Circular Letter No. 7/60/DASP Customer Protection and Prudential Principles, and Security Improvement for the Operation of Card-Based Payment Instrument Activities

No. 7/60/DASP Jakarta, December 30, 2005 CIRCULAR LETTER Concerning : Customer Protection and Prudential Principles, and Security Improvement for the Operation of Card-Based Payment Instrument Activities

------------------------------------------------------------------------- With the issuance of Bank Indonesia Regulation Number 7/52/PBI/2005 dated December 28, 2005 concerning Operation of Card-Based Payment Instrument Activities (State Gazette of the Republic of Indonesia of 2005 Number 148, Supplement to the State Gazette of the Republic of Indonesia Number 4538), and as an effort to support the development of a sound operation of Card-Based Payment Instrument activities, it is necessary to enact implementation provisions for customer protection and prudential principles, and to improve security in the operation of Card-Based Payment activities in a Bank Indonesia Circular Letter.
I. CUSTOMER PROTECTION PRINCIPLES

1. Issuers are required to implement the customer protection principles in the
   operation of Card-Based Payment Instrument activities (APMK) by providing … Unofficial translation

providing written information to Cardholders concerning the issued APMK. The information provided must use clear and comprehensible Bahasa Indonesia, written in letters and numbers readable for the Cardholder, and delivered in an appropriate and timely manner.
2. For ATM Cards, Debit Cards, and/or Prepaid Cards, Issuers are required to
provide information for the Cardholders conveying at least the following:
a. procedure and use of the cards, facilities included with the cards, and risks that may arise from use of the cards; b. rights and obligations of the Cardholders that comprise at least the following:
1) important information need to be paid attention to by the
Cardholders in the use of the cards, including all the consequences/risks that may arise from use of the cards, such as to never give information concerning the Cardholders Personal Identification Number (PIN) to any other parties and to take caution in conducting transaction using ATM machine.
2) rights and obligations of the Cardholders in the occurance of
several cases that may bring loses upon the Cardholders, that may be caused by card forgery, failure in the Issuer system, or other reasons.
3) types and amount of administration charges, and
4. procedures…

4) procedures and consequences in the case that a Cardholder
wishes to discontinue being a Cardholder.
c. Complaint procedures concerning the use of the cards and estimated
time for dealing with these complaints.
3. Credit Cards Issuers are required to provide written information for the
Cardholders comprising all the information as defined in number 2, and to conduct the following actions:
a. To deliver general information concerning:
1) loan collectibility (performing, impaved, doubtful, or non￾performing) and the consequences for each collectibility status,
2) whether the Issuers use sevices of parties other than the Issuers
in the collection of debt , and
3) procedure and basis for calculating of interest and/or penalties,
and the components for calculating of interest and/or penalties, including at the time of ending the calculation for interest This general information shall be delivered by the Issuers to the Cardholders and must be reinformed to the Cardholders regarding any occurrence of changes. b. To deliver billing statements in a complete, accurate, informative, appropriate, and timely manner.
4. The written …

4. The written information as referred to in number 2 and number 3 shall be
printed in font size of 10, in Times New Roman, Bookman Antiqua, or Bookman Old Style type of characters, and be printed in dark colour on a light colour background (contrast colouring).
5. Issuers of Credit Cards are not allowed to automatically give any facilities
that require additional cost from the Cardholders and/or facilities other than the main functions of Credit Cards without written approval from the Cardholders. Written approval in this case includes written approval delivered through faximile, e-mail, or verbal agreement in an official record obtained by the officers of the concerning Issuers. Issuers are prohibited from writing any clauses in the agreement between Issuers and Cardholders that open the possibility of automatically give products to Cardholders and/or give any facilities requiring additional payment from the Cardholders, without written consent from the Cardholders. Examples of prohibited clauses:
a. A clause in the agreement between the issuers and the Cardholders such as the following:
“By signing this agreement, the Issuer has the right to give a facility or product to the Cardholder at any time and require the payment to be charged to the Credit Card which automatically be charged to the Cardholder.” b. Statement …

b. Statement offering a product, as follows:
“This product offering is considered to be accepted by the Cardholder if within 30 days after this product is offered, the Cardholder does not make any confirmation by phone to 021- 12345678”.
II. PRUDENTIAL PRINCIPLES

1. In the issuance of Credit Cards, Issuers are required to implement risk
   management based on the applicable provisions of Bank Indonesia concerning risk management.
2. Besides complying to the provision referred to in number 1, all Credit
   Cards issued by the Issuers to the Cardholders must also meet the followings requirements:
   a. Minimum Age Limit
   1) The minimum age limit for applicant of primary Credit Cards
   conveys the meaning of maturity as defined in the applicable provisions of Civil Law Code (KUHP), which is the age of 21 years old or married. The Issuers are required to obtain documents as proof of marriage status of the applicant for primary Credit Cards. The age limitation is necessary considering the Credit Card agreement is a civil case agreement between a bank and the Cardholders …

Cardholders. Therefore, the minimum age limit must be in compliance with the applicable Civil Law concerning the legal age limit for a party to conduct legal action on his behalf.
2) The minimum age for Secondary Card Holder is 17 years old or
married. The Issuers are required to acquire document completion as proof of age of the Credit Card applicant. For an applicant of Secondary Card who has not yet reached the age of 17, it is an obligation of the Issuers to request the necessary documents as proof of marriage of the concerning applicant of Secondary Credit Card. The minimum age limit policy for secondary Cardholders is according to the minimum age for acquiring Personal Identity Cards (KTP). The secondary Cardholders at this age are considered to be mature enough to understand that transactions using the Credit Cards shall be debt that must be paid off by the primary Cardholders, requiring careful and wisely use of the Credit Cards for transactions by the secondary Cardholders. b. The minimum monthly salary of applicants for Primary Cardholders must be 3 (three) times the Minimum Regional Wages (UMR) per month; The stipulation is necessary to ensure:
1) that people …

1) that people will not use debt as main source to cover the living
expenses,
2) Credit Cards will only be used by people capable of setting
aside their income in order to pay off their debt, and
3) Credit Cards shall be functioning mainly as paying instrument
that gives comfort and ease, and not only be a tool to raise consumption ability.
c. Maximum credit limit shall be 2 (twice) the monthly income,
comprises the following provisions:
1) The maximum credit limit shall be applied for individual
primary Cardholder per Issuer, and the limit is the cumulative maximum limit of the primary card and secondary card. Example: If Credit Cardholder A at Issuer X having a monthly salary of Rp.5.000.000,00, the maximum credit can be obtained by Cardholder A from Issuer X shall be Rp.10.000.000,00, including all the primary cards and secondary cards issued by Issuer X.
2) Maximum credit limit of 2 (twice) the monthly salary shall be
applied as the maximum limit in Credit Card industry provided that activies of exchanging information having a positive list nature between Issuers has effectively taken place.
3) Exception …

3) Exception be made for certain Credit Cardholders having been
categorized as infinite Cardholder based on considerations of the Issuer, the maximum credit limit of 2 (twice) the monthly salary can be overlooked, provided that this policy be reported to Bank Indonesia by the Issuer. d. The minimum percentage for paying off the debt of the Cardholder is no less than 10% (ten percent) of the total claims.
3. To increase security and assist Issuers in managing their liquidity, it is
necessary to stipulate the following provisions:
a. Maximum nominal limit of transferable funds between Issuers through ATM machine shall be set at Rp.10.000.000,- (ten million rupiahs) per account in one day. b. Maximum cash withdrawal limit using ATM Cards and Credit Cards on ATM machines shall be Rp.10.000.000,- (ten million rupiahs) per account in one day.
4. To increase security and support preventive actions against money
laundering crimes, the maximum limit on stored value for Prepaid cards shall be Rp.1.000.000,- (one million rupiahs).
III. SECURITY IMPROVEMENT
1. Issuers …

1. Issuers are required to increase security for Card-Based Payment
Instrument Activities (APMK) to minimize criminal actions related to APMK and to increase public trust on APMK.
2. Security improvement as referred to in number 1 shall be conducted upon
all technological infrastructures related to conducting APMK, conveying securing the cards and all systems used in the process of APMK transactions, namely:
a. Card safety improvement shall be implemented by using magnetic stripe and chip (integrated circuit) having the ability to store and/or process data, allowing additional application on the cards in order to secure the transaction process. b. Security improvement on Electronic Data Capture (EDC) machines on merchant and/or service point of sales, on ATM machines, and on the back end system at the Issuers, Acquirers and/or third party processor, shall be conducted by providing machine and system with the ability to process cards with chip technology as defined in letter a.
c. Except for ATM Cards and Debit Cards with domestic brands using
PIN as securing method, the PIN being used must consist the minimum of 6 (six) digits. Nevertheless, the system used in processing the ATM Cards and Debit Cards with domestic brands must be …

must be able to process APMK Cards with global brands that have a different number of digits for PIN.
3. Chip technology usage to increase security of cards as referred to in
number 2 shall be conducted by applying the following provisions:
a. For global branded Credit Cards, ATM Cards, Debit Cards, and/or Prepaid Cards, standards for applied chip, system, and application shall be according to the applicable standard for chip, sytem, and application and/or as required by the Principal Issuers of the card brands. b. Standard for chip on cards for domestic brand Credit Cards, ATM Cards, Debit Cards, and/or Prepaid Cards shall be based on the applicable chip standard for global brand cards as referred to in letter a. Whereas the standard for system or application used must be adjusted to be able to process cards with the concerning chip technology. In the case that the concerning domestic brand cards do not use the standards for global brand cards, the chip standard for the cards must at least be based on the International Organization for Standardization (ISO) for smartcards. Whereas the standards for system or application for card processing must be adjusted to be able to process the concerning cards using chip standard based on ISO.
4. The use …

4. The use of chip technology for ATM Cards, Debit Cards, and Credit Cards
   must be implemented for each card issued since September 1, 2006, for all new Cardholders or renewal of old Cards. Renewal of old cards must be completed no later than December 31, 2008. Prepaid Cards requiring permission from Bank Indonesia issued after the promulgation of this Circular Letter must also apply chip technology.
5. Technology application for chip processing of cards in APMK system
   namely EDC, ATM, and back end system as an effort to improve security, and the usage of 6 digit PIN to secure transaction processes shall be conducted gradually, as the following:
   a. Acquirers must change or improve security for all EDC, ATM, and back end system provided in order for all EDC, ATM, and back end system to process transactions of paying cards using chip technology no later than December 31, 2008. b. Issuers must implement 6 digits PIN to secure transaction process of APMK no later than December 31, 2006.
6. In relation to the requirement of changes as referred to in number 4 and
   number 5, all ATM Cards, Debit Cards, and Credit Cards issued by Issuers in Indonesia, including the transaction process, must completely based on chip technology no later than December 31, 2008.
   IV. COOPERATION…

IV. COOPERATION BETWEEN ISSUERS AND/OR FINANCIAL ACQUIRER
AND OTHER PARTIES
1. In the case that Issuers and/or Financial Acquirer having working
cooperation with other parties besides the Issuers and/or Financial Acquirer in conducting APMK activities, such as cooperation in marketing, collecting, and/or system operational, the concerning Issuers and/or Financial Acquirer must ascertain the method, mechanism, procedure, and quality of the activities held by the other parties to be based on the method, mechanism, procedure, and quality of the activities conducted by the Issuers and/or Financial Acquirers.
2. In the case that an Issuer using services of other parties to conduct
collection of Credit Card transactions, the following provisions shall be applied:
a. collection by other parties shall only be conducted if Credit Card claims have been categorized as doubtful or non-performing based on the collectibility criteria applied by Credit Card industry in Indonesia, and b. Issuers must guarantee that the collection by other parties shall not only be conducted by referring to the provisions in number 1, but also be executed without breaking the law.
3. In the case …

3. In the case that an Issuer and/or Financial Acquirer having working
cooperation with Technical Acquirer and/or Switching Company, the concerning Issuer and/or Financial Acquirer must ascertain that the system used by the Technical Acquirer and/or Switching Company is in compliance with the security standard required for Issuers and/or Financial Acquirers in this Circular Letter.
4. Issuers and/or Financial Acquirers having working cooperation with other
parties to process transactions for APMK activities must comply with the provisions of Bank Indonesia concerning cooperation between bank and other parties, such as Bank Indonesia provisions concerning information system technology.
V. CARD PRINTING AND PERSONALIZATION
Card printing and personalization shall be conducted according to the following provisions:
1. Card Printing
a. Cards must be printed at card printing companies having security insurance for the whole process, beginning from the printing process until card delivery process by the Issuer. b. Guarantee for security as referred to in letter a must be proved by:
1) Certificate …

1) Ceritificate from General Principal, in the case that Issuers as
users of the General Principal’s brand and General Principle conducting certification process on the Issuer companies. In this case, the General Principal shall determine the qualified printing companies for card printing, and the General Principal shall require the Issuers to print the cards only at the intended certified company.
2) Issuer’s trust on the security of production process and delivery
process of the card printing company, provided that the Issuer is a user of the General Principal’s brand but the General Principal does not conduct a certification process on the card printing company, or the Issuer is a Special Principal. In this case, card printing shall be executed at any printing companies if the Issuer is certain about the security of production process and delivery process.
2. Card Personalization
a. Personalizing the cards may be performed by the Issuers or other parties. In the case that card personalization is executed by other parties, the card personalization performed until December 31, 2006 may be taken place at domestic personalization companies or foreign personalization companies. b) Starting from …

b. Starting from January 1, 2007, card personalization by other parties must be conducted at domestic personalization companies, under the following requirements:
1) For cards as member of Network of Global Brand General
Principals, primary card personalization shall be conducted by card personalization companies having certified by the General Principal and obtained approval from Bank Indonesia as card personalization companies.
2) For cards as member of the Network of Domestic Brand
General Principals, card personalization must be conducted according to the following provisions:
a) If the concerning General Principal conducts certification process on personalization company, card personalization must be performed by personalization company having certified by the concerning General Principal and having approved as a card personalization company by Bank Indonesia; or b) If the concerning General Principal fails to conduct certification process on the personalization company, primary card personalization shall be performed by a personalization company having approval from Bank Indonesia as a card personalization company.
3) Particularly …

3) Particularly for special domestic Principal cards, card
personalization must be conducted at card personalization companies having approval from Bank Indonesia as card personalization companies.
c. Card personalization companies may obtain approval from Bank
Indonesia by submitting a written request to Bank Indonesia c.q. Directorate Accounting and Payment System and fulfilling the requirements as follow:
1) Having a legal standing in Indonesia and formed as Limited
Liability Company (PT) with proof by submission of corporation charter and articles of association of the Limited Liability Companies and their last alteration if available, which have been legalized by the authority. The photo copied corporation charter and articles of association of the Limited Liability Company must also be legalized by an authorized party/officer;
2) Having the ability to personalize cards securely, with proof of
audit certification from independent security auditors;
3) Having the willingness to keep the secrecy of data obtained
from personalization process, proved by a letter stating the willingness to keep the secrecy of data;
4. Having …

4) Having the willingness to be evaluated by Bank Indonesia at
any time if necessary, proved by a letter stating the willingness to be assesed by Bank Indonesia. d. Upon the written request, Bank Indonesia c.q the Directorate of Accounting and Payment Sytem shall give approval or rejection within no later than 45 (forty five) working days after acceptance of complete documents by Bank Indonesia c.q the Directorate of Accounting and Payment System. Bank Indonesia c.q the Directorate of Accounting and Payment System obtains the right to cancel the approval given to the card personalization companies in the case that the card personalization companies no longer in compliance with the requirements as referred to in letter c based on the assesement of Bank Indonesia. e. The written request as referred to in letter c shall be addressed to:
The Directorate of Accounting and Payment System Bank Indonesia Building D, 2nd Floor Jalan M.H. Thamrin No. 2 Jakarta 10110
VI. OBLIGATION TO SHARE INFORMATION
1. Credit Card …

1. Credit Card Issuers are required to share information with other Issuers
concerning data of Cardholders conveying negative list, positive list, and merchant black list.
2. Credit Card Issuers are required to give written report of the performed
information sharing activities, comprises the followings:
a. type and amount of shared data by each Credit Card Issuer; b. requested data consisting of amount of data sources and amount of requested data by each Credit Card Issuer.
3. The requirement to give report may be conducted separately by each
Credit Card Issuer or in groups through the Association of Credit Card Issuers.
4. The report shall be submitted to Bank Indonesia based on Bank Indonesia
Circular Letter concerning Supervision of APMK Operational Activities. The provisions in this Circular Letter shall come into force on December 30, 2005. For the public to be informed, it is ordered that this Circular Letter be promulgated in the State Gazette of the Republic of Indonesia. Kindly be informed.

BANK INDONESIA,
MOHAMAD ISHAK
THE DIRECTOR OF ACCOUNTING
AND PAYMENT SYSTEM