Fraud Control, Implementation of Anti-Fraud Strategy, and Anti-Fraud Strategy Reporting for Insurance Companies, Sharia Insurance Companies, Reinsurance Companies, Sharia Reinsurance Companies, or Sharia Units

To:

1. Board of Directors of Insurance Companies;
2. Board of Directors of Sharia Insurance Companies;
3. Board of Directors of Reinsurance Companies; and
4. Board of Directors of Sharia Reinsurance Companies,
   At their respective locations.

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 46 /SEOJK.05/2017

CONCERNING

FRAUD CONTROL, IMPLEMENTATION OF ANTI-FRAUD STRATEGY, AND ANTI-FRAUD STRATEGY REPORTING FOR INSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, REINSURANCE COMPANIES, SHARIA REINSURANCE COMPANIES, OR SHARIA UNITS

In accordance with the mandate of Article 72 paragraph (5) of the Financial Services Authority Regulation Number 69/POJK.5/2016 concerning the Conduct of Business by Insurance Companies, Sharia Insurance Companies, Reinsurance Companies, and Sharia Reinsurance Companies (State Gazette of the Republic of Indonesia Year 2016 Number 302, Supplement to the State Gazette of the Republic of Indonesia Number 5992), it is necessary to regulate implementation provisions regarding fraud control, implementation of anti-fraud strategy, and anti-fraud strategy reporting for insurance companies, Sharia insurance companies, reinsurance companies, Sharia reinsurance companies, or Sharia units in this Financial Services Authority Circular as follows:

I. GENERAL PROVISIONS

In this Financial Services Authority Circular, the following terms are defined:

1. Company means insurance companies, Sharia insurance companies, reinsurance companies, and Sharia reinsurance companies.

2. Sharia Unit means a working unit at the head office of an insurance company or reinsurance company that functions as the head office of offices outside the head office that conduct business based on Sharia principles.

3. Fraud means intentional deviation or tolerance actions carried out to deceive, trick, or manipulate the Company or Sharia Unit, policyholders, insured parties, participants, or other parties, so that the Company, Sharia Unit, policyholders, insured parties, participants, or other parties suffer losses and/or the perpetrator of Fraud obtains financial benefits, whether directly or indirectly.

4. Anti-Fraud Strategy is the strategy of the Company or Sharia Unit in controlling Fraud, which is designed by referring to the process of Fraud occurrence, taking into account comprehensive potential Fraud characteristics, and implemented in the form of a Fraud control system.

II. FRAUD CONTROL

1. In order to control the risk of Fraud occurring, the Company or Sharia Unit is required to carry out the Fraud control function and implement the Anti-Fraud Strategy.

2. The Fraud control function as referred to in number 1 includes the following aspects:

a. active management supervision, at least including:

1. comprehensive Fraud control carried out by the Board of Directors or equivalent in the execution of duties, authority, and responsibility;
2. the duties, authority, and responsibility of the Board of Directors or equivalent as referred to in number 1) in conducting general Fraud control generally cover:
   a) the development of culture and concern for anti-Fraud at all levels of the organization, for example by declaring anti-Fraud regulations; b) the preparation and supervision of the implementation of the code of ethics in preventing Fraud for all levels of the Company's or Sharia Unit's organization; c) the preparation and supervision of the implementation of the Anti-Fraud Strategy; d) the development of human resource quality, specifically related to increasing awareness and Fraud control; e) monitoring and evaluation of Fraud incidents and the determination of follow-up actions; and f) the development of effective communication channels within the Company or Sharia Unit so that all levels of the Company's or Sharia Unit's organization understand and comply with applicable policies and procedures, including policies regarding Fraud control; and
3. the Board of Commissioners or equivalent is responsible for periodically monitoring Fraud control.

b. organization and accountability, at least including:

1. The Company or Sharia Unit forms a unit or function responsible for handling Fraud control within the Company's or Sharia Unit's organization.
2. The formation of the unit or function as referred to in number 1) must at least meet the following criteria:
   a) organizational structure adjusted to the characteristics and complexity of the Company's or Sharia Unit's business activities; b) determination of clear job descriptions and responsibilities; c) accountability of the unit or function directly to the Board of Directors or equivalent, and communication and reporting relationships directly to the Board of Commissioners or equivalent; and d) the execution of duties in the unit or function is carried out by human resources possessing competence, integrity, and independence, and supported by clear accountability.

c. control and monitoring, at least including:

1. in order to increase the effectiveness of the internal control system, the Company or Sharia Unit conducts Fraud control and monitoring.
2. steps in Fraud control and monitoring as referred to in number 1) must at least be as follows:
   a) determination of control policies and procedures specifically aimed at implementing the anti-Fraud strategy; b) control through review, both by management (top-level review) and operational review (functional review) by internal audit regarding the implementation of the Anti-Fraud Strategy; c) control in the field of human resources aimed at increasing the effectiveness of task execution and Fraud control, for example, rotation policies, transfer policies, mandatory leave policies, and social activities or gatherings; d) determination of separation of functions in the execution of the Company's or Sharia Unit's activities at all levels of the organization, for example, separation of functions between the acceptance, claims, and finance sections, with the aim that each party involved in these activities does not have the opportunity to commit and conceal Fraud; e) information system control supporting processing, storage, and electronic data security to prevent potential Fraud. This information system control must be accompanied by the availability of an accounting system to ensure accurate and consistent use of data in recording and reporting the Company's or Sharia Unit's finances, at least by performing reconciliation or data verification periodically; and f) other controls regarding Fraud control, such as physical asset and documentation control.

d. education and training, at least including:

1. The Company or Sharia Unit must conduct education and training for employees involved in implementing the Anti-Fraud Strategy.
   a) education and training as referred to in number 1) must at least include:
   education and training regarding the anti-Fraud policies owned by the Company or Sharia Unit, for example, education and training for employees regarding the implementation procedures of anti-Fraud policies, Fraud detection methodology, and reporting procedures for Fraud findings; and b) the schedule and timing of implementation at least 1 (one) time within 1 (one) year.
2. education and training as referred to in number 1) is adjusted to the needs of the Company or Sharia Unit and the complexity of the Company's or Sharia Unit's business organization.

III. IMPLEMENTATION OF ANTI-FRAUD STRATEGY

1. In order to implement the control and monitoring aspects of Fraud as referred to in Roman II number 2 letter c, the Company or Sharia Unit is required to implement an anti-Fraud strategy including:
   a. prevention; b. detection;
   c. investigation, reporting, and sanctions; and
   d. monitoring, evaluation, and follow-up.

2. Preventive steps to reduce the possibility of Fraud occurring must at least cover:
   a. anti-Fraud awareness, at least including:

   1. preparation and socialization of the anti-Fraud statement. For example, zero tolerance policy regarding Fraud;
   2. employee awareness program. For example, organizing seminars or discussions related to anti-Fraud, training, publications regarding understanding of Fraud forms, transparency of investigation results, and continuous follow-up on Fraud; and
   3. customer awareness program. For example, creating anti-Fraud brochures, written explanations or through other means to increase the concern and vigilance of policyholders, insured parties, or participants regarding the possibility of Fraud occurring.
      b. vulnerability identification, at least including:
   4. conducting a process of identifying, analyzing, and assessing every activity of the Company or Sharia Unit that has the potential to harm the Company or Sharia Unit;
   5. documenting and informing the results of identification to interested parties within the Company or Sharia Unit; and
   6. updating information, especially regarding activities assessed as having a high risk of Fraud occurring.
      c. know your employee, at least including:
   7. effective recruitment systems and procedures. Through this system, it is expected to obtain a complete and accurate picture of the track record of prospective employees (pre-employee screening);
   8. a selection system equipped with appropriate qualifications considering risks, and established objectively and transparently. The system must cover the execution of promotions and transfers, including placement in positions with high risk regarding Fraud; and
   9. policies for recognizing employees, including the recognition and monitoring of employee character, behavior, and lifestyle.

3. Detection is an activity to identify and find Fraud incidents, at least including:
   a. whistleblowing policies and mechanisms formulated clearly, easily understood, and effectively implementable, at least including:

   1. protection for whistleblowers and ensuring the confidentiality of the reporter's identity and the Fraud report submitted;
   2. preparing internal regulations regarding Fraud complaints referring to applicable laws and regulations; and
   3. preparing a Fraud reporting system containing at least:
      a) reporting procedures; b) facilities; c) parties responsible for handling reports; and d) follow-up mechanisms for reported Fraud incidents; b. policies and mechanisms for audits conducted at least in high-risk or vulnerable business units regarding Fraud occurrence; and
      c. policies and mechanisms for surveillance systems conducted by independent parties and/or internal parties of the Company or Sharia Unit. The surveillance system is an activity to monitor and test the effectiveness of anti-Fraud policies conducted without the knowledge or awareness of the tested or examined party.

4. In carrying out investigation, reporting, and sanctions activities, the Company or Sharia Unit must have at least the following:
   a. Company or Sharia Unit investigation standards include:

   1. determination of parties authorized to conduct investigations considering the required independence and competence; and
   2. mechanisms for conducting investigations to follow up on detection results while maintaining the confidentiality of obtained information;
      b. mechanisms for reporting Fraud incidents to internal Company or Sharia Unit parties and to the Financial Services Authority; and
      c. sanction policies to provide a deterrent effect for perpetrators of Fraud in the Company or Sharia Unit must be applied transparently and consistently, at least including:
   3. mechanisms for imposing sanctions; and
   4. parties authorized to impose sanctions.

5. Monitoring, evaluation, and follow-up activities for Fraud incidents consist of:
   a. conducting monitoring of follow-up actions for Fraud incidents, considering internal Company or Sharia Unit regulations and applicable laws and regulations. b. maintaining Fraud incident data (Fraud profiling) to support implementation of evaluations, at least including data and information regarding Fraud types, dates of Fraud occurrence, divisions/sections where Fraud occurred, parties involved, positions, losses in Rupiah, actions taken by the Company or Sharia Unit, weaknesses/causes of Fraud occurrence, follow-up/improvements, and chronology of Fraud incidents.
   c. follow-up mechanisms to prevent Fraud incidents from recurring, at least including steps to:

   1. improve weaknesses; and
   2. strengthen the Company's or Sharia Unit's internal control system.

6. The implementation of the Anti-Fraud Strategy is documented in 1 (one) guideline, which serves as a reference for the Company or Sharia Unit to implement the Anti-Fraud Strategy.

7. The implementation of the Anti-Fraud Strategy is carried out against parties involved in insurance business activities, at least including:
   a. policyholders, insured parties, or participants deviation actions carried out by policyholders, insured parties, or participants, either in the policy application process or the claim submission process; b. supporting insurance business companies such as insurance brokerage companies, reinsurance brokerage companies, agents, and loss assessment companies deviation actions carried out by supporting insurance business companies against the Company or Sharia Unit and policyholders, insured parties, or participants;
   c. internal Company or Sharia Unit
   deviation actions carried out by internal parties of the Company or Sharia Unit, acting alone or colluding with internal or external parties of the Company or Sharia Unit; and d. other parties related to the Company or Sharia Unit.

8. In formulating the Anti-Fraud Strategy guideline, the Company or Sharia Unit considers at least the following:
   a. internal and external environmental conditions; b. complexity of business activities;
   c. potential, types, and risks of Fraud; and
   d. adequacy of required resources.

9. The implementation of the Anti-Fraud Strategy as referred to in number 1 is part of the implementation of risk management, specifically including aspects of the internal control system.

IV. REPORTING

1. The Company or Sharia Unit is required to submit the Anti-Fraud Strategy report to the Financial Services Authority as follows:
   a. the implementation report of the Anti-Fraud Strategy follows the Financial Services Authority Regulation regarding periodic reports of insurance companies. b. reports of every Fraud incident estimated to have a significant negative impact on the Company or Sharia Unit, policyholders, insured parties, participants, and/or ceding companies, including those potentially becoming public attention, at most 3 (three) working days since the company's management signed the Fraud reporting document.
   c. the report as referred to in letter b must at least contain:

   1. perpetrator's name;
   2. form or type of deviation;
   3. location of the incident;
   4. brief information regarding the modus operandi; and
   5. indication of losses.

2. Submission of the Anti-Fraud Strategy report is conducted as follows:
   a. for insurance companies and reinsurance companies:
   Executive Head of Non-Bank Financial Industry Supervision Financial Services Authority Up. Director of Insurance and BPJS Health Supervision. b. for insurance companies and reinsurance companies that have Sharia Units:

   1. Executive Head of Non-Bank Financial Industry Supervision
      Financial Services Authority
      Up. Director of Insurance and BPJS Health Supervision; and
   2. Executive Head of Non-Bank Financial Industry Supervision
      Financial Services Authority
      Up. Sharia IKNB Director.
      c. for Sharia insurance companies and Sharia reinsurance companies:
      Executive Head of Non-Bank Financial Industry Supervision Financial Services Authority Up. Sharia IKNB Director.

3. Submission of the Anti-Fraud Strategy report is conducted online through the Financial Services Authority's data communication network system.

4. In the event that the Financial Services Authority's data communication network system is not yet available, the Company or Sharia Unit submits the Anti-Fraud Strategy report online via the email address designated by the Financial Services Authority.

5. The email address of the Company or Sharia Unit used to submit the Anti-Fraud Strategy report must be reported in writing to the Financial Services Authority.

V. CLOSING

The provisions in this Financial Services Authority Circular shall come into force as of the date of establishment.

Established in Jakarta on 25 August 2017

EXECUTIVE HEAD OF INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY,

signed

RISWINANDI