment services;
5. trade through electronic system provider which facilitates the payments;
6. utilization of infrastructures and system for other PIP for payment transaction processing (white labelling); and
7. other supporting services related to implementation of PIP activities.

-11- Part Two PIP Designation Section 1 Designation as PIP Article 9 Any party acting as PIP must first obtain designation from Bank Indonesia. Article 10 The provision as referred to in Article 9 is exempted for Bank Indonesia as PIP. Article 11 (1) PIP designation is based on assessment by Bank Indonesia by considering: a. impacts on financial system stability; and/or b. public interest. (2) The impacts on financial system stability as referred to in paragraph (1) point a include but are not limited to systemic risks to the financial system arising from disruption to PIP infrastructures. (3) The public interest as referred to in paragraph (1) point b include but are not limited to PIP designation impacts

-12- in increasing the efficiency of Payment System which is beneficial for the society or public at large. Article 12 The impacts on financial system stability as referred to in Article 11 paragraph (1) point a are assessed based on an assessment by Bank Indonesia including but not limited to assessment of: a. technical, operation, and governance feasibility; b. value and frequency of the processed transaction; c. scope of service; d. interconnectedness with other PJP and/or PIP; e. scope of network provided globally in the context of cross-border payment transactions; f. impacts on national Payment System industry; and/or g. impacts on intermediation, financial access, and financial system resilience. Article 13 The public interest as referred to in Article 11 paragraph (1) point b is assessed based on an assessment by Bank Indonesia including but not limited to assessment of: a. scope of nationwide network uses ; and/or b. impacts on user’s convenience and public trust in the event of system and/or infrastructure disruption.

-13- Article 14 In the PIP designation as referred to in Article 9, Bank Indonesia may consider information and/or recommendations from SRO, the relevant authority, and/or other relevant parties. Section 2 PIP Designation Period Article 15 (1) If required, Bank Indonesia may determine PIP designation period. (2) The PIP designation period as referred to in paragraph (1) is decided based on: a. the conducted activities; and/or b. the processed Source of Fund. Section 3 PIP Designation Requirements Article 16 The party to be designated as PIP must meet requirements which include the following aspects: a. institution; b. capital and finance;

-14- c. risk management; and d. information system capability. Article 17 The institutional aspect as referred to in Article 16 point a includes entity legality, ownership, control, and management. Article 18 (1) The party to be designated as PIP must be in the form of: a. Bank; or b. Non-Bank Institution. (2) The Non-Bank Institution as referred to in paragraph (1) point b must be a limited liability company. Article 19 (1) The Non-Bank Institution as referred to in Article 18 paragraph (1) point b must at least have 1 (one) member of board of directors domiciled in the Republic of Indonesia. (2) The director of Non-Bank Institution as referred to in paragraph (1) domiciled outside the Republic of Indonesia must perform his or her functions, duties, and responsibilities as a member of board director.

-15- Article 20 (1) The member of board of directors or board of commissioners of a party to be designated as PIP may concurrently act as a member of board of directors or board of commissioners of another company provided that: a. It remains in accordance with the laws and regulations on fair business competition; and b. It does not reduce effectiveness of performance of duties and responsibilities as well as the capability and integrity as a member of board of directors or board of commissioners of a party to be designated as PIP in Payment System operation. (2) The member of board of directors or board of commissioners and shareholder of a party to be designated as PIP must meet institutional requirements, namely aspect of integrity and track record in performing functions as the management and/or shareholder including but not limited to: a. they have never been declared bankrupt and/or found guilty of causing a business entity to be declared bankrupt within the last 5 (five) years prior to submitting requirements for the designation; b. they never been convicted of a certain crime by a final and binding court decision within the last 5

-16- (five) years prior to submitting requirements for the designation; c. they are not listed in a bad debt list when submitting requirements for the designation; and d. they are not listed in a national blacklist of withdrawers of blank cheque or bilyet giro administered by Bank Indonesia when submitting requirements for the designation. (3) The shareholder as referred to in paragraph (2) is a shareholder who holds: a. shares of 25% (twenty-five percent) or higher than the number of shares issued by a party to be designated as PIP and have voting rights; or b. shares of less than 25% (twenty-five percent) of the number of shares issued by a party to be designated as PIP and have voting rights but may be proven that the person concerned have controlled the party to be designated as PIP, both directly and indirectly. Article 21 (1) Institutional aspect in the form of ownership of a party to be designated as PIP includes share ownership composition and ownership structure. (2) Institutional aspect in the form of ownership as referred to in paragraph (1) for a party to be designated as PIP in

-17- the form of Non-Bank Institution is specified under the following provisions: a. share ownership composition, at least 80% (eighty percent) of which shall be owned by:

1. Indonesian citizen; and/or
2. Indonesian legal entity; b. The calculation of foreign share ownership composition for a party to be designated as PIP in the form of Non-Bank Institution with the status of public company is conducted only with share ownership at the percentage of 5% (five percent) or more; c. for a party to be designated as PIP in the form of Non-Bank Institution with the status of public company, share ownership with the percentage below 5% (five percent) traded on the stock exchange is calculated as domestic share; d. for a Non-Bank Institution in the form of public company, share ownership with the percentage below 5% (five percent) traded on the stock exchange will be calculated as foreign share in the event that the share:
3. is traded on Indonesia stock exchange and declared to be owned by a foreign party by a party to be designated as PIP; or

-18- 2. is traded outside Republic of Indonesia; e. share ownership composition is calculated based on valid and latest proof of share ownership; f. foreign share ownership portion is calculated according to direct or indirect ownership; g. the direct ownership as referred to in point f is calculated based on 1 (one) share ownership level above the party to be designated as PIP; h. the indirect ownership as referred to in point f is calculated until the ultimate shareholder; and i. PIP submits self-assessment of ownership structure at least once a year and incidentally in the event of ownership composition change. (3) In supervising implementation of PIP activities, Bank Indonesia may determine a policy on assessment of PIP ownership composition in PIP in the form of Non-Bank Institution, including PIP in the form of public company, by considering: a. materiality scale; and/or b. other aspects to ensure the achievement of balance between innovation with stability and national interest. (4) In the event that there are any differences in assessment of share ownership composition between Bank Indonesia and a party to be designated as PIP in the form of Non-

-19- Bank Institution, the assessment of share ownership composition to be used is the share ownership composition determined by Bank Indonesia. Article 22 (1) Institutional aspect in the form of control of a party to be designated as PIP in the form of Non-Bank Institution is regulated with the following provisions: a. share composition with voting rights of at least 80% (eighty percent) must be owned by a domestic party, namely:

1. Indonesian citizen; and/or
2. Indonesian legal entity; b. assessment of Bank Indonesia on share composition with voting rights is conducted collectively on each ownership level until the ultimate shareholder with the biggest voting right individually owned by a domestic party; c. in the event that there is a special right to nominate majority members of board of directors and/or members of board of commissioners, the right must be owned by a domestic party; d. in the event that there is a special right in the form of veto right against a decision or approval in a general meeting of shareholders with significant

-20- impacts on the company, the right must be owned by a domestic party; e. Bank Indonesia may determine the institutional aspect in the form of other control based on the assessment of Bank Indonesia; f. In the event that a party to be designated as PIP has obtained an institutional license from other authorities, Bank Indonesia may determine another policy on the institutional aspect in the form of ownership and/or control; and g. the party to be designated as PIP submits self￾assessment of ownership structure at least once a year and incidentally in the event of control change. (2) In supervising implementation of PIP activities, Bank Indonesia may determine a policy to assess control in PIP in the form of Non-Bank Institution, including PIP in the form of public company, by considering: a. materiality scale; and/or b. other aspects to ensure the achievement of balance between innovation with stability and national interest. (3) In the event that there is any differences on the assessment of control is between Bank Indonesia and a party to be designated as PIP in the form of Non-Bank

-21- Institution, the assessment of control to be used is the control determined by Bank Indonesia. Article 23 (1) In processing the designation requirements as referred to in Article 16 point a, Bank Indonesia may conduct a fit and proper test. (2) Fit and proper test as referred to in paragraph (1) is conducted to: a. parties who own:

1. shares of 25% (twenty-five percent) or more than the number of shares issued by a party to be designated as PIP and have voting rights; or
2. shares of less than 25% (twenty-five percent) of the number of shares issued by a party to be designated as PIP and have voting rights but may be proven that the person concerned have controlled a party to be designated as PIP, both directly and indirectly; b. members of board of directors; and c. members of board of commissioners, of a party applying for requirements for designation as PIP.

-22- (3) Fit and proper test may be conducted by Bank Indonesia in the event of: a. plan for change of the party as referred to in paragraph (2); or b. supervision result indicating any breach, fraud, and/or business performance deterioration with significant impacts on Payment System operation by the party as referred to in paragraph (2). (4) Fit and proper test as referred to in paragraph (1) aims to ensure fulfillment of the following requirements: a. integrity; b. financial reputation; c. financial feasibility; and/or d. competence. (5) The fit and proper test as referred to in paragraph (4) may be conducted through administrative assessment and/or interview. (6) In the event that a party to be designated as PIP has obtained an institutional license and/or is under supervision of another authority, Bank Indonesia may coordinate with the authority.

-23- Article 24 (1) Requirements for designation in relation to institutional aspect must be supported by fulfillment of the following documents: a. legality of the legal entity consisting of:

1. document indicating the company’s purpose and objective, management structure, articles of association, amount of authorized capital and the latest initial capital, and the latest shareholders composition;
2. document indicating business license from the competent authority; and
3. document indicating recommendation for a party to be designated as PIP which has supervisory authority under the laws and regulations; b. ownership and control consisting of the latest document indicating ownership structure and control of a party to be designated as PIP until the latest ultimate shareholder; c. management consisting of a document indicating the management integrity containing statements of each member of board of directors, member of board of commissioners, and shareholder as referred to in Article 20 paragraph (3);

-24- d. representations and warranties from the relevant members of board of directors that a company is currently not being subject to:

1. sanctioned; and/or
2. legal proceedings in criminal, civil, and/or bankruptcy case; and e. readiness of the company’s human resources and organization, including organizational structure along with job description, authority, and responsibility, including work unit or function responsible for consumer protection, implementation of anti-money laundering and countering the financing of terrorism, risk management, internal audit, and compliance. (2) Accuracy and completeness of the documents of requirements for designation as referred to in paragraph (1) must be accompanied by: a. result of legal due diligence from an independent legal consultant; and/or b. statement letter of the relevant members of board of directors that all of the submitted documents of requirements for designation are accurate and complete according to the company’s condition.

-25- Article 25 Forms and details of the documents of requirements for designation as referred to in Article 16 and their amendments are contained in a list of requirements published on the web page of Bank Indonesia or any other media determined by Bank Indonesia. Article 26 (1) The capital and finance aspect as referred to in Article 16 point b includes minimum requirements of initial capital, feasibility analysis, and business forecasting. (2) The minimum initial capital for a party to be designated as PIP is at least Rp100,000,000,000.00 (one hundred billion rupiah). (3) PIP with global network in Indonesia is exempted from the initial capital requirement as referred to in paragraph (2) provided that it: a. is able to present a written guarantee from majority shareholders, the controlling party, and/or the party responsible for PIP operation to ensure capital adequacy; and b. only conducts PIP activities designated by Bank Indonesia. (4) Fulfillment of the initial capital requirement for a party to be designated as PIP in the form of Bank as referred

-26- to in paragraph (2) shall consider the provisions on capital fulfillment regulated by the competent authority. (5) Bank Indonesia may determine to change the minimum initial capital as referred to in paragraph (2) based on the following considerations: a. support national economic and financial policy; b. maintain national efficiency; c. protect public interest; d. maintain industrial growth; and/or e. maintain fair business competition. (6) Provisions for the change of minimum initial capital as referred to in paragraph (5) shall be regulated by Regulation of Member of Board of Governors. Article 27 The requirements for capital and finance aspect as referred to in Article 26 must be supported by fulfillment of the following documents: a. minimum initial capital requirements in the form of the documents indicating capital structure such as amount of authorized capital and the latest initial capital; b. feasibility analysis requirements in the form of documents indicating the condition, readiness, and company’s financial performance in a certain period; and c. business forecasting requirements in the form of

-27- documents indicating business feasibility calculation in implementation of Payment System activities to be conducted and the target to be achieved. Article 28 (1) The risk management aspect as referred to in Article 16 point c includes legal risk, operational risk, and liquidity risk. (2) Implementation of the risk management aspect as referred to in paragraph (1) is assessed through: a. active supervision by the board of directors and board of commissioners to a party to be designated as PIP in the form of limited liability company; b. availability of policies and procedures as well as fulfillment of organizational structure adequacy; c. risk management process and risk management function as well as human resources; and d. internal control. Article 29 The requirements for risk management aspect as referred to in Article 28 must be supported by fulfillment of documents: a. indicating the policy and procedure for implementation of management of legal risk, operational risk, and liquidity risk;

-28- b. indicating cooperation plan between a company and another party in implementation of Payment System activities to be conducted by the company, including but not limited to:

1. summary of all cooperation between a party to be designated as PIP and another party in relation to Payment System activities to be conducted; and
2. cooperation agreement or final draft of cooperation agreement with all parties cooperating in Payment System activities to be conducted; c. indicating operational policy and procedure as well as availability of instruments for consumer protection; d. indicating operational procedure for monitoring anti￾money laundering and countering the financing of terrorism; e. explaining Payment System products or activities to be conducted; f. indicating operational readiness, including standard operational procedure and specification of hardware and software in Payment System products or activities to be conducted; and g. indicating operational procedure for monitoring company liquidity in relation to implementation of Payment System activities.

-29- Article 30 The information system capability aspect as referred to in Article 16 point d shall at least be assessed through: a. procedure for security control information system; b. fraud management system; c. information system audit and security test; and d. level of capability and availability of information system. Article 31 The designation requirements for information system capability aspect as referred to in Article 30 must be equipped by documents indicating: a. procedure for security control of the system used in implementation of Payment System activities; b. procedure, mechanism, and infrastructures of fraud management system; c. result of system reliability test conducted by external and internal parties; and d. procedure, mechanism, and infrastructures of effective management of business continuity and disaster recovery.

-30- Section 4 Mechanism and Procedure for Submission of Designation Requirements Article 32 Bank Indonesia shall submit a written notice to a party to be designated as PIP to meet the requirements for designation. Article 33 A party to be designated as PIP must: a. comply with the mechanism and procedure for submission of designation requirements specified by Bank Indonesia; b. conduct self-assessment in fulfillment of completeness of documents for designation requirements; and c. submit documents for designation requirements in relation to designation aspect as requested by Bank Indonesia. Article 34 (1) The mechanism and procedure for submission of designation requirements as referred to in Article 33 point a are conducted through electronic system under Bank Indonesia Regulation on integrated license of Bank Indonesia through license front office.

-31- (2) In the event that the electronic system as referred to in paragraph (1) may not be implemented for certain designation or it experiences disruption, the mechanism and procedure for submission of designation requirements are conducted under Bank Indonesia Regulation on integrated license of Bank Indonesia through license front office. Article 35 (1) Bank Indonesia reviews fulfillment of requirements for PIP designation. (2) The review of requirements for PIP designation as referred to in paragraph (1) is conducted through the following phases: a. administrative review; and b. substance analysis of designation requirements, including feasibility analysis, and institutional aspect, capital and finance, risk management, and information system capability. (3) After the phases of review of PIP designation requirements as referred to in paragraph (2), Bank Indonesia may conduct an on-site visit to a party to be designated as PIP.

-32- Article 36 (1) In particular conditions, Bank Indonesia may omit on site visit in PIP designation process by requesting additional documents indicating operational readiness as replacement of on-site visit. (2) The particular conditions as referred to in paragraph (1) include: a. natural disasters; b. pandemic; and/or c. any other conditions determined by Bank Indonesia. Article 37 (1) To fulfill completeness of documents for designation requirements for a party to be designated as PIP, Bank Indonesia will hold: a. pre-consultative meeting; b. consultative meeting; and/or c. coaching clinic. (2) The pre-consultative meeting as referred to in paragraph (1) point a is held by Bank Indonesia and must be attended by a party to be designated as PIP.

-33- (3) Bank Indonesia holds the pre-consultative meeting as referred to in paragraph (2) in phases prior to or during submission of required documents through an electronic system. (4) Bank Indonesia holds the consultative meeting and/or coaching clinic as referred to in paragraph (1) point b and point c in the phase of revision to the required documents and checking. (5) In the event that the consultative meeting and/or coaching clinic is held by Bank Indonesia as referred to in paragraph (4), a party to be designated as PIP must attend it. Article 38 (1) The administrative review as referred to in Article 35 paragraph (2) point a is conducted under Bank Indonesia Regulation on integrated license of Bank Indonesia through license front office. (2) The substance analysis as referred to in Article 35 paragraph (2) point b is conducted under the following provisions: a. Bank Indonesia conducts an substance analysis of designation requirements within a maximum period

-34- of 20 (twenty) business days after requirement documents is accepted and declared complete by the front office license; b. in the event that the documents for designation requirements are incompliant with the analysis result by Bank Indonesia, a party to be designated as PIP must submit the revision within a maximum period of 40 (forty) business days; and c. Bank Indonesia conducts substance analysis of the designation requirements to the revision as referred to in point b within a maximum period of 20 (twenty) business days after a party to be designated PIP submits the revision. (3) Bank Indonesia rejects submission of designation requirements at the substance analysis phase as referred to in paragraph (2) in the event that: a. based on the analysis result of the required document revision as referred to in paragraph (2) point b are still incompliant; b. the revised documents as referred to in paragraph (4) point b are not submitted to Bank Indonesia by a party to be designated as PIP; or c. submission of the revised documents by a party to be designated as PIP passes the period as referred to in paragraph (2) point b.

-35- Article 39 (1) The on-site visit as referred to in Article 35 paragraph (3) is conducted within a maximum period of 20 (twenty) business days after the substance analysis as referred to in Article 35 paragraph (2) point b is declared compliant. (2) In the event that, according to the on-site visit as referred to in paragraph (1), there are findings to be revised, a party to be designated as PIP must submit a report and/or revised document to Bank Indonesia within a maximum period of 120 (one hundred twenty) business days since the completion date of the on-site visit. (3) Bank Indonesia rejects the submission of designation requirements in the on-site visit phase as referred to in Article 35 paragraph (3) in the event that: a. the report and/or revised document based on the analysis as referred to in paragraph (2) is incompliant; b. the report and/or revised document is submitted after the period as referred to in paragraph (2); or c. the report and/or revised document as referred to in paragraph (2) is not submitted by a party to be designated as PIP. (4) The rejection of submission as referred to in paragraph (3) and Article 38 paragraph (3) shall be notified by Bank Indonesia in writing.

-36- Article 40 Provisions for submission period of the report and/or revised document in the on-site visit phase as referred to in Article 39 paragraph (2) shall apply mutatis mutandis to submission of additional documents in particular conditions as referred to in Article 36 paragraph (1). Article 41 In the event that a party to be designated as PIP has conduct trials of products, activities, services, and business models in a testing environment for development of innovation for Payment System technology for Payment System and it is declared successful by Bank Indonesia, the onsite visit phase as referred to in Article 35 paragraph (3) may not be conducted. Article 42 In the event that the submission for designation of a party to be designated as PIP is rejected: a. the party to be designated as PIP may resubmit the requirements after 180 (one hundred eighty) business days as from the rejection letter date as referred to in Article 39 paragraph (4); and b. Bank Indonesia returns all submitted documents for the designation.

-37- Section 5 Authority of Bank Indonesia to Request Completeness of Designation Requirements Article 43 (1) Bank Indonesia has the authority to request a party to be designated as PIP to submit required additional data and/or information related to institutional aspect, capital and financial, risk management, and information system capability in PIP designation. (2) The request for additional documents as referred to in paragraph (1) is submitted through the web page of Bank Indonesia or any other media determined by Bank Indonesia. (3) In the event that there are needs of the additional document as referred to in paragraph (1), Bank Indonesia informs in writing or through electronic media to a party to be designated as PIP which is in the designation process.

-38- Section 6 Grant of PIP Designation Article 44 (1) Bank Indonesia grants designation for the submitted requirements of designation based on: a. result of required document review and on site visit as referred to in Article 35 and Article 36; or b. result of requirement review and the testing of development of innovation in Payment System technology declares successful as referred to in Article 35 and Article 41. (2) Bank Indonesia has the authority to determine a policy on the grant of designation as referred to in paragraph (1) based on the following considerations to: a. support national economic and financial policy; b. maintain national efficiency; c. maintain public interest; d. maintain industrial growth; and/or e. maintain fair business competition.

-39- Article 45 (1) PIP which has obtained designation must conduct its activities not later than 120 (one hundred twenty) business days commencing from the date of designation grant letter from Bank Indonesia. (2) PIP which has conducted Payment System activities must submit its realization report in writing to Bank Indonesia through the license application of Bank Indonesia. (3) In the event that the application as referred to in paragraph (2) may not be implemented or experiences disruption, the realization report will be submitted directly in accordance with the mechanism determined by Bank Indonesia. (4) The report as referred to in paragraph (2) shall be submitted not later than 10 (ten) business days from the effective date of activity commencement. (5) In the event that PIP does not conduct its activities within the period as referred to in paragraph (1), the designation granted by Bank Indonesia will be declared null and void.

-40- (6) PIP whose designation is declared null and void as referred to in paragraph (5) may resubmit designation requirements within 180 (one hundred eighty) business days at the earliest commencing from the null and void date. Article 46 Bank Indonesia publishes the names of Banks and Non-Bank Institutions which have obtained designation and have effectively conducted activities as PIP on the web page of Bank Indonesia. CHAPTER III PAYMENT SYSTEM OPERATION BY PIP Article 47 PIP consists of: a. Bank Indonesia as the Payment System Infrastructure Provider at Bank Indonesia; and b. any other party which operates Payment System infrastructures in the industry.

-41- Article 48 The other party which operates Payment System infrastructures in the industry as referred to in Article 47 point b includes NPG operators and other PIP designated by Bank Indonesia. Part One Operation of Payment System Infrastructures by Bank Indonesia Article 49 Bank Indonesia operates Payment System infrastructures of Bank Indonesia including: a. Sistem BI-RTGS; b. SKNBI; c. fast payment infrastructures of Bank Indonesia; and d. other Payment System infrastructures designated by Bank Indonesia. Article 50 Principles of Operation of payment system infrastructures by Bank Indonesia include: a. service provision in infrastructure operation; b. transactions may be conducted as real-time gross settlement or using deferred net settlement;

-42- c. settlement is permanent and may not be canceled; and d. other principles. Article 51 In operation of payment system infrastructures by Bank Indonesia, parties eligible as participants include: a. Bank Indonesia; b. Bank; c. Non-Bank Institution; and/or d. other parties. Article 52 In payment system infrastructures operation, Bank Indonesia has the authority to: a. determine participation aspects, including criteria, institution, type, requirement, participation status, and obligation; b. determine provisions and procedures for operation including provisions and procedures for infrastructure operation in normal, abnormal, emergency, and/or other conditions designated by Bank Indonesia; c. provide facilities and infrastructures for operation; d. conduct operational activities; e. determine a policy on nominal limit, operation hour, and price or cost scheme;

-43- f. make efforts to guarantee reliability, availability, and security of operation; g. monitor compliance of participants with Bank Indonesia provisions; h. impose administrative sanctions on participants; and/or i. other authorities in payment system infrastructures operation. Article 53 (1) In the operation of payment system infrastructures by Bank Indonesia, participants are required to: a. maintain smoothness and security in using Payment System infrastructures; b. be responsible for accuracy of all data, instructions, and/or information they submit to Bank Indonesia through infrastructures; c. perform agreements with Bank Indonesia if required in infrastructure operation; d. conduct operational activities of infrastructures under a system use agreement between Bank Indonesia and participants as well as other relevant Bank Indonesia provisions; e. inform transaction fees to customers in a transparent manner;

-44- f. provide data and information to Bank Indonesia on infrastructure operational activities; g. comply with the provisions issued by SRO; h. comply with other provisions for infrastructure operation by Bank Indonesia; and/or i. other obligations in the operation of payment system infrastructures by Bank Indonesia. (2) Provisions for other obligations as referred to in paragraph (1) letter i shall be regulated by Bank Indonesia regulation. (3) Participant which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: a. written warning; b. payment obligation; and/or c. decrease in participation status. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated by Regulation of Member of Board of Governors. Article 54 The participant obligations and sanction imposition as referred to in Article 53 do not apply to Bank Indonesia.

-45- Article 55 Further provisions on fast payment infrastructures of Bank Indonesia shall be regulated by Regulation of the Member of Board of Governors. Part Two NPG Operation Article 56 Bank Indonesia determines NPG policy through switching interconnection to realize national Payment System interoperability. Article 57 Scope of NPG includes domestic payment transactions including: a. switching interconnection; b. interconnection and interoperability of access to Sources of Fund in the form of payment channel including automatic teller machine, electronic data capture, agent, PJP conducting payment initiation and/or acquiring services, which make payment to goods and/or service providers, and other payment channels; and/or

-46- c. Source of Fund interoperability in the form of payment instruments such as automatic teller machine card and/or debit card, credit card, electronic money, and other payment instruments. Article 58 Parties to NPG include: a. NPG provider; and b. parties connected with NPG. Article 59 The NPG providers as referred to in Article 58 point a consist of: a. Standard Agency; b. Switching Agency; and c. Services Agency. Article 60 Parties connected with NPG as referred to in Article 58 point b include: a. PJP conducting administration of Source of Fund; b. PJP conducting payment initiation and/or acquiring services activities which exchange fund for payment to goods and/or service provider;

-47- c. PJP conducting payment initiation and/or acquiring services which process payment transactions using various instruments; and/or d. any other parties designated by Bank Indonesia. Article 61 Parties connected with NPG as referred to in Article 60 consist of: a. commercial bank; b. sharia commercial bank; and c. Non-Bank Institution. Article 62 Rural banks and sharia rural banks may be connected with NPG through commercial banks or sharia commercial banks. Article 63 In NPG operation, Bank Indonesia has the authority to: a. determine requirements and procedures for submission of designation or approval for NPG providers; b. grant designation or approval to NPG providers; c. determine functions and duties which may be performed by each NPG provider; d. determine obligations to be met by NPG providers; e. determine reportging obligations;

-48- f. determine obligations to be met by parties connected with NPG; g. determine price scheme policy; h. conduct supervision and impose administrative sanctions on NPG operators; and/or i. determine certain policies on NPG operation. Article 64 (1) The NPG provider as referred to in Article 58 point a must: a. process Settlement in Bank Indonesia; b. process domestic payment transactions through NPG; c. use national branding in accordance with the procedures determined by Bank Indonesia; d. comply with price scheme policy; e. provide service features for payment transactions processed through NPG; and/or f. comply with other obligations. (2) Provisions for other obligations as referred to in paragraph (1) point f shall be regulated by Bank Indonesia regulation. (3) NPG provider which breach the provisions as referred to in paragraph (1) is subject to the following administrative sanctions:

-49- a. warning; b. penalty; c. temporary, partial, or entire suspension of activities; and/or d. revocation of designation and/or approval as NPG providers. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated by Regulation of Member of Board of Governors. Article 65 (1) Parties connected with NPG as referred to in Article 60 must: a. become a member of at least 2 (two) Switching Institutions; b. use national branding in accordance with procedures determined by Bank Indonesia; c. provide service features for payment transactions processed through NPG; and/or d. comply with other obligations. (2) Provisions for other obligations as referred to in paragraph (1) point d shall be regulated by Bank Indonesia regulation.

-50- (3) The party connected with NPG which breach the provisions as referred to in paragraph (1) are subject to the following administrative sanctions: a. warning; b. penalty; and/or c. temporary or permanent suspension of connectivity with NPG. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated by Regulation of Member of Board of Governors. Article 66 (1) PJP conducting payment initiation and/or acquiring services which process payment transactions using various instruments may be connected indirectly with PIP designated as Switching Agency through: a. PJP conducting payment initiation and/or acquiring services activities which exchange fund for payment to goods and/or service provider; or b. PJP conducting administration of Source of Fund. (2) The indirect interconnectedness with PIP designated as Switching Agency as referred to in paragraph (1) is conducted by meeting the requirements:

-51- a. that capturing all data on PJP conducting payment initiation and/or acquiring services which process payment transactions using various instruments may remain obtained by Bank Indonesia through interconnectedness;

1. PJP conducting payment initiation and/or acquiring services which make payment to goods and/or service provider; or
2. PJP conducting administration of Source of Fund; and b. PJP conducting payment initiation and/or acquiring services which process payment transactions using various instruments may not conduct activities as conducted by PIP in payment transaction processing.

-52- Part Three Operation of Payment System Infrastructures by PIP Designated by Bank Indonesia Section 1 General Principles of Operation Article 67 (1) PIP is required to meet general principles in Payment System operation consisting of: a. operational obligation including the following aspects:

1. governance;
2. risk management including prudential principles;
3. information system security standard;
4. interconnection and interoperability; and
5. compliance with the laws and regulations; b. Bank Indonesia policy on price scheme in Payment System operation; and c. capability of human resources and organization, as well as fulfillment of code of ethics and code of conduct in sound business practices.

-53- (2) PIP which breaches the provisions as referred to in paragraph (1) is subject the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (3) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (2) shall be regulated by Regulation of Member of Board of Governors. Section 2 PIP Obligations in Payment System Operation Article 68 (1) The obligation in governance aspect as referred to in Article 67 paragraph (1) point a point 1 is fulfilled according to the following principles: a. openness; b. accountability; c. responsibility; d. independence; and e. fairness.

-54- (2) PIP applies the governance principle as referred to in paragraph (1) in every business activity. (3) Implementation of the governance principle as referred to in paragraph (1) is realized at least in: a. performance of duties and responsibilities of board of directors and board of commissioners; b. fulfillment of institutional aspect in the form of the following obligations:

1. maintain fulfillment of institutional aspect including legality of legal entities, ownership, control, and management as referred to in Article 17 until Article 22; and
2. submit an action plan in the event of breach of institutional aspect fulfillment as referred to in point 1 and must obtain approval of Bank Indonesia. c. implementation of compliance, internal audit, and external audit functions; d. implementation of risk management; e. strategic plan; and f. transparency of financial and non-financial conditions.

-55- Article 69 The fulfillment of obligation of the risk management aspect, including prudential principles, as referred to in Article 67 point a point 2 at least includes: a. active supervision by board of directors and board of commissioners; b. availability of policies and procedures as well as fulfillment of organizational structure adequacy; c. risk management process and risk management function as well as human resources; and d. internal control. Article 70 (1) The fulfillment of obligation in information system security standard aspect as referred to in Article 67 paragraph (1) point a point 3 at least includes: a. availability of written policies and procedures for information system; b. use of a safe and reliable system at least for:

1. security and protection of data confidentiality;
2. fraud management;
3. fulfillment of certification and/or standard for system security and reliability;
4. maintenance and improvement of technology security; and

-56- 5. information system availability; c. implementation of cyber security standard; d. security of data and/or information; and e. implementation of periodic information system audit. (2) The fraud management as referred to in paragraph (1) point b point 2 includes the phases of prevention, detection, resolution, and monitoring. (3) The fraud management as referred to in paragraph (2) is implemented at least by applying fraud detection system on account and transaction levels. (4) Certification and/or standard of system security and reliability as referred to in paragraph (1) point b point 3 is generally applicable certification and/or standard determined by Bank Indonesia, authority, or related institutions relevant to the types of activities conducted by PIP and/or PIP classifications. (5) The data and/or information security as referred to in paragraph (1) point d includes but is not limited to security of data and/or information related to payment instruments and payment transactions.

-57- Article 71 (1) The fulfillment of obligation in interconnection and interoperability aspect as referred to in Article 67 paragraph (1) point a point 4 at least includes: a. compliance with interconnection and interoperability mechanism, including the standard determined by Bank Indonesia; b. fulfillment of mechanism of interconnection with data infrastructure and Payment System infrastructure; and c. domestically process of payment transaction. (2) The domestically process of payment transaction as referred to in paragraph (1) point c applies to Initiation, Authorization, Clearing, and Settlement phases. (3) The domestically process of payment transaction as referred to in paragraph (2) is conducted for any transaction which: a. uses access to Sources of Fund in the form of instruments and/or services provided by PJP members; and b. is executed within the territory of the Republic of Indonesia. (4) Electronic system used for transaction processing in the phases of Initiation, Authorization, Clearing, and Settlement is placed in the data center and disaster

-58- recovery center within the territory of the Republic of Indonesia. (5) Bank Indonesia shall determine types of access to Source of Fund and implementation phases of domestically process of transactions. (6) The payment transaction may be processed outside the territory of the Republic of Indonesia to the extent it has been approved by Bank Indonesia. (7) The approval of Bank Indonesia for payment transaction processing outside the territory of the Republic of Indonesia as referred to in paragraph (6) may be granted by considering: a. the usage of electronic system and/or activities integrated with PIP head office outside the territory of the Republic of Indonesia; b. the usage of electronic system integrated with PIP head office outside the territory of the Republic of Indonesia; c. readiness level of the national industry and infrastructures; and/or d. other aspects determined by Bank Indonesia. (8) The approval of Bank Indonesia will be granted provided that the PIP guarantees that processing outside the territory of the Republic of Indonesia does not reduce the

-59- effectiveness of supervision, data collection, and protection of personal data. Article 72 The fulfillment of obligation to comply with the laws and regulations as referred to in Article 67 paragraph (1) point a point 5 at least includes: a. fair business competition; b. electronic information and transaction; c. anti-money laundering and countering the financing of terrorism; d. consumer protection; e. implementation of mandatory use of rupiah; f. personal data protection; and g. other laws and regulations. Section 3 Price Scheme Article 73 (1) Bank Indonesia determines price scheme policy in Payment System operation as referred to in Article 67 paragraph (1) point b. (2) In the determination of the price scheme policy as referred to in paragraph (1), Bank Indonesia considers:

-60- a. promoting expansion of acceptance, service, and innovation; b. increasing efficiency and competition; and/or c. observing the interest of the public and industry in a balanced manner. (3) The price scheme policy as referred to in paragraph (1) includes: a. price scheme from PIP to members; b. price scheme between PJP, PIP, and/or other relevant parties; and c. any other price schemes determined by Bank Indonesia. (4) In addition to applicable to PIP, the price scheme policy in Payment System operation as referred to in paragraph (1) must be complied with by parties cooperating with PIP. (5) Details of the price scheme as referred to in paragraph (3) are determined under a decree of the Member of Board of Governors of Bank Indonesia. (6) Bank Indonesia may evaluate the determination of price scheme policy as referred to in paragraph (1). (7) PIP is required to fulfill the principles of price transparency and fair business competition in determining price scheme in Payment System operation.

-61- (8) PIP which breaches the provisions as referred to in paragraph (7) is subject the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (9) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (8) shall be regulated by Regulation of Member of Board of Governors. Section 4 Capability of Human Resources and Organization, as well as Code of Ethics and Code of Conduct Article 74 (1) In Payment System operation, PIP is required to ensure capability of human resources and organization, as well as fulfillment of code of ethics and code of conduct of sound business practices. (2) The capability of human resources and organization, as well as fulfillment of code of ethics and code of conduct of sound business practices as referred to in paragraph

-62- (1) at least includes: a. build and ensure the capability of quality human resources and organization, including development of competency in accordance with competency standard in Payment System; and b. build integrity including reputation in realizing sound business practices. (3) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated by Regulation of Member of Board of Governors.

-63- Part Four PIP Classifications Section 1 Classifications of PSPS, PSPK, and PSPU Article 75 In Payment System operation, Bank Indonesia determines PIP classifications. Article 76 The PIP classifications as referred to in Article 75 consist of: a. PSPS; b. PSPK; and c. PSPU. Section 2 Criteria of Determination of PJP Classifications Article 77 (1) In determining the PIP classifications as referred to in Article 75, Bank Indonesia considers the following criteria: a. size; b. interconnectedness;

-64- c. complexity; and/or d. substitutability. (2) The determination of PIP classifications under the criteria as referred to in paragraph (1) aims to identify Payment System industry structures according to their roles and/or contributions to the national Payment System ecosystem. (3) The size criterion as referred to in paragraph (1) point a is the criterion which describes the size of PIP in an ecosystem measured by using performance of the processed transaction. (4) The interconnectedness criterion as referred to in paragraph (1) point b is the criterion which describes the interconnectedness between one PIP and another, PJP, and/or Supporting Providers measured by using performance of the processed transaction. (5) The complexity criterion as referred to in paragraph (1) point c is the criterion which explains the complexity of payment services provided in implementation of PIP activities. (6) The substitutability criterion as referred to in paragraph (1) point d is the criterion which describes the substitutability level of payment functions and/or services provided by PIP in implementation of PIP activities.

-65- Article 78 Bank Indonesia may use PIP classifications as considerations in determining: a. the direction of development of Bank Indonesia Payment System infrastructures; and/or b. treatment in operation of Bank Indonesia infrastructures and/or standardization policy. Article 79 (1) Bank Indonesia may determine fulfillment of certain obligations for PIP in accordance with the PIP classifications as referred to in Article 76. (2) PIP is required to meet certain obligations in accordance with the PIP classifications as referred to in paragraph (1), include the following aspects: a. capital; b. risk management and information system security standard; and c. others determined by Bank Indonesia. (3) PIP which breaches the provisions as referred to in paragraph (2) is subject to the following administrative sanctions:

-66- a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated by Regulation of Member of Board of Governors. Section 3 Payment System Capital Obligation Article 80 (1) PIP in the form Non-Bank Institution is required to meet the capital aspect as referred to in Article 79 paragraph (2) point a in the form of ongoing capital during implementation of business activities. (2) The obligation to provide ongoing capital during implementation of business activities as referred to in paragraph (1) is calculated according to the transaction nominal amount and PIP classifications. (3) The obligation to provide ongoing capital during implementation of business activities as referred to in

-67- paragraph (1) is calculated by using the ratio of Payment System capital obligation under the following provisions: a. at least 10% (ten percent) of risk-weighted transaction for all PIP classifications; and b. surcharge of capital requirements based on PIP classifications amounts to:

1. 5% (five percent) of risk-weighted transaction for PSPS; and
2. 2.5% (two point five percent) of risk-weighted transaction for PSPK. (4) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: d. warning; e. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or f. revocation of designation as PIP. (5) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (4) shall be regulated by Regulation of Member of Board of Governors. Article 81 The ongoing capital during implementation of business activities as referred to in Article 80 consists of:

-68- a. core capital including:

1. main core capital; and
2. additional core capital; and b. supplementary capital. Article 82 (1) The main core capital as referred to in Article 81 point a point 1 includes: a. capital stock; b. advance payment of capital; c. agio or disagio stock; d. current profit or loss, including accumulated profit or loss in the previous year; and e. balance of other comprehensive income. (2) The main core capital as referred to in paragraph (1) is calculated by deduction factors including: a. deferred tax asset; b. goodwill; c. intangible asset; d. all shares with ownership of more than 5% (five percent) or more; e. repurchase of capital instrument acknowledged as PIP capital components; and

-69- f. fund placement in debt instruments of other entities recognized as capital components by the issuing entity. Article 83 (1) The additional core capital as referred to in Article 81 point a point 2 includes: a. debt instruments in the following forms:

1. debt securities; and
2. subordinated loan, with no period and yield payment may not be accumulated; b. hybrid instruments with no period and yield payment may not be accumulated; c. non-cumulative preference shares with or without purchase option feature; and d. premium or discount from issuance of instruments as referred to in point a and point b. (2) The additional core capital as referred to in paragraph (1) is owned by another party which is unaffiliated. (3) The additional core capital as referred to in paragraph (1) is calculated by deduction factors including components of additional core capital which is: a. self-owned by contractual obligations; and

-70- b. owned by other parties indicated as cross holding scheme. (4) The additional core capital calculated after the deduction factors as referred to in paragraph (3) is 1/3 (one-third) at the maximum of the main core capital. Article 84 (1) The supplementary capital as referred to in Article 81 point b includes: a. long-term debt instruments, in the form of debt securities and subordinated loan with maturity of 5 (five) years and over; and b. premium or discount from issuance of instruments as referred to in point a. (2) The supplementary capital as referred to in paragraph (1) is owned by another party which is unaffiliated. (3) The supplementary capital as referred to in paragraph (1) is calculated by deduction factors including components of supplementary capital which is: a. self-owned by contractual obligations; and b. owned by other parties indicated as cross holding. (4) The supplementary capital calculated after the deduction factors as referred to in paragraph (3) is 1/3 (one-third) at the maximum of the additional core capital.

-71- Article 85 (1) The risk-weighted transaction as referred to in Article 80 paragraph (3) point a is determined 10 (ten) times of the transaction expense. (2) The transaction expense as referred to in paragraph (1) is total of the following calculation range: a. 4% (four percent) of the transaction nominal amount processed by PIP with a range up to Rp100,000,000,000.00 (one hundred billion rupiah); b. 1% (one percent) of the transaction nominal amount processed by PIP with a range above than Rp100,000,000,000.00 (one hundred billion rupiah) until Rp1,000,000,000,000.00 (one trillion rupiah); and c. 0.1% (zero point one percent) of the transaction nominal amount processed by PIP with a range above than Rp1,000,000,000,000.00 (one trillion rupiah). Article 86 The obligation to provide ongoing capital for PIP in the form of Bank means the mandatory minimum capital requirements in accordance with the laws and regulations on financial services.

-72- Article 87 (1) Bank Indonesia may determine the change of: a. the component of ongoing capital as referred to in Article 82, Article 83, and Article 84; and b. the transaction expense as referred to in Article 85 paragraph (2), by considering characteristics of activities implemented by PIP. (2) In the event that there is any difference in calculation of ongoing capital between Bank Indonesia and PIP, the calculation used as a reference shall be the calculation that determined by Bank Indonesia. (3) Provisions for the change of ongoing capital during implementation of business activities and transaction cost as referred to in paragraph (1) shall be regulated by Regulation of Member of Board of Governors. Section 4 Implementation of Risk Management and Information System Security Standard by PIP Classifications Article 88 (1) The fulfillment of obligations in risk management and information system security standard as referred to in

-73- Article 79 paragraph (2) point b for PSPS at least include the following: a. having adequate policy and standard operational procedure for risk management; b. having capability of maintaining service availability level; c. having separate internal audit unit, compliance unit, and risk management unit; d. having data center and disaster recovery center in separate locations with the same and simultaneously active information system infrastructure capacity according to business impact analysis; e. conducting a testing of disaster recovery plan for application system and supporting infrastructures of payment system to the disaster recovery center at least once a year including cyber resilience simulation; f. having fraud management system which can detect fraud activities on the level of account, network activities, and transactions; g. implementing an information technology audit by an external independent information technology auditor registered with the authority or SRO, at least once a year;

-74- h. implementing a comprehensive penetration test by an external independent information technology auditor registered with the authority or SRO, at least once a year; i. implementing a financial audit by a public accountant registered with the authority; and j. having international standard certificate on security of information on the main Payment System activities. (2) The fulfillment of obligations in risk management and information system security standard as referred to in Article 79 paragraph (2) point b for PSPK at least include the following: a. having adequate policy and standard operational procedure for risk management; b. having capability of maintaining service availability level; c. having at least an internal audit unit, a unit performing compliance function and risk management function; d. having data center and disaster recovery center in separate locations with the same information system infrastructure capacity according to business impact analysis;

-75- e. conducting a testing of disaster recovery plan for application system and supporting infrastructures of payment system to the disaster recovery center at least once a year including cyber resilience simulation; f. having fraud management system which can detect fraud activities on the level of account, network activities, and transactions; g. implementing an information technology audit by an external independent information technology auditor registered with the authority or SRO, at least once a year; h. implementing a comprehensive penetration test by an external independent information technology auditor registered with the authority or SRO, at least once a year; i. implementing a financial audit by a public accountant registered with the authority; and j. having international standard certificate on security of information on the main Payment System activities. (3) The fulfillment of obligations in risk management and information system security standard as referred to in Article 79 paragraph (2) point b for PSPU at least include the following:

-76- a. having adequate policy and standard operational procedure for risk management; b. having capability of maintaining service availability level; c. having at least an internal audit, compliance function, and risk management function; d. having data center and disaster recovery center in separate locations with the same information system infrastructure capacity according to business impact analysis; e. conducting a testing of disaster recovery plan for application system and supporting infrastructures of payment system to the disaster recovery center at least once a year including cyber resilience simulation; f. having fraud management system which can detect fraud activities on the level of account, network activities, and transactions; g. implementing an information technology audit by an external independent information technology auditor registered with the authority or SRO or internal independent information technology auditor, at least once a year; h. implementing a comprehensive penetration test by an external independent information technology

-77- auditor registered with the authority or SRO, at least once a year; i. implementing a financial audit by a public accountant registered with the authority; and j. at least adopt generally applicable practice in the industry relating to information security. (4) Further provisions on risk management application and information system by PIP classifications shall be regulated by Regulation of Member of Board of Governors. Article 89 (1) In addition to the fulfillment of obligation in risk management and information system security standard as referred to in Article 88, PIP is required to ensure the application of cyber security standard at least uses the following approaches: a. governance aspect; b. prevention aspect; and c. resolution aspect. (2) Implementation of the governance aspect as referred to in paragraph (1) point a includes: a. having framework and policy related to cyber-risk management that are separate from information technology management;

-78- b. having an independent cyber-risk management function or organ of business and information system management function; and c. ensuring the fulfillment of human resources with cyber resilience and security competence to support cyber-risk culture. (3) The implementation of the prevention aspect as referred to in paragraph (1) point b includes: a. availability of mechanism to monitor cyber resilience and security in a sustainable manner; and b. having data management capability and/or analysis of cyber resilience and security. (4) The implementation of the resolution aspect as referred to in paragraph (1) point c includes a function for cyber incident management, including supporting infrastructures according to business scale and implementation of periodic security test. (5) The implementation of the cyber security standard aspect as referred to in paragraph (1) until paragraph (4) is conducted by PIP classifications as referred to in Article 76. (6) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions:

-79- a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (7) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (6) shall be regulated by Regulation of Member of Board of Governors. Article 90 PIP in the form of Non-Bank Institution must meet the provision on the obligation to provide ongoing capital as well as risk management and information system security standard specified under this Bank Indonesia Regulation by observing the provisions on capital and risk management and information system security standard specified by other authorities. Section 5 Other Obligations Determined by Bank Indonesia Article 91 Bank Indonesia has the authority to determine obligations in other aspects as referred to in Article 79 paragraph (2) point

-80- c based on the supervision result to mitigate legal risk, operational risk, liquidity risk, and/or other risks. Section 6 Evaluation, Notice, and Deadline for Obligation Fulfillment Article 92 (1) Bank Indonesia evaluates the designated PIP classifications as referred to in Article 76. (2) The evaluation as referred to in paragraph (1) is conducted periodically at least once a year or incidentally if required. (3) For the first time, periodic evaluation as referred to in paragraph (1) is conducted not later than 1 (one) year as from determination of PIP classifications. Article 93 (1) Bank Indonesia submits a written notice to PIP of: a. result of PIP classifications; and b. evaluation result of determination of PIP classification in the event of change of PIP classifications.

-81- (2) Bank Indonesia may determine other mechanisms to notify the classification result and evaluation result as referred to in paragraph (1) to PIP. Article 94 (1) Bank Indonesia determines the deadline for obligation fulfillment according to PIP classifications based on a follow-up plan prepared by PIP. (2) The follow-up plan as referred to in paragraph (1) is required to obtain approval of Bank Indonesia. (3) Bank Indonesia may review fulfillment of the follow-up plan as referred to in paragraph (2). (4) PIP which breaches the provisions as referred to in paragraph (2) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (5) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (4) shall be regulated by Regulation of Member of Board of Governors.

-82- Part Five Activity Development, Product Development, and/or Cooperation Section 1 Scope of Activity Development, Product Development, and/or Cooperation Article 95 (1) PIP may conduct activity development, product development, and/or cooperation with other parties according to the risk category, to the extent they are approved or reported to Bank Indonesia. (2) The activity development as referred to in paragraph (1) is an addition of new activities based on the granted designation. (3) The product development as referred to in paragraph (1) consists of: a. addition or development of features; b. platform replacement; c. system replacement; d. movement of infrastructures; and/or e. other product development in Payment System operation.

-83- (4) Cooperation with other parties as referred to in paragraph (1) may be conducted with: a. other PJP and/or PIP; and/or b. Supporting Provider. Section 2 Categories of Activity Development, Product Development, and/or Cooperation Article 96 Activity development, product enhancement, and/or cooperation are categorized by the level of risks consisting of: a. low risk; b. medium risk; and c. high risk. Article 97 The activity development, product development, and/or cooperation with low risk as referred to in Article 96 point a means: a. activity development or product development with criteria affecting Pre-transaction and/or Post￾transaction phase and it will only be in the form of:

1. enhancement of the system currently in use; and/or

-84- 2. enhancement of the infrastructure currently in use; or b. cooperation with an Indonesian citizen and/or Indonesian legal entity and is not accompanied by product and/or activity development. Article 98 The activity development, product development, and/or cooperation with medium risk as referred to in Article 96 point b include: a. activity development and/or product development with the following criteria:

1. affect to the phases of Initiation, Authorization, Clearing, and/or Settlement as follows: a) enhancement of the system currently in use; and/or b) enhancement of the infrastructure currently in use; or
2. affecting Pre-transaction and/or Post-transaction as follows: a) enhancement of transaction security features; b) cross-border enhancement; and/or c) use of new system and/or infrastructure that have never been used; or

-85- b. activity development and/or product development accompanied by cooperation with criteria affecting Pre￾transaction and/or Post-transaction phase and provision of information technology solution and/or technical service by another party that has an impact on business sustainability of PIP; or c. cooperation with other than an Indonesian citizen and/or Indonesian legal entity that is not accompanied by product and/or activity development. Article 99 The activity development, product development, and/or cooperation with high risk as referred to in Article 96 point c are: a. activity development and/or product development with criteria affecting the phases of Initiation, Authorization, Clearing, and/or Settlement as follows:

1. change of transaction security features;
2. cross-border activity/product development; and/or
3. use of new system and/or infrastructure that has never been used; or b. activity development and/or product development accompanied by cooperation with criteria affecting phases of Initiation, Authorization, Clearing, and/or

-86- Settlement and provision of information technology solution and/or technical service by another party that has an impact on business sustainability of PIP. Article 100 (1) Bank Indonesia may adjust the criteria for each risk category as referred to in Article 97, Article 98, and Article 99 by considering developments of: a. innovations in business model and infrastructure; and b. complexity of activities in the industry. (2) Provisions for the adjustment to the criteria for each risk category as referred to in paragraph (1) shall be regulated by Regulation of Member of Board of Governors. Section 3 Risk Assessment of Activity Development, Product Development, and/or Cooperation Article 101 (1) PIP must first conduct self-risk assessment of the planned activity development, product development, and/or cooperation to be implemented by risk category. (2) The self-assessment as referred to in paragraph (1) is conducted by referring to the risk category as referred to

-87- in Article 96 in the format and procedure determined by Bank Indonesia and published through the license application of Bank Indonesia. (3) Bank Indonesia may determine different risk categories from the PIP self-assessment result as referred to in paragraph (2). (4) The risk category determination by Bank Indonesia as referred to in paragraph (3) must be complied by PIP. Section 4 Application of Activity Development, Product Development, and/or Cooperation Article 102 (1) Based on the risk assessment result, PIP is required to: a. submit to Bank Indonesia reports on activity development, product development, and/or cooperation if the activity development, product development, and/or cooperation meet low risk category; or b. submit to Bank Indonesia approval request for activity development, product development, and/or cooperation if the activity development, product development, and/or cooperation meet medium or high risk category.

-88- (2) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: a. warning; b. penalty; c. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or d. revocation of designation as PIP. (3) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (2) shall be regulated by Regulation of Member of Board of Governors. Article 103 (1) PIP is required to submit the reports on activity development, product development, and/or cooperation as referred to in Article 102 paragraph (1) point a. (2) The reports as referred to in paragraph (1) are submitted through the license application of Bank Indonesia not later than 10 (ten) business days after realization of the activity development, product development, and/or cooperation. (3) The mechanism and procedure for report submission as referred to in paragraph (1) are conducted under the

-89- provisions of Bank Indonesia Regulation on integrated license of Bank Indonesia through front office license. (4) In the event that the application as referred to in paragraph (2) may not be implemented or experiences disruption, the reports shall be submitted directly in accordance with the mechanism determined by Bank Indonesia. (5) The reports as referred to in paragraph (1) are submitted in Indonesian along with the supporting documents containing information on the following: a. description of the conducted activity, product, and/or cooperation; b. realization of the conducted activity, product, and/or cooperation; and c. any other documents required by Bank Indonesia. (6) The form and details of documents as referred to in paragraph (5) and their amendments are published through the web page of Bank Indonesia or any other media determined by Bank Indonesia. (7) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: a. warning; b. penalty;

-90- c. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or d. revocation of designation as PIP. (8) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (7) shall be regulated by Regulation of Member of Board of Governors. Article 104 (1) In the event that PIP submits the reports after the deadline as referred to in Article 103 paragraph (2) until the following 30 (thirty) business days, the report submission is declared as late. (2) In the event that PIP submits the reports after the deadline as referred to in paragraph (1), PIP will be declared as not submitting the reports to Bank Indonesia. (3) PIP which is declared as late in submitting the reports as referred to in paragraph (1) is subject to an administrative sanction in the form of penalty amounting to Rp500,000.00 (five hundred thousand rupiah) per delayed business day per report. (4) PIP which does not submit or is declared as not submitting the reports as referred to in paragraph (2) is

-91- subject to an administrative sanction in the form of penalty amounting to Rp20,000,000.00 (twenty million rupiah) per report. (5) The mechanism of penalty payment as referred to in paragraph (3) and paragraph (4) is conducted through: a. debiting of giro account at Bank Indonesia; b. fund transfer to an account determined by Bank Indonesia; or c. any other payment mechanisms determined by Bank Indonesia. (6) Further provisions on the penalty payment mechanism as referred to in paragraph (5) shall be regulated by Regulation of Member of Board of Governors. Article 105 (1) Bank Indonesia reviews any approval request for activity development, product development, and/or cooperation. (2) The approval request review as referred to in paragraph (1) is conducted through the following phases: a. administrative review; b. analysis of business model of the planned activity development, product development, and/or cooperation; and c. substance analysis against fulfillment of requirements based on the submitted documents.

-92- (3) After the phase of approval request review as referred to in paragraph (2), Bank Indonesia may conduct an on￾site visit. (4) Bank Indonesia grants approval for the submitted application based on: a. result of the approval request review as referred to in paragraph (2); or b. result of the approval request review as referred to in paragraph (2) and on site visit as referred to in paragraph (3). (5) Bank Indonesia has the authority to determine a policy on approval for activity development, product development, and/or cooperation with other parties as referred to in paragraph (4) based on the following considerations to: a. support national economic and financial policy; b. maintain national efficiency; c. protect public interest; d. maintain industrial growth; and/or e. maintain fair business competition. Article 106 (1) In particular conditions, Bank Indonesia may omit on site visit in approval process for activity development, product development, and/or cooperation by requesting

-93- additional documents indicating operational readiness to replace the on-site visit. (2) The particular conditions as referred to in paragraph (1) include: a. natural disasters; b. pandemic; and/or c. any other conditions determined by Bank Indonesia. Article 107 (1) The application of approval request for activity development, product development, and/or cooperation in medium risk and high-risk categories is submitted through the license application of Bank Indonesia. (2) The mechanism and procedure for approval request processing, including administrative review, are conducted under the provisions of Bank Indonesia Regulation on integrated license of Bank Indonesia through front office license. (3) In the event that the application as referred to in paragraph (1) may not be implemented or experiences disruption, the application of approval request shall be submitted directly in accordance with the mechanism determined by Bank Indonesia.

-94- Article 108 (1) The mechanism and procedure for approval request processing of activity development, product development, and/or cooperation in high-risk category are specified as follows: a. Bank Indonesia may conduct a pre-consultative meeting for PIP on fulfillment of documents required for the approval request, prior to the application submission; and b. Bank Indonesia may conduct a consultative meeting and/or coaching clinic for PIP in the phase of document revision and review. (2) PIP conduct self-assessment of the planned activity development, product development, and/or cooperation to be implemented by risk category. (3) After the approval request documents are declared complete and correct based on the administrative review as referred to in Article 107 paragraph (2), Bank Indonesia conducts analysis of business model and analysis of substance of approval requirements within 20 (twenty) business days at the maximum. (4) In the event that the document of approval request requirements does not meet the requirements based on the analysis of business model and analysis of substance as referred to in paragraph (3), PIP must revise the

-95- documents and submit them to Bank Indonesia within 40 (forty) business days at the maximum. (5) Bank Indonesia conducts analysis of substance of approval requirement within 20 (twenty) business days at the maximum after PIP submits the revised documents as referred to in paragraph (4). Article 109 (1) The on-site visit as referred to in Article 105 paragraph (3) is conducted within 20 (twenty) business days at the maximum after a notice is delivered to PIP stating that the approval request documents are declared to meet the requirements. (2) In the event that there is any finding based on the on￾site visit as referred to in paragraph (1), PIP must make revision according to the review findings and submit the revision evidence to Bank Indonesia within 120 (one hundred twenty) business days as from the completion date of the on-site visit. (3) Provisions for submission period of the revised document in the review phase as referred to in paragraph (2) shall apply mutatis mutandis to submission of additional documents in particular conditions as referred to in Article 106 paragraph (1).

-96- Article 110 (1) Bank Indonesia declines the approval request in the phase of analysis of business model and analysis of substance and/or on site visit if: a. based on the analysis of business model and analysis of substance of the revised documents as referred to in Article 108 paragraph (4), the documents do not meet the requirements; b. based on the analysis of revised report after on site visit as referred to in Article 109 paragraph (2), the documents are still incompliance; or c. the revised documents are not submitted by PIP to Bank Indonesia within the period as referred to in Article 108 paragraph (4) or Article 109 paragraph (2). (2) The decline of the approval request as referred to in paragraph (1) shall be notified by Bank Indonesia to the applicant in writing. (3) If Bank Indonesia decline the approval request as referred to in paragraph (1): a. PIP may resubmit the approval request after 180 (one hundred eighty) business days as from the decline letter date as referred to in paragraph (2); and

-97- b. Bank Indonesia returns all submitted approval request documents. Article 111 (1) The mechanism and procedure for approval request processing of activity development, product development, and/or cooperation in medium risk category are specified as follows: a. Bank Indonesia may conduct a pre-consultative meeting for PIP on fulfillment of documents required for the approval request, prior to the approval request submission; and/or b. Bank Indonesia may conduct a consultative meeting for PIP in the document revision phase. (2) PIP conducts self-assessment of the planned activity development, product development, and/or cooperation to be implemented by risk category. (3) After the approval request documents are declared complete and correct based on the administrative review as referred to in Article 107 paragraph (2), Bank Indonesia conducts the analysis of business model and the analysis of substance of approval request within 20 (twenty) business days at the maximum. (4) In the event that the approval request substance does not meet the requirements based on the analysis of

-98- business model and the analysis of substance as referred to in paragraph (3), PIP must revise the documents and submit them to Bank Indonesia within 30 (thirty) business days at the maximum. (5) Bank Indonesia conducts the analysis of substance of approval requirements within 20 (twenty) business days at the maximum after PIP submits the revised documents as referred to in paragraph (4). Article 112 (1) Bank Indonesia declines the approval request in the phase of the analysis of business model and the analysis of substance if: a. based on the result of the analysis of business model and the analysis of substance of the revised documents as referred to in Article 111 paragraph (4), the documents are incompliance; or b. the revised documents are not submitted by PIP to Bank Indonesia within the period as referred to in Article 111 paragraph (4). (2) The decline of the approval request as referred to in paragraph (1) shall be notified by Bank Indonesia to the applicant in writing. (3) In the event that Bank Indonesia declines the approval request as referred to in paragraph (1):

-99- a. PIP may resubmit the approval request after 180 (one hundred eighty) business days as from the decline letter date as referred to in paragraph (2); and b. Bank Indonesia returns all submitted approval request documents. Article 113 Processing of reports on activity development, product development, and/or cooperation in low-risk category is specified as follows: a. PIP conducts self-assessment of the planned activity development, product development, and/or cooperation to be implemented by risk category; b. Bank Indonesia checks completeness of reporting documents within 10 (ten) business days at the maximum as from the is received in the license application of Bank Indonesia; c. Bank Indonesia conducts an administrative review of the request as referred to in point b; d. based on the administrative review result, in the event that any of the submitted documents are incomplete and/or inaccurate, Bank Indonesia shall inform to PIP to complete and/or revise the documents within 14 (fourteen) calendar days at the maximum; and

-100- e. after the required reporting documents are declared complete and accurate based on the administrative review, Bank Indonesia accepts the report from PIP. Article 114 (1) The submission of approval request for activity development, product development, and/or cooperation with supporting documents to meet the requirements includes the following aspects: a. operational readiness; b. system security and reliability; c. implementation of risk management; and d. consumer protection. (2) In addition to the supporting documents as referred to in paragraph (1), Bank Indonesia may consider the supervision result of PIP performance. (3) If required, Bank Indonesia may request PIP to submit any required additional data and/or information. (4) Bank Indonesia submits the request for additional data and/or information as referred to in paragraph (3) in writing or by electronic media to PIP which is in the process of approval.

-101- Article 115 Requirements for operational readiness aspect for activity development and/or product development in high risk category are accompanied by fulfillment of documents which at least indicate: a. recommendation for PIP which has supervisory authority under the laws and regulations; b. recommendation for PIP from an institution or organ that has an authority to stipulate fatwa in sharia sector for the planned activity development and/or product development under sharia principles; c. complete explanation of business model or transaction flow; d. sustainable business feasibility and potential; and e. operational readiness. Article 116 Requirements for operational readiness aspect for activity development and/or product development accompanied by cooperation with high risk category are accompanied by fulfillment of documents which at least: a. indicate recommendation for PIP which has supervisory authority under the laws and regulations; b. indicate recommendation for PIP from an institution or organ that has an authority to stipulate fatwa in sharia

-102- sector for the planned activity development and/or product development under sharia principles; c. indicate complete explanation of business model or transaction flow; d. indicate sustainable business feasibility and potential; e. indicate operational readiness; f. indicate cooperation agreement between PIP and the cooperating party; and g. especially for cooperation with Supporting Provider, the documents shall include:

1. indication of assessment result of PIP against the Supporting Provider in relation to its ability to its ability to provide the service to be cooperated;
2. indication that PIP is fully responsible for secure and smooth payment transaction processing; and
3. if required, Bank Indonesia may request additional documents to strengthen the assessment result as referred to point 1 indicating the capability of Supporting Provider in providing services. Article 117 Requirements for system security and reliability aspect for activity development and/or product development in high risk category are accompanied by fulfillment of documents which at least indicate:

-103- a. security control procedure for the system used; b. audit result of information system and security test from an internal or external independent auditor; c. fraud management infrastructure; and d. procedure, mechanism, and infrastructures of effective management of business continuity and disaster recovery. Article 118 Requirements for system security and reliability aspect for activity development and/or product development with cooperation in high risk category must be fulfilled by submitting documents which at least indicate: a. security control procedure for the system used; b. audit result of information system and security test from an internal or external independent auditor; c. fraud management infrastructure; d. procedure, mechanism, and infrastructures of effective management of business continuity and disaster recovery; and e. PIP assessment result of system security and reliability of a party to be invited for cooperation.

-104- Article 119 Requirements for implementation of risk management aspect for activity development and/or product development in high risk category are accompanied by fulfillment of documents which at least indicate: a. policy and procedure for implementation of risk management; b. operational procedure for monitoring anti-money laundering and countering the financing of terrorism; c. procedure and mechanism of fraud management; and d. assessment result of arising risk exposure and risk mitigation. Article 120 Requirements for implementation of risk management aspect for activity development and/or product development with cooperation in high risk category are accompanied by the fulfillment of documents which at least indicate: a. policy and procedure for risk management application; b. operational procedure for monitoring anti-money laundering and countering the financing of terrorism; c. procedure and mechanism of fraud management; and d. assessment result of arising risk exposure and risk mitigation.

-105- Article 121 Requirements for consumer protection aspect for activity development and/or product development in high risk category are accompanied by fulfillment of documents which at least indicate: a. policy and operational procedure for consumer protection; b. transparency of activities or products developed for the user; c. procedure and mechanism to handle and settle consumer complaints; and d. PIP obligations to maintain the security and confidentiality of customer data. Article 122 Requirements for consumer protection aspect for activity development and/or product development in high risk category are accompanied by fulfillment of documents which at least indicate: a. policy and operational procedure for consumer protection; b. transparency of activities or products developed for the user; c. procedure and mechanism to handle and settle consumer’s complaints;

-106- d. PIP obligations to maintain the security and confidentiality of customer data; and e. obligations of a party to be invited for cooperation to maintain the security and confidentiality of consumer’s data. Article 123 Requirements for operational readiness aspect for activity development and/or product development in medium risk category are accompanied by fulfillment of documents which at least indicate: a. recommendation for PIP which has supervisory authority under the laws and regulations; b. recommendation from an institution or organ that has an authority to stipulate fatwa in sharia sector for the planned activity development and/or product development under sharia principles; c. complete explanation of business model or transaction flow; d. sustainable business feasibility and potential; and e. operational readiness.

-107- Article 124 Requirements for operational readiness aspect for cooperation in medium risk category are accompanied by fulfillment of documents which at least: a. indicate recommendation for PIP which has supervisory authority under the laws and regulations; b. indicate recommendation from an institution or organ that has an authority to stipulate fatwa in sharia sector for the planned activity development and/or product development under sharia principles; c. indicate complete explanation of business model or transaction flow of the cooperation to be implemented; d. indicate cooperation agreement between PIP and the cooperating party; and e. especially for cooperation with Supporting Provider, the accompanying documents shall:

1. indicate assessment result of PIP against the Supporting Provider in relation to its ability to provide the service to be cooperated;
2. indicate that PIP is fully responsible for security and smoothness of payment transaction processing; and

-108- 3. if required, Bank Indonesia may request additional documents to strengthen the assessment result as referred to in point 1 indicating the capability of Supporting Provider in providing services. Article 125 Requirements for operational readiness aspect for activity development and/or product development with cooperation in medium risk category are accompanied by fulfillment of documents which at least: a. indicate recommendation for PIP which has supervisory authority under the laws and regulations; b. indicate recommendation from an institution or organ that has an authority to stipulate fatwa in sharia sector for the planned activity development and/or product development under sharia principles; c. indicate complete explanation of business model or transaction flow; d. indicate sustainable business feasibility and potential; e. operational readiness; f. indicate cooperation agreement between PIP and the cooperating party; and g. especially for cooperation with Supporting Provider, the accompanying documents shall:

-109-

1. indicate assessment result of PIP against the Supporting Provider in relation to its ability to provide the service to be cooperated;
2. indicate that PIP is fully responsible for security and smoothness of payment transaction processing; and
3. if required, Bank Indonesia may request additional documents to strengthen the assessment result as referred to in point 1 the capability of Supporting Provider in providing services. Article 126 Requirements for system security and reliability aspect for activity development and/or product development in medium risk category are accompanied by fulfillment of documents which at least indicate: a. audit result of information system and/or security test from an internal or external independent auditor; b. PIP assessment result of activity development and/or product development impacts on change of procedures for security control, fraud management system, as well as the procedure, mechanism, and infrastructure of management of business continuity and disaster recovery; and

-110- c. result of adjustment to the procedure and mechanism based on the assessment result as referred to in point b. Article 127 Requirements for system security and reliability aspect for cooperation in medium risk category are accompanied by documents which at least indicate PIP assessment result of system security and reliability of a party to be invited for cooperation. Article 128 Requirements for system security and reliability aspect for activity development and/or product development with cooperation in medium risk category are accompanied by fulfillment of documents which at least indicate: a. audit result of information system and/or security test from an internal or external independent auditor; b. PIP assessment result of activity development and/or product development impacts on change of procedures for security control, fraud management system, as well as the procedure, mechanism, and infrastructure of management of business continuity and disaster recovery; c. PIP assessment result of system security and reliability of a party to be invited for cooperation; and

-111- d. result of adjustment to the procedure and mechanism based on the assessment result as referred to in point b. Article 129 Requirements for implementation of risk management aspect for activity development and/or product development in medium risk category are accompanied by fulfillment of documents which at least indicate: a. assessment result of arising risk exposure and risk mitigation; b. assessment result of the procedure for monitoring anti￾money laundering or countering the financing of terrorism as well as procedure and mechanism of fraud management; and c. result of adjustment to the procedure and mechanism based on the assessment result as referred to in point b. Article 130 Requirements for implementation of risk management aspect for cooperation in medium risk category are accompanied by fulfillment of documents which at least indicate: a. assessment result of risk exposure arising from the cooperation and risk mitigation; b. assessment result of the procedure for monitoring anti￾money laundering or countering the financing of

-112- terrorism as well as procedure and mechanism of fraud management; and c. result of adjustment to the procedure and mechanism based on the assessment result as referred to in point b. Article 131 Requirements for implementation of risk management aspect for activity development or product development with cooperation in medium risk category are accompanied by fulfillment of documents whichat least indicate: a. assessment result of arising risk exposure and risk mitigation; b. assessment result of the procedure for monitoring anti￾money laundering or countering the financing of terrorism as well as procedure and mechanism of fraud management; and c. result of adjustment to the procedure and mechanism based on the assessment result as referred to in point b. Article 132 Requirements for consumer protection aspect for activity development and/or product development in medium risk category are accompanied by fulfillment of documents which at least indicate:

-113- a. transparency of activities or products developed for the users; b. PIP obligations to maintain the security and confidentiality of customer data; c. PIP assessment result on activity development and/or product development impacts on change of policy and operational procedure for consumer protection as well as procedure and mechanism to handle and settle consumer’s complaints; and d. result of adjustment to the procedure and mechanism based on the assessment result as referred to in point c. Article 133 Requirements for consumer protection for cooperation in medium risk category are accompanied by fulfillment of documents which at least indicate obligations of a party to be invited for cooperation to maintain the security and confidentiality of customer data. Article 134 Requirements for consumer protection aspect for activity development and/or product development with cooperation in medium risk category must be fulfilled fulfilled by submitting documents which at least indicate:

-114- a. transparency of activities or products developed for the users; b. PIP obligations to maintain the security and confidentiality of customer data; c. obligations of a party who is invited for cooperation to maintain the security and confidentiality of consumer’s data. d. PIP assessment result on activity development and/or product development and cooperation impacts on change of policy and operational procedure for consumer protection as well as procedure and mechanism to handle and settle consumer complaints; and e. result of adjustment to the procedure and mechanism based on the assessment result as referred to in point d. Article 135 (1) In the event that there is any approval request for cooperation as part of activity development and/or product development in medium risk or high risk category, PIP shall submit it in 1 (one) approval request. (2) The PIP as referred to in paragraph (1) is a PIP which conducts activity development and/or product development.

-115- (3) The PIP as referred to in paragraph (2) must ensure fulfillment of required documents for approval request from a party to be invited for cooperation. Article 136 Forms and details of the required documents for the approval request as referred to in Article 115 to Article 135 and their amendments are contained in a list of requirements published on the web page of Bank Indonesia or any other media determined by Bank Indonesia. Article 137 (1) PIP is required to be responsible for the validity and accuracy of all documents, data, information, reports, details, and/or explanation submitted to Bank Indonesia for application of activity development, product development, and/or cooperation. (2) In the event that any evidence is found that the submitted documents, data, and/or information as referred to in paragraph (1) are invalid and/or inaccurate, Bank Indonesia has the authority to revoke any granted approval and/or apply any other further actions to the supervision.

-116- (3) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated in Regulation of Member of Board of Governors. Article 138 (1) In the event that any approval request for cooperation between PIPs or between PIP and PJP, the approval request shall be submitted by one of the PIP or PJP which: a. has the system or infrastructure; or b. has been agreed between PIPs or between PIP and PJP to enter into the cooperation. (2) Bank Indonesia may determine the PIP or PJP which will apply for cooperation approval.

-117- Article 139 (1) Bank Indonesia may determine a policy on processing an approval for activity development, product development, and/or cooperation in order to: a. support implementation of national economy and financial programs; and/or b. maintain industry’s efficiency and growth. (2) The policy on processing as referred to in paragraph (1) is conducted through: a. granting conditional approval; and/or b. determining the requirements for different approval processing. (3) The conditional approval as referred to in paragraph (2) point a must be accompanied by a statement of commitment including: a. fulfillment of operational system security and reliability by implementing risk mitigation; b. no disruption, procedural error, or fraud; c. no breach of the principles of consumer protection and anti-money laundering and countering the financing of terrorism; and d. compliance with the laws and regulations. (4) The conditional approval as referred to in paragraph (2) point a shall be granted after documents are declared accurate and complete based on administrative review.

-118- (5) The conditional approval as referred to in paragraph (4) is granted for 6 (six) months at the maximum. (6) Within the 6 (six) months as referred to in paragraph (5), PIP is required to meet the following requirements and approval phases: a. analysis of business model of the planned activity development, product development, and/or cooperation; b. substance analysis against fulfillment of requirements based on the submitted documents; c. on site visit if required. (7) In the event that PIP does not meet the requirements and phases as referred to in paragraph (6), Bank Indonesia shall revoke the conditional approval. (8) PIP which breaches the provisions as referred to in paragraph (6) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (9) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (8) shall

-119- be regulated in Regulation of Member of Board of Governors. Article 140 (1) The determination of the requirements for different approval processing as referred to in Article 139 paragraph (2) point b may be granted provided that the approval processing is conducted according to the phases as referred to in Article 105. (2) The determination of the requirements for different approval processing as referred to in paragraph (1) may be granted after: a. PIP obtains good rating in risk management assessment from Bank Indonesia; b. PIP participates in the testing of development of innovation in Payment System technology conducted by Bank Indonesia and is declared successful; c. activity development, product development, and/or cooperation have obtained recommendation from SRO that is conducted to meet the national standard determined by Bank Indonesia; and/or d. meets any other aspects designated by Bank Indonesia.

-120- Article 141 (1) PIP which has obtained approval must conduct its activities maximum 120 (one hundred twenty) business days as from the date of approval grant letter from Bank Indonesia. (2) PIP which has obtained the approval as referred to in paragraph (1) is required to submit its realization report in writing to Bank Indonesia through the license application of Bank Indonesia. (3) In the event that the application as referred to in paragraph (2) may not be implemented or experiences disruption, the realization report is submitted directly by the mechanism determined by Bank Indonesia. (4) The report as referred to in paragraph (2) shall be submitted not later than 10 (ten) business days as from the effective date of activity commencement. (5) In the event that PIP does not conduct its activities within the period as referred to in paragraph (1), the approval granted by Bank Indonesia shall be declared null and void. (6) PIP whose the approval is declared null and void as referred to in paragraph (5) may resubmit an approval request within 180 (one hundred eighty) business days at the earliest as from the null and void date.

-121- (7) PIP which breaches the provisions as referred to in paragraph (2) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (8) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (7) shall be regulated in Regulation of Member of Board of Governors. Article 142 (1) PIP which has conducted activity development, product development, and/or cooperation in medium risk or high risk category without the approval of Bank Indonesia is subject to an administrative sanction in the form of penalty amounting to Rp30,000,000.00 (thirty million rupiah) for each activity development, product development, and/or cooperation conducted without obtaining the approval of Bank Indonesia. (2) The mechanism of penalty payment as referred to in paragraph (1) is applied through:

-122- a. debiting of giro account at Bank Indonesia; b. fund transfer to an account determined by Bank Indonesia; or c. any other payment mechanisms determined by Bank Indonesia. (3) Further provisions on the penalty payment mechanism as referred to in paragraph (2) shall be regulated by Regulation of Member of Board of Governors. Section 5 PIP Responsibilities in Cooperation with Supporting Provider Article 143 (1) PIP cooperating with Supporting Providers must: a. assess the Supporting Provider; and b. be fully responsible for the security and smoothness of payment transaction processing. (2) The minimum responsibilities for security and smoothness of payment transaction processing as referred to in paragraph (1) point b shall be conducted at least by: a. having a mechanism for monitoring of Supporting Provider performance; b. ensuring implementation of risk management; and

-123- c. ensuring availability of access to Supporting Provider for Bank Indonesia. Article 144 The assessment of Supporting Provider as referred to in Article 143 paragraph (1) point a is conducted prior to the cooperation implementation to at least ensure: a. legality and profile of Supporting Provider; b. performance of Supporting Provider; c. fulfillment of security and reliability principle of information system and infrastructures; d. capability or competency of Supporting Providers; and e. compliance with the laws and regulations. Article 145 PIP must conduct periodic evaluation on the performance of Supporting Provider. Article 146 (1) The implementation of risk management by Supporting Provider as referred to in Article 143 paragraph (2) point b in the form of periodic information system audit implementation, strengthening of business continuity plan, and mitigation of single point of failure.

-124- (2) Implementation of risk management is conducted in an integrated manner in each phase of Supporting Provider use in the process of planning, procurement, development, operation, maintenance, until termination of cooperation. Article 147 PIP must ensure availability of access for Bank Indonesia to data or information, system and infrastructure, and human resources of Supporting Providers. Article 148 Bank Indonesia may request PIP to terminate or not to extend any cooperation with another party in the event that the cooperation: a. breaches the laws and regulations; b. does not contribute to development of fast, easy, affordable, safe, and reliable payment system; and/or c. may potentially be detrimental to or decrease the performance of PIP.

-125- Section 6 Implementation of Cooperation between PIP and Supporting Provider and/or Payment System Service Provider Outside the Territory of the Republic of Indonesia Article 149 (1) In addition to considering the fulfillment of cooperation requirements, in the event that there is a request to enter into cooperation by PIP and Supporting Provider and/or Payment System service providers outside the territory of the Republic of Indonesia, Bank Indonesia may consider the following: a. reciprocal aspect; b. equal standard for risk management implementation; and/or c. benefits for the economy of Indonesia. (2) The consideration as referred to in paragraph (1) observes PIP classifications. Part Six Policy on Single Ownership and Value which May be Equated to Money Article 150 (1) Any party is prohibited from owning:

-126- a. shares of 25% (twenty-five percent) or higher than the number of shares issued by PIP and have voting rights; or b. shares of less than 25% (twenty-five percent) of the number of shares issued by PIP and have voting rights but may be proven that they have control over the PIP, both directly and indirectly, in more than 1 (one) Non-Bank Institution, each of which has designation as PIP and/or license as PJP. (2) The party as referred to in paragraph (1) is required to ensure fulfillment of its PIP capital. (3) PIP which breaches the provisions as referred to in paragraph (1) and paragraph (2) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated in Regulation of Member of Board of Governors.

-127- Article 151 (1) PIP in the form of Non-Bank Institution is prohibited from taking any corporate actions resulting in a change of parties who hold: a. shares of 25% (twenty-five percent) or higher than the number of shares issued by PIP and have voting rights; or b. shares of less than 25% (twenty-five percent) of the number of shares issued by PIP and have voting rights but may be proven that they have control over the PIP, both directly and indirectly, for 5 (five) years as from the designation is first granted except with the approval of Bank Indonesia. (2) The approval of Bank Indonesia as referred to in paragraph (1) is granted for: a. fulfillment of provisions and/or further action to the supervision by Bank Indonesia; and/or b. capital strengthening to increase provider performance which is not intended as designation transfer to obtain certain benefits. (3) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions:

-128- a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated in Regulation of Member of Board of Governors. Article 152 (1) PIP is prohibited from: a. accepting any virtual currency used as a Source of Fund in payment transaction processing; b. processing any payment transaction by using virtual currency as a Source of Fund; and/or c. connecting any virtual currency to payment transaction processing. (2) PIP is prohibited from facilitating trade of virtual currency as a commodity except that is regulated in accordance with the provisions of laws and regulations. (3) PIP which breaches the provisions as referred to in paragraph (1) and/or paragraph (2) is subject to the following administrative sanctions: a. warning;

-129- b. penalty; c. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or d. revocation of designation as PIP. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated in Regulation of Member of Board of Governors. Part Seven Corporate Actions, Change of Ownership, and Change of Control of PIP Article 153 (1) In the event that PIP conducts corporate actions in the form of merger, consolidation, spin-off, and/or acquisition of PIP, the following provisions shall apply: a. PIP in the form of Non-Bank Institution is required to first obtain approval from Bank Indonesia; and b. PIP in the form of Bank is required to submit a report to Bank Indonesia. (2) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions:

-130- a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (3) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (2) shall be regulated in Regulation of Member of Board of Governors. Article 154 The approval request and report as referred to in Article 153 shall at least contain the following information: a. background of the corporate action; b. party that will conduct the corporate action; c. targeted time of the corporate action; d. management structure, share ownership structure, and corporate ownership structure after the corporate action; and e. business plan for Payment System service provider after the corporate action. Article 155 (1) In the event of merger, consolidation or spin-off with change of members of board of directors responsible for

-131- the operation of Payment System, the proposed changes must be first reported to Bank Indonesia. (2) Based on the result of report as referred to in paragraph (1), Bank Indonesia may request the substitution of prospective members of board of directors. (3) The substitution of prospective members of board of directors as referred to in paragraph (2) shall be conducted in the event that Bank Indonesia assesses that the prospective members of board of directors does not meet the requirements. (4) The assessment by Bank Indonesia as referred to in paragraph (3) may be based on information obtained from the result of administrative examinations and interviews with the prospective members of board of directors. Article 156 (1) For PIP merging with other PIP, the surviving PIP must report in writing to Bank Indonesia in the event that it intends to continue its activities as PIP. (2) In the event of PIP acquisition, PIP designation remains inherent in the acquired Bank or Non-Bank Institution. (3) The acquired PIP as referred to in paragraph (2) must report in writing to Bank Indonesia regarding the acquisition.

-132- (4) A legal entity resulting from merger, consolidation or spin-off which has not obtain designation as PIP must first obtain designation from Bank Indonesia in the event that it intends to conduct activities as PIP. Article 157 The mechanism, format, and procedure for approval and reporting as referred to in Article 153 shall be further regulated in the Regulation of Member of Board of Governors. Part Eight Operation of Integrated Payment Interface Article 158 Bank Indonesia may operate integrated payment interface infrastructure that connects access to Sources of Fund with PJP to forward the process of payment Initiation and/or Authorization of payment transactions. Article 159 (1) In the operation of integrated payment interface as referred to in Article 158, Bank Indonesia has the authority to determine, including but not limited to, the following: a. price and cost scheme;

-133- b. parties connecting with the integrated payment interface; c. access to Source of Fund to be processed through integrated payment interface; d. interconnectedness with Payment System infrastructure and data infrastructure determined by Bank Indonesia; e. features and service types of integrated payment interface, such as a function to facilitate payment processing and collection of data and/or information; and/or f. other aspects related to access, standard, security, branding, implementation, and termination of interconnectedness with integrated payment interface. (2) Further provisions on the operation of integrated payment interface as referred to in paragraph (1) shall be regulated in Regulation of Member of Board of Governors. Article 160 (1) In the operation of integrated payment interface, any parties connected with the integrated payment interface as referred to in Article 159 paragraph (1) point b is required to:

-134- a. meet the obligation to operate and collect data and/or information in operation of integrated payment interface; and b. comply with other obligations determined by Bank Indonesia in operation of integrated payment interface. (2) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: a. warning; and/or b. temporary, partial, or entire suspension of activities, including cooperation implementation. (3) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (2) shall be regulated in Regulation of Member of Board of Governors. Part Nine Operation of Payment System Infrastructures with Systemic Impacts Article 161 General principles of Operation of payment system infrastructures categorized as financial market infrastructures with systemic impacts include:

-135- a. authority of Bank Indonesia to determine Payment System infrastructures operated by Bank Indonesia as Payment System infrastructure categorized as financial market infrastructures with systemic impacts; b. scope of Payment System infrastructures operated by Bank Indonesia categorized as financial market infrastructures with systemic impacts; c. parameters to determine infrastructures; d. operation that is conducted according to in the applicable international standard; and/or e. further actions to the oversight. Article 162 Payment System infrastructures operated by Bank Indonesia categorized as financial market infrastructures with systemic impacts include: a. BI-RTGS System; b. fast payment infrastructures of Bank Indonesia; and c. other Payment System infrastructures operated by Bank Indonesia. Article 163 (1) The categories as referred to in Article 162 are based on the following considerations:

-136- a. number and value of the processed transaction; b. number and type of participant; c. type of market served; d. market share; e. connectivity with infrastructures of financial market and other financial institutions; f. availability of immediate substitute of Payment System infrastructures; and/or g. other matters determined by Bank Indonesia. (2) The considerations as referred to in paragraph (1) are adjusted to the types and characteristics of Payment System infrastructures. Article 164 The operation of Payment System infrastructures categorized as financial market infrastructures with systemic impacts must be conducted in accordance with the applicable international standard. Article 165 Fulfillment of the international standard as referred to in Article 164 includes: a. aspect of infrastructure operation; and b. aspect of authority’s responsibility in conducting oversight.

-137- Article 166 The infrastructure operation aspect as referred to in Article 165 point a includes: a. legal basis; b. governance; c. framework for comprehensive management of risk; d. credit risk; e. collateral; f. risk liquidity; g. settlement finality; h. money settlement; i. exchange-of-value settlement systems; j. participants default rules and procedures; k. general business risk; l. custodian and investment risk; m. operational risk; n. access participation requirements; o. tiered participation arrangements; p. efficiency and effectiveness; q. communication procedures and standard; and r. disclosure of rules, key procedure, and market data.

-138- Article 167 The aspect of authority responsibility in conducting oversight as referred to in Article 165 point b includes: a. regulation and oversight on financial market infrastructures; b. authority and resources for regulation and oversight; c. disclosure of policies related to financial market infrastructures; d. implementation of financial market infrastructure principles; and e. cooperation with other authorities. Article 168 Further actions to the oversight as referred to in Article 167 includes: a. moral suasion; b. recommendations for policies, regulations, or developments; c. coordination with the relevant authority; and/or d. any other actions determined by Bank Indonesia. Article 169 Bank Indonesia publishes aspect of operation of Payment System infrastructures categorized as systemic on its web page.

-139- CHAPTER IV INNOVATION IN PAYMENT SYSTEM TECHNOLOGY Part One Scope of Innovation in Payment System Technology Article 170 Bank Indonesia provides a testing environment for development of innovation in Payment System technology to support development of digital economy and finance. Article 171 Innovation in Payment System technology include: a. product; b. activity; c. service; and d. business model, using innovative technology in digital economy and finance ecosystem which may support Payment System operation. Article 172 Innovative technology means technology used in the digital economy and finance ecosystem which may support Payment System operation, including but not limited to:

-140- a. use of un-tested technology; b. use of technology with limited use; c. use of non-standardized technology; and/or d. use of new technology, which may impact financial system and Payment System. Article 173 Provision of testing environment aims to: a. promote technology innovations; and b. monitor and detect opportunities and risks of technology innovations against development of digital economy and finance ecosystem as well as Payment System operation. Article 174 The testing of development of Payment System technology innovations as referred to in Article 171 is conducted by Bank Indonesia through the following testing: a. development of innovations which have been unused or used in the Payment System industry in a limited manner (innovation lab); b. innovations in policies or provisions for Payment System (regulatory sandbox); and c. innovations which have been used in the Payment System industry and must be promoted for wider use (industrial sandbox).

-141- Part Two Request for Testing of Development of Innovation in Payment System Technology Article 175 The testing of development of innovations in Payment System technology may come from: a. requests submitted by:

1. PIP; or
2. any other parties determined by Bank Indonesia; or b. initiative of Bank Indonesia. Article 176 (1) PIP or other parties determined by Bank Indonesia which requests for testing of development of innovation in Payment System technology must submit a written request in Indonesian to Bank Indonesia. (2) The request as referred to in paragraph (1) is accompanied by supporting documents. Article 177 (1) The supporting documents as referred to in Article 176 paragraph (2) includes:

-142- a. profile of prospective participant, including information of entity; b. contact person; and c. data and information. (2) The data and information as referred to in paragraph (1) point c consist of: a. features of the product, activity, service, and business model to be tested; b. elements of innovation in the product, activity, service, and business model to be tested; c. benefits for customers and/or economy; d. risk management, information security, consumer protection, anti-money laundering and countering the financing of terrorism, as well as infrastructure and operational readiness; e. proposed scenario for testing of development of innovation in Payment System technology; f. the testing scope includes the limit of number of users or merchants, limit of transaction nominal amount, limit of regional nominal amount, and other limits; and/or g. implementation period of testing of development of innovation in Payment System technology. (3) For application of testing for industrial sandbox, in addition to the supporting documents as referred to in

-143- paragraph (2), it also includes information on list of parties participating in the testing and profile of all prospective participant. (4) If required, Bank Indonesia may request additional supporting documents for the application of testing of development of innovation in Payment System technology as referred to in paragraph (1) and paragraph (2). Article 178 (1) The application and supporting documents as referred to in Article 176 are submitted to Bank Indonesia through the license application of Bank Indonesia. (2) In the event that the application as referred to in paragraph (1) may not be implemented or experiences disruption, the application and supporting documents shall be submitted directly in accordance with the mechanism determined by Bank Indonesia. Part Three The Testing Environment for Development of Innovation in Payment System Technology Article 179 (1) Bank Indonesia may determine:

-144- a. the product, activity, service, technology, and business model related to Payment System operation to be facilitated through the testing environment for development of innovation in Payment System technology; and b. participants of testing environment for development of innovation in Payment System technology. (2) The determination as referred to in paragraph (1) is submitted by Bank Indonesia to participants of testing environment for development of innovation in Payment System technology in writing or any other media determined by Bank Indonesia. Article 180 The implementation of testing environment for development of innovation in Payment System technology is conducted by applying the following principles: a. criteria-based process; b. transparency; c. proportionality; d. fairness; e. equal treatment; and f. forward looking.

-145- Article 181 In the implementation of the testing for development of innovation in Payment System technology, Bank Indonesia may involve SRO and/or another party. Article 182 (1) The period of testing environment for development of innovation in Payment System technology is determined 6 (six) months at the maximum as from the participant in the testing environment for development of innovation in Payment System technology. (2) If required, the period as referred to in paragraph (1) may be extended once for 6 (six) months at the maximum. (3) The period extension as referred to in paragraph (2) is requested in writing by a participant of testing environment for development of innovation in Payment System technology to Bank Indonesia within not later than 1 (one) month prior to the end of the testing period as referred to in paragraph (1), with the reasons and required extension period. (4) Bank Indonesia replies to the request submitted prior to the end of the period as referred to in paragraph (1).

-146- Article 183 (1) During the process of testing for development of innovation in Payment System technology, Bank Indonesia may determine a certain policy on the testing participants, including but not limited to: a. certain limits, including limit of area, number of users and/or certain period; and/or b. ease to operate development of innovation in Payment System technology during the testing process. (2) The determination of certain policy as referred to in paragraph (1) is based on the following considerations: a. characteristics of the product, activity, service, and business model to be tested; b. development of innovation in Payment System technology; and/or c. development of digital economy and finance ecosystem which may support Payment System operation.

-147- Part Four Coordination in Implementation of Testing for Development of Innovation Payment System Technology Article 184 (1) Bank Indonesia may coordinate with another authority within and/or outside the country in implementation of testing for development of innovation in Payment System technology. (2) The coordination as referred to in paragraph (1) is conducted to: a. synchronize the implementation of innovation in Payment System technology which has intersecting functions or powers among authorities; b. identify and response to issues related to matters that have not been regulated by each authority in implementation of innovation in Payment System technology; c. to develop and integrate the digital economy and finance; and/or d. others related to implementation of testing for development of innovation in Payment System technology considered necessary by Bank Indonesia and other authorities.

-148- (3) The synchronization in implementing innovation in Payment System technology that has intersecting functions or powers among authorities as referred to in paragraph (2) point a is conducted by considering: a. testing implementation against each scenario for testing of products, activities, services, technology, and business model related to functions or powers of the relevant authorities; and/or b. other considerations related to the alignment of innovation in Payment System technology. Part Five Result of Testing for Development of Innovation in Payment System Technology Article 185 (1) Bank Indonesia determines the result status of testing for development of innovation in Payment System technology based on the assessment result of all activities during the testing. (2) The assessment as referred to in paragraph (1) is conducted by considering: a. suitability with the proposed testing scenario; b. correlation with Payment System; c. features and risk level;

-149- d. system readiness and reliability; e. implementation of consumer protection, risk management, and prudential principle; f. compliance with the laws and regulations. (3) Based on the assessment result as referred to in paragraph (2), Bank Indonesia determines the following result status of testing for development of innovation in Payment System technology: a. successful; or b. unsuccessful. (4) Bank Indonesia submits the result status of testing for development of innovation in Payment System technology to applicants in writing or any other media determined by Bank Indonesia. (5) In the event that the testing is declared successful as referred to in paragraph (3) point a as well as the product, activity, service, and business model are included in Payment System operation category, the participant is prohibited from marketing the tested product, activity, service, and business model prior to obtaining the designation and/or approval under the provisions of Bank Indonesia for Payment System. (6) In the event that the testing is declared unsuccessful as referred to in paragraph (3) point b and the product, activity, service, and business model are included in

-150- Payment System operation category, the participant is prohibited from marketing the product and/or service and from using the tested technology and/or business model. (7) PIP which breaches the provisions as referred to in paragraph (5) or paragraph (6) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (8) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (7) shall be regulated in Regulation of Member of Board of Governors. Article 186 The evaluation result of testing for development of innovation in Payment System may serve as the consideration of Bank Indonesia in formulation of regulations, supervision, and development of products, activities, services, and business models in digital economy and finance development.

-151- Article 187 Bank Indonesia may publish on its web page the testing for development of innovation in Payment System technology to be conducted and the result of the testing for development of innovation in Payment System technology. CHAPTER V SUPERVISION AND OVERSIGHT OF PAYMENT SYSTEM Part One Supervision and Oversight Approach Article 188 Bank Indonesia supervises and oversees Payment System operation by using risk-based and/or compliance-based supervision approach. Part Two Supervision and Oversight Purpose Article 189 Supervision and oversight of Payment System operation aims to ensure achievement of the Payment System operation objectives while keep encouraging industry innovations in

-152- Payment System as well as observing international standards and practices. Part Three Supervision and Oversight Object Article 190 (1) The supervision object of Payment System operation is PIP. (2) In conducting the supervision of PIP as referred to in paragraph (1), Bank Indonesia may supervise the party cooperating with PIP. (3) The party cooperating with PIP as referred to in paragraph (2) is Supporting Provider or other parties in cooperation with PIP in facilitating payment transactions. Article 191 The oversight object by Bank Indonesia includes Payment System infrastructures operated by Bank Indonesia, including Payment System infrastructures with systemic impacts.

-153- Part Four Supervision and Oversight Mechanism Article 192 (1) The supervision of Payment System operation is conducted through: a. off-site supervision; and b. on-site supervision. (2) Bank Indonesia may assign another party for and on behalf of Bank Indonesia to conduct on-site supervision as referred to in paragraph (1) point b. (3) Another party as referred to in paragraph (2) is required to meet the provisions of Bank Indonesia. Article 193 (1) The off-site supervision as referred to in Article 192 paragraph (1) point a is conducted through monitoring, identification, and/or assessment through analysis of reports, data, and information obtained by Bank Indonesia. (2) The on-site supervision as referred to in Article 192 paragraph (1) point b is conducted through periodic and/or incidental inspection both face-to-face and by any other mechanisms determined by Bank Indonesia.

-154- (3) The inspection as referred to in paragraph (2) is conducted on documents, infrastructures, information system, and other aspects used by PIP. Article 194 Oversight of Payment System infrastructures categorized as financial market infrastructures with systemic impacts is conducted through: a. monitoring; b. assessment; and c. efforts inducing change. Article 195 In conducting oversight of Payment System infrastructures categorized as financial market infrastructures with systemic impacts as referred to in Article 194, Bank Indonesia may conduct cooperative oversight with domestic and international authority related to oversight of interdependent and correlated financial market infrastructures.

-155- Part Five Scope of Supervision and Oversight Article 196 Scope of supervision by Bank Indonesia on the supervision object includes: a. risk exposure, including compliance with the laws and regulations; b. implementation of governance and risk management; and c. other aspects determined by Bank Indonesia. Article 197 Mechanism, intensity, and focus of supervision by Bank Indonesia are conducted by observing PIP classifications and scope of supervision as referred to in Article 196. Article 198 Oversight of Payment System infrastructures operated by Bank Indonesia categorized as financial market infrastructures with systemic impacts include: a. fulfillment of the principles of financial market infrastructures with systemic impacts; b. operational performance; c. participant’s liquidity condition; and/or

-156- d. issues, recommendations, or the applicable international standards. Article 199 Bank Indonesia oversees in accordance with the aspect of authority’s responsibility as referred to in Article 167. Part Six Data and/or Information for Supervision Article 200 (1) PIP is required to provide, including but not limited to, the following to Bank Indonesia or any other parties assigned by Bank Indonesia: a. documents, data, information, and/or reports; b. oral and written details and/or explanation; and/or c. access to infrastructures and/or information system required in supervision. (2) If requested by Bank Indonesia, the obligation as referred to in paragraph (1) related to Payment System applies to parties in cooperation with PIP. (3) PIP is responsible to ensure that parties in cooperation with PIP meet the obligations as referred to in paragraph (2).

-157- (4) The PIP as referred to in paragraph (1) and parties in cooperation with PIP as referred to in paragraph (2) is required to be responsible for the validity, accuracy, completeness, and punctuality of each submission to Bank Indonesia or any other parties assigned by Bank Indonesia as referred to in paragraph (1). (5) The documents, data, information, reports, details, and/or explanation as referred to in paragraph (1) are submitted through: a. reporting; b. direct meeting; and/or c. any other media determined by Bank Indonesia. (6) PIP which breaches the provisions as referred to in paragraph (1) or paragraph (4) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (7) Further provisions on mandatory submission of data and/or information for supervision as referred to in paragraph (1) and paragraph (2) and procedure for administrative sanction imposition as referred to in

-158- paragraph (6) shall be regulated in Regulation of Member of Board of Governors. Part Seven Integrated Supervision Article 201 (1) Bank Indonesia may conduct integrated supervision of PIP and parent companies, subsidiaries, and/or any other affiliated parties. (2) Integrated supervision is conducted to: a. identify and mitigate risk exposure arising from ownership relationship, control, business, and finance which may affect sustainability of operational activities and PIP payment processing, and Payment System ecosystem; b. ensure fulfillment of institutional and legal aspect, business feasibility, governance, and risk management by PIP; c. ensure fair business competition and efficiency in the industry, and support financial system stability; and d. ensure fulfillment of other aspects determined by Bank Indonesia.

-159- (3) The integrated supervision as referred to in paragraph (1) is conducted through: a. off-site supervision; and/or b. on-site supervision. (4) The off-site supervision as referred to in paragraph (3) point a is conducted through monitoring, identification, and/or assessment of parent companies, subsidiaries, and/or other affiliated parties through analysis of reports, data, and information obtained by Bank Indonesia. (5) On-site supervision as referred to in paragraph (3) point b is conducted through periodic and/or incidental inspection of parent companies, subsidiaries, and/or other affiliated parties either face-to-face or by any other mechanisms. (6) The inspection as referred to in paragraph (5) is conducted on documents, infrastructures, information system used by PIP, and other inspection objects. (7) If requested by Bank Indonesia, parent companies, subsidiaries, and/or other affiliated parties are required to provide: a. requested information and data; b. opportunities to examine all bookkeeping and records, documents, and physical facilities related to their business activities; and/or

-160- c. any other requirements, for implementation of the integrated supervision as referred to in paragraph (2). (8) PIP, parent companies, subsidiaries, and/or other affiliated parties are prohibited from hindering supervision process by Bank Indonesia. (9) Bank Indonesia may coordinate with other authority in the event that parent companies, subsidiaries, and/or other affiliated parties are under the supervision of other authority. (10) PIP which breaches the provisions as referred to in paragraph (7) or paragraph (8) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (11) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (10) shall be regulated in Regulation of Member of Board of Governors.

-161- Part Eight Further Actions to the Supervision and Oversight Article 202 (1) Based on the supervision result as referred to in Article 192 paragraph (1), Bank Indonesia shall conduct the following further actions to the supervision: a. requesting PIP to:

1. do or not do any action;
2. limit activities or operation; and/or
3. conduct temporary, partial, or entire suspension of activities, including cooperation implementation; and/or b. revoke any granted designation and/or approvals. (2) The further actions to the supervision as referred to in paragraph (1) may be accompanied by: a. public announcement; b. termination of approval processing for activity development, product development, and/or cooperation; and/or c. submission to other authority of information and/or recommendations resulting from supervision, in the event that the supervision result relates to other authorities, by Bank Indonesia.

-162- (3) The further actions to the supervision as referred to in paragraph (1) may be conducted by observing PIP classifications. (4) Bank Indonesia may conduct further actions to the supervision of PIP which is considered to have potential difficulties detrimental to business continuity. (5) The PIP as referred to in paragraph (4) is assessed through the following aspects: a. business performance and capital; b. risk management and sufficient security and reliability of information system; and/or c. integrity and/or competence of the management and shareholders. (6) PIP is required to submit an action plan and execute it to resolve issues according to the aspect as referred to in paragraph (5). (7) PIP which breaches the provisions as referred to in paragraph (6) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP.

-163- (8) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (7) shall be regulated in Regulation of Member of Board of Governors. Article 203 (1) Bank Indonesia has the authority to impose administrative sanctions on PIP in the following forms: a. warning; b. penalty; c. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or d. revocation of designation as PIP. (2) The administration sanction imposition as referred to in paragraph (1) may be accompanied by: a. public announcement; and/or b. termination of approval processing for activity development, product development, and/or cooperation, by Bank Indonesia. (3) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (1) shall be regulated in Regulation of Member of Board of Governors.

-164- Article 204 In the event that PIP does not meet its obligation to pay penalty sanction as referred to in Article 203 paragraph (1) point b, Bank Indonesia may change the imposed penalty into the sanction of termination or revocation of designation. Article 205 (1) The change of imposed penalty into the sanction of termination or revocation of designation as referred to in Article 204 shall be imposed in the event that PIP does not make the penalty payment until the deadline determined by Bank Indonesia. (2) Based on the sanction change as referred to in paragraph (1), the imposed penalty is declared to be omitted. Article 206 In imposing the administrative sanctions on PIP, Bank Indonesia considers the following aspects: a. level of errors and/or breaches; and b. consequences on:

1. smoothness and security of Payment System aspect;
2. consumer protection aspect;

-165- 3. anti-money laundering and countering the finance of terrorism aspect; and/or 4. other aspects determined by Bank Indonesia. Article 207 (1) Other parties which breach the provisions as referred to in Article 192 paragraph (3) are subject to the following administrative sanctions: a. written warning; and/or b. recommendation for the relevant institution to:

1. remove the other party assigned from a particular profession list; or
2. revoke business license. (2) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (1) shall be regulated in Regulation of Member of Board of Governors. Article 208 (1) Any party is prohibited from conducting Payment System activities prior to obtaining designation from Bank Indonesia. (2) PIP is prohibited from marketing any product, activity, and/or cooperation categorized to have medium or high risk prior to obtaining approval from Bank Indonesia.

-166- (3) PIP which breaches the provisions as referred to in paragraph (2) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated in Regulation of Member of Board of Governors. Article 209 In the event that PIP or a party cooperating with PIP is proven to submit invalid and/or inaccurate documents, data, and/or information, Bank Indonesia has the authority to conduct further action to the supervision as referred to in Article 202. Article 210 Bank Indonesia conducts the further action to the oversight as referred to in Article 168.

-167- CHAPTER VI TERMINATION OF PAYMENT SYSTEM OPERATION Part One Evaluation of PIP Designation Article 211 (1) Bank Indonesia evaluates designation granted to PIP. (2) The evaluation of designation as referred to in paragraph (1) is conducted periodically every 3 (three) years from the date of designation letter issuance by Bank Indonesia or incidentally. (3) The evaluation as referred to in paragraph (1) is conducted based on: a. supervision result by Bank Indonesia; b. corporate actions by PIP; c. request for extension of designation in the event that Bank Indonesia determines the designation period; d. recommendations from other authorities; e. final and binding court decision; f. request from PIP to terminate their activities; and/or g. other considerations in creating fast, easy, affordable, safe, and reliable Payment System.

-168- (4) In conducting the designation evaluation as referred to in paragraph (3) point a, Bank Indonesia conducts further action to the supervision as referred to in Article 202 paragraph (3) until paragraph (6). (5) In conducting designation evaluation as referred to in paragraph 3, Bank Indonesia may consider the following aspects, including but not limited to: a. transaction performance; b. business or institution activities; c. efficiency or concentration level in Payment System industry; and/or d. compliance with the laws and regulations. (6) The designation evaluation as referred to in paragraph (2) and/or further actions to the supervision as referred to in paragraph (4) may serve as the basis for Bank Indonesia to: a. shorten or extend designation period in the event that the designation is granted within a certain period; b. revoke PIP designation; or c. carry on business continuity of PIP.

-169- Article 212 (1) PIP whose designation is revoked is required to notify all parties in cooperation with the PIP that its designation has been revoked. (2) PIP which has designation from Bank Indonesia is required to terminate its cooperation with any PIP that is subject to sanction of designation revocation not later than the following business day from the date of designation revocation notice as referred to in paragraph (1). (3) PIP is required to ensure consumer protection aspect during the process of cooperation termination. (4) Implementation of the cooperation termination as referred to in paragraph (2) is required to be notified in writing and received by Bank Indonesia not later than 10 (ten) business days from the date of cooperation termination implementation. (5) PIP which breaches the provisions as referred to in paragraph (1) until paragraph (4) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP.

-170- (6) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (5) shall be regulated in Regulation of Member of Board of Governors. Article 213 (1) PIP submitting a request for termination of activity or revocation of designation at its own request must submit it in writing to Bank Indonesia of the plan for activity termination or designation revocation not later than 30 (thirty) business days prior to the date of activity termination or designation revocation. (2) The request as referred to in paragraph (1) is accompanied by the following information and documents on: a. reasons for activity termination; b. effective date of activity termination; c. mechanism of notification or publication to the relevant parties of the activity termination plan; d. mechanism of completion of rights and obligations; and e. any other information requested by Bank Indonesia. (3) Bank Indonesia issues the letter on termination of activity or revocation of designation as PIP based on the

-171- request for termination or revocation as referred to in paragraph (1) after completion of the rights and obligations of PIP. (4) PIP must report the implementation of activity termination or designation revocation in writing to Bank Indonesia not later than 10 (ten) business days from the date of termination of activity or designation revocation letter from Bank Indonesia as referred to in paragraph (3) equipped with: a. documents or evidence containing completion of the rights and obligations to the relevant parties; and b. statement letter from the management that all claims arising from the termination of activity or revocation of designation shall be the full responsibility of the management. (5) Information on revocation of designation as PIP by Bank Indonesia is published on the web page of Bank Indonesia or any other media determined by Bank Indonesia.

-172- Part Two Completion of PIP Obligations Article 214 (1) PIP must complete all obligations to members and/or parties cooperating in Payment System operation prior to revocation of PIP designation by Bank Indonesia. (2) Mechanism and period of completion of all obligations arising from Payment System operation as referred to in paragraph (1) are determined by Bank Indonesia by observing the action plan submitted by PIP. (3) If required, Bank Indonesia may determine extension of the period as referred to in paragraph (2) at the request of PIP accompanied by the reasons and proposed and required extension period. (4) The request for period extension as referred to in paragraph (3) is submitted in writing to Bank Indonesia not later than 30 (thirty) business days prior to the end of the period of obligation completion determined by Bank Indonesia as referred to in paragraph (2). (5) In the event that PIP has not completed the obligations within the period extension as referred to in paragraph (3), Bank Indonesia may revoke the designation which may be accompanied by follow-up to the obligation completion.

-173- (6) The follow-up to the obligation completion as referred to in paragraph (5) is conducted through transfer of PIP obligations to the Probate Court or other follow-ups. (7) With the designation revocation by Bank Indonesia, all impacts arising from obligations between PIP and members and cooperating parties shall become the responsibilities of PIP. Article 215 (1) Follow-up in the form of obligation transfer from PIP to the Probate Court as referred to in Article 214 paragraph (6) is conducted not later than 30 (thirty) business days as from the end of the obligation completion period as referred to in Article 214 paragraph (2) and paragraph (3). (2) The obligation transfers from PIP to the Probate Court as referred to in paragraph (1) is conducted under the laws and regulations. (3) In conducting the obligation transfer as referred to in paragraph (1), PIP may apply transfer fee charged on the obligation transferred to the Probate Court.

-174- Part Three Designation Revocation at Own Request Article 216 (1) In the event that the designation revocation is conducted at the request of PIP, PIP must submit the request in writing to Bank Indonesia for the plan for termination of activity not later than 30 (thirty) business days prior to the termination of activity date. (2) The request as referred to in paragraph (1) is equipped by the following information and documents on: a. reasons for activity termination; b. effective date of activity termination; and c. mechanism of notice or publication to the relevant parties of the activity termination plan. (3) Revocation of designation as PIP by Bank Indonesia is conducted after all obligations arising from Payment System operation completed by PIP. (4) In the event that the obligations arising from Payment System operation as referred to in paragraph (3) fail to be completed, PIP may transfer the obligations to the Probate Court under the laws and regulations. (5) After the obligations arising from the Payment System operation are transferred to the Probate Court as

-175- referred to in paragraph (4), Bank Indonesia may revoke the designation as PIP. (6) PIP must report the implementation of activity termination in writing to Bank Indonesia not later than 10 (ten) business days from the date of designation revocation letter from Bank Indonesia equipped with: a. documents containing completion of the rights and obligations to the relevant parties; and b. statement letter from the management that all claims arising from the activity termination as PIP shall be the full responsibility of the management. (7) Information on revocation of designation as PIP by Bank Indonesia is published on the web page of Bank Indonesia or any other media determined by Bank Indonesia. (8) Bank Indonesia may re-evaluate designation revocation at the request of PIP, in the event a request to cancel the designation revocation is made by PIP, which is in the process of obligation completion or designation revocation. (9) The request for cancellation of the designation revocation as referred to in paragraph (8) is submitted by PIP to Bank Indonesia in writing and accompanied by documents or information indicating:

-176- a. reasons for cancellation of the designation revocation; b. efforts made to improve the conducted Payment System activities; and c. PIP commitment to resume Payment System activities under the provisions of Bank Indonesia. (10) Based on the designation revocation request as referred to in paragraph (1) or evaluation as referred to in paragraph (8), Bank Indonesia will: a. approve; or b. reject, the revocation of designation. CHAPTER VII DATA AND/OR INFORMATION Part One Subject of Data and/or Information Collection Article 217 (1) PIP is required to submit data and/or information related to Payment System to Bank Indonesia. (2) The data and/or information related to Payment System as referred to in paragraph (1) are on: a. payment transaction;

-177- b. payment transaction information details; c. PIP performance; d. Payment System operation; e. monitoring of compliance of participants of Payment System infrastructures operated by Bank Indonesia; and/or f. other data and/or information. (3) The data and/or information as referred to in paragraph (2) are in the form of: a. documents, reports, raw data, and/or processed data; and/or b. oral and/or written details and/or explanation, related to Payment System. (4) Bank Indonesia may process the data and/or information as referred to in paragraph (1), including to use it for the interest of Bank Indonesia. (5) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP.

-178- (6) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (5) shall be regulated in Regulation of Member of Board of Governors. Article 218 (1) In the event that the data and/or information are requested by Bank Indonesia, other parties cooperating with PIP is required to submit them in the following forms: a. documents, reports, raw data, and/or processed data; and/or b. oral and/or written details and/or explanation, related to Payment System. (2) The other parties cooperating with PIP as referred to in paragraph (1) include but not limited to: a. Supporting Providers; and b. PIP members. (3) The data and/or information as referred to in paragraph (1) include: a. payment transaction; and/or b. payment transaction information details. (4) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions:

-179- a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (5) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (4) shall be regulated in Regulation of Member of Board of Governors. Part Two Mechanism of Data and/or Information Collection Article 219 (1) Mechanism to collect data and/or information on Payment System from PIP and/or any other parties cooperating with PIP is conducted through: a. submission of reports to Bank Indonesia; b. data capturing through inter-system connections; and/or c. any other mechanisms designated by Bank Indonesia. (2) The reports to Bank Indonesia as referred to in paragraph (1) point a may be periodically or incidentally

-180- submitted online through the system of Bank Indonesia and/or offline. (3) The data capturing through inter-system connections as referred to in paragraph (1) point b may be conducted directly and real-time. (4) The data and/or information by other mechanisms as referred to in paragraph (1) point c may be submitted in a meeting with Bank Indonesia or any other media determined by Bank Indonesia. (5) The procedure and mechanism of data and/or information collection as referred to in paragraph (1) are applied under Bank Indonesia regulation on data collection. Article 220 (1) PIP is required to submit Payment System operation reports to Bank Indonesia. (2) The reports submitted to Bank Indonesia as referred to in paragraph (1) include the following aspects: a. institution; b. capital and finance; c. governance and risk management; d. information system capability; and e. any other aspects determined by Bank Indonesia.

-181- (3) The reports as referred to in paragraph (1) consist of: a. periodic reports; and b. incidental reports. (4) Submission of the periodic reports as referred to in paragraph (3) point a includes but not limited to: a. daily report; b. weekly report; c. monthly report; d. quarterly report; e. annual report; f. report on audit result of information system and security test from an internal or external independent auditor; and/or g. report on Payment System capital obligation. (5) The incidental reports as referred to in paragraph (3) point b consist of: a. report on changes in equity and/or report on change of ownership and control structure as well as change of PIP management structure; b. report on change of data and information in documents submitted to Bank Indonesia for designation requirements; c. report on disruption in payment transaction processing and the conducted follow-up;

-182- d. report on force majeure in the implementation of payment transaction processing; e. report on information system audit from an independent auditor in the event of significant changes; and f. other reports which are required by Bank Indonesia. (6) The disruption as referred to in paragraph (5) point c and force majeure as referred to in paragraph (5) point d must be notified to Bank Indonesia not later than 1 (one) hour after the disruption occurrence. (7) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: a. warning; b. penalty; c. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or d. revocation of designation as PIP. (8) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (7) shall be regulated in Regulation of Member of Board of Governors.

-183- Article 221 (1) The submission of periodic reports as referred to in Article 220 paragraph (4), the following provisions shall apply: a. the daily report as referred to in Article 220 paragraph (4) point a is submitted not later than the end of the following day; b. the weekly report as referred to in Article 220 paragraph (4) point b is submitted not later than Wednesday in the following week; c. the monthly report as referred to in Article 220 paragraph (4) point c is submitted not later than the fifteenth day of the following month; d. the quarterly report as referred to in Article 220 paragraph (4) point d is submitted not later than the fifteenth day of the following month; e. the annual report as referred to in Article 220 paragraph (4) point e is conducted under the following provisions:

1. annual report on payment system is submitted not later than 15 December of the current year;
2. report on management and supervision by the board of commissioners is submitted not later than 4 (four) months after the financial year ends; and

-184- 3. audited financial statement is submitted not later than 6 (six) months after the financial year ends; f. the report on audit result of information system and security test from an internal or external independent auditor as referred to in Article 220 paragraph (4) point f is submitted not later than 10 (ten) business days after the audit report is completed; and g. the report on payment system capital obligation as referred to in Article 220 paragraph (4) point g is submitted not later than 7 (seven) months after the financial year ends, the calculation of which refers to an audited financial statement as of December and transactions processed in the financial year. (2) The submission of incidental reports as referred to in Article 220 paragraph (5), the following provisions shall apply: a. the report of changes in equity and/or report on change of ownership and control structure as well as change of PIP management structure as referred to in Article 220 paragraph (5) point a and report on change of data and information as referred to in Article 220 paragraph (5) point b are submitted not

-185- later than 20 (twenty) business days after the change takes place; b. the report on disruption as referred to in Article 220 paragraph (5) point c is submitted not later than the 3 (three) days after the disruption occurrence; c. the report on force majeure as referred to in Article 220 paragraph (5) point d is submitted not later than the 3 (three) business days after the force majeure occurrence; and d. the report on audit result of information system from an independent auditor in the event of significant changes as referred to in Article 220 paragraph (5) point e is submitted not later than 10 (ten) business days after the audit report is completed. (3) In the event that the report submission dates as referred to in paragraph (1) and paragraph (2) fall on Saturdays, Sundays, holidays, and/or joint leave determined by Bank Indonesia, the report may be submitted on the following business day. (4) For online periodic report submission and sanction imposition are conducted under Bank Indonesia regulation. (5) The change of reference for ongoing capital during implementation of business activities as referred to in

-186- paragraph (1) point g shall be regulated in Regulation of Member of Board of Governors. (6) The administrative sanctions in the form of penalty as referred to in Article 220 paragraph (7) point b for any PIP which breaches the provisions as referred to in paragraph (1) point e item 2, paragraph (1) point f, and/or paragraph (2) point b are determined Rp7,500,000.00 (seven million five hundred thousand rupiah) per report. (7) The mechanism of penalty payment as referred to in paragraph (6) is applied through: a. debiting of giro account at Bank Indonesia; b. fund transfer to an account determined by Bank Indonesia; or c. any other payment mechanisms determined by Bank Indonesia. (8) Further provisions on the penalty payment mechanism as referred to in paragraph (7) shall be regulated in Regulation of Member of Board of Governors.

-187- Part Three Processing of Data and/or Information Article 222 (1) In processing of data and/or information related to Payment System, PIP and/or any other parties cooperating with PIP is required to: a. apply personal data protection principles including meeting the aspect of PIP member’s approval for the use of their personal data, including:

1. personal data is collected in a limited and specific manner, legal, proper, and transparent;
2. personal data is processed according to its purpose;
3. personal data is processed by guaranteeing the rights of personal data owners;
4. personal data is processed in an accurate and complete manner, not misleading, updated, may be justified, and observing the purpose of personal data processing;
5. personal data is processed by protecting personal data security from loss, misuse, illegal access and disclosure, and changing or tampering of personal data;

-188- 6. personal data is processed by informing the collection purpose, processing activities, and personal data protection failure; and 7. the processed personal data will be destroyed and/or deleted unless the data remains in retention period as required under the laws and regulations. b. fulfill mechanism of processing of data and/or information on Payment System determined by Bank Indonesia, including processing mechanism through data infrastructures and Payment System infrastructures of Bank Indonesia; c. fulfill mechanism of utilization of third-party data infrastructures designated by Bank Indonesia; d. apply cyber risk management in Payment System operation, including information system security standard; e. observe data integrity which represents actual and consistent facts or conditions by using a transparent method; and f. comply with the laws and regulations. (2) The principle of personal data protection as referred to in paragraph (1) point a is implemented by considering public interest and/or other requirements determined by the authority.

-189- (3) The mechanism of processing of data and/or information on Payment System as referred to in paragraph (1) point b consists of: a. mechanism of processing of data and/or information on payment between member and PIP; b. mechanism of processing of data and/or information on payment between PIP; c. mechanism of processing of data and/or information on payment between PIP and Bank Indonesia; d. mechanism of processing of data and/or information on payment between members; and e. mechanism of processing of data and/or information on payment between member and Bank Indonesia. (4) PIP which breaches the provisions as referred to in paragraph (1) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (5) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (4) shall

-190- be regulated in Regulation of Member of Board of Governors. Article 223 The mechanism of processing of data and/or information on Payment System as referred to in Article 222 paragraph (1) point b includes: a. access and procedure for processing; b. data standardization, technical standardization, security standardization, and governance standardization; and/or c. any other mechanisms determined by Bank Indonesia. Article 224 (1) PIP and/or other parties in the implementation of data standardization, technical standardization, security standardization, and governance standardization as referred to in Article 223 point b is required to meet: a. standard application; b. standard testing and verification; c. system development, change, and maintenance; and d. other obligations determined by Bank Indonesia.

-191- (2) Provisions for other obligations as referred to in paragraph (1) point d are specified in Bank Indonesia regulation. (3) PIP and/or other parties which does not filfill the obligations as referred to in paragraph (1) is subject to the following administrative sanctions: a. warning; b. temporary, partial, or entire suspension of activities, including cooperation implementation; and/or c. revocation of designation as PIP. (4) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (3) shall be regulated in Regulation of Member of Board of Governors. Article 225 In the event that the data and/or information on Payment System is processed through utilization of data infrastructures of the third party, PIP, and/or any party cooperating with PIP must at least meet the following: a. access and surveillance by Bank Indonesia; b. risk management and information system security; c. data protection; d. service reliability; and e. data integrity.

-192- Article 226 To follow up the supervision result, Bank Indonesia may determine a certain policy on data and/or information processing to PIP. CHAPTER VIII SRO Part One SRO Obligations Article 227 (1) SRO is required to: a. perform duties designated by Bank Indonesia; and b. maintain confidentiality of data and/or information. (2) In the event that SRO breaches the provisions as referred to in paragraph (1), Bank Indonesia has the authority to impose the following administrative sanctions: a. warning; and/or b. change of management. (3) Further provisions on the administrative sanction imposition procedure as referred to in paragraph (2) shall

-193- be regulated in Regulation of Member of Board of Governors. Part Two SRO Membership Article 228 (1) PIP must become members of SRO determined by Bank Indonesia. (2) Registration as SRO members for prospective PIP may be conducted at the same time with submission of requirements for designation as PIP to Bank Indonesia. (3) PIP membership in SRO will be effective if PIP has received designation as PIP from Bank Indonesia. (4) Bank Indonesia as PIP is exempted from becoming an SRO member. Part Three SRO Provisions Article 229 (1) In supporting the implementation of authority in Payment System, Bank Indonesia may assign SRO to prepare and issue technical and micro provisions for Payment System with the approval of Bank Indonesia.

-194- (2) SRO may determine provisions other than those assigned by Bank Indonesia as referred to in paragraph (1) for the interest of its members provided that they are not in contravention with Bank Indonesia provisions. (3) SRO must request the approval of Bank Indonesia for strategic matters in performing its functions and duties. (4) PIP as SRO member is required to meet the provisions issued by SRO. (5) Any breach of SRO provisions by PIP as referred to in paragraph (4) may serve as the basis for consideration for Bank Indonesia to conduct further actions to the supervision. CHAPTER IX MISCELLANEOUS PROVISIONS Article 230 Any license, which has been obtained by a payment system service provider, will be converted to PIP designation based on an assessment conducted under Bank Indonesia regulation on Payment System. Article 231 (1) Bank Indonesia evaluates designation for any payment system service provider which has obtained its license

-195- prior to enforcement of Bank Indonesia Regulation on Payment System hereunder. (2) The designation evaluation as referred to in paragraph (1) is determined as follows: a. for payment system service providers declaring their willingness to meet PIP designation requirements, designation evaluation will be conducted within 2 (two) years at the maximum since this Bank Indonesia Regulation has come into force; or b. for payment system service providers which have met PIP designation requirements, designation evaluation will be conducted within 3 (three) years at the minimum since this Bank Indonesia Regulation has come into force or anytime where required. (3) Based on the evaluation result as referred to in paragraph (2), Bank Indonesia may: a. declare that PIP designation remains valid; or b. revoke PIP designation.

-196- CHAPTER X TRANSITIONAL PROVISIONS Article 232 At the time when this Bank Indonesia Regulation comes into force, payment system service provider’s license whose validity and which is granted prior to enforcement of Bank Indonesia Regulation shall be determined as PIP according to the designation conversion result as specified hereunder. Article 233 (1) In the event that after the enforcement of Bank Indonesia Regulation Number 22/23/PBI/2020 on Payment System (State Gazette of the Republic of Indonesia of 2020 Number 311, Supplement to State Gazette of the Republic of Indonesia Number 6610), there is no change of foreign ownership composition by a foreign party or there is no change of control by a foreign party, the provisions for share ownership composition and/or provisions for domestic control as specified in the Bank Indonesia Regulation shall not apply to PIP as referred to in Article 230. (2) The provisions of paragraph (1) shall apply to PIP which has met Bank Indonesia provisions for share ownership composition prior to enforcement of Bank Indonesia

-197- Regulation Number 22/23/PBI/2020 on Payment System (State Gazette of the Republic of Indonesia of 2020 Number 311, Supplement to State Gazette of the Republic of Indonesia Number 6610) by observing fairness principle. (3) PIP which has not met Bank Indonesia provisions for share ownership composition prior to Bank Indonesia Regulation Number 22/23/PBI/2020 on Payment System (State Gazette of the Republic of Indonesia of 2020 Number 311, Supplement to State Gazette of the Republic of Indonesia Number 6610) must submit an action plan to meet the provisions for share ownership composition and/or domestic control specified hereunder. (4) The action plan as referred to in paragraph (3) must obtain approval of Bank Indonesia. Article 234 The PIP as referred to in Article 230 will be determined as PSPS, PSPK, or PSPU since this Bank Indonesia Regulation comes into force. Article 235 (1) The PIP as referred to in Article 234 must meet the provisions for certain obligations according to PIP

-198- classifications as referred to in Article 79 paragraph (2) within 2 (two) years at the maximum since this Bank Indonesia Regulation comes into force. (2) PIP as referred to in Article 234 which has not met the certain obligations according to PIP classifications as referred to in Article 79 paragraph (2) must submit an action plan and obtain the approval of Bank Indonesia. (3) In the event that PIP does not implement an action plan which has been approved by Bank Indonesia as referred to in paragraph (2), Bank Indonesia may evaluate its PIP designation. Article 236 The PIP as referred to in Article 234 must become an SRO member within 1 (one) year at the maximum since this Bank Indonesia Regulation comes into force. CHAPTER XI CLOSING PROVISIONS Article 237 At the time when this Bank Indonesia Regulation comes into force, all laws and regulations on Payment System in Bank Indonesia are declared to remain effective to the extent not contrary to this Bank Indonesia Regulation.

-199- Article 238 This Bank Indonesia Regulation comes into force on the date of its promulgation. In order that every person may know hereof, it is ordered to promulgate this Bank Indonesia Regulation by its placement in the State Gazette of the Republic of Indonesia. Issued in Jakarta on 1 July 2021 GOVERNOR OF BANK INDONESIA, PERRY WARJIYO Promulgated in Jakarta on 1 July 2021 MINISTER OF LAW AND HUMAN RIGHSTS REPUBLIC OF INDONESIA, YASONNA H. LAOLY STATE GAZETTE OF THE REPUBLIC OF INDONESIA OF 2021 OF NUMBER 148

ELUCIDATION OF BANK INDONESIA REGULATION NOMOR 24/ 7 /PBI/2021 ON PAYMENT SYSTEM INFRASTRUCTURE PROVIDERS I. GENERAL Payment System regulation reform aims to strike the balance among optimization of digital innovation opportunities by maintaining stability in order to create fast, easy, affordable, safe, and reliable Payment System by observing access expansion and consumer protection. The regulatory contents of Bank Indonesia Regulation Number 22/23/PBI/2020 on Payment System (State Gazette of the Republic of Indonesia of 2020 Number 311, Supplement to State Gazette of the Republic of Indonesia Number 6610) is principle based to cover an end-to end Payment System operation ecosystem, and therefore, further regulation is required including to accommodate the regulatory need and risk mitigation based on development of innovations and business models in Payment System by remains prioritizing the principle of forward looking, agile, and structured.

To seek balance between optimization of innovation opportunities and efforts to maintain stability, further regulation is required on Payment System infrastructure operation among others are on access policy, Payment System infrastructure providers, supervision, and termination of activity operation, and data and/or information. Such aspects need to be supported by strengthening the Bank Indonesia’s authority and fulfillment of PIP obligation. In terms of access policy aspect, further provisions on Bank Indonesia Regulation Number 22/23/PBI/2020 on Payment System (State Gazette of the Republic of Indonesia of 2020 Number 311, Supplement to State Gazette of the Republic of Indonesia Number 6610) needs to prioritize simplification of the scope of Payment System operation, processing and requirements for license or designation, including correlation with testing environment of innovations in Payment System technology and implementation of sound business practice related to regulation of ownership and control, such as assessment mechanism and self-assessment obligation. In addition, SRO function optimization is required to issue technical and micro provisions and review Payment System provider status in SRO membership to ensure the fulfillment of SRO provisions, so that the effectiveness of Bank Indonesia regulation may be increased through technical and micro regulations. In Payment System infrastructure operation aspect, regulation aims to ensure the fulfillment of general principles of Payment System operation including operation obligations for PIP, policy on price scheme, as well as building the capability and integrity of human resources and organization to realize sound business practices. In addition, it is necessary to strengthen the policy of Bank Indonesia in terms of domestic processing aspect to ensure implementation of changes in Payment System operation approach

-3- based on PIP classifications, including classification criteria, capital, risk management, and information system aspect. For Payment System infrastructure operation, Bank Indonesia regulation must be directed to strengthen Bank Indonesia authority in Financial Market Infrastructure and Bank Indonesia Payment System infrastructure as well as interconnectedness between PJP and PIP in accordance with the policy of Bank Indonesia. On the other hand, Bank Indonesia supervision of Payment System providers, including in an integrated manner, as well as monitoring of Financial Market Infrastructure with systemic impacts needs to be optimized to support the effectiveness of the policy of Bank Indonesia. Further regulation is also required to reform the functions of Bank Indonesia in facilitating development of innovation in Payment System technology , simplification of processing and requirements for risk-based activities, products, and/or cooperation development, including the authority of Bank Indonesia in determining price scheme policy. In Payment System operation termination aspect, there is a need to have further regulations to accommodate revitalization of PIP designation evaluation function and follow-up supervision by observing business performance, institution, and compliance with the laws and regulations, including to re-arrange the obligation settlement mechanism in PIP operation termination. In data and/or information processing aspect, regulatory reform aims to ensure obligations of PIP and parties in cooperation with PIP in the implementation of consumer data protection, cyber risk management, and use of third party’s infrastructures. Payment System regulatory reform will be conducted in a sustainable manner to ensure the establishment of fast, easy, affordable, safe, and

-4- reliable Payment System in line with development of activities, business models, and innovations, as well as efforts to maintain stability and mitigate risks. II. ARTICLE BY ARTICLE Article 1 Sufficiently clear. Article 2 Sufficiently clear. Article 3 Sufficiently clear. Article 4 Sufficiently clear. Article 5 Sufficiently clear. Article 6 Sufficiently clear. Article 7 Sufficiently clear.

-5- Article 8 Sufficiently clear. Article 9 Sufficiently clear. Article 10 Sufficiently clear. Article 11 Sufficiently clear. Article 12 Sufficiently clear. Article 13 Sufficiently clear. Article 14 Sufficiently clear. Article 15 Sufficiently clear. Article 16 Sufficiently clear.

-6- Article 17 Sufficiently clear. Article 18 Sufficiently clear. Article 19 Paragraph (1) Sufficiently clear. Paragraph (2) Responsibilities as members of board of directors among others are to ensure supervision effectiveness by Bank Indonesia, including to attend physical meetings if required by Bank Indonesia. Article 20 Paragraph (1) Sufficiently clear. Paragraph (2) Point a Sufficiently clear. Point b The term “certain crimes” means:

1. money laundering crime;
2. terrorism financing crime;

-7- 3. predicate crimes as specified in the law on prevention and eradication of the crime of money laundering, namely: a. corruption; b. bribery; c. narcotics; d. psychotropic drugs; e. smuggling of workers; f. smuggling of migrants; g. in banking sector; h. in capital market sector; i. in insurance sector; j. customs; k. excise; l. human trafficking; m. illicit arms trafficking; n. terrorism; o. abduction; p. theft; q. embezzlement; r. fraud; s. counterfeit of money; t. gambling; u. prostitution; v. taxation sector; w. forestry sector; x. environment sector; y. marine and fishery sector; or

-8- 4. other crimes with imprisonment of 4 (four) years or more. Point c Sufficiently clear. Point d Sufficiently clear. Paragraph (3) Sufficiently clear. Article 21 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Point a Materiality scale includes among others ownership portion with certain number of shares and complexity of ownership structure. Point b Sufficiently clear. Paragraph (4) Sufficiently clear. Article 22 Paragraph (1) Sufficiently clear.

-9- Paragraph (2) Materiality scale includes among others control portion through the number of shares, voting rights, and certain special rights as well as complexity of control structure. Paragraph (3) Sufficiently clear. Article 23 Sufficiently clear. Article 24 Sufficiently clear. Article 25 Sufficiently clear. Article 26 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) The term “PIP with global network” means principal as payment system service providers which have been converted to PIP and conduct PIP activities outside Indonesia. Paragraph (4) Sufficiently clear.

-10- Paragraph (5) Sufficiently clear. Paragraph (6) Sufficiently clear. Article 27 Sufficiently clear. Article 28 Paragraph (1) Operational risk includes cyber-risk. Paragraph (2) Point a Scope of active supervision among others are determination of accountability, policy, and control process to manage risks which may arise from Payment System operation. Point b Availability of policies and procedures as well as fulfillment of organizational structure adequacy among others are:

1. clear organizational structure and separation of duties or authority;
2. risk measurement method; and
3. risk management procedure. Point c Risk management process and risk management function, and human resources hall at least be fulfilled with a dedicated function for risk management.

-11- Point d Internal control of Payment System operation among others includes:

1. safety procedures and measures in provision of services;
2. audit trail of processed payment transactions;
3. adequate procedure to guarantee integrity of data and/or information; and
4. measures to protect confidentiality of data and/or information. Article 29 Sufficiently clear. Article 30 Sufficiently clear. Article 31 Sufficiently clear. Article 32 Sufficiently clear. Article 33 Sufficiently clear. Article 34 Sufficiently clear.

-12- Article 35 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) On-site visits through visit to PIP is conducted to verify the accuracy and compliance of the submitted documents and to ensure operational readiness. Article 36 Sufficiently clear. Article 37 Sufficiently clear. Article 38 Sufficiently clear. Article 39 Sufficiently clear. Article 40 Sufficiently clear. Article 41 Sufficiently clear.

-13- Article 42 Sufficiently clear. Article 43 Sufficiently clear. Article 44 Sufficiently clear. Article 45 Sufficiently clear. Article 46 Sufficiently clear. Article 47 Sufficiently clear. Article 48 the example of other PIP is a party conducting Clearing and Settlement activities to access Sources of Fund in the form of card-based means of payment. Article 49 Point a Sufficiently clear. Point b Sufficiently clear.

-14- Point c Fast payment infrastructure of Bank Indonesia means Payment System infrastructures to facilitate retail payments accessible at any time. Point d Sufficiently clear. Article 50 Sufficiently clear. Article 51 Sufficiently clear. Article 52 Point a Sufficiently clear. Point b The term “Abnormal condition” means a situation or condition which occurs due to disruption or damage to hardware, software, communication network, application and infrastructure supporting facilities affecting smoothness of infrastructure operation. The term “Emergency” means a condition beyond the power of providers and/or members which causes operational activities of infrastructures cannot be conducted due to fire, riot, sabotage, natural disasters, and/or other causes, declared by the authority or competent officials, including Bank Indonesia.

-15- Point c The term “Facilities and infrastructures for operation” among others helpdesk, information system, and contingency facilities for participants. Point d The term “Operational activities” among others operational activities of Payment System infrastructures by Bank Indonesia under the applicable provisions. Point e Included in cost or price scheme policy are among others the policy of Bank Indonesia to exclude price or cost of certain transactions to support economic and financial policy. Point f Efforts to guarantee reliability, availability, and security of operation are conducted among others by preparing minimum service standard on Payment System infrastructure operation by Bank Indonesia, procedure to mitigate an abnormal and/or emergency situations. Point g Sufficiently clear. Point h Sufficiently clear. Point i Other authorities include the authority to request data and/or information.

-16- Article 53 Paragraph (1) Point a Sufficiently clear. Point b Sufficiently clear. Point c Sufficiently clear. Point d Sufficiently clear. Point e Sufficiently clear. Point f Sufficiently clear. Point g Sufficiently clear. Point h The term “comply with other provisions” among others comply with the provisions for customer service standard and limit of transaction nominal amount. Point i Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear.

-17- Article 54 Sufficiently clear. Article 55 Sufficiently clear. Article 56 Sufficiently clear. Article 57 Point a The term “switching interconnection” means interconnectedness between one switching PIP network and other switching PIP network. Point b The term “Interconnection of access to Sources of Fund in the form of payment channel” means interconnectedness between network in one payment channel and another. The term “interoperability of access to Sources of Fund in the form of payment channel” means a condition where payment instruments may be used in infrastructures other than PJP infrastructures conducting administration of source of fund and the relevant payment instrument issuers. The term “agent” means a party cooperating with PJP conducting administration of source of fund in providing Payment System and financial services by using mobile-based and web-based facilities and device.

-18- The term “other payment channels” means proprietary channels by banks, except payment channels whose transactions are processed through SKNBI and/or Sistem BI-RTGS. Point c The term “Source of Fund interoperability” means a condition where payment instruments may be used in infrastructures other than PIP infrastructures conducting administration of source of fund and the relevant payment instrument issuers. The term “Automated teller machine card” means a card widely known as automated teller machine (ATM) card. Article 58 Sufficiently clear. Article 59 Sufficiently clear. Article 60 Sufficiently clear. Article 61 Sufficiently clear. Article 62 Sufficiently clear. Article 63 Sufficiently clear.

-19- Article 64 Paragraph (1) Point a Settlement processing at Bank Indonesia includes:

1. Settlement by a Switching Agency for calculation of transactions between members in the same Switching Agency; and
2. Settlement by a Services Agency for calculation of transactions between Services Agency and/or between PJP conducting administration of Source of Fund. Point b Sufficiently clear. Point c The term “national branding” means a set of rules on logo, expansion of national acceptance, and domestic processing. Point d Sufficiently clear. Point e Included in service features for payment transactions processed through NPG include payment, transfer, cash withdrawal, balance check, and/or other service features. Point f Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear.

-20- Paragraph (4) Sufficiently clear. Article 65 Paragraph (1) Point a Sufficiently clear. Point b Sufficiently clear. Point c The term “service features for payment transactions processed through NPG” among others payment, transfer, cash withdrawal, balance check, and/or other service features. Point d Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear. Article 66 Sufficiently clear.

-21- Article 67 Paragraph (1) Point a Sufficiently clear. Point b Sufficiently clear. Point c Human resource capability includes among others competency. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear. Article 68 Sufficiently clear. Article 69 Sufficiently clear. Article 70 Sufficiently clear. Article 71 Paragraph (1) Point a The term “interconnection and interoperability mechanism” among others interconnection and interoperability

-22- mechanism of payment transaction processing and data processing. Point b The term “data infrastructure” among others integrated data infrastructure facilitated by Bank Indonesia. Point c Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear. Paragraph (5) Sufficiently clear. Paragraph (6) Sufficiently clear. Paragraph (7) Point a The term “The usage of electronic system and/or activities integrated with PIP head office outside the territory of the Republic of Indonesia” among others:

1. electronic system used for risk management;
2. electronic system used for implementation of anti-money laundering and countering the financing of terrorism; and

-23- 3. transaction reconciliation conducted in an integrated manner with PIP head office outside the territory of the Republic of Indonesia. The term “PIP head office” among others main office or primary entity office domiciled outside the territory of the Republic of Indonesia. Point b Sufficiently clear. Point c Sufficiently clear. Point d Sufficiently clear. Paragraph (8) Sufficiently clear. Article 72 Sufficiently clear. Article 73 Sufficiently clear. Article 74 Sufficiently clear. Article 75 Sufficiently clear.

-24- Article 76 Sufficiently clear. Article 77 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) The size criterion is measured among others by using nominal amount and volume of transactions processed by PIP. Paragraph (4) The interconnectedness criterion is measured among others by using nominal amount, volume, and/or interconnectedness of transactions processed by PIP. Paragraph (5) The complexity criterion is measured among others by considering complexity of payment services. Paragraph (6) Sufficiently clear. Article 78 Sufficiently clear. Article 79 Sufficiently clear.

-25- Article 80 Sufficiently clear. Article 81 Sufficiently clear. Article 82 Sufficiently clear. Article 83 Sufficiently clear. Article 84 Sufficiently clear. Article 85 Sufficiently clear. Article 86 Sufficiently clear. Article 87 Sufficiently clear. Article 88 Sufficiently clear.

-26- Article 89 Sufficiently clear. Article 90 The term “observing provisions for capital specified by other authority” means if the provisions for the obligations of capital as well as risk management and information system security standard are stricter or higher than the provisions obliged by Bank Indonesia , the provisions of other authority will apply. In the event that the provisions of other authority specify less stricter or lower for obligation of capital as well as risk management and information system security standard than the provisions obliged by Bank Indonesia, then the obligation of capital and risk management and information system security standard specified in this Bank Indonesia Regulation will apply. Article 91 Sufficiently clear. Article 92 Sufficiently clear. Article 93 Sufficiently clear. Article 94 Sufficiently clear.

-27- Article 95 Sufficiently clear. Article 96 Sufficiently clear. Article 97 Sufficiently clear. Article 98 Sufficiently clear. Article 99 Sufficiently clear. Article 100 Sufficiently clear. Article 101 Paragraph (1) Self-assessment is conducted by observing, among others, business model catalog for development of activities, products, and/or cooperation issued by Bank Indonesia. Self-assessment by PIP among others contains assessment results of risk categories and explanation of the selected risk category assessment. Paragraph (2) Sufficiently clear.

-28- Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear. Article 102 Sufficiently clear. Article 103 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear. Paragraph (5) Point a Sufficiently clear. Point b Sufficiently clear. Point c Other documents include documents required by Bank Indonesia to support reports submitted by PJP.

-29- The example of other documents among others the explanation of business model and/or transaction flow from development of products, activities, and/or cooperation. Paragraph (6) Sufficiently clear. Paragraph (7) Sufficiently clear. Paragraph (8) Sufficiently clear. Article 104 Sufficiently clear. Article 105 Sufficiently clear. Article 106 Sufficiently clear. Article 107 Sufficiently clear. Article 108 Sufficiently clear. Article 109 Sufficiently clear.

-30- Article 110 Sufficiently clear. Article 111 Sufficiently clear. Article 112 Sufficiently clear. Article 113 Sufficiently clear. Article 114 Sufficiently clear. Article 115 Sufficiently clear. Article 116 Sufficiently clear. Article 117 Sufficiently clear. Article 118 Sufficiently clear.

-31- Article 119 Sufficiently clear. Article 120 Sufficiently clear. Article 121 Sufficiently clear. Article 122 Sufficiently clear. Article 123 Sufficiently clear. Article 124 Sufficiently clear. Article 125 Sufficiently clear. Article 126 Sufficiently clear. Article 127 Sufficiently clear.

-32- Article 128 Sufficiently clear. Article 129 Sufficiently clear. Article 130 Sufficiently clear. Article 131 Sufficiently clear. Article 132 Sufficiently clear. Article 133 Sufficiently clear. Article 134 Sufficiently clear. Article 135 Sufficiently clear. Article 136 Sufficiently clear.

-33- Article 137 Sufficiently clear. Article 138 Sufficiently clear. Article 139 Sufficiently clear. Article 140 Sufficiently clear. Article 141 Sufficiently clear. Article 142 Sufficiently clear. Article 143 Sufficiently clear. Article 144 Sufficiently clear. Article 145 Evaluation is conducted to ensure the provision of supporting services will support execution of safe, efficient, smooth, and reliable payment transactions by observing consumer protection aspect.

-34- Article 146 Sufficiently clear. Article 147 Sufficiently clear. Article 148 Sufficiently clear. Article 149 Sufficiently clear. Article 150 Sufficiently clear. Article 151 Sufficiently clear. Article 152 Examples of “virtual currency” include Bitcoin, BlackCoin, Dash, Dogecoin, Litecoin, Namecoin, Nxt, Peercoin, Primecoin, Ripple, and Ven. Article 153 Sufficiently clear. Article 154 Sufficiently clear.

-35- Article 155 Sufficiently clear. Article 156 Sufficiently clear. Article 157 Sufficiently clear. Article 158 Sufficiently clear. Article 159 Sufficiently clear. Article 160 Sufficiently clear. Article 161 Sufficiently clear. Article 162 Sufficiently clear.

-36- Article 163 Paragraph (1) Point a Sufficiently clear. Point b Sufficiently clear. Point c Sufficiently clear. Point d Sufficiently clear. Point e Sufficiently clear. Point f The term “immediate availability of substitute Payment System infrastructure” means availability of other Payment System infrastructures which may substitute the function of the Payment System infrastructure in an immediate manner. Point g Sufficiently clear. Paragraph (2) Sufficiently clear. Article 164 The term “international standards” among others are Principles for Financial Market Infrastructures issued by Bank for International Settlements – Committee on Payment and Settlement Systems (CPSS) and International Organization of Securities Commissions (IOSCO).

-37- Article 165 Sufficiently clear. Article 166 Sufficiently clear. Article 167 Sufficiently clear. Article 168 Sufficiently clear. Article 169 Sufficiently clear. Article 170 Sufficiently clear. Article 171 Sufficiently clear. Article 172 Sufficiently clear. Article 173 Sufficiently clear.

-38- Article 174 Sufficiently clear. Article 175 Sufficiently clear. Article 176 Sufficiently clear. Article 177 Sufficiently clear. Article 178 Sufficiently clear. Article 179 Sufficiently clear. Article 180 Sufficiently clear. Article 181 The term “another party” include among others the relevant ministries and institutions. Article 182 Sufficiently clear.

-39- Article 183 Sufficiently clear. Article 184 Sufficiently clear. Article 185 Sufficiently clear. Article 186 Sufficiently clear. Article 187 Sufficiently clear. Article 188 Sufficiently clear. Article 189 Sufficiently clear. Article 190 Sufficiently clear. Article 191 Sufficiently clear.

-40- Article 192 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) The term “provisions of Bank Indonesia” among others are provisions regarding the obligation to maintain data confidentiality. Article 193 Paragraph (1) Sufficiently clear. Paragraph (2) An example of inspection by other mechanisms includes inspection through online communication. Paragraph (3) Sufficiently clear. Article 194 Sufficiently clear. Article 195 Sufficiently clear. Article 196 Sufficiently clear.

-41- Article 197 Sufficiently clear. Article 198 Sufficiently clear. Article 199 Sufficiently clear. Article 200 Sufficiently clear. Article 201 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear. Paragraph (5) An example of inspection by other mechanisms includes inspection through online communication. Paragraph (6) Sufficiently clear. Paragraph (7) Sufficiently clear.

-42- Paragraph (8) Sufficiently clear. Paragraph (9) Sufficiently clear. Paragraph (10) Sufficiently clear. Paragraph (11) Sufficiently clear. Article 202 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear. Paragraph (5) Point a Examples of further actions to supervision related to business performance and capital aspect include additional capital from shareholders, corporate actions, and other Sources of Fund. Point b An example of further actions to the supervision related to risk management and adequacy, security, and reliability of information system includes information technology.

-43- Point c Examples of further action to the supervision related to integrity and/or competence of the management and shareholders include fitness and properness, change of management, audit or certification. Paragraph (6) Sufficiently clear. Paragraph (7) Sufficiently clear. Paragraph (8) Sufficiently clear. Article 203 Sufficiently clear. Article 204 Sufficiently clear. Article 205 Sufficiently clear. Article 206 Sufficiently clear. Article 207 Sufficiently clear.

-44- Article 208 Sufficiently clear. Article 209 Sufficiently clear. Article 210 Sufficiently clear. Article 211 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Point a Sufficiently clear. Point b Sufficiently clear. Point c Sufficiently clear. Point d Sufficiently clear. Point e Sufficiently clear. Point f Sufficiently clear.

-45- Point g Other considerations among others are business development and sustainability of PIP. Paragraph (4) Sufficiently clear. Paragraph (5) Sufficiently clear. Paragraph (6) Sufficiently clear. Article 212 Sufficiently clear. Article 213 Sufficiently clear. Article 214 Sufficiently clear. Article 215 Sufficiently clear. Article 216 Paragraph (1) The term “termination of activity” means termination of key activities of PIP or termination of products. Paragraph (2) Sufficiently clear.

-46- Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear. Paragraph (5) Sufficiently clear. Paragraph (6) Sufficiently clear. Paragraph (7) Sufficiently clear. Paragraph (8) Sufficiently clear. Paragraph (9) Sufficiently clear. Paragraph (10) Sufficiently clear. Article 217 Paragraph (1) Sufficiently clear. Paragraph (2) Point a The term “data and/or information on payment transactions” at least include payment instruments, nominal amount, and channels. Point b The term “data and/or information on payment transaction information details” at least include profiles of goods and/or

-47- service providers, profiles of service users, payment methods, transaction areas, and products. Point c The term “data and/or information on PIP performance” at least include financial statements, business performance reports, statements of changes in equity, and business plans of PIP. Point d The term “data and/or information on Payment System operation” at least include consumer complaints, fraud, incidents, and cyber-attack. Point e The term “data and/or information on monitoring of compliance of Payment System infrastructure participants operated by Bank Indonesia” at least include governance, operation, infrastructure, business continuity plan in relation to cyber incident and attack, fraud, and consumer protection. Point f Sufficiently clear. Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear. Paragraph (5) Sufficiently clear. Paragraph (6) Sufficiently clear.

-48- Article 218 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Point a The term “data and/or information on payment transactions” include payment instruments, nominal amount, and channels. Point b The term “data and/or information on payment transaction information details” at least include profiles of goods and/or service providers, profiles of service users, payment methods, transaction areas, and products. Paragraph (4) Sufficiently clear. Paragraph (5) Sufficiently clear. Article 219 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) The term “data capturing through inter-system connection directly and real time” is conducted among others through data

-49- infrastructures operated by Bank Indonesia, other authority, or provision of information system access to Bank Indonesia. Paragraph (4) Sufficiently clear. Paragraph (5) Sufficiently clear. Article 220 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear. Paragraph (4) Point a An example of daily report is system availability report. Point b An example of weekly report is weekly payment transaction report. Point c Examples of monthly report are monthly payment transaction report, fraud report, and report on disruption and availability of technology information infrastructures. Point d An example of quarterly report is unaudited financial statement.

-50- Point e Examples of annual report include:

1. annual report on Payment System, which includes among others business plan and realization of payment system operation activities, main data updates, and self￾assessment of information system;
2. management report and supervision result by the board of commissioners which includes among others are governance including ownership and control structure, risk management and information system security standard, and supervision result by the board of commissioners; and/or
3. audited financial statements. Point f Sufficiently clear. Point g Sufficiently clear. Paragraph (5) Point a Sufficiently clear. Point b Report on change of data and information among others contains change of PIP name, office address, main documents on business relationship, rights and obligations of parties, cooperation agreement, parties in cooperation, and procedure and mechanism of dispute resolution.

-51- Point c Disruption in payment transaction processing means failure in PIP, including efforts made to mitigate it, among others:

1. malfunction of data center and disaster recovery center;
2. network failure in payment transactions processing; and/or
3. fraud accompanied by information on the chronology and resulting losses impact. Point d Force majeure means an event beyond the control of PIP, causing conduct payment transaction processing cannot be carried out due to, including but not limited to, fire, riot, sabotage, and natural disasters, such as earthquake and flood declared by the local authority or competent official, including Bank Indonesia. Point e Sufficiently clear. Point f Sufficiently clear. Paragraph (6) Notice of force majeure occurrence is submitted to Bank Indonesia by phone, facsimile, and/or any other means of information. Paragraph (7) Sufficiently clear. Paragraph (8) Sufficiently clear.

-52- Article 221 Sufficiently clear. Article 222 Paragraph (1) Point a Sufficiently clear. Point b Data infrastructures of Bank Indonesia among others include information system and data infrastructures operated by Bank Indonesia such as Integrated Payment Interface and data hub, or operated by parties appointed by Bank Indonesia. Bank Indonesia Payment System Infrastructures among others include infrastructures used to operate or facilitate clearing and/or settlement of payment transactions. Point c Utilization of third-party data infrastructures among others includes use of cloud computing. Point d Cyber risk management includes governance, prevention, and resolution. Point e Sufficiently clear. Point f Sufficiently clear. Paragraph (2) Sufficiently clear.

-53- Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear. Paragraph (5) Sufficiently clear. Article 223 Mechanism of processing of data and/or information on Payment System conducted by standardization among others includes standardization of open application programming interface (open API). Article 224 Sufficiently clear. Article 225 Point a The term “access and surveillance” means ensuring access right, audit right, and guarantee for access right and data and/or information collection. Point b Sufficiently clear. Point c The term “data protection” means ensuring confidentiality and protection of data stored or processed using third party’s data infrastructures. Point d Sufficiently clear.

-54- Point e The term “data integrity” means ensuring data processing is conducted accurately, representing actual and consistent facts or conditions and using a transparent method. Article 226 Sufficiently clear. Article 227 Sufficiently clear. Article 228 Sufficiently clear. Article 229 Paragraph (1) Sufficiently clear. Paragraph (2) Sufficiently clear. Paragraph (3) The approval to be requested to Bank Indonesia by SRO among others is determination of cost or price scheme. Paragraph (4) Sufficiently clear. Paragraph (5) Sufficiently clear.

-55- Article 230 Sufficiently clear. Article 231 Sufficiently clear. Article 232 Sufficiently clear. Article 233 Paragraph (1) The term “change of foreign ownership composition” means change of foreign share ownership percentage for all shares held by a foreign party in an entity, either change to higher or lower percentage, experiencing material and/or significant changes. The term “change of control by a foreign party” means change of foreign party which controls an entity, due to change of share ownership composition (percentage) with voting rights or special rights or the controlling subject as specified in the company’s deed. Paragraph (2) Sufficiently clear. Paragraph (3) Sufficiently clear. Paragraph (4) Sufficiently clear.

-56- Article 234 Sufficiently clear. Article 235 Sufficiently clear. Article 236 Sufficiently clear. Article 237 Sufficiently clear. Article 238 Sufficiently clear. SUPPLEMENT TO STATE GAZETTE OF THE REPUBLIC OF INDONESIA NUMBER 6693