Implementation of Risk Management for Financing Institutions, Venture Capital Companies, Microfinance Institutions, and Other Financial Service Institutions

COPY OF
FINANCIAL SERVICES AUTHORITY REGULATION
REPUBLIC OF INDONESIA
NUMBER 42 OF 2024
CONCERNING
THE IMPLEMENTATION OF RISK MANAGEMENT FOR FINANCING INSTITUTIONS, VENTURE CAPITAL COMPANIES, MICROFINANCE INSTITUTIONS, AND OTHER FINANCIAL SERVICE INSTITUTIONS BY THE GRACE OF GOD THE ALMIGHTY THE COMMISSIONERS OF THE FINANCIAL SERVICES AUTHORITY, Considering: that in order to implement the mandate of Article 122 paragraph (3) and
Article 269 of Law Number 4 of 2023 concerning
the Development and Strengthening of the Financial Sector, it is necessary to establish a Financial Services Authority Regulation concerning the Implementation of Risk Management for Financing Institutions, Venture Capital Companies, Microfinance Institutions, and Other Financial Service Institutions; Recalling: 1. Law Number 21 of 2011 concerning Financial Services Authority (State Gazette of the Republic of Indonesia Year 2011 Number 111, Supplement to the State Gazette of the Republic of Indonesia Number 5253) as amended by Law Number 4 of 2023 concerning the Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845);
2. Law Number 4 of 2023 concerning
the Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845); DECIDING:
Decreeing: FINANCIAL SERVICES AUTHORITY REGULATION CONCERNING THE IMPLEMENTATION OF RISK MANAGEMENT FOR FINANCING INSTITUTIONS, VENTURE CAPITAL COMPANIES, MICROFINANCE INSTITUTIONS, AND OTHER FINANCIAL SERVICE INSTITUTIONS. https://jdih.ojk.go.id/

CHAPTER I
GENERAL PROVISIONS
Article 1
In this Financial Services Authority Regulation, the following terms are defined as:

Financing Institutions, Venture Capital Companies,
Microfinance Institutions, and Other Financial Service Institutions which hereinafter are referred to as PVML are financial service institutions comprising financing companies, infrastructure financing companies, venture capital companies, microfinance institutions, pawnshop companies, providers of information technology-based joint financing services, Indonesia Export Financing Institution, housing secondary financing companies, PT Permodalan Nasional Madani, Badan Pengelola Tabungan Perumahan Rakyat, PT Sarana Multi Infrastruktur (Persero), and other financial service institutions.
Financing Company is a legal entity that conducts
financing activities for goods and/or services to the public, including those conducting their business activities based on Sharia principles.
Infrastructure Financing Company is a legal entity
specifically established to conduct financing activities in the form of providing funds for infrastructure projects and/or carrying out other activities or facilities in the context of supporting infrastructure financing, including those conducting their business activities based on Sharia principles.
Venture Capital Company is a legal entity that
conducts venture capital business activities, including those conducting their business activities based on Sharia principles.
Microfinance Institution is a financial institution
specifically established to provide business development services and community empowerment, whether through loans or financing in micro-scale businesses to members and the public, savings management, or providing business development consulting services that do not solely seek profit, including those conducting their business activities based on Sharia principles.
Pawnshop Company is a legal entity that
conducts business activities providing loans secured by movable property, including those conducting their business activities based on Sharia principles.
Provider of Information Technology-based Joint Financing Services which hereinafter is referred to as
Provider of LPBBTI is an Indonesian legal entity that provides, manages, and operates the provision of financial service services to match fund providers with fund recipients in conducting financing either conventionally or based on Sharia principles directly through electronic systems using the internet.
Housing Secondary Financing Company is a
company established by the Government of the
Republic of Indonesia to conduct housing secondary financing and other activities related to the development of the housing secondary financing market.
Indonesia Export Financing Institution which
hereinafter is abbreviated as LPEI is the Indonesia Export Financing Institution as referred to in the Law concerning the Indonesia Export Financing Institution.
PT Permodalan Nasional Madani which hereinafter
is referred to as PT PNM is a company established based on Government Regulation of the Republic of Indonesia Number 38 of 1999 concerning State Capital Participation for the Establishment of State-Owned Limited Liability Companies (Persero) in the context of the Development of Cooperatives, Small and Medium Enterprises.
Badan Pengelola Tabungan Perumahan Rakyat which
hereinafter is referred to as BP Tapera is a legal entity established to manage people's housing savings.
PT Sarana Multi Infrastruktur (Persero) which
hereinafter is referred to as PT SMI (Persero) is a state-owned business entity established based on Government Regulation Number 66 of 2007 concerning State Capital Participation of the Republic of Indonesia for the Establishment of Limited Liability Companies (Persero) in the Field of Infrastructure Financing as last amended by Government Regulation Number 53 of 2020 concerning the Second Amendment to Government Regulation Number 66 of 2007 concerning State Capital Participation of the Republic of Indonesia for the Establishment of Limited Liability Companies (Persero) in the Field of Infrastructure Financing.
Risk is the potential for losses that cannot be
controlled and/or can be controlled due to the occurrence of a specific event.
Risk Management is a series of procedures and
methodologies used to identify, measure, control, and monitor Risks that arise from all PVML business activities.
Credit Risk is the Risk due to the failure of other
parties to fulfill their obligations to PVML.
Market Risk is the Risk on asset, liability,
equity, and/or administrative account positions including derivative transactions due to changes in overall market conditions.
Operational Risk is the Risk due to
insufficiency and/or malfunction of internal processes, human error, system failure, and/or the occurrence of external events that affect PVML operations.
Strategic Risk is the Risk due to inaccuracy
in the making and/or implementation of strategic decisions and failure to anticipate changes in the business environment.
Liquidity Risk is the Risk due to
PVML's inability to meet maturing liabilities from cash flow funding sources and/or from liquid assets that can be easily converted into cash, without disrupting activities and the financial condition of PVML.
Legal Risk is the Risk arising from
legal claims and/or weaknesses in legal aspects.
Compliance Risk is the Risk due to PVML not
complying with and/or not implementing laws and regulations and provisions applicable to PVML.
Reputational Risk is the Risk due to a decrease
in the level of trust of stakeholders stemming from negative perceptions of PVML.
Insurance Risk is the Risk of LPEI's failure to
meet obligations to policyholders, insured parties, or participants as a result of insufficient risk selection processes (underwriting), premium or contribution setting, use of reinsurance, and/or claims handling.
Board of Directors is the PVML organ authorized and
fully responsible for managing PVML for the benefit of PVML, in accordance with the purpose and objectives of PVML and representing PVML, both inside and outside the court in accordance with the provisions of the articles of association for PVML in the form of a limited liability company, or equivalent to the Board of Directors for PVML in the form of a cooperative legal entity, LPEI, or BP Tapera.
Manager is a party appointed by the Board of Directors of a legal entity in the form of a cooperative and given authority and power to manage the business of a PVML in the form of a cooperative legal entity.
Board of Commissioners is the PVML organ tasked with
carrying out general and/or specific supervision in accordance with the articles of association and providing advice to the Board of Directors for PVML in the form of a limited liability company legal entity, or equivalent to the Board of Commissioners for PVML in the form of a cooperative legal entity, LPEI, or BP Tapera.
Sharia Supervisory Board which hereinafter is abbreviated as
DPS is a party that has the task and function of supervision over the implementation of PVML activities to ensure compliance with Sharia principles.
Sharia Principles are Islamic legal principles
based on fatwas and/or statements of Sharia compliance issued by institutions having the authority to issue fatwas in the field of Sharia.

CHAPTER II
IMPLEMENTATION OF RISK MANAGEMENT
Article 2
(1) PVML is required to implement Risk Management effectively.
(2) The implementation of Risk Management as referred to in paragraph (1) must at least cover:
a. active supervision by the Board of Directors, Board of Commissioners, DPS, and Manager; b. adequacy of policies, procedures, and Risk limit setting;
c. adequacy of risk identification, measurement,
monitoring, and control processes, as well as Risk Management information systems; and d. a comprehensive internal control system. (3) In implementing Risk Management as referred to in paragraph (1), PVML is required to have guidelines for the implementation of Risk Management. (4) Further provisions regarding the implementation of Risk Management as referred to in paragraph (1) are determined by the Financial Services Authority.
Article 3
The implementation of Risk Management as referred to in
Article 2 must be adjusted to the objectives, policies, business,
scale, business complexity, and capabilities of PVML.
Article 4
(1) Risk Management as referred to in Article
2 paragraph (1) for Financing Companies, Infrastructure Financing Companies, Venture Capital Companies, Housing Secondary Financing Companies, PT PNM, BP Tapera, and PT SMI (Persero) must be applied for:
a. Credit Risk; b. Market Risk;
c. Operational Risk;
d. Strategic Risk; e. Liquidity Risk; f. Legal Risk; g. Compliance Risk; and h. Reputational Risk.
(2) Risk Management as referred to in Article
2 paragraph (1) for LPEI must be applied for:
a. Credit Risk; b. Market Risk;
c. Operational Risk;
d. Strategic Risk; e. Liquidity Risk; f. Legal Risk; g. Compliance Risk; h. Reputational Risk; and
i. Insurance Risk.
(3) Risk Management as referred to in Article
2 paragraph (1) for Providers of LPBBTI must be applied at least for:
a. Credit Risk; b. Operational Risk;
c. Strategic Risk;
d. Legal Risk; e. Compliance Risk; and f. Reputational Risk.
(4) Risk Management as referred to in Article
2 paragraph (1) for Pawnshop Companies:
a. with a national business scope must be applied at least for:
1. Credit Risk;
2. Market Risk;
3. Operational Risk;
4. Strategic Risk;
5. Liquidity Risk;
6. Legal Risk;
7. Compliance Risk; and
8. Reputational Risk;
b. with a provincial business scope must be applied at least for:
1. Credit Risk;
2. Market Risk;
3. Operational Risk;
4. Strategic Risk;
5. Liquidity Risk;
6. Legal Risk;
7. Compliance Risk; and
8. Reputational Risk; and
c. with a district/city business scope
must be applied at least for:
1. Credit Risk;
2. Operational Risk;
3. Strategic Risk;
4. Liquidity Risk;
5. Legal Risk;
6. Compliance Risk; and
7. Reputational Risk.
(5) Risk Management as referred to in Article
2 paragraph (1) for Microfinance Institutions:
a. with a large business scale must be applied for:
1. Credit Risk;
2. Operational Risk;
3. Liquidity Risk;
4. Legal Risk;
5. Compliance Risk; and
6. Reputational Risk;
b. with a medium business scale must be applied for:
1. Credit Risk;
2. Operational Risk; and
3. Liquidity Risk; and
c. with a small business scale must be applied for:
1. Credit Risk;
2. Operational Risk; and
3. Liquidity Risk.
Article 5
(1) PVML may establish other Risks outside the Risks as referred to in Article 4 that arise from the implementation of PVML business activities after obtaining approval from the Financial Services Authority. (2) The Financial Services Authority may request PVML to establish other Risks outside the Risks as referred to in Article 4 that arise from the implementation of PVML business activities, including risks related to Sharia Principles. (3) PVML is required to fulfill the request of the Financial Services Authority to establish other Risks as referred to in paragraph (2). (4) Further provisions regarding the procedure for establishing other Risks outside the Risks as referred to in paragraph (1) and the procedure for the Financial Services Authority requesting PVML to establish other Risks as referred to in paragraph (2) are determined by the Financial Services Authority.
Article 6
(1) PVML that violates provisions as referred to in
Article 2 paragraph (1), paragraph (3), Article 3, Article
4, and/or Article 5 paragraph (3) shall be subject to administrative sanctions in the form of:
a. written warning; b. suspension of part or all of business activities;
c. restriction of certain business activities;
d. reduction of risk assessment results; e. cancellation of approval; f. prohibition from becoming controlling shareholders, Board of Directors, Board of Commissioners, DPS, and/or Manager; and/or g. administrative fine. (2) Administrative sanctions as referred to in paragraph (1) letters b and c are exempted for Housing Secondary Financing Companies, LPEI, BP Tapera, PT PNM, and PT SMI (Persero). (3) Administrative sanctions as referred to in paragraph (1) letters b through g may be imposed with or without prior imposition of administrative sanctions in the form of a written warning as referred to in paragraph (1) letter a. (4) Administrative sanctions in the form of administrative fines as referred to in paragraph (1) letter g are imposed at most IDR 50,000,000.00 (fifty million rupiah). (5) In the event that PVML has fulfilled the provisions as referred to in paragraph (1), the Financial Services Authority revokes the administrative sanction. (6) In the event that a violation of provisions as referred to in paragraph (1) occurs and the violation has been https://jdih.ojk.go.id/

remedied, the Financial Services Authority provides an administrative sanction in the form of a written warning that expires automatically. (7) In addition to administrative sanctions as referred to in paragraph (1), the Financial Services Authority is authorized to:
a. reduce the health assessment results; b. conduct a re-evaluation of the main parties that caused PVML to violate provisions as referred to in paragraph (1), and/or
c. record the track record of parties
that caused PVML to violate provisions as referred to in paragraph (1) in the Financial Services Authority's electronic system.

CHAPTER III
ACTIVE SUPERVISION BY THE BOARD OF DIRECTORS, BOARD OF COMMISSIONERS, SHARIA SUPERVISORY BOARD, AND MANAGERS
Section One
General
Article 7
PVML is required to establish authority and responsibility at every level of position related to the implementation of Risk Management as referred to in Article 2.
Section Two
Authority and Responsibility of the Board of Directors and Managers
Article 8
(1) Authority and responsibility as referred to in
Article 7 for the Board of Directors and Managers must at least:
a. formulate written and comprehensive Risk Management policies and strategies; b. be responsible for the implementation of Risk Management policies and Risk exposures taken by PVML as a whole;
c. evaluate and decide on transactions and
Risk limits that require approval from the Board of Directors and Managers; d. develop a Risk Management culture at all levels of the organization; e. ensure the improvement of human resource competence related to Risk Management; f. ensure that the Risk Management function has operated independently; and g. conduct periodic reviews to ensure:

the accuracy of Risk assessment methodologies;
the adequacy of Risk Management information system implementation; and
the appropriateness of Risk Management policies and procedures as well as Risk limit setting.
https://jdih.ojk.go.id/

(2) The authority and responsibility of the Board of Directors and Managers as referred to in paragraph (1) letter a are exempted for LPEI. (3) The authority and responsibility of the Board of Directors and Managers as referred to in paragraph (1) letters e and g may be exempted for Large-scale Microfinance Institutions and Pawnshop Companies with a provincial business scope. (4) The authority and responsibility of the Board of Directors and Managers as referred to in paragraph (1) letters e, f, and g may be exempted for Medium-scale Microfinance Institutions and Pawnshop Companies with a district/city business scope. (5) The authority and responsibility of the Board of Directors and Managers as referred to in paragraph (1) letters d, e, letters f, and g may be exempted for Small-scale Microfinance Institutions. (6) Risk Management policies and strategies as referred to in paragraph (1) letter a must be evaluated periodically at least once in one (one) year and at any time in the event of factors that significantly affect PVML business activities. (7) The responsibility of the Board of Directors and Managers for the implementation of Risk Management policies as referred to in paragraph (1) letter b includes:
a. evaluating and providing guidance based on reports submitted by the Risk Management function; and b. submitting accountability reports to the Board of Commissioners and DPS:

at least once in one (one)
year, for PVML other than LPEI; or
at least once in six (six)
months, for LPEI.
(8) In order to implement the authority and responsibility as referred to in paragraph (1), the Board of Directors and Managers are required to have an understanding of the Risks inherent in all functional activities of PVML and be able to take necessary actions in accordance with the Risk profile of PVML.
Section Three
Authority and Responsibility of the Board of Commissioners
Article 9
(1) Authority and responsibility as referred to in
Article 7 for the Board of Commissioners must at least:
a. approve and evaluate Risk Management policies; b. evaluate the accountability of the Board of Directors and Managers for the implementation of Risk Management policies as referred to in letter a; and
c. evaluate and decide on requests
from the Board of Directors regarding transactions and limits https://jdih.ojk.go.id/

Risk that require approval from the Board of
Commissioners.
(2) In addition to the authority and responsibility as referred to in paragraph (1), the Board of Commissioners for LPEI has the authority and responsibility to formulate written and comprehensive Risk Management policies and strategies. (3) The authority and responsibility of the Board of Commissioners as referred to in paragraph (1) letter b may be exempted for Medium-scale Microfinance Institutions and Pawnshop Companies with a district/city business scope. (4) The authority and responsibility of the Board of Commissioners as referred to in paragraph (1) letters b and c may be exempted for Small-scale Microfinance Institutions. (5) The evaluation of Risk Management policies as referred to in paragraph (1) letter a is conducted at least once in one (one) year and at any time in the event of factors that significantly affect business activities of PVML. (6) The evaluation of the Board of Directors' accountability for the implementation of Risk Management policies as referred to in paragraph (1) letter b is conducted:
a. at least once in one (one) year, for PVML other than LPEI; or b. at least once in six (six) months, for LPEI.
Section Four
Authority and Responsibility of the Sharia Supervisory Board
Article 10
(1) Authority and responsibility as referred to in
Article 7 for the DPS must at least:
a. evaluate Risk Management policies related to the fulfillment of Sharia Principles; and b. evaluate the accountability of the Board of Directors and Managers for the implementation of Risk Management policies related to the fulfillment of Sharia Principles as referred to in letter a. (2) The evaluation of Risk Management policies as referred to in paragraph (1) letter a is conducted at least once in one (one) year and at any time in the event of factors that significantly affect business activities of PVML. (3) The evaluation of the accountability of the Board of Directors and Managers for the implementation of Risk Management policies related to the fulfillment of Sharia Principles as referred to in paragraph (1) letter b is conducted:
a. at least once in one (one) year, for PVML other than LPEI; or b. at least once in six (six) months, for LPEI. https://jdih.ojk.go.id/

Article 11
(1) PVML that violates provisions as referred to in
Article 7 and/or Article 8 paragraph (8)
shall be subject to administrative sanctions in the form of:
a. written warning; b. suspension of part or all of business activities;
c. restriction of certain business activities;
d. reduction of risk assessment results; e. cancellation of approval; f. prohibition from becoming controlling shareholders, Board of Directors, Board of Commissioners, DPS, and/or Manager; and/or g. administrative fine. (2) Sanctions as referred to in paragraph (1) letters b and c are exempted for Housing Secondary Financing Companies, LPEI, BP Tapera, PT PNM, and PT SMI (Persero). (3) Administrative sanctions as referred to in paragraph (1) letters b through g may be imposed with or without prior imposition of administrative sanctions in the form of a written warning as referred to in paragraph (1) letter a. (4) Administrative sanctions in the form of administrative fines as referred to in paragraph (1) letter g are imposed at most IDR 50,000,000.00 (fifty million rupiah). (5) In the event that PVML has fulfilled the provisions as referred to in paragraph (1), the Financial Services Authority revokes the administrative sanction. (6) In the event that a violation of provisions as referred to in paragraph (1) occurs and the violation has been https://jdih.ojk.go.id/

remedied, the Financial Services Authority provides an administrative sanction in the form of a written warning that expires automatically. (7) In addition to administrative sanctions as referred to in paragraph (1), the Financial Services Authority is authorized to:
a. reduce the health assessment results; b. conduct a re-evaluation of the main parties that caused PVML to violate provisions as referred to in paragraph (1); and/or
c. record the track record of parties
that caused PVML to violate provisions as referred to in paragraph (1) in the Financial Services Authority's electronic system. https://jdih.ojk.go.id/

CHAPTER IV
RISK POLICY ADEQUACY, PROCEDURES, AND RISK LIMIT DETERMINATION First Section Risk Management Policy Adequacy
Article 12
(1) The adequacy of Risk Management Policy as referred to in Article 2 paragraph (2) letter b shall contain at least:
a. the determination of Risks related to the business activities of PVML; b. the determination of the use of measurement methods and Risk Management information systems;
c. the determination of the level of Risk to be taken, the determination of Risk tolerance, and the determination of Risk limits;
d. the determination of Risk rating assessments; e. the preparation of emergency plans in worst-case conditions; and f. the determination of internal control systems in the implementation of Risk Management. (2) The Risk Management Policy as referred to in paragraph (1) letter b and letter d may be exempted for medium-scale Microfinance Institutions and Pawn Companies with business scope at the district/city level. (3) The Risk Management Policy as referred to in paragraph (1) letter b, letter d, and letter f may be exempted for small-scale Microfinance Institutions.

Second Section
Risk Management Procedures and Risk Limit Determination
Article 13
(1) Risk Management Procedures and Risk Limit Determination as referred to in Article 2 paragraph (2) letter b must be adjusted to the level of Risk to be taken regarding PVML Risks. (2) Risk Management Procedures and Risk Limit Determination as referred to in paragraph (1) shall contain at least:
a. accountability and levels of delegation of authority; b. the implementation of periodic reviews of Risk Management Procedures and Risk Limit Determination at least 1 (one) time in 1 (one) year; and
c. adequate documentation of Risk Management Procedures and Risk Limit Determination.
(3) Risk Management Procedures and Risk Limit Determination as referred to in paragraph (2) letter b may be exempted for medium-scale Microfinance Institutions and Pawn Companies with business scope at the district/city level. (4) Risk Management Procedures and Risk Limit Determination as referred to in paragraph (2) letter b and letter c may be exempted for small-scale Microfinance Institutions. (5) Risk Limit Determination as referred to in paragraph (2) must cover:
a. overall limits; b. limits per type of Risk; and
c. limits per functional activities and specific transactions with Risk exposure.
(6) Risk Limit Determination as referred to in paragraph (5) letter b and letter c may be exempted for small-scale Microfinance Institutions.

Article 14
(1) PVMLs that violate the provisions as referred to in Article 13 paragraph (1) and/or paragraph (5) shall be subject to administrative sanctions in the form of:
a. written warnings; b. suspension of part or all of business activities;
c. restriction of certain business activities;
d. reduction of Risk level assessment results; e. revocation of approval; f. prohibition from becoming controlling shareholders, Directors, Board of Commissioners, DPS, and/or Managers; and/or g. administrative fines. (2) Administrative sanctions as referred to in paragraph (1) letter b and letter c are exempted for Secondary Housing Financing Companies, LPEI, BP Tapera, PT PNM, and PT SMI (Persero). (3) Administrative sanctions as referred to in paragraph (1) letter b through letter g may be imposed with or without prior imposition of administrative sanctions in the form of written warnings as referred to in paragraph (1) letter a. (4) Administrative sanctions in the form of administrative fines as referred to in paragraph (1) letter g shall be imposed at most IDR 50,000,000.00 (fifty million rupiah). (5) In the event that PVML has fulfilled the provisions as referred to in paragraph (1), the Financial Services Authority revokes the administrative sanctions. (6) In the event that violations of the provisions as referred to in paragraph (1) occur and the violations have been corrected, the Financial Services Authority imposes administrative sanctions in the form of written warnings that end automatically. (7) In addition to administrative sanctions as referred to in paragraph (1), the Financial Services Authority has the authority to:
a. reduce health assessment results; b. conduct re-assessments of main parties that caused PVML to violate the provisions as referred to in paragraph (1); and/or
c. record track records of parties that caused PVML to violate the provisions as referred to in paragraph (1) in the Financial Services Authority's electronic system.

CHAPTER V
ADEQUACY OF RISK IDENTIFICATION, MEASUREMENT, MONITORING, AND CONTROL PROCESSES, AND RISK MANAGEMENT INFORMATION SYSTEMS First Section General
Article 15
(1) PVMLs must carry out risk identification, measurement, monitoring, and control processes as referred to in Article 2 paragraph (2) letter c regarding material Risk factors. (2) The implementation of risk identification, measurement, monitoring, and control processes as referred to in paragraph (1) must be supported by:
a. reliable and timely management information systems; b. accurate and informative reports regarding PVML's financial conditions, functional activity performance, and Risk exposure; and
c. human resources with competence in the field of Risk Management.
(3) The implementation of risk identification, measurement, monitoring, and control processes as referred to in paragraph (2) letter c may be exempted for medium-scale Microfinance Institutions and Pawn Companies with business scope at the district/city level. (4) The implementation of risk identification, measurement, monitoring, and control processes as referred to in paragraph (2) letter a and letter c may be exempted for small-scale Microfinance Institutions.

Second Section
Risk Identification, Measurement, Monitoring, and Control Processes
Article 16
(1) To implement risk identification processes, PVMLs must conduct analyses at least regarding:
a. Risk characteristics inherent to PVML; and b. Risks from PVML's business activities.
(2) To implement risk measurement processes, PVMLs must conduct at least:
a. periodic evaluations at least:
1. 1 (one) time in 1 (one) year, for PVMLs other than LPEI; or
2. 1 (one) time in 6 (six) months, for LPEI,
regarding the suitability of assumptions, data sources, and procedures used to measure Risks; and b. adjustments to risk measurement processes in the event of changes in PVML's business activities and material Risk factors. (3) To implement risk monitoring processes, PVMLs must conduct at least:
a. evaluations of Risk exposure; and b. adjustments to reporting processes regarding material changes to:
1. business activities;
2. Risk factors;
3. information technology; and
4. PVML's Risk Management information systems.
(4) PVMLs must implement risk control processes to manage specific Risks that may endanger the continuity of PVML's business.

Third Section
Risk Management Information Systems
Article 17
(1) Risk Management Information Systems as referred to in Article 2 paragraph (2) letter c must be supported by human resources with competence in the field of Risk Management information systems. (2) The obligation to support human resources with competence in the field of Risk Management information systems as referred to in paragraph (1) may be exempted for medium and small-scale Microfinance Institutions and Pawn Companies with business scope at the district/city level. (3) Risk Management Information Systems as referred to in Article 2 paragraph (2) letter c include reports or information at least regarding:
a. Risk exposure; b. compliance with Risk Management policies as referred to in Article 12 as well as Risk Management Procedures and Risk Limit Determination as referred to in Article 13; and
c. the implementation of Risk Management compared to established targets.
(4) Reports or information generated from Risk Management Information Systems as referred to in paragraph (1) must be submitted regularly to the Directors or Managers.

Article 18
(1) PVMLs that violate the provisions as referred to in Article 15 paragraph (1), paragraph (2), Article 16, and/or Article 17 paragraph (1) shall be subject to administrative sanctions in the form of:
a. written warnings; b. suspension of part or all of business activities;
c. restriction of certain business activities;
d. reduction of Risk level assessment results; e. revocation of approval; f. prohibition from becoming controlling shareholders, Directors, Board of Commissioners, DPS, and/or Managers; and/or g. administrative fines. (2) Administrative sanctions as referred to in paragraph (1) letter b and letter c are exempted for Secondary Housing Financing Companies, LPEI, BP Tapera, PT PNM, and PT SMI (Persero). (3) Administrative sanctions as referred to in paragraph (1) letter b through letter g may be imposed with or without prior imposition of administrative sanctions in the form of written warnings as referred to in paragraph (1) letter a. (4) Administrative sanctions in the form of administrative fines as referred to in paragraph (1) letter g shall be imposed at most IDR 50,000,000.00 (fifty million rupiah). (5) In the event that PVML has fulfilled the provisions as referred to in paragraph (1), the Financial Services Authority revokes the administrative sanctions. (6) In the event that violations of the provisions as referred to in paragraph (1) occur and the violations have been corrected, the Financial Services Authority imposes administrative sanctions in the form of written warnings that end automatically. (7) In addition to administrative sanctions as referred to in paragraph (1), the Financial Services Authority has the authority to:
a. reduce health assessment results; b. conduct re-assessments of main parties that caused PVML to violate the provisions as referred to in paragraph (1); and/or
c. record track records of parties that caused PVML to violate the provisions as referred to in paragraph (1) in the Financial Services Authority's electronic system.

CHAPTER VI
INTERNAL CONTROL SYSTEMS
First Section
General
Article 19
PVMLs must implement internal control systems effectively regarding Risks inherent in the implementation of business activities and operations at all levels of the PVML organization.

Article 20
(1) The implementation of internal control systems as referred to in Article 19 must be capable of detecting weaknesses and deviations that cause or affect Risk exposure in a timely manner. (2) Internal control systems as referred to in paragraph (1) must ensure:
a. PVML management level compliance with Risk Management policies and procedures, regulatory provisions, and PVML's internal policies or regulations; b. the compliance and effectiveness of Risk Management functions in designing and implementing Risk Management strategies and policies;
c. the availability of complete, accurate, relevant, and timely financial and management information;
d. effectiveness and efficiency in business and operational activities; and e. the effectiveness of Risk culture throughout the PVML organization. (3) Internal control systems as referred to in paragraph (2) letter e may be exempted for large-scale Microfinance Institutions and Pawn Companies with business scope at the provincial level. (4) Internal control systems as referred to in paragraph (2) letter b and letter e may be exempted for medium-scale Microfinance Institutions and Pawn Companies with business scope at the district/city level. (5) Internal control systems as referred to in paragraph (2) letter b, letter c, and letter e may be exempted for small-scale Microfinance Institutions.

Second Section
Internal Control Systems in Risk Management Implementation
Article 21
(1) Comprehensive internal control systems as referred to in Article 2 paragraph (2) letter d in the implementation of Risk Management shall contain at least:
a. the suitability of internal control systems with the types and levels of Risks inherent to PVML's business activities; b. the determination of authority and responsibility for monitoring the adequacy of Risk Management policies as referred to in Article 12, as well as Risk Management Procedures and Risk Limit Determination as referred to in Article 13;
c. the determination of reporting lines and clear separation of functions from operational functions to Risk control functions;
d. organizational structures that clearly depict PVML's business activities; e. accurate and timely financial and operational reporting; f. adequate procedures to ensure PVML's compliance with regulatory provisions and provisions applicable to PVML; g. effective, independent, and objective reviews of PVML's operational activity assessment procedures; h. adequate testing and reviews of Risk Management information systems;
i. complete and adequate documentation of operational procedures, scope, and audit findings, as well as responses from Directors, Board of Commissioners, DPS, and PVML Managers based on audit results; and
j. periodic and continuous verification and reviews of the handling of PVML's material weaknesses and actions by Directors, Board of Commissioners, DPS, and PVML Managers to correct deviations that occur. (2) Assessments of internal control systems in the implementation of Risk Management as referred to in paragraph (1) must be conducted by the internal audit function. (3) Internal control systems in the implementation of Risk Management as referred to in paragraph (1) letter c, letter g, letter h, and letter j may be exempted for large-scale Microfinance Institutions and Pawn Companies with business scope at the provincial level. (4) Controls over internal control systems in the implementation of Risk Management as referred to in paragraph (1) letter c, letter g, letter h, letter i, and letter j may be exempted for medium-scale Microfinance Institutions and Pawn Companies with business scope at the district/city level. (5) Controls over internal control systems in the implementation of Risk Management as referred to in paragraph (1) letter b, letter c, letter f, letter g, letter h, letter i, and letter j may be exempted for small-scale Microfinance Institutions.

Article 22
(1) PVMLs that violate the provisions as referred to in Article 19, Article 20 paragraph (2), and/or Article 21 paragraph (2) shall be subject to administrative sanctions in the form of:
a. written warnings; b. suspension of part or all of business activities;
c. restriction of certain business activities;
d. reduction of Risk level assessment results; e. revocation of approval; f. prohibition from becoming controlling shareholders, Directors, Board of Commissioners, DPS, and/or Managers; and/or g. administrative fines. (2) Administrative sanctions as referred to in paragraph (1) letter b and letter c are exempted for Secondary Housing Financing Companies, LPEI, BP Tapera, PT PNM, and PT SMI (Persero). (3) Administrative sanctions as referred to in paragraph (1) letter b through letter g may be imposed with or without prior imposition of administrative sanctions in the form of written warnings as referred to in paragraph (1) letter a. (4) Administrative sanctions in the form of administrative fines as referred to in paragraph (1) letter g shall be imposed at most IDR 50,000,000.00 (fifty million rupiah). (5) In the event that PVML has fulfilled the provisions as referred to in paragraph (1), the Financial Services Authority revokes the administrative sanctions. (6) In the event that violations of the provisions as referred to in paragraph (1) occur and the violations have been corrected, the Financial Services Authority imposes administrative sanctions in the form of written warnings that end automatically. (7) In addition to administrative sanctions as referred to in paragraph (1), the Financial Services Authority has the authority to:
a. reduce health assessment results; b. conduct re-assessments of main parties that caused PVML to violate the provisions as referred to in paragraph (1); and/or
c. record track records of parties that caused PVML to violate the provisions as referred to in paragraph (1) in the Financial Services Authority's electronic system.

CHAPTER VII
ORGANIZATION AND RISK MANAGEMENT FUNCTIONS
First Section
General
Article 23
To implement effective risk management processes and systems as referred to in Article 2, PVMLs must establish:
a. Risk Management Committees; b. Risk Management Work Units; and
c. Risk Management Functions,
based on PVML's total assets.

Article 24
(1) PVMLs with total assets exceeding IDR 250,000,000,000.00 (two hundred fifty billion rupiah) must establish:
a. Risk Management Committees; and b. Risk Management Work Units.
(2) PVMLs with total assets up to IDR 250,000,000,000.00 (two hundred fifty billion rupiah) must establish Risk Management Functions. (3) PVMLs with total assets up to IDR 250,000,000,000.00 (two hundred fifty billion rupiah) may establish Risk Management Work Units and/or Risk Management Committees. (4) Total assets as referred to in paragraph (1) through paragraph (3) are determined based on:
a. annual financial reports of PVMLs audited by public accountants, for PVMLs required to prepare annual financial reports audited by public accountants; or b. monthly financial reports for December, for PVMLs not required to prepare annual financial reports audited by public accountants. (5) PVMLs based on:
a. annual financial reports of PVMLs audited by public accountants, for PVMLs required to prepare annual financial reports audited by public accountants; or b. monthly financial reports for December, for PVMLs not required to prepare annual financial reports audited by public accountants, that experience an increase in total assets to exceed IDR 250,000,000,000.00 (two hundred fifty billion rupiah) must make adjustments to meet the provisions based on the new total assets as regulated by this Financial Services Authority Regulation within 1 (one) year from the date of the PVML's financial report. (6) PVMLs based on:
a. annual financial reports of PVMLs audited by public accountants, for PVMLs required to prepare annual financial reports audited by public accountants; or b. monthly financial reports for December, for PVMLs not required to prepare annual financial reports audited by public accountants, that experience a decrease in total assets to become less than or equal to IDR 250,000,000,000.00 (two hundred fifty billion rupiah) may make adjustments to meet the provisions based on the new total assets as regulated by this Financial Services Authority Regulation.

Second Section
Risk Management Committees
Article 25
(1) Risk Management Committees as referred to in Article 24 paragraph (1) letter a and paragraph (3) shall consist of at least:
a. half of the Board of Directors members; and b. relevant executive officials.
(2) One of the Board of Directors members as referred to in paragraph (1) letter a is a Board of Directors member who oversees the Risk Management Function. (3) The authority and responsibility of Risk Management Committees as referred to in paragraph (1) include providing recommendations to the Chief Executive or equivalent, containing at least:
a. the preparation of policies, strategies, and guidelines for implementing Risk Management; b. improvements or adjustments to Risk Management implementation based on the results of Risk Management implementation evaluations; and
c. the determination of matters related to business decisions that deviate from normal procedures.
(4) Further provisions regarding the organizational structure of Risk Management Committees as referred to in paragraph (1) are determined by the Financial Services Authority.

Third Section
Risk Management Work Units and Risk Management Functions
Article 26
(1) The organizational structure of Risk Management Work Units as referred to in Article 24 paragraph (1) letter b and paragraph (3) or PVML's Risk Management Functions as referred to in Article 24 paragraph (2) must be adjusted to the size and complexity of PVML's business, Risks inherent to PVML, accompanied by authority and responsibility. (2) Risk Management Work Units or Risk Management Functions must be independent of business and operational functions and of internal control functions. (3) Risk Management Work Units or Risk Management Functions report directly to the Chief Executive or equivalent, or to Board of Directors members who oversee the Risk Management Function. (4) The authority and responsibility of Risk Management Work Units or Risk Management Functions include:
a. identifying Risks, including Risks inherent to PVML's business activities; b. preparing risk measurement methods;
c. monitoring the implementation of Risk Management strategies prepared by Directors or Managers;
d. monitoring overall Risk positions, per type of Risk, and per type of functional activity, as well as conducting testing using scenario/assumptions of abnormal conditions and testing using historical data; e. periodic reviews of Risk Management processes; f. reviewing proposals for the development or expansion of business activities; g. evaluating the accuracy of models and validity of data used to measure Risks, for PVMLs using models for internal purposes; h. providing recommendations to business and operational functions and/or to Risk Management Committees, according to their authority; and
i. preparing and submitting Risk profile reports to the Chief Executive or equivalent, or to Board of Directors or Managers who oversee Risk Management Functions, Risk Management Work Units, and/or Risk Management Committees regularly.
(5) The authority and responsibility of Risk Management Work Units or Risk Management Functions as referred to in paragraph (4) letter e, letter f, letter g, letter h, and letter i may be exempted for large-scale Microfinance Institutions and Pawn Companies with business scope at the provincial level. (6) The authority and responsibility of Risk Management Work Units or Risk Management Functions as referred to in paragraph (4) letter b, letter e, letter f, letter g, letter h, and letter i may be exempted for medium-scale Microfinance Institutions and Pawn Companies with business scope at the district/city level. (7) The authority and responsibility of Risk Management Work Units or Risk Management Functions as referred to in paragraph (4) letter b, letter c, letter d, letter e, letter f, letter g, letter h, and letter i may be exempted for small-scale Microfinance Institutions. (8) Further provisions regarding the organizational structure of Risk Management Work Units or Risk Management Functions as referred to in paragraph (1) are determined by the Financial Services Authority.

Fourth Section
Relationship Between Business and Operational Functions with Risk Management Work Units or Risk Management Functions
Article 27
(1) Business and operational functions as referred to in Article 26 paragraph (2) must inform Risk Management Work Units or Risk Management Functions of inherent Risk exposures regularly.

(2) Further provisions regarding the relationship between business and operational functions with the Risk Management unit or Risk Management function as referred to in paragraph (1) shall be determined by the Financial Services Authority.

Article 28
(1) Financing Institutions, Venture Capital Companies, Microfinance Institutions, and other financial service institutions (hereinafter referred to as "PVML") that violate the provisions as referred to in Article 24 paragraph (1), paragraph (2), paragraph (5), and/or Article 27 paragraph (1) shall be subject to administrative sanctions consisting of:
a. written warning; b. suspension of part or all of business activities;
c. restriction of certain business activities;
d. reduction of the risk assessment result; e. cancellation of approval; f. prohibition from becoming controlling shareholders, Directors, Board of Commissioners, DPS, and/or Managers; and/or g. administrative fine.

(2) Administrative sanctions as referred to in paragraph (1) letters b and c are excluded for Secondary Housing Financing Companies, LPEI, BP Tapera, PT PNM, and PT SMI (Persero).

(3) Administrative sanctions as referred to in paragraph (1) letters b through g may be imposed with or without prior imposition of an administrative sanction consisting of a written warning as referred to in paragraph (1) letter a.

(4) Administrative sanctions consisting of administrative fines as referred to in paragraph (1) letter g shall be imposed at most Rp50,000,000.00 (fifty million rupiah).

(5) In the event that PVML has fulfilled the provisions as referred to in paragraph (1), the Financial Services Authority shall revoke the administrative sanction.

(6) In the event that a violation of the provisions as referred to in paragraph (1) occurs and the violation has been corrected, the Financial Services Authority shall provide an administrative sanction consisting of a written warning that ends automatically.

(7) In addition to administrative sanctions as referred to in paragraph (1), the Financial Services Authority has the authority to:
a. reduce the health assessment result; b. conduct a re-evaluation of the main party that caused PVML to violate the provisions as referred to in paragraph (1); and/or
c. record the track record of the party that caused PVML to violate the provisions as referred to in paragraph (1) in the Financial Services Authority's electronic system.

https://jdih.ojk.go.id/

CHAPTER VIII
RISK MANAGEMENT FOR BUSINESS DEVELOPMENT OR EXPANSION

Article 29
(1) PVML must have written policies and procedures to manage risks inherent in the development or expansion of PVML's business activities.

(2) The policies and procedures as referred to in paragraph (1) must at least cover:
a. systems, procedures, and authorities in the management of business development or expansion; b. identification of all risks inherent in the development or expansion of business activities, both related to PVML and consumers;
c. trial period for risk measurement and monitoring methods against the development or expansion of business activities;
d. accounting information systems for business development or expansion; e. legal aspect analysis for business development or expansion; and f. transparency of information to consumers.

(3) The accounting information system as referred to in paragraph (2) letter d must at least accurately describe the risk profile and profit or loss levels for the development or expansion of business activities.

(4) The legal aspect analysis as referred to in paragraph (2) letter e covers:
a. the potential legal risks arising from the development or expansion of business activities; and b. compliance with applicable regulations.

(5) Aspects in implementing information transparency as referred to in paragraph (2) letter f must pay attention to at least:
a. information provided is complete, correct, and not misleading to consumers; b. balanced information between potential benefits that may be obtained and risks that may arise for consumers;
c. information provided does not obscure, reduce, or cover up important matters related to potential risks; and
d. other information in accordance with Financial Services Authority Regulations regarding consumer and public protection in the financial services sector.

(6) The policies and procedures as referred to in paragraph (2) letters c and d may be excluded for Large-scale Microfinance Institutions and Pawnshop Companies with provincial business scope.

https://jdih.ojk.go.id/

(7) The policies and procedures as referred to in paragraph (2) letters c, d, and e may be excluded for Medium-scale Microfinance Institutions and Pawnshop Companies with district/city business scope.

(8) The policies and procedures as referred to in paragraph (2) letters b, c, d, and e may be excluded for Small-scale Microfinance Institutions.

(9) PVML's business activities constitute a form of business development or expansion if they meet the criteria:
a. have never been conducted previously by PVML; or b. have been conducted previously by PVML but involve development that changes or increases certain risk exposures on PVML.

(10) Further provisions regarding the management of risks for business development or expansion as referred to in paragraph (1) shall be determined by the Financial Services Authority.

Article 30
PVML is prohibited from assigning or approving Directors, Board of Commissioners, DPS, Managers, and/or employees of PVML to carry out activities that are not PVML's business activities using PVML's facilities or assets.

Article 31
(1) In managing risks inherent in new products and activities, LPEI must have written policies and procedures.

(2) The policies and procedures as referred to in paragraph (1) must at least:
a. standard operating systems, procedures, and authorities in the management of new products and activities; b. identification of all risks inherent in new products and activities;
c. trial period for risk measurement and monitoring methods against new products and activities;
d. accounting information systems for new products and activities; and e. legal aspect analysis and consumer protection for new products and activities.

(3) LPEI must disclose risks inherent in new products and activities as referred to in paragraph (2) letter b to consumers, which shall be documented in a document signed by the consumer.

(4) The Board of Directors must submit a report on the issuance of each new product and activity to the Board of Commissioners.

https://jdih.ojk.go.id/

(5) The report as referred to in paragraph (4) must be submitted at the latest 7 (seven) working days since the new product and activity are effectively implemented.

Article 32
(1) PVML that violates the provisions as referred to in Article 29 paragraph (1), Article 30, and/or Article 31 paragraph (1), paragraph (3) shall be subject to administrative sanctions consisting of:
a. written warning; b. suspension of part or all of business activities;
c. restriction of certain business activities;
d. reduction of the risk assessment result; e. cancellation of approval; f. prohibition from becoming controlling shareholders, Directors, Board of Commissioners, DPS, and/or Managers; and/or g. administrative fine.

(2) Administrative sanctions as referred to in paragraph (1) letters b and c are excluded for Secondary Housing Financing Companies, LPEI, BP Tapera, PT PNM, and PT SMI (Persero).

(4) Administrative sanctions consisting of administrative fines as referred to in paragraph (1) letter g shall be imposed at most Rp50,000,000.00 (fifty million rupiah).

(5) In the event that PVML has fulfilled the provisions as referred to in paragraph (1), the Financial Services Authority shall revoke the administrative sanction.

https://jdih.ojk.go.id/

CHAPTER IX
SELF-ASSESSMENT AND REPORTING ON RISK MANAGEMENT IMPLEMENTATION

Article 33
(1) PVML other than LPEI must conduct an annual self-assessment of the risk profile for the end of December position.

(2) LPEI must conduct a quarterly self-assessment of the risk profile for the positions of March, June, September, and December.

(3) If necessary, the Financial Services Authority may request PVML to conduct a self-assessment of the risk profile at any time.

(4) PVML must implement a self-assessment of the risk profile at any time as requested by the Financial Services Authority as referred to in paragraph (3).

(5) The results of the self-assessment of the risk profile as referred to in paragraph (1), paragraph (2), and paragraph (4) must receive approval from the Board of Directors or Manager.

(6) The results of the self-assessment of the risk profile as referred to in paragraph (1), paragraph (2), and paragraph (4) must be submitted to the Board of Commissioners.

(7) The results of the self-assessment of the risk profile as referred to in paragraph (1) constitute part of the health assessment results for PVML other than LPEI that conduct health assessments with a scope covering risk profile factors.

(8) The results of the self-assessment of the risk profile as referred to in paragraph (2) for the December position constitute part of the health assessment results for LPEI.

(9) Further provisions regarding the self-assessment of the risk profile as regulated in paragraph (1) through paragraph (4) shall be determined by the Financial Services Authority.

Article 34
(1) PVML must submit the results of the self-assessment of the risk profile as referred to in Article 33 paragraph (1) and paragraph (2) in the risk profile report to the Financial Services Authority.

(2) The risk profile report as referred to in paragraph (1) submitted by PVML to the Financial Services Authority must contain the same material as the risk profile report submitted by the Risk Management unit or designated executive responsible for the Risk Management function to members of the Board of Directors or Manager overseeing the Risk Management function and to the Risk Management Committee.

(3) The risk profile report on the self-assessment of risk levels for PVML other than LPEI for the end of December position as referred to in Article 33 paragraph (1) must be submitted at the latest on February 15 of the following year.

https://jdih.ojk.go.id/

(4) If the deadline for submitting the risk profile report on the self-assessment of risk levels for PVML other than LPEI as referred to in paragraph (3) falls on a holiday, the deadline for submitting the report is on the next working day.

(5) The risk profile report on the self-assessment of risk levels for PVML other than LPEI for the end of December position as referred to in Article 33 paragraph (1) constitutes part of the health assessment results report for PVML other than LPEI that conduct health assessments with a scope covering risk profile factors.

(6) The risk profile report on the self-assessment of risk levels for LPEI on a quarterly basis as referred to in Article 33 paragraph (2) must be submitted at the latest 1 (one) month since the reporting period ended.

(7) The risk profile report on the self-assessment of risk levels for LPEI for the end of December position as referred to in Article 33 paragraph (2) constitutes part of the health assessment results report for LPEI.

(8) PVML must submit the risk profile report on the self-assessment of risk levels at any time as referred to in Article 33 paragraph (3) within the time limit determined by the Financial Services Authority.

Article 35
(1) In the event of conditions that have the potential to cause significant losses to financial conditions, PVML must submit other risk profile reports to the Financial Services Authority.

(2) Other risk profile reports as referred to in paragraph (1) include reports other than the mandatory risk profile reports as referred to in Article 33.

(3) Other risk profile reports as referred to in paragraph (1) must be submitted at the latest 1 (one) month after the condition with the potential to cause significant losses to PVML's financial conditions is known.

(4) The obligation to submit other risk profile reports as referred to in paragraph (1) may be based on a request from the Financial Services Authority.

(5) Further provisions regarding the assessment of other risk profiles as regulated in paragraph (1) through paragraph (3) shall be determined by the Financial Services Authority.

Article 36
(1) PVML must submit:
a. risk profile reports as referred to in Article 34 paragraph (1); and b. other risk profile reports as referred to in Article 35 paragraph (1), online through the Financial Services Authority's data communication network system.

https://jdih.ojk.go.id/

(2) In the event that the Financial Services Authority's data communication network system as referred to in paragraph (1) is not available or experiences disturbances, submission is carried out through the Financial Services Authority's electronic mail address.

(3) In the event of disturbances to the Financial Services Authority's electronic mail, report submission is carried out offline through the Financial Services Authority office.

(4) If the deadline for submitting reports as referred to in paragraph (1) falls on a holiday, the deadline for submitting reports is on the next working day.

(5) Under certain conditions, the Financial Services Authority has the authority to set different submission deadlines for reports from the provisions as referred to in paragraph (1).

(6) Further provisions regarding the procedure for submitting risk profile reports shall be determined by the Financial Services Authority.

Article 37
(1) The Financial Services Authority may conduct an assessment of the implementation of Risk Management on PVML.

(2) In the assessment of the implementation of Risk Management as referred to in paragraph (1), PVML must submit data and information related to the implementation of Risk Management to the Financial Services Authority.

Article 38
(1) PVML that violates the provisions as referred to in Article 33 paragraph (1), paragraph (2), paragraph (4), paragraph (5), paragraph (6), Article 34 paragraph (1), paragraph (2), paragraph (6), paragraph (8), Article 35 paragraph (1), paragraph (3), Article 36 paragraph (1), and/or Article 37 paragraph (2) shall be subject to administrative sanctions consisting of:
a. written warning; b. suspension of part or all of business activities;
c. restriction of certain business activities;
d. reduction of the risk assessment result; e. cancellation of approval; f. prohibition from becoming controlling shareholders, Directors, Board of Commissioners, DPS, and/or Managers; and/or g. administrative fine.

(2) Administrative sanctions as referred to in paragraph (1) letters b and c are excluded for Secondary Housing Financing Companies, LPEI, BP Tapera, PT PNM, and PT SMI (Persero).

https://jdih.ojk.go.id/

(4) Administrative sanctions consisting of administrative fines as referred to in paragraph (1) letter g shall be imposed at most Rp50,000,000.00 (fifty million rupiah).

(5) In the event that PVML has fulfilled the provisions as referred to in paragraph (1), the Financial Services Authority shall revoke the administrative sanction.

CHAPTER X
OTHER PROVISIONS

Article 39
In the event that PVML applies Integrated Risk Management as referred to in Financial Services Authority Regulations regarding the implementation of Integrated Risk Management for financial conglomerates, the Risk Management function as referred to in Article 24 may be merged with the Risk Management function in the structure of the corresponding PVML's financial conglomerate.

Article 40
The Financial Services Authority may grant approval or different policies based on certain considerations with this Financial Services Authority Regulation.

CHAPTER XI
TRANSITIONAL PROVISIONS

Article 41
PVML other than LPEI that have obtained business licenses before this Financial Services Authority Regulation is promulgated, the obligation to submit risk profile reports on the self-assessment of risk levels for the end of December position as referred to in Article 33 paragraph (1) shall be implemented for:
a. Financing Companies, Infrastructure Financing Companies, Venture Capital Companies, Secondary Housing Financing Companies, BP Tapera, PT PNM, and PT SMI (Persero) submitted starting from the 2024 assessment period, submitted at the latest on February 15, 2025; b. Pawnshop Companies and LPBBTI Organizers submitted starting from the 2025 assessment period, submitted at the latest on February 15, 2026;
c. Large-scale Microfinance Institutions submitted starting from the 2027 assessment period, submitted at the latest on February 15, 2028;
d. Medium-scale Microfinance Institutions submitted starting from the 2028 assessment period, submitted at the latest on February 15, 2029; and e. Small-scale Microfinance Institutions submitted starting from the 2030 assessment period, submitted at the latest on February 15, 2031.

https://jdih.ojk.go.id/

Article 42
(1) For Financing Companies that have obtained business licenses before this Financial Services Authority Regulation takes effect, the imposition of administrative sanctions for violations of Article 24 paragraph (1) letter b shall start to apply 1 (one) year since this Financial Services Authority Regulation is promulgated.

(2) For LPEI, BP Tapera, PT PNM, Secondary Housing Financing Companies, and PT SMI (Persero) that have been supervised by the Financial Services Authority before this Financial Services Authority Regulation takes effect, the imposition of administrative sanctions for violations of Article 2 paragraph (1), paragraph (3), Article 3, Article 4, Article 5 paragraph (3), Article 7, Article 8 paragraph (8), Article 13 paragraph (1), paragraph (5), Article 15 paragraph (1), paragraph (2), Article 16, Article 17 paragraph (1), Article 19, Article 20 paragraph (2), Article 21 paragraph (2), Article 24 paragraph (1), paragraph (2), Article 27 paragraph (1), Article 29 paragraph (1), Article 30, Article 31 paragraph (1), paragraph (3), Article 33 paragraph (1), paragraph (2), paragraph (4), paragraph (5), paragraph (6), Article 34 paragraph (1), paragraph (2), paragraph (6), paragraph (8), Article 35 paragraph (1), paragraph (3) and Article 36 paragraph (1), and/or Article 37 paragraph (2) shall start to apply 6 (six) months since this Financial Services Authority Regulation is promulgated.

(3) For Venture Capital Companies that have obtained business licenses before this Financial Services Authority Regulation takes effect, the imposition of administrative sanctions for violations of Article 2 paragraph (1), paragraph (3), Article 3, Article 4, Article 5 paragraph (3), Article 7, Article 8 paragraph (8), Article 13 paragraph (1), paragraph (5), Article 15 paragraph (1), paragraph (2), Article 16, Article 17 paragraph (1), Article 19, Article 20 paragraph (2), Article 21 paragraph (2), Article 24 paragraph (1), paragraph (2), Article 27 paragraph (1), Article 29 paragraph (1), Article 30, Article 33 paragraph (1), paragraph (4), paragraph (5), paragraph (6), Article 34 paragraph (1), paragraph (2), paragraph (8), Article 35 paragraph (1), paragraph (3), Article 36 paragraph (1), and/or Article 37 paragraph (2) shall start to apply 1 (one) year since this Financial Services Authority Regulation is promulgated.

(4) For LPBBTI Organizers that have obtained business licenses before this Financial Services Authority Regulation takes effect, the imposition of administrative sanctions for violations of Article 2 paragraph (1), paragraph (3), Article 3, Article 4, Article 5 paragraph (3), Article 7, Article 8 paragraph (8), Article 13 paragraph (1) paragraph (5), Article 15 paragraph (1), paragraph (2), Article 16, Article 17 paragraph (1), Article 19, Article 20 paragraph (2), Article 21 paragraph (2), Article 24 paragraph (1), paragraph (2), Article 27 paragraph (1), Article 29 paragraph (1), Article 30, Article 33 paragraph (1), paragraph (4), paragraph (5), paragraph (6), Article 34 paragraph (1), paragraph (2), paragraph (8), Article 35 paragraph (1), paragraph (3), Article 36 paragraph (1), and/or Article 37 paragraph (2) shall start to apply 1 (one) year since this Financial Services Authority Regulation is promulgated.

(5) For Pawnshop Companies that have obtained business licenses before this Financial Services Authority Regulation takes effect, the imposition of administrative sanctions for violations of Article 2 paragraph (1), paragraph (3), Article 3, Article 4, Article 5 paragraph (3), Article 7, Article 8 paragraph (8), Article 13 paragraph (1), paragraph (5), Article 15 paragraph (1), paragraph (2), Article 16, Article 17 paragraph (1), Article 19, Article 20 paragraph (2), Article 21 paragraph (2), Article 24 paragraph (1), paragraph (2), Article 27 paragraph (1), Article 29 paragraph (1), Article 30, Article 33 paragraph (1), paragraph (4), paragraph (5), paragraph (6), Article 34 paragraph (1), paragraph (2), paragraph (8), Article 35 paragraph (1), paragraph (3), Article 36 paragraph (1), and/or Article 37 paragraph (2) shall start to apply 1 (one) year since this Financial Services Authority Regulation is promulgated.

(6) For Large-scale Microfinance Institutions that have obtained business licenses before this Financial Services Authority Regulation takes effect, the imposition of administrative sanctions for violations of Article 2 paragraph (1), paragraph (3), Article 3, Article 4, Article 5 paragraph (3), Article 7, Article 8 paragraph (8), Article 13 paragraph (1) paragraph (5), Article 15 paragraph (1) paragraph (2), Article 16, Article 17 paragraph (1), Article 19, Article 20 paragraph (2), Article 21 paragraph (2), Article 24 paragraph (1), paragraph (2), Article 27 paragraph (1), Article 29 paragraph (1), Article 30, Article 33 paragraph (1), paragraph (4), paragraph (5), paragraph (6), Article 34 paragraph (1), paragraph (2), paragraph (8), Article 35 paragraph (1), paragraph (3), Article 36 paragraph (1), and/or Article 37 paragraph (2) shall start to apply 3 (three) years since this Financial Services Authority Regulation is promulgated.

(7) For Medium-scale Microfinance Institutions that have obtained business licenses before this Financial Services Authority Regulation takes effect, the imposition of administrative sanctions for violations of Article 2 paragraph (1), paragraph (3), Article 3, Article 4, Article 5 paragraph (3), Article 7, Article 8 paragraph (8), Article 13 paragraph (1), paragraph (5), Article 15 paragraph (1), paragraph (2), Article 16, Article 17 paragraph (1), Article 19, Article 20 paragraph (2), Article 21 paragraph (2), Article 24 paragraph (1), paragraph (2), Article 27 paragraph (1), Article 29 paragraph (1), Article 30, Article 33 paragraph (1), paragraph (4), paragraph (5), paragraph (6), Article 34 paragraph (1), paragraph (2), paragraph (8), Article 35 paragraph (1), paragraph (3), Article 36 paragraph (1), and/or Article 37 paragraph (2) shall start to apply 4 (four) years since this Financial Services Authority Regulation is promulgated.

(8) For Small-scale Microfinance Institutions that have obtained business licenses before this Financial Services Authority Regulation takes effect, the imposition of administrative sanctions for violations

https://jdih.ojk.go.id/

administrative sanctions for violations of the provisions of Article 2 paragraph (1), paragraph (3), Article 3, Article 4, Article 5 paragraph (3), Article 7, Article 8 paragraph (8), Article 13 paragraph (1), paragraph (5), Article 15 paragraph (1), paragraph (2), Article 16, Article 17 paragraph (1), Article 19, Article 20 paragraph (2), Article 21 paragraph (2), Article 24 paragraph (1), paragraph (2), Article 27 paragraph (1), Article 29 paragraph (1), Article 30, Article 33 paragraph (1), paragraph (4), paragraph (5), paragraph (6), Article 34 paragraph (1), paragraph (2), paragraph (8), Article 35 paragraph (1), paragraph (3), Article 36 paragraph (1), and/or Article 37 paragraph (2) shall take effect 6 (six) years from the date this Financial Services Authority Regulation is promulgated.

Article 43
(1) Administrative sanctions that have been imposed on Financing Institutions, Venture Capital Companies, and Microfinance Institutions (PVML) based on Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions shall remain valid insofar as they do not conflict with this Financial Services Authority Regulation. (2) PVML that have not been able to overcome the causes of the imposition of administrative sanctions as referred to in paragraph (1) shall be subject to further administrative sanctions in accordance with the procedures for imposing administrative sanctions as regulated in this Financial Services Authority Regulation.

CHAPTER XII
FINAL PROVISIONS

Article 44
At the time this Financial Services Authority Regulation takes effect:
a. Financial Services Authority Regulation of the Republic of Indonesia Number 4/POJK.05/2018 concerning Secondary Housing Financing Companies (State Gazette of the Republic of Indonesia Year 2018 Number 40, Supplement to the State Gazette of the Republic of Indonesia Number 6192) as amended by Financial Services Authority Regulation of the Republic of Indonesia Number 12/POJK.05/2022 concerning Amendments to Financial Services Authority Regulation of the Republic of Indonesia Number 4/POJK.05/2018 concerning Secondary Housing Financing Companies (State Gazette of the Republic of Indonesia Year 2022 Number 6/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 6/OJK); b. Financial Services Authority Regulation of the Republic of Indonesia Number 16/POJK.05/2019 concerning Supervision of PT Permodalan Nasional Madani (Persero) (State Gazette of the Republic of Indonesia Year 2019 Number 107, Supplement to the State Gazette of the Republic of Indonesia Number 6357);
c. Financial Services Authority Regulation of the Republic of Indonesia Number 46/POJK.05/2020 concerning Infrastructure Financing Companies (State Gazette of the Republic of Indonesia Year 2020 Number 249, Supplement to the State Gazette of the Republic of Indonesia Number 6576);
d. Financial Services Authority Regulation of the Republic of Indonesia Number 9/POJK.05/2022 concerning Supervision of the Indonesia Export Financing Institution (State Gazette of the Republic of Indonesia Year 2022 Number 1/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 1/OJK); e. Financial Services Authority Regulation of the Republic of Indonesia Number 10/POJK.05/2022 concerning Joint Financing Services Based on Information Technology (State Gazette of the Republic of Indonesia Year 2022 Number 2/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 2/OJK); f. Financial Services Authority Regulation of the Republic of Indonesia Number 20 of 2022 concerning Supervision of the People's Housing Savings Management Body by the Financial Services Authority (State Gazette of the Republic of Indonesia Year 2022 Number 23/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 15/OJK); and g. Financial Services Authority Regulation of the Republic of Indonesia Number 25 of 2023 concerning the Conduct of Business by PVML and PVMLS (State Gazette of the Republic of Indonesia Year 2023 Number 43/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 65/OJK), shall remain valid insofar as they do not conflict with the provisions in this Financial Services Authority Regulation.

Article 45
(1) At the time this Financial Services Authority Regulation takes effect, the provisions regarding the implementation of Risk Management in Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions (State Gazette of the Republic of Indonesia Year 2020 Number 200, Supplement to the State Gazette of the Republic of Indonesia Number 6552) are declared not to apply to Financing Companies. (2) Implementing regulations of Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions (State Gazette of the Republic of Indonesia Year 2020 Number 200, Supplement to the State Gazette of the Republic of Indonesia Number 6552) are declared to remain valid for Financing Companies insofar as they do not conflict with this Financial Services Authority Regulation.

Article 46
This Financial Services Authority Regulation takes effect on the date of its promulgation. https://jdih.ojk.go.id/

This copy is in accordance with the original
Director of Legal Development
Legal Department signed
Aat Windradi

In order that everyone may be informed, it is ordered to promulgate this Financial Services Authority Regulation by placing it in the State Gazette of the Republic of Indonesia.

Established in Jakarta on 24 December 2024
DEPUTY CHAIRMAN OF THE COMMISSIONERS COUNCIL
OF THE FINANCIAL SERVICES AUTHORITY OF THE
REPUBLIC OF INDONESIA AS A MEMBER OF THE
COMMISSIONERS COUNCIL REPLACING THE CHAIRMAN OF THE COMMISSIONERS COUNCIL OF THE FINANCIAL SERVICES AUTHORITY OF THE REPUBLIC OF INDONESIA, signed MIRZA ADITYASWARA

Promulgated in Jakarta on 27 December 2024
MINISTER OF LAW OF THE REPUBLIC OF INDONESIA, signed SUPRATMAN ANDI AGTAS

STATE GAZETTE OF THE REPUBLIC OF INDONESIA YEAR 2024 NUMBER 55/OJK https://jdih.ojk.go.id/

EXPLANATION
OF
FINANCIAL SERVICES AUTHORITY REGULATION
OF THE REPUBLIC OF INDONESIA
NUMBER 42 OF 2024
CONCERNING
THE IMPLEMENTATION OF RISK MANAGEMENT FOR FINANCING INSTITUTIONS, VENTURE CAPITAL COMPANIES, MICROFINANCE INSTITUTIONS, AND OTHER FINANCIAL SERVICE INSTITUTIONS

I. GENERAL
Regulations regarding Risk Management for financial service institutions are a strategic step that not only protects institutions from various threats, but also encourages growth, efficiency, and trust from all stakeholders. Provisions regarding Risk Management for Non-Bank Financial Service Institutions were previously regulated in Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions. The issuance of Law Number 4 of 2023 concerning the Development and Strengthening of the Financial Sector (UU P2SK) has mandated the division of the supervision field for Non-Bank Financial Service Institutions into 2 (two) separate supervision fields, namely the supervision field for insurance, pensions, and guarantees; and the supervision field for financing institutions, venture capital companies, microfinance institutions, and other financial service institutions. The scope of this Financial Services Authority Regulation covers financing service businesses, Microfinance Institutions, LPEI, Secondary Housing Financing Companies, PT PNM, BP Tapera, and PT SMI (Persero). Financing service businesses include Financing Companies, Infrastructure Financing Companies, Venture Capital Companies, Pawnshop Companies, LPBBTI Organizers, and other financing activities regulated by the Financial Services Authority. Financing Companies are the only financial service institutions in the supervision field of financing institutions, venture capital companies, microfinance institutions, and other financial service institutions that are subject to Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions. In addition, regulations regarding Risk Management for sui generis financial service institutions such as LPEI, BP Tapera, PT PNM, and PT SMI (Persero) are regulated in their respective Financial Services Authority Regulations. Financial service institutions such as Venture Capital Companies, Microfinance Institutions, LPBBTI Organizers, Infrastructure Financing Companies, and Pawnshop Companies have not yet regulated the implementation of Risk Management. UU P2SK has mandated the preparation of the implementation of Risk Management for financing service businesses as contained in Article 122 paragraph (3) and the implementation of Risk Management for Financial Sector Business Actors as regulated in Article 269 of UU P2SK. To implement the mandate of UU P2SK, harmonize provisions, and improve financial service institutions in the supervision field of financing institutions, Venture Capital Companies, Microfinance Institutions, and other financial service institutions, it is necessary to prepare a Financial Services Authority Regulation concerning the Implementation of Risk Management for Financing Institutions, Venture Capital Companies, Microfinance Institutions, and Other
Financial Service Institutions.

II. ARTICLE BY ARTICLE

Article 1
Clearly sufficient.

Article 2
Paragraph (1)
The implementation of Risk Management includes the implementation of anti-money laundering programs, counter-terrorism financing prevention, and counter-proliferation financing of weapons of mass destruction prevention as referred to in legislation regarding the implementation of anti-money laundering, counter-terrorism financing prevention, and counter-proliferation financing of weapons of mass destruction prevention programs in the financial service sector. To ensure the effective implementation of Risk Management, the Board of Directors, Board of Commissioners, DPS, and Managers refer to the duties and responsibilities of the Board of Directors, Board of Commissioners, DPS, and Managers.

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Article 3
The term "business complexity" is reflected, among others, in the diversity of business activities, products and/or services, branch office networks or distribution channels, and/or supporting technology used. The term "PVML capability" refers, among others, to financial capability, supporting infrastructure, and human resource capability.

Article 4
Paragraph (1)
Letter a
Examples of Credit Risk include credit concentration risk, counterparty credit risk, and settlement risk.
Credit concentration risk is a Risk that arises due to the concentration of fund provision to 1 (one) party or a group of parties, industries, sectors, and/or specific geographic areas that has the potential to cause significant losses that can threaten the continuity of PVML's business.

Counterparty credit risk is a Risk that arises due to the failure of the counterparty to fulfill its obligations and arises from transaction types that have specific characteristics, for example, transactions influenced by fair value or market value movements. Settlement risk is a Risk that arises due to the failure to deliver cash and/or financial instruments on the agreed settlement date from the sale and/or purchase of financial instruments.

Letter b
Clearly sufficient.

Letter c
Clearly sufficient.

Letter d
Strategic Risk arises, among others, because:
a. PVML sets strategies that are not aligned with PVML's vision and mission; b. PVML conducts strategic environment analysis that is not comprehensive;
c. there is a mismatch of strategic plans (strategic plan) between strategic levels; and
d. failure to anticipate changes in the business environment such as technological changes, macroeconomic condition changes, market competition, and changes in relevant authority policies.

Letter e
Clearly sufficient.

Letter f
Legal Risk arises, among others, due to the absence of supporting legislation or weaknesses in agreements such as the non-fulfillment of contract validity requirements or imperfect collateral binding.

Letter g
Clearly sufficient.

Letter h
Reputational Risk arises, among others, due to negative media coverage and/or rumors regarding PVML, and ineffective PVML communication strategies.

Paragraph (2)
Letter a
See explanation of paragraph (1) letter a.

Letter b
Clearly sufficient.

Letter c
Clearly sufficient.

Letter d
See explanation of paragraph (1) letter d.

Letter e
Clearly sufficient.

Letter f
See explanation of paragraph (1) letter f.

Letter g
Clearly sufficient.

Letter h
See explanation of paragraph (1) letter h.

Letter i
Clearly sufficient.

Paragraph (3)
Letter a
Credit Risk for LPBBTI Organizers arises, among others, because the credit scoring possessed by the LPBBTI Organizer is not accurate enough to detect the possibility of fund recipients failing to fulfill their obligations and arises from transaction types that have specific characteristics.

Letter b
Clearly sufficient.

Letter c
See explanation of paragraph (1) letter d.

Letter d
See explanation of paragraph (1) letter f.

Letter e
Clearly sufficient.

Letter f
See explanation of paragraph (1) letter h.

Paragraph (4)
The scope of business of Pawnshop Companies refers to Financial Services Authority Regulations regarding pawnshops.

Letter a
Number 1
See explanation of paragraph (1) letter a.

Number 2
Clearly sufficient.

Number 3
Clearly sufficient.

Number 4
See explanation of paragraph (1) letter d.

Number 5
Clearly sufficient.

Number 6
See explanation of paragraph (1) letter f.

Number 7
Clearly sufficient.

Number 8
See explanation of paragraph (1) letter h.

Letter b
Number 1
See explanation of paragraph (1) letter a.

Number 2
Clearly sufficient.

Number 3
Clearly sufficient.

Number 4
See explanation of paragraph (1) letter d.

Number 5
Clearly sufficient.

Number 6
See explanation of paragraph (1) letter f.

Number 7
Clearly sufficient.

Number 8
See explanation of paragraph (1) letter h.

Letter c
Number 1
See explanation of paragraph (1) letter a.

Number 2
Clearly sufficient.

Number 3
See explanation of paragraph (1) letter d.

Number 4
Clearly sufficient.

Number 5
See explanation of paragraph (1) letter f.

Number 6
Clearly sufficient.

Number 7
See explanation of paragraph (1) letter h.

Paragraph (5)
Letter a
The determination of business scale for Microfinance Institutions refers to Financial Services Authority Regulations regarding Microfinance Institutions.

Number 1
See explanation of paragraph (1) letter a.

Number 2
Clearly sufficient.

Number 3
Clearly sufficient.

Number 4
See explanation of paragraph (1) letter f.

Number 5
Clearly sufficient.

Number 6
See explanation of paragraph (1) letter h.

Letter b
Number 1
See explanation of paragraph (1) letter a.

Number 2
Clearly sufficient.

Number 3
Clearly sufficient.

Letter c
Number 1
See explanation of paragraph (1) letter a.

Number 2
Clearly sufficient.

Number 3
Clearly sufficient.

Article 5
Paragraph (1)
The term "Other Risks" refers to Risks other than those mandated for each Financial Service Institution (LJK).

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Article 6
Paragraph (1)
The imposition of administrative sanctions as referred to in paragraph (1) is applied by considering, among others:
a. complexity of the regulatory violation; b. repeated regulatory violations; and/or
c. impact of the regulatory violation on consumer losses, PVML's financial condition, and the financial service sector.

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Paragraph (5)
Clearly sufficient.

Paragraph (6)
Clearly sufficient.

Paragraph (7)
Clearly sufficient.

Article 7
Every level of position includes, among others, the Board of Directors, Board of Commissioners, DPS, Managers, and other positions related to the implementation of Risk Management.

Article 8
Paragraph (1)
Letter a
Risk Management policies and strategies include, among others, the determination and approval of the level of Risk taken (risk appetite) along with Risk limits, whether overall (composite), per Risk type, per functional activity, or per material/significant transaction.

Letter b
Clearly sufficient.

Letter c
Transactions and Risk limits requiring Board of Directors approval include, among others, transactions and Risk limits that have exceeded the authority of PVML officials one level below the Board of Directors, in accordance with applicable PVML internal policies and procedures.

Letter d
The development of Risk Management culture includes, among others, adequate communication to all organizational levels regarding Risk Management principles, including developing a risk-aware culture and the importance of effective internal controls.

Letter e
The improvement of human resource competence includes, among others, continuous education and training programs regarding the implementation of Risk Management.

Letter f
The term "independent" refers, among others, to the separation of functions between the Risk Management function that performs risk identification, measurement, monitoring, and control, and the function that conducts and completes business and operational activities.

Letter g
Periodic review is intended, among others, to anticipate changes in external and internal factors.

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Paragraph (5)
Clearly sufficient.

Paragraph (6)
The frequency of periodic evaluation is adjusted to PVML's needs, considering the size and complexity of PVML. In the event of internal and/or external factors significantly affecting PVML's business activities, PVML may evaluate Risk Management policies and strategies outside of periodic evaluations.

Paragraph (7)
Clearly sufficient.

Paragraph (8)
Clearly sufficient.

Article 9
Paragraph (1)
Letter a
Clearly sufficient.

Letter b
Clearly sufficient.

Letter c
The term "transactions and Risk limits requiring Board of Commissioners approval" refers, among others, to business or operational activities that have exceeded the Board of Directors' authority to decide on the matter, in accordance with applicable PVML internal policies and procedures.

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Paragraph (5)
Clearly sufficient.

Paragraph (6)
Clearly sufficient.

Article 10
Clearly sufficient.

Article 11
Paragraph (1)
See explanation of Article 6 paragraph (1).

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Paragraph (5)
Clearly sufficient.

Paragraph (6)
Clearly sufficient.

Paragraph (7)
Clearly sufficient.

Article 12
Paragraph (1)
Risk Management policies are established, among others, by formulating Risk Management strategies to ensure that:
a. PVML maintains Risk exposure in accordance with PVML's internal policies and procedures, legislation, and other regulations; and b. PVML is managed by human resources with knowledge, experience, and expertise in Risk Management according to PVML's business complexity. The formulation of Risk Management strategies is conducted by considering PVML's financial condition, PVML's organization, and Risks arising from changes in external and internal factors.

Letter a
Clearly sufficient.

Letter b
Clearly sufficient.

Letter c
The level of Risk to be taken (risk appetite) considers PVML's experience in managing Risk and PVML's capital capability to absorb Risk. Risk Tolerance (risk tolerance) is the potential loss that can be absorbed by PVML's capital.

Letter d
The determination of Risk rating assessment is the basis for PVML to categorize PVML's Risk ratings.
Risk ratings for PVML are categorized into 5 (five) ratings, namely:

rating 1 (low);
rating 2 (medium-low);
rating 3 (medium);
rating 4 (medium-high); and
rating 5 (high).

Letter e
The term "contingency plan" refers to a plan for developing scenarios to anticipate internal disruptions including system failures and external disruptions that cause emergency conditions that can disrupt PVML's operations. The formulation of contingency plans is known as the term contingency plan. The worst-case scenario is known as the term worst-case scenario.

Letter f
Clearly sufficient.

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly sufficient.

Article 13
Paragraph (1)
Clearly sufficient.

Paragraph (2)
Letter a
Clearly sufficient.

Letter b
Clearly sufficient.

Letter c
Adequate documentation is conducted with written, complete, accurate, current, and intact documentation so as to facilitate audit trails for PVML's internal control purposes.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Paragraph (5)
Letter a
The term "overall limits" refers to the Risk limit that can be tolerated by PVML for all Risks applied.

Letter b
The term "limits per Risk type" refers to the Risk limit that can be tolerated by PVML for each type of Risk.

Letter c
The term "limits per specific functional activity" refers to the Risk limit that can be tolerated by PVML for each functional activity.

Paragraph (6)
Clearly sufficient.

Article 14
Paragraph (1)
See explanation of Article 6 paragraph (1).

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Paragraph (5)
Clearly sufficient.

Paragraph (6)
Clearly sufficient.

Paragraph (7)
Clearly sufficient.

Article 15
Paragraph (1)
The term "Risk factors" refers to various parameters that influence Risk exposure.
The term "material Risk factors" refers to Risk factors, both quantitative and qualitative, that significantly affect PVML's financial condition.

Paragraph (2)
Letter a
Clearly sufficient.

Letter b
The term "informative" refers, among others, to being easy to understand.

Letter c
The term "having competence in Risk Management" refers, among others, to having:
a. expertise certificates in Risk Management; b. experience in Risk Management; and/or
c. adequate experience in the relevant Financial Service Institution sector.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Article 16
Paragraph (1)
The Risk identification process can, among others, be based on PVML's past loss experiences.

Paragraph (2)
To implement Risk measurement, PVML can use various approaches, both qualitative and quantitative, adjusted to the business objectives and complexity of PVML's business.

Letter a
Clearly sufficient.

Letter b
The term "material changes" refers to changes in PVML's business activities and Risk factors, both quantitative or qualitative, that can affect PVML's financial condition.

Paragraph (3)
Letter a
Evaluation of Risk exposure is conducted through monitoring and reporting of material Risks or Risks impacting PVML's capital/funding conditions, which is based, among others, on potential Risk assessments using historical trends.

Letter b
Clearly sufficient.

Paragraph (4)
Risk control can be conducted, among others, through hedging, Risk mitigation methods, and capital addition to absorb potential losses.

Article 17
Paragraph (1)
The term "having competence in Risk Management Information Systems" refers to having competence in Risk Management Information Systems, including having expertise certificates and/or proof of having undergone training in Risk Management Information Systems. The term "Risk Management Information System" refers to a system that uses information technology and data processing to support decision-making in risk management.

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Letter a
Reports or Risk exposure information cover quantitative and qualitative exposure, both overall (composite) and details per Risk type and per functional activity type.

Letter b
Clearly sufficient.

Letter c
Clearly sufficient.

Paragraph (4)
The term "regularly" refers to the frequency of reports or information submitted to the Board of Directors or Managers, adjusted to PVML's needs.

Article 18
Paragraph (1)
See explanation of Article 6 paragraph (1).

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Paragraph (5)
Clearly sufficient.

Paragraph (6)
Clearly sufficient.

Paragraph (7)
Clearly sufficient.

Article 19
Clearly sufficient.

Article 20
Paragraph (1)
The term "timely" refers to the condition before the occurrence of weaknesses and deviations that cause or influence risk exposure.

Paragraph (2)
Letter a
Clearly sufficient.

Letter b
Clearly sufficient.

Letter c
Complete, accurate, useful, and timely financial and management information is needed for appropriate and accountable decision-making, and communicated to interested parties.

Letter d
Effectiveness and efficiency in business and operational activities are needed, among others, to protect PVML's assets and other resources from related Risks.

Letter e
Risk culture (risk culture) effectiveness is intended to identify weaknesses and deviations earlier and continuously reassess the fairness of existing PVML policies and procedures.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Paragraph (5)
Clearly sufficient.

Article 21
Clearly sufficient.

Article 22
Paragraph (1)
See explanation of Article 6 paragraph (1).

Paragraph (2)
Clearly sufficient.

Paragraph (3)
Clearly stated.
Paragraph (4)
Clearly stated.
Paragraph (5)
Clearly stated.
Paragraph (6)
Clearly stated.
Paragraph (7)
Clearly stated.
Article 23
Clearly stated.
Article 24
Paragraph (1)
The Risk Management Committee must be non-structural.
The Risk Management Committee for BP Tapera is the Risk Management Commission.
Paragraph (2)
Clearly stated.
Paragraph (3)
Clearly stated.
Paragraph (4)
Clearly stated.
Paragraph (5)
Clearly stated.
Paragraph (6)
Clearly stated.
Article 25
Paragraph (1)
Letter a
Clearly stated.
Letter b
The term "relevant executive officials" refers to officials who are directly responsible to the Board of Directors or have significant influence over the policy and/or operations of the PVML related to the implementation of Risk Management, including officials one level below the Board of Directors, division heads, branch heads, heads of the Risk Management work unit, heads of the compliance work unit, and heads of the internal audit work unit. Paragraph (2) Clearly stated. Paragraph (3) Letter a Clearly stated. Letter b Clearly stated. Letter c Decisions on business deviating from normal procedures include, among others, significant expansion of business beyond the business plan and taking positions or risk exposures that deviate from established limits and exceed the PVML's capital capacity to absorb risk. Paragraph (4) Clearly stated.
Article 26
Paragraph (1)
The PVML determines an appropriate organizational structure suitable for the PVML's conditions, including financial capacity and human resources. The establishment of the Risk Management function is adjusted to the size and complexity of the PVML's business activities and must be accompanied by clear authority and responsibility. Paragraph (2) The concept of independence is reflected, among others, by:
a. separation of functions and tasks between the Risk Management function and the business and operational (risk-taking) function and the internal control function; and b. a decision-making process that is impartial or does not favor specific business and operational functions or ignore other operational functions. Paragraph (3) Clearly stated. Paragraph (4) The authority and responsibility of the Risk Management work unit or Risk Management function are adjusted to the PVML's business objectives and complexity. Letter a Risk identification includes coordinating with all work units within the PVML. Letter b Clearly stated. Letter c Clearly stated. Letter d The term "overall risk," known as "composite risk," refers to the risks faced by the PVML considering all types of risks within the PVML. The term "testing using abnormal condition assumptions," known as "stress testing," refers to testing risk positions using several abnormal condition assumptions to determine the impact of such abnormal conditions on the PVML's risk positions. The term "testing using historical data," known as "back testing," refers to testing risk positions using historical data to determine the effectiveness of Risk Management. Letter e Reviews are conducted, among others, based on internal audit findings and/or developments in internationally applicable Risk Management practices. Letter f Such reviews include, among others, an assessment of the PVML's ability to develop or expand business activities and a review of proposed changes to systems and procedures. Letter g Models for internal use are known as internal models. Letter h Recommendations include, among others, recommendations related to the size or maximum risk exposure that must be maintained by the PVML. Letter i Risk Profile is a comprehensive overview of the potential risk magnitude inherent in the entire portfolio or PVML exposure. Report submission frequency may be increased if market conditions change rapidly. Paragraph (5) Clearly stated. Paragraph (6) Clearly stated. Paragraph (7) Clearly stated. Paragraph (8) Clearly stated.
Article 27
Paragraph (1)
The periodic submission of risk exposure information is adjusted to the characteristics of the type of risk.
Paragraph (2)
Clearly stated.
Article 28
Paragraph (1)
See the explanation of Article 6 paragraph (1).
Paragraph (2)
Clearly stated.
Paragraph (3)
Clearly stated.
Paragraph (4)
Clearly stated.
Paragraph (5)
Clearly stated.
Paragraph (6)
Clearly stated.
Paragraph (7)
Clearly stated.
Article 29
Paragraph (1)
Clearly stated.
Paragraph (2)
Letter a
Clearly stated.
Letter b
Clearly stated.
Letter c
The pilot period is intended to ensure that risk measurement and monitoring methods have been tested.
Letter d
Clearly stated.
Letter e
Clearly stated.
Letter f
Clearly stated.
Paragraph (3)
Clearly stated.
Paragraph (4)
Clearly stated.
Paragraph (5)
Letter a
Clearly stated.
Letter b
Clearly stated.
Letter c
Clearly stated.
Letter d
The term "other information" refers to notifications to consumers regarding the results of the auction of financing objects and the consumer's remaining obligations after deducting the results of the auction of financing objects. Paragraph (6) Clearly stated. Paragraph (7) Clearly stated. Paragraph (8) Clearly stated. Paragraph (9) Letter a Criteria for "never done before" include business activities that have been conducted by other PVMLs but have never been conducted by the PVML in question, referring to the respective regulatory provisions of each PVML. Letter b Clearly stated. Paragraph (10) Clearly stated.
Article 30
Categories of actions constituting approval include, among others, knowing but not prohibiting or allowing activities that are not PVML business activities to occur using PVML facilities or assets by the Board of Directors, Board of Commissioners, DPS, Manager, and/or employees.
Article 31
Clearly stated.
Article 32
Paragraph (1)
See the explanation of Article 6 paragraph (1).
Paragraph (2)
Clearly stated.
Paragraph (3)
Clearly stated.
Paragraph (4)
Clearly stated.
Paragraph (5)
Clearly stated.
Paragraph (6)
Clearly stated.
Paragraph (7)
Clearly stated.
Article 33
Clearly stated.
Article 34
Paragraph 1
Clearly stated.
Paragraph 2
Clearly stated.
Paragraph 3
Clearly stated.
Paragraph 4
Clearly stated.
Paragraph 5
Example: For XYZ Financing Company, which has implemented health level assessments with a scope covering the risk profile, the risk profile report resulting from XYZ Financing Company's own risk level assessment is part of the health level assessment results report. Thus, XYZ Financing Company does not submit a separate risk profile report. Paragraph 6 Clearly stated. Paragraph 7 Clearly stated. Paragraph 8 Clearly stated.
Article 35
Paragraph (1)
Conditions that have the potential to cause significant losses to the PVML's financial condition are caused, among others, by Reputation Risk and Market Risk from the issuance of products or the execution of PVML activities. Paragraph (2) Clearly stated. Paragraph (3) Clearly stated. Paragraph (4) Clearly stated. Paragraph (5) Clearly stated.
Article 36
Paragraph (1)
Clearly stated.
Paragraph (2)
Clearly stated.
Paragraph (3)
Clearly stated.
Paragraph (4)
Clearly stated.
Paragraph (5)
Specific conditions include, among others, the existence of urgent conditions.
Paragraph (6)
Clearly stated.
Article 37
Paragraph (1)
Clearly stated.
Paragraph (2)
Examples of data and information related to the implementation of risk management include:
a. risk management implementation guidelines; b. determination of financing disbursement risk limits; and
c. authority to decide on the value of disbursed financing.
Article 38
Paragraph (1)
See the explanation of Article 6 paragraph (1).
Paragraph (2)
Clearly stated.
Paragraph (3)
Clearly stated.
Paragraph (4)
Clearly stated.
Paragraph (5)
Clearly stated.
Paragraph (6)
Clearly stated.
Paragraph (7)
Clearly stated.
Article 39
Clearly stated.
Article 40
The granting of different approvals or policies is intended, among others, to:
a. support national policy; b. protect public interest;
c. maintain industry growth; and/or
d. maintain healthy business competition.
The consideration of supporting national policy is intended so that the pawn industry's growth does not hinder national policies established by the government, the Financial Services Authority (OJK), and/or relevant authorities. The consideration of protecting public interest is intended so that the pawn industry consistently meets the broad needs of society with equal access and quality, as well as affordable costs. The consideration of maintaining industry growth is intended so that the industry can grow optimally in society. The consideration of maintaining healthy business competition is intended so that the implementation of pawn services can be conducted honestly, not contrary to law, or not hindering business competition.
Article 41
Clearly stated.
Article 42
Clearly stated.
Article 43
Clearly stated.
Article 44
Clearly stated.
Article 45
Clearly stated.
Article 46
Clearly stated.
SUPPLEMENT TO THE STATE GAZETTE OF THE REPUBLIC OF INDONESIA NUMBER 123/OJK

Lineage: No known changes

Similar documents from other regulators