Circular Letter No. 9/30/DPNP - Risk Management in the Use of Information Technology by Commercial Banks

No. 9/30/DPNP Jakarta, 12 December 2007 C I R C U L A R L E T T E R Intended for ALL COMERCIAL BANKS IN INDONESIA Regarding : Risk Management in the Use of Information Technology by Commercial Banks Following the issuance of Regulation of Bank Indonesia Number 9/15/PBI/2007 dated November 30th 2007 on the Implementation of Risk Management in the use of Information Technology by Commercial Banks (Official Gazette of the Republic of Indonesia Year of 2007 Number 144, Additions to the Official Gazette of the Republic of Indonesia Number 4785), it is deemed necessary to establish functional directives in the form of a Circular Letter with the following main directives:
I. GENERAL
1. The use of Information Technology is required by Banks to improve
operational effectiveness and efficiency. Furthermore, an advance in Information Technology allows Banks to enhance its service towards its customers through Electronic Banking products.
2. Should a Bank be unable to carry out Information Technology by itself, it is
permitted for such Bank to use other party or vendor Information Technology service providers.
3. In light of the fact that the use of Information Technology can increase risks
faced by a Bank, Banks are therefore required to implement effective risk management measures.
II. GUIDELINES OF RISK MANAGEMENT IN THE USE OF INFORMATION
TECHNOLOGY
1. Banks are required to implement effective risk management measures in
the carrying out of Information Technology, whether it is done by itself or third party service providers.
2. In the implementation of the aforementioned risk management in the use of
Information Technology, Banks are required to have policies and Procedures for the …..

procedures for the management of Information Technology resources in order to support the continuation of the Bank’s business, especially customer service. These resources include, amongst others, hardware, software, networks, human resources and data/information.
3. Policies and procedures in the use of Information Technology and
guidelines for risk management in the use of Information Technology should refer to either the Guidelines for Risk Management in the Use of Information Technology by Commercial Banks, which comprises Appendix 1 of this Circular Letter or the Standard Guidelines for Bank Risk Management as arranged in Circular Letter Number 5/21/DPNP on Risk Management for Commercial Banks.
4. The aforementioned policies and procedures are to include at the least the
following aspects:
a. Management; b. Development and establishment;
c. Operational Information Technology;
d. Communication networks; e. Information security; f. Business Continuity Plan; g. End user computing; h. Audit;
i. Electronic Banking; and
j. Employment of Information Technology service providers.
5. Guidelines presented in Appendix 1 are the main principles of
implementation of risk management in the use of Information Technology which are mandatory for Banks in order to mitigate the risks associated with the carrying out of Information Technology.
6. Banks with a high level of magnitude and complexity should utilize stricter
parameters in addition to items specified in the guidelines as presented in
Appendix 1. Meanwhile, Banks of a relatively lower level of magnitude and
complexity are able to use parameters looser than those specified in the guidelines as presented in Appendix 1, as long as the Bank has taken into account the results of risk assessments on the Bank’s business activities, Information Technology security profile, and cost and benefit.
7. Banks already in possession of policies and procedures for the use of
Information Technology and guidelines for risk management in the use of Information Technology prior to the validation of this Circular Letter are required to conform and complete said items referring to Appendix 1 as of March 31st 2009 at the latest.
III. REPORTING …..

III. REPORTING

1. For the Implementation of Risk Management in the Use of Information
   technology, Banks are required to submit the following reports:
   a. Report on the Use of Information Technology, conforming to the following requirements:
   1) Such report is presented using the form presented in Appendix
   2.1.
   2) Such report is to be submitted by September 30th 2008 at the
   latest b. Annual Report on the Use of Information Technology, conforming to the following requirements:
   1) Such report is presented using the form presented in Appendix
   2.4.
   2) Such report must be submitted at least 1 (one) month after the
   end of each report year. The Annual Report on the Use of Information Technology for 2008 is to be submitted by January 31st 2009 at the latest.
   c. Reports on Fundamental Alteration Plans of Information Technology,
   conforming to the following requirements:
   1) Such report is presented using the form presented in Appendix
   2.2.
   2) Such report must be submitted at least 2 (two) months before
   related alterations are carried out. Reports on the following alterations must be submitted at least 4 (four) months before said alterations are carried out:
   a) Establishment of out-of-state Data Centers by foreign parties. b) Establishment of out-of-state Disaster Recovery Centers by foreign parties. c) Carrying out of Information Technology based transaction processing on foreign soil by foreign parties. d. Reports on the Realization of Fundamental Alteration Plans of Information Technology, …..

Information Technology, conforming to the following requirements:
1) Such report is presented using the form presented in Appendix
2.3.
2) Such report must be submitted at least 1 (one) month before
related alterations are carried out.
3) Banks that submit reports on the realization of alteration plans
concerning new products or activities using the report format as presented in Appendix 2.3 are not required to submit a New Product and Activity Report as directed in Bank Indonesia’s regulations on risk management for commercial banks.
2. Banks are required to submit all of the reports mentioned above even
though the existing implementation of Information Technology in the Bank are sub-contracted to or provided by a third party
IV. REQUEST FOR APPROVAL FOR THE CARRYING OUT OF INFORMATION
TECHNOLOGY BY FOREIGN PARTIES ON FOREIGN SOIL
1. New Requests
Banks can only establish Data Centers, Disaster Recovery Centers and/or carry out Information Technology Based Transaction Processing out of state after receiving approval for plans to do so from Bank Indonesia. To obtain said permission, Banks must submit requests complemented by documents as outlined in Appendix 2.2.3 and Appendix 2.2.5.
2. Renewal of Prior Request(s)
Banks that have previously reported the establishment or carrying out of Information Technology by foreign parties on foreign soil prior to the validation of this regulation must submit a renewed request for approval to Bank Indonesia for the continuation of the employment of said parties in the establishment or carrying out of Information Technology used by the Bank. The renewed request for approval as mentioned above must be complemented by documents as outlined in Appendix 2.2.3 and Appendix 2.2.5. Exceptions are made for the establishment of Data Centers and Disaster Recovery Centers of …..

Recovery Centers of Branch Offices of Foreign Banks, where forms used are outlined in Appendix 2.6.
V. MISCELLANEOUS
Submission of reports as outlined in section III and submission of requests for approval as outlined in section IV are to be addressed to:
a. Audit Directorate, Jl. MH Thamrin no.2, Jakarta 10350, for Banks whose main office is in the vicinity of Bank Indonesia’s main office; b. Bank Indonesia’s local office, for Banks whose main office is outside the vicinity of Bank Indonesia’s main office.
VI. CONCLUSION
Regulations in this Circular Letter of Bank Indonesia are valid as of March 31st 2008. So as to inform every person concerned, dictating the placement of this Regulation of Bank Indonesia in the Official Gazette of the Republic of Indonesia BANK INDONESIA, HALIM ALAMSYAH DIRECTORATE DIRECTOR BANKING RESEARCH AND REGULATION