Implementation of Risk Management for Financing Companies and Sharia Financing Companies

To:

The Board of Directors of Financing Companies; and
The Board of Directors of Sharia Financing Companies,
At their respective locations.

COPY
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 7 /SEOJK.05/2021 CONCERNING THE IMPLEMENTATION OF RISK MANAGEMENT FOR FINANCING COMPANIES AND SHARIA FINANCING COMPANIES

In relation to the provisions of Article 25 of Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions (State Gazette of the Republic of Indonesia Year 2020 Number 200, Supplement to the State Gazette of the Republic of Indonesia Number 6552), it is necessary to regulate further regarding the implementation of risk management, the organizational structure of the risk management committee, the organizational structure of the risk management function, the relationship between business and operational functions and the risk management function, and the management of risks associated with the development or expansion of business activities for financing companies and Sharia financing companies in this Financial Services Authority Circular Letter as follows:

I. GENERAL PROVISIONS
In this Financial Services Authority Circular Letter, the following terms are defined:

Company means a financing company and a Sharia financing company.
Financing Company means a business entity that conducts financing activities for goods and/or services, including those that conduct part of their business based on Sharia principles.
Sharia Financing Company means a Financing Company that conducts all its business activities based on Sharia financing.
Board of Directors means the company organ authorized and fully responsible for the management of the company for the benefit of the company, in accordance with the company's purpose and objectives, and represents the company, both inside and outside of court, in accordance with the provisions of the Articles of Association.
Board of Commissioners means the company organ tasked with conducting general and/or specific supervision in accordance with the Articles of Association and providing advice to the Board of Directors.
Sharia Supervisory Board is a board that has the task and function of supervision and provides advice to the Board of Directors regarding the implementation of the Company's activities to ensure compliance with Sharia principles.
Risk is the potential for losses that cannot be controlled and/or can be controlled due to the occurrence of a specific event.
Risk Management is a series of procedures and methodologies used to identify, measure, control, and monitor Risks arising from the Company's business activities.
Strategic Risk is the risk resulting from inaccuracies in making and/or implementing strategic decisions and failures in anticipating changes in the business environment.
Operational Risk is the risk resulting from insufficient and/or non-functioning internal processes, human error, system failures, and/or external events affecting the Company's operations.
Credit Risk is the risk resulting from the failure of other parties to fulfill their obligations to the Company.
Market Risk is the risk on asset, liability, equity, and/or administrative account positions, including derivative transactions, resulting from overall changes in market conditions.
Liquidity Risk is the risk resulting from the Company's inability to meet maturing liabilities from cash flow funding sources and/or from liquid assets that can be easily converted into cash, without disrupting the Company's activities and financial condition.
Legal Risk is the risk resulting from legal claims and/or weaknesses in legal aspects.
Compliance Risk is the risk resulting from the Company's failure to comply with and/or implement applicable laws and regulations and provisions applicable to the Company.
Reputational Risk is the risk resulting from a decline in stakeholder trust stemming from negative perceptions of the Company.

II. GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT

The implementation of Risk Management must be adjusted to the objectives, business policies, size, and complexity of the Non-Bank Financial Service Institution (LJKNB), considering the development of conditions and potential problems faced.
In the implementation of Risk Management as referred to in item 1, the Company must have and implement written Risk Management strategies, policies, and procedures.
The implementation of Risk Management as referred to in items 1 and 2 refers to the guidelines for the implementation of Risk Management as contained in Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
The written Risk Management strategies, policies, and procedures as referred to in item 2 can be formulated in the form of the Company's internal Risk Management guidelines.
The guidelines for the implementation of Risk Management for the Company as referred to in item 3 are the minimum reference for the Company in implementing Risk Management, to ensure that all Risks faced by the Company are identified, measured, controlled, and monitored accurately.
The Risk Management strategies, policies, and procedures as referred to in item 4 must at least cover:
a. the implementation of Risk Management, which at least covers:
1. active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board;
2. adequacy of Risk Management policies and procedures and the establishment of Risk limits;
3. adequacy of risk identification, measurement, control, and monitoring processes, as well as Risk Management information systems; and
4. a comprehensive internal control system;
  b. the implementation of Risk Management for each type of Risk, which covers the implementation of Risk Management for each of the 8 (eight) risks, namely:
5. Strategic Risk;
6. Operational Risk;
7. Credit Risk;
8. Market Risk;
9. Liquidity Risk;
10. Legal Risk;
11. Compliance Risk; and
12. Reputational Risk; and
  c. risk profile assessment, which covers the assessment of inherent risks and the assessment of the quality of Risk Management implementation reflecting the Risk control system for the Company. This assessment is conducted against the 8 (eight) types of Risks as referred to in letter b. In conducting the risk profile assessment, the Company refers to the Financial Services Authority Regulation regarding the assessment of the health level of non-bank financial service institutions.
The Company must have an organizational structure that supports the effective implementation of Risk Management, including the organizational structure of the Risk Management committee and the organizational structure of the Risk Management function, which are an integral part of the Company's Risk Management organizational structure.
The Company's Risk Management organizational structure as referred to in item 7 must explain the relationship between business and operational functions and the Risk Management function.
The Risk Management organizational structure as referred to in items 7 and 8 refers to Appendix II, which is an integral part of this Financial Services Authority Circular Letter.
In the context of risk measurement, the Company may use various approaches to Risk measurement, including using internal models. The use of internal models is intended to anticipate the increasingly complex development of the Company's business activities as well as to anticipate the Company's future policies. The implementation of internal models requires various minimum quantitative and qualitative requirements so that risk assessment results can better reflect the Company's actual condition.
In order to implement effective Risk Management, the Company must take preparatory, developmental, and/or improvement steps, including:
a. conducting an analysis of the organization, Risk Management policies, and procedures, or internal Risk Management guidelines; b. formulating a plan to improve the Company's Risk Management in accordance with the reference in the standard guidelines for the implementation of Risk Management for the Company, in case there are still inconsistencies between the Risk Management strategies, policies, and procedures, or internal Risk Management guidelines for the Company in accordance with the standard guidelines for the implementation of Risk Management in this Financial Services Authority Circular Letter;
c. socializing the Risk Management strategies, policies, and procedures, or internal Risk Management guidelines to employees so that they understand Risk Management practices, and developing a risk management culture among all employees at every level of the Company's organizational structure; and
d. ensuring that the internal audit function participates in monitoring the formulation and improvement of internal Risk Management guidelines and the implementation of such Risk Management as well as the risk profile assessment as regulated in the Financial Services Authority Regulation regarding the assessment of the health level of non-bank financial service institutions.
The implementation of Risk Management in the Company also includes the implementation of anti-money laundering and counter-terrorism financing programs as regulated in the Financial Services Authority Regulation regarding the implementation of anti-money laundering and counter-terrorism financing programs in the financial services sector.

III. MANAGEMENT OF RISKS ASSOCIATED WITH THE DEVELOPMENT OR EXPANSION OF BUSINESS ACTIVITIES OF THE COMPANY

The Company must have written policies and procedures to manage the inherent risks associated with the development or expansion of business activities.
The Risk Management policies and procedures in the context of the development or expansion of business activities must be in line with the Company's business plan.
The Company's business activities categorized as a form of development or expansion of business activities are business activities that:
a. have never been previously conducted by the Company, such as other financing business activities based on approval from the Financial Services Authority as regulated in the Financial Services Authority Regulation regarding the conduct of Company business and fee-based activities based on reporting to the Financial Services Authority; or b. have been previously conducted by the Company, but are developed in a way that changes or increases certain Risk exposures to the Company, such as working capital financing activities conducted via business capital facilities with a financing value greater than Rp500,000,000.00 (five hundred million rupiah).
The Risk Management strategies, policies, and procedures, or the Company's internal Risk Management guidelines regarding the aspects referred to in Roman numeral II item 6 letters a and b need to be adjusted in the event that the development or expansion of the Company's business activities has a significant impact on the Company's overall business activities.

This copy is consistent with the original
Director of Law 1
Legal Department signed
Mufli Asmawidjaja

IV. OTHER PROVISIONS

Companies that already have Risk Management strategies, policies, and procedures, or internal Risk Management guidelines, but which are not yet in accordance with the Risk Management implementation standards as referred to in the appendix of this Financial Services Authority Circular Letter, must adjust and improve their Risk Management strategies, policies, and procedures, or internal Risk Management guidelines by referring to this Financial Services Authority Circular Letter.
Companies may expand and deepen the guidelines for the implementation of Risk Management as referred to in the appendix of this Financial Services Authority Circular Letter in accordance with the Company's needs.

V. CLOSING

At the time this Financial Services Authority Circular Letter takes effect, Financial Services Authority Circular Letter Number 10/SEOJK.05/2016 concerning Guidelines for the Implementation of Risk Management and Self-Assessment Report on the Implementation of Risk Management for Non-Bank Financial Service Institutions is declared not applicable to the Company.
This Financial Services Authority Circular Letter takes effect on the date of issuance.

Established in Jakarta on 5 February 2021
EXECUTIVE HEAD OF INSURANCE, PENSION FUND,
FINANCING INSTITUTION, AND
OTHER FINANCIAL SERVICE INSTITUTION SUPERVISOR FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, signed RISWINANDI

APPENDIX I
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 7 /SEOJK.05/2021 CONCERNING THE IMPLEMENTATION OF RISK MANAGEMENT FOR FINANCING COMPANIES AND SHARIA FINANCING COMPANIES

TABLE OF CONTENTS
I. IMPLEMENTATION OF RISK MANAGEMENT............................................................1.
A. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board ................................................................................................1.
B. Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits..........................................................................................9.
C. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Risk Management Information Systems ..........16.
D. Comprehensive Internal Control System .........................................25.
II. IMPLEMENTATION OF RISK MANAGEMENT FOR EACH RISK .....27.
A. Strategic Risk ................................................................................. 27.

Definition.......................................................................................... 27.
Objective .......................................................................................... 28.
Implementation of Risk Management........................................................ 28.
B. Operational Risk ............................................................................ 35.
Definition.......................................................................................... 35.
Objective .......................................................................................... 36.
Implementation of Risk Management........................................................ 36.
C. Credit Risk ..................................................................................... 46.
Definition.......................................................................................... 46.
Objective .......................................................................................... 48.
Implementation of Risk Management........................................................ 48.
D. Market Risk ...................................................................................... 64.
Definition.......................................................................................... 64.
Objective .......................................................................................... 64.
Implementation of Risk Management........................................................ 64.
E. Liquidity Risk ............................................................................... 70.
Definition.......................................................................................... 70.
Objective .......................................................................................... 71.
Implementation of Risk Management........................................................ 71.
F. Legal Risk................................................................................... 86.
Definition.......................................................................................... 86.
Objective .......................................................................................... 86.
Implementation of Risk Management........................................................ 87.
G. Compliance Risk.............................................................................. 91.
Definition.......................................................................................... 91.
Objective .......................................................................................... 91.
Implementation of Risk Management........................................................ 91.
H. Reputational Risk ................................................................................. 95.
Definition.......................................................................................... 95.
Objective .......................................................................................... 95.
Implementation of Risk Management........................................................ 95.
III. RISK PROFILE ASSESSMENT................................................................... 101.

GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT FOR FINANCING COMPANIES AND SHARIA FINANCING COMPANIES
I. IMPLEMENTATION OF RISK MANAGEMENT
As regulated in Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions, the Company is required to implement Risk Management effectively, which generally covers at least 4 (four) pillars, namely:

active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board;
adequacy of Risk Management policies and procedures and the establishment of Risk limits;
adequacy of risk identification, measurement, control, and monitoring processes, as well as risk management information systems; and
a comprehensive internal control system.
The Risk Management principles of each of the aforementioned pillars are elaborated as follows:
A. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board The Board of Directors, Board of Commissioners, and Sharia Supervisory Board are responsible for the effectiveness of Risk Management implementation in the Company. Therefore, the Board of Directors, Board of Commissioners, and Sharia Supervisory Board must at least:

understand well the types and levels of inherent risks associated with the Company's business activities;
provide clear direction regarding matters related to the implementation of Risk Management;
conduct active supervision and risk mitigation;
develop a Risk Management culture in all integrated Risk Management processes/cycles within the Company;
ensure an adequate organizational structure to support the effective implementation of risk management;
establish clear tasks and responsibilities for each function; and
ensure the adequacy of the quantity and quality of human resources to support the effective implementation of Risk Management.
Matters that need to be considered in the implementation of active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board include the following:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a. The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, within the scope of their respective authorities, are responsible for ensuring that the implementation of Risk Management has been effective in accordance with the Company's characteristics, complexity, and Risk profile; b. The Board of Directors and Board of Commissioners must ensure that each function in the Company implements Risk Management;
c. The Board of Directors must ensure clarity of authority and responsibility for Risk management, adequacy of systems to measure Risk, adequate structure for Risk-taking limits, effective internal controls, and comprehensive, periodic, and timely reporting systems;
d. The authority and responsibility of the Board of Directors at least include:

formulating written and comprehensive Risk Management policies and strategies, including among others:
a) formulating and updating procedures and tools to identify, measure, control, and monitor Risk; b) formulating overall Risk limits and per Risk type, considering the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) in accordance with the Company's condition and calculating the impact of Risk on capital adequacy. After receiving approval from the Board of Commissioners, the Board of Directors establishes the aforementioned Risk Management policies, strategies, and framework; c) ensuring that all policies, provisions, systems, and procedures, as well as business activities conducted by the Company are in accordance with applicable laws and regulations; d) after receiving approval from the Board of Commissioners regarding Risk Management policies, the Board of Directors establishes the aforementioned Risk Management strategies, policies, and procedures, or internal Risk Management guidelines; and e) evaluating and updating Risk Management strategies, policies, and procedures, or internal Risk Management guidelines at least 1 (one) time in 1 (one) year or at a higher frequency in the event of significant changes in factors affecting the Company's business activities, Risk exposure, or Risk profile;
being responsible for the implementation of Risk Management policies and the Risk exposure taken by the Company as a whole, including among others:
a) evaluating and providing direction based on reports submitted by the Risk Management function, including reports regarding the Risk profile; b) taking necessary actions in accordance with the Company's Risk profile, including by providing recommendations or proposals regarding the implementation of Risk Management to each function in the Company; c) ensuring that all material Risks and the impacts caused by such Risks have been followed up on and submitting accountability reports on such follow-up to the Board of Commissioners periodically. The aforementioned reports include among others reports on developments and problems related to material Risks accompanied by improvement steps that have been, are being, and will be taken; d) ensuring the implementation of improvement steps for problems or deviations in the Company's business activities found by the internal audit function; and e) submitting accountability reports on the implementation of Risk Management policies and the Risk exposure taken by the Company to the Board of Commissioners and Sharia Supervisory Board at least 1 (one) time in 6 (six) months;
evaluating and deciding on transactions and Risk limits that require Board of Directors approval, including formulating and establishing approval mechanisms for transactions, including those exceeding limits and authority for each job level in the Company;
developing a Risk Management culture at all organizational levels, including developing Risk awareness at all organizational levels, including among others adequate communication to all organizational levels regarding the importance of effective internal controls;
ensuring the improvement of competence of human resources related to Risk Management so that the Company has adequate resource support to manage and control Risk, including among others through continuous education and training programs related to the implementation of Risk Management;
ensuring that the Risk Management function has operated independently, reflected among others:
a) the separation of functions between the Risk Management function that conducts identification,

measurement, monitoring and control
Risk with internal control functions; and b) the implementation of Risk Management free from conflicts of interest between functions;
7) carrying out periodic reviews to ensure:
a) the accuracy of Risk assessment methodologies; b) the adequacy of the implementation of the Risk Management information system; and c) the appropriateness of Risk Management policies and procedures and the establishment of Risk limits, these reviews are conducted to anticipate if there are changes in external and internal factors; e. Authorities and responsibilities of the Board of Commissioners, at a minimum include:

approving Risk Management policies prepared by the Board of Directors and evaluating such policies,
including the Risk Management strategy prepared by the Board of Directors, at least 1 (one) time in 1 (one) year or at a more frequent frequency in the event of changes in factors that significantly affect the Company's business activities;
evaluating the Board of Directors' accountability at least 1 (one) time in 6 (six) months and
providing guidance for improvements in the implementation of Risk Management policies periodically. The evaluation is conducted to ensure that the Board of Directors manages the Company's activities and Risks effectively and ensures that Risk Management policies and implementation are carried out effectively and integrated into the overall business process. In conducting this evaluation, the Board of Commissioners may form a risk monitoring committee that is tasked with assisting the Board of Commissioners in monitoring the implementation of Risk Management prepared by the Board of Directors;
evaluating and deciding on the Board of Directors'
requests related to transactions and Risk limits that require Board of Commissioners approval. These transactions and Risk limits are business or operational activities that have exceeded the authority of the Board of Directors to do so, in accordance with the Company's internal policies and procedures; and
forming a risk monitoring committee tasked with
assisting the Board of Commissioners in monitoring the implementation of Risk Management prepared by the Board of Directors (mandatory for Companies with total assets exceeding Rp200,000,000,000.00 (two hundred billion rupiah). f. Authorities and responsibilities of the Shariah Supervisory Board, at a minimum include:
evaluating policies, including the Risk Management strategy
prepared by the Board of Directors related to compliance with Shariah principles at least 1 (one) time in 1 (one) year or at a more frequent frequency in the event of changes in factors that significantly affect the Company's business activities and providing guidance regarding Risk Management policies established in the context of compliance with Shariah principles; and
evaluating the Board of Directors' accountability for
the implementation of Risk Management policies related to compliance with Shariah principles at least 1 (one) time in 6 (six) months. The evaluation is conducted to ensure that Risk Management policies and processes are implemented in accordance with Shariah principles;

Human Resources (HR)
In carrying out the responsibility of implementing Risk Management related to HR, the Board of Directors must:
a. establish clear HR qualifications for each level of position related to the implementation of Risk Management;

b. ensure the adequacy of the quantity and quality of HR available in the Company and ensure that the HR understands their tasks and responsibilities, both for the business and operational functions (risk-taking function), Risk Management function, internal control function or internal audit function as well as supporting functions responsible for the implementation of Risk Management;
c. develop employee recruitment, development, and
training systems including managerial succession plans and adequate remuneration to ensure the availability of competent employees in the field of Risk Management; d. ensure the improvement of competence and integrity of leaders and employees in business and operational functions (risk-taking function), Risk Management function and internal control function or internal audit function by considering factors such as knowledge, experience or track record, and adequate ability in the field of Risk Management through continuous education and training programs to guarantee the effectiveness of the Risk Management process; e. place competent human resources in each function according to the nature, number, and complexity of the Company's business activities; f. ensure that officials and staff placed in each of these functions have:

an understanding of the Risks inherent (inherent risk) in each of the Company's business activities;
an understanding of relevant Risk factors and market conditions affecting the Company's business activities, and the ability to estimate the impact
of changes in these factors on the Company's business continuity; and
the ability to communicate the implications of the Company's Risk exposure to the Board of Directors and Risk Management committee in a timely manner.
g. ensure that all HR understand the strategy, level of Risk to be taken (risk appetite) and Risk tolerance, (risk tolerance), the Risk Management framework established by the Board of Directors and approved or known by the Board of Commissioners and implement it consistently in all of the Company's business activities.

Risk Management Organization
In order to implement effective Risk Management, the Board of Directors of the Company establishes an organizational structure by considering at least the following matters:
a. The organizational structure prepared must be accompanied by clear tasks and responsibilities generally as well as regarding the implementation of Risk Management in all functions adjusted to the objectives and business policies, size and complexity of the Company's business activities; b. The Company has a Risk Management committee and an independent Risk Management function;
c. The organizational structure must be designed to ensure
that the internal control function and the Risk Management function operate independently from the business and operational functions (risk-taking function) of the Company; d. The organizational structure must be designed so that the Risk Management function has direct access and reporting to the Board of Directors, Board of Commissioners, and Shariah Supervisory Board for matters such as the following:

assessment of Risks and Risk exposure positions as well as
steps to be taken to manage such Risks;
assessment of changes in the Company's Risk profile;
assessment of established Risk limits;
Risk Management related to strategy,
for example, the Company's strategy, mergers and acquisitions, and financing distribution; and
assessment of Risks that have occurred and identification
of appropriate corrective actions for such Risks. e. The person in charge of the Risk Management function must have the authority and obligation to inform the Board of Commissioners of any event that may have a material impact on the Company's Risk Management system;

f. Adequacy of the delegation of authority framework is adjusted to the characteristics and complexity of business activities, the level of Risk to be taken (risk appetite) of the Company, as well as the experience and expertise of the respective personnel. Delegated authority must be reviewed periodically to ensure that the authority is in line with current conditions and the performance level of the relevant officials. B. Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits

The implementation of effective Risk Management must be supported
by a framework that includes Risk Management policies and procedures as well as clearly established risk limits in line with the vision, mission, and strategy of the Company.
The formulation of strategy, policies, and Risk Management procedures
is done by considering among other things the type, complexity of business activities, Risk profile, level of Risk to be taken (risk appetite) as well as regulations established by regulators or healthy Company practices.
The implementation of Risk Management policies and procedures
owned by the Company must be supported by adequate funding, quality HR, and adequate infrastructure.
The policies and procedures owned by the Company must be
based on Risk Management strategy and supplemented with Risk tolerance (risk tolerance) and Risk limits.
The Company's Risk Management policy must explain
how the relationship between Risk Management and objectives, strategy, and current Company conditions
Matters to be considered in the establishment of strategy,
policies, procedures, and limits include the following:
a. Risk Management Strategy

The Company formulates Risk Management strategy
in accordance with the overall business strategy by considering the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance).
Risk Management strategy is prepared to ensure
that the Company's Risk exposure is managed in a controlled manner in accordance with applicable laws and regulations.
Risk Management strategy is prepared based on
the following general principles:
a) Risk Management strategy must be oriented long-term to ensure the Company's business continuity by considering economic conditions or cycles; b) Risk Management strategy comprehensively can control and manage Risk of the Company and its subsidiaries; and c) achieve adequate capital as expected accompanied by adequate resource allocation.
Risk Management strategy is prepared by
considering the following factors:
a) the Company's objectives and strategic plans; b) economic and industry developments as well as their impact on the Company's Risk; c) the Company's organization including adequacy of HR and supporting infrastructure; d) the Company's financial conditions; and e) the Company's ability to manage Risk that arises as a result of changes in external factors and internal factors.
The Company's Risk Management policy links
Risk Management with capital management (capital required and equity capital).
Risk Management policy must detail
Risk Management strategy into Risk Management policies and procedures.
The Board of Directors must communicate the Risk Management strategy effectively to all relevant employees so that it is clearly understood.
The Board of Directors must evaluate the Risk Management strategy periodically including its impact
on the Company's financial performance, to determine whether changes to the Risk Management strategy of the Company are necessary.

b. Level of Risk to be Taken (risk appetite) and Risk Tolerance (risk tolerance)

In formulating Risk Management policies, the Board of Directors
must provide clear guidance regarding the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) of the Company. In addition, the Board of Directors must inform the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) to all levels of the organization in the Company.
The level of Risk to be taken (risk appetite)
is the level and type of Risk that can be taken by the Company in order to achieve the Company's objectives. The level of Risk to be taken is reflected in the strategy and business objectives of the Company which are formulated in the form of the Company's business plan.
The level of Risk to be taken (risk appetite) can
be the amount of Risk or characteristics of Risk that can be accepted by the Company.
Risk tolerance (risk tolerance) is the maximum
limit of the level of Risk and amount of Risk established by the Company. Risk tolerance (risk tolerance) is a breakdown of the level of Risk to be taken (risk appetite).
Risk tolerance (risk tolerance) can be quantitative and/or qualitative limits. Examples of quantitative limits are limits on the level of
financing interest rates that can be used by the Company. Examples of qualitative limits are a management decision stating no tolerance (zero tolerance) for fraud (fraud) or money laundering practices, where if such conditions exist, the Company must immediately take action.
The establishment of Risk tolerance (risk tolerance) is done by considering the level of Risk to be taken
(risk appetite), the Company's overall objectives and strategy, as well as the Company's ability to accept Risk (risk bearing capacity)
c. Policies and Procedures
Risk Management policy is written guidance in implementing Risk Management and
must be in line with the vision, mission, strategy of the Company and in its formulation must be coordinated with related functions.
Risk Management procedures are the methods or
mechanisms to implement Risk Management policies, including policies in the identification, measurement, control, and monitoring of Risk.
Policies and procedures must be designed and
implemented by considering the characteristics and complexity of business activities, the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance), Risk profile as well as laws and regulations or healthy Company practices.
Risk Management policies and procedures
are adequately documented and communicated to all employees and are reviewed periodically and updated to accommodate changes in factors that impact the Company's Risk.
Risk Management policy must:
a) be relevant to the type of Risk determined, both Risk related to strategy as well as related to the Company's daily operations; b) detail the relationship between the Company's tolerance limits, regulations regarding financing, and Risk monitoring methods; and c) explain the relationship between Risk Management with objectives, strategy and current conditions of the Company.
Risk Management policy must at a minimum contain:
a) the establishment of Risk related to the Company's financing business activities based on the Company's analysis results of Risk that is inherent (inherent risk) in each of the Company's financing business activities that have been and will be conducted; b) the establishment of methods and information systems in performing identification, measurement, monitoring and control of Risk in each of the Company's business activities; c) the establishment of risk to be taken (risk appetite), Risk tolerance (risk tolerance), and Risk limits; d) the establishment of data that must be reported, report formats, and types of information that must be included in reports related to the implementation of Risk Management so as to reflect Risk exposure that is considered in the context of decision making while still considering the principle of prudence; e) the establishment of authority and size of limits in a hierarchical manner including transaction limits that require Board of Directors approval; f) the establishment of Risk profile rankings as a basis for the Company to determine steps for improvement of the Company's business activities and specific Company activity areas as well as evaluating the results of implementation of policies and Risk Management strategies; g) an organizational structure that clearly formulates the roles and responsibilities of the Board of Directors, Board of Commissioners, and Shariah Supervisory Board, committees, Risk Management functions, business and operational functions (risk taking function), internal audit functions, and other supporting functions; h) business continuity plan policies (business continuity plan or business continuity management) in the event of worst-case external and internal conditions, so that the Company's business continuity can be maintained, including disaster recovery plans (disaster recovery plan) and contingency plans (contingency plan). The formulation of business continuity plan policies meets among other things the following:
i. involves various related functions;
ii. is flexible to be able to respond to
various scenarios of unexpected and specific disruptions, i.e., descriptions of certain conditions and actions that are needed immediately;
iii. periodic testing and evaluation of the business continuity plan; and
iv. The Board of Directors must update the business continuity plan periodically to ensure the effectiveness of the business continuity plan that has been prepared;
i) the establishment of an internal control system in the implementation of Risk Management to ensure compliance with applicable external and internal regulations, effectiveness and efficiency of the Company's operational activities, effectiveness of Risk culture (risk culture) at each level of the Company's organization, as well as the availability of accurate, complete, relevant, and timely management and financial information; and j) policies on the use of derivatives, diversification/ specialization, and asset and liability management;
Risk Management procedures must at a minimum include:
a) clear process stages; b) clear accountability and levels of delegation of authority; c) implementation of periodic reviews of procedures at least 1 (one) time in 1 (one) year or more frequent frequency, depending on the type of Risk, needs and Company development; and

d) adequate documentation of procedures to facilitate review implementation and audit trail. d. Establishment of Risk Limits

The Company must have Risk limits that are appropriate
with the level of Risk to be taken (risk appetite), Risk tolerance, and the Company's overall strategy by considering the Company's capital ability to absorb Risk exposure or losses that arise, past loss experience, HR ability, and compliance with applicable external regulations.
The establishment of Risk limits must at a minimum include:
a) clear accountability and levels of delegation of authority; b) implementation of periodic reviews of the establishment of Risk limits at least 1 (one) time in 1 (one) year or at a more frequent frequency, depending on the type of Risk, needs, and Company development; and c) adequate documentation of the establishment of Risk limits to facilitate review implementation and audit trail.
The establishment of Risk limits is done comprehensively
over all aspects related to Risk, which includes overall Risk limits, limits per Risk, and Risk limits per Company activity that has Risk exposure.
Risk limits must be understood by all relevant parties and communicated well including
in the event of changes.
In the context of Risk control, Risk limits
are used as a threshold to determine the level of intensity of Risk mitigation to be implemented by management.
The Company must have an approval mechanism
in the event of exceeding Risk limits.
The size of Risk limits is proposed by the relevant business and
operational functions (risk-taking function), which is then recommended to the function performing the Risk Management function to obtain approval from the Board of Directors, Board of Commissioners, and Shariah Supervisory Board through the Risk Management committee, or the Board of Directors in accordance with their respective authorities as regulated in the Company's internal policies.
C. Adequacy of the Process of Risk Identification, Measurement, Control, and Monitoring, as well as Risk Management Information Systems

Risk identification, measurement, control, and monitoring
are a main part of the Risk Management implementation process. Risk identification is proactive, covering all Company's business activities and is conducted to analyze the sources and likelihood of Risk emergence as well as its impact. Next, the Company needs to perform Risk measurement in accordance with the characteristics and complexity of the Company's business activities. The effectiveness of Risk Management implementation also needs to be supported by Risk control by considering the results of Risk measurement, including establishing Risk mitigation strategies. Next, monitoring is conducted on the results of Risk measurement and control.
The Company establishes a function that is independent from the party
conducting transactions to monitor the level and trend as well as analyze the direction of Risk Management implementation.
In order to support the process of risk identification, measurement,
control, and monitoring, the Company also needs to develop a Risk Management information system that is adjusted to the characteristics and complexity of business activities of the Company.
Matters to be considered in the implementation of the process
of risk identification, measurement, control, and monitoring include the following:
a. Risk Identification

The Company performs periodic identification of all Risks,
including Risks inherent (inherent risk) in the Company's business activities.
The Company has methods or systems to
perform Risk identification in all of the Company's business activities.
The Risk identification process is conducted by
analyzing all sources of Risk at a minimum conducted against Risk from the Company's business activities as well as ensuring that Risk from new business activities has gone through an adequate Risk Management process before being introduced or operated. b. Risk Measurement
The Risk measurement system is used to measure
the Company's Risk exposure as a reference for performing control. Risk measurement is conducted periodically for all of the Company's business activities.
The system must at least be able to measure:
a) the sensitivity of the Company's business activities to changes in factors affecting it, both under normal and abnormal conditions; b) the tendency of changes in the aforementioned factors based on fluctuations that occurred in the past and their correlations; c) Risk factors individually; d) overall Risk exposure as well as per type of Risk, considering the interconnection between Risks; and e) all Risks inherent (inherent risk) in all of the Company's business activities, including business development and can be integrated into the Company's management information system.
The selection of measurement methods is adjusted to the
characteristics and complexity of business activities of the Company.
Risk measurement methods can be conducted quantitatively and/or qualitatively. These measurement methods can include methods established by the regulator for risk assessment and capital calculation, or methods developed internally by the Company. Examples of simple qualitative methods include the use of checklists or subjective risk ratings such as low, medium-low, medium, medium-high, and high. Examples of quantitative methods include statistical methods such as credit scoring tools and value at risk (VaR).
For Companies using alternative methods with internal models in measuring Credit Risk, Market Risk, and Operational Risk, at a minimum, they must consider:

a) Requirements for the use of internal models, at a minimum covering:
i. the content and quality of data created or maintained must comply with generally applicable standards so as to enable reliable statistical results;
ii. the availability of a management information system that allows the system to capture appropriate and accurate data and information at the right time;
iii. the availability of documentation of the data sources used for the risk measurement process; and
iv. databases and data storage processes must be part of the system design to prevent the interruption of a series of statistical data.

b) In the event the Company conducts back testing against internal models such as credit scoring tools and value at risk (VaR), and stress testing for exposures containing specific Risks, the Company must use historical data or a series of parameters and assumptions prepared by the Company itself or assumptions requested by the regulator.

c) To address weaknesses that may arise from the use of certain risk measurement models, the Company must validate those models, which is conducted by an independent internal party relative to the function applying the model.

d) If necessary, validation is conducted or supplemented with review results conducted by external parties possessing competence and technical expertise in the development of risk measurement models. Model validation is a process:
i. evaluating the internal logic of a specific model by verifying mathematical accuracy;
ii. comparing model predictions with subsequent events (events after a certain position date); and
iii. comparing one model with other existing models, both internal and external, if available.

e) Validation must also be performed on new models, whether developed internally by the Company or provided by external parties. Models used by the Company must be evaluated periodically and ad hoc, especially in the event of significant changes in market conditions.

f) Risk measurement methods must be clearly understood by employees involved in risk control, including the Risk Management Committee, the Risk Management function, and the Board of Directors overseeing the Risk Management function.

The risk measurement system must be evaluated periodically at least once every 6 (six) months or ad hoc and improved if necessary to ensure the appropriateness of assumptions, accuracy, reasonableness, and integrity of data, as well as the procedures used to measure Risk.
The risk measurement process must clearly contain the validation process, validation frequency, data and information documentation requirements, and evaluation requirements for assumptions used, before a model is applied by the Company.
Stress testing is conducted to complement the risk measurement system by estimating potential losses of the Company under abnormal market conditions using specific scenarios to observe the sensitivity of the Company's performance to changes in Risk factors and to identify impacts that significantly affect the Company's portfolio.
The Company needs to conduct periodic stress testing and review the results of such stress testing, and take appropriate steps if estimated future conditions exceed the acceptable level of tolerance. These results are used as input when establishing or changing policies and limits.
The Company measures Risk based on its ability to assess its own Risks and the Company's capital position.

c. Risk Control

The Company must have a risk control system referring to established policies and procedures.
The risk control process implemented by the Company must be adjusted to the Risk exposure or the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance).
Risk control can be carried out by the Company, among others, through hedging mechanisms and other Risk mitigation methods to absorb potential losses.

Examples of Risk mitigation methods for Companies can include steps for handling potential risks, for example, by using the accept, control, avoid, and transfer (ACAT) method. Steps for handling potential Risks that can be taken by the Company are as follows:

a) Accept, the Company decides to accept the Risk if the magnitude of impact and potential occurrence of the Risk is still within the Risk tolerance (risk tolerance) set by the Company.
Example: Risks categorized as "low" and "medium-low" are decided to be accepted, or Risks categorized as "medium" and "medium-high" are decided to be accepted by taking other preventive steps.

b) Control, the Company decides to reduce the impact or likelihood of the Risk occurring.
Example: mitigating financing Risk by conducting feasibility analysis of the debtor's repayment capacity and forming provisions for financing receivable write-offs.

c) Avoid, the Company decides not to carry out an activity or chooses an alternative activity that produces the same output to avoid the occurrence of Risk.
Example: Policy not to disburse financing through working capital financing facilities and multi-purpose financing facilities.

d) Transfer, the Company decides to transfer all or part of the responsibility for carrying out a process to a third party.
Example: cooperating with other parties through channeling financing.

The Company must have a framework that is responsive to changes occurring due to the types of Risks present in the Company.

d. Risk Monitoring

Risks that have been identified, measured, and controlled by the Company can be monitored in the form of a Risk documentation (risk register).
Example of creating a risk register at a minimum covers:
a) determination of all activities in the Company containing Risks that have been carried out in the Risk identification process; b) ranking of likelihood of occurrence and impact (inherent risk assessment) obtained from the results of Risk measurement; c) steps for handling potential risks (potential risk treatment), such as accept, control, avoid, and transfer (ACAT) used in the Risk control process; and d) ranking of likelihood of occurrence and impact after the Risk mitigation process.
The Company must have a Risk monitoring system and procedures (risk tolerance) which among others cover monitoring of Risk exposure magnitude, Risk tolerance, internal limit compliance, and stress testing results as well as consistency of implementation with established policies and procedures.
Monitoring is carried out by both business and operational functions (risk-taking function) and the Risk Management function.
Monitoring results and periodic evaluation results are presented in periodic reports submitted to the Company's management for the purpose of Risk mitigation and necessary actions.

e. Risk Management Information System

The Risk Management information system is part of the management information system that must be owned and developed according to the Company's needs in order to implement effective Risk Management.
As part of the Risk Management process, the Company's Risk Management information system is used to support the implementation of the Risk identification, measurement, control, and monitoring processes in accordance with the Financial Services Authority Regulation regarding the Implementation of Risk Management in the Use of Information Technology by Non-Bank Financial Service Institutions.
The Risk Management information system must be able to ensure:
a) the availability of accurate, complete, informative, timely, and reliable information so that it can be used by the Board of Directors, Board of Commissioners, Sharia Supervisory Board, and related functions in implementing Risk Management to assess, mitigate, and monitor Risks faced by the Company, both overall Risks and per type of Risk, or in the context of decision-making by the Board of Directors; b) the effectiveness of Risk Management implementation covering policies, procedures, and Risk limit determinations; and c) the availability of information on the results or realization of Risk Management implementation compared to targets set by the Company in accordance with Risk Management implementation policies and strategies.
The Risk Management information system and the information generated must be adjusted to the characteristics and complexity of the Company's business activities and be adaptive to changes.
The adequacy of the scope of information generated from the Risk Management information system must be reviewed periodically to ensure that the scope has been adequate according to the development of the level of complexity of the Company's business activities.
As part of the Risk Management information system, Risk profile reports are compiled periodically by the Risk Management function which is independent of the business and operational functions (risk-taking function) and internal control functions. The frequency of submission of reports to the relevant Board of Directors must be increased according to needs, especially when market conditions change rapidly.
The Risk Management information system must support reporting to the Financial Services Authority.
In developing new information system technology and software, the Company must ensure that the implementation of new information systems and technologies will not disrupt the continuity of the Company's information systems.
If the Company decides to assign outsourced labor in software development and system improvement, the Company must ensure that the decision to appoint the third party is done objectively and independently. Outsourcing agreements or contracts must include clauses regarding maintenance and updating as well as anticipatory steps to prevent disturbances that may occur during operation.
Before implementing a new management information system, the Company must conduct testing to ensure that the processes and outputs generated have gone through effective and accurate development, testing, and re-evaluation processes, and the Company must ensure that historical accounting and management data can be accessed by the new system or software properly.
The Company must account for and update system documentation containing hardware, software, databases, parameters, process stages, assumptions used, data sources, and generated outputs so as to facilitate embedded control and audit trail implementation.
The Company must prepare a backup system and effective procedures to prevent disturbances in the Risk monitoring process and conduct periodic checks and re-evaluations of the backup system.

D. Comprehensive Internal Control System

The implementation process of effective Risk Management must be supported by a reliable internal control system. Effective implementation of the internal control system can help the Company preserve its assets, ensure the availability of trustworthy financial and managerial reporting, increase the Company's compliance with internal regulations and legislation, and reduce the Risk of losses, deviations, and violations of prudential aspects. The establishment of a reliable and effective internal control system of the Company becomes the responsibility of all business and operational functions (risk-taking function), supporting functions, and internal audit functions.
Matters to be considered in the implementation of the internal control system include the following:

a. The Company implements the internal control system effectively in the implementation of the Company's Risk Management referring to established policies and procedures. Example, the application of the principle of separation of duties (four eyes principle) that is adequate and consistent.

b. The internal control system in the implementation of Risk Management at a minimum covers:

alignment between the internal control system and the type and level of inherent Risk attached to the Company's business activities;
determination of authority and responsibility for monitoring compliance with Risk Management policies and procedures as well as Risk limit determinations;
determination of reporting lines and clear separation of duties from the business and operational functions (risk-taking function) to the internal audit function;
organizational structure that clearly describes the tasks and responsibilities of each unit and individual;
accurate and timely financial and operational reporting;
adequacy of procedures to ensure the Company's compliance with internal regulations and legislation;
effective, independent, and objective review of the Company's policies, frameworks, and operational procedures;
adequate testing and evaluation of the management information system;
complete and adequate documentation of the scope, operational procedures, audit findings, and responses from the Board of Directors, Board of Commissioners, and Sharia Supervisory Board of the Company based on audit results; and
periodic and continuous verification and review of the handling of material weaknesses of the Company and actions by the Company's Board of Directors to correct deviations that occur.

c. Review implementation of Risk Management implementation at a minimum as follows:

Periodic review and evaluation at least once every 1 (one) year by the Risk Management function and internal control function or internal audit function;
Frequency and intensity of review and evaluation can be increased based on the development of the Company's Risk exposure, changes in market conditions, measurement methods, and Risk management; and
Review by the internal control function or internal audit function among others covers:
a) reliability of the Risk Management framework, including policies, organizational structure, resource allocation, Risk Management process design, information systems, and Risk reporting of the Company; and b) implementation of Risk Management by the business and operational functions (risk-taking function) or supporting functions, including review of the implementation of monitoring by the Risk Management function.
Results of the review assessment by the Risk Management function are submitted to the Board of Commissioners, internal control function or internal audit function, audit committee (if any), and relevant Board of Directors as input for the purpose of improving the Risk Management framework and process.
Monitoring by the internal control function or internal audit function regarding improvements from internal and external audit findings. Audit findings that have not been followed up must be informed by the internal control function or internal audit function to the Board of Directors to take necessary steps.
The Company's responsiveness to weaknesses and/or deviations occurring against applicable internal and external regulations.

II. IMPLEMENTATION OF RISK MANAGEMENT FOR EACH TYPE OF RISK

A. Strategic Risk

Definition

a. Strategic Risk is Risk resulting from inaccuracies in making and/or executing strategic decisions and failures in anticipating changes in the business environment.

b. Strategic Risk can be caused among others by:

setting strategies that are less aligned with the Company's vision and mission;
conducting non-comprehensive strategic environment analysis;
misalignment of strategic plans across strategic levels; and
failure to anticipate changes in the business environment such as technological changes, macroeconomic condition changes, market competition, and changes in relevant authority policies.

Objective

The main objective of Risk Management for Strategic Risk is to minimize the possibility of negative impacts from inaccurate strategic decision-making and failures in anticipating changes in the business environment.

Implementation of Risk Management

Implementation of Risk Management for Strategic Risk is adjusted to the size and complexity of the Company's business. Implementation of Risk Management for Strategic Risk at a minimum covers:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board

In the implementation of active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Strategic Risk, besides carrying out active supervision as stated in Part I letter A, on each aspect of the Company, the following applications must be added:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board

a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Strategic Risk is carried out effectively and integrated with the implementation of Risk Management for other Risks that can impact the Company's overall Risk profile.

b) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must compile and approve strategic plans and business plans covering matters regulated in the provisions and communicate them to Company employees at every level of the organization.

c) The Board of Directors is responsible for the implementation of Risk Management for Strategic Risk which covers:
i. ensuring that the strategic objectives set are aligned with the mission and vision, culture, business direction, and Risk tolerance (risk tolerance) of the Company;
ii. providing clear guidance regarding the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) that the Company accepts;
iii. ensuring that the structure, culture, infrastructure, financial conditions, manpower, and managerial competence including executive officials, as well as existing systems and controls in the Company are suitable and adequate to support the implementation of the set strategy; and
iv. ensuring that every strategic problem that arises can be resolved effectively by the relevant work units and monitoring of corrective actions by the strategic policy work units.

d) The Board of Directors must monitor internal conditions including the Company's weaknesses and strengths, as well as the development of external factors or conditions that directly or indirectly affect the Company's business activities.

e) The Board of Directors is responsible for ensuring that Risk Management for Strategic Risk has been implemented effectively and consistently at all relevant operational levels below them.

In the event the Board of Directors delegates some of its responsibilities to executive officials and management below them, such delegation does not eliminate the obligation of the Board of Directors as the primary party who must be responsible.

Human Resources (HR)

The Company ensures the adequacy of HR for Strategic Risk referring to the scope of implementation in general as stated in Part I letter A number 2 letter b.

Strategic Risk Management Organization

a) All business and operational functions (risk-taking function) and supporting functions are responsible for assisting the Board of Directors in compiling strategic planning and implementing strategies effectively.

b) Business and operational functions and other supporting functions are responsible for ensuring at a minimum:
i. Risk Management practices for Strategic Risk and controls in the business and operational functions (risk taking function) are consistent with the overall Risk Management framework for Strategic Risk; and
ii. business and operational functions (risk taking function) and other supporting functions have policies, procedures, and resources to support the effectiveness of the Risk Management framework for Strategic Risk.

c) The Board of Directors overseeing the Risk Management function leads the change programs required in the implementation of the set strategy.

d) The Risk Management function in the Risk Management process for Strategic Risk at a minimum:
i. coordinates with business and operational functions (risk taking function) in the process of compiling strategic plans;
ii. monitors the development of strategic plan implementation, and provides input regarding opportunities and choices available for continuous strategy development and improvement; and
iii. ensures that all strategic issues and their impact on the achievement of strategic objectives are followed up promptly.

availability and limitations of resources; and
iii. analyze all available strategy alternatives after considering the Company's strategic objectives and risk tolerance.
The depth and scope of the analysis must align with the scale and complexity of the Company's business activities. b) The Company must establish strategic plans and business plans in writing and implement such plans. c) Such strategic plans and business plans must be evaluated and adjusted in the event of deviations from target achievements due to significant external and internal changes. d) In the event the Company plans to implement long-term and sustainable strategies, the Company must have adequate managerial succession plans to support the effective implementation of strategies on a sustainable basis. e) The Company must have sufficient funding sources to support the implementation of strategic plans.
2) Risk Appetite and Risk Tolerance
The determination of risk appetite and risk tolerance for Strategic Risk refers to the provisions as referred to in Roman I letter B number 6 letter b.
3) Policies and Procedures
a) The Company must have and implement policies and procedures to formulate and approve strategic plans. b) The Company must have adequate procedures to identify and respond to changes in the business environment. c) The Company must have procedures to measure progress achieved from the realization of business plans and performance according to the established schedule.
4) Determination of Risk Limits
Strategic Risk limits generally relate to limitations on deviations from established strategic plans, such as budget deviation limits and completion time target deviation limits.
c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Information Systems for Strategic Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system for Strategic Risk, in addition to meeting the provisions as in Roman I letter C, the Company must additionally apply:

Strategic Risk Identification
a) The Company must identify and account for deviations resulting from the non-realization or ineffective implementation of established business strategies or business plans, particularly those having a significant impact on the Company's business activities. b) The Company must conduct risk analysis, particularly regarding strategies requiring many resources and/or high risk, such as strategies to enter new market segments, acquisition strategies, or diversification strategies in the form of business activities and services.
Strategic Risk Measurement
a) In measuring Strategic Risk, the Company may use indicators or parameters including strategic alignment of business with business environment conditions, strategy choices: high-risk strategies and low-risk strategies, the Company's strategic position in the industry, and the achievement of business plan realization. b) The Company may conduct stress testing on strategy implementation to identify any events or changes in the business environment that could negatively impact the fulfillment of initial assumptions of strategic plans and measure the potential negative impact of such events on the Company's business performance, both financially and non-financially. c) Stress testing results must provide feedback to the strategic planning process. d) In the event stress testing results show a risk level higher than the Company's risk tolerance or the Company's ability to absorb risk, the Company develops contingency plans or strategies to mitigate such risk.
Strategic Risk Control
a) The Company must have systems and controls to monitor the implementation of business decision-making strategies and the Company's response to external changes, including financial performance by comparing actual results with expected results, to ensure that taken risks remain within tolerance limits and to report significant deviations to the Board of Directors. Such risk control systems must be approved and reviewed periodically by the Board of Directors to ensure their ongoing suitability. b) The Company must have a good strategy formulation and determination process and have a good monitoring section for the implementation of the Company's strategic plans so as to ensure conditions after the implementation of such strategies regarding the Company's business activities.
Strategic Risk Monitoring
a) The Company must have a process to monitor and control the implementation of strategies periodically. Monitoring is conducted, among others, by paying attention to past loss experiences caused by Strategic Risk or deviations in the implementation of strategic plans. b) Strategic issues arising from operational and business environment changes that have a negative impact on the Company's business conditions or financial conditions are reported to the Board of Directors in a timely manner, accompanied by an analysis of the impact on Strategic Risk and necessary corrective actions.
Risk Management Information System for Strategic Risk
a) The Company must ensure that the owned risk management information system is adequate to support the strategic planning and decision-making process and is reviewed periodically. b) The Risk Management function is responsible for ensuring that all material risks arising from changes in the business environment and strategy implementation are reported to the Board of Directors in a timely manner.
Comprehensive Internal Control System
The implementation of the internal control system for Strategic Risk refers to the provisions as in Roman I letter D.
B. Operational Risk

Definition
a. Operational Risk is Risk due to the inadequacy and/or malfunction of internal processes, human error, system failure, and/or external events affecting the Company's operations. b. Operational Risk can be caused, among others, by weaknesses in human resources, weaknesses in internal processes, inadequate systems and infrastructure, and external events having a negative impact on the Company.
c. These sources of Risk can cause events having a negative impact on the Company's operations, so the emergence of Operational Risk event types is one of the measures of the success or failure of Operational Risk Management. Some examples of Operational Risk events include organizational and business activity complexity, human resources, technology and information systems, fraud (internal and external fraud), business and organizational disruptions, and the level of interaction and dependency of the Company.
Objective
The main objective of Operational Risk Management is to minimize the likelihood of negative impacts from the malfunction of internal processes, human error, system failure, and/or events originating from outside the Company's environment.
Implementation of Risk Management
The implementation of Risk Management for Operational Risk is adjusted to the size and complexity of the Company's business activities. The implementation of Risk Management for Operational Risk must at least cover:
a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Operational Risk, in addition to carrying out active supervision as in Roman I letter A, in each aspect of such active supervision, the Company must additionally apply:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Operational Risk is carried out effectively and integrated with the implementation of Risk Management for other risks that can impact the Company's overall risk profile. b) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board are responsible for developing an organizational culture aware of Operational Risk and fostering commitment to managing Operational Risk in accordance with the Company's business strategy. c) The Company's Board of Directors creates a culture of objective disclosure of Operational Risk across all organizational elements so that Operational Risk can be identified quickly and mitigated appropriately. d) The Board of Directors ensures the establishment of effective reward policies, including remuneration and punishment, integrated into the performance evaluation system to support optimal Risk Management implementation. e) The Board of Directors must ensure that the exercise of authority and responsibilities delegated to third-party service providers is carried out well and responsibly. f) The Board of Commissioners ensures that the Company's remuneration policies are in accordance with the Company's Risk Management strategy.
Human Resources (HR)
a) The Company must have a code of ethics applied to all employees at every organizational level. b) The Company must consistently apply sanctions to employees proven to have committed deviations and violations. c) All Company employees become part of the implementation of Risk Management for Operational Risk.
Operational Risk Management Organization
a) Business and operational management functions (risk-taking function) or support functions are risk owners responsible for the daily Operational Risk Management process and reporting specific problems and Operational Risks within their units according to reporting levels. b) To facilitate the Operational Risk Management process in business and operational functions (risk-taking function) or support functions, and to ensure consistent implementation of Operational Risk Management policies, the Company may appoint dedicated operational risk officers who have a dual reporting line, namely directly to the heads of business and operational functions (risk-taking function) or support functions, and to the Risk Management function. The responsibilities of dedicated operational risk officers include developing specific risk indicators for business and operational functions (risk-taking function) or support functions, and to the Risk Management function. The responsibilities of dedicated operational risk officers include developing specific risk indicators for business and operational functions (risk-taking function) or support functions, determining escalation limits, and compiling Operational Risk Management reports. b. Adequacy of Risk Management Policies and Procedures as well as Determination of Risk Limits In ensuring the adequacy of Risk Management policies and procedures and the determination of risk limits for Operational Risk, in addition to implementing Risk Management policies and procedures and risk limits as referred to in Roman I letter B, in each aspect, the Company must additionally apply:
Risk Management Strategy
The formulation of strategies for Operational Risk refers to the Risk Management strategy as referred to in Roman I letter B number 6 letter a.
Risk Appetite and Risk Tolerance
The determination of risk appetite and risk tolerance for Operational Risk refers to the provisions as referred to in Roman I letter B number 6 letter b.
Policies and Procedures
a) The Company must establish Operational Risk Management policies that must be internalized into the business processes of all business activities and support activities of the Company, including unique Operational Risk policies according to the needs of business activities and support activities. b) The Company must have procedures that are derivatives of Operational Risk Management policies. Such procedures may include:
i. general controls, namely general operational controls on all business activities and support activities of the Company, such as separation of functions or mandatory leave requirements; and
ii. specific controls, namely operational controls specific to each business activity and support activity of the Company, such as accounting for debtor financing documents or the process of exercising authority and responsibilities delegated to third-party service providers.
c) The Company must have business continuity management (BCM), namely an integrated and comprehensive management process to ensure the continuity of the Company's operations. Some policies that can be implemented include:
i. business impact analysis (BIA);
ii. assessment of Operational Risks that may occur due to disruptions in the Company's operations;
iii. recovery strategies implemented by the Company for each form of disruption that occurs;
iv. documentation, including disaster recovery plans and contingency plans; and
v. periodic testing to ensure that the BCM approach used can be operated effectively when disruptions occur.
d) The Company has early warning procedures to handle unexpected changes in information technology systems that increase the likelihood of Operational Risk occurring. e) To mitigate Operational Risk originating from the complexity of internal processes, the Company must have policies at least covering:
i. controls to prevent Operational Risk for both all internal processes and those related to external parties;
ii. transaction settlement procedures for internal processes, including to ensure the effectiveness of transaction settlement processes;
iii. accounting execution procedures to ensure accurate accounting records, including the suitability of accounting methods used, accounting processes carried out, and documentation of supporting documents;
iv. asset and collateral storage procedures, including asset and collateral documentation, controls required for physical asset security, and periodic checks on asset conditions;
v. procedures for carrying out business activities and other Company activities, such as operating leases, fee-based activities, and outsourcing; and
vi. fraud prevention and settlement procedures.
f) To reduce the likelihood of Operational Risk originating from HR, the Company's Risk Management policies must at least contain policies regarding recruitment and placement according to organizational needs, competitive remuneration and incentive structures, training and development, periodic rotation, career planning and succession policies, and handling of employment termination issues. g) To reduce the likelihood of Operational Risk originating from systems and infrastructure, the Company's Risk Management policies must at least be supported by access procedures, including to risk management information systems, accounting information systems, risk management systems, document room security, and data processing rooms. h) To reduce the likelihood of Operational Risk originating from external events, the Company's Risk Management policies must be supported, among others, by insurance protection for the Company's physical assets, backup systems, and occupational safety guarantees for specific high-risk job fields. i) To reduce the likelihood of Operational Risk originating from customer and prospective customer profiles, the Risk Management policy must include the Company's obligation to conduct customer due diligence (CDD) or enhanced due diligence (EDD) periodically and consistently according to Operational Risk exposure. The implementation of CDD or EDD refers to all requirements and guidelines as regulated in legislation and provisions governing the implementation of anti-money laundering and counter-terrorism financing programs. CDD or EDD must be supported by an effective internal control system, specifically efforts to prevent the Company against internal crimes (internal fraud).
Determination of Risk Limits
The determination of limits for Operational Risk refers to the provisions as referred to in Roman I letter B number 6 letter d.
c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Risk Management Information Systems for Operational Risk.
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system for Operational Risk, in addition to meeting the provisions as in Roman I letter C, in each process, the Company must additionally apply:
Operational Risk Identification
a) The Company must identify and measure parameters affecting Operational Risk exposure, including the frequency and impact of:
i. system failures and errors;
ii. administrative system weaknesses;
iii. debtor relationship failures;
iv. accounting calculation errors;
v. payment processing delays and errors;
vi. fraud;
vii. accounting manipulation;
viii. information technology system weaknesses; and
ix. classification recording errors.
b) The Company develops a database regarding:
i. types and impacts of losses caused by Operational Risk based on risk identification results, including loss data that may be predictable or difficult to predict;
ii. violations of control systems; and/or
iii. other operational issues that may cause losses in the future.
c) The Company considers various internal and external factors in identifying and measuring Operational Risk, including:
i. the Company's organizational structure, risk culture, HR management, organizational changes, and employee turnover;
ii. the Company's debtor characteristics, as well as the complexity of the Company's business activities and transaction volume;
iii. the design and implementation of systems and processes used; and
iv. the external environment, industry trends, market structure, including social and political conditions.
Operational Risk Measurement
a) In measuring Operational Risk, the Company may use indicators/parameters including the Company's business activity characteristics and complexity, HR, infrastructure and information technology systems, fraud, disruptions to the Company, and the use of third-party services. b) The Company considers various internal and external factors in measuring Operational Risk. c) Methods that the Company can use to measure Operational Risk include, among others, scorecards, risk mapping, and frequency matrices. d) For Companies that have not yet developed special methods for measuring Operational Risk, the main source of Operational Risk information is internal audit findings related to Operational Risk.
Operational Risk Control
a) Risk control is carried out consistently according to the risk appetite, results of Operational Risk identification and measurement. b) In implementing Operational Risk controls, the Company may develop programs to mitigate Operational Risk, including securing information technology processes and outsourcing some of the Company's operational activities. c) In the event the Company develops information technology process security, the Company must ensure the security level of electronic data processing. d) The Company must have support systems, at least covering:
i. early error identification;
ii. efficient, accurate, and timely processing and settlement of all transactions; and
iii. confidentiality, truthfulness, and transaction security.
e) The Company must periodically review procedures, documentation, data processing systems, contingency plans, and other operational practices to reduce the likelihood of human error.
Operational Risk Monitoring
a) The Company must continuously monitor Operational Risk exposure and losses that may be caused by the Company's main activities, including by implementing internal control systems and providing periodic reports on losses caused by Operational Risk. b) The Company must periodically review the factors causing Operational Risk and the impact of its losses.
Risk Management Information System for Operational Risk
a) The management information system must be able to generate complete and accurate reports to detect and correct deviations in a timely manner. b) The Company must have a reporting mechanism for Operational Risk that can provide information according to user needs, including the following:
i. Operational Risk profile and losses caused by Operational Risk;
ii. results of various Operational Risk measurement methods and trends, and/or summaries of internal audit findings;
iii. reports on the status and effectiveness of the implementation of follow-up plans for Operational Risk issues;
iv. procedure deviation reports;
v. fraud incident reports, for example in the form of a whistle-blowing system; and
vi. recommendations from the Operational Risk Management function regarding reviews conducted on the Company's Operational Risk assessment, external auditor's letters of recommendation, specifically regarding the Company's operational control aspects, and letters of recommendation from the Financial Services Authority.
d. Comprehensive Internal Control System
In implementing the internal control system for Operational Risk, in addition to applying internal controls as referred to in Roman I letter D, the Company must have a routine rotation system to avoid potential self-dealing, collusion, or concealment of documentation or transactions that are not normal.
C. Credit Risk

Definition
a. Credit Risk is the risk due to the failure of other parties to fulfill obligations to the Company, including credit risk due to debtor failure, including credit concentration risk, counterparty credit risk, and settlement risk. b. Credit Risk is generally present in all Company activities whose performance depends on debtor performance, counterparty performance, and/or issuer performance.
c. Credit Risk can increase due to the concentration of financing distribution, including to specific debtors, geographic regions, business activities, types of financing, or specific industries. This risk is commonly referred to as financing concentration risk.

d. Counterparty credit risk arises from transactions that generally have the following characteristics:

transactions are influenced by fair value or market value movements;
the fair value of the transaction is influenced by the movement of certain market variables;
transactions result in the exchange of cash flows or financial instruments; and
the risk characteristics are bilateral, i.e., if the fair value of the contract is positive, the Company is exposed to credit risk from the counterparty; whereas if the fair value of the contract is negative, the counterparty is exposed to credit risk from the Company.
e. Settlement risk arises from the failure to deliver cash and/or financial instruments on the agreed settlement date of a sale and/or purchase transaction of financial instruments. f. Country risk is risk arising from uncertainty due to the deterioration of a country's economic conditions, a country's failure to pay its debts, socio-political turmoil in a country, and a country's policies, including nationalization or asset takeover, exchange rate controls and/or devaluation. Several types of risk included in country risk are:
sovereign risk is the potential loss arising because the government of a country cannot or is unwilling to meet its obligations;
transfer risk is the potential loss arising because foreign parties abroad cannot provide or cannot obtain foreign currency to meet their obligations due to certain restrictions, such as restrictions on cash and/or capital flows by the government of a country; and
macroeconomic risk is the potential loss arising because foreign parties abroad cannot meet obligations due to changes in economic policy in their country, such as interest rate increases aimed at maintaining currency stability.

Objectives
a. The main objective of Risk Management for Credit Risk is to minimize the likelihood of negative impacts from the Company's financing disbursement activities that could cause losses to the Company. b. Generally, Credit Risk Exposure is one of the main risk exposures, so the Company's ability to identify, measure, monitor, and control Credit Risk, as well as provide sufficient capital for such risk, is very important.
Implementation of Risk Management
The implementation of Risk Management for Credit Risk is adjusted to the size and complexity of the company's business. The implementation of Risk Management for Credit Risk must at least cover:
a. Active Supervision by the Board of Directors, Board of Commissioners, and Shariah Supervisory Board In carrying out active supervision by the Board of Directors, Board of Commissioners, and Shariah Supervisory Board for Credit Risk, in addition to carrying out active supervision as referred to in Roman I letter A, in each aspect of active supervision, the Company must add the following implementation:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Shariah Supervisory Board
a) The Board of Directors, Board of Commissioners, and Shariah Supervisory Board must ensure that the implementation of Risk Management for Credit Risk is carried out effectively and integrated with the implementation of Risk Management in the execution of financing disbursement activities, including monitoring developments and problems in the Company's business activities related to Credit Risk, including the resolution of troubled financing. b) The Board of Directors, Board of Commissioners, and Shariah Supervisory Board are responsible for ensuring that all financing disbursement activities are carried out in accordance with the Credit Risk strategy and policies approved by the Board of Commissioners and in accordance with applicable regulations. c) The Board of Directors, Board of Commissioners, and Shariah Supervisory Board ensure that the implementation of Risk Management is carried out effectively in the execution of financing disbursement activities, including monitoring developments and problems in the Company's financing disbursement activities. d) The Board of Commissioners monitors financing disbursement, including reviewing financing disbursements with large amounts or given to related parties to ensure compliance with applicable regulations.
Human Resources (HR)
The Company must have adequate HR in the field of financing management. In addition, the Company must have HR capable of developing relevant models for Credit Risk mitigation.
Risk Management Organization for Credit Risk
In the implementation of Risk Management for Credit Risk, the Company must have the following functions:
a) business units that carry out financing provision or disbursement activities; b) financing recovery units that handle troubled credit; and c) Risk Management units, specifically those that assess and monitor Credit Risk. In addition, the Company may form a financing committee responsible specifically for deciding on the provision of financing in certain amounts in accordance with each Company's policy. The membership of the financing committee is not limited to the business unit but also includes other units related to Credit Risk management, such as the financing recovery unit. b. Adequacy of Risk Management Policies and Procedures and the Determination of Risk Limits In ensuring the adequacy of Risk Management policies and procedures and the determination of Risk limits for Credit Risk, in addition to ensuring the adequacy of Risk Management policies and procedures and the determination of Risk limits as in Roman I letter B, in each aspect, the Company needs to add the following implementation:
Risk Management Strategy
a) The Risk Management Strategy for Credit Risk must cover strategies for all activities with significant Credit Risk exposure. b) The Risk Management Strategy for Credit Risk must align with the Company's objectives to maintain financing quality, profit, and business growth.
Risk Appetite and Risk Tolerance
a) Risk appetite must reflect the Company's perspective on Credit Risk, such as financing disbursement strategy and the composition of financing receivables portfolio and concentration levels. b) Risk tolerance for Credit Risk must reflect the Company's efforts to achieve its goals and be in accordance with the established risk appetite, such as maximum financing limits, financing receivables quality, and reserve adequacy. The determination of risk appetite and risk tolerance for Credit Risk refers to the provisions as referred to in Roman I letter B number 6 letter a.
Policies and Procedures
a) In the implementation of Risk Management for Credit Risk for all of the Company's business activities, a framework for healthy financing disbursement and financing disbursement policies must be established, including policies and procedures for controlling financing concentration risk. b) The Company must have policies and procedures to ensure that all financing disbursements are carried out on an arm's length basis. If the Company has policies that allow financing disbursements outside normal policies under certain conditions, such policies must clearly contain criteria, requirements, and procedures, including steps to control or mitigate the risk of such financing disbursements. c) The Company must have policies and procedures to identify financing concentration risk. In addition, the Company must also have policies and procedures to identify Credit Risk arising from country risk. d) The Company must develop and apply policies and procedures correctly so as to support:
i. healthy financing disbursement;
ii. control and monitoring of Credit Risk;
iii. correct evaluation in utilizing new business opportunities; and
iv. identification and handling of troubled financing.
e) The Company's policies must contain information needed for healthy financing provision, including:
i. financing purpose and payment sources;
ii. debtor risk profile and its mitigation, as well as sensitivity to developments in economic and market conditions;
iii. debtor's ability to repay;
iv. debtor's business ability and field business conditions, as well as the debtor's position in a specific industry; and
v. financing requirements submitted, including agreements designed to anticipate changes in debtor risk exposure in the future.
f) The Company's policies also contain factors that need to be considered in the financing approval process, including:
i. profitability levels, including comprehensive analysis of estimated costs and income, including estimated costs in the event of default, as well as capital requirement calculations; and
ii. consistency in pricing, which is done by considering risk levels, specifically the debtor's overall conditions as well as the quality and ease of liquidation of collateral used as security.
g) The Company must have procedures for financing analysis, approval, and administration, which include:
i. delegation of authority in financing disbursement decision-making procedures, which must be clearly formalized;
ii. separation of functions between those who conduct analysis, provide approval, and carry out financing administration within the framework or mechanism of financing disbursement decision-making delegation procedures;
iii. functions that conduct periodic reviews to establish or update the quality of financing disbursements exposed to Credit Risk;
iv. development of financing administration systems, including:
(1) efficiency and effectiveness of financing administration operations, including monitoring documentation, contract requirements, financing agreements, and collateral pledges; (2) accuracy and timeliness of information provided for management information systems; (3) adequate separation of functions and/or tasks; (4) feasibility of controlling all back-office procedures; and (5) compliance with written internal policies and procedures and applicable regulations. h) The Company has early warning procedures to handle unexpected and significant changes in Credit Risk in financing disbursement activities. i) The Company must account for, document, and update all quantitative and qualitative information and material evidence in financing archives used in assessment and review.
Determination of Risk Limits
a) The Company must determine overall financing disbursement limits for all of the Company's business activities containing Credit Risk, both for related and unrelated parties, as well as for individual and group debtors. b) The Company needs to apply risk tolerance for Credit Risk. c) The determination of limits for Credit Risk is used to reduce risks arising, including due to financing disbursement concentration. d) The determination of Credit Risk limits must be documented in writing and completely to facilitate audit trail setting for internal and external auditors.
c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Credit Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, as well as Risk Management information systems for Credit Risk, in addition to meeting the provisions as referred to in Roman I letter C, in each process, the Company must add the following implementation:
Credit Risk Identification
a) The system for identifying Credit Risk must be able to provide adequate information, including regarding the composition of the financing portfolio. b) In identifying Credit Risk, both individually and by portfolio, factors that can affect the level of Credit Risk in the future must be considered, such as the possibility of changes in economic conditions and the assessment of Credit Risk exposure in stressed conditions. c) In identifying Credit Risk, the results of financing quality assessment based on analysis of business prospects, financial performance, and debtor repayment ability must be considered. Specifically for counterparty credit risk, identification is also carried out by considering the feasibility of financing from the counterparty, as well as considering Credit Risk both settlement and pre-settlement. d) Specifically for financing concentration risk, the Company must also identify the causes of financing concentration risk due to idiosyncratic factors (factors specifically related to each debtor) and systematic factors (macroeconomic factors and financial factors that can affect performance and/or market conditions). e) Specifically for country risk, the Company must identify country risk exposure for each country, including intra-group exposure, exposure based on specific regions, exposure based on individuals, and exposure based on transaction counterparties.
Credit Risk Measurement
a) The Company must have written systems and procedures for measuring Risk that at least allow for:
i. centralization of exposure reporting on financial positions (balance sheets) and administrative accounts containing Credit Risk from each debtor or per group of debtors and/or specific transaction counterparties referring to the single obligor concept;
ii. assessment of differences in Credit Risk categories between debtors or transaction counterparties using a combination of qualitative and quantitative aspects and the selection of specific criteria;
iii. distribution of complete measurement results for monitoring by relevant functions;
iv. comprehensive management of counterparty credit risk, both at the counterparty level (by combining counterparty credit risk with other financing exposures) and at the overall Company level; and
v. analysis of country exposures based on time period, transaction counterparty category, and type of financing disbursement, and can measure country exposures for the Company, using scenario analysis and stress testing.
b) The Credit Risk measurement system must at least consider:
i. characteristics of each type of transaction exposed to Credit Risk;
ii. financial conditions of the debtor or transaction counterparty and requirements in financing agreements such as interest rates;
iii. financing term linked to potential changes occurring in the market;
iv. aspects of financing risk transfer, collateral risk transfer, and the encumbrance of fiduciary rights, liens, or mortgages on collateral;
v. potential for default, both based on the results of standard approach assessments and results of assessments using internally conducted rating processes; and
vi. the Company's ability to absorb potential failures.
c) Companies that develop and use internal rating systems in Credit Risk management must adjust to the portfolio characteristics, size, and complexity of the Company's business activities. d) Companies using risk measurement techniques with the internal rating approach must update data periodically. e) Measurement tools must be able to measure quantifiable inherent risk exposures, including the composition of financing receivables portfolio and concentration levels, financing receivables quality and reserve adequacy, and external factors. f) To measure Credit Risk related to counterparty failure (counterparty credit risk) such as over-the-counter derivative transactions, the Company must use market value which is carried out periodically. g) Measurement of Credit Risk due to counterparty failure (counterparty credit risk) must include routine monitoring. The Company must measure current exposure both gross and net against owned collateral in an appropriate and accountable manner (e.g., financing interest rate). One element of a strong limit monitoring system is the measurement and monitoring of highest exposure or potential future exposure (PFE) at the confidence level chosen by the Company, both at the portfolio and counterparty levels. h) To support the analysis of Credit Risk due to counterparty failure (counterparty credit risk) carried out, the Company must conduct stress testing regularly. i) Stress testing results must be periodically reviewed by the Board of Directors and must be reflected in the Credit Risk policies and limits due to counterparty failure (counterparty credit risk) established by the Board of Directors and Board of Commissioners. j) If stress testing results show vulnerability, the Board of Directors and Board of Commissioners must consider appropriate Risk Management strategies for Credit Risk due to counterparty failure (counterparty credit risk), for example, by hedging or reducing exposure. k) Companies that develop and use internal rating systems in Credit Risk management must adjust the system to the portfolio characteristics, size, and complexity of the Company's business activities. l) Basic principles in the use of internal ratings are:
i. Procedures for using the internal rating system must be formalized and documented.
ii. The internal rating system must be able to identify early changes in risk profiles caused by potential or actual decreases in Credit Risk.
iii. The internal rating system must be periodically evaluated by the Risk Management function.
iv. If the Company uses internal ratings to determine financing receivables quality and reserve amounts, there must be formal procedures ensuring that the determination of financing receivables quality and reserves with internal ratings is more prudent or equal to applicable related regulations.
v. Results from the internal rating system must be submitted periodically to the Board of Directors.
m) One model that can be used by the Company is statistical or probabilistic methodology to measure Risk related to specific types of Credit Risk transactions, such as credit scoring tools. n) In using such systems, the Company must:
i. periodically review the accuracy of models and assumptions used to project failure; and
ii. adjust assumptions to changes occurring in internal and external conditions.
o) If there are large risk exposures or relatively complex transactions, the decision-making process for Credit Risk transactions must not only be based on such systems, so it must be supported by other Credit Risk measurement tools. p) The Company must document assumptions, data, and other information used in Credit Risk measurement, including changes thereto, as well as periodic data and information updates. q) The implementation of this system must:
i. support the decision-making process and ensure compliance with delegation of authority regulations;
ii. be independent from possible manipulation that would affect results through adequate and effective security procedures; and
iii. be reviewed by functions or parties independent of the function applying the system.
Credit Risk Control
a) The Company must ensure that the credit function and other functions conducting transactions exposed to Credit Risk have functioned adequately and that Credit Risk exposure is kept consistent with established limits and meets prudential standards. b) Credit Risk control can be carried out in several ways, including risk mitigation, active portfolio position and risk management, setting concentration risk limits in the Company's annual plan, setting authority levels in the financing disbursement approval process, and periodic concentration analysis at least once (1) in one (1) year. c) Credit Risk control is also carried out against country risk exposure for each country, including intra-group exposure, exposure based on specific regions, exposure based on individuals, and exposure based on transaction counterparties. d) The Company must have an effective system to detect troubled financing. In addition, the Company must separate the troubled financing resolution function from the function that decides on financing disbursement. Each strategy and result of troubled financing handling is accounted for, which is subsequently used as input for the function responsible for disbursing or restructuring financing.
Credit Risk Monitoring
a) The Company must develop and apply comprehensive information systems and procedures to monitor the composition and condition of each debtor or transaction counterparty against the entire financing portfolio of the Company. The system must align with the characteristics, size, and complexity of the Company's portfolio. b) Monitoring procedures must be able to identify troubled financing receivables or other transactions to ensure that troubled financing receivables receive more attention, including rescue actions and the formation of sufficient reserves. c) An effective financing monitoring system will enable the Company to:
i. understand total Credit Risk exposure or per specific aspect to anticipate financing concentration risk, including per type of transaction counterparty, economic sector, or geographic region;
ii. understand the current financial conditions of debtors or counterparties, including obtaining information regarding the composition of debtor assets and growth trends;
iii. monitor compliance with requirements set forth in financing agreements or other transaction contracts;
iv. periodically assess the adequacy of collateral compared to debtor or transaction counterparty obligations;
v. identify problems accurately, including late payments, and classify potential troubled financing accurately and in a timely manner for corrective actions;

vi. handle problematic financing receivables promptly;

vii. identify the level of Credit Risk as a whole as well as per specific type of financing;

viii. monitor compliance with risk limits and provisions related to the disbursement of financing, including financing concentration risk limits and country risk exposure limits;

ix. understand total Credit Risk exposure as well as per specific aspect to anticipate country risk, which includes intra-group exposure, exposure based on specific regions, exposure based on individuals, and exposure based on counterparties; and

x. exceptions taken regarding the disbursement of specific financing.

Risk Management Information System for Credit Risk

a) The information system owned must be able to accommodate Credit Risk mitigation strategies through various methods or policies, such as the establishment of limits and hedging.

b) The Risk Management Information System for Credit Risk must be able to provide data that is accurate, complete, informative, timely, and reliable.

The data provided includes data regarding the total amount of financing exposure for individual borrowers and counterparties, country risk exposure, reserves formed related to country risk as well as financing portfolios and reports on Credit Risk limit exceptions that can be used by the Board of Directors to identify the existence of financing concentration risk.

d. Comprehensive Internal Control System

In the internal control system for Credit Risk, in addition to applying internal controls as stated in Section I letter D, the Company must also apply:

an independent and continuous review system regarding the effectiveness of the implementation of the Risk Management process for Credit Risk, which at least contains an evaluation of the financing administration process, the accuracy of the implementation of internal rating or the use of other monitoring tools, and the effectiveness of the execution of the function or officers who monitor the quality of financing receivables;
for Companies that have Credit Risk exposure resulting from counterparty failure (counterparty credit risk), an independent and continuous review system regarding the effectiveness of the implementation of the Risk Management process for Credit Risk resulting from counterparty failure, which at least contains an evaluation of the model approval process for Risk measurement and the valuation system used by the financing unit as well as validation of significant changes in the Credit Risk measurement process resulting from counterparty failure;
an internal review system by individuals independent of the business unit to help evaluate the overall financing process, determine the accuracy of internal ratings, and to assess the appropriateness of the account officer in monitoring financing individually;
an efficient and effective reporting system to provide adequate information including information regarding country risk exposure to the Board of Directors, Board of Commissioners, and audit committee; and
internal audit of the Credit Risk process is carried out periodically, which among others includes the identification of:

a) the suitability of financing disbursement activities with established policies and procedures;

b) the implementation of all authorizations within the limits of the guidelines provided;

c) accurate reporting of individual financing quality and portfolio composition to the Board of Directors;

d) weaknesses in the Risk Management process for Credit Risk, policies and procedures, including any exceptions to Risk Management policies and procedures and the establishment of Risk limits; and

e) compliance with Credit Risk limits including country risk exposure limits.

D. Market Risk

Definition

a. Market Risk is the Risk on the position of assets, liabilities, equity, and administrative accounts including derivative transactions due to overall changes in market conditions.

b. Market Risk includes among others Interest Rate Risk, Exchange Rate Risk, and Equity Risk.

Objective

The main objective of Risk Management for Market Risk is to minimize the possibility of negative impacts due to changes in market conditions on the Company's assets and capital.

Implementation of Risk Management

The implementation of Risk Management for Market Risk is adjusted to the size and complexity of the Company's business. Generally, in the principle of implementing Risk Management for Market Risk, it at least covers:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Shariah Supervisory Board

In the implementation of active supervision by the Board of Directors, Board of Commissioners, and Shariah Supervisory Board for Market Risk, in addition to carrying out active supervision as referred to in Section I letter A, in each aspect of active supervision, the Company must add the application of:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Shariah Supervisory Board

a) The Board of Directors, Board of Commissioners, and Shariah Supervisory Board must ensure that the implementation of Risk Management for Market Risk is carried out effectively and integrated with other Risk Management that can impact the Company's overall Risk profile.

b) The Board of Directors must ensure clarity of authority and responsibility for Market Risk management, adequacy of systems to measure Market Risk, adequate structure of limits for Risk taking, effective internal controls, and comprehensive, periodic, and timely reporting systems.

Human Resources (HR)

The Company ensures the adequacy of HR for Market Risk with reference to the provisions as referred to in Section I letter A number 2 letter b.

Risk Management Organization for Market Risk

The Company ensures the adequacy of the Risk Management organization for Market Risk with reference to the provisions as referred to in Section I letter A number 3.

b. Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits

In ensuring the adequacy of Risk Management policies and procedures and the establishment of Risk limits for Market Risk, in addition to implementing Risk Management policies and procedures and the establishment of Risk limits as referred to in Section I letter B, in each aspect the Company needs to add the application of:

Risk Management Strategy

In establishing the Risk Management strategy for Market Risk, the Company must consider the Company's market position, the composition of instruments or the Company's business activities, and the category of the Company's debtors.

Level of Risk to be Taken (risk appetite) and Risk Tolerance (risk tolerance)

The establishment of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) for Market Risk refers to the provisions as referred to in Section I letter B number 6 letter b.

Policies and Procedures

a) The Company must have policies and processes for establishing the difference between reference interest rates and market interest rates in a specific transaction while considering overall financial conditions and the principle of prudence.

b) The Company must have policies to face changes in market prices for assets owned by the Company. Such policies must consider the Company's asset and liability positions both in the short term and long term.

c) The Company must have adequate financing disbursement procedures to face changes in market conditions.

Establishment of Risk Limits

a) The Company must ensure consistency in the establishment of limits for various types of instruments that have Market Risk exposure.

b) The Company may establish limits based on the grouping of types of instruments that have similar characteristics.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Market Risk

In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, as well as Risk Management information systems for Market Risk, in addition to meeting the provisions as in Section I letter C, in each of those processes, the Company must add the application of:

Market Risk Identification

The Company must have a risk identification process adjusted to the Market Risk inherent in the Company's business activities, which includes Interest Rate Risk, Exchange Rate Risk, and Equity Risk.

Market Risk Measurement

a) In measuring Market Risk, the Company can use indicators/parameters including:

i. business strategies and policies related to Market Risk;

ii. volume and composition of asset portfolios with Market Risk exposure; and

iii. volume and composition of liability portfolios exposed to Market Risk.

b) The Company must have a system or model for measuring Market Risk to measure positions and sensitivities related to Market Risk under both normal and stress conditions.

c) The Company must carry out quantitative measurement of Market Risk. Some examples of measurement methods that can be carried out include sensitivity analysis, earnings at risk, value at risk, and economic value of equity;

d) The Market Risk measurement system must at least consider:

i. providing information regarding outstanding positions and potential profits or losses regularly, including information regarding each customer's position;

ii. covering all Market Risk exposure both currently and potential in the future, and being able to perform marked to market;

iii. being able to accommodate increases in exposure volume, changes in fair value valuation techniques, changes in methodology, and new business activities;

iv. taking into account Market Risk exposure associated with options, both explicit options and embedded options;

v. having documented assumptions and parameters that are evaluated periodically;

vi. supported by adequate data collection systems;

vii. equipped with scenario analysis and stress testing; and

viii. integrated with the Risk Management process regularly from the aspect of decision making, governance structure, as well as internal capital allocation processes.

e) The Company must be able to measure potential profits or losses periodically on fund disbursement activities that have Market Risk exposure.

f) The Company must document every assumption, data, and information used in the measurement of Market Risk, including changes thereto, as well as the updating of data and information carried out periodically.

g) The Company must understand the weaknesses of the methods used, as well as take into account and mitigate the impact of the weaknesses of such methods.

h) The Company must review the Market Risk measurement models, including conducting back testing and improvements where necessary.

i) In measuring Risk at the portfolio level, the Company must take into account correlations between markets and between Risk categories when evaluating Market Risk positions comprehensively, for example by including such correlations as one of the stress testing scenarios.

j) In scenario analysis and stress testing, scenarios using historical data analysis, using hypothetical assumptions, or using scenarios established by the Financial Services Authority may be used.

Market Risk Control

a) The Company must take risk control measures including preventing the occurrence of greater Market Risk losses.

b) Companies that have securities must conduct periodic reviews of the condition, credibility, and repayment ability of the issuers of the securities. Such reviews must be documented and carried out at least every 6 (six) months.

c) In the event that the Company has securities listed or traded in the capital market and based on the review results there is a possibility of increased failure of the issuer of securities and bonds, the Company must carry out controls including closely monitoring the credit spread of such securities and taking necessary actions to reduce losses, for example by forming reserves.

Market Risk Monitoring

The Company must monitor compliance with limits periodically and follow up to address in the event of limit breaches. Such reports are submitted to interested parties in accordance with the Company's internal policies.

Risk Management Information System for Market Risk

a) The Risk Management Information System for Market Risk must at least be able to quantitatively measure Risk exposure and monitor changes in market factors (interest rates, exchange rates, and equity prices) on a real-time basis, and can be used to estimate potential future losses. For financing interest rate Risk, the quantification of Risk exposure must be carried out at least monthly.

b) The Risk Management Information System must be able to facilitate stress testing, especially to identify Risks quickly so that corrective actions can be taken immediately, including as a response to changes in market factors that can have a negative impact on the Company's health level.

d. Comprehensive Internal Control System

In the implementation of the internal control system for Market Risk, in addition to applying internal controls as referred to in Section I letter D, the Company must also apply:

The Company must have an adequate internal control system to ensure that transactions and processes related to market risk taking are carried out with reference to established policies, procedures, and limits.
The application of segregation of duties must be adequate and carried out consistently so that there are no conflicts of interest.
The Company may have a function that performs trading position valuation and validates the Market Risk measurement model. Such function must be independent of the business and operational functions (risk taking function).

E. Liquidity Risk

Definition

a. Liquidity Risk is the Risk due to the Company's inability to meet maturing liabilities from cash flow funding sources and/or from liquid assets that can be easily converted into cash, without disrupting the Company's activities and financial conditions.

b. Liquidity Risk can be caused by the Company's inability to liquidate assets without incurring material discounts due to the absence of an active market or severe market disruption, which is called market liquidity risk.

c. The inability to obtain cash flow funding sources resulting in Liquidity Risk can be caused among others by:

the inability to generate cash flows originating from productive assets or from the sale of assets including liquid assets; and/or
the inability to generate cash flows originating from fund gathering, inter-company transactions, and received loans.

Objective

The main objective of Risk Management for Liquidity Risk is to minimize the possibility of negative impacts from the Company's inability to meet maturing liabilities from cash flow funding sources and/or liquid assets that can be easily converted into cash, without disrupting the Company's activities and financial conditions.

Implementation of Risk Management

The implementation of Risk Management for Liquidity Risk is adjusted to the size and complexity of the Company's business. Generally, in the principle of implementing Risk Management for Liquidity Risk, it at least covers:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Shariah Supervisory Board

In the implementation of active supervision by the Board of Directors, Board of Commissioners, and Shariah Supervisory Board for Liquidity Risk, in addition to carrying out active supervision as in Section I letter A, in each aspect of such active supervision, the Company must add the application of:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Shariah Supervisory Board

a) The Board of Directors, Board of Commissioners, and Shariah Supervisory Board must ensure that Risk Management for Liquidity Risk is carried out effectively and integrated with other Risk Management that can impact the Company's overall Risk profile.

b) The authority and responsibility of the Board of Directors at least includes:

i. monitoring the position and Liquidity Risk periodically both in normal situations and in unfavorable market situations;

ii. evaluating the Company's position and Liquidity Risk at least once every 1 (one) month;

iii. conducting immediate evaluation of liquidity positions and the Company's Risk profile in the event of significant changes including an increase in funding acquisition costs and/or an increase in the liquidity gap;

iv. adjusting Risk Management policies and strategies for Liquidity Risk as needed based on the results of evaluations of the Company's position and Liquidity Risk; and

v. submitting reports to the Board of Commissioners regarding the position and Liquidity Risk profile as well as the implementation of Risk Management policies and procedures for Liquidity Risk, which among others include evaluations of policies, strategies, and procedures, liquidity conditions periodically or in the event of significant changes.

c) The authority and responsibility of the Board of Commissioners in the implementation of Risk Management for Liquidity Risk includes among others approving and periodically evaluating Risk Management policies and strategies for Liquidity Risk including emergency funding plans.

Human Resources (HR)

The Board of Directors must ensure that every function responsible for Liquidity Risk management has HR with adequate competence.

Risk Management Organization for Liquidity Risk

a) The Company must have a risk monitoring committee responsible for managing the Company's liquidity (mandatory for Companies with total assets exceeding IDR 200,000,000,000.00 (two hundred billion rupiah).

b) The Company ensures the adequacy of the Risk Management organization for Liquidity Risk with reference to general provisions as referred to in Section I letter A number 3.

b. Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits

In ensuring the adequacy of Risk Management policies and procedures and the establishment of Risk limits for Liquidity Risk, in addition to implementing Risk Management policies and procedures and the establishment of Risk limits as referred to in Section I letter B, in each aspect the Company needs to add the application of:

Risk Management Strategy

The Company must have a Risk Management strategy for Liquidity Risk that applies Assets and Liabilities Management (ALM).

Level of Risk to be Taken (risk appetite) and Risk Tolerance (risk tolerance)

a) The Level of Risk (risk tolerance) to be taken (risk appetite) of the Company is reflected in the composition of assets and liabilities and the gapping strategy carried out by the Company.

b) Risk Tolerance for Liquidity Risk must consider every factor that affects Liquidity Risk exposure, among others determined by the composition of liquid assets and funding sources owned by the Company to support the Company's current and future strategies.

Policies and Procedures

a) Risk Management policies and procedures for Liquidity Risk, in addition to containing provisions as referred to in Section I letter B number 6 letter c, also among others include:

i. Liquidity management policies and procedures which at least include:

(a) composition of assets and liabilities;

(b) the level of liquid assets that must be maintained by the Company;

(d) diversification and stability of funding sources;

(e) liquidity management on various funding sources including by market and counterparty;

(f) routine liquidity management and intra-group liquidity management or group business liquidity; and

(g) Liquidity Risk limits.

ii. The Company must establish indicators that are early warning indicators for Liquidity Risk as a tool for identifying problems and determining Liquidity Risk mitigation.

iii. The aforementioned early warning indicators include internal indicators and external indicators. Internal indicators among others include deteriorating asset quality, increased concentration on certain assets and funding sources, increased currency mismatch, repeated occurrence of limit breaches, increased overall funding costs, and/or worsening cash flow positions as a result of large maturity mismatches especially on a short-term time scale.

External indicators among others include negative public information about the Company, downgrades in rating agency results, continuous decline in the Company's stock price, decline in credit line facilities provided by correspondent companies, and/or limited access to obtain long-term funding.

iv. The Company must conduct Liquidity Risk stress testing adjusted to the Company's fund management strategy so that it can accurately describe the Company's Liquidity Risk profile.

v. Emergency funding plans, among others explaining the approach and strategy in facing crisis conditions that impact the Company's liquidity position. Policies regarding emergency funding plans must at least include the Company management's action plan in liquidity crisis situations and methods used to obtain funding in such crisis situations. The Board of Directors must periodically review and update the emergency funding plan to ensure the effectiveness of such emergency funding plan.

Establishment of Risk Limits

a) Liquidity Risk limits must be consistent and relevant to the Company's business, the complexity of the Company's business activities, risk tolerance, business activity characteristics, currency, markets in

where the Company actively conducts transactions, historical data, profitability levels, and available capital. b) Policies regarding limits must be applied consistently to manage Liquidity Risk, including to limit funding gaps across various time horizons and/or limit the concentration of funding sources, instruments, or specific market segments.
c. Adequacy of the Risk Identification, Measurement, Control, and Monitoring Processes, as well as the Risk Management Information System for Liquidity Risk
In ensuring the adequacy of the risk identification, measurement, control, and monitoring processes, as well as the risk management information system for Liquidity Risk, in addition to meeting the provisions as stated in Section I Letter C, the Company must add the following applications in each process:

Liquidity Risk Identification
a) In order to identify Liquidity Risk, the Company must conduct an analysis of all sources of Liquidity Risk. Sources of Liquidity Risk include:
i. Financing business activities that can affect the sources and uses of funds, both in asset and liability positions as well as administrative accounts; and
ii. Other risks that can increase Liquidity Risk, such as Credit Risk, Market Risk, and Operational Risk.
b) The analysis is conducted to determine the amount and trend of liquidity needs and the available funding sources to meet those needs. c) The Company must conduct an analysis of exposures to other risks that can increase Liquidity Risk, including Interest Rate Risk, Credit Risk, Operational Risk, and Legal Risk. Generally, Liquidity Risk is often caused by weaknesses or problems arising from other risks, so risk identification must also include the linkages between Liquidity Risk and other risks.
Liquidity Risk Measurement
a) In measuring Liquidity Risk, indicators/parameters such as the following may be used:
i. Composition of short-term assets and liabilities, including administrative account transactions;
ii. Cash flow management;
iii. Vulnerability to funding needs; and
iv. Access to funding sources.
b) The Company must have measurement tools that can quantitatively measure Liquidity Risk accurately and comprehensively in a timely manner. These measurement tools must also be able to measure Liquidity Risk arising from assets, liabilities, and administrative accounts. c) These measurement tools must include at least:
i. Liquidity ratios, which are financial ratios describing liquidity indicators and/or measuring the Company's ability to meet short-term liabilities;
ii. Maturity profile, which is the mapping of asset, liability, and administrative account positions on a specific time scale based on the remaining time to maturity;
iii. Cash flow projections, which are projections of all cash inflows and cash outflows, including funding needs to meet commitments and contingencies in administrative account transactions; and
iv. Stress testing, which is a test of the Company's ability to meet liquidity needs under crisis conditions using specific stress scenarios for the Company or stress in the market.
d) The Liquidity Risk measurement approach used by the Company must be adjusted to the Company's composition of assets, liabilities, and administrative accounts. In the event that the Company has more complex business activities, the Company must use more advanced measurement approaches, such as simulation-based and more dynamic measurements supported by various relevant assumptions. e) The liquidity ratios used in Liquidity Risk measurement must be adjusted to the business strategy, risk tolerance, and past performance. Measurement results using ratios must be analyzed by considering relevant qualitative information. f) The maturity profile presents asset, liability, and administrative account items mapped on a time scale based on the remaining time to maturity according to contract and/or based on assumptions, particularly for balance sheet position accounts and administrative accounts that do not have contractual maturities. Factors considered in determining assumptions to estimate balance sheet position accounts and administrative accounts without contractual maturities include business activity characteristics, counterparty and/or customer behavior, market conditions, and historical experience. g) The preparation of the maturity profile aims to identify the occurrence of liquidity gaps within a specific time scale. The maturity profile must be prepared at least monthly in both Rupiah and foreign currencies. If the Company has liquidity positions in various foreign currencies in significant amounts, the Company may prepare the maturity profile in each of the respective foreign currencies for internal purposes and review it periodically to assess its suitability with the Company's liquidity conditions. Cash flow projections must be prepared at least monthly, with the projection period adjusted to the Company's needs by considering the structure of assets, liabilities, and administrative accounts. h) Measurement using stress testing as stated in item c) is conducted with the following provisions:
i. Stress testing must be able to describe the Company's ability to meet liquidity needs under crisis conditions, based on various scenarios.
ii. The scope and frequency of stress testing must be adjusted to the scale, complexity of business activities, and the Company's Liquidity Risk exposure, with the following provisions:
(a) Stress testing must be conducted periodically using stress scenarios specific to the Company or stress scenarios in the market.
(b) Stress testing must be conducted at least once (1) in one (1) year. The implementation period of stress testing may be conducted within a shorter time frame if the Company considers that the occurring crisis conditions could cause the Company to be exposed to Liquidity Risk that is not tolerable and/or upon request from the Financial Services Authority (OJK). (c) Stress scenarios specific to the Company may include, among others, a downgrade of the Company's rating by rating agencies, large-scale withdrawals of funds, disruptions or failures of systems supporting the Company's operations. (d) Stress scenarios in the market may include, among others, changes in economic indicators and changes in market conditions, both local and global. (e) In conducting stress testing, the Company uses scenarios that are historical and/or hypothetical, as well as other scenarios, considering business activities and the Company's vulnerabilities. (f) Stress testing must consider the implications of scenarios on various different time horizons, including daily. i) The Company must develop stress testing assumptions for specific Company scenarios and market scenarios, including:
i. Assumptions regarding the behavior of transaction counterparties and/or customers under crisis conditions that can affect cash flows; and
ii. Assumptions regarding the behavior of other market participants as a response to crisis conditions in the market.
j) The assumptions used in the Company's Liquidity Risk measurement must be reasonable and adjusted to the characteristics of the Company's asset liquidity, liability liquidity, and administrative account transaction liquidity, and updated according to market conditions and volatility. k) In conducting stress testing for Liquidity Risk, the Company must consider the assessment results conducted on other types of risks, including Market Risk, Credit Risk, and Reputational Risk, and analyze the potential interactions with these various types of risks. l) The Company must follow up on the results of stress testing, including:
i. Adjusting risk management policies and strategies for Liquidity Risk;
ii. Adjusting the composition of liquid assets, liabilities, and/or administrative accounts;
iii. Developing or refining emergency funding plans; and/or
iv. Reviewing the setting of limits.
Results of stress testing and follow-up actions on stress testing must be reported to the Board of Directors and evaluated by the Board of Directors.
Liquidity Risk Control
a) Liquidity Risk control is conducted through funding strategies, periodic management of liquidity positions and Liquidity Risk, intra-group liquidity position and Liquidity Risk management, management of high-quality liquid assets, and emergency funding plans. b) Funding Strategy
i. Funding strategies include strategies for diversifying funding sources and tenors linked to the Company's business characteristics and plans.
ii. The Company must identify and monitor key factors affecting its ability to obtain funds, including identifying and monitoring alternative funding sources and market access that can strengthen its capacity to survive under crisis conditions.
c) Intra-Group Liquidity Position and Liquidity Risk Management In managing intra-group liquidity positions and Liquidity Risk, the Company must consider and analyze:
i. Funding needs of companies within the Company's business group that can affect the Company's liquidity conditions; and
ii. Constraints or obstacles to accessing intra-group liquidity,
and ensure that their impact has been considered in Liquidity Risk measurement. d) Management of High-Quality Liquid Assets
i. The Company must have high-quality liquid assets in sufficient amounts and composition adjusted to business characteristics and the Liquidity Risk profile in order to meet intra-day, short-term, and long-term liquidity needs.
ii. The Company must evaluate and monitor all positions and compositions of high-quality liquid assets, including assets that have been pledged and/or available as collateral.
e) Emergency Funding Plan
i. The Company must have an emergency funding plan to handle liquidity problems under various crisis conditions, adjusted to the risk profile level, stress testing results, complexity of business activities, business scope and organizational structure, and the Company's role in the financial system.
ii. The emergency funding plan includes policies, strategies, procedures, and action plans to ensure the Company's ability to obtain the necessary funding sources in a timely manner and at reasonable costs, at least covering:
(a) Setting indicators and/or events used to identify the occurrence of crisis conditions; (b) Mechanisms for periodic internal monitoring and reporting by the Company regarding the indicators as stated in letter (a); (c) Strategies for facing various crisis conditions and decision-making procedures to take action on changes in behavior and cash flow patterns that cause cash flow deficits; (d) Strategies to obtain funding support under crisis conditions, considering costs and their impact on capital and various other important aspects; (e) Managerial coordination at least covering:
(1) Setting of authorized parties responsible for identifying, implementing the emergency funding plan, and forming special teams during crisis conditions; and (2) Setting of strategies and good communication procedures to internal parties; (f) Internal reporting procedures for management decision-making; and (g) Procedures for setting priorities in relationships with debtors to address liquidity problems under crisis conditions.
iii. The emergency funding plan must be documented, evaluated, updated, and tested periodically to ensure reliability levels.
Liquidity Risk Monitoring
a) The Liquidity Risk monitoring conducted by the Company must pay attention to early warning indicators to know potential increases in the Company's Liquidity Risk. b) Early warning indicators consist of internal indicators and external indicators.
i. Internal Indicators include, among others, the Company's funding and asset growth strategies, increased concentration on both the asset and liability sides of the Company, increased foreign currency mismatch, positions approaching or repeatedly violating internal limits or regulatory limits, and increased funding costs for the Company.
ii. External Indicators can come from third parties, market analysts, or market participants. Generally, these indicators relate to the financing capacity of the respective Company. Examples of indicators from third parties include, among others, market rumors regarding problems with the Company, credit rating downgrades by rating agencies, declines in the Company's stock price, declines in transaction volume, or declines in financing lines.
Risk Management Information System for Liquidity Risk
a) The Company must have adequate and reliable risk management information systems to support the implementation of risk identification, measurement, control, and monitoring processes, as well as Liquidity Risk reporting under normal and crisis conditions in a complete, accurate, timely, comprehensive, and continuous manner. b) The risk management information system must be able to provide information at least regarding:
i. Cash flows and maturity profiles of assets, liabilities, and administrative accounts;
ii. Compliance with risk management policies, strategies, and procedures for Liquidity Risk, including limits and liquidity ratios;
iii. Risk profile reports and liquidity trends for management purposes in a timely manner;
iv. Information that can be used for stress testing purposes; and
v. Other information related to Liquidity Risk, such as positions and valuations of high-quality liquid asset portfolios, concentration of funding sources, assets and liabilities, and receivables and liabilities in administrative accounts, which are unstable.

d. Comprehensive Internal Control System
In implementing the internal control system for Liquidity Risk, in addition to applying internal controls as stated in Section I Letter D, the Company must also apply:

An adequate independent review system regarding the implementation of Risk Management for Liquidity Risk carried out by functions acting as risk monitoring, internal control, or internal audit functions.
Independent reviews conducted by functions acting as risk monitoring include, among others:
a) Compliance with risk management policies and procedures for Liquidity Risk, including in the management of liquidity positions and Liquidity Risk, composition of assets and liabilities, high-quality liquid assets, and compliance with limits; b) Adequacy of methods, assumptions, and indicators for Liquidity Risk measurement, including stress testing; and c) Performance of Liquidity Risk measurement models, among others based on comparisons between Liquidity Risk measurement results and actual values.
Weaknesses identified in internal controls and independent reviews must be reported to relevant parties for follow-up action.

F. Legal Risk

Definition
a. Legal Risk is the Risk arising from legal claims and/or weaknesses in legal aspects. b. Legal Risk can originate, among others, from weaknesses in legal aspects caused by weak contractual agreements made by the Company, the absence and/or changes in legislation causing a transaction already conducted by the Company to be non-compliant with regulations, and litigation processes arising from third-party lawsuits against the Company or the Company's lawsuits against third parties.
Objective
The main objective of Risk Management for Legal Risk is to minimize the possibility of negative impacts from weaknesses in legal aspects, the absence and/or changes in legislation, and litigation processes.
Implementation of Risk Management
The implementation of Risk Management for Legal Risk is adjusted to the size and complexity of the Company's business. Generally, the principles of implementing Risk Management for Legal Risk include at least:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Legal Risk, in addition to implementing active supervision as stated in Section I Letter A, the Company must add the following applications to each aspect:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Legal Risk is conducted effectively and integrated with the implementation of Risk Management for other risks that can impact the Company's overall risk profile. b) The Board of Directors must establish effective communication mechanisms, including involving Company employees, regarding legal problems faced with the legal department or relevant functions so that Legal Risk can be prevented and controlled promptly. c) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must apply legal governance, which is a governance system to form, execute, and interpret regulations and internal provisions, including standard contracts used. d) The Board of Directors must ensure legal consistency in all business activities, meaning there is alignment between business activities conducted and regulations, and does not create ambiguity in agreements made by the Company. e) The Board of Directors must ensure legal completeness, so that all matters regulated by regulations, both national and international, can be well implemented by the Company, including prohibitions in regulations, which are clearly regulated in the Company's internal provisions.
Human Resources (HR)
The Company must consistently apply sanctions to Company employees proven to have committed deviations and violations of external and internal regulations, as well as the Company's internal code of ethics.
Risk Management Organization for Legal Risk
a) The Company must have a function acting as a legal watch or a function under the legal field that provides analysis or legal advice to all employees at every organizational level. This must also be supported by HR with knowledge in legal fields related to the Company. b) The Risk Management function must conduct analysis of legal risk exposures when the Company develops or expands business activities. c) The Risk Management function, business and operational functions (risk-taking units), and the function under the legal field must jointly assess the impact of changes in certain regulations on Legal Risk exposure.

b. Adequacy of Risk Management Policies and Procedures and Setting of Risk Limits In ensuring the adequacy of risk management policies and procedures and the setting of risk limits for Legal Risk, in addition to ensuring the adequacy of risk management policies and procedures and the setting of risk limits as referred to in Section I Letter B, the Company must add the following applications in each aspect:

Risk Management Strategy
The Risk Management Strategy for Legal Risk is an inseparable part of the Company's Risk Management Strategy as referred to in Section I Letter B number 6 letter a.
Risk Appetite and Risk Tolerance
The setting of risk appetite and risk tolerance for Legal Risk refers to the provisions as referred to in Section I Letter B number 6 letter b.
Policies and Procedures
a) The Company must have and implement procedures for analyzing legal aspects of new business activities. b) The Company must periodically evaluate and update policies and procedures for controlling Legal Risk, in accordance with external and internal Company developments, such as changes in regulations.
Setting of Risk Limits
The setting of limits for Legal Risk refers to the general scope of implementation as referred to in Section I Letter B number 6 letter d.

c. Adequacy of the Risk Identification, Measurement, Control, and Monitoring Processes, as well as the Risk Management Information System for Legal Risk
In ensuring the adequacy of the risk identification, measurement, control, and monitoring processes, as well as the risk management information system for Legal Risk, in addition to meeting the provisions as stated in Section I Letter C, the Company must add the following applications in each process:

Legal Risk Identification
The implementation of identification for Legal Risk refers to the provisions as referred to in Section I Letter C number 4 letter a.
Legal Risk Measurement
a) The Company must have adequate measurement methods for Legal Risk that are integrated with the Company's Risk Management framework, using either quantitative or qualitative approaches. b) In measuring Legal Risk, the Company may use indicators or parameters such as potential losses due to litigation claims, cancellation of agreements caused by weak contractual aspects, and/or the occurrence of changes in legislation causing the Company's business activities to be misaligned with existing regulations.
Legal Risk Control
The function under the legal field must periodically review contracts and agreements between the Company and other parties, among others by re-evaluating the effectiveness of the enforceability process to check the validity of rights in the contracts and agreements.
Legal Risk Monitoring
The implementation of monitoring for Legal Risk refers to the provisions as referred to in Section I Letter C number 4 letter d.
Risk Management Information System for Legal Risk
The Company must document and account for every incident, including litigation processes related to Legal Risk, along with the amount of potential losses caused by the incident, in a data administration system. The recording and accounting of this data are compiled into a statistical data set that can be used for

projecting potential losses of business activities for the Company over a certain period. d. Comprehensive Internal Control System The implementation of an internal control system for Legal Risk refers to the general provisions as stated in Appendix I letter D.

G. Compliance Risk

Definition
a. Compliance Risk is the Risk arising from the Company's failure to comply with and/or implement laws and regulations and provisions. b. Compliance Risk can originate from, among others:

legal behavior, namely the Company's behavior or activities that deviate from or violate provisions and/or laws and regulations; and
organizational behavior, namely the Company's behavior or activities that deviate from or contradict generally applicable standards.

Objective
The main objective of Risk Management for Compliance Risk is to ensure that the Risk Management process can minimize the possibility of negative impacts from the Company's behavior that deviates from or violates generally applicable standards, provisions, and/or laws and regulations.
Implementation of Risk Management
The implementation of Risk Management for Compliance Risk is adjusted to the size and complexity of the Company's business. Generally, in the principle of implementing Risk Management for Compliance Risk, it must at least include:
a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In carrying out active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Compliance Risk, in addition to carrying out active supervision as referred to in Appendix I letter A, for each aspect of active supervision, the Company must add the implementation of:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that Risk Management for Compliance Risk is carried out effectively and integrated with the implementation of other Risk Management that can impact the Company's overall Compliance Risk profile. b) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that any compliance issues that arise can be resolved effectively by the relevant function and that monitoring is conducted over corrective actions by the compliance function. c) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that all policies, provisions, systems, and procedures, as well as business activities conducted by the Company, are in accordance with laws and regulations.
Human Resources (HR)
Employees placed in the compliance function are not placed in positions vulnerable to conflicts of interest in carrying out the responsibilities of the compliance function.
Risk Management Organization for Compliance Risk
The Company must have a compliance function as regulated in the Financial Services Authority Regulation regarding Corporate Governance. This function must support the implementation of Risk Management for Compliance Risk.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In ensuring the adequacy of Risk Management policies and procedures and the setting of Risk limits for Compliance Risk, in addition to ensuring the adequacy of Risk Management policies and procedures and the setting of Risk limits as stated in Appendix I letter B, in each aspect, the Company needs to add the implementation of:

Risk Management Strategy
The formulation of strategy for Compliance Risk refers to the provisions as referred to in Appendix I letter B number 6 letter a.
Risk Appetite and Risk Tolerance
On principle, the Company must comply with provisions and laws and regulations. This causes the Company should have no tolerance at all for Compliance Risk and take steps quickly and accurately in handling the Risk.
Policies and Procedures
a) The Company must have an adequate compliance work plan. b) The Company must ensure the effectiveness of the implementation of Risk Management for Compliance Risk, especially that the formulation of policies and procedures is in accordance with generally applicable standards, provisions, and/or laws and regulations.
Risk Limit Setting
The setting of limits for Compliance Risk refers to the provisions as referred to in Appendix I letter B number 6 letter d.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information System for Compliance Risk
In ensuring the adequacy of the risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system for Compliance Risk, in addition to meeting the provisions as referred to in Appendix I letter C, for each process, the Company must add the implementation of:

Compliance Risk Identification
The Company must conduct identification and analysis of several factors that can increase Compliance Risk exposure, including:
a) the type and complexity of the Company's business activities, including the development or expansion of business activities; and b) the number and materiality of the Company's non-compliance with internal policies and procedures, provisions and/or laws and regulations, as well as healthy business ethics practices and standards.
Compliance Risk Measurement
In measuring Compliance Risk, the Company can use indicators or parameters including:
a) the type and significance of violations committed; b) the frequency of violations (including sanctions) or the Company's compliance track record; and c) violations of laws and regulations or generally applicable business standards; and d) follow-up on violations.
Compliance Risk Control
The implementation of control for Compliance Risk refers to the provisions as referred to in Appendix I letter C number 4 letter c.
Compliance Risk Monitoring
The Risk Management function or compliance function must monitor and report Compliance Risks that occur to the Company's Board of Directors both at any time when the Compliance Risk occurs and periodically.
Risk Management Information System for Compliance Risk
The implementation of the management information system for Compliance Risk refers to the provisions as referred to in Appendix I letter C number 4 letter e.

d. Comprehensive Internal Control System
In implementing Risk Management for Compliance Risk, in addition to meeting the provisions as referred to in Appendix I letter D, the Company must have an internal control system for Compliance Risk, including to ensure the Company's responsiveness level to deviations from generally applicable standards, provisions, or laws and regulations.

H. Reputational Risk

Definition
a. Reputational Risk is the Risk arising from a decrease in the level of trust of stakeholders stemming from negative perceptions of the Company. b. Reputational risk arises, among others, due to media coverage and/or rumors regarding the Company that are negative, as well as the Company's communication strategy being less effective.
Objective
The main objective of Risk Management for Reputational Risk is to anticipate and minimize loss impacts from the decrease in the level of trust of stakeholders (stakeholders) stemming from negative perceptions of the Company for the accuracy of the Company's Reputational Risk.
Implementation of Risk Management
The implementation of Risk Management for Reputational Risk is adjusted to the size and complexity of the Company's business. The implementation of Risk Management for Reputational Risk must at least include:
a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In carrying out active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Reputational Risk, in addition to carrying out active supervision as referred to in Appendix I letter A, for each aspect of active supervision, the Company must add the implementation of:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Reputational Risk is carried out effectively and integrated with the implementation of other Risk Management that can impact the Company's overall Risk profile. b) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must pay attention to the implementation of Risk Management for Reputational Risk by relevant functions in the Company, especially functions related to interaction with external parties. c) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must behave professionally and maintain business ethics so as to become an example for all elements of the Company's organization in efforts to build and maintain reputation. d) The Board of Directors must establish the flow of information delivery to debtors and other external parties related to the Company's business activities in order to control Reputational Risk.
Human Resources (HR)
The Company needs to provide HR for centralized service in handling questions, suggestions, or complaints from debtors, for example, in the form of a call center service.
Reputational Risk Management Organization
a) All employees, including management of business and operational functions (risk-taking function) and the Company's support functions, must be part of the implementation structure of Risk Management for Reputational Risk, given that reputation is the result of all the Company's business activities. b) The role of business function management is to identify Reputational Risks that occur in the business or activities of that unit and as a front liner in building and preventing Reputational Risk, especially regarding relationships with debtors. c) The Risk Management function for Reputational Risk, including corporate secretary, public relations, investor relations, is responsible for, among others:
i. carrying out public relations functions and following up on negative news or other events that affect the Company's reputation and can cause losses to the Company; and
ii. communicating information needed by stakeholders, including investors, debtors, creditors, associations, and the public.
b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In ensuring the adequacy of Risk Management policies and procedures and the setting of Risk limits for Reputational Risk, in addition to ensuring the adequacy of Risk Management policies and procedures and the setting of Risk limits as referred to in Appendix I letter B, in each aspect, the Company must add the implementation of:
Risk Management Strategy
The Risk Management Strategy for Reputational Risk is an inseparable part of the Company's Risk Management Strategy as referred to in Appendix I letter B number 6 letter a.
Risk Appetite and Risk Tolerance
The setting of Risk Appetite and Risk Tolerance for Reputational Risk refers to the provisions as in Appendix I letter B number 6 letter b.
Policies and Procedures
a) The Company must have written policies and procedures that meet the principle of transparency in the implementation of good corporate governance. These policies must also align with provisions or laws and regulations governing consumer protection. b) The Company must have and implement appropriate communication policies in order to face news or publications that are negative or prevent information that tends to be counterproductive, including by applying effective media usage strategies to face negative news.
Risk Limit Setting
Reputational Risk limits are generally not limits that can be quantified financially. For example: the time limit for following up on debtor complaints and the time limit for waiting in line to receive service.
c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information System for Reputational Risk
In ensuring the adequacy of the risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system for Reputational Risk, in addition to meeting the provisions as referred to in Appendix I letter C, for each process, the Company must add the implementation of:
Reputational Risk Identification
a) The Company must record and account for every event related to Reputational Risk, including the amount of potential losses, in a data administration system. b) The Company can use several information sources to identify the impact of Reputational Risk, including mass media news, the Company's website, and social network analysis results, debtor complaints through call center services, or debtor satisfaction questionnaires.
Reputational Risk Measurement
a) Recording and accounting for every event related to Reputational Risk, including the amount of potential losses, in a data administration system is compiled into a statistical data that can be used to project potential losses in a certain period and specific Company activities. b) In measuring Reputational Risk, indicators/parameters can include the influence of management, owners, and group reputation, business ethics violations, product complexity and business cooperation, frequency, materiality, and exposure of negative news, and frequency and materiality of debtor or consumer complaints.
Reputational Risk Control
a) The Company must immediately follow up on and resolve customer complaints and legal lawsuits that can increase Reputational Risk exposure. b) The Company must develop reliable mechanisms to carry out effective Reputational Risk control actions. Generally, Reputational Risk control can be done through 2 (two) things:
i. Prevention of events causing Reputational Risk, which is generally done through a series of activities as follows:
(a) Corporate social responsibility, is a series of activities carried out by the Company for community empowerment in the form of economic or social activities that are expected to build a positive reputation of stakeholders towards the Company. (b) Routine communication or education to stakeholders in order to form a positive reputation of stakeholders.
ii. Recovery of the Company's reputation after an event causing Reputational Risk occurs, namely all follow-up actions by the Company to restore reputation and prevent the worsening of the Company's reputation.
c) Reputational Risk mitigation or events causing Reputational Risk are carried out by considering the materiality of the problem and costs. Reputational Risk can be accepted as long as it is still in accordance with the Risk Appetite.
Reputational Risk Monitoring
The implementation of monitoring for Reputational Risk refers to the general provisions as in Appendix I letter C number 4 letter d.
Risk Management Information System for Reputational Risk
a) The Company must have regular procedures and a reporting mechanism for Reputational Risk or events causing Reputational Risk, both in written form and in electronic system form, including discussion in board or management meetings. b) The Company must have an early warning system mechanism to provide signals to management so that follow-up and mitigation can be carried out as needed.

This copy is in accordance with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja

d. Comprehensive Internal Control System
The implementation of an internal control system for Reputational Risk refers to the general provisions as referred to in Appendix I letter D.

III. RISK PROFILE ASSESSMENT
The Company conducts an assessment of the Risk profile in all of the Company's business activities, which consists of an assessment of:

Inherent Risk (inherent risk) in the Company's business activities; and
the quality of Risk Management implementation, which reflects the assessment of the adequacy of the Risk control system.
This assessment mechanism refers to the Financial Services Authority Regulation regarding the Assessment of the Health Level of Non-Bank Financial Service Institutions.

Determined in Jakarta on 5 February 2021
CHIEF EXECUTIVE OF THE INSURANCE, PENSION FUND, LENDING INSTITUTION, AND OTHER FINANCIAL SERVICE INSTITUTIONS SUPERVISOR FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, signed RISWINANDI

APPENDIX II
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 7 /SEOJK.05/2021 REGARDING IMPLEMENTATION OF RISK MANAGEMENT FOR FINANCING COMPANIES AND SHARIA FINANCING COMPANIES

ORGANIZATIONAL STRUCTURE OF RISK MANAGEMENT
FOR FINANCING COMPANIES AND
SHARIA FINANCING COMPANIES

I. General Guidelines
A. The Risk Management organizational structure is adjusted to the size and complexity of the Company's business.
B. The Risk Management organizational structure also considers the relevant and inherent Risks in each of the Company's business activities.
C. The Risk Management organizational structure must still follow good corporate governance practices as regulated in the Financial Services Authority Regulation regarding Corporate Governance.

II. Risk Management Committee Organizational Structure
A. Risk Management Committee Membership

The Risk Management Committee is non-structural, where its members are part of the structure existing within the Company.
Risk Management Committee (risk management committee) members can be permanent and non-permanent. Permanent members are the Board of Directors and executive officials appointed to exercise authority and responsibility permanently for a certain period, such as Directors overseeing the compliance function or Risk Management function, or executive officials overseeing the Risk Management function, while non-permanent members are Directors and executive officials related to the topics discussed and recommended in the Risk Management Committee, such as the treasury division head for topics on interest rate and exchange rate exposure management.
The Risk Management Committee must consist of at least:
a. half of the Board of Directors members, namely 50% (fifty percent) of the total number of Board of Directors members. For example, if the number of Directors is 4 (four), then half is 2 (two) Board of Directors members, whereas if the number of Directors is 3 (three), then half is 2 (two) Board of Directors members; and b. relevant executive officials, namely executive officials from the Company related to the Risks present in the Company's business activities.

B. Authority and Responsibility of the Risk Management Committee The authority and responsibility of the Risk Management Committee is to provide recommendations to the President Director regarding Risk Management, which must at least include:

formulating policies, strategies, and guidelines for the implementation of Risk Management, including the Risk level taken (risk appetite) and Risk tolerance (risk tolerance), Risk Management framework, and contingency plans to anticipate abnormal conditions;
making improvements or adjustments to the implementation of Risk Management based on the results of Risk Management implementation evaluation, including refining the Risk Management process periodically or incidentally as a result of changes in external and internal Company conditions that affect funding adequacy, the Company's Risk profile, and the ineffectiveness of Risk Management implementation based on evaluation results; and
determining matters related to business decisions that deviate from normal procedures, such as the disbursement of financing conducted, taking Risk positions, or taking Risk exposures that exceed the established limits.

III. Risk Management Function Organizational Structure
A. Organizational Structure

The organizational structure of the Risk Management function is adjusted to the size and complexity of the Company's business.
The Risk Management function as referred to in number 1 can be carried out by officials/employees specifically assigned to carry out the Risk Management function or by a work unit that specifically carries out the Risk Management function.

B. Independence of the Risk Management Function

The Risk Management function must be independent from the business and operational functions and from the internal control function to create 3 (three) lines of defense within the Company to manage Risk (3 lines of defense).
The implementation of Risk Management with the principle of 3 (three) lines of defense within the Company in order to manage Risk (3 lines of defense), namely:
a. First line (1st lines of defense), namely the business and operational function (risk-taking function); b. Second line (2nd lines of defense), namely the Risk Management function (risk management function); and
c. Third line (3rd lines of defense), namely the internal control function implemented by the internal audit function (internal audit function).
The authority and responsibility of each function as referred to in number 2 are described as follows:
a. Business and Operational Function (Risk-Taking Function) The business and operational function (risk-taking function) is the Company's frontline in the implementation of Risk Management, which has authority and responsibility including, among others:

reporting inherent Risk exposure (inherent risk) present in each business and operational unit to the Risk Management function periodically;
ensuring a conducive Risk control environment in each business and operational unit;
applying the established Risk Management policies in carrying out business and operational activities; and
implement recommendations from the Risk Management function in order to control Risks in each business and operational unit.

b. Risk Management Function
The Risk Management function has the following authority and responsibilities:

identify Risks, including inherent Risks in the Company's business activities;
develop Risk measurement methods appropriate to the size and complexity of the Company's business, including designing and implementing the necessary tools for the implementation of Risk Management;
monitor the implementation of the Risk Management strategy formulated by the Board of Directors, including monitoring the Risk Management strategy in business and operational functions;
monitor the overall (composite) Risk position, by type of Risk, and by type of functional activity against the established Risk tolerance and limits, and conduct:
(1) testing using abnormal condition scenarios/assumptions (stress testing), to determine the impact of the implementation of Risk Management policies and strategies on the Company's overall performance; and (2) testing using historical data (back testing), to determine how accurate the Risk measurement method is based on the historical data owned by the Company against the established Risk Management policies and strategies;
periodically review the Risk Management process, including:
(1) developing the necessary tools for the implementation of Risk Management, starting from the risk identification, measurement, monitoring, and control processes; (2) ensuring the adequacy of the Risk Management framework; (3) ensuring the accuracy of Risk assessment methods; and (4) ensuring the adequacy of the Risk Management information system.
review proposals for the development or expansion of the Company's business activities, focusing on the Company's ability to develop or expand business activities and their impact on the Company's overall Risk exposure;
evaluate the accuracy of models and validity of data used to measure Risks, for Companies using models for internal purposes (internal models) in Risk measurement;
provide recommendations to:
(1) business and operational functions (risk-taking function), inter alia in determining the Risk exposure limits acceptable to the Company; and/or (2) the Risk Management Committee, inter alia in the formulation of Risk Management policies, strategies, and frameworks, according to the authority held; and
prepare and submit Risk profile reports to the President Director or the Director overseeing the Risk Management function and the Risk Management Committee on a periodic basis, where the frequency of reports can be increased in the event of rapidly changing market conditions.

c. Internal Audit Function
The internal audit function in the implementation of Risk Management has authority and responsibilities including:

evaluate the compliance of all levels of the Company's organization with the established Risk Management policies and procedures;
evaluate the effectiveness of the implementation of Risk Management in accordance with Risk Management strategies and policies; and
evaluate the effectiveness of the Risk culture within the Company as a whole.

IV. Relationship between Business and Operational Functions and the Risk Management Function

A. Information Submission

Business and operational functions (risk-taking function), as the first line of defense within the Company in managing Risks, must periodically inform the Risk Management function of inherent Risks.
The frequency of submitting information on inherent Risk exposure is adjusted to the characteristics of the type of Risk. If inherent Risks faced by business and operational functions (risk-taking function) are handled on a daily basis, submission of information to the Risk Management function can be done more intensively.

B. Examples of Relationships between Functions in the Risk Management Organizational Structure

Format 1
The Risk Management function within the Company is part of another single function, but the Risk Management function reports directly to the President Director or the Director overseeing the compliance function or the Risk Management function.
Format 2
The Risk Management function within the Company is a separate single function and reports directly to the President Director or the Director overseeing the compliance function or the Risk Management function.
Format 3
The Risk Management function within the Company is combined with the Risk Management unit found in the Parent Company or a regional office abroad.* The President Director must ensure that the implementation of Risk Management in the combined Company complies with regulations regarding the implementation of Risk Management for the Company.

This copy is consistent with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja
*) Risk management group in the parent company or regional office abroad.

Other Formats
Companies may develop organizational structures according to the size and complexity of the Company's business. The more complex and/or the larger the size of a Company, the more complete the organization, particularly in the Risk Management organizational structure, such as the formation of special work units handling the Risk Management function.

Established in Jakarta on 5 February 2021
EXECUTIVE HEAD OF SUPERVISOR
OF INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICES INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

Implementation of Risk Management for Financing Companies and Sharia Financing Companies

Lineage: Superseded

Timeline

Similar documents from other regulators