Implementation of Information Technology Risk Management by Non-Bank Financial Service Institutions

To:

Board of Directors of Insurance Companies;
Management and Acting Management of Pension Funds;
Board of Directors of Financing Institutions;
Board of Directors of Pawnshop Companies;
Board of Directors of Guarantee Institutions;
Board of Directors of Technology-Based Money Lending Service Providers;
Executive Director of the Indonesian Export Financing Institution;
Board of Directors of Secondary Housing Financing Companies;
Board of Directors of Social Security Guarantee Organizations; and
Board of Directors of PT Permodalan Nasional Madani (Persero),
At their respective locations.

COPY
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 22 /SEOJK.05/2021 CONCERNING THE IMPLEMENTATION OF INFORMATION TECHNOLOGY RISK MANAGEMENT BY NON-BANK FINANCIAL SERVICE INSTITUTIONS

In accordance with the mandate of Article 33 of Financial Services Authority Regulation Number 4/POJK.05/2021 concerning the Implementation of Information Technology Risk Management by Non-Bank Financial Service Institutions (State Gazette of the Republic of Indonesia Year 2021 Number 78, Supplement to the State Gazette of the Republic of Indonesia Number 6668), it is necessary to regulate further provisions regarding the implementation of information technology risk management by non-bank financial service institutions in this Financial Services Authority Circular as follows:

I. GENERAL PROVISIONS
In this Financial Services Authority Circular, the following definitions apply:

Non-Bank Financial Service Institution, hereinafter referred to as LJKNB, is an institution that conducts activities in the insurance, pension fund, financing institution, and other financial service sectors.
Information Technology is a technique to collect, prepare, store, process, announce, analyze, and/or disseminate information.
Electronic Financial Service is a service for consumers to obtain information, communicate, and conduct financial transactions through electronic media.
Electronic System is a series of electronic devices and procedures that function to prepare, collect, process, analyze, store, display, announce, send, and/or disseminate electronic information.
Data Center is a facility used to place an Electronic System and its related components for the purposes of placement, storage, and data processing.
Disaster Recovery Center is a facility used to restore data or information and important functions of an Electronic System that are disrupted or damaged due to disasters caused by nature or humans.
Database is a comprehensive set of data arranged systematically, accessible by users according to their respective authorities, and managed by a Database Administrator.
Disaster Recovery Plan is a document containing plans and steps to replace and/or restore access to data, hardware, and software required, so that LJKNB can carry out critical business operational activities after a disruption and/or disaster.
Board of Directors is a corporate organ authorized and fully responsible for managing the corporation for the interests of the corporation, in accordance with the purpose and objectives of the corporation, and representing the corporation, both in and out of court, in accordance with the articles of association for LJKNB in the form of a limited liability company or equivalent to the Board of Directors for LJKNB in the form of a cooperative legal entity, joint venture, pension fund, Indonesian Export Financing Institution, social security guarantee organization, or limited partnership company.
Board of Commissioners is a corporate organ tasked with conducting general and/or specific supervision in accordance with the articles of association and providing advice to the Board of Directors for LJKNB in the form of a limited liability company or equivalent to the Board of Commissioners for LJKNB in the form of a cooperative legal entity, joint venture, pension fund, Indonesian Export Financing Institution, social security guarantee organization, or limited partnership company.

II. SCOPE OF NON-BANK FINANCIAL SERVICE INSTITUTIONS
LJKNB as referred to in Section I number 1 includes:

Insurance companies, consisting of:
a. insurance companies; b. reinsurance companies;
c. sharia insurance companies;
d. sharia reinsurance companies; e. insurance brokerage companies; f. reinsurance brokerage companies; and g. insurance loss assessor companies, as referred to in legislation concerning insurance;
Pension funds as referred to in legislation concerning pension funds;
Financing institutions, consisting of:
a. financing companies; b. sharia financing companies;
c. venture capital companies;
d. sharia venture capital companies; and e. infrastructure financing companies, as referred to in legislation concerning financing institutions;
Other financial service institutions, consisting of:
a. pawnshop companies as referred to in legislation concerning pawnshops; b. guarantee institutions, consisting of
1. guarantee companies;
2. sharia guarantee companies;
3. re-guarantee companies; and
4. sharia re-guarantee companies,
  as referred to in legislation concerning guarantees;
  c. technology-based money lending service providers as referred to in legislation concerning technology-based money lending services;
  d. Indonesian Export Financing Institutions as referred to in legislation concerning Indonesian Export Financing Institutions; e. secondary housing financing companies as referred to in legislation concerning secondary housing financing companies; f. social security guarantee organizations as referred to in legislation concerning social security guarantee organizations; and g. PT Permodalan Nasional Madani (Persero) as referred to in legislation concerning PT Permodalan Nasional Madani (Persero), which utilize Information Technology in conducting business.

III. SCOPE OF INFORMATION TECHNOLOGY RISK MANAGEMENT

The implementation of information technology risk management covers at least:
a. active oversight by the Board of Directors and Board of Commissioners; b. adequacy of policies and procedures for the use of Information Technology;
c. adequacy of processes for identifying, measuring, controlling, and monitoring information technology usage risks; and
d. internal control systems regarding the use of Information Technology.
The implementation of risk management as referred to in number 1 is carried out in an integrated manner in every stage of Information Technology usage, from the planning, procurement, development, operational, maintenance, to the cessation and deletion of Information Technology resources.
The implementation of information technology risk management as referred to in number 1 must be adjusted to the purpose, business policies, size, and complexity of the LJKNB's business.
The implementation of information technology risk management as referred to in number 1 is manifested in good documentation of at least the following aspects:
a. organization and management supporting the implementation of information technology risk management; b. application of risk management components in the use of Information Technology;
c. policies and procedures for the use of Information Technology;
d. application architecture; e. application list; f. communication network; g. Data Center and Disaster Recovery Center; h. Information Technology security;
i. Disaster Recovery Plan;
j. Information Technology service providers; and k. Information Technology costs.
The documentation as referred to in number 4 is prepared in accordance with formats 1 through 11 contained in the Appendix, which is an integral part of this Financial Services Authority Circular.

IV. ACTIVE OVERSIGHT BY THE BOARD OF DIRECTORS AND BOARD OF COMMISSIONERS

LJKNB must establish clear authority and responsibility of the Board of Directors, Board of Commissioners, and officials at every level of position related to the use of Information Technology in writing.
For LJKNB that has an Information Technology oversight committee, the execution of the duties and responsibilities of the Information Technology oversight committee is manifested through regular meetings documented in meeting minutes.
Regular meetings as referred to in number 2 may involve relevant working units within LJKNB and can be conducted physically or virtually.
The Information Technology steering committee establishes the time frame for regular meetings as referred to in number 3 in written policies.

V. ADEQUACY OF POLICIES AND PROCEDURES FOR THE USE OF INFORMATION TECHNOLOGY

Policies and procedures for the use of Information Technology must contain at least the following aspects:
a. management; b. development and procurement;
c. Information Technology operations;
d. communication network; e. information security; f. Disaster Recovery Plan; g. use of Information Technology service providers; and h. Electronic Financial Services, for LJKNB that provide Electronic Financial Services.
Policies and procedures for the management aspect as referred to in number 1 letter a must consist of at least:
a. risk awareness regarding the provision of Information Technology from management; b. clear understanding of the risk level to be taken (risk appetite), risk tolerance, and risk limits of LJKNB;
c. understanding of legislation concerning Information Technology; and
d. transparency and responsibility regarding significant risks of each aspect related to the provision of Information Technology.
Policies and procedures for the development and procurement aspect as referred to in number 1 letter b include:
a. development stages:
1. initiation and planning;
2. definition of user needs;
3. system design;
4. programming;
5. testing;
6. implementation;
7. post-implementation review;
8. maintenance; and
9. destruction; and
  b. procurement stages:
10. procurement guidelines;
11. purchase and license contracts;
12. maintenance;
13. warranty;
14. dispute resolution;
15. contract amendments;
16. security; and
17. subcontracting of activities to third parties.
The initiation and planning stage as referred to in number 3 letter a number 1) must consist of at least:
a. Preparation of a proposal containing:
1. plans to add, refine, or improve a system;
2. expected objectives and benefits;
3. risk analysis and handling;
4. explanation of how the system to be developed can support the business development of LJKNB;
5. achievement of LJKNB's business objectives; and
6. protection of LJKNB consumers;
  b. evaluation by management and the Information Technology operating working unit;
  c. principle approval by management, the highest official of the Information Technology operating working unit, and/or the highest official of the Information Technology user working unit regarding plans for new system development and/or system changes;
  d. feasibility study, which includes considerations of LJKNB's business, functional needs, implementation schedule, factors affecting development, and cost-benefit analysis; and e. approval and signing of the feasibility study document by management, the highest official of the Information Technology operating working unit, and/or the highest official of the Information Technology user working unit.
The user needs definition stage as referred to in number 3 letter a number 2) must consist of at least:
a. needs collection, which is a process of collecting information, either through interviews, research, or filling out specific forms, regarding the objectives of system development, desired output, system capabilities to accommodate business process needs and system working mechanisms, and system usage procedures; b. needs analysis, which is a process of understanding problems and needs to determine solutions that can be developed;
c. needs specification, which is a process to describe the functionality of the system to be developed, process or procedure specifications, and existing systems, both in terms of software and supporting hardware as well as Database design; and
d. needs management, which is a process to identify, control, and store every change to needs during the system development process.
The system design stage as referred to in number 3 letter a number 3) is a process of converting identified information needs, functions, and infrastructure during the initiation and planning stage into design specifications or designs that form the basis for system development. During the system design stage, control must be exercised over aspects including authorized, accurate, complete, and secure input information, processes, and output.
The programming stage as referred to in number 3 letter a number 4) must consist of at least:
a. programming standards, which include the elaboration of programmer responsibilities and the rights of parties directly involved in the programming process, namely by:
1. limiting access to data, programs, utilities, and systems outside their responsibility, including through library management controls 1; and
2. version control, which is a method that systematically stores the chronology of improved program copies and serves as one of the documents in the provision of development;
  b. documentation conducted on systems developed independently and systems purchased or developed by Information Technology service providers, which includes detailed application descriptions, programming documentation, formats used, naming standards, and implementation instructions for end-users.
The testing stage as referred to in number 3 letter a number 5) includes among others:
a. unit test, which is a trial conducted by the developer on the functionality of each unit or sub-module of the system that has been fully developed; b. system integration test, which is testing conducted by the developer on the overall functionality of the system after being integrated into a complete whole;
c. stress test, which is a resilience test conducted by the developer on the system's ability to handle processes or transactions on a large scale or quantity, with further criteria regarding processes or transactions on a large scale or quantity to be determined further by LJKNB; and
d. user acceptance test, which is a final trial conducted by the end-user on the system that has been fully developed to test the functionality of the entire system, whether it has met the user needs defined in the user needs definition stage before deciding that implementation can be carried out.
In the event that the results of testing at the user acceptance test stage as referred to in number 8 letter d have met user needs and LJKNB's security standards, a minutes of the test approved by the end-user must be created.
The implementation stage as referred to in number 3 letter a number 6) must consider among others:
a. program integrity checks, which are adequate controls over the conversion from source code to the system to be implemented; b. data migration from the old system to the new system;
c. checks on the accuracy and security of migrated data in the new system;
d. the possibility of implementing a parallel run 2 between the old and new systems, until it is certain that the data in the new system is accurate and reliable; e. certainty of data integrity, namely the accuracy and reliability of the Database, including data stored within it; f. direct data and reference repairs (patching data) during implementation must be avoided as it can affect data integrity in the production server Database; g. storage arrangements for source code and Database from the old system; and h. anticipation of weaknesses in the operating system, developed systems, Database, and network, including threats from unauthorized parties such as viruses 3, trojan horses 4, worms 5, spyware 6, Denial-of-Service (DoS) 7, wardriving, spoofing 8, and logic bombs 9, by testing and applying security controls over the system to be implemented.
The post-implementation review stage as referred to in number 3 letter a number 7) includes analysis of:
a. the effectiveness of project management activities by comparing among others plans and actual costs, benefits obtained, and project schedule accuracy; and b. system performance, problems encountered, and steps taken to resolve those problems.
The results of the analysis as referred to in number 11 are documented and reported to management.
The maintenance stage as referred to in number 3 letter a number 8) is conducted to establish maintenance methodologies appropriate to the characteristics and risks of each project of the systems owned by LJKNB.
The destruction stage as referred to in number 3 letter a number 9) is the final process of system development by deleting or destroying systems, including data that are no longer used, to avoid misuse by unauthorized parties.
Procurement guidelines as referred to in number 3 letter b number 1) must consider among others:
a. submission or proposal of procurement plans to obtain management approval, which must contain at least analysis of user needs regarding the expected objectives and benefits, cost-benefit analysis, and the benefits of the system to be procured to support LJKNB's business needs; b. the suitability of Information Technology service providers, contracts, licenses, and products obtained with LJKNB's Information Technology provision needs;
c. the suitability of specifications offered by Information Technology service providers with the specifications of Information Technology provision needs at LJKNB;
d. comparison of offers submitted among Information Technology service providers; and e. the financial condition of Information Technology service providers and the commitment of Information Technology service providers to the services provided to LJKNB.
Purchase and license contracts as referred to in number 3 letter b number 2) must consider among others:
a. written explanation that the use of software is exclusive or not; b. information and the number of users who can use the software;
c. a list of other related entities that can use the software, such as subsidiaries or corporate groups;
d. information regarding software development in-house or outsourcing by Information Technology service providers, and whether software purchases include source code or not, or are only usage rights or rentals with time or feature restrictions; and e. usage location, whether the license usage location is limited to a specific location or not.
Maintenance as referred to in number 3 letter b number 3) covers at least:
a. training by Information Technology service providers to LJKNB; b. Information Technology service providers providing software documentation, including technical instructions for using the software;
c. implementation and costs for software updates and/or modifications;
d. the possibility for LJKNB to access source code in the event that Information Technology service providers can no longer provide services or there is a need for modifications that cannot be performed by Information Technology service providers; and e. the possibility for Information Technology service providers to assist in the data conversion process during system replacement in the future.
Warranty as referred to in number 3 letter b number 4) has aspects covering at least:
a. not violating the intellectual property rights of other parties, both domestically and internationally; b. not containing secret codes, undisclosed restrictions, or automatic restrictions in the agreement;
c. functioning according to specifications and must state the limitations of the responsibility of Information Technology service providers in the event of problems;
d. maintenance is carried out by Information Technology service providers during the agreed period; and e. remains valid in the event of mergers, consolidations, takeovers, or changes in ownership, both for LJKNB or Information Technology service providers.
Dispute resolution as referred to in number 3 letter b number 5) covers at least dispute resolution clauses in license agreements between LJKNB and Information Technology service providers.
Contract amendments as referred to in number 3 letter b number 6) must be based on agreements containing clauses that clearly state that Information Technology service providers

--- Footnotes ---

A collection of software or data with specific functions, stored and ready for use.
One of the system implementation strategies where both old and new systems run side-by-side until users are sure that the new system has no problems. After a period of time when the new system is proven to work correctly, the old system will be completely deleted and users will rely solely on the new system.
Malicious programs that become active with the assistance of a person (executed) and cannot replicate their own spread, as it is done by a person, usually through email attachments, games, or pirated programs.
Malicious programs inserted by hackers into programs already known to users; their replication or distribution must be activated by programs already known to users through social engineering methods.
Computer programs designed to replicate themselves automatically and attached to emails or as part of network messages.
Software that collects sensitive information about users without the user's knowledge or consent.
Attacks on information technology systems causing them to become slow or completely non-functional, for example, by making network bandwidth or computer disk space appear to be fully used, server disruptions, and service disruptions to other systems or users.
A state where a person or program can impersonate another person or program by falsifying data for the purpose of obtaining certain benefits.
Code intentionally inserted into a software system that, under certain conditions, performs a series of destructive functions.

cannot modify the agreement without the consent of both parties.

Security as referred to in item 3 letter b item 7) includes at least:
a. continuous responsibility of the Information Technology service provider to protect the security and confidentiality of Information Technology resources and LJKNB data; b. prohibition for the Information Technology service provider to use or disclose information owned by LJKNB without LJKNB's consent;
c. assurance from the Information Technology service provider that the software does not contain features that can access the system and/or data without authentication process (back door 10) that allows access by unauthorized parties to LJKNB's system and data; and
d. an explicit statement that the Information Technology service provider will not use features that could cause the software to malfunction.
The transfer of some activities (subcontracting) to other parties as referred to in item 3 letter b item 8) includes at least clauses stating that the Information Technology service provider:
a. can only transfer some activities (subcontracting) to third parties based on LJKNB's consent, evidenced by written documents; and b. is responsible for the software even if the software is designed and/or developed by other parties.
Policies and procedures for IT operational aspects as referred to in item 1 letter c include at least:
a. Data management policies and procedures, which consist of at least:

Data Center management, for LJKNB subject to the obligation of Data Center ownership;
Disaster Recovery Center management, for LJKNB subject to the obligation of Disaster Recovery Center ownership; and
Database management;
b. Policies and procedures related to change management, which consist of at least:
Change control, meaning that every change in Information Technology resources that occurs and/or is likely to occur must be well controlled through coordinated supervision functions involving relevant work units;
Software update management, meaning that LJKNB must have complete documentation of the latest software installations performed so that it can know the latest information regarding product fixes, security issues, patch 11, or upgrades, or other issues relevant to the software version used; and
Data migration, in the event that LJKNB makes fundamental or major changes to software and/or hardware that result in data migration, LJKNB needs to have policies and procedures regarding data migration handling;
c. Incident or problem handling, where LJKNB must maintain the necessary facilities to handle problems, which consist of at least:
helpdesk function, tasked with responding to and handling IT-related problems at LJKNB; and
handling of super user 12 usage, namely users who have very broad authority, which contains at least regarding:

10 Method to bypass normal authentication or secure remote access from a computer to access a system but not identified through normal inspection.

determination and criteria of parties having super user access rights;
super user password 13 management mechanism, which includes storage and password replacement;
d. Information exchange control, which consists of at least:
requests and provision of information by internal and external parties; and
sending information through media such as electronic mail, flash drives, compact disks, hardcopy copies;
e. Quality control function, which functions to assess the quality of software and hardware; and f. Mechanism for destruction and deletion of software and hardware.

In formulating policies and procedures regarding Data Center management as referred to in item 23 letter a item 1), LJKNB must pay attention to the following:
a. the building must:

be located in a geographically safe area; and
have adequate road access;
b. physical access to the Data Center must be limited and well controlled;
c. environmental factor control, including:
ensuring the availability of sufficient, stable electricity sources, and the availability of alternative electricity sources to anticipate the failure of the main electricity source;
ensuring the availability of fire and smoke detectors, fire extinguishers, temperature and humidity measuring instruments, and water drainage pipes;
paying attention to spatial arrangement, including:
a) avoiding placing rooms under piping areas such as bathrooms and kitchens;

11 A set of code added to software to fix an error, usually a temporary correction between two software version releases.

b) avoiding the use of room windows that directly face sunlight, unless the room windows have adequate covering media to prevent sunlight exposure into the room; c) the use of raised floors; d) availability of emergency doors; and e) management of support equipment such as the availability of racks with non-flammable materials, placement of cables and other network infrastructure, and others; d. Data Center operational activities, including:

scheduling tasks to be carried out at the Data Center must be ensured to run effectively and safely from unauthorized changes;
task operation by Information Technology operators must be limited according to authority;
distribution of information produced by the system (output) must be done safely to avoid the opening of confidential information;
backup process;
monitoring of hardware and software; and
activation of audit trails, and
e. agreements with Information Technology service providers, in the event that the provision and management of Data Centers are carried out by Information Technology service providers, concerning the performance, reputation of the service provider, and continuity of service provision.

In formulating policies and procedures regarding Disaster Recovery Center management as referred to in item 23 letter a item 2), LJKNB must pay attention to the following:
a. the placement of the Disaster Recovery Center is not located in earthquake, flood, or lightning-prone areas and is connected to communication and electricity infrastructure different from the Data Center, as well as other facilities necessary for the continued operation of the system; b. the system at the Disaster Recovery Center must be compatible with the system used at the Data Center and must be adjusted if there are changes at the Data Center;
c. considering the travel time to ensure the recovery process; and
d. agreements with Information Technology service providers, in the event that the provision and management of Disaster Recovery Centers are carried out by Information Technology service providers, concerning the performance, reputation of the service provider, and continuity of service provision.
In formulating policies and procedures regarding Database management as referred to in item 23 letter a item 3), LJKNB must pay attention to the following:
a. the availability of human resources with competence in Database management, specifically regarding access, maintenance, problem handling, and Database administration; and b. the existence of a data backup mechanism where:

the data backup location must be stored in a safe environment and have a location different from the Data Center location;
data backup is done comprehensively (full system backup) and periodically or done in the event of fundamental system changes;
data backup must meet adequate system security standards;
periodic restore tests must be conducted to ensure that data backups can be used when needed (emergency conditions); and
there is a mechanism for the destruction and/or deletion of data backup media.

Policies and procedures for communication network aspects as referred to in item 1 letter d include at least:
a. network performance measurement and capacity planning; b. network security;
c. network management;
d. network problem handling procedures; e. network communication usage mechanism, including internet, intranet, and wireless networks; f. problem resolution procedures; g. facilities for backup and recovery; and h. agreements and contracts containing fulfillment of service levels in accordance with the service level agreement with Information Technology service providers, in the event that the provision and management of communication networks are carried out by Information Technology service providers.
Information security policies as referred to in item 1 letter e include at least:
a. information security objectives; b. management commitment to information security;
c. framework for establishing controls and handling information security problems;
d. compliance with internal regulations and legislation regarding information security; e. training and increasing awareness of the importance of information security; f. duties and responsibilities of parties in information security; g. analysis of the impact of information security on the continuity of LJKNB's business and operations; h. sanctions for violations of information security policies; and
i. documents or other regulations supporting information security policies.
Information security procedures as referred to in item 1 letter e include at least:
a. asset management, which includes at least:

LJKNB assets related to information are identified, owners/responsible parties are determined, and recorded so that they can be protected appropriately;

12 User id that has very broad authority.

assets related to information can be data (hardcopy or softcopy), software, hardware, networks, support equipment (e.g., electricity resources and air conditioners), and human resources including qualifications and skills; and
information must be classified so that adequate protection can be carried out according to its classification. Examples of classification:
a) confidential information, e.g., consumer data and/or personal information; b) internal information, e.g., regulations regarding personnel; and c) ordinary information, e.g., financial product information offered to consumers; b. Human resource management, which includes at least:
human resources, whether LJKNB employees, consultants, honorary employees, and employees from Information Technology service providers who have access to information, must understand their responsibilities regarding information security;
the roles and responsibilities of human resources, whether LJKNB employees, consultants, honorary employees, and employees from Information Technology service providers who have access to information, must be defined and documented in accordance with information security policies;
in cooperation agreements or contracts with LJKNB employees, consultants, honorary employees, and employees from Information Technology service providers, provisions regarding information security in accordance with LJKNB's information security policies must be included. As an example, there needs to be a clause stating that LJKNB employees, consultants, honorary employees, and employees from Information Technology service providers must maintain the confidentiality of the information they obtain in accordance with information classification;
in addition to cooperation agreements between LJKNB and Information Technology service providers, all employees from Information Technology service providers assigned to LJKNB must sign an information confidentiality agreement (non-disclosure agreement);
training and/or socialization about information security must be provided to LJKNB employees, consultants, honorary employees, and employees from Information Technology service providers. This training and/or socialization is provided according to the roles and responsibilities of each party;
LJKNB establishes sanctions for violations of information security policies;
LJKNB establishes procedures regulating the obligation for LJKNB employees, consultants, honorary employees, and employees from Information Technology service providers to return assets and changes/closure of access rights caused by changes in duties or the end of employment or contract periods; and
LJKNB establishes separation of duties and responsibilities regarding information security, namely ensuring the separation of duties and responsibilities between human resources in LJKNB operations;
c. Physical and environmental security, which includes at least:
important information processing facilities (e.g., computer devices and network devices) are given adequate physical and environmental security to prevent unauthorized access, damage, and other disturbances;
physical and environmental security for important information processing facilities includes among others room dividers, access control, e.g., use of access control card 14, personal identification

13 Special code or symbol to secure computer systems, i.e., to identify parties accessing data, programs, or computer applications used.

number 15, or biometrics 16, completeness of security equipment inside the room (e.g., alarms, detectors and fire extinguishers, temperature and humidity measuring instruments, or CCTV) and maintenance of room and equipment cleanliness (e.g., from dust, cigarettes, food, drinks, or flammable items);
3) support facilities such as air conditioners and electricity resources must ensure capacity and availability in supporting the operation of information processing facilities;
4) assets belonging to Information Technology service providers must be clearly identified and given adequate protection, for example by applying sufficient security, dual control 17, or placing them separately from LJKNB assets; and
5) periodic maintenance and inspection of information processing facilities and support facilities in accordance with established procedures;
d. Access control, which includes at least:

physical and logic 18 access control;
formal written procedures approved by management regarding user administration, including registration, changes, and deletion of users, for both internal and external LJKNB users;
access provision refers to the principle of business need and with minimal access;
application of identification and authentication methods according to risk analysis, which can be one or a combination of "what you know" (e.g., passwords), "what you have" (e.g., mobile phones, magnetic chip cards, and/or tokens), "something you are" (e.g., biometrics such as retina and fingerprints);
procedures for control through the provision of initial passwords to users, paying attention to at least the following:
a) initial passwords must be changed at the first log-in 19; b) initial passwords are given securely, e.g., through closed envelopes or double-layered carbon paper so that only authorized parties know them; c) initial passwords are specific or unique for each user and not easily guessed; d) user-id 20 owners, especially LJKNB employees, honorary employees, and employees from Information Technology service providers, must sign a responsibility statement or user-id and password usage agreement when receiving user-ids and passwords; and e) standard (default) passwords owned by operating systems, application systems, database management systems, and network devices must be changed by LJKNB before implementation and as much as possible replace standard user-ids from the system (default user-ids);
procedures requiring users to:
a) maintain password confidentiality; b) avoid writing passwords on paper and other places without adequate security; c) use quality passwords, namely:
(1) adequate password length so that it is not easily guessed; (2) easy to remember and consist of at least a combination of 2 character types (letters, numbers, or special characters);

14 Electronic device used to provide environmental access security using cards.

15 A unique series of digits consisting of letters, numbers, or ASCII codes used to identify, among others, computer users, ATM users, internet banking users, and mobile banking users.

16 Utilization of technology by identifying a person's biological characteristics.

17 Security performed in layers involving the approval of 2 (two) or more people.

18 Basic principle in automatic processing

(3) not based on the user's personal data such as name, phone number, or date of birth; and (4) not using common words and easily guessed by software (to avoid brute force attacks), e.g., the word 'pass', 'password', 'adm', or common words in the dictionary; d) change passwords periodically; and e) avoid using the same password repeatedly;
7) procedures to disable access rights if user-ids are not used for a certain period, set the maximum number of password failures, and disable users after reaching the maximum number of password failures;
8) periodic review procedures by work units not involved in operational access control, regarding user access rights to ensure that access rights correspond to the authority granted;
9) operating systems, application systems, Databases, utilities, and other devices owned by LJKNB can help implement password security, for example:
a) forcing users to change passwords after a certain period and rejecting if users enter the same password as previously used when changing passwords; b) storing passwords securely (encrypted); c) disconnecting or accessing users if there is no response for a certain period; d) disabling or deleting user access rights if users do not log-in for a certain period, e.g., due to leave, rotation, and/or transfer; and e) access restriction procedures at least through the use of passwords and setting authorized parties for access for LJKNB using file sharing; e. IT operational security, which includes at least:

availability of tested backup and recovery procedures according to the level of importance for data, information, and software that has been created;
existence of adequate anticipation and security control processes for weaknesses in operating systems, application systems, Databases, and networks, including threats from unauthorized parties such as viruses, trojan horses, worms, spyware, Denial-of-Service (DoS), war driving, spoofing, and logic bombs;
protection of audit trails or logs from interference and unauthorized access;
synchronization of time indicators from all LJKNB Electronic Systems with an agreed accurate time indicator source; and
maintenance of records of software used and periodic monitoring of Electronic Systems and possible problems that arise;
f. Information security monitoring carried out according to risk or information criticality level; and g. Information security incident handling, which includes at least:
scope of incident handling, which includes at least:
a) parties who must report incidents; b) types of incidents that must be reported; c) incident reporting flow; d) analysis of incidents; and e) documentation of evidence related to incidents and follow-up actions to be taken; and
identification, reporting, processing of follow-up, documentation, and evaluation of incidents that occur.

Policies and procedures for Disaster Recovery Plan aspects as referred to in item 1 letter f include at least:
a. analysis of the Disaster Recovery Plan; b. types of Disaster Recovery Plan procedures;
c. components of Disaster Recovery Plan procedures;
d. determination of clear responsibilities for related parties in the implementation of the Disaster Recovery Plan; e. Disaster Recovery Plan testing; and f. updating of the Disaster Recovery Plan.
Analysis of the Disaster Recovery Plan as referred to in item 30 letter a is an analysis of the possibility of risks arising from factors including:
a. fire factors; b. natural disaster factors such as floods and earthquakes;
c. technical disturbance factors such as hardware failure, software failure, electricity disturbances, data transmission disturbances, and
d. human factors such as human error and/or sabotage.
Types of Disaster Recovery Plan procedures as referred to in item 30 letter b include at least:
a. emergency response procedures, to control systems during disturbances/disasters, reduce loss impacts, and determine disaster status; b. system recovery procedures that allow LJKNB's operational activities to return to normal conditions; and
c. data synchronization procedures used to ensure equality between machine data used for operations and data backups, as well as to ensure that all business processing results during the recovery period have entered the system.
Components of Disaster Recovery Plan procedures as referred to in item 30 letter c include at least:

a. human resources, namely the Disaster Recovery Plan must explain the composition, authority, and responsibilities of every human resource related to the implementation of Information Technology and have adequate communication channels; b. Information Technology resources and core applications of Non-Bank Financial Service Institutions (LJKNB), namely LJKNB must have complete procedures and documentation to restore main applications related to LJKNB's business activities as well as other LJKNB operations; and
c. communication facilities, to ensure the availability of alternative communication channels that can be used in the internal and/or external environment in the event of disruption or disaster.

The determination of clear responsibilities for related parties in the implementation of the Disaster Recovery Plan as referred to in item 30 letter d includes at least regarding responsibilities:
a. management; b. the Information Technology implementation work unit; and
c. supporting work units, such as work units that oversee logistics functions.
Management responsibilities as referred to in item 34 letter a cover at least:
a. establishing written policies and procedures for the Disaster Recovery Plan; b. reviewing and approving the Disaster Recovery Plan;
c. evaluating the feasibility of the Disaster Recovery Plan of third-party Information Technology service providers, in the event LJKNB uses the services of third-party Information Technology service providers; and
d. determining the level of disruption and disaster and its recovery.
Information Technology implementation work unit responsibilities as referred to in item 34 letter b cover at least:
a. the effectiveness of the Disaster Recovery Plan implementation; b. the determination of recovery scenarios to be used in the event of disruption or disaster based on prioritization of systems considered critical; and
c. evaluation of reports regarding each stage in the testing and implementation of the Disaster Recovery Plan.
Supporting work unit responsibilities as referred to in item 34 letter c cover at least:
a. the application of the Disaster Recovery Plan; and b. supporting the work unit responsible for the implementation of Information Technology.
Disaster Recovery Plan testing as referred to in item 30 letter e covers at least:
a. testing frequency; b. testing scope;
c. testing scenarios; and
d. analysis, reports, and documentation of testing results.
In the event LJKNB uses third-party Information Technology service providers, the implementation of Disaster Recovery Plan testing as referred to in item 30 letter e must involve the relevant third-party Information Technology service provider.
LJKNB must update the Disaster Recovery Plan as referred to in item 30 letter f to ensure the alignment of business processes, human resources, and Information Technology resources with current and future external and/or internal conditions.
Policies and procedures regarding the use of third-party Information Technology service providers as referred to in item 1 letter g cover at least:
a. the determination of criteria for the use of third-party Information Technology service providers, which contains at least regarding criteria for Information Technology implementation that can be done independently (in-house) or through third-party Information Technology service providers; b. principles for the use of third-party Information Technology service providers, which at least contain information regarding:
1. approval from management;
2. responsibility remains with LJKNB;
3. does not hinder the supervision process by the Financial Services Authority (Otoritas Jasa Keuangan);
4. cooperation carried out must be documented in a written agreement;
5. the scope of the cooperation agreement, which contains at least regarding:
  a) scope of work; b) costs and duration of the cooperation agreement; c) ownership and copyright; d) risk limits borne by LJKNB and the third-party Information Technology service provider, including those caused by changes including:
  (1) scope of the cooperation agreement; (2) scope of business and organization of the third-party Information Technology service provider; and (3) legal aspects including regulations, copyright, and patents; e) prohibition for the third-party Information Technology service provider to use or disclose information owned by LJKNB; f) service level agreement containing performance standards of the third-party Information Technology service provider including regarding agreed service levels and performance targets; g) clauses stating that:
  (1) the service level agreement remains valid in the event of a change in ownership of LJKNB or the third-party Information Technology service provider; (2) the third-party Information Technology service provider cannot modify software that has been agreed upon in the agreement without the consent of both parties; (3) the third-party Information Technology service provider must conduct knowledge transfer to LJKNB; (4) there is a guarantee stating that the third-party Information Technology service provider continues to support the services provided to LJKNB for a certain period after implementation; (5) only partial transfer of activities (subcontracting) can be carried out based on LJKNB approval evidenced by written documents; (6) no objection in the event that the Financial Services Authority and/or other parties competent according to statutory regulations are authorized to conduct examinations, will conduct examinations on the Information Technology service provision activities provided; and (7) the possibility of terminating, changing, making a new agreement, or taking over activities organized by the third-party Information Technology service provider, and terminating the agreement before the end of the agreement period, including in this case at the request of the Financial Services Authority; h) guarantee of access to source code in the event:
  (1) the software is considered important by LJKNB; (2) modification is required that cannot be done by the third-party Information Technology service provider; and/or (3) the Information Technology service provider can no longer provide services; i) willingness of the third-party Information Technology service provider to provide technical documents to LJKNB regarding the services carried out by the third-party Information Technology service provider including regarding flowcharts and implementation manuals (manual book) of the software; j) sanctions and/or penalties for cancellation and/or violation of the cooperation agreement; and k) compliance with statutory provisions including dispute resolution in the event of disagreements;
6. due diligence mechanism, which includes analysis at least regarding:
  a) existence, history, qualifications, background, and reputation of the third-party Information Technology service provider; b) financial condition of the third-party Information Technology service provider; c) ability and effectiveness of service provision, including after-sales support; and d) application of risk management by the third-party Information Technology service provider; and
7. the use of third-party Information Technology service providers must provide greater benefits than the costs incurred by LJKNB; and
  c. the determination of the third-party Information Technology service provider, which contains at least regarding the selection mechanism.
Policies and procedures regarding Electronic Financial Services as referred to in item 1 letter h contain at least:
a. scope and description of Electronic Financial Services; and b. responsibilities and authority for the management of Electronic Financial Services.

VI. ADEQUACY OF THE PROCESS OF IDENTIFICATION, MEASUREMENT, CONTROL, AND MONITORING OF INFORMATION TECHNOLOGY USAGE RISKS

The process of identification, measurement, control, and monitoring of risks is carried out at least regarding aspects:
a. management; b. development and procurement;
c. Information Technology operations;
d. communication networks; e. information security; f. Disaster Recovery Plan; g. use of third-party Information Technology service providers; and h. Electronic Financial Services, for LJKNB that organizes Electronic Financial Services.
LJKNB must have an integrated or unified risk management approach to be able to carry out identification, measurement, control, and monitoring of risks effectively.
The risk identification process as referred to in item 1 covers at least the following steps:
a. collection of data or information regarding activities related to the implementation of Information Technology that have the potential to cause or increase risks, both from activities that are currently ongoing or will be carried out, including data or information originating from:
1. critical Information Technology resources;
2. complaints or grievances submitted by Information Technology users to the Information Technology implementation work unit and/or help desk;
3. audit findings related to the implementation of Information Technology;
4. results of due diligence on the performance of third-party Information Technology service providers; and
5. results of self-assessments conducted by the Information Technology implementation work unit regarding the implementation of Information Technology, if any; and
  b. risk analysis related to the potential impact of each risk, including among others fraud in programming, system failure, natural disasters, errors in selecting the technology used, and the possibility of the emergence of viruses, trojan horses, worms, spyware, Denial-of-Service (DoS), war driving, and spoofing.
The risk measurement process as referred to in item 1 can be carried out quantitatively and/or qualitatively, using methods established by the Financial Services Authority and/or other regulators for risk assessment purposes or methods developed independently by LJKNB.
The risk measurement process must clearly contain the validation process, validation frequency, data and information documentation requirements, and evaluation requirements for assumptions used, before a model is applied by LJKNB.
The risk control process as referred to in item 1 takes into account the following categories:
a. accept, namely LJKNB decides to accept the risk if the magnitude of the impact caused is still within tolerance limits; b. control, namely LJKNB decides to reduce the impact caused or the likelihood of the risk occurring;
c. avoid, namely LJKNB decides not to carry out an activity or chooses alternative activities that produce the same output to avoid the occurrence of risk; or
d. transfer, namely LJKNB decides to transfer all or part of the responsibility for the implementation of Information Technology to third-party Information Technology service providers.
LJKNB must take handling steps for the risk control process for each category as referred to in item 6, including preventing the occurrence of greater risk losses.
Risk control can be carried out by LJKNB, among others, by applying policies, procedures, organizational structure including workflows, and other risk mitigation methods to absorb potential losses.
In the event that the development and procurement of Information Technology is carried out by third-party Information Technology service providers, the risk control process carried out includes ensuring the existence of a written agreement in the form of an escrow agreement for applications or software considered important by LJKNB.
The risk monitoring process as referred to in item 1 regarding the risk control process as referred to in item 6 is carried out by evaluating the compliance, adequacy, and effectiveness of Information Technology implementation performance.
Follow-up on evaluation results can be formulated in the form of decisions or actions to improve the effectiveness of Information Technology implementation.

VII. INTERNAL CONTROL SYSTEM OVER THE USE OF INFORMATION TECHNOLOGY

LJKNB implements an internal control system containing at least:
a. management supervision; b. risk identification and assessment;
c. control activities and segregation of functions;
d. information systems, accounting systems, and communication systems; and e. monitoring activities and correction of deviations carried out by:
1. Information Technology implementation and user work units;
2. work units or functions that oversee internal audit; and/or
3. other parties.
Information systems, accounting systems, and communication systems as referred to in item 1 letter d must be supported by adequate technology, human resources, and organizational structure of LJKNB.
Monitoring activities and correction of deviations as referred to in item 1 letter e cover at least:
a. continuous monitoring activities; b. effective and comprehensive internal audit functions; and
c. correction of deviations identified by Information Technology implementation and user work units, work units or functions that oversee internal audit, and/or other parties.
The implementation of effective and comprehensive internal audit functions as referred to in item 3 letter b covers at least:
a. background and objectives of audit implementation; b. auditor duties and responsibilities;
c. auditor authority;
d. audit process; and e. follow-up on audit results.

VIII. PROCEDURES FOR SUBMITTING REPORTS ON CERTAIN CONDITIONS, REQUESTS FOR APPROVAL FOR THE PLACEMENT OF DATA CENTERS AND/OR DISASTER RECOVERY CENTERS OUTSIDE THE TERRITORY OF INDONESIA, CRITICAL INCIDENT REPORTS, AND REPORTS ON THE CURRENT DEVELOPMENT OF CONDITIONS RELATED TO INFORMATION TECHNOLOGY

LJKNB submits:
a. reports as specific actions that must be reported to the Financial Services Authority as referred to in Article 21 paragraph (6) letter a and letter c of Financial Services Authority Regulation Number 4/POJK.05/2021 regarding the Implementation of Risk Management in the Use of Information Technology by Non-Bank Financial Service Institutions; b. requests for approval for the placement of Electronic Systems in Data Centers and/or Disaster Recovery Centers outside the territory of Indonesia as referred to in Article 23 paragraph (3) of Financial Services Authority Regulation Number 4/POJK.05/2021 regarding the Implementation of Risk Management in the Use of Information Technology by Non-Bank Financial Service Institutions; and/or
c. reports on critical incidents, misuse, and/or crimes in the implementation of Information Technology as referred to in Article 31 paragraph (1) of Financial Services Authority Regulation Number 4/POJK.05/2021 regarding the Implementation of Risk Management in the Use of Information Technology by Non-Bank Financial Service Institutions,
via online through the Financial Services Authority's data communication network system.
LJKNB ensures that the reports as referred to in item 1 letter a and letter c and the approval requests as referred to in item 1 letter b submitted online as referred to in item 1 are correct and identical to the hardcopy documents submitted.
In the event that the Financial Services Authority's data communication network system as referred to in item 1 is not yet available or experiences technical disruptions, the reports as referred to in item 1 letter a and letter c and the approval requests as referred to in item 1 letter b are submitted to the Financial Services Authority offline by:
a. being handed over directly; or b. being sent through a courier service company.
In the event of technical disruptions as referred to in item 3, the Financial Services Authority announces this through the Financial Services Authority website.
Submission of reports offline as referred to in item 3 must be submitted in electronic data (softcopy) form using media in the form of a compact disc (CD) or other electronic data storage media.
Submission of reports as referred to in item 3 is accompanied by a cover letter in the form of a hardcopy copy signed by the Board of Directors.
The format for the approval request as referred to in item 1 letter b is as stated in Format 12 of the Appendix which is an integral part of this Financial Services Authority Circular.
Submission of the cover letter as referred to in item 6, reports as referred to in item 1 letter a and letter c, and approval requests as referred to in item 1 letter b are addressed to the Supervision Director of each respective LJKNB as stated in Format 13 of the Appendix which is an integral part of this Financial Services Authority Circular.
LJKNB is deemed to have submitted reports as referred to in item 1 letter a and letter c and/or approval requests as referred to in item 1 letter b with the following provisions:

This copy is in accordance with the original
Acting Director of Legal Affairs 1
Legal Department signed
Evi Maria

a. for online submission via the Financial Services Authority's data communication network system, evidenced by a receipt from the Financial Services Authority's data communication network system; or b. for offline submission, evidenced by a receipt from the Financial Services Authority.

IX. CLOSING

The provisions in this Financial Services Authority Circular apply in accordance with the implementation for each respective LJKNB in Financial Services Authority Regulation Number 4/POJK.05/2021 regarding the Implementation of Risk Management in the Use of Information Technology by Non-Bank Financial Service Institutions.

Determined in Jakarta on August 24, 2021

EXECUTIVE HEAD OF SUPERVISOR
FOR INSURANCE, PENSION FUNDS,
LENDING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

APPENDIX
FINANCIAL SERVICES AUTHORITY CIRCULAR
REPUBLIC OF INDONESIA
NUMBER 22 /SEOJK.05/2021
REGARDING
IMPLEMENTATION OF RISK MANAGEMENT IN THE USE OF INFORMATION TECHNOLOGY BY NON-BANK FINANCIAL SERVICE INSTITUTIONS

TABLE OF CONTENTS
FORMAT 1: ORGANIZATION AND SUPPORTING MANAGEMENT FOR THE IMPLEMENTATION OF INFORMATION TECHNOLOGY RISK MANAGEMENT .............................................. 2
FORMAT 2: IMPLEMENTATION OF RISK MANAGEMENT COMPONENTS IN THE USE OF INFORMATION TECHNOLOGY......................................................... 3
FORMAT 3: POLICIES AND PROCEDURES FOR THE USE OF INFORMATION TECHNOLOGY..................................................................................................... 4
FORMAT 4: APPLICATION ARCHITECTURE .......ERROR! BOOKMARK NOT DEFINED.
FORMAT 5: APPLICATION LIST........................................................................ 6
FORMAT 6: COMMUNICATION NETWORK.............................................................. 7
FORMAT 7: DATA CENTERS AND DISASTER RECOVERY CENTERS........................ 8
FORMAT 8: INFORMATION TECHNOLOGY SECURITY ...................................... 9
FORMAT 9: DISASTER RECOVERY PLAN.............................................. 10
FORMAT 10: THIRD-PARTY INFORMATION TECHNOLOGY SERVICE PROVIDERS..................... 11
FORMAT 11: INFORMATION TECHNOLOGY COSTS ............................................... 12
FORMAT 12: REQUEST FOR APPROVAL FOR THE PLACEMENT OF ELECTRONIC SYSTEMS IN DATA CENTERS AND/OR DISASTER RECOVERY CENTERS OUTSIDE THE TERRITORY OF INDONESIA..................................................................... 13
FORMAT 13: LIST OF DESTINATIONS FOR SUBMISSION OF COVER LETTERS, REPORTS AS SPECIFIC ACTIONS THAT MUST BE REPORTED TO THE FINANCIAL SERVICES AUTHORITY, CRITICAL INCIDENT REPORTS, MISUSE, AND/OR CRIMES IN THE IMPLEMENTATION OF TECHNOLOGY, AND REQUESTS FOR APPROVAL FOR THE PLACEMENT OF ELECTRONIC SYSTEMS IN DATA CENTERS AND/OR DISASTER RECOVERY CENTERS OUTSIDE THE TERRITORY OF INDONESIA ……………………………………………………………..17

FORMAT 1: ORGANIZATION AND SUPPORTING MANAGEMENT FOR THE IMPLEMENTATION OF INFORMATION TECHNOLOGY RISK MANAGEMENT (to be filled with organizational structure and number of human resources of the Information Technology implementation work unit, membership data and implementation of Information Technology steering committee meetings)

FORMAT 2: IMPLEMENTATION OF RISK MANAGEMENT COMPONENTS IN THE USE OF INFORMATION TECHNOLOGY No. Item Description

Active Supervision
Board of Directors and Board of Commissioners
(to be filled with a brief explanation regarding the active supervision of the Board of Directors and Board of Commissioners carried out by LJKNB)
Adequacy of policies and procedures for the use of Information Technology
(to be filled with a brief explanation regarding the policies and procedures for the use of Information Technology owned by LJKNB)
Adequacy of the process of identification, measurement, control, and monitoring of risks in the use of Information Technology
(to be filled with a brief explanation regarding the process of identification, measurement, control, and monitoring of risks in the use of Information Technology carried out by LJKNB)
Internal control system over the use of Information Technology
(to be filled with a brief explanation regarding the risk control mechanism and its results)

FORMAT 3: POLICIES AND PROCEDURES FOR THE USE OF INFORMATION TECHNOLOGY

LIST OF INFORMATION TECHNOLOGY USE POLICIES
No. Document Title 1) Description 2) Category 3) Review and Update Time 4) 1.
2. etc.
Notes:

Filled with the policy document title
Filled with a brief description regarding the policy document
Filled with the policy category, namely management, development and procurement, Information Technology operations, communication networks, information security, Disaster Recovery Plan, use of third-party Information Technology service providers, or Electronic Financial Services
Filled with the date of review and update of the policy document

LIST OF INFORMATION TECHNOLOGY USE PROCEDURES
No. Document Title 1) Description 2) Category 3) Review and Update Time 4) 1.
2. etc.
Notes:

Filled with the procedure document title
Filled with a brief description regarding the procedure document
Filled with the procedure category, namely management, development and procurement, Information Technology operations, communication networks, information security, Disaster Recovery Plan, use of third-party Information Technology service providers, or Electronic Financial Services
Filled with the date of review and update of the procedure document

FORMAT 4: APPLICATION ARCHITECTURE
(to be filled with application architecture image)

No. Application Name 1) Description 2) Platform 3) Data Center Location 4) Data Center Operator 5) Disaster Recovery Center Location 6) Disaster Recovery Center Operator 7) Application Developer 8) Implementation Date 9) Ownership 10) 1. 2. etc.

FORMAT 5: APPLICATION LIST
Notes:

Filled with the application name
Filled with a description regarding the application
Filled with the platform used for application installation, namely mobile (cellular phone) and/or personal computer.
Filled with the city location of the Data Center.
Filled with the Data Center operator, namely self (the respective LJKNB) or third-party Information Technology service provider (state the name of the third-party Information Technology service provider).
Filled with the city location of the Disaster Recovery Center.
Filled with the Disaster Recovery Center operator, namely self (the respective LJKNB) or third-party Information Technology service provider (state the name of the third-party Information Technology service provider).
Filled with in-house if the application is developed by the respective LJKNB or third-party Information Technology service provider (state the name of the third-party Information Technology service provider) if the application is developed by the third-party Information Technology service provider.
Filled with the implementation date (go live) of the application.
Filled with lease or outright purchase.

FORMAT 6: COMMUNICATION NETWORK
(to be filled with communication network topology image)

DATA CENTER
Address
Area Size
Ownership: Own/Information Technology Service Provider *) Controls Environmental Factor (fill in an explanation regarding the control of environmental factors as referred to in Roman V number 24 letter c) Physical Controls (fill in an explanation regarding the control of environmental factors as referred to in Roman V number 24 letter a, letter b, and letter d) DISASTER RECOVERY CENTER Address Area Size Ownership: Own/Information Technology Service Provider *) Disaster Recovery Center Location Different from Data Center Yes/No *) Environmental Factor Controls (fill in an explanation regarding the control of environmental factors as referred to in Roman V number 24 letter c) Physical Controls (fill in an explanation regarding the control of environmental factors as referred to in Roman V number 24 letter a, letter b, and letter d) FORMAT 7: DATA CENTER AND DISASTER RECOVERY CENTER

FORMAT 8: INFORMATION TECHNOLOGY SECURITY
No. Asset Name 1) Asset Type 2) Description 3) Notes:

Fill in with the name of the asset for Information Technology security, examples: antivirus brand XYZ, firewall brand ABC, and others.
Fill in with the asset type (software or hardware)
Fill in with a brief description of the asset such as function, number of licenses, asset version, and others)

Disaster Level and/or Disturbance
Minor disaster/major disaster/catastrophic disaster *) Date of Last Test Last Disaster Recovery Plan Test (fill in the date of the last test of the disaster recovery plan) List of Applications and/or Information Technology Resources Tested (fill in with a list of applications and/or Information Technology resources that were tested) Test Results (fill in with a brief explanation of the test results) Execution Time Review (fill in the time of the review execution) Review Results (fill in with the review results) Review Follow-up (fill in with the steps that need to be taken after the review execution) FORMAT 9: DISASTER RECOVERY PLAN

FORMAT 10: INFORMATION TECHNOLOGY SERVICE PROVIDER No. Name 1) Address 2) Services Provided 3) Notes:

Fill in with the name of the Information Technology service provider
Fill in with the address of the Information Technology service provider
Fill in with the list of services provided by the Information Technology service provider to LJKNB

No. Information Technology Resources 1) Costs Incurred 2) FORMAT 11: INFORMATION TECHNOLOGY COSTS Notes:

Fill in with the type and name of Information Technology resources used
Fill in with the cost amount incurred in rupiah

APPLICATION FOR APPROVAL OF PLACEMENT OF ELECTRONIC SYSTEMS IN DATA CENTERS AND/OR DISASTER RECOVERY CENTERS OUTSIDE INDONESIAN TERRITORY

Name of the country where the planned location for the placement of electronic systems in
Data Centers and/or Disaster Recovery Centers is located (attach data on the name, address, and ownership of the organizer of the Data Center and/or Disaster Recovery Center to be planned) ………………………………………………………………………………………………….
Name of the electronic system to be placed in the data center and/or disaster recovery center outside Indonesian territory
……………………………………………………………………………………………………
Description of the electronic system to be placed in the data center
and/or disaster recovery center outside Indonesian territory ………………………………………………………………………………………………….
………………………………………………………………………………………………….
………………………………………………………………………………………………….
Fulfillment of requirements:
Fulfillment of requirements in
Article 21 paragraph (2)
to paragraph (4) of Financial Services Authority Regulation Number 4/POJK.05/2021 regarding the Implementation of Risk Management in the Use of Information Technology by Non-Bank Financial Service Institutions (POJK 4/2021) (fill in LJKNB's analysis and explanation regarding the fulfillment of the provisions in Article 21 paragraph (2) to paragraph (4) of POJK 4/2021) Country Risk Analysis (fill in LJKNB's analysis and explanation regarding the country risk that will be conducted for the placement of electronic systems) Statement letter from LJKNB's Board of Directors and the Information Technology service provider to ensure Yes/No *) (Attach) FORMAT 12: APPLICATION FOR APPROVAL OF PLACEMENT OF ELECTRONIC SYSTEMS IN DATA CENTERS AND/OR DISASTER RECOVERY CENTERS OUTSIDE INDONESIAN TERRITORY

the operation of
Electronic Systems outside Indonesian territory does not reduce the effectiveness of supervision by the Financial Services Authority Cooperation agreement between LJKNB and the Information Technology service provider to ensure that information regarding LJKNB's secrets is only disclosed as long as it meets the provisions of Indonesian legislation. Yes/No *) (Attach) Written agreement with the Information Technology service provider contains a choice of law clause Yes/No *) (Attach) Statement letter of non-objection from the supervisory authority of the Information Technology service provider outside Indonesian territory that the Financial Services Authority is granted access to conduct examinations against the Information Technology service provider Yes/No *) (Attach) Statement letter that LJKNB will periodically submit the results of assessments conducted by the parent company, the main entity, Yes/No *) (Attach)

and/or other entities that have similar business activities within one LJKNB group outside Indonesian territory regarding the implementation of risk management on the Information Technology service provider Analysis containing that the benefits obtained by LJKNB from the planned placement of Electronic Systems outside Indonesian territory are greater than the burdens borne by LJKNB (fill in LJKNB's analysis and explanation containing that the benefits obtained by LJKNB from the planned placement of Electronic Systems outside Indonesian territory are greater than the burdens borne by LJKNB) LJKNB's Plan to enhance LJKNB's human resource capabilities both related to the operation of Information Technology as well as business transactions or products offered Yes/No *) (Attach)

No. LJKNB PURPOSE OF SUBMISSION

Insurance Companies,
Reinsurance Companies, and
Health BPJS
Head of Executive Supervisor for
Insurance, Pensions,
Financing Institutions, and Other
Financial Service Institutions Financial Services Authority attn. Director of Insurance and Health BPJS Supervision Wisma Mulia Building 2, 12th Floor Jalan Jenderal Gatot Subroto Kav. 40 Jakarta 12710
Sharia Insurance Companies,
Sharia Reinsurance Companies,
Sharia Financing Companies,
Sharia Venture Capital Companies,
Sharia Guarantee Companies, and
Sharia Reinsurance Guarantee Companies
Head of Executive Supervisor for
Insurance, Pensions,
Financing Institutions, and Other
Financial Service Institutions Financial Services Authority attn. Sharia LJKNB Director I Wisma Mulia Building 2, 15th Floor Jalan Jenderal Gatot Subroto Kav. 40 Jakarta 12710
Insurance Brokerage Companies,
Reinsurance Brokerage Companies, and
Insurance Loss Appraisal Companies
Head of Executive Supervisor for
Insurance, Pensions,
Financing Institutions, and Other
Financial Service Institutions Financial Services Authority attn. LJKNB Supporting Services Director J Wisma Mulia Building 2, 12th Floor Jalan Jenderal Gatot Subroto Kav. 40 Jakarta 12710
Pensions and Labor BPJS
Head of Executive Supervisor for
Insurance, Pensions,
Financing Institutions, and Other
Financial Service Institutions Financial Services Authority attn. Director of Pension and Labor BPJS Supervision Wisma Mulia Building 2, 12th Floor Jalan Jenderal Gatot Subroto Kav. 40 Jakarta 12710 FORMAT 13: LIST OF PURPOSES FOR SUBMISSION OF COVER LETTERS, REPORTS AS CERTAIN ACTIONS THAT MUST BE REPORTED TO THE FINANCIAL SERVICES AUTHORITY, CRITICAL INCIDENT REPORTS, MISUSE, AND/OR CRIMES IN THE OPERATION OF TECHNOLOGY, AND APPLICATIONS FOR APPROVAL OF PLACEMENT OF ELECTRONIC SYSTEMS IN DATA CENTERS AND/OR DISASTER RECOVERY CENTERS OUTSIDE INDONESIAN TERRITORY

This copy is consistent with the original
Acting Director of Law 1
Legal Department signed
Evi Maria
5. Financing Companies,
Venture Capital Companies, and Infrastructure Financing Companies Head of Executive Supervisor for Insurance, Pensions, Financing Institutions, and Other Financial Service Institutions Financial Services Authority attn. Director of Financing Institution Supervision Wisma Mulia Building 2, 15th Floor Jalan Jenderal Gatot Subroto Kav. 40 Jakarta 12710
6. Pawnshop Companies,
Guarantee Companies,
Reinsurance Guarantee Companies,
Indonesia Export Financing Institutions, Secondary Housing Financing Companies, PT Permodalan Nasional Madani (Persero) Head of Executive Supervisor for Insurance, Pensions, Financing Institutions, and Other Financial Service Institutions Financial Services Authority attn. Director of Special Financial Institution Supervision Wisma Mulia Building 2, 15th Floor Jalan Jenderal Gatot Subroto Kav. 40 Jakarta 12710
7. Organizers of Technology-Based
Peer-to-Peer Lending Services
Head of Executive Supervisor for
Insurance, Pensions,
Financing Institutions, and Other
Financial Service Institutions Financial Services Authority attn. Director of Financial Technology Regulation, Licensing, and Supervision Wisma Mulia Building 2, 12th Floor Jalan Jenderal Gatot Subroto Kav. 40 Jakarta 12710 Established in Jakarta on the date of August 24, 2021 HEAD OF EXECUTIVE SUPERVISOR FOR INSURANCE, PENSIONS, FINANCING INSTITUTIONS, AND OTHER FINANCIAL SERVICE INSTITUTIONS FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, signed RISWINANDI