Circular Letter No. 7/59/DASP Administration Procedures of Card-Based Payment Instrument Activities

Number 7/59/DASP Jakarta, 30 December 2005 CIRCULAR Subject : Administration Procedures of Card-Based Payment Instrument Activities

------------------------------------------- In connection with the enactment of Bank Indonesia Regulation Number 7/52/PBI/2005, dated 28 December 2005, concerning Card-Based Payment Instrument Activities (State Gazette of the Republic of Indonesia Number 148/2005, Supplement to State Gazette of the Republic of Indonesia Number 4583), and in order to support smoothness and effectiveness of the Card-Based Payment Instrument Activities, it is necessary to regulate further the operation of the Card-Based Payment Instrument Activities in a Bank Indonesia Circular.
I. ADMINISTRATION PROCEDURES OF CARD-BASED PAYMENT
INSTRUMENT ACTIVITIES (APMK)
A. Requirements for APMK Administrators

1. Principals
   The Principals shall consist of general Principals and special Principals. The activities as general Principals may only be performed by non-Bank Institutions, whereas the activities as special Principals may be performed by both Bank and non￾Bank Institutions. In order to act as a Principal, either a Credit Card, an ATM Card, a Debit Card and/or a Prepaid Card Principal, a Bank or non-Bank Institution shall report in writing beforehand on the administration … Unofficial translation

administration of the activities as a Principal to Bank Indonesia. The written report shall contain at least the following matters:
a. the types of APMK activities administered; b. the planned time to begin the activities as a Principal; and
c. the brand name used.
The aforesaid written report shall be attached with the documents on:
a. the company profile of the Bank or non-Bank Institution; and b. the business arrangement between the Principal and the Issuer, particularly for the general Principal. The business arrangement shall contain, among others, the procedures of establishment and requirements to become an Issuer, the mechanisms of settlement, and the implementation of other operating business activities of the issuance of the general Principal’s brand—name cards.
2. Issuers
a. Any Bank may act as an Issuer of Credit Cards, ATM Cards, Debit Cards and/or Prepaid Cards. b. Any non-Bank Institution may act as an Issuer, provided that:
1) The non-Bank Institution that may act as an
Issuer of Credit Cards is a non-Bank Institution licensed by the Ministry of Finance of the Republic of Indonesia to administer the Credit Card activities.
2) The non-Bank…

2) The non-Bank Institution that may act as an
Issuer of ATM and/or Debit Cards is a non￾Bank Institution authorized to perform the activities to raise funds from the society in the form of deposit based on the law that regulates the non-Bank Institutions.
3) The non-Bank Institution that may act as an
Issuer of Prepaid Cards that requires approval of Bank Indonesia shall be a non-Bank Institution that:
a) has an Indonesian legal entity in the form of a Limited Liability Company (PT); and b) has the experience and reputation in the administration of Single-purpose-single￾merchant or Multi-purpose-single￾merchant Prepaid Cards in Indonesia for at least 2 (two) years.
c. In order to be approved by Bank Indonesia, the Bank
and non-Bank Institution that will act as Issuers as referred to in letters a and b shall request in writing in respect of the plan to administer the activities as Issuers to Bank Indonesia. The written request shall contain at least the following matters:
1) the types of APMK activities to be
administered; and
2) the planned time to begin the activities as
Issuers.
The aforesaid …

The aforesaid written request shall be attached with the following documents, consisting of:
1) The Bank’s Work Plan that shall state the
planned activities of the Bank as an Issuer or the planned activities of the non-Bank Institution.
2) The photocopy of the legal entity’s
incorporation deed legalized by the authorized party, particularly for non-Bank Institutions. The photocopy of the legal entity’s incorporation deed shall also be legalized by the authorized party/official.
3) The business analysis results of the APMK
activity administration that will be performed in 1 (one) year. The business analysis results shall contain at least the description of:
a) the existing market potentials; b) the market segments to be targeted and the business competition analysis; c) the targeted number of card holders to be achieved; d) the plan of cooperation with the Principals and/or Acquirers, including their number and names; e) the planned scope of the operating areas; and f) the targeted income to be achieved.
4) The evidence … …

4) The evidence of the legal requirements,
including:
a) The photocopy of the written agreements or the principles of the written agreements between the Issuers and the Principals, particularly for the general Principals. The principles of the written agreements shall contain, among others, the agreements between the general Principals and the Issuers on the use of the trade names of the general Principals in card issuance, the rights and duties of each party, the cooperation implementation plan, the timeframe, and the mechanisms of settlement of disputes that arise. If the prospect Issuer is a branch office of a foreign Bank, and the agreement entered into with the general Principal is a Global Agreement between the Bank’s head office and the general Principal, the branch office of the foreign Bank shall simply submit the principles of the Global Agreement. b) The concept of arrangement of the rights and duties of the parties, such as the arrangements of the rights and duties of the Issuers, Acquirers and Card Holders. c) The procedures …

c) The procedures of settlement of disputes arising among the parties, including at least:
(1) the mechanisms of arrangement or settlement of possible disputes between the Issuer and the Card Holder; and (2) the mechanisms of settlement of customer claims on the issued products, and d) Particularly for non-Bank Institutions, they shall also submit recommendations from the authorized parties that provide institutional licensing and/or the authorities that supervise such non-Bank Institutions. The recommendations shall, in this matter, among others, be in respect of the financial condition, the health condition and the compliance of such non-Bank Institutions with the prevailing legislation.
5) The evidence of preparedness of the risk
management application that includes at least the liquidity risk management, the credit risk management and/or the operating risk management in the form of:
a) The internal regulations on active supervision of the Board of Commissioners …

Commissioners and the Board of
Directors, including at least:
(1) The establishment of accountability, policies and processes of controlling and managing the risks arising out of card issuance. (2) The agreement and restudy of the main aspects of the procedures of security control of card issuance. b) The procedures of security control of card issuance that shall contain at least the arrangement of:
(1) the procedures and security steps taken in card issuance, such as the creation and delivery of PINs and delivery of cards to the Card Holders; (2) the separation of duties among the processes of application, agreement and invoice; (3) the authority or control in providing the agreement for the prospect Card Holders; (4) the steps to authenticate the identity and authorization of the customers who execute APMK transactions; (5) the audit …

(5) the audit trail of the transactions of the Card Holders; (6) the adequate procedures to guarantee the integrity of the data, records or files, and information on the APMK transactions; and (7) the steps to maintain confidentiality of the Card Holders’ information. c) The procedures of controlling the reputation and operating risks that shall contain at least:
(1) the provision of information on the benefits and risks of the products before the customers become Card Holders; and (2) the procedures of the disaster recovery plan and the business continuity plan that are effective in coping with and minimizing the problems arising out of unexpected occurrences that may disrupt smoothness of the APMK system operation.
6) The evidence of the operating preparedness that
shall include at least:
a) the plan …

a) the plan of the organizational structure and the preparedness of the human resources; and b) the plan of the business equipment and facilities that shall at least contain the information on:
(1) the locations and rooms to be used for the operating activities; and (2) the system-related technical equipment (hardware and software) and the network to be used.
3. Acquirers
a. In the administration of the APMK activities, the Acquirers shall consist of Financial Acquirers and Technical Acquirers. b. Any Bank may act as a Financial Acquirer of Credit Cards, ATM Cards, Debit Cards and/or Prepaid Cards.
c. The non-Bank Institution that may act as a Financial
Acquirer of Credit Cards, ATM Cards, Debit Cards and/or Prepaid Cards shall be the non-Bank Institution with the authority to perform the activities of credit provision or funding based on the legislation that regulates the non￾Bank Institutions. d. In order to be approved by Bank Indonesia, the Bank and the non-Bank Institution that will act as Financial Acquirers as referred to above shall request in writing for the planned activity implementation as Financial Acquires to …

Acquirers to Bank Indonesia, and the request shall at least contain the following matters:
1) the type of APMK activities to be performed by the
Financial Acquirers; and
2) the planned time to begin the administration as the
Financial Acquirers.
The written request as referred to above shall be attached with the following documents, consisting of:
1) The Bank’s Work Plan that shall state the planned
activities of the Bank as a Financial Acquirer or the work plan of the non-Bank Institution.
2) The photocopy of the legal entity’s incorporation
deed legalized by the authorized party, particularly for the non-Bank Institution. The photocopy of the legal entity’s incorporation deed shall also be legalized by the authorized party/official.
3) The business analysis results of the Financial
Acquirer’s activities that will be performed in 1 (one) year. The business analysis results shall contain at least:
a) the existing market potentials; b) the market segments to be targeted and the business competition analysis; c) the plan of cooperation with the Principals, Issuers and Technical Acquirers, including their number and names; d) the planned scope of the operating areas; and e) the targeted income to be achieved.
4) The evidence …

4. The evidence of the legal requirements, including:
a) the photocopy of the written agreements or the principles of the written agreements between the Financial Acquirers and the Issuers and/or the suppliers of the goods and/or services; b) the arrangement of the rights and duties of the parties, such as the arrangement of the rights and duties of the Financial Acquirers, Issuers and/or the suppliers of the goods and/or services; c) the procedures of settlement of the disputes arising among the parties. The procedures of settlement of the disputes shall, in this matter, among others, include the mechanisms of arrangement or settlement of the disputes possibly occurring among the Financial Acquirers and the Issuers and/or the suppliers of the goods and/or services; and d) particularly for non-Bank Institutions, they shall also include the recommendations from the parties authorized to provide institutional licensing and/or the authorities that supervise such non-Bank Institutions. In this matter, the recommendations shall be, among others, the recommendations on the financial condition, health condition and compliance of the non￾Bank Institutions with the prevailing legislation.
5. The evidence …

5. The evidence of preparedness for the risk
management application that shall include, among others, the management of liquidity risks, credit risks and operating risks. The documents on the preparedness for the risk management application shall be in the form of security control arrangement by the Financial Acquirers over the system used that shall contain:
a) the adequate procedures to guarantee integrity of the data, records or files and information on APMK transactions; b) the steps to authenticate the identity and authorization of the customers who execute APMK transactions; c) the audit trail of the transactions processed through the Financial Acquirers’ systems; d) the steps to maintain confidentiality of the Card Holders’ data processed through the Financial Acquirer’s systems, including the systems provided by the Technical Acquirer, if the Financial Acquirer cooperates with the Technical Acquirer. e) The steps to maintain confidentiality of the Card Holders’ data stored in the system of the supplier of the goods/services who cooperates with the Financial Acquirer; and f) The procedures of the effective disaster recovery plan and the business continuity plan in coping …

in coping with and minimizing the problems arising out of unexpected occurrences that may disrupt smoothness of the APMK system operation.
6. The evidence of the operating preparedness as
referred to in the provision of point 2.c.6).
B. Delivery of Reports and Request for Approval The reports of the Bank or non-Bank Institution that will act as a Principal and the request for approval for the Bank or non-Bank Institution that will act as an Issuer and/or a Financial Acquirer shall be delivered by:

1. the head office of the Bank or non-Bank Institution if the Bank
   or non-Bank Institution has its head office in the Indonesian territory; or

2. the branch office of the Bank or the branch/representative
   office of the non-Bank Institution in Indonesia if the Bank or non-Bank Institution has its head office outside the Indonesian territory. The reports and requests for approval as referred to above shall be submitted to Bank Indonesia pursuant to the provisions stated in the Attachment to this Bank Indonesia Circular.
   C. Processing of Requests for Approval
   To the written request submitted by the Bank or non-Bank Institution that will become an Issuer and/or a Financial Acquirer, Bank Indonesia shall respond by rejecting or approving. The procedures of approval of performing the APMK activities shall be as follows:
   1) For the administration …

3. For the administration of the APMK activities, the request for
   which is submitted to Bank Indonesia, through the Directorate of Accounting and Payment System, the procedures of approval shall be as follows:
   a. The provision of a response in the form of approval or rejection in a time period of no longer than 45 (forty￾five) business days after the complete request letter and documents are received by the Directorate of Accounting and Payment System. b. In order to provide a response as referred to in letter a, the Directorate of Accounting and Payment System shall carry out the following:
   1) administrative inspection of the requirements and
   appropriateness of the documents submitted by the Bank or non-Bank Institution;
   2) on-site supervision to the relevant Bank and/or
   non-Bank Institution to verify the documents submitted, if necessary; and
   3) particularly at the request of the Bank, requesting
   recommendations from the relevant work unit at Bank Indonesia that handles the banking supervision on the financial condition, health level and compliance of the Bank with the prevailing legislation, including the information if there are problems facing the Bank.
   c. If the administrative inspection of the documents and the
   on-site inspection as referred to in points b.1) and b.2) have been carried out, and taking into account the recommendations …

recommendations of the banking supervisors as referred to in point b.3) or the recommendations of the parties authorized to provide institutional licensing and/or the authorities supervising non-Bank Institutions, the Directorate of Accounting and Payment System shall carry out the following:
1) Rejecting, if the evaluation results as referred to in
point b.1) and/or the existing recommendations fail to meet one or more requirements established by Bank Indonesia and/or do not produce any good results. Then, the Directorate of Accounting and Payment System shall send a rejection letter specifying the reason(s) for the rejection and return all the attached documents submitted by the Bank or non￾Bank Institution. The Bank or non-Bank Institution whose request is rejected may request again the approval of the Directorate of Accounting and Payment System by fulfilling all the requirements and procedures of requesting as an Issuer and/or a Financial Acquirer as regulated in this Circular; or
2) Approving, if the evaluation results as referred to
in points b.1) and b.2) meet all the requirements established by Bank Indonesia and the existing recommendations indicate good results. Then …

Then, the Directorate of Accounting and Payment System shall send an approval letter to the relevant Bank or non-Bank Institution to act as an Issuer and/or a Financial Acquirer. Particularly for the Bank, the reporting on the operation of the ATM machines to the Directorate of Banking Licensing and Information or the Bank Indonesia Offices of the relevant regions may be carried out following the approval for the issuance of ATM Cards by the Directorate of Accounting and Payment System.
2. For the APMK activities administered by commercial Banks
whose activities are based on the syariah principles (Syariah Commercial Banks) or by the Syariah Business Units (UUS), the approval or rejection of the administration of APMK activities shall be made by Bank Indonesia, through the Directorate of Syariah Banking, by means of the procedures pursuant to the Bank Indonesia regulations on the business activities of Syariah Commercial Banks and UUS. D. Implementation of APMK Activities

1. For the approvals provided by the Directorate of Accounting
   and Payment System, the APMK activities shall be performed on the basis of the following provisions:
   a. If the request of the Bank or non-Bank Institution to act as an Issuer and/or a Financial Acquirer is approved, then within a time period of no longer than 45 (forty-five) business days as of the date on which the approval is provided …

provided, the Bank or non-Bank Institution shall carry out its activities as an Issuer and/or a Financial Acquirer. b. If, within the time period as referred to in letter a, the Bank or non-Bank Institution having been approved as an Issuer and/or Financial Acquirer has carried out its activities, the Bank or non-Bank Institution shall report in writing on the commencement of its activities as an Issuer and/or a Financial Acquirer to the Directorate of Accounting and Payment System.
c. The written report as referred to in letter d shall be
submitted no later than 10 (ten) business days as of the date on which the activities are commenced. d. If, after the termination of the time period of 45 (forty￾five) business days as referred to in letter a, the Bank or non-Bank Institution having been approved as an Issuer and/or a Financial Acquirer has not carried its activities, the Bank or non-Bank Institution shall report in writing to Bank Indonesia on the reason(s) for being incapable of carrying out the activities and on the time planned for performing the activities. e. The written report on being incapable of carrying out the activities as an issuer and/or a Financial Acquirer as referred to in letter d shall be submitted no later than 10 (ten) business days as of the date on which the time period of 45 (forty-five) business days terminates as referred to in letter a.
2. For the approval provided by the Directorate of Syariah
Banking, the APMK activities of the Syariah Commercial Banks or UUS shall be carried out pursuant to the Bank Indonesia …

Indonesia regulations on the business activities of the Syariah Commercial Banks and UUS. E. Suspension or Cancellation of Approvals
1. Bank Indonesia, through the Directorate of Accounting and
Payment System, may suspend the enactment of the approval provided for an Issuer and/or a Financial Acquirer if, until the time limit as referred to in point D.1.a, the Issuer and/or the Financial Acquirer is incapable of carrying out its activities.
2. In addition to the condition as referred to in point 1, Bank
Indonesia, through the Directorate of Accounting and Payment System, may suspend the approval provided if the Bank’s financial condition worsens, there are recommendations from the non-Bank Institution supervising authorities to suspend the enactment of the approval provided for the non-Bank Institution or the risk management of the Bank or non-Bank Institution is weak that, in the opinion of the supervising authorities, may cause losses to the parties relevant to the APMK activities and/or the national economy.
3. The timeframe for suspending the approval by Bank Indonesia,
through the Directorate of Accounting and Payment System, as referred to in points 1 and 2 shall be established by taking into account the condition of the Issuer and/or the Financial Acquirer, the problems faced by the Issuer and/or the Financial Acquirer, and other relevant factors.
4. The Issuer and/or the Financial Acquirer cannot commence
their activities until obtaining the written notice on the revocation of the suspended approval from Bank Indonesia, through the Directorate of Accounting and Payment System.
5. Bank Indonesia …

5. Bank Indonesia, through the Directorate of Accounting and
Payment System, may annul the approval provided if the Bank’s financial condition worsens, there are recommendations from the non-Bank Institution supervising authorities to annul the approval provided for the non-Bank Institution or the risk management of the Bank or non-Bank Institution is weak that, in the opinion of the supervising authorities, may cause losses to the parties relevant to the APMK activities and/or the national economy.
6. The suspension or annulment of the approval provided for
Syariah Commercial Banks or UUS as Issuers and/or Financial Acquirers shall be carried out pursuant to the Bank Indonesia regulations on the business activities of Syariah Commercial Banks and UUS.
II. DISCONTINUATION OF APMK ACTIVITY ADMINISTRATION
1. The Administrator’s activities may be discontinued by Bank
Indonesia or at the request of the relevant administrator.
2. Bank Indonesia shall discontinue permanently the APMK activity
administration if:
a. The APMK activity Administrator fails to meet the Bank Indonesia regulations after being imposed with the sanction of temporary discontinuation; b. There is a court ruling with fixed legal power sentencing the Administrator to discontinue its APMK activities or there is a written request/recommendation from the authorities supervising the APMK Administrator; or
c. There is …

c. There is a written request/recommendation to Bank Indonesia
from the supervising authorities to discontinue the Administrator’s business activities or the aforesaid supervising authorities have discontinued the Administrator’s business activities.
3. If the Administrator is to discontinue its APMK activities, the
relevant Administrator shall report the same in writing to Bank Indonesia, through the Directorate of Accounting and Payment System, no later than 1 (one) month before the Administrator discontinues its activities.
4. The report as referred to in point 3 shall contain at least the
following matters:
a. the reason(s) for discontinuing the activities; and b. the mechanisms of settling the issues of the rights and duties of the Administrator and the Card Holders.
5. Bank Indonesia shall, based on the provisions as referred to in point
2 or the report on the discontinuation of the activities by the Administrator as referred to in point 3, send a confirmation letter to the Administrator on the discontinuation of the activities and simultaneously annul the approval provided.
6. The implementation of the discontinued activities by the
Administrator shall be reported in writing to Bank Indonesia, through the Directorate of Accounting and Payment System, no later than 3 (three) business days as of the date on which the activities are discontinued.
7. If the Administrator who has discontinued its activities is to
readminister its APMK activities, the Administrator shall submit a written request …

written request prior to administering any such activities, in compliance with all the requirements and procedures as regulated in this Circular.
III. MISCELLANEOUS

1. The Bank or non-Bank Institution that will act as both an Issuer and
   a Financial Acquirer shall meet not only the requirements as an Issuer as referred to in point I.A.2 but also the requirements as a Financial Acquirer as referred to in point I.A.3.
2. The requests for approval for the Bank and/or non-Bank Institution
   that will act as both an Issuer and a Financial Acquirer as referred to in point 1 may be submitted in a single request.
3. The Bank and/or non-Bank Institution that has been approved as an
   Issuer and will perform the activities as a Financial Acquirer and/or a Technical Acquirer shall report in writing on the plan of activities as a Financial Acquirer and/or a Technical Acquirer to Bank Indonesia. The aforesaid written report shall be attached with:
   a. The evidence of legal requirements, among others, in the form of:
   1) The photocopy of the written agreements or the
   principles of the written agreements between:
   a) The Financial Acquirer and other Issuers and suppliers of the goods and/or services; or b) The Technical Acquirer and other Issuers, other Financial Acquirers and suppliers of the goods and/or services.
   2) The arrangement of the rights and duties between:
   a) The Financial …

a) The Financial Acquirer and other Issuers and suppliers of the goods and/or services; or b) The Technical Acquirer and other Issuers and suppliers of the goods and/or services.
3) The procedures of settlement of disputes arising among
the parties. b. The evidence of preparedness of liquidity management, particularly for the Financial Acquirer, including, among others:
1) the mechanisms of the fulfilment of the obligations of
the Financial Acquirer; and
2) the mechanisms if the Financial Acquirer experiences
the failure to settle.
4. The Issuer and/or the Financial Acquirer who will cooperate with
the Technical Acquirer and/or the Switching Company shall request the Technical Acquirer and/or the Switching Company to report on their activities in writing to Bank Indonesia, through the Directorate of Accounting and Payment System. The request of the Issuer and/or the Financial Acquirer shall be carried out in writing or contained in the Agreement between the Issuer and/or the Financial Acquirer and the Technical Acquirer and/or the Switching Company.
5. The report of the Technical Acquirer and/or the Switching
Company to Bank Indonesia shall include at least the following matters:
a. the planned time to commence the cooperation; b) the names …

b. the names and number of the Issuers and/or the Financial Acquirers who have cooperated with the Technical Acquirer and/or the Switching Company; and
c. the standard fulfilment of the system security test of the
Technical Acquirer and/or the Switching Company based on the independent security auditor’s inspection results.
6. Submission of Reports
The reports as regulated in this Circular shall be submitted to:
Directorate of Accounting and Payment System Bank Indonesia Building D, 2nd Floor, Bank Indonesia Office Complex Jalan M.H. Thamrin Number 2 Jakarta 10110
IV. PROVISIONS OF TRANSFER

1. The Banks and non-Bank Institutions that had administered the
   APMK activities as Principles, Issuers and/or Financial Acquirers prior to 28 December 2004 shall report in writing to Bank Indonesia on the administration of their activities.
2. The report as referred to in point 1 shall contain:
   a. The company profile of the APMK activity Administrators that shall at least include:
   1) the name, place and status of the company;
   2) the line of business of the company as stated in the
   Company Registry, particularly for non-Bank Institutions;
   3) the brief history of the company;
   4) the information …

4) the information on the administered APMK activities;
and
5) the parties who cooperate with the Administrator.
b. Particularly for the Administrators as non-Bank Institutions, the report shall be attached with the photocopy of the legal entity’s incorporation deed or the photocopy of the incorporation deed of the legal entity legalized by the authorized party.
3. The reports containing the matters as referred to in point 2 shall
have been received by Bank Indonesia, through the Directorate of Accounting and Payment System, no later than 31 January 2006.
4. The Banks or non-Bank Institutions that have acted as special
Principals and the non-Bank Institutions that have acted as general Principals that have had their representative offices in the Indonesian territory and will change the status of their offices to branch offices shall report in writing on the plan to change the status of their office to Bank Indonesia. The provisions of this Circular shall be effective as of 30 December 2005. In order to be informed to everybody, it shall be instructed that this Circular be announced in the State Gazette of the Republic of Indonesia. Thank you. BANK INDONESIA, MOHAMAD ISHAK DIRECTOR OF ACCOUNTING AND PAYMENT SYSTEM