FINANCIAL SERVICES AUTHORITY REGULATION

REPUBLIC OF INDONESIA

NUMBER 30 OF 2025

CONCERNING

THE IMPLEMENTATION OF CORPORATE GOVERNANCE AND RISK MANAGEMENT FOR FINANCIAL SECTOR TECHNOLOGY INNOVATION PROVIDERS

BY THE GRACE OF THE ALMIGHTY GOD,

THE BOARD OF COMMISSIONERS OF THE FINANCIAL SERVICES AUTHORITY,

Considering:
a. that in order to improve the performance of financial sector technology innovation providers, protect the interests of stakeholders, and enhance compliance for financial sector technology innovation providers, the implementation of good corporate governance is required to build trust and competitiveness in the financial sector technology innovation ecosystem; b. that the very rapid development of financial sector technology innovation, with increasingly complex and unique risks arising from the provision of financial sector technology innovation, needs to be balanced with the implementation of adequate, effective, and measurable risk management;
c. that based on the considerations referred to in letters a and b, and in order to implement the provisions of Article 269 and Article 270 paragraph (3) of Law Number 4 of 2023 concerning the Development and Strengthening of the Financial Sector, it is necessary to establish a Financial Services Authority Regulation concerning the Implementation of Corporate Governance and Risk Management for Financial Sector Technology Innovation Providers;

Recalling:

1. Law Number 21 of 2011 concerning the Financial Services Authority (State Gazette of the Republic of Indonesia Year 2011 Number 111, Supplement to the State Gazette of the Republic of Indonesia Number 5253) as amended by Law Number 4 of 2023 concerning the Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845);
2. Law Number 4 of 2023 concerning the Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845);

DECIDING:
Establishing: FINANCIAL SERVICES AUTHABILITY REGULATION CONCERNING THE IMPLEMENTATION OF CORPORATE GOVERNANCE AND RISK MANAGEMENT FOR FINANCIAL SECTOR TECHNOLOGY INNOVATION PROVIDERS.

CHAPTER I

GENERAL PROVISIONS

Article 1

In this Financial Services Authority Regulation, the following terms are defined as:

1. Financial Sector Technology Innovation, hereinafter abbreviated as ITSK, is technology-based innovation that impacts products, activities, services, and business models within the digital financial ecosystem.
2. ITSK Provider is any party that provides ITSK and holds a business license from the Financial Services Authority.
3. Consumer is any person who owns and/or utilizes products and/or services provided by financial service business actors.
4. Good Corporate Governance for ITSK Providers, hereinafter referred to as Good Corporate Governance, is the structure and process used and implemented by ITSK Providers to improve the achievement of business results and optimize company value for ITSK Providers for all stakeholders in an accountable manner, based on statutory regulations and ethical values.
5. Stakeholder is all parties who have direct or indirect interests in the business activities of ITSK Providers.
6. Controlling Shareholder, hereinafter abbreviated as PSP, is a legal entity, individual, and/or business group that holds 25% (twenty-five percent) or more of the issued and voting shares of the ITSK Provider, or holds less than 25% (twenty-five percent) of the issued and voting shares of the ITSK Provider but can be proven to have controlled the ITSK Provider, directly or indirectly.
7. General Meeting of Shareholders, hereinafter abbreviated as GMS, is the company organ that has authority not delegated to the Board of Directors or Board of Commissioners within the limits determined by laws concerning limited liability companies and/or the articles of association for ITSK Providers that are limited liability companies.
8. Board of Directors is the organ of the ITSK Provider authorized and fully responsible for the management of the ITSK Provider for the interests of the ITSK Provider, in accordance with the purpose and objectives of the ITSK Provider, and representing the ITSK Provider, both in and out of court, in accordance with the provisions of the articles of association.
9. Board of Commissioners is the organ of the ITSK Provider tasked with conducting general and/or specific supervision in accordance with the articles of association and providing advice to the Board of Directors.
10. Conflict of Interest is a state where there is a conflict between the interests of the ITSK Provider and the personal, family, and shareholder group interests of members of the Board of Directors, members of the Board of Commissioners, and employees of the ITSK Provider.
11. Risk is the potential for uncontrollable and/or controllable losses resulting from a specific event.
12. Risk Management is a series of procedures and methodologies used to identify, measure, control, and monitor Risks arising from all business activities of ITSK Providers.
13. Strategic Risk is Risk resulting from inaccuracies in making and/or implementing strategic decisions and failures in anticipating changes in the business environment.
14. Operational Risk is Risk resulting from insufficient and/or non-functional internal processes, human error, and/or external events affecting the operations of ITSK Providers.
15. Cyber Risk is Risk caused by attacks, failures, vulnerabilities, or loopholes in information system security that have potential losses and negative impacts on information technology systems, data, or operations.
16. Legal Risk is Risk arising from legal claims and/or weaknesses in legal aspects.
17. Compliance Risk is Risk resulting from ITSK Providers not complying with and/or not implementing statutory regulations for ITSK Providers.
18. Reputational Risk is Risk resulting from a decrease in the level of trust of Stakeholders stemming from negative perceptions of ITSK Providers.

CHAPTER II

GOOD CORPORATE GOVERNANCE

Part One

Implementation of Good Corporate Governance

Article 2

(1) ITSK Providers are required to implement Good Corporate Governance in conducting their business activities at every level or tier of the organization.
(2) The implementation of Good Corporate Governance for ITSK Providers as referred to in paragraph (1) must at least cover the following principles:
a. transparency; b. accountability;
c. responsibility;
d. independence; and e. fairness.
(3) The implementation of Good Corporate Governance for ITSK Providers aims to:
a. optimize the value of ITSK Providers for Stakeholders, particularly Consumers, so that ITSK Providers have strong competitiveness, both nationally and internationally; b. improve the management of ITSK Providers in a professional, effective, and efficient manner;
c. enhance the compliance of the organs of ITSK Providers and their subordinate levels so that decision-making and actions are grounded in high ethics and moral values, compliance with statutory regulations, and awareness of the social responsibility of ITSK Providers towards Consumers, society, and environmental sustainability;
d. improve the conducive climate for the development of ITSK Providers; e. realize ITSK Providers that are healthier, reliable, trustworthy, competitive, and meet Consumer protection principles; and f. increase the contribution of ITSK Providers to the national economy. (4) The implementation of Good Corporate Governance as referred to in paragraph (1) must at least be manifested in the form of:
a. the execution of duties and authorities of shareholders and GMS; b. active supervision by the Board of Directors and Board of Commissioners;
c. the implementation of Risk Management;
d. the implementation of internal audit functions; e. the implementation of external audit functions; f. the handling of Conflicts of Interest; g. information transparency; h. business ethics;
i. the feasibility of annual business plans;
j. transparency of financial and non-financial conditions; and k. the implementation of control functions regarding personal data protection and information system security. (5) In addition to the implementation of Good Corporate Governance as referred to in paragraph (1), ITSK Providers must follow industry dynamics to encourage the implementation of Good Corporate Governance. (6) In conducting business activities, ITSK Providers must conduct their business activities in compliance with statutory regulations.

Article 3

(1) ITSK Providers are required to have adequate standard operating procedures regarding the implementation of Good Corporate Governance for all business activities of ITSK Providers. (2) The standard operating procedures as referred to in paragraph (1) are established by the Board of Directors. (3) ITSK Providers are required to conduct activities in accordance with the standard operating procedures as referred to in paragraph (1). (4) ITSK Providers are required to conduct evaluations and revisions of the standard operating procedures as referred to in paragraph (1). (5) Evaluations and revisions of the standard operating procedures as referred to in paragraph (4) are conducted periodically.

Article 4

ITSK Providers are required to conduct self-assessments of the implementation of Good Corporate Governance periodically.

Article 5

(1) The Financial Services Authority has the authority to conduct assessments of the implementation of Good Corporate Governance.
(2) The Financial Services Authority has the authority to require ITSK Providers to take or refrain from taking specific actions to improve the implementation of Good Corporate Governance. (3) ITSK Providers are required to fulfill the requests of the Financial Services Authority to take or refrain from taking specific actions as referred to in paragraph (2).

Part Two

Shareholders and General Meeting of Shareholders

Article 6

PSPs are required to comply with statutory regulations and support the implementation of healthy, competitive business activities and management of ITSK Providers in accordance with prudential principles and Risk Management, and commitments to operational development.

Article 7

(1) ITSK Providers are required to ensure that every party becoming a PSP obtains approval from the Financial Services Authority through the implementation of fit and proper assessments. (2) The fit and proper assessment as referred to in paragraph (1) is conducted in accordance with Financial Services Authority Regulations concerning fit and proper assessments and re-assessments for key parties in the ITSK sector as well as digital financial assets and crypto assets.

Article 8

(1) Shareholders participate in:
a. supporting the implementation of healthy, competitive business activities of ITSK Providers in accordance with prudential principles and Risk Management; and b. maintaining the continuity of ITSK Providers' business. (2) Shareholders must have commitments to the operational development of ITSK Providers.

Article 9

(1) Shareholders are prohibited from interfering in the operational activities of ITSK Providers that are the responsibility of the Board of Directors in accordance with the provisions of the articles of association of ITSK Providers and statutory regulations, except when exercising rights and obligations as GMS. (2) Shareholders of ITSK Providers who serve as members of the Board of Directors or members of the Board of Commissioners at the same ITSK Provider must prioritize the interests of the ITSK Provider.

Article 10

(1) ITSK Providers establish GMS policies and procedures in the articles of association of ITSK Providers in accordance with statutory regulations.
(2) In making decisions, GMS must protect the interests of Stakeholders.

Part Three

Active Supervision by the Board of Directors and Board of Commissioners

Paragraph 1

Board of Directors

Article 11

(1) ITSK Providers are required to have at least 2 (two) members of the Board of Directors.
(2) At least 1 (one) member of the Board of Directors as referred to in paragraph (1) is required to have knowledge and/or experience in:
a. the field of ITSK; b. the information technology industry; and/or
c. financial service institutions.
(3) The knowledge and/or experience as referred to in paragraph (2) is evidenced by:
a. certification; and/or b. work experience in the industry as referred to in paragraph (2) for at least 3 (three) years.
(4) One of the members of the Board of Directors as referred to in paragraph (1) is required to be appointed as the Chief Executive Director.
(5) In necessary cases, other members of the Board of Directors may be appointed as Deputy Chief Executive Directors.
(6) The Chief Executive Director as referred to in paragraph (4) must come from parties independent of controlling shareholders.
(7) Members of the Board of Directors are prohibited from holding concurrent positions in other companies except as members of the board of commissioners or equivalent in companies other than ITSK Providers or at ITSK Providers with different types of ITSK. (8) The Chief Executive Director must reside in Indonesia. (9) At least 50% (fifty percent) of the members of the Board of Directors must reside in Indonesia. (10) Board of Directors members with foreign nationality must possess:
a. limited stay permits or permanent stay permits from the competent authority; b. work permits from the competent authority; and/or
c. other documents established by the competent authority in accordance with statutory regulations.

Article 12

(1) The dismissal or replacement of Board of Directors members must prioritize the primary interests of ITSK Providers.
(2) The dismissal or replacement of Board of Directors members as referred to in paragraph (1) conducted before the end of the Board of Directors members' term of office must consider:
a. the Board of Directors members are assessed as unable to perform duties and responsibilities in the management and implementation of healthy ITSK Provider strategies; b. the dismissal or replacement of Board of Directors members is not based on subjective assessments by shareholders, but is based on objective assessments regarding the management of ITSK Providers;
c. the dismissal or replacement of Board of Directors members has gone through established planning and mechanisms, which at least consider assessments by members of the Board of Commissioners and have been scheduled in the GMS; and/or
d. there is information that Board of Directors members are included in parties prohibited from being key parties established by competent authorities.
(3) The Financial Services Authority has the authority to conduct evaluations and order ITSK Providers to take corrective actions regarding decisions to dismiss or replace Board of Directors members conducted before the end of the Board of Directors members' term of office.

Article 13

(1) Board of Directors members may resign from their positions before the term of office ends through written notification to ITSK Providers.
(2) The Financial Services Authority has the authority to conduct evaluations and order ITSK Providers to take corrective actions regarding the resignation of Board of Directors members. (3) The evaluation as referred to in paragraph (2) is conducted to assess whether the resignation is voluntary, free from coercion, or other conditions.

Article 14

The authority of the Financial Services Authority to take corrective actions and evaluations regarding the appointment, dismissal, replacement, and/or resignation of Board of Directors members may be communicated by the Financial Services Authority through written orders in accordance with Financial Services Authority Regulations concerning written orders.

Article 15

(1) In the event of:
a. the dismissal of Board of Directors members; b. Board of Directors members being permanently unable to perform duties; and/or
c. Board of Directors members resigning,
which results in the number of Board of Directors members becoming less than the minimum number of Board of Directors members as referred to in Article 11 paragraph (1), ITSK Providers are required to appoint replacements for the said Board of Directors members. (2) ITSK Providers are required to fulfill provisions regarding the appointment of replacements for Board of Directors members as referred to in paragraph (1) no later than 6 (six) months from the date of dismissal of Board of Directors members, Board of Directors members being permanently unable to perform duties, or resignation. (3) In the event of a shortage of Board of Directors members as referred to in paragraph (1), the Board of Commissioners may take management actions for ITSK Providers in accordance with the articles of association or GMS decisions as regulated in statutory regulations for a period of no longer than 6 (six) months. (4) Provisions regarding the rights, authorities, and obligations of the Board of Directors towards ITSK Providers apply to the Board of Commissioners taking management actions for ITSK Providers as referred to in paragraph (3). (5) In the event that the articles of association or GMS decisions do not regulate that the Board of Commissioners can take management actions for ITSK Providers as referred to in paragraph (3), the Financial Services Authority may order ITSK Providers to appoint a specific level of employee to take management actions for ITSK Providers.

Article 16

(1) ITSK Providers are prohibited from appointing Board of Directors members who come from:
a. active employees or officials of the Financial Services Authority; or b. former employees or officials of the Financial Services Authority who ceased working at the Financial Services Authority less than 6 (six) months ago. (2) In the event of a Conflict of Interest or potential Conflict of Interest from former employees or officials of the Financial Services Authority, candidate Board of Directors members as referred to in paragraph (1) letter b, in connection with the nomination of the said candidate at ITSK Providers, the candidate discloses the Conflict of Interest in the fit and proper assessment process. (3) In the event that, based on the assessment of the Financial Services Authority, there is a Conflict of Interest or potential Conflict of Interest from former employees or officials of the Financial Services Authority, candidate Board of Directors members as referred to in paragraph (1) letter b, in connection with the nomination of the said candidate at ITSK Providers, the Financial Services Authority has the authority to establish necessary supervisory actions. (4) ITSK Providers are required to implement determinations issued by the Financial Services Authority regarding necessary supervisory actions to prevent Conflicts of Interest or potential Conflicts of Interest as referred to in paragraph (3).

Article 17

(1) ITSK Providers are required to ensure that every candidate for Board of Directors members obtains approval from the Financial Services Authority through the implementation of fit and proper assessments. (2) The fit and proper assessment as referred to in paragraph (1) is conducted in accordance with Financial Services Authority Regulations concerning fit and proper assessments and re-assessments for key parties in the ITSK sector as well as digital financial assets and crypto assets.

Article 18

(1) The Board of Directors is required to:
a. comply with statutory regulations, the articles of association, and other internal regulations of ITSK Providers in performing their duties; b. manage ITSK Providers in accordance with their authority and responsibilities with good faith and prudential principles;
c. be accountable for the performance of their duties to shareholders through GMS;
d. ensure that ITSK Providers consider Consumer interests with good faith and prudential principles in accordance with statutory regulations, the articles of association, and/or GMS decisions; e. ensure that information regarding ITSK Providers is provided to the Board of Commissioners accurately, relevantly, and in a timely manner; f. conduct data and information management in accordance with Good Corporate Governance for ITSK Providers and statutory regulations; and g. assist and provide facilities and/or resources for the smooth execution of duties and authorities of ITSK Provider organs. (2) The Board of Directors has the authority to represent ITSK Providers in accordance with statutory regulations, the articles of association, and GMS decisions. (3) The Board of Directors is required to follow up on findings from audits or examinations and recommendations from internal audit functions, external auditors, results of Financial Services Authority supervision, and/or results of supervision by other authorities and institutions.

Article 19

(1) The Board of Directors is required to have guidelines and work rules that are binding for each member of the Board of Directors.
(2) The guidelines and work rules as referred to in paragraph (1) must at least include:
a. the organization of ITSK Providers and the division of tasks for the Board of Directors; b. the duties, responsibilities, and authorities of the Board of Directors;
c. the regulation of authorities and procedures for Board of Directors decisions;
d. the regulation of Board of Directors work ethics; e. the regulation of Board of Directors meetings; f. prohibitions against the Board of Directors; g. Board of Directors performance evaluations; and h. the pattern of working relationships between the Board of Directors and the Board of Commissioners.

Article 20

(1) The Board of Directors is required to make decisions in accordance with the guidelines and work rules.
(2) Decisions made by the Board of Directors are binding and become the responsibility of all members of the Board of Directors.

Article 21

(1) The Board of Directors is required to hold Board of Directors meetings periodically at least 1 (one) time within a period of 1 (one) month.
(2) Each member of the Board of Directors is required to attend Board of Directors meetings at least 50% (fifty percent) of the total Board of Directors meetings in a 1 (one) year period. (3) The Board of Directors may conduct Board of Directors meetings as referred to in paragraph (1) through face-to-face meetings utilizing information technology. (4) The Board of Directors is required to hold joint meetings with the Board of Commissioners at least 1 (one) time within a period of 3 (three) months and may be conducted through face-to-face meetings utilizing information technology.

Article 22

(1) Every strategic policy and decision must be decided through Board of Directors meetings in accordance with the mechanisms contained in the articles of association of ITSK Providers and statutory regulations. (2) Decision-making by the Board of Directors through Board of Directors meetings as referred to in paragraph (1) must first be conducted based on deliberation for consensus. (3) In the event that deliberation for consensus is not reached, decision-making is conducted based on the majority vote. (4) In the event that deliberation for consensus is not reached or the majority vote is not obtained as referred to in paragraph (3), the Chief Executive Director may provide a final decision. (5) In the event that ITSK Providers have an even number of Board of Directors members, the Chief Executive Director may provide a final decision at meetings as referred to in paragraph (1). (6) ITSK Providers are required to ensure that the Board of Directors documents the results of Board of Directors meetings in the Board of Directors meeting minutes and documents them properly. (7) ITSK Providers are required to ensure that the Board of Directors clearly states differing opinions that occur in Board of Directors meeting decisions in the Board of Directors meeting minutes, accompanied by the reasons for the differing opinions. (8) Board of Directors members present or absent at Board of Directors meetings have the right to receive copies of the Board of Directors meeting minutes. (9) The number of Board of Directors meetings held and the attendance of each Board of Directors member must be included in the report on the implementation of Good Corporate Governance.

Article 23
The Board of Directors is required to ensure effective, precise, and swift decision-making and to act independently, without interests that could interfere with their ability to perform their duties independently and objectively.

Article 24
Members of the Board of Directors are prohibited from:
a. exploiting their position at the ITSK Provider where they serve for personal, family, and/or third-party interests that could harm or reduce the profits of the ITSK Provider where they serve; b. taking and/or receiving personal benefits from the ITSK Provider where they serve other than remuneration and facilities established based on a General Meeting of Shareholders (GMS) decision; and
c. fulfilling shareholder requests related to the operational activities of the ITSK Provider where they serve other than those established based on a GMS decision; and
d. granting general power of attorney to third parties resulting in the transfer of the Board of Directors' duties and functions.

Paragraph 2
Commissioners Board

Article 25
(1) The ITSK Provider must have at least 1 (one) member of the Commissioners Board or at most equal to the number of Board of Directors members.
(2) One of the members of the Commissioners Board as referred to in paragraph (1) must be appointed as the Lead Commissioner or equivalent.
(3) If necessary, other members of the Commissioners Board may be appointed as Deputy Lead Commissioner or equivalent.
(4) Members of the Commissioners Board are prohibited from holding concurrent positions as Board of Directors members, Commissioners Board members, functional field staff, or other positions at the ITSK Provider of the same ITSK type. (5) Foreign citizen members of the Commissioners Board residing in Indonesia must possess a work permit from the competent authority.

Article 26
(1) The dismissal or replacement of Commissioners Board members must prioritize the primary interests of the ITSK Provider.
(2) The dismissal or replacement of Commissioners Board members as referred to in paragraph (1) conducted before the end of the term of office must consider:
a. the Commissioners Board member is assessed as unable to perform supervision and implementation of the healthy strategy of the ITSK Provider; b. the dismissal or replacement of the Commissioners Board member is not based on subjective assessments by shareholders, but on objective assessments regarding the supervision of the ITSK Provider;
c. the dismissal or replacement of the Commissioners Board member has gone through applicable planning and mechanisms and has been scheduled in the GMS; and/or
d. there is information that the Commissioners Board member is included in the list of prohibited main parties established by the competent authority.
(3) The Financial Services Authority (OJK) has the authority to conduct evaluations and order the ITSK Provider to take corrective actions regarding decisions to dismiss or replace Commissioners Board members conducted before the end of the term of office.

Article 27
(1) Members of the Commissioners Board may resign from their position before the term ends through written notification to the ITSK Provider.
(2) The Financial Services Authority (OJK) has the authority to conduct evaluations and order the ITSK Provider to take corrective actions regarding the resignation of Commissioners Board members. (3) The evaluation as referred to in paragraph (2) is conducted to assess whether the resignation is voluntary, without elements of coercion, or other conditions.

Article 28
The authority of the Financial Services Authority (OJK) to take corrective actions and evaluations regarding the appointment, dismissal, replacement, and/or resignation of Commissioners Board members can be communicated by the Financial Services Authority (OJK) through written orders in accordance with the Financial Services Authority Regulation regarding written orders.

Article 29
(1) In the event of:
a. dismissal of a Commissioners Board member; b. permanent inability of a Commissioners Board member; and/or
c. resignation of a Commissioners Board member,
resulting in the number of Commissioners Board members becoming less than the minimum number of Commissioners Board members as referred to in Article 25 paragraph (1), the ITSK Provider must appoint a replacement for the said Commissioners Board member.

(2) The ITSK Provider must fulfill regulations regarding the appointment of replacement Commissioners Board members as referred to in paragraph (1) at the latest 6 (six) months from the date of dismissal, permanent inability, or resignation of the Commissioners Board member.

Article 30
(1) The ITSK Provider must ensure that every candidate for Commissioners Board member obtains approval from the Financial Services Authority (OJK) through the implementation of competency and propriety assessments. (2) The competency and propriety assessment as referred to in paragraph (1) is conducted in accordance with the Financial Services Authority Regulation regarding competency and propriety assessments and re-assessments for main parties in the ITSK sector and digital financial assets and crypto assets.

Article 31
The Commissioners Board is required to:
a. perform supervision duties and provide advice to the Board of Directors; b. perform duties, authorities, and responsibilities with good faith and the principle of prudence;
c. supervise the management policies and general operations conducted by the Board of Directors for the benefit of the ITSK Provider and in accordance with the purpose and objectives of the ITSK Provider;
d. compile the Commissioners Board activity report, which is part of the Good Corporate Governance implementation report; e. direct, monitor, and evaluate the effectiveness of the implementation of Good Corporate Governance, Risk Management, compliance, and internal audit; f. ensure the Board of Directors has followed up on findings from audits or examinations and recommendations from the ITSK Provider's internal audit, external auditors, results of Financial Services Authority (OJK) supervision, and/or results of supervision by other authorities and institutions; and g. ensure effective, precise, and swift decision-making and independent action in performing duties.

Article 32
Members of the Commissioners Board have the right to receive accurate, relevant, and timely information from the Board of Directors regarding the ITSK Provider.

Article 33
(1) The Commissioners Board must supervise the Board of Directors' follow-up on findings from audits or examinations and recommendations from the ITSK Provider's internal audit, external auditors, results of Financial Services Authority (OJK) supervision, and/or results of supervision by other authorities and institutions. (2) Based on the supervision results as referred to in paragraph (1), the Commissioners Board must report to the Financial Services Authority (OJK) at the latest 10 (ten) working days from the discovery of:
a. the Board of Directors' failure to follow up on audit findings, or examination findings, audit findings, or recommendations from the ITSK Provider's internal audit, external auditors, results of Financial Services Authority (OJK) supervision, and/or results of supervision by other authorities and institutions; b. violations of financial and ITSK-related statutory regulations; and/or
c. conditions or estimated conditions that could endanger the continuity of the ITSK Provider's business.

Article 34
(1) The Commissioners Board must have binding guidelines and working procedures for each member of the Commissioners Board.
(2) The guidelines and working procedures as referred to in paragraph (1) must at least include:
a. duties, responsibilities, and authorities of the Commissioners Board; b. regulations on the authority and decision-making procedures of the Commissioners Board;
c. regulations on the work ethics of the Commissioners Board;
d. regulations on Commissioners Board meetings; e. prohibitions for the Commissioners Board; f. evaluation of the Commissioners Board's performance; and g. working relationship patterns between the Commissioners Board and the Board of Directors.

Article 35
(1) The Commissioners Board must hold Commissioners Board meetings at least 1 (one) time within a 3 (three) month period.
(2) Members of the Commissioners Board must attend Commissioners Board meetings at least 75% (seventy-five percent) of the total Commissioners Board meetings in a 1 (one) year period. (3) The Commissioners Board may hold Commissioners Board meetings as referred to in paragraph (1) in person by utilizing information technology. (4) The Commissioners Board must hold joint meetings with the Board of Directors at least 1 (one) time within a 3 (three) month period.

(5) In the event the Commissioners Board consists of only 1 (one) member, the meeting as referred to in paragraph (4) may be applied as a Commissioners Board meeting as referred to in paragraph (1). (6) Decision-making by the Commissioners Board through Commissioners Board meetings must first be conducted through deliberation for consensus. (7) In the event that consensus is not reached, decision-making is conducted based on the majority vote. (8) In the event the ITSK Provider has a Commissioners Board consisting of 1 (one) member, the decision of the Commissioners Board at the meeting as referred to in paragraph (5) may become a final decision. (9) In the event the ITSK Provider has an even-numbered Commissioners Board, the Lead Commissioner may provide a final decision at the meeting as referred to in paragraph (1). (10) The ITSK Provider must ensure the Commissioners Board documents the results of the Commissioners Board meetings as referred to in paragraph (1) and paragraph (4) in the Commissioners Board meeting minutes and documents them properly. (11) The ITSK Provider must ensure the Commissioners Board clearly states any differing opinions occurring in the Commissioners Board meeting decisions in the Commissioners Board meeting minutes, accompanied by the reasons for the differing opinions. (12) Members of the Commissioners Board present or absent at the Commissioners Board meeting have the right to receive copies of the Commissioners Board meeting minutes. (13) The number of Commissioners Board meetings held and the attendance of each Commissioners Board member must be included in the Good Corporate Governance implementation report.

Article 36
Members of the Commissioners Board are prohibited from:
a. exploiting their position at the ITSK Provider where they serve for personal, family, and/or third-party interests that could harm or reduce the profits of the ITSK Provider where they serve; b. taking and/or receiving personal benefits from the ITSK Provider where they serve other than remuneration and facilities established based on a GMS decision; and
c. interfering in the operational activities of the ITSK Provider that are the responsibility of the Board of Directors.

Fourth Part
Risk Management Implementation

Article 37
(1) The ITSK Provider must:
a. implement appropriate and effective Risk Management; b. have an early warning system for Risks; and
c. periodically evaluate the implementation of Risk Management,
which is adjusted to the complexity and scale of the ITSK Provider's business, with reference to the requirements and procedures in accordance with this Financial Services Authority Regulation. (2) In implementing Risk Management, the ITSK Provider implements anti-money laundering, counter-terrorism financing, and counter-proliferation financing of weapons of mass destruction programs in carrying out business activities, in accordance with the Financial Services Authority Regulation regarding the implementation of anti-money laundering, counter-terrorism financing, and counter-proliferation financing of weapons of mass destruction programs in the financial services sector.

Fifth Part
Internal Audit Function

Article 38
(1) The ITSK Provider must have an internal audit function operated by at least 1 (one) human resource with expertise and/or background in the audit field.
(2) The internal audit function as referred to in paragraph (1) is directly responsible to a member of the Board of Directors.
(3) In the event there are indications of violations of statutory regulations by the ITSK Provider or other matters found by the internal audit function, they can be reported directly to the Commissioners Board. (4) The internal audit function as referred to in paragraph (1) must have and perform duties and responsibilities at least:
a. compiling and realizing the annual audit program plan; b. assisting the Board of Directors and Commissioners Board in supervising the ITSK Provider's operations, especially in monitoring audit results;
c. making analyses and assessments in the fields of finance, accounting, operations, and other activities;
d. providing improvement suggestions and objective information about audited activities at all management levels; and e. documenting evidence from tests and audits already conducted by the internal audit function, including information technology system audits. (5) In addition to the duties and responsibilities as referred to in paragraph (4), the internal audit function may also conduct security and vulnerability audits of the entire ITSK Provider's information system, and must be independent of the information system development function and the information system business and operational functions. (6) The Financial Services Authority (OJK) may request the ITSK Provider to submit evidence from tests and audits as referred to in paragraph (4) letter e. (7) The Financial Services Authority (OJK) may request the ITSK Provider to present the plan and realization of the annual audit program as referred to in paragraph (4) letter a. (8) The ITSK Provider must have guidelines and working procedures for the internal audit function containing at least:
a. duties, responsibilities, and authorities; b. requirements and internal auditor code of ethics; and
c. coordination mechanisms and accountability of internal audit results.

Sixth Part
External Audit Function

Article 39
(1) In providing transparent and quality financial information, the ITSK Provider uses the services of an external auditor conducted by a public accountant. (2) The public accountant as referred to in paragraph (1) is a public accountant registered with the Financial Services Authority (OJK).

Seventh Part
Conflict of Interest

Article 40
(1) Members of the Board of Directors, members of the Commissioners Board, and employees of the ITSK Provider must avoid all forms of Conflict of Interest in the implementation of management and supervision duties of the ITSK Provider. (2) In the event of a Conflict of Interest, members of the Board of Directors, members of the Commissioners Board, and employees of the ITSK Provider must disclose the Conflict of Interest in every decision meeting the conditions of having a Conflict of Interest. (3) In addition to disclosing the Conflict of Interest as referred to in paragraph (2), members of the Board of Directors, members of the Commissioners Board, and employees of the ITSK Provider are prohibited from taking actions that have the potential to harm the ITSK Provider or reduce the profits of the ITSK Provider.

(4) The ITSK Provider must have a Conflict of Interest policy aimed at identifying, reducing, and managing potential Conflicts of Interest that may arise in the ITSK Provider due to the implementation of the ITSK Provider's business activities, which are formulated into regulations.

Eighth Part
Information Transparency

Article 41
In fulfilling the implementation of Good Corporate Governance, the ITSK Provider must disclose:
a. share ownership of Board of Directors and Commissioners Board members reaching 5% (five percent) or more at the ITSK Provider where the Board of Directors and Commissioners Board members serve and/or in other companies located domestically and abroad; b. financial relationships of Board of Directors and Commissioners Board members with other Board of Directors members, other Commissioners Board members, shareholders of the ITSK Provider, and/or employees of the ITSK Provider where the Board of Directors and Commissioners Board members serve;
c. family relationships of Board of Directors and Commissioners Board members with other Board of Directors members, other Commissioners Board members, shareholders of the ITSK Provider, and/or employees of the ITSK Provider where the Board of Directors and Commissioners Board members serve up to the second degree, both horizontally and vertically; and
d. remuneration and facilities received by Board of Directors and Commissioners Board members, in the Good Corporate Governance implementation report.

Article 42
(1) The ITSK Provider must disclose to the Financial Services Authority (OJK) regarding important matters, including:
a. resignation or dismissal of external auditors; b. material transactions with parties having affiliate relationships;
c. Conflicts of Interest that are ongoing and/or may occur; and
d. other material information regarding the ITSK Provider, in the Good Corporate Governance implementation report.
(2) The ITSK Provider must provide and/or open access to all systems used to the Financial Services Authority (OJK).

Ninth Part
Business Ethics

Article 43
(1) The ITSK Provider must compile guidelines on ethical behavior, containing business ethics values, as a guide for Board of Directors members, Commissioners Board members, and employees of the ITSK Provider. (2) The ITSK Provider is prohibited from taking actions aimed at exploiting loopholes in regulations or business ethics that are not in accordance with the principles of healthy ITSK Provider management, which could increase Risks for the ITSK Provider, and/or bring unfair benefits. (3) Members of the Board of Directors, members of the Commissioners Board, and employees of the ITSK Provider are prohibited from offering or giving anything, directly or indirectly, to third parties, to influence decision-making related to the business activities of the ITSK Provider, in violation of statutory regulations. (4) Members of the Board of Directors, members of the Commissioners Board, and employees of the ITSK Provider are prohibited from receiving anything for personal, family, and/or third-party interests in violation of statutory regulations, directly or indirectly, from anyone, which could influence decision-making related to the business activities of the ITSK Provider.

Tenth Part
Annual Business Plan Feasibility

Article 44
(1) The ITSK Provider must compile and submit an annual business plan with procedures in accordance with the Financial Services Authority Regulation regarding licensing and supervision of each type of ITSK. (2) ITSK Providers who violate the obligations as referred to in paragraph (1) are subject to administrative sanctions in accordance with the Financial Services Authority Regulation regarding licensing and supervision of each type of ITSK.

Eleventh Part
Transparency of Financial and Non-Financial Conditions

Article 45
The ITSK Provider must implement transparency of financial and non-financial conditions at least:
a. announcing annual reports on the website; b. informing ITSK products and/or services with reference to statutory regulations regarding consumer protection, and personal data protection;
c. informing the implementation of Good Corporate Governance, at least disclosing all aspects of the implementation of Good Corporate Governance principles; and
d. disclosure and form of accountability of the ITSK Provider regarding the use of Consumer Data in accordance with statutory regulations regarding personal data protection.

Twelfth Part
Implementation of Control Functions Regarding Personal Data Protection and Information System Security

Article 46
The implementation of control functions regarding personal data protection and information system security as referred to in Article 2 paragraph (4) letter k includes at least:
a. availability of written information system policies and procedures; b. use of safe and reliable systems at least:

1. securing and protecting data confidentiality;
2. model development;
3. fulfillment of certifications, security standards, and/or system reliability; and
4. maintenance and improvement of technology security;
   c. implementation of cybersecurity standards;
   d. securing data and information; e. conducting periodic, comprehensive information system audits, and applying the principle of prudence; and f. implementation of personal data protection principles in accordance with statutory regulations regarding personal data protection.

Thirteenth Part
Good Corporate Governance Reporting

Article 47
(1) The ITSK Provider must submit the Good Corporate Governance implementation report as part of the annual report.
(2) The Good Corporate Governance implementation report as referred to in paragraph (1) must at least contain:
a. transparency of Good Corporate Governance implementation by disclosing all aspects of the implementation of Good Corporate Governance principles as referred to in Article 2 paragraph (2); b. the results of the ITSK Provider's self-assessment of the implementation of Good Corporate Governance; and
c. action plans including necessary corrective actions and completion times and obstacles/difficulties in completion, if there are still deficiencies in the implementation of Good Corporate Governance.

(3) The Good Corporate Governance implementation report as referred to in paragraph (1) must be submitted at the latest by April 30 of the following year.
(4) If April 30 falls on a Saturday, Sunday, or holiday, the Good Corporate Governance implementation report as referred to in paragraph (1) is submitted on the next working day. (5) Under certain conditions, the Financial Services Authority (OJK) has the authority to set different submission deadlines for reports from the regulations as referred to in paragraph (3). (6) ITSK Providers who submit the Good Corporate Governance implementation report at most 20 (twenty) working days after the period as referred to in paragraph (3) are declared late in submitting the Good Corporate Governance implementation report. (7) ITSK Providers who do not submit the Good Corporate Governance implementation report until the end of the period as referred to in paragraph (6) are declared not to have submitted the Good Corporate Governance implementation report. (8) Regulations regarding the form and structure of the Good Corporate Governance implementation report are established by the Financial Services Authority (OJK).

Fourteenth Part
Administrative Sanctions

Article 48
(1) ITSK Providers who violate regulations as referred to in Article 2 paragraph (1), Article 3 paragraph (1), paragraph (3), paragraph (4), Article 4, Article 5 paragraph (3), Article 6, Article 7 paragraph (1), Article 9 paragraph (1), Article 11 paragraph (1), paragraph (2), paragraph (4), paragraph (6), paragraph (7), paragraph (8), paragraph (9), paragraph (10), Article 12 paragraph (1), paragraph (2), Article 15 paragraph (1), paragraph (2), Article 16 paragraph (1), paragraph (4), Article 17 paragraph (1), Article 18 paragraph (1), paragraph (3), Article 19, Article 20 paragraph (1), Article 21 paragraph (1), paragraph (2), paragraph (4), Article 22 paragraph (1), paragraph (2), paragraph (6), paragraph (7), Article 23, Article 24, Article 25 paragraph (1), paragraph (2), paragraph (4), paragraph (5), Article 26 paragraph (1), paragraph (2), Article 29, Article 30 paragraph (1), Article 31, Article 33, Article 34, Article 35 paragraph (1), paragraph (2), paragraph (4), paragraph (6), paragraph (10), paragraph (11), Article 36, Article 38 paragraph (1), paragraph (4), paragraph (8), Article 40 paragraph (2), paragraph (3), paragraph (4), Article 41, Article 42, Article 43, Article 45, and/or Article 47 paragraph (1), paragraph (3) are subject to administrative sanctions in the form of:
a. written warning; b. temporary suspension, partial, or full suspension of activities including implementation of cooperation;
c. administrative fines;
d. listing of main parties in the list of tainted persons in the financial sector; and/or e. revocation of business licenses.

(2) ITSK Providers who are late in fulfilling the provisions as referred to in Article 47 paragraph (6) shall be subject to an administrative fine of Rp100,000.00 (one hundred thousand rupiah) per working day of the late submission of the report. (3) ITSK Providers who fail to submit as referred to in Article 47 paragraph (7) shall be subject to an administrative fine of Rp3,000,000.00 (three million rupiah). (4) The imposition of administrative sanctions as referred to in paragraph (1) letters b, c, d, and e may be imposed with or without prior imposition of an administrative sanction in the form of a written warning as referred to in paragraph (1) letter a. (5) The imposition of administrative sanctions as referred to in paragraph (3) does not eliminate the reporting obligation as referred to.

CHAPTER III
RISK MANAGEMENT FOR ITSK PROVIDERS

First Section
Risk Management

Article 49
(1) ITSK Providers are required to implement Risk Management effectively.
(2) The implementation of Risk Management as referred to in paragraph (1) shall at least cover:
a. active supervision by the Board of Directors and Board of Commissioners; b. adequacy of Risk Management policies and procedures as well as the determination of Risk limits;
c. adequacy of the process for identifying, measuring, controlling, and monitoring Risks, as well as the Risk Management information system; and
d. a comprehensive internal control system.
(3) In implementing Risk Management as referred to in paragraph (1), ITSK Providers must have guidelines for the implementation of Risk Management.
(4) Provisions regarding the implementation of Risk Management as referred to in paragraph (1) shall be determined by the Financial Services Authority (OJK).

Article 50
The implementation of Risk Management as referred to in Article 49 must be adjusted to the objectives, business policies, size, business complexity, and capabilities of the ITSK Provider.

Article 51
ITSK Providers are required to implement Risk Management as referred to in Article 49 paragraph (1) for:
a. Strategic Risk; b. Operational Risk;
c. Cyber Risk;
d. Legal Risk; e. Compliance Risk; and f. Reputational Risk.

Second Section
Active Supervision by the Board of Directors and Board of Commissioners

Paragraph 1
General

Article 52
ITSK Providers are required to determine the authority and responsibilities at every level of position related to the implementation of Risk Management as referred to in Article 49.

Paragraph 2
Authority and Responsibilities of the Board of Directors

Article 53
(1) The authority and responsibilities as referred to in Article 52 for the Board of Directors shall at least:
a. formulate and determine written and comprehensive Risk Management policies and strategies; b. be responsible for the implementation of Risk Management policies and the overall Risk exposure taken by the ITSK Provider;
c. evaluate and decide on transactions and Risk limits that require Board of Directors approval;
d. develop a Risk Management culture at all levels of the organization; e. ensure the improvement of human resource competence related to Risk Management; f. ensure that the Risk Management function has operated independently; and g. conduct periodic reviews to ensure:

1. the accuracy of Risk assessment methodologies;
2. the adequacy of the implementation of the Risk Management information system; and
3. the appropriateness of Risk Management policies and procedures as well as the determination of Risk limits.
   (2) The Risk Management policies and strategies as referred to in paragraph (1) letter a shall be reviewed periodically at least 1 (one) time within a period of 1 (one) year and whenever there are factors that significantly affect the business activities of the ITSK Provider. (3) Any changes to the results of the review as referred to in paragraph (2) must be documented by the ITSK Provider. (4) The Board of Directors' responsibility for the implementation of Risk Management policies as referred to in paragraph (1) letter b includes:
   a. evaluating and providing direction based on reports submitted by the Risk Management function; and b. submitting accountability reports to the Board of Commissioners at least 1 (one) time within a period of 1 (one) year. (5) To exercise the authority and responsibilities as referred to in paragraph (1) and paragraph (4), the Board of Directors must have an understanding of the Risks inherent in all functional activities of the ITSK Provider and be able to take necessary actions according to the ITSK Provider's Risk profile.

Paragraph 3
Authority and Responsibilities of the Board of Commissioners

Article 54
(1) The authority and responsibilities as referred to in Article 52 for the Board of Commissioners shall at least:
a. approve and evaluate Risk Management policies; b. evaluate the Board of Directors' accountability for the implementation of Risk Management policies as referred to in letter a; and
c. evaluate and decide on Board of Directors' requests related to transactions and Risk limits that require Board of Commissioners approval.
(2) The evaluation of Risk Management policies as referred to in paragraph (1) letter a shall be conducted at least 1 (one) time within a period of 1 (one) year and whenever there are factors that significantly affect the business activities of the ITSK Provider. (3) The evaluation of the Board of Directors' accountability for the implementation of Risk Management policies as referred to in paragraph (1) letter b shall be conducted at least 1 (one) time within a period of 1 (one) year.

Third Section
Adequacy of Policies, Procedures, and Determination of Risk Limits

Paragraph 1
Adequacy of Risk Management Policies

Article 55
The adequacy of Risk Management policies as referred to in Article 49 paragraph (2) letter b shall at least contain:
a. the determination of Risks related to the business activities of the ITSK Provider; b. the determination of the use of measurement methods and Risk Management information systems;
c. the determination of the level of Risk to be taken, Risk tolerance, and the determination of Risk limits;
d. the determination of Risk rating assessments; e. the preparation of emergency plans in worst-case scenarios; and f. the determination of internal control systems in the implementation of Risk Management.

Paragraph 2
Risk Management Procedures and Determination of Risk Limits

Article 56
(1) Risk Management procedures and the determination of Risk limits as referred to in Article 49 paragraph (2) letter b must be adjusted to the level of Risk to be taken against the ITSK Provider's Risks. (2) Risk Management procedures and the determination of Risk limits as referred to in paragraph (1) shall at least contain:
a. clear accountability and levels of delegation of authority; b. the periodic review of Risk Management procedures and the determination of Risk limits; and
c. adequate documentation of Risk Management procedures and the determination of Risk limits.
(3) The determination of Risk limits as referred to in paragraph (2) must cover:
a. overall limits; b. limits per type of Risk; and
c. limits per functional activities and specific transactions with Risk exposure.

Fourth Section
Adequacy of the Process for Identifying, Measuring, Controlling, and Monitoring Risks, as well as Risk Management Information Systems

Paragraph 1
General

Article 57
(1) ITSK Providers are required to carry out the process of identifying, measuring, controlling, and monitoring Risks as referred to in Article 49 paragraph (2) letter c regarding material Risk factors. (2) The implementation of the process of identifying, measuring, controlling, and monitoring Risks as referred to in paragraph (1) must be supported by:
a. timely management information systems; b. accurate and informative reports regarding financial conditions, functional activity performance, and the ITSK Provider's Risk exposure; and
c. human resources with competence in the field of Risk Management.

Paragraph 2
Process of Identifying, Measuring, Controlling, and Monitoring Risks

Article 58
(1) To carry out the process of identifying Risks, ITSK Providers must conduct analyses at least regarding:
a. the characteristics of Risks inherent in the ITSK Provider; and b. Risks from the business activities of the ITSK Provider.
(2) To carry out the measurement of Risks, ITSK Providers must conduct at least:
a. periodic evaluations at least 1 (one) time within a period of 1 (one) year regarding the suitability of assumptions, data sources, and procedures used to measure Risks; and b. adjustments to the Risk measurement process in the event of changes in the ITSK Provider's business activities and material Risk factors. (3) ITSK Providers must carry out the Risk control process to manage specific Risks that endanger the continuity of the ITSK Provider's business. (4) To carry out the monitoring of Risks, ITSK Providers must conduct at least:
a. evaluations of Risk exposure; and b. adjustments to the reporting process in the event of changes:

1. in business activities;
2. in Risk factors;
3. in information technology; and
4. in the ITSK Provider's Risk Management information system, which are material.

Paragraph 3
Risk Management Information Systems

Article 59
(1) The Risk Management information system as referred to in Article 49 paragraph (2) letter c must be supported by human resources with competence in the field of Risk Management information systems. (2) The Risk Management information system as referred to in Article 49 paragraph (2) letter c covers reports or information at least regarding:
a. Risk exposure; b. compliance with the adequacy of Risk Management policies as referred to in Article 55 and Risk Management procedures as well as the determination of Risk limits as referred to in Article 56; and
c. the realization of Risk Management implementation compared to established targets.
(3) Reports or information as referred to in paragraph (2) must be submitted periodically to the Board of Directors.

Fifth Section
Internal Control Systems

Paragraph 1
General

Article 60
ITSK Providers are required to implement effective internal control systems against Risks inherent in the execution of business activities at all levels of the ITSK Provider's organization.

Article 61
(1) The implementation of internal control systems as referred to in Article 60 must at least be able to timely detect weaknesses and deviations that cause or affect Risk exposure. (2) The internal control system as referred to in paragraph (1) must ensure:
a. the compliance of the ITSK Provider's management level with Risk Management policies and procedures, as well as laws and regulations, as well as internal policies or provisions of the ITSK Provider; b. the compliance and effectiveness of the Risk Management function in designing and implementing Risk Management strategies and policies;
c. the availability of complete, accurate, relevant, and timely financial and management information;
d. effectiveness and efficiency in business and operational activities; and e. the effectiveness of Risk culture throughout the ITSK Provider's organization.

Paragraph 2
Internal Control Systems in the Implementation of Risk Management

Article 62
(1) In the implementation of Risk Management, the comprehensive internal control system as referred to in Article 49 paragraph (2) letter d shall at least contain:
a. the suitability of the internal control system with the type and level of Risks inherent in the ITSK Provider's business activities; b. the determination of authority and responsibilities for monitoring compliance with the adequacy of Risk Management policies as referred to in Article 55 and Risk Management procedures as well as the determination of Risk limits as referred to in Article 56;
c. the determination of reporting channels and clear separation of functions from operational functions to Risk control functions;
d. an organizational structure that clearly describes the ITSK Provider's business activities; e. accurate and timely financial and operational reporting; f. adequate procedures to ensure the ITSK Provider's compliance with legal provisions for ITSK Providers; g. effective, independent, and objective reviews of operational activity assessment procedures for the ITSK Provider; h. adequate testing and review of the Risk Management information system;
i. complete and adequate documentation of operational procedures, scope, and audit findings, as well as the responses of the Board of Directors and Board of Commissioners of the ITSK Provider based on audit results; and
j. periodic and continuous verification and review of the handling of material weaknesses of the ITSK Provider and the actions of the Board of Directors and Board of Commissioners of the ITSK Provider to correct deviations that occur. (2) The assessment of the internal control system in the implementation of Risk Management as referred to in paragraph (1) must be conducted by the internal audit function.

Sixth Section
Organization and Risk Management Functions

Paragraph 1
General

Article 63
To carry out effective Risk Management processes and systems as referred to in Article 49, ITSK Providers are required to establish a Risk Management function.

Paragraph 2
Risk Management Function

Article 64
(1) The organizational structure of the Risk Management function as referred to in Article 63 must be adjusted to the size and complexity of the ITSK Provider's business as well as the Risks inherent in the ITSK Provider. (2) The Risk Management function as referred to in paragraph (1) must be independent of business and operational functions and of internal control functions. (3) The Risk Management function as referred to in paragraph (1) is directly responsible to the Chief Executive Officer or equivalent, or a member of the Board of Directors who oversees the Risk Management function. (4) The Risk Management function has authority and responsibilities including:
a. identifying Risks, including Risks inherent in the ITSK Provider's business activities; b. formulating Risk measurement methods;
c. monitoring the implementation of Risk Management strategies formulated by the Board of Directors;
d. monitoring overall Risk positions, per type of Risk, and per type of functional activity; e. periodically reviewing the Risk Management process; f. reviewing proposals for the development or expansion of business activities; g. evaluating the accuracy of models and validity of data used to measure Risks, for ITSK Providers using models for internal purposes; h. providing recommendations to business and operational functions, according to the authority held; and
i. formulating and submitting Risk profile reports to the Chief Executive Officer or equivalent, or a member of the Board of Directors who oversees the Risk Management function, periodically.
(5) Provisions regarding the organizational structure of the Risk Management function as referred to in paragraph (1) shall be determined by the Financial Services Authority (OJK).

Paragraph 3
Relationship between Business and Operational Functions and Risk Management Functions

Article 65
(1) Business and operational functions as referred to in Article 64 paragraph (2) must periodically inform the Risk Management function of the inherent Risk exposure. (2) Provisions regarding the relationship between business and operational functions and Risk Management functions as referred to in paragraph (1) shall be determined by the Financial Services Authority (OJK).

Seventh Section
Management of Risks Inherent in the Development or Expansion of Business Activities

Article 66
(1) ITSK Providers must have written policies and procedures to manage Risks inherent in the development or expansion of the ITSK Provider's business activities. (2) The policies and procedures as referred to in paragraph (1) shall at least cover:
a. systems, procedures, and authorities in the management of the development or expansion of business activities; b. the identification of all Risks inherent in the development or expansion of business activities, both related to the ITSK Provider and Consumers;
c. the trial period for Risk measurement and monitoring methods regarding the development or expansion of business activities;
d. accounting information systems for the development or expansion of business activities; e. legal aspect analysis for the development or expansion of business activities; and f. transparency of information to Consumers. (3) The business activities of an ITSK Provider constitute a form of development or expansion of business activities if they meet the criteria:
a. not previously conducted by the ITSK Provider; or b. previously conducted by the ITSK Provider, but with development that changes or increases specific Risk exposure in the ITSK Provider. (4) Provisions regarding the management of Risks for the development or expansion of business activities as referred to in paragraph (1) shall be determined by the Financial Services Authority (OJK).

Article 67
ITSK Providers are prohibited from assigning or approving the Board of Directors, Board of Commissioners, and/or employees of the ITSK Provider to carry out activities that are not the business activities of the ITSK Provider using the facilities or equipment of the ITSK Provider.

Eighth Section
Self-Assessment and Risk Profile Reporting

Article 68
(1) ITSK Providers are required to conduct self-assessments of their Risk profiles semi-annually for the months of June and December.
(2) If necessary, the Financial Services Authority (OJK) may request ITSK Providers to conduct self-assessments of their Risk profiles at any time.
(3) ITSK Providers must carry out self-assessments of their Risk profiles at any time as requested by the Financial Services Authority (OJK) as referred to in paragraph (2). (4) The results of the self-assessment of the Risk profile as referred to in paragraph (1) and paragraph (3) must receive approval from the Board of Directors and be submitted to the Board of Commissioners. (5) Provisions regarding the self-assessment of the Risk profile as referred to in paragraph (1) through paragraph (3) shall be determined by the Financial Services Authority (OJK).

Article 69
(1) ITSK Providers are required to submit the results of the self-assessment of the Risk profile as referred to in Article 68 paragraph (1) in a Risk profile report to the Financial Services Authority (OJK). (2) The Risk profile report as referred to in paragraph (1) is part of the semi-annual report. (3) The Risk profile report regarding the results of the semi-annual self-assessment of the Risk profile as referred to in paragraph (1) must be submitted no later than 1 (one) month after the end of the reporting period. (4) If the deadline for submitting the Risk profile report regarding the results of the self-assessment of the Risk profile as referred to in paragraph (3) falls on a Saturday, Sunday, or public holiday, the Risk profile report regarding the results of the self-assessment of the Risk profile must be submitted on the next working day. (5) In certain conditions, the Financial Services Authority (OJK) has the authority to set different submission deadlines for reports from the provisions as referred to in paragraph (4). (6) ITSK Providers are required to submit Risk profile reports regarding the results of ad-hoc self-assessments of the Risk profile as referred to in Article 68 paragraph (3) within the time limits established by the Financial Services Authority (OJK). (7) ITSK Providers that submit Risk profile reports as referred to in paragraph (1) are declared late in submitting the Risk profile report if submitted no later than 20 (twenty) working days after the time limit as referred to in paragraph (3). (8) ITSK Providers that do not submit Risk profile reports as referred to in paragraph (1) until the end of the time limit as referred to in paragraph (7) are declared not to have submitted the Risk profile report.

Article 70
(1) In the event of conditions that have the potential to cause significant losses to financial conditions, ITSK Providers are required to submit other Risk profile reports to the Financial Services Authority (OJK). (2) Other Risk profile reports as referred to in paragraph (1) include information and data other than the Risk profile reports required as referred to in Article 69. (3) Other Risk profile reports as referred to in paragraph (1) must be submitted no later than 1 (one) month after the condition with the potential to cause significant losses to the ITSK Provider's financial conditions is known. (4) The obligation to submit other Risk profile reports as referred to in paragraph (1) may be based on a request from the Financial Services Authority (OJK). (5) If the submission deadline falls on a Saturday, Sunday, or public holiday, other Risk profile reports as referred to in paragraph (3) or paragraph (4) must be submitted on the next working day. (6) In certain conditions, the Financial Services Authority (OJK) has the authority to set different submission deadlines for reports from the provisions as referred to in paragraph (5).

Article 71
(1) ITSK Providers are required to submit:
a. Risk profile reports as referred to in Article 69 paragraph (1); and b. other Risk profile reports as referred to in Article 70 paragraph (1), electronically through the Financial Services Authority (OJK) data communication network system. (2) In the event that the Financial Services Authority (OJK) data communication network system as referred to in paragraph (1) is not yet available or experiences an interruption, submission is conducted electronically via the Financial Services Authority (OJK) email address. (3) In the event of an interruption to the Financial Services Authority (OJK) email, report submission is conducted offline through the Financial Services Authority (OJK) office. (4) Provisions regarding the procedures for submitting Risk profile reports and other Risk profile reports shall be determined by the Financial Services Authority (OJK).

Article 72
(1) The Financial Services Authority (OJK) may conduct assessments regarding the implementation of Risk Management at ITSK Providers.
(2) ITSK Providers are required to submit data and information related to the implementation of Risk Management to the Financial Services Authority (OJK).

Part Nine
Administrative Sanctions
Article 73
(1) ITSK Organizers who commit violations against the provisions as regulated in Article 49 paragraph (1), paragraph (3), Article 50, Article 51, Article 52, Article 53 paragraph (3), Article 56 paragraph (1), paragraph (3), Article 57, Article 58, Article 59 paragraph (1), Article 60, Article 61 paragraph (2), Article 62 paragraph (2), Article 63, Article 65 paragraph (1), Article 66 paragraph (1), Article 67, Article 68 paragraph (1), paragraph (3), paragraph (4), Article 69 paragraph (1), paragraph (6), Article 70 paragraph (1), paragraph (3), Article 71 paragraph (1), and/or Article 72 paragraph (2) shall be subject to administrative sanctions in the form of:
a. written warning; b. temporary suspension, partial or full, of activities including the implementation of cooperation;
c. administrative fine;
d. listing of the main party in the list of persons of bad repute in the financial sector; and e. revocation of business license.
(2) ITSK Organizers declared late in submitting reports as referred to in Article 69 paragraph (7) shall be subject to sanctions in the form of a fine of Rp100,000.00 (one hundred thousand rupiah) per working day of report delay. (3) ITSK Organizers who do not submit reports as referred to in Article 69 paragraph (8) shall be subject to sanctions in the form of a fine of Rp3,000,000.00 (three million rupiah). (4) The imposition of administrative sanctions as referred to in paragraph (1) letters b, c, d, and e may be imposed with or without prior imposition of administrative sanctions in the form of a written warning as referred to in paragraph (1) letter a. (5) The imposition of administrative sanctions as referred to in paragraph (3) does not eliminate the reporting obligation referred to.
CHAPTER IV
OTHER PROVISIONS
Article 74
The Financial Services Authority has the authority to issue written orders to ITSK Organizers in accordance with the procedures set forth in Financial Services Authority regulations regarding written orders.
Article 75
(1) The obligation to submit annual reports on the implementation of Good Governance as referred to in Article 47 paragraph (1) shall be submitted for the first time for the 2026 reporting period, to be submitted no later than April 30, 2027. (2) The obligation to submit semi-annual Risk Profile reports as referred to in Article 69 paragraph (1) shall be submitted for the first time for the second semester of 2026 reporting period, to be submitted no later than 1 (one) month since the end of the reporting period.
Article 76
The Financial Services Authority may grant approvals or policies that differ from this Financial Services Authority Regulation based on specific considerations.
CHAPTER V
TRANSITIONAL PROVISIONS
Article 77
At the time this Financial Services Authority Regulation takes effect:
a. ITSK Organizers are required to adjust the number of Commissioners as referred to in Article 25 paragraph (1) no later than at the first General Meeting of Shareholders (GMS) after this Financial Services Authority Regulation takes effect; and b. members of the Board of Commissioners who do not comply with the dual mandate provisions as referred to in Article 25 paragraph (4) may continue to serve until the first General Meeting of Shareholders (GMS) after this Financial Services Authority Regulation takes effect.
CHAPTER VI
CLOSING PROVISIONS
Article 78
At the time this Financial Services Authority Regulation takes effect, provisions regarding self-evaluation, governance, and Risk Management in Financial Services Authority Regulation Number 3 of 2024 concerning the Implementation of Financial Sector Technology Innovation (State Gazette of the Republic of Indonesia Year 2024 Number 5/OJK), for ITSK Organizers who have obtained a business license from the Financial Services Authority, are repealed and declared invalid.
Article 79
At the time this Financial Services Authority Regulation takes effect:
a. Article 6 paragraph (4) and Article 23, Article 40 paragraph (3) letter b, and paragraph (4) letter b of Financial Services Authority Regulation Number 29 of 2024 concerning Alternative Credit Rating (State Gazette of the Republic of Indonesia Year 2024 Number 41/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 109/OJK); and b. Article 6 paragraph (4) and Article 23, Article 39 paragraph (2) letter c and paragraph (3) letter b of Financial Services Authority Regulation Number 4 of 2025 concerning Financial Service Aggregation Organizers (State Gazette of the Republic of Indonesia Year 2025 Number 8/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 138/OJK), are repealed and declared invalid.

Article 80
This Financial Services Authority Regulation takes effect on July 1, 2026.
To ensure that everyone knows it, it is ordered to promulgate this Financial Services Authority Regulation by placing it in the State Gazette of the Republic of Indonesia. Determined in Jakarta on November 21, 2025 CHAIRMAN OF THE BOARD OF COMMISSIONERS FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, Œ MAHENDRA SIREGAR Promulgated in Jakarta on the date Д MINISTER OF LAW OF THE REPUBLIC OF INDONESIA, Ѽ SUPRATMAN ANDI AGTAS STATE GAZETTE OF THE REPUBLIC OF INDONESIA YEAR 2025 NUMBER Ж

EXPLANATION
OF
FINANCIAL SERVICES AUTHORITY REGULATION
OF THE REPUBLIC OF INDONESIA
NUMBER 30 OF 2025
CONCERNING
THE IMPLEMENTATION OF GOVERNANCE AND RISK MANAGEMENT FOR FINANCIAL SECTOR TECHNOLOGY INNOVATION PROVIDERS
I. GENERAL
The rapid development of ITSK requires optimal support and strengthening. One form of strengthening can be realized through the implementation of Good Governance principles in the ITSK ecosystem. Good Governance plays a strategic role in building trust and increasing the competitiveness of the ITSK sector. In addition, Good Governance contributes to increasing financial inclusion by creating a positive perception of technology adaptation in the financial sector. In practice, governance plays a role in ensuring that ITSK service providers are able to maintain data integrity, protect user data confidentiality, and comply with statutory regulations. Governance structures, such as the characteristics and competencies of the Board of Directors and Board of Commissioners, have a significant impact on the Risk Management of ITSK organizers. To build trust and competitiveness in the ITSK ecosystem, it is necessary to carry out activities based on the implementation of reliable and integrated governance and Risk Management. Thus, ITSK Organizers meet statutory regulations, standards, ethical values, as well as generally applicable principles and practices. In addition, the implementation of effective governance and Risk Management allows ITSK Organizers to maintain and build a foundation for value creation, optimize sustainable performance, manage rights and responsibilities, and maintain a balance of interests among shareholders and all other Stakeholders (stakeholders) in an effort to contribute more broadly to driving the national economy. Risk Management is a crucial element in the ITSK ecosystem that plays an important role in preventing potential significant Risks in the ITSK sector arising from the rapid development of technology. In practice, ITSK Organizers face various types of Risks that have the potential to affect operational stability and security, including cyber security Risk, technology Risk, and market dynamics. The rapid growth of ITSK requires the implementation of effective Risk Management to mitigate challenges arising from technology innovation. With the implementation of appropriate Risk Management strategies, ITSK Organizers can ensure safe, stable, and sustainable operational continuity. In order to create a sustainable ITSK ecosystem capable of supporting financial inclusion in Indonesia, regulations regarding the governance and Risk Management of ITSK organizers are needed. Based on these considerations, it is necessary to formulate regulations regarding the implementation of governance and Risk Management for ITSK Organizers. Generally, this Financial Services Authority Regulation contains main materials arranged systematically, including among others regarding Good Governance, which includes the implementation of Good Governance, shareholders and GMS, active supervision by the Board of Directors and Board of Commissioners, and reporting on Good Governance, as well as regarding the implementation of Risk Management for ITSK
Organizers, which includes among others active supervision by the Board of Directors and Board of Commissioners, adequacy of policies, procedures, and determination of Risk limits, adequacy of Risk identification, measurement, control, and monitoring processes, as well as Risk Management information systems, and internal control systems. Furthermore, provisions regarding self-evaluation, governance, Risk Management, governance reports, and Risk Management and prudence implementation reports for ITSK Organizers who have a business license at the Financial Services Authority are subject to the provisions in this Financial Services Authority Regulation.
II. ARTICLE BY ARTICLE
Article 1
It is clear enough.
Article 2
Paragraph (1)
It is clear enough.
Paragraph (2)
Letter a
Transparency includes transparency in the decision-making process and transparency in the disclosure and provision of relevant and easily accessible information to Stakeholders. Letter b Accountability includes clarity of functions and the implementation of accountability of the ITSK Organizer's organs. Letter c Responsibility for the conformity of management with statutory regulations and ethical values as well as standards, principles, and practices at ITSK Organizers. Letter d Independence includes a state managed independently and professionally and free from Conflicts of Interest and influence or pressure from any party that is not in accordance with statutory regulations and ethical values as well as standards, principles, and practices at ITSK Organizers.

Letter e
Fairness includes equality, balance, and justice in fulfilling the rights of Stakeholders arising from agreements, statutory regulations, and ethical values as well as standards, principles, and practices. Paragraph (3) It is clear enough. Paragraph (4) Letter a It is clear enough. Letter b It is clear enough. Letter c It is clear enough. Letter d It is clear enough. Letter e It is clear enough. Letter f Handling Conflicts of Interest, among others, ensuring that decisions made by the Board of Directors and/or Board of Commissioners are based solely on the business interests of the ITSK Organizer in question. Letter g It is clear enough. Letter h It is clear enough. Letter i It is clear enough. Letter j It is clear enough. Letter k It is clear enough. Paragraph (5) It is clear enough. Paragraph (6) Statutory regulations include among others laws regarding personal data protection.
Article 3
It is clear enough.
Article 4
It is clear enough.
Article 5
Paragraph (1)
It is clear enough.
Paragraph (2)
Examples of taking or not taking certain actions to improve the implementation of Good Governance include among others:
a. increasing or decreasing the number of members of the Board of Directors and/or members of the Board of Commissioners in cases where the number of existing members of the Board of Directors and/or members of the Board of Commissioners is deemed ineffective and inefficient; and b. adding information regarding transparency of share ownership of less than 5% (five percent) by Board of Directors members on:

1. ITSK Organizers where the Board of Directors members in question serve; and/or
2. other companies located domestically and internationally,
   against Board of Directors members who are proven to exercise control.
   Paragraph (3)
   It is clear enough.
   Article 6
   PSP supports the implementation of business activities and the healthy, competitive management of ITSK Organizers in accordance with the principles of prudence and Risk Management, including:
   a. not participating in the operational decision-making of ITSK Organizers for shareholders who are not managers or employees of the ITSK Organizer; and b. not influencing the operational decision-making of ITSK Organizers, in accordance with Financial Services Authority regulations regarding ITSK. Statutory regulations include among others laws regarding limited liability companies and Financial Services Authority regulations.
   Article 7
   It is clear enough.
   Article 8
   Paragraph (1)
   It is clear enough.
   Paragraph (2)
   Commitments include among others when needed, especially shareholders are willing to increase the operational funds of ITSK Organizers by means such as increasing paid-up capital, subordinated loans, and/or changing the composition/number of shareholders.
   Article 9
   It is clear enough.
   Article 10
   It is clear enough.
   Article 11
   Paragraph (1)
   It is clear enough.
   Paragraph (2)
   It is clear enough.
   Paragraph (3)
   Letter a
   Certifications are issued by credible or accountable bodies/institutions/associations.
   Required certifications include among others Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), or Certified Data Privacy Solutions Engineer (CDPSE). Letter b It is clear enough. Paragraph (4) ITSK Organizers may use other job titles for the Chief Executive Officer, such as President Director. Paragraph (5) ITSK Organizers may use other job titles for the Deputy Chief Executive Officer, such as Vice President Director. Paragraph (6) What is meant by "controlling shareholder" is PSP and the ultimate controlling shareholder in accordance with Financial Services Authority regulations regarding fitness and propriety assessments and reassessments for main parties in the ITSK sector as well as digital financial assets and crypto assets. Independence assessment is based on relevant connections in management, ownership, and/or financial relationships, as well as family relationships with controlling shareholders. Paragraph (7) Examples of dual mandate prohibition provisions for Board of Directors members, except as members of the board of commissioners or equivalent at companies other than ITSK Organizers or at ITSK Organizers with different types of ITSK, are:
   a. Board of Directors of alternative credit rating agencies becoming commissioners at telecommunications companies; or b. Board of Directors of alternative credit rating agencies becoming Board of Commissioners at financial service aggregation organizers. Paragraph (8) It is clear enough. Paragraph (9) It is clear enough. Paragraph (10) Letter a It is clear enough. Letter b It is clear enough. Letter c Other documents determined by the competent authority include among others permits to use foreign labor.
   Article 12
   Paragraph (1)
   Dismissal of Board of Directors members includes temporary dismissal of Board of Directors members. Restriction of authority of temporarily dismissed Board of Directors members is implemented in accordance with statutory regulations. This provision is intended so that in the dismissal or replacement of Board of Directors members of ITSK Organizers, it is not based on personal interests but rather focuses on the interests of the ITSK Organizer as the top priority. Paragraph (2) Letter a It is clear enough. Letter b Objective assessments regarding the management of ITSK Organizers include among others aspects of performance, integrity, financial reputation, and/or competence. Letter c It is clear enough. Letter d It is clear enough. Paragraph (3) The authority of the Financial Services Authority to conduct evaluations and order ITSK Organizers to take corrective actions, among others, in conditions where Board of Directors members are dismissed before the end of their term, where the dismissal process is indicated to be intended to obscure the violation conditions committed by the respective Board of Directors member, including suspected criminal acts.
   Article 13
   Paragraph (1)
   Procedures for resignation of Board of Directors members are in accordance with statutory regulations and are stated in the Articles of Association of the ITSK Organizer. Paragraph (2) The authority of the Financial Services Authority to conduct evaluations and order ITSK Organizers to take corrective actions, among others, in conditions where Board of Directors members are dismissed before the end of their term objectively. What is meant by "corrective action" is an action taken by the Financial Services Authority to order the ITSK Organizer to cancel or annul the resignation made by the Board of Directors member. Paragraph (3) What is meant by "other conditions" is the resignation of Board of Directors members intended to release responsibility as a Board of Directors member in handling ITSK Organizer problems.
   Article 14
   It is clear enough.
   Article 15
   Paragraph (1)
   Letter a
   It is clear enough.
   Letter b
   Permanent impediments include among others:
   a. death; or b. mental disability or other conditions, which do not allow the individual to perform duties well.
   Letter c
   It is clear enough.
   Paragraph (2)
   The 6 (six) month period given includes the implementation of fitness and propriety assessments of Board of Directors members until appointment by the GMS.
   Paragraph (3)
   What is meant by statutory regulations is the law regarding limited liability companies.
   Paragraph (4)
   It is clear enough.
   Paragraph (5)
   It is clear enough.
   Article 16
   Paragraph (1)
   It is clear enough.
   Paragraph (2)
   It is clear enough.
   Paragraph (3)
   Supervisory actions determined by the Financial Services Authority include among others:
   a. setting a waiting period of more than 6 (six) months; and/or b. not approving or canceling the appointment of Board of Directors members who do not disclose Conflicts of Interest or potential Conflicts of Interest in the fitness and propriety assessment process. Paragraph (4) It is clear enough.
   Article 17
   It is clear enough.
   Article 18
   It is clear enough.
   Article 19
   Paragraph (1)
   Guidelines and work rules of the Board of Directors are also known as the Board of Directors Charter.
   Paragraph (2)
   Letter a
   It is clear enough.
   Letter b
   It is clear enough.
   Letter c
   It is clear enough.
   Letter d
   It is clear enough.
   Letter e
   Meeting arrangements include among others regulating meeting agendas, quorum requirements, decision-making, members' rights when there are differing opinions in decision-making, and meeting minutes. Letter f It is clear enough. Letter g It is clear enough. Letter h Work relationship patterns between the Board of Directors and Board of Commissioners include among others through meetings between the Board of Directors and Board of Commissioners.
   Article 20
   It is clear enough.
   Article 21
   Paragraph (1)
   It is clear enough.
   Paragraph (2)
   It is clear enough.
   Paragraph (3)
   The form of meetings is adjusted to the needs of ITSK Organizers, among others by using teleconference technology.
   Paragraph (4)
   It is clear enough.
   Article 22
   Paragraph (1)
   What is meant by "strategic policies and decisions" are Board of Directors decisions that can significantly affect the finances of the ITSK Organizer and/or have a continuous impact on budgets, human resources, organizational structure, and/or third parties. Paragraph (2) It is clear enough. Paragraph (3) It is clear enough. Paragraph (4) It is clear enough. Paragraph (5) It is clear enough. Paragraph (6) It is clear enough. Paragraph (7) Differing opinions are commonly known as dissenting opinions. Paragraph (8) It is clear enough. Paragraph (9) It is clear enough.
   Article 23
   It is clear enough.
   Article 24
   Letter a
   It is clear enough.

Letter b
It is clear enough.
Letter c
It is clear enough.
Letter d
What is meant by "other parties" is employees of the ITSK Organizer and/or other persons.
Article 25
Paragraph (1)
It is clear enough.
Paragraph (2)
ITSK Organizers may use other job titles for the Lead Commissioner, such as President Commissioner.
Paragraph (3)
Organizers may use other job titles for the Deputy Lead Commissioner, such as Vice President Commissioner.
Paragraph (4)
Examples of same types of ITSK:
alternative credit rating agencies with alternative credit rating agencies, financial service aggregation organizers with financial service aggregation organizers. Paragraph (5) It is clear enough.
Article 26
Paragraph (1)
Dismissal of Board of Commissioners members includes temporary dismissal of Board of Commissioners members. Restriction of authority of temporarily dismissed Board of Commissioners members is implemented in accordance with statutory regulations. This provision is intended so that in the dismissal or replacement of Board of Commissioners members of ITSK Organizers, it is not based on personal interests but rather focuses on the interests of the ITSK Organizer as the top priority. Paragraph (2) Letter a It is clear enough. Letter b Objective assessments regarding the management of ITSK Organizers include among others aspects of performance, integrity, financial reputation, and/or competence. Letter c It is clear enough. Letter d It is clear enough. Paragraph (3) The authority of the Financial Services Authority to conduct evaluations and order ITSK Organizers to take corrective actions, among others, in conditions where Board of Commissioners members are dismissed before the end of their term, where the dismissal process is indicated to be intended to obscure the violation conditions committed by the respective Board of Commissioners member, including suspected criminal acts.
Article 27
Paragraph (1)
Procedures for resignation of Board of Commissioners members are in accordance with statutory regulations and are stated in the Articles of Association of the ITSK Organizer. Paragraph (2) The authority of the Financial Services Authority to conduct evaluations and order ITSK Organizers to take corrective actions, among others, in conditions where Board of Commissioners members are dismissed before the end of their term objectively. What is meant by "corrective action" is an action taken by the Financial Services Authority to order the ITSK Organizer to cancel or annul the resignation made by the Board of Directors member. Paragraph (3) What is meant by "other conditions" is the resignation of Board of Commissioners members intended to release responsibility as a Board of Directors member in handling ITSK Organizer problems.
Article 28
It is clear enough.
Article 29
Paragraph (1)
See Explanation of Article 15 paragraph (1).
Paragraph (2)
The 6 (six) month period given includes the implementation of fitness and propriety assessments of Board of Commissioners members until appointment by the GMS.
Article 30
It is clear enough.
Article 31
It is clear enough.
Article 32
It is clear enough.
Article 33
It is clear enough.
Article 34
Paragraph (1)
Guidelines and work rules of the Board of Commissioners are also known as the Board of Commissioners Charter.
Paragraph (2)
Letter a
It is clear enough.
Letter b

It is clear enough.
Letter c
It is clear enough.
Letter d
See explanation of Article 19 paragraph (2) letter e.
Letter e
It is clear enough.
Letter f
It is clear enough.
Letter g
Work relationship patterns between the Board of Commissioners and Board of Directors include among others through meetings between the Board of Commissioners and Board of Directors.
Article 35
It is clear enough.
Article 36
It is clear enough.
Article 37
Paragraph (1)
Letter a
Effective implementation of Risk Management is part of the implementation of the 3 (three) lines Risk governance model (three lines model). The functions and roles of each line in the 3 (three) lines Risk governance model (three lines model) are as follows:
a. the first line as the Risk owning unit is the unit that directly identifies and manages Risk in business processes; b. the second line as the Risk Management and compliance function is the unit that measures, monitors, and treats Risk aggregately, and develops Risk Management and compliance methodologies and policies of ITSK Organizers; and
c. the third line as the internal audit function is the unit that ensures that Risk governance and control are effectively implemented by ITSK Organizers.
Letter b
It is clear enough.
Letter c
It is clear enough.
Paragraph (2)
It is clear enough.
Article 38
Paragraph (1)
It is clear enough.
Paragraph (2)
It is clear enough.
Paragraph (3)
Examples of other matters found by the internal audit function that can be reported directly to the Board of Commissioners are that the internal audit function finds indications of cyber attacks

and data leakage due to the lack of periodic penetration testing of systems. The internal audit function then reports these findings to the Board of Directors members. However, the Board of Directors member does not follow up on the internal audit function's findings due to a conflict of interest. The internal audit function in question may report these findings directly to the Board of Commissioners.

Paragraph (4)
Letter a
Audit is also known as examination.
What is meant by "examination" is general and/or special examinations, including those originating from the initiative of the ITSK Operator or the request of the Financial Services Authority.

Letter b
Sufficiently clear.

Letter c
In making analysis and assessments, the internal audit work unit or the function responsible for implementing internal audit among others identifies all possibilities to improve and increase the efficiency of resource and fund utilization.

Letter d
Sufficiently clear.

Letter e
Sufficiently clear.

Paragraph (5)
Sufficiently clear.

Paragraph (6)
Sufficiently clear.

Paragraph (7)
Sufficiently clear.

Paragraph (8)
Guidelines and rules of work for the internal audit function are also known as the internal audit charter.

Article 39
Paragraph (1)
Sufficiently clear.

Paragraph (2)
What is meant by "public accountant registered with the Financial Services Authority" includes among others public accountants in sectors other than ITSK, digital financial assets including crypto assets registered based on Financial Services Authority Regulations regarding the use of public accountants and public accounting firms in financial services activities.

Article 40
Paragraph (1)
The Conflict of Interest provision is intended so that shareholders, Board of Directors members, Board of Commissioners members, and employees of the ITSK Operator do not participate in making a decision in situations and conditions where there is a Conflict of Interest, but when a decision must still be made, the parties concerned must prioritize the economic interests of the ITSK Operator and avoid the ITSK Operator from losses that may arise or the possibility of reduced profits of the ITSK Operator, and disclose the Conflict of Interest condition in every decision.

Paragraph (2)
Sufficiently clear.

Paragraph (3)
Conflicts of Interest that have the potential to harm the ITSK Operator or reduce the profits of the ITSK Operator include among others giving special treatment to certain parties outside of procedures and regulations and giving interest rates that do not comply with procedures and regulations.

Paragraph (4)
Sufficiently clear.

Article 41
Letter a
What is meant by "other company" is a financial service institution or non-financial service institution inside or outside the country.

Letter b
Sufficiently clear.

Letter c
What is meant by "family relationship up to the second degree both horizontally and vertically" is the following parties:

1. biological/step/adopted parents;
2. biological/step/adopted siblings;
3. biological/step/adopted children;
4. biological/step/adopted grandparents;
5. biological/step/adopted grandchildren;
6. biological/step/adopted siblings of parents;
7. husband or wife;
8. parents-in-law or in-laws;
9. husband or wife of biological/step/adopted children;
10. grandparents of husband or wife;
11. husband or wife of biological/step/adopted grandchildren; and
12. biological/step/adopted siblings of husband or wife along with the husband or wife of the sibling in question.

Letter d
Sufficiently clear.

Article 42
Paragraph (1)
Letter a
Sufficiently clear.

Letter b
What is meant by "affiliation" is:
a. family relationship due to marriage or descent up to the second degree, both horizontally and vertically with employees, Board of Directors members, Board of Commissioners members, and/or shareholders of the ITSK Operator; b. relationship with the ITSK Operator due to the existence of one and/or more Board of Directors or Board of Commissioners members in common;
c. control relationship with the ITSK Operator both directly and indirectly;
d. share ownership relationship in the ITSK Operator of 20% (twenty percent) or more; and/or e. relationship between 2 (two) companies controlled, both directly and indirectly, by the same party.

Letter c
Sufficiently clear.

Letter d
What is meant "Other material information regarding the ITSK Operator" is shareholder intervention, internal disputes, and/or problems arising as a result of remuneration policies at the ITSK Operator.

Paragraph (2)
Sufficiently clear.

Article 43
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Prohibited actions include among others:

1. exploitation of loopholes in existing regulations or those not yet regulated that can imply an increase in overall Risk; and
2. massive recruitment of employees by the ITSK Operator originating from other ITSK Operators so as to disrupt the operational continuity of the ITSK Operator in question.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
Sufficiently clear.

Article 44
Sufficiently clear.

Article 45
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
The application of Good Corporate Governance is informed among others to shareholders.

Letter d
Disclosure and the form of accountability of the ITSK Operator regarding the use of Consumer Data include among others disclosure regarding the working method of data processing in providing services to user parties or Consumers, from input to output of ITSK activities, the accuracy level of methods, models, and/or innovations used to process alternative data, which aims to increase transparency and determine the accountability of the parties involved.

Article 46
Sufficiently clear.

Article 47
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Sufficiently clear.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
What is meant by "holiday" is national holidays, joint leave established by the central government, and/or local holidays established by the local government. What is meant by "day" is calendar day.

Paragraph (5)
Sufficiently clear.

Paragraph (6)
Sufficiently clear.

Paragraph (7)
Sufficiently clear.

Paragraph (8)
Sufficiently clear.

Article 48
Paragraph (1)
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
Sufficiently clear.

Letter d
What is meant "list of persons of good character" is a list of those who did not pass based on the mechanism and procedures for re-evaluation of Principal Parties.

Letter e
Sufficiently clear.

Paragraph (2)
Sufficiently clear.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
Sufficiently clear.

Paragraph (5)
Sufficiently clear.

Article 49
Paragraph (1)
The application of Risk Management including the application of anti-money laundering and counter-terrorism financing programs, and counter-proliferation financing of weapons of mass destruction programs as referred to in legislation regarding the application of anti-money laundering, counter-terrorism financing, and counter-proliferation financing of weapons of mass destruction programs in the financial services sector. To ensure the effective application of Risk Management, the Board of Directors and Board of Commissioners refer to the duties and responsibilities of the Board of Directors and Board of Commissioners.

Paragraph (2)
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
What is meant by "Risk Management information system" is a system that uses information technology and data processing to support decision-making in Risk Management.

Letter d
Sufficiently clear.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
Sufficiently clear.

Article 50
What is meant by "business complexity" among others is reflected in the diversity of business activities, products and/or services, and/or supporting technologies used. What is meant by "capability of the ITSK Operator" among others is financial capability, supporting infrastructure, and human resource capability.

Article 51
Letter a
Strategic Risk arises among others because:
a. The ITSK Operator sets strategies that are less aligned with the vision and mission of the ITSK Operator; b. The ITSK Operator conducts an environmental analysis that is not comprehensive;
c. There is a mismatch of strategic plans between strategic levels; and
d. Failure to anticipate changes in the business environment such as technological changes, macroeconomic condition changes, market competition, and changes in relevant authority policies.

Letter b
Examples of Operational Risk:
systems that are unable to manage business activities, employees who are inadequately trained, no plan to face operational disasters, inadequate operational security, Risk related to the use of third-party services, anti-money laundering, counter-terrorism financing and counter-proliferation financing of weapons of mass destruction, Consumer data protection Risk.

Letter c
Examples of Cyber Risk:
Distributed Denial of Service (DDoS) attacks, malware, phishing, and software piracy.

Letter d
Legal Risk arises among others due to the absence of supporting legislation or weaknesses in agreements such as the failure to meet the validity requirements of contracts.

Letter e
Sufficiently clear.

Letter f
Reputational Risk arises among others due to media reports and/or rumors regarding the ITSK Operator that are negative, as well as ineffective communication strategies of the ITSK Operator.

Article 52
What is meant by "every job level" is the Board of Directors, Board of Commissioners, and all other positions related to the application of Risk Management.

Article 53
Paragraph (1)
Letter a
Including in Risk Management policies and strategies is the establishment and approval of Risk limits both overall (composite) Risk, per type of Risk, per functional activity, or per material/significant transaction.

Letter b
Sufficiently clear.

Letter c
Transactions requiring Board of Directors approval include among others transactions that have exceeded the authority of the ITSK Operator official one level below the Board of Directors, in accordance with the internal policies and procedures of the ITSK Operator in force.

Letter d
The development of a Risk Management culture among others includes adequate communication to all levels of the organization about the importance of effective internal controls.

Letter e
Improvement of human resource competence among others through continuous education and training programs regarding the application of Risk Management.

Letter f
What is meant by independent among others is the separation of functions between the Risk Management function that performs identification, measurement, monitoring, and control of Risk with the function that conducts and completes business and operational activities.

Letter g
Periodic review among others is intended to anticipate if there are changes in external factors and internal factors.

Paragraph (2)
The frequency of periodic evaluation is adjusted to the needs of the ITSK Operator while considering the size and complexity of the ITSK Operator. In the event that there are internal and/or external factors that significantly affect the business activities of the ITSK Operator, the ITSK Operator may conduct evaluation of Risk Management policies and strategies outside of periodic evaluation.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
Sufficiently clear.

Paragraph (5)
Sufficiently clear.

Article 54
Paragraph (1)
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
What is meant by "transactions and Risk limits requiring Board of Commissioners approval" among others are business or operational activities that have exceeded the authority of the Board of Directors to decide on the matter, in accordance with the internal policies and procedures of the ITSK Operator in force.

Paragraph (2)
Sufficiently clear.

Paragraph (3)
Sufficiently clear.

Article 55
Risk Management policies are established among others by formulating Risk Management strategies to ensure that:
a. The ITSK Operator continues to maintain Risk exposure in accordance with the internal policies and procedures of the ITSK Operator and legislation and other regulations; and b. The ITSK Operator is managed by human resources who have knowledge, experience, and expertise in the field of Risk Management in accordance with the business complexity of the ITSK Operator. The formulation of Risk Management strategies is done by considering the financial conditions of the ITSK Operator, the organization of the ITSK Operator, and Risks arising as a result of changes in external factors and internal factors.

Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
The level of Risk to be taken (risk appetite) considers the experience owned by the ITSK Operator in managing Risk and the capital capability of the ITSK Operator in absorbing Risk. Risk Tolerance (risk tolerance) is the potential loss that can be absorbed by the capital of the ITSK Operator.

Letter d
The establishment of Risk rating assessment is the basis for ITSK to categorize Risk ratings.
Risk ratings for ITSK Operators are categorized into 5 (five) ratings, namely:

1. rating 1 (low);
2. rating 2 (low-medium);
3. rating 3 (medium);
4. rating 4 (medium-high); and
5. rating 5 (high).

Letter e
What is meant by "emergency plan" is a plan to develop scenarios to anticipate internal disruptions including system failures and external disruptions that cause emergency conditions that can cause operational disruptions of the ITSK Operator. The formulation of emergency plans is known as the term contingency plan. The worst-case condition is known as the term worst-case scenario.

Letter f
Sufficiently clear.

Article 56
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
Adequate documentation is done with written, complete, accurate, current, and intact documentation so as to facilitate the ability to conduct an audit trail for the internal control purposes of the ITSK Operator.

Paragraph (3)
Letter a
What is meant by "overall limit" is the Risk limit that can be tolerated by the ITSK Operator for all Risks applied.

Letter b
What is meant by "limit per type of Risk" is the Risk limit that can be tolerated by the ITSK Operator for each type of Risk.

Letter c
What is meant by "limit per specific functional activity" is the Risk limit that can be tolerated by the ITSK Operator for each functional activity.

Article 57
Paragraph (1)
Risk factors are various parameters that affect Risk exposure.
Material Risk factors are Risk factors, both quantitative and qualitative, that have a significant impact on the financial conditions of the ITSK Operator.

Paragraph (2)
Letter a
Sufficiently clear.

Letter b
What is meant by "informative" among others is easy to understand.

Letter c
What is meant by "having competence in the field of Risk Management" among others has:
a. expertise certificates in the field of Risk Management; b. experience in the field of Risk Management; and/or
c. adequate experience in the field of related financial service institutions.

Article 58
Paragraph (1)
The Risk identification process among others can be based on the loss experience of the ITSK Operator that has occurred.

Paragraph (2)
To implement Risk measurement, the ITSK Operator can use various approaches, both qualitative and quantitative, adjusted to the business objectives, and the complexity of the ITSK Operator's business.

Letter a
Sufficiently clear.

Letter b
What is meant by "changes in the business activities of the ITSK Operator and material Risk factors" is changes in the business activities of the ITSK Operator and Risk factors that are quantitative or qualitative, which can affect the financial conditions of the ITSK Operator.

Paragraph (3)
What is meant by "endangering the continuity of the ITSK Operator's business" includes Risks that have the potential to endanger the continuity of the ITSK Operator's business. Risk control is done among others by hedging, Risk mitigation methods, and capital addition to absorb potential losses.

Paragraph (4)
Letter a
Evaluation of Risk exposure is done by monitoring and reporting of material Risk or Risk that impacts the capital/funding conditions of the ITSK Operator, which among others is based on the assessment of potential Risk using historical trends.

Letter b
Sufficiently clear.

Article 59
Paragraph (1)
What is meant by "having competence in the field of Risk Management information systems" is having competence in the field of Risk Management information systems among others having expertise certificates and/or proof of having followed training in the field of Risk Management information systems.

Paragraph (2)
Letter a
Risk exposure reports or information cover quantitative and qualitative exposure, overall (composite) as well as details per type of Risk and per type of functional activity.

Letter b
Sufficiently clear.

Letter c
Sufficiently clear.

Paragraph (3)
What is meant by "periodically" is the frequency of reports or information submitted to the Board of Directors adjusted to the needs of the ITSK Operator.

Article 60
An effective internal control system becomes the responsibility of all parties involved in the ITSK Operator organization, among others the Board of Commissioners, Board of Directors, Risk Management function, internal audit function, and employees.

Article 61
Paragraph (1)
What is meant by "timely" is the condition before the occurrence of weaknesses and deviations that cause or affect Risk exposure.

Paragraph (2)
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
Complete, accurate, useful, and timely financial and management information is needed in order to make appropriate and accountable decisions, and communicated to interested parties.

Letter d
Effectiveness and efficiency in business and operational activities among others are needed to protect assets and other resources of the ITSK Operator from related Risks.

Letter e
The effectiveness of Risk culture (risk culture) is intended to identify weaknesses and deviations earlier and continuously reassess the fairness of existing policies and procedures at the ITSK Operator.

Article 62
Sufficiently clear.

Article 63
Sufficiently clear.

Article 64
Paragraph (1)
The ITSK Operator determines the appropriate organizational structure in accordance with the conditions of the ITSK Operator, including financial capability and human resources. The establishment of the Risk Management function is adjusted to the size and complexity of the ITSK Operator's business activities and must be accompanied by clear authority and responsibility.

Paragraph (2)
The meaning of independence among others is reflected in:
a. separation of functions and duties between the Risk Management function and the business and operational (risk-taking) function and the internal control function; and b. decision-making process that is impartial or does not benefit a specific business and operational function or ignores other operational functions. Internal control can be carried out by the internal audit work function.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
The authority and responsibility of the Risk Management work unit or Risk Management function are adjusted to the business objectives and business complexity of the ITSK Operator.

Letter a
Risk identification includes coordinating with all work units present in the ITSK Operator.

Letter b
Sufficiently clear.

Letter c
Sufficiently clear.

Letter d
Overall (composite) Risk is the Risk faced by the ITSK Operator by considering all types of Risk at the ITSK Operator in question.

Letter e
Review among others is conducted based on internal audit findings and/or the development of Risk Management practices that are internationally applicable.

Letter f
Included in the review among others is the assessment of the ITSK Operator's capability to carry out business development or expansion activities and the review of proposed system and procedure changes.

Letter g
Models for internal purposes are known as the term internal model.

Letter h
Recommendations among others contain recommendations related to the amount or maximum Risk exposure that must be maintained by the ITSK Operator.

Letter i
Risk Profile is a comprehensive overview of the magnitude of potential Risk inherent in the entire portfolio or exposure of the ITSK Operator.
The frequency of report submission can be increased in the event that market conditions change rapidly.

Paragraph (5)
Sufficiently clear.

Article 65
Paragraph (1)
The submission of Risk exposure information periodically is adjusted to the characteristics of the type of Risk.

Paragraph (2)
Sufficiently clear.

Article 66
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
The trial period is intended to ensure that Risk measurement and monitoring methods have been tested.

Letter d
Sufficiently clear.

Letter e
Sufficiently clear.

Letter f
Sufficiently clear.

Paragraph (3)
Letter a
Criteria for never having been done before among others are business activities that have been carried out by other ITSK Operators but have never been done by the ITSK Operator in question, referring to the respective legislation of each ITSK Operator.

Letter b
Sufficiently clear.

Paragraph (4)
Sufficiently clear.

Article 67
Categories of actions to approve among others include knowing but not prohibiting or allowing the occurrence of activities that are not the business activities of the ITSK Operator using the facilities or facilities of the ITSK Operator by the Board of Directors, Board of Commissioners, and/or employees.

Article 68
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Self-assessment of the Risk profile at any time among others occurs when the ITSK Operator carries out new business activities and affects the Risk profile that has been submitted in previous periods.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
Sufficiently clear.

Paragraph (5)
Sufficiently clear.

Article 69
Paragraph (1)
Sufficiently clear.

Paragraph (2)
The Risk Profile Report replaces the application of Risk Management and prudence which is part of the semi-annual report as referred to in Article 40 paragraph (3) letter b of the Financial Services Authority Regulation regarding alternative credit rating agencies and Article 39 paragraph (2) letter c of the Financial Services Authority Regulation regarding financial service aggregation operators.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
See Explanation of Article 47 paragraph (4).

Paragraph (5)
Sufficiently clear.

Paragraph (6)
Sufficiently clear.

Paragraph (7)
Sufficiently clear.

Paragraph (8)
Sufficiently clear.

Article 70
Paragraph (1)
What is meant by "conditions with the potential to cause significant loss to financial conditions" is a condition that has the potential to reduce profits thereby causing losses to the ITSK Operator.

Paragraph (2)
Example:
The ITSK Operator has an increased potential for Reputational Risk due to deviations (fraud) committed by the Board of Directors and news related to the deviation (fraud) is published in local mass media and there are Consumer complaints that are estimated to affect the reputation of the ITSK Operator. Information and data can be and/or sourced from events, actions, and/or other matters.

Paragraph (3)
Example:
The ITSK Operator knows of an increase in potential Reputational Risk on March 1, 2026. With the aforementioned condition, the ITSK Operator is required to submit another Risk Profile Report no later than April 1, 2026.

Paragraph (4)
The basis for the request of the Financial Services Authority among others is that the Financial Services Authority identifies the existence of other Risk exposures that have the potential to cause significant loss to the financial conditions of the ITSK Operator.

Paragraph (5)
See Explanation of Article 47 paragraph (4).

Paragraph (6)
Sufficiently clear.

Article 71
Sufficiently clear.

Article 72
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Example of data and information related to the application of Risk Management: guidelines for the application of Risk Management.

Article 73
Paragraph (1)
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
Sufficiently clear.

Letter d
See the explanation of Article 48 paragraph (1) letter d.

Letter e
Sufficiently clear.

Paragraph (2)
Sufficiently clear.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
Sufficiently clear.

Paragraph (5)
Sufficiently clear.

Article 74
Sufficiently clear.

Article 75
Sufficiently clear.

Article 76
Certain considerations are based, among others, on industry developments, changes in risk regarding products, services, and activities, the condition of Financial Sector Technology Innovation Providers (FTIP), and other significant conditions that affect the implementation of FTIP.

Article 77
It is sufficiently clear.

Article 78
It is sufficiently clear.

Article 79
It is sufficiently clear.

Article 80
It is sufficiently clear.

ADDITION TO THE STATE GAZETTE OF THE REPUBLIC OF INDONESIA NUMBER ⸙