Implementation of Risk Management for Sharia Rural Financing Banks

COPY
FINANCIAL SERVICES AUTHORITY REGULATION
OF THE REPUBLIC OF INDONESIA
NUMBER 23/POJK.03/2018
CONCERNING
THE IMPLEMENTATION OF RISK MANAGEMENT FOR SHARIA RURAL FINANCING BANKS BY THE GRACE OF THE ALMIGHTY GOD, THE COMMISSIONERS OF THE FINANCIAL SERVICES AUTHORITY, Considering:
a. that the increasing complexity of products and activities of Sharia Rural Financing Banks results in increasing risks faced by these banks; b. that the increasing risks faced by Sharia Rural Financing Banks necessitate regulations on the implementation of risk management for these banks as referred to in Article 69 of Law Number 21 of 2011 concerning the Financial Services Authority;
c. that the implementation of risk management is one of the efforts to strengthen institutional capacity and improve the reputation of the Sharia Rural Financing Bank industry in accordance with the policy direction for the development of Sharia Rural Financing Banks, thereby creating a financial sector that grows sustainably and stably with high competitiveness;
d. that based on the considerations referred to in letters a through c, it is necessary to establish a Financial Services Authority Regulation concerning the Implementation of Risk Management for Sharia Rural Financing Banks; Recalling:

1. Law Number 21 of 2008 concerning Sharia Banking (State Gazette of the Republic of Indonesia Year 2008 Number 94, Supplement to the State Gazette of the Republic of Indonesia Number 4867);
2. Law Number 21 of 2011 concerning the Financial Services Authority (State Gazette of the Republic of Indonesia Year 2011 Number 111, Supplement to the State Gazette of the Republic of Indonesia Number 5253);
   DECIDING:
   Establishing: FINANCIAL SERVICES AUTHORITY REGULATION CONCERNING THE IMPLEMENTATION OF RISK MANAGEMENT FOR SHARIA RURAL FINANCING BANKS.

CHAPTER I
GENERAL PROVISIONS
Article 1
In this Financial Services Authority Regulation, the following terms are defined as:

1. Sharia Rural Financing Bank, hereinafter abbreviated as BPRS, is a Sharia bank that does not provide payment transaction services in its activities.
2. Board of Directors is the corporate organ authorized and fully responsible for managing the corporation for the benefit of the corporation, in accordance with the purpose and objectives of the corporation, and representing the corporation, both inside and outside of court, in accordance with the provisions of the articles of association.
3. Board of Commissioners is the corporate organ tasked with conducting general and/or specific supervision in accordance with the articles of association and providing advice to the Board of Directors.
4. Sharia Supervisory Board is a board tasked with providing advice and suggestions to the Board of Directors and supervising BPRS activities to ensure compliance with Sharia principles.
5. Sharia Principles are Islamic legal principles in banking activities based on fatwas issued by institutions authorized to issue fatwas in the field of Sharia.
6. Executive Officer is an officer who is directly responsible to the Board of Directors or has influence over BPRS policies and operations.
7. Risk is the potential loss resulting from the occurrence of a specific event.
8. Risk Management is a series of methodologies and procedures used to identify, measure, monitor, and control Risks arising from all BPRS business activities.

CHAPTER II
SCOPE OF RISK MANAGEMENT
Article 2
(1) BPRS is required to implement Risk Management effectively as referred to in this Financial Services Authority Regulation.
(2) The implementation of Risk Management as referred to in paragraph (1) must at least cover:
a. active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board; b. adequacy of Risk Management policies and procedures as well as the establishment of Risk limits;
c. adequacy of the Risk identification, measurement, monitoring, and control processes as well as the Risk Management information system; and
d. a comprehensive internal control system.
(3) Further provisions regarding the implementation of Risk Management as referred to in paragraph (2) shall be regulated by a Financial Services Authority Circular.

Article 3
(1) Risks that must be managed in the implementation of Risk Management include:
a. Credit Risk; b. Operational Risk;
c. Compliance Risk;
d. Liquidity Risk; e. Reputation Risk; and f. Strategic Risk.
(2) BPRS with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) is required to implement Risk Management as referred to in Article 2 for all types of Risks as referred to in paragraph (1). (3) BPRS with core capital of less than IDR 50,000,000,000.00 (fifty billion rupiah) is required to implement Risk Management as referred to in Article 2 for at least 4 (four) Risks as referred to in paragraph (1) letters a through d.

CHAPTER III
ACTIVE SUPERVISION BY THE BOARD OF DIRECTORS, BOARD OF COMMISSIONERS, AND SHARIA SUPERVISORY BOARD
Article 4
BPRS is required to establish clear authority and responsibility at every level of position related to the implementation of Risk Management for active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board as referred to in Article 2 paragraph (2) letter a.

Article 5
(1) The authority and responsibility of the Board of Directors as referred to in Article 4 must at least cover:
a. formulating written policies and guidelines for the implementation of Risk Management; b. evaluating and deciding on transactions requiring Board of Directors approval;
c. developing a Risk Management culture at all levels of the organization;
d. ensuring the improvement of human resources competence related to Risk Management; e. ensuring that the Risk Management function operates independently; and f. being responsible for:

1. the implementation of Risk Management policies; and
2. the overall Risk exposure taken by BPRS.
   (2) To execute the authority and responsibility as referred to in paragraph (1), the Board of Directors must have adequate understanding of the Risks inherent in all functional activities of BPRS and be able to take necessary actions in accordance with the BPRS Risk profile.

Article 6
The authority and responsibility of the Board of Commissioners as referred to in Article 4 must at least cover:
a. approving and evaluating Risk Management policies; b. ensuring the implementation of Risk Management by the Board of Directors;
c. evaluating the Board of Directors' accountability for the implementation of Risk Management policies as referred to in Article 5 paragraph (1) letter f number 1); and
d. evaluating and deciding on Board of Directors' requests related to transactions requiring Board of Commissioners approval.

Article 7
The authority and responsibility of the Sharia Supervisory Board as referred to in Article 4 must at least cover:
a. evaluating Risk Management policies related to the fulfillment of Sharia Principles; and b. evaluating the Board of Directors' accountability for the implementation of Risk Management policies as referred to in Article 5 paragraph (1) letter f number 1) related to the fulfillment of Sharia Principles.

CHAPTER IV
RISK MANAGEMENT POLICIES, RISK MANAGEMENT PROCEDURES, AND ESTABLISHMENT OF RISK LIMITS
Article 8
The adequacy of Risk Management policies as referred to in Article 2 paragraph (2) letter b must at least cover:
a. the establishment of Risks related to BPRS business activities, products, and services; b. the establishment of the Risk Management information system;
c. the determination of limits and the establishment of Risk tolerance;
d. the establishment of Risk rating assessments; e. the preparation of contingency plans in worst-case scenarios; and f. the establishment of an internal control system in the implementation of Risk Management.

Article 9
(1) The adequacy of Risk Management procedures as referred to in Article 2 paragraph (2) letter b must at least cover:
a. clear levels of delegation of authority and accountability; and b. adequate documentation of Risk Management procedures and the establishment of Risk limits.
(2) The establishment of Risk limits as referred to in Article 2 paragraph (2) letter b includes:
a. overall limits; b. limits per type of Risk; and
c. limits per specific functional activities with Risk exposure.

CHAPTER V
RISK IDENTIFICATION, MEASUREMENT, MONITORING, AND CONTROL PROCESSES, AND RISK MANAGEMENT INFORMATION SYSTEM
Article 10
(1) BPRS is required to conduct risk identification, measurement, monitoring, and control processes as referred to in Article 2 paragraph (2) letter c against all material Risk factors. (2) The implementation of the risk identification, measurement, monitoring, and control processes as referred to in paragraph (1) must be supported by:
a. adequate management information systems; and b. accurate and informative reports regarding BPRS financial conditions, functional activity performance, and Risk exposure.

Article 11
(1) BPRS conducts Risk identification at least by analyzing:
a. the characteristics of Risks inherent in BPRS; and b. Risks from BPRS business activities, products, and services.
(2) BPRS conducts Risk measurement at least by:
a. evaluating the suitability of assumptions, data sources, and procedures used to measure Risk; and b. adjusting the Risk measurement process if there are material changes in business activities, products, transactions, and Risk factors. (3) BPRS conducts Risk monitoring at least by:
a. evaluating Risk exposure; and b. adjusting the reporting process if there are material changes in business activities, products, transactions, Risk factors, information technology, and BPRS Risk Management information systems. (4) BPRS conducts Risk control at least by evaluating Risk mitigation techniques to manage Risks that could endanger the continuity of BPRS business.

Article 12
(1) The adequacy of the Risk Management information system as referred to in Article 2 paragraph (2) letter c must at least include reports or information regarding:
a. Risk exposure; b. compliance with the adequacy of Risk Management policies as referred to in Article 8;
c. compliance with the adequacy of Risk Management procedures and the establishment of Risk limits as referred to in Article 9; and
d. the implementation of Risk Management compared to established targets.
(2) Reports or information generated from the Risk Management information system as referred to in paragraph (1) must be submitted periodically to the Board of Directors.

CHAPTER VI
INTERNAL CONTROL SYSTEM
Article 13
BPRS is required to implement a comprehensive internal control system effectively regarding the implementation of business activities and operations at all levels of the BPRS organization.

Article 14
The implementation of a comprehensive internal control system as referred to in Article 13 must at least be able to detect weaknesses and deviations in a timely manner.

Article 15
(1) The comprehensive internal control system as referred to in Article 2 paragraph (2) letter d must at least cover:
a. the suitability of the internal control system with the type and level of Risks inherent in business activities and BPRS service types; b. the establishment of authority and responsibility for monitoring compliance with the adequacy of Risk Management policies as referred to in Article 8;
c. the establishment of authority and responsibility for monitoring compliance with the adequacy of Risk Management procedures and the establishment of Risk limits as referred to in Article 9;
d. clear reporting channels and separation of functions; e. an organizational structure that clearly depicts BPRS business activities; f. accurate and timely financial and operational reporting; g. adequate procedures to ensure BPRS compliance with laws and regulations, policies, and internal BPRS regulations; h. complete and adequate documentation; and
i. verification and review of the internal control system.
(2) The assessment of the comprehensive internal control system as referred to in paragraph (1) is conducted by the internal audit unit or an Executive Officer designated to be responsible for the implementation of the internal audit function.

CHAPTER VII
ORGANIZATION AND RISK MANAGEMENT FUNCTIONS
Article 16
(1) BPRS with core capital of at least IDR 80,000,000,000.00 (eighty billion rupiah) is required to establish:
a. a Risk Management Committee; and b. a Risk Management Unit.
(2) BPRS with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) and less than IDR 80,000,000,000.00 (eighty billion rupiah) is required to establish a Risk Management Unit. (3) BPRS with core capital of less than IDR 50,000,000,000.00 (fifty billion rupiah) is required to appoint at least 1 (one) Executive Officer responsible for the implementation of the Risk Management function. (4) BPRS with core capital of less than IDR 80,000,000,000.00 (eighty billion rupiah) may establish a Risk Management Committee. (5) The establishment of a Risk Management Committee, Risk Management Unit, and/or the appointment of 1 (one) Executive Officer responsible for the implementation of the Risk Management function as referred to in paragraphs (1) through (3) must be carried out no later than December 31, 2021.

Article 17
(1) The Risk Management Committee as referred to in Article 16 paragraph (1) letter a and paragraph (4) must consist of at least:
a. a majority of Board of Directors members; and b. relevant Executive Officers.
(2) The authority and responsibility of the Risk Management Committee as referred to in paragraph (1) provide recommendations to the President Director at least covering:
a. the formulation of policies and guidelines for the implementation of Risk Management; b. the improvement and/or refinement of Risk Management implementation based on the results of Risk Management implementation evaluations; and
c. considerations and/or establishment of matters related to operational decisions that deviate from normal procedures.

Article 18
(1) The Risk Management Unit as referred to in Article 16 paragraph (1) letter b and paragraph (2) and the Executive Officer as referred to in Article 16 paragraph (3) must be independent. (2) The Risk Management Unit as referred to in Article 16 paragraph (1) letter b and paragraph (2) and the Executive Officer as referred to in Article 16 paragraph (3) are directly responsible to a Board of Directors member who oversees the Risk Management function. (3) The authority and responsibility of the Risk Management Unit or the designated Executive Officer responsible for the implementation of the Risk Management function include:
a. monitoring the implementation of Risk Management policies and guidelines approved by the Board of Directors; b. monitoring overall Risk positions, per type of Risk, and per type of functional activity;
c. assessing proposals for the issuance of products and/or the implementation of new activities;
d. submitting recommendations to units or employees handling operational functions and to the Risk Management Committee, according to their authority; and e. preparing and submitting Risk profile reports periodically to the Board of Directors member overseeing the Risk Management function and to the Risk Management Committee.

CHAPTER VIII
REPORTING
First Section
Risk Management Implementation Action Plan
Article 19
(1) In implementing Risk Management as referred to in Article 2, BPRS is required to formulate and submit an action plan to the Financial Services Authority.
(2) The action plan as referred to in paragraph (1) must be submitted no later than June 30, 2019.
(3) BPRS adjusts the action plan as referred to in paragraph (1) upon request by the Financial Services Authority.
(4) The action plan as referred to in paragraph (1) and/or the adjustment of the action plan as referred to in paragraph (3) for BPRS with core capital:
a. of at least IDR 50,000,000,000.00 (fifty billion rupiah) must be completed no later than June 30, 2022; or b. of less than IDR 50,000,000,000.00 (fifty billion rupiah) must be completed no later than June 30, 2023. (5) The deadline for completing the action plan as referred to in paragraph (4) takes into account the deadline for establishing a Risk Management Committee, Risk Management Unit, and/or appointing an Executive Officer responsible for the implementation of the Risk Management function as referred to in Article 16 paragraph (5).

Article 20
(1) BPRS is required to submit reports on the realization of the Risk Management implementation action plan as referred to in Article 19 to the Financial Services Authority every semester. (2) Reports on the realization of the Risk Management implementation action plan as referred to in paragraph (1) must be submitted no later than July 31 for the first semester report and January 31 of the following year for the second semester report. (3) Reports on the realization of the Risk Management implementation action plan as referred to in paragraph (1) are first submitted for the first semester of 2020. (4) In the event that BPRS has realized all Risk Management implementation action plans as referred to in Article 19 paragraph (1) before the deadline as referred to in Article 19 paragraph (4) and has reported this to the Financial Services Authority, BPRS is not required to submit realization reports for subsequent semesters.

Second Section
Risk Profile Reports
Article 21
(1) BPRS is required to submit Risk profile reports to the Financial Services Authority every semester.
(2) The Risk profile reports submitted by BPRS as referred to in paragraph (1) must contain the same material as the Risk profile reports submitted by the Risk Management Unit or the Executive Officer designated to be responsible for the implementation of the Risk Management function to the Board of Directors member overseeing the Risk Management function and to the Risk Management Committee. (3) The Risk profile reports as referred to in paragraph (1) must be submitted no later than July 31 for the first semester report and January 31 of the following year for the second semester report. (4) BPRS submits Risk profile reports outside the established timeframe as referred to in paragraph (1) upon request by the Financial Services Authority. (5) BPRS with core capital as referred to in Article 3 paragraph (2) submits for the first time Risk profile reports as referred to in paragraph (1) covering:
a. 3 (three) Risks consisting of Credit Risk, Operational Risk, and Compliance Risk for the second semester of 2022; and b. 6 (six) Risks consisting of Credit Risk, Operational Risk, Compliance Risk, Liquidity Risk, Reputation Risk, and Strategic Risk for the second semester of 2024. (6) BPRS with core capital as referred to in Article 3 paragraph (3) submits for the first time Risk profile reports as referred to in paragraph (1) covering:
a. 2 (two) Risks consisting of Credit Risk and Operational Risk for the second semester of 2023; and b. 4 (four) Risks consisting of Credit Risk, Operational Risk, Compliance Risk, and Liquidity Risk for the second semester of 2025.

Third Section
Other Risk Profile Reports
Article 22
(1) In the event of conditions that have the potential to cause significant losses to financial conditions, BPRS is required to submit other Risk profile reports to the Financial Services Authority. (2) Other Risk profile reports as referred to in paragraph (1) include reports other than the mandatory Risk profile reports as referred to in Article 21 paragraph (5) letter a and paragraph (6). (3) Other Risk profile reports as referred to in paragraph (1) must be submitted no later than 1 (one) month after the condition potentially causing significant losses to BPRS financial conditions is known. (4) The obligation to submit other Risk profile reports as referred to in paragraph (1) may be based on a request by the Financial Services Authority.

Fourth Section
Format and Submission Procedures for Reports
Article 23
(1) BPRS is required to submit reports as referred to in Article 21 paragraph (1) and Article 22 paragraph (1) online through the Financial Services Authority's reporting system. (2) In the event that online submission of reports through the Financial Services Authority's reporting system as referred to in paragraph (1) cannot yet be performed, BPRS submits reports offline to the Financial Services Authority.

Article 24
(1) Provisions regarding the procedures for assessing Risk profiles as regulated in Article 21 and the procedures for assessing other Risk profiles as regulated in Article 22 are regulated by a Financial Services Authority Circular. (2) Provisions regarding the format, instructions for preparation, and procedures for submitting the action plan as referred to in Article 19 paragraph (1) and reports as referred to in Article 20 paragraph (1), Article 21 paragraph (1), and Article 22 paragraph (1) are regulated by a Financial Services Authority Circular.

CHAPTER IX
ASSESSMENT OF RISK MANAGEMENT IMPLEMENTATION
Article 25
(1) The Financial Services Authority is authorized to conduct assessments regarding the implementation of Risk Management at BPRS.
(2) In the assessment of Risk Management implementation as referred to in paragraph (1), BPRS is required to submit data and information related to the implementation of Risk Management to the Financial Services Authority.

CHAPTER X
ADJUSTMENT OF RISK MANAGEMENT IMPLEMENTATION
Article 26
(1) BPRS that, based on monthly reports, experiences an increase in core capital to at least IDR 50,000,000,000.00 (fifty billion rupiah) for 6 (six) consecutive monthly report positions until December 31, 2022, is required to report all Risks as referred to in Article 3 paragraph (1) according to the staging as referred to in Article 21 paragraph (5). (2) BPRS that, based on monthly reports, experiences an increase in core capital to at least IDR 50,000,000,000.00 (fifty billion rupiah) for 6 (six) consecutive monthly report positions after December 31, 2022, until December 31, 2024, is required to report all Risks as referred to in Article 3 paragraph (1) for the first time in the Risk profile report for the second semester of 2024.

(3) BPRS that, based on monthly reports, experience an increase in core capital to at least IDR 50,000,000,000.00 (fifty billion rupiah) for 6 (six) consecutive monthly report positions after December 31, 2024, are required to report all Risks as referred to in Article 3 paragraph (1) for the first time in the next semester's Risk Profile report, at the latest 1 (one) year after the BPRS meets the core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) for 6 (six) consecutive monthly report positions.

Article 27
(1) BPRS that, based on monthly reports, experience an increase in core capital to at least IDR 80,000,000,000.00 (eighty billion rupiah) for 6 (six) consecutive monthly report positions after December 31, 2021, must have fulfilled the organizational structure as referred to in Article 16 paragraph (1), at the latest 1 (one) year after the BPRS meets the core capital of at least IDR 80,000,000,000.00 (eighty billion rupiah) for 6 (six) consecutive monthly report positions. (2) BPRS that, based on monthly reports, experience an increase in core capital to at least IDR 50,000,000,000.00 (fifty billion rupiah) and less than IDR 80,000,000,000.00 (eighty billion rupiah) for 6 (six) consecutive monthly report positions after December 31, 2021, must have fulfilled the organizational structure as referred to in Article 16 paragraph (2), at the latest 1 (one) year after the BPRS meets the core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) and less than IDR 80,000,000,000.00 (eighty billion rupiah) for 6 (six) consecutive monthly report positions.

Article 28
BPRS that, based on monthly reports, experience a decrease in core capital resulting in a reduction of the obligation to apply the number of Risks from the original amount, shall continue to apply the type of Risks and the completeness of the organizational structure that were in effect prior to the decrease in core capital.

CHAPTER XI
ADMINISTRATIVE SANCTIONS

Article 29
(1) BPRS that do not fulfill reporting provisions as referred to in Article 19 paragraph (1), Article 20 paragraph (1), Article 21 paragraph (1), and Article 22 paragraph (1) shall be subject to administrative sanctions in the form of:
a. a fine of IDR 100,000.00 (one hundred thousand rupiah) per day of delay per report for BPRS that submit reports to the Financial Services Authority beyond the deadline for submission up to 1 (one) month after the deadline, with a maximum fine of IDR 3,000,000.00 (three million rupiah) per report; or b. a fine of IDR 5,000,000.00 (five million rupiah) per report for BPRS that have not submitted reports after 1 (one) month from the deadline for submission. (2) The imposition of administrative sanctions in the form of fines as referred to in paragraph (1) does not eliminate the obligation to submit reports. (3) BPRS that submit Risk Profile reports as referred to in Article 21 paragraph (1) which, based on the assessment of the Financial Services Authority, are declared untrue and/or significantly incomplete shall be subject to administrative sanctions in the form of a written warning and a fine of IDR 10,000,000.00 (ten million rupiah). (4) In addition to administrative sanctions in the form of written warnings and fines as referred to in paragraph (3), BPRS shall be subject to administrative sanctions in the form of:
a. a reduction in the BPRS's health rating assessment; and/or b. the listing of Board of Directors members and Board of Commissioners members on the failed list through the competency and propriety test mechanism. (5) The imposition of administrative sanctions in the form of fines as referred to in paragraph (3) is carried out after the BPRS has been given 2 (two) written warnings by the Financial Services Authority with a grace period of 10 (ten) working days for each warning, and the BPRS does not submit or does not correct the Risk Profile report within a period of 10 (ten) working days after the last written warning.

Article 30
BPRS that do not implement provisions as referred to in Article 2 paragraph (1), Article 3 paragraphs (2) and (3), Article 4, Article 10, Article 13, Article 16 paragraphs (1), (2), and (3), Article 21 paragraph (2), Article 23 paragraph (1), Article 25 paragraph (2), and Article 27, shall be subject to administrative sanctions in the form of:
a. written warnings; b. reduction in the BPRS's health rating assessment; and/or
c. temporary suspension of part of the BPRS's operational activities.

Article 31
(1) BPRS that violate the provisions of Article 26 shall be subject to administrative sanctions in the form of a written warning and a fine of IDR 10,000,000.00 (ten million rupiah). (2) In addition to administrative sanctions in the form of written warnings and fines as referred to in paragraph (1), BPRS shall be subject to administrative sanctions in the form of:
a. a reduction in the BPRS's health rating assessment; and/or b. the listing of Board of Directors members and Board of Commissioners members on the failed list through the competency and propriety test mechanism. (3) The imposition of administrative sanctions in the form of fines as referred to in paragraph (1) is carried out after the BPRS has been given 2 (two) written warnings by the Financial Services Authority with a grace period of 10 (ten) working days for each warning, and the BPRS does not submit or does not correct the Risk Profile report within a period of 10 (ten) working days after the last written warning.

CHAPTER XII
TRANSITIONAL PROVISIONS

Article 32
(1) The imposition of sanctions for the submission of Risk Profile reports as referred to in Article 21 paragraph (5) letter a shall begin to be applied to the submission of reports in the second semester of 2023. (2) The imposition of sanctions for the submission of Risk Profile reports as referred to in Article 21 paragraph (6) letter a shall begin to be applied to the submission of reports in the second semester of 2024.

Article 33
BPRS that have submitted applications for business licenses or licenses for changes in BPR business activities to become BPRS before this Financial Services Authority Regulation takes effect must:
a. form a Risk Management Committee, a Risk Management Work Unit, and/or appoint 1 (one) Executive Official responsible for the implementation of Risk Management functions, implemented according to the time limits as referred to in Article 16 paragraph (5); and b. submit action plans, realization of action plans, and complete action plans as referred to in Article 19 and Article 20.

Article 34
BPRS that submit applications for business licenses or licenses for changes in BPR business activities to become BPRS after this Financial Services Authority Regulation takes effect must implement Risk Management effectively as referred to in this Financial Services Authority Regulation at the time the BPRS obtains the business license or license for changes in BPR business activities to become BPRS, except for the obligation to submit Risk Profile reports which is implemented according to the phasing as referred to in Article 21 paragraph (5) and paragraph (6).

CHAPTER XIII
CLOSING PROVISIONS

Article 35
This Financial Services Authority Regulation shall take effect on the date of its enactment.

This copy is in accordance with the original
Director of Law 1
Legal Department signed
Yuliana

To ensure everyone knows, ordering the enactment of this Financial Services Authority Regulation by placing it in the State Gazette of the Republic of Indonesia.

Determined in Jakarta on December 5, 2018
CHAIRMAN OF THE COMMISSIONERS BOARD
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
WIMBOH SANTOSO

Enacted in Jakarta on December 10, 2018
MINISTER OF LAW AND HUMAN RIGHTS
REPUBLIC OF INDONESIA, signed
YASONNA H. LAOLY

STATE GAZETTE OF THE REPUBLIC OF INDONESIA YEAR 2018 NUMBER 227

EXPLANATION
OF
FINANCIAL SERVICES AUTHORITY REGULATION
REPUBLIC OF INDONESIA
NUMBER 23 /POJK.03/2018
CONCERNING
THE IMPLEMENTATION OF RISK MANAGEMENT FOR
SHARIA RURAL FINANCING BANKS

I. GENERAL
Sharia Rural Financing Banks (BPRS) as financial intermediation institutions with a main segment for micro and small businesses and rural communities, always face Risks in the implementation of their business activities. The increasingly rapid development of the banking industry, the public's need for more varied, easy, and fast financial service provision, accompanied by very rapid development of information technology, drives BPRS to further improve services which will have an impact on increasing BPRS Risks. This increase in Risks must be balanced with an increase in Risk control. Therefore, BPRS are required to implement Risk Management. The implementation of Risk Management is not only directed at BPRS but also to protect BPRS stakeholders.

Risk Management principles, including the types of Risks that must be applied by BPRS, are adjusted to the characteristics of BPRS business activities and aligned with Financial Services Authority regulations regarding the implementation of Risk Management for Sharia commercial banks and Financial Services Authority regulations regarding the implementation of Risk Management for rural credit banks. Risk Management principles are essentially banking standards to operate more cautiously in the scope of the very rapid development of business activities and banking operations today. Considering that there are still core capital gaps in the BPRS industry, the implementation of Risk Management is differentiated according to BPRS core capital. The Financial Services Authority establishes these provisions as minimum standards that must be fulfilled by BPRS in implementing Risk Management.

With these provisions, BPRS are expected to be able to carry out all activities in an integrated manner in an accurate and comprehensive Risk management framework.

II. ARTICLE BY ARTICLE

Article 1
Clear enough.

Article 2
Clear enough.

Article 3
Paragraph (1)
Letter a
The term "Credit Risk" refers to the Risk arising from the failure of customers or other parties to fulfill obligations to the BPRS, including Risks arising from the BPRS sharing in the business losses of customers financed through profit-sharing financing, whether using the net revenue sharing method or the profit and loss sharing method (Investment Risk).

Letter b
The term "Operational Risk" refers to Risks caused, among others, by insufficient and/or non-functional internal processes, human resource errors, system failures, and/or external problems affecting BPRS operations.

Letter c
The term "Compliance Risk" refers to Risks arising from the BPRS's failure to comply with and/or implement statutory regulations and other provisions and Sharia Principles, including Risks arising from weaknesses in legal aspects. Weaknesses in legal aspects are caused, among others, by legal claims, the absence of supporting statutory regulations, or weaknesses in agreements such as the failure to meet the validity requirements of contracts and imperfect collateral binding.

Letter d
The term "Liquidity Risk" refers to the Risk arising from the BPRS's inability to fulfill maturing obligations from cash flow funding sources and/or high-quality liquid assets that can be pledged, without disrupting BPRS activities and/or financial conditions, including Risks arising from changes in the interest rates paid by the BPRS to customers, due to changes in the interest rates received by the BPRS from fund disbursement, which can affect the behavior of third-party fund customers of the BPRS (Rate of Return Risk).

Letter e
The term "Reputational Risk" refers to the Risk arising from a decline in stakeholder trust stemming from negative perceptions of the BPRS.

Letter f
The term "Strategic Risk" refers to the Risk arising from the BPRS's inaccuracy in making and/or implementing strategic decisions and the BPRS's failure to anticipate changes in the business environment.

Paragraph (2)
Clear enough.

Paragraph (3)
Clear enough.

Article 4
The establishment of clear authority and responsibility at every level of position related to the implementation of Risk Management aims for the effectiveness of supervision of Risk Management implementation.

Article 5
Paragraph (1)
Letter a
Risk Management Policy includes, among others, strategies and Risk frameworks established according to the level of Risk to be taken (risk appetite) and risk tolerance.

Letter b
Transactions requiring Board of Directors approval include, among others, transactions that have exceeded the authority of BPRS officials one level below the Board of Directors, in accordance with prevailing internal policies and procedures.

Letter c
The development of Risk Management culture includes, among others, providing information to all employees and adequate communication regarding Risk Management principles, including developing a Risk-aware culture and the importance of effective internal control.

Letter d
The improvement of human resource competence includes, among others, through continuous education and training programs regarding the implementation of Risk Management.

Letter e
The term "independent" includes, among others, the separation of functions between the work unit or Executive Official responsible for handling Risk Management functions from the work unit or employees carrying out BPRS operational functions and internal audit functions. Operational functions are functions related to fund collection and fund disbursement.

Letter f
Number 1)
Included in the responsibility for implementing Risk Management Policy are:
a) evaluating and providing direction based on reports submitted by the work unit or Executive Official responsible for the implementation of Risk Management functions; b) submitting accountability reports to the Board of Commissioners and Sharia Supervisory Board every 6 (six) months or more depending on operational changes, new product issuance, and/or the implementation of new activities; c) ensuring that significant risk impacts have been followed up; d) effectively communicating Risk Management policies to all relevant organizational levels to ensure clear understanding; and e) ensuring that work units or employees handling operational functions inform the Risk exposure attached to the respective work unit to the Risk Management work unit or Executive Official responsible for the implementation of Risk Management functions every 6 (six) months or more depending on operational changes, new product issuance, and/or the implementation of new activities.

Number 2)
Clear enough.

Paragraph (2)
The term "having adequate understanding" includes understanding of Sharia Principles related to BPRS functional activities.

Article 6
Letter a
The evaluation of Risk Management Policy is conducted by the Board of Commissioners once in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities.

Letter b
Clear enough.

Letter c
The evaluation of the Board of Directors' accountability for the implementation of Risk Management Policy is conducted by the Board of Commissioners every semester or more.

Letter d
Transactions requiring Board of Commissioners approval are transactions that, in accordance with statutory regulations, require Board of Commissioners approval, including, among others, providing financing to related parties.

Article 7
Letter a
The evaluation of Risk Management Policy related to the fulfillment of Sharia Principles is conducted by the Sharia Supervisory Board once in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities.

Letter b
The evaluation of the Board of Directors' accountability for the implementation of Risk Management Policy related to the fulfillment of Sharia Principles is conducted by the Sharia Supervisory Board every semester or more.

Article 8
The establishment of Risk Management Policy considers financial conditions, organizational structure and complexity, and Risks arising from changes in internal and external factors.

Letter a
Clear enough.

Letter b
Included in the Risk Management information system are information flows to the BPRS Board of Directors utilizing information technology or data processing results to support decision-making.

Letter c
The term "Risk tolerance" is the potential loss that can be absorbed by BPRS capital.

Letter d
The term "Risk rating assessment" is the basis for BPRS to establish BPRS Risk ratings categorized into 5 (five) Risk ratings, namely very low, low, medium, high, and very high.

Letter e
The term "worst-case contingency plan or contingency plan" is a plan to develop scenarios to anticipate internal disruptions including system failures and external disruptions causing emergency conditions that can disrupt BPRS operations.

Letter f
Clear enough.

Article 9
Risk Management procedures and the establishment of Risk limits are adjusted to the level of Risk to be taken (risk appetite). The level of Risk to be taken takes into account the experience possessed by the BPRS regarding BPRS business transaction Risks in the past.

Paragraph (1)
Letter a
Clear enough.

Letter b
The term "adequate documentation of Risk Management procedures and Risk limit establishment" is written, complete, accurate, current, and intact documentation so as to facilitate audit trails for BPRS internal control purposes.

Paragraph (2)
Letter a
The term "overall limit" is the Risk limit that can be tolerated by the BPRS for all applied Risks.

Letter b
The term "limit per type of Risk" is the Risk limit that can be tolerated by the BPRS for each type of Risk.

Letter c
The term "limit per specific functional activity" is the Risk limit that can be tolerated by the BPRS for each functional activity.

Article 10
Paragraph (1)
The term "Risk factors that are material" refers to Risk factors that are quantitative and qualitative and have a significant influence on BPRS financial conditions.

Paragraph (2)
Letter a
The term "adequate management information system" is a management information system capable of providing complete, accurate, current, and intact data and information for decision-making related to Risk Management.

Letter b
Clear enough.

Article 11
Paragraph (1)
Risk identification is conducted based on past experience related to transactions that caused losses, reduced profits, or caused problems at the BPRS.

Paragraph (2)
Letter a
Evaluation is conducted by independent work units or officials not involved in the preparation and/or establishment in carrying out Risk measurement. Evaluation is conducted according to business development, BPRS internal and external conditions that can directly affect BPRS conditions.

Letter b
Included in material changes are changes in business activities, products, transactions, organizational structure, information systems, and quantitative and qualitative Risk factors that have a significant influence on BPRS conditions.

Paragraph (3)
Letter a
Evaluation of Risk exposure is conducted by independent work units or officials not involved in the preparation and/or establishment of Risk exposure, by monitoring and reporting significant Risks or those impacting BPRS capital conditions, which among others is conducted using historical data analysis.

Letter b
Clear enough.

Paragraph (4)
Included in the Risk control process is the addition of capital to absorb potential losses.

Article 12
Paragraph (1)
Letter a
Reports or information regarding Risk exposure include overall quantitative and/or qualitative Risk exposure, details per type of Risk and per type of functional activity.

Letter b
Clear enough.

Letter c
Clear enough.

Letter d
Clear enough.

Paragraph (2)
The term "periodically" means every 6 (six) months or more depending on operational changes, new product issuance, and/or the implementation of new activities.

Article 13
Clear enough.

Article 14
The purpose of a comprehensive internal control system is to ensure:
a. compliance with statutory regulations, policies, and internal BPRS provisions; b. the availability of complete, accurate, current, and intact financial and management information;
c. effectiveness and efficiency in operational activities; and
d. the effectiveness of Risk culture throughout the BPRS organization.

Article 15
Paragraph (1)
Letter a
Clear enough.

Letter b
Clear enough.

Letter c
Clear enough.

Letter d
The term "establishment of clear reporting lines and separation of functions" is:
a. reporting lines from work units or employees handling operations to work units or employees carrying out control functions; and b. separation of functions between work units or employees handling operations and work units or employees carrying out control functions.

Letter e
Clear enough.

Letter f
Clear enough.

Letter g
Clear enough.

Letter h
The term "complete and adequate documentation" is documentation of operational procedures, scope and audit findings, and responses from BPRS management to audit results. Management refers to Board of Directors members and Board of Commissioners members.

Letter i
Verification and review of the internal control system including handling of significant BPRS weaknesses and actions by BPRS management to correct deviations that occur. Management refers to Board of Directors members and Board of Commissioners members.

Paragraph (2)
Clear enough.

Article 16
Paragraph (1)
Letter a
The Risk Management Committee is a non-structural unit with membership that can be permanent or non-permanent according to BPRS policy.

Letter b
The Risk Management Work Unit is a structural work unit.

Paragraph (2)
The Risk Management Work Unit and Compliance Work Unit can be merged into 1 (one) work unit that carries out Risk Management functions and Compliance functions.

Paragraph (3)
The Executive Official responsible for the implementation of Risk Management functions can concurrently serve as the Executive Official responsible for the implementation of Compliance functions.

Paragraph (4)
BPRS may consider forming a Risk Management Committee if necessary.

Paragraph (5)
Clear enough.

Article 17
Paragraph (1)
Letter a
The term "majority of Board of Directors members" means more than 50% (fifty percent) of the total number of Board of Directors members.
Board of Directors members in the Risk Management Committee do not include the President Director and consist of at least Board of Directors members who oversee the Compliance function.

Letter b
The term "related Executive Official" is a BPRS official one level below the Board of Directors who leads the operational work unit and head of the work unit

Risk Management Work. The membership of Executive Officers in the Risk Management Committee is adjusted according to the problems and needs of the BPRS.

Paragraph (2)
Letter a
Clear enough.
Letter b
Clear enough.
Letter c
Included in operational decisions that deviate from normal procedures include significant exceeding of business expansion compared to the BPRS business plan and taking positions or risk exposures that do not match the established limits.

Article 18
Paragraph (1)
What is meant by "independent" is a Risk Management work unit or Executive Officer appointed who is responsible for the implementation of Risk Management functions does not handle fund collection and lending functions and does not perform internal audit functions.

Paragraph (2)
Clear enough.

Paragraph (3)
The authority and responsibility of the Risk Management work unit or Executive Officer appointed who is responsible for the implementation of Risk Management functions are adjusted according to the complexity of the BPRS business activities. Letter a Clear enough. Letter b Clear enough. Letter c The assessment of proposals for the issuance of products and/or the implementation of new activities aims to evaluate the BPRS's ability to issue products and/or implement new activities, including the assessment of system and procedure changes due to the issuance of products and/or implementation of new activities. Letter d What is meant by "work units or employees handling operational functions" are work units or employees handling fund collection, lending, and other operational activities. Recommendations include the magnitude or maximum risk exposure that the BPRS must maintain. Recommendations are submitted to the Risk Management Committee in accordance with BPRS regulations requiring the establishment of a Risk Management Committee or BPRS that has a Risk Management Committee. Letter e The Risk Profile is a comprehensive picture of the magnitude of potential risks inherent in the entire portfolio or BPRS exposures. The submission of periodic reports is adjusted to the BPRS conditions and is conducted at least every semester. The Risk Profile Report is submitted to the Risk Management Committee in accordance with BPRS regulations requiring the establishment of a Risk Management Committee or BPRS that has a Risk Management Committee.

Article 19
Paragraph (1)
Clear enough.

Paragraph (2)
Clear enough.

Paragraph (3)
Requests for adjustments to action plans by the Financial Services Authority (OJK) include cases where the action plan is deemed not to fully meet the requirements set by the Financial Services Authority and/or BPRS that based on monthly reports has experienced an increase in core capital to become at least IDR 50,000,000,000.00 (fifty billion rupiah) or to become at least IDR 80,000,000,000.00 (eighty billion rupiah) during 6 (six) consecutive monthly report positions.

Paragraph (4)
Clear enough.

Paragraph (5)
Clear enough.

Article 20
Paragraph (1)
Clear enough.

Paragraph (2)
What is meant by "first semester" is January 1 to June 30.
What is meant by "second semester" is July 1 to December 31.

Paragraph (3)
Clear enough.

Paragraph (4)
Clear enough.

Article 21
Paragraph (1)
The Risk Profile Report submitted by the BPRS to the Financial Services Authority (OJK) is based on complete, accurate, current, and complete data and information.

Paragraph (2)
The Risk Profile Report is submitted by the Risk Management work unit or Executive Officer appointed who is responsible for the implementation of Risk Management functions to the Risk Management Committee in accordance with this Financial Services Authority Regulation requiring the BPRS to have a Risk Management Committee or BPRS that has a Risk Management Committee.

Paragraph (3)
What is meant by "first semester" is January 1 to June 30.

What is meant by "second semester" is July 1 to December 31.

Paragraph (4)
Clear enough.

Paragraph (5)
Clear enough.

Paragraph (6)
Clear enough.

Article 22
Paragraph (1)
What is meant by "conditions potentially causing significant loss to the financial condition of the BPRS" are conditions that have the potential to reduce profits, cause losses, or reduce the BPRS's capital ratio.

Paragraph (2)
Example:
BPRS A has core capital of IDR 10,000,000,000.00 (ten billion rupiah) in 2024 and is required to submit a Risk Profile Report covering Credit Risk and Operational Risk. However, due to large withdrawals of third-party funds in a short period, BPRS A is exposed to Liquidity Risk. With these conditions, BPRS A is required to submit another Risk Profile Report, namely Liquidity Risk.

Paragraph (3)
Clear enough.

Paragraph (4)
Requests by the Financial Services Authority (OJK) include cases where the BPRS has been designated by the Financial Services Authority (OJK) as a BPRS under intensive supervision or a BPRS under special supervision.

Article 23
Clear enough.

Article 24
Clear enough.

Article 25
Paragraph (1)
Assessment of Risk Management at the BPRS includes assessment of inherent Risk and assessment of Risk management quality.

Paragraph (2)
The submission of data and information related to the implementation of Risk Management is carried out by the BPRS in accordance with requests from the Financial Services Authority (OJK).

Article 26
What is meant by "monthly report" is the monthly report submitted by the BPRS, including monthly reports after correction of the results of the Financial Services Authority (OJK) examination.

Article 27
What is meant by "monthly report" is the monthly report submitted by the BPRS, including monthly reports after correction of the results of the Financial Services Authority (OJK) examination.

Article 28
What is meant by "monthly report" is the monthly report submitted by the BPRS, including monthly reports after correction of the results of the Financial Services Authority (OJK) examination.

Article 29
Paragraph (1)
Clear enough.

Paragraph (2)
Clear enough.

Paragraph (3)
Clear enough.

Paragraph (4)
Letter a
Clear enough.
Letter b
The listing of BPRS Board of Directors members and Board of Commissioners members in the list of parties receiving a "fail" rating is implemented through a competency and fitness test process in accordance with legislation regarding competency and fitness tests.

Paragraph (5)
Clear enough.

Article 30
Clear enough.

Article 31
Paragraph (1)
Clear enough.

Paragraph (2)
Letter a
Clear enough.
Letter b
The listing of BPRS Board of Directors members and Board of Commissioners members in the list of parties receiving a "fail" rating is implemented through a competency and fitness test process in accordance with legislation regarding competency and fitness tests.

Paragraph (3)
Clear enough.

Article 32
Clear enough.

Article 33
Clear enough.

Article 34
Clear enough.

Article 35
Clear enough.
SUPPLEMENT TO THE STATE GAZETTE OF THE REPUBLIC OF INDONESIA NUMBER 6265 ---