Implementation of Risk Management for Islamic Commercial Banks and Islamic Business Units

To:

1. The Board of Directors of Islamic Commercial Banks; and
2. The Board of Directors of Conventional Commercial Banks Having Islamic Business Units,
   At their respective locations.

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 25/SEOJK.03/2023

CONCERNING

THE IMPLEMENTATION OF RISK MANAGEMENT
FOR ISLAMIC COMMERCIAL BANKS AND ISLAMIC BUSINESS UNITS

In view of the enforcement of the Financial Services Authority Regulation Number 65/POJK.03/2016 concerning the Implementation of Risk Management for Islamic Commercial Banks and Islamic Business Units (State Gazette of the Republic of Indonesia Year 2016 Number 298, Supplement to the State Gazette of the Republic of Indonesia Number 5988) and the Financial Services Authority Regulation Number 38/POJK.03/2017 concerning the Implementation of Consolidated Risk Management for Banks Exercising Control over Subsidiary Companies (State Gazette of the Republic of Indonesia Year 2017 Number 144, Supplement to the State Gazette of the Republic of Indonesia Number 6087), as well as in order to manage and mitigate risks in Islamic commercial banks and Islamic business units through a process of risk identification, measurement, monitoring, and control that is appropriate for Islamic banking business activities and considers compliance with Sharia principles, it is necessary to regulate implementation provisions regarding the implementation of risk management for Islamic commercial banks and Islamic business units in this Financial Services Authority Circular Letter as follows:

I. GENERAL PROVISIONS

1. In this Financial Services Authority Circular Letter, the following terms are defined as:
   a. Bank means Islamic Commercial Banks and Islamic Business Units. b. Islamic Commercial Bank, hereinafter abbreviated as BUS, is a bank that conducts business activities based on Sharia principles, which in its activities provides services in payment transactions.
   c. Islamic Business Unit, hereinafter abbreviated as UUS, is a working unit of the head office of a conventional commercial bank that functions as the parent office of offices or units conducting business activities based on Sharia principles, or a working unit in the branch office of a bank located abroad that conducts conventional business activities, which functions as the parent office of Sharia sub-branches and/or Sharia units.
   d. Sharia Principles are Islamic legal principles based on fatwas and/or Sharia compliance statements issued by institutions having authority in issuing fatwas in the field of Sharia. e. Conventional Commercial Bank, hereinafter abbreviated as BUK, is a bank that conducts business activities conventionally, which in its activities provides services in payment transactions. f. Risk is the potential for loss resulting from the occurrence of a specific event. g. Risk Management is a series of methodologies and procedures used to identify, measure, monitor, and control Risks arising from all business activities. h. Credit Risk is the Risk due to the failure of customers or other parties to fulfill obligations to the Bank in accordance with the agreed agreement, including Credit Risk due to the failure of facility recipients, risk of concentration of fund disbursement, counterparty credit risk, and settlement risk.
   i. Market Risk is the Risk on the balance sheet and administrative account positions due to changes in market prices, including Risk in the form of changes in the value of tradable or leasable assets.
   j. Liquidity Risk is the Risk due to the Bank's inability to meet maturing obligations from cash flow funding sources and/or from high-quality liquid assets that can be pledged, without disrupting the Bank's activities and financial condition. k. Operational Risk is the Risk of loss caused by inadequate internal processes, failure of internal processes, human error, system failure, and/or external events affecting the Bank's operations.
   l. Legal Risk is the Risk due to legal claims and/or weaknesses in legal aspects.
   m. Reputational Risk is the Risk due to a decrease in the level of trust of stakeholders originating from negative perceptions of the Bank. n. Strategic Risk is the Risk due to inaccuracies in making and/or implementing strategic decisions, as well as failure to anticipate changes in the business environment. o. Compliance Risk is the Risk due to the Bank's failure to comply with and/or implement applicable laws and regulations and Sharia Principles. p. Yield Risk is the Risk due to changes in the yield rate paid by the Bank to customers because of changes in the yield rate received by the Bank from fund disbursement, which can affect the behavior of the Bank's third-party funds customers. q. Investment Risk is the Risk due to the Bank sharing in the business losses of customers financed through profit-sharing financing, both using the net revenue sharing method and the profit and loss sharing method.

2. The institution having authority in issuing fatwas in the field of Sharia is the National Sharia Board of the Indonesian Ulema Council (DSN-MUI).

3. Banks implement Risk Management effectively, both individually for the Bank and on a consolidated basis with subsidiary companies for BUS.

4. The implementation of Risk Management as referred to in item 3 is in accordance with the Standard Guidelines for the Implementation of Risk Management contained in the Appendix, which is an integral part of this Financial Services Authority Circular Letter.

5. The implementation of Risk Management as referred to in item 3 is included in implementing banking synergy for BUS in accordance with Financial Services Authority Regulations concerning Islamic commercial banks.

6. Banks implement Risk Management in accordance with the objectives, business policies, size and complexity of business, and the Bank's capabilities.

7. In addition to this Financial Services Authority Circular Letter, Banks continue to pay attention to other laws and regulations in the implementation of specific products and activities. For example, the implementation of Risk Management in:
   a. the implementation of Bank products based on information technology continues to pay attention to Financial Services Authority Regulations concerning the implementation of information technology by commercial banks; and b. the implementation of marketing cooperation by the Bank with insurance companies continues to pay attention to Financial Services Authority Circular Letters concerning the implementation of risk management on banks conducting marketing cooperation activities with insurance companies (bancassurance).

8. The effective implementation of Risk Management for all types of Risks is in accordance with the Guidelines for the Implementation of Risk Management for Each Type of Risk contained in the Appendix, which is an integral part of this Financial Services Authority Circular Letter.

9. Banks may expand and deepen the Standard Guidelines for the Implementation of Risk Management as contained in the Appendix, which is an integral part of this Financial Services Authority Circular Letter, in accordance with the objectives, business policies, size and complexity of business, and the Bank's capabilities.

10. Business activities consist of Bank business activities and other activities conducted by the Bank besides business activities, at all levels or tiers of the organization, in accordance with laws and regulations.

II. STANDARDS FOR THE IMPLEMENTATION OF RISK MANAGEMENT

1. Standards for the implementation of Risk Management for Banks include at least:
   a. General implementation of Risk Management, which includes:

1. active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board (DPS);
2. adequacy of Risk Management policies and procedures and the establishment of Risk limits;
3. adequacy of the process of risk identification, measurement, monitoring, and control, and Risk Management information systems; and
4. a comprehensive internal control system;
   b. Implementation of Risk Management for each type of Risk, which includes the implementation of Risk Management for all 10 (ten) types of Risks, namely Credit Risk, Market Risk, Liquidity Risk, Operational Risk, Legal Risk, Reputational Risk, Strategic Risk, Compliance Risk, Yield Risk, and Investment Risk; and
   c. Risk Profile Assessment, which includes an assessment of inherent Risk and the quality of Risk Management implementation in the Bank's operational activities. The Risk Profile Assessment referred to is conducted both for the Bank individually and for BUS on a consolidated basis. The assessment is conducted against the 10 (ten) types of Risks as referred to in letter b in accordance with Financial Services Authority Regulations concerning the assessment of the health level of Islamic commercial banks and Islamic business units.

2. To support active supervision by the DPS, the Bank provides a function supporting the implementation of Risk Management related to the fulfillment of Sharia Principles. The function referred to may include, among others, a Sharia compliance function, a Sharia risk management function, and a Sharia internal audit function.

3. In implementing Risk Management, the Bank forms a Risk Management Committee and a Risk Management Working Unit.

4. The Risk Management Committee and Risk Management Working Unit for UUS may be formed separately or combined with the BUK having the UUS in accordance with the size and complexity of the UUS's business, as well as the Risks inherent in the UUS.

5. In implementing effective Risk Management, the Bank takes preparation, development, and/or refinement steps as necessary, including:
   a. conducting diagnosis and analysis regarding the organization, policies, procedures, and guidelines, as well as the development of systems related to the implementation of Risk Management; b. preparing an adjustment plan and implementing adjustments with reference to the Standard Guidelines for the Implementation of Risk Management, in the event of inconsistencies between the Bank's policies, procedures, and/or guidelines and the Standard Guidelines for the Implementation of Risk Management;
   c. socializing Risk Management implementation guidelines to employees so that they understand Risk Management practices and develop a Risk culture (risk culture) among all employees at every level of the Bank's organization; and
   d. ensuring that the Internal Audit Working Unit (SKAI) participates in monitoring the Risk Management implementation process, including the refinement of Risk Management guidelines and the preparation of quarterly Risk Profile reports.

III. REPORTING

In the implementation of Risk Management, Banks submit reports as follows:

1. Risk Profile Report
   a. Banks submit Risk Profile Reports both individually and on a consolidated basis to the Financial Services Authority quarterly for the positions of March, June, September, and December. b. The mechanism for submission and format of the Risk Profile Report for the positions of March and September is in accordance with Financial Services Authority Regulations concerning the implementation of risk management for Islamic commercial banks and Islamic business units.
   c. The Risk Profile Report for the positions of June and December is submitted as part of the self-assessment results of the Bank's health level in accordance with Financial Services Authority Regulations concerning the assessment of the health level of Islamic commercial banks and Islamic business units.
   d. The Risk Profile Report submitted by the Bank to the Financial Services Authority contains the same substance as the Risk Profile Report submitted by the Risk Management Working Unit to the President Director or to members of the Board of Directors assigned specifically and the Risk Management Committee. e. The mechanism for assessing the Risk Profile, setting the Risk level, and setting the Risk Profile rating is conducted in accordance with Financial Services Authority Regulations concerning the assessment of the health level of Islamic commercial banks and Islamic business units.

2. Other Reports
   a. Report in the Event of Conditions Potentially Causing Significant Loss to the Bank's Financial Condition The report in the event of conditions potentially causing significant loss to the Bank's financial condition is an incidental report submitted to the Financial Services Authority based on the Bank's current conditions having specific exposures and the Financial Services Authority's assessment results of the Bank. The report is submitted in the event of conditions including:

1. the Bank is placed under a supervision status other than normal supervision by the Financial Services Authority;
2. the Bank has very significant Market Risk and Liquidity Risk exposures; and/or
3. external conditions, namely the market experiencing very sharp fluctuations and tending to be uncontrollable by the Bank.
   b. Other Reports Related to the Implementation of Risk Management
4. Banks submit other reports related to the implementation of Risk Management, including in liquidity monitoring in the form of cash flow projection reports in both Rupiah and foreign currencies. Cash flow projection reports are submitted in accordance with laws and regulations concerning integrated commercial bank reports.
5. Under certain conditions, the Financial Services Authority may request Banks to submit reports related to the implementation of Risk Management for Liquidity Risk outside the established time and/or other reports besides those submitted periodically. Examples of other reports besides those submitted periodically include stress testing results reports for the measurement of Liquidity Risk.

This copy is in accordance with the original
Director of Law 1
Legal Department
Mufli Asmawidjaja

IV. CLOSING

1. At the time this Financial Services Authority Circular Letter comes into force, Bank Indonesia Circular Letter Number 5/21/DPNP dated September 29, 2003 concerning the Implementation of Risk Management for Commercial Banks is revoked and declared invalid.

2. The provisions in this Financial Services Authority Circular Letter come into force on January 1, 2024.

Established in Jakarta on December 21, 2023

EXECUTIVE HEAD OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,
DIAN EDIANA RAE

signed signed

APPENDIX I
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 25/SEOJK.03/2023 CONCERNING THE IMPLEMENTATION OF RISK MANAGEMENT FOR ISLAMIC COMMERCIAL BANKS AND ISLAMIC BUSINESS UNITS

• 2 -
  STANDARD GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT FOR ISLAMIC COMMERCIAL BANKS AND ISLAMIC BUSINESS UNITS

• 3 -
  TABLE OF CONTENTS

I. GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT IN GENERAL............... 5
A. Active Supervision by the Board of Directors, Board of Commissioners, and DPS
........................................................................................................ 5

1. Authority and Responsibilities of the Board of Directors, Board of Commissioners, and DPS ..………………………………………………………………………….5
2. Human Resources.............................................................. 7
3. Risk Management Organization ................................................... 8
   B. Risk Management Policies and Procedures and the Establishment of Risk Limits………………………………………………………………………………11
4. Risk Management Strategy...................................................... 12
5. Risk Appetite and Risk Tolerance........... 12
6. Policies and Procedures .......................................................... 13
7. Risk Limits............................................................................. 14
   C. Process of Risk Identification, Measurement, Monitoring, and Control, and Risk Management Information Systems ........................... 15
8. Risk Identification ................................................................... 15
9. Risk Measurement.................................................................. 16
10. Risk Monitoring ................................................................. 18
11. Risk Control ................................................................ 18
12. Risk Management Information Systems........................................ 19
    D. Internal Control System ............................................................ 20

II. GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT FOR EACH TYPE OF RISK........................................................................................ 23
A. Credit Risk................................................................................... 23

1. General Explanation ................................................................... 23
2. Objectives.................................................................................... 24
3. Implementation of Risk Management ................................................. 24
   B. Market Risk ................................................................................... 36
4. General Explanation ................................................................... 36
5. Objectives.................................................................................... 36
6. Implementation of Risk Management ................................................. 36
   C. Liquidity Risk............................................................................. 43
7. General Explanation ................................................................... 43
8. Objectives.................................................................................... 44
9. Implementation of Risk Management ................................................. 44
   D. Operational Risk ......................................................................... 56
10. General Explanation ................................................................... 56
11. Objectives.................................................................................... 56
12. Implementation of Risk Management ................................................. 56
    E. Legal Risk ................................................................................ 64
13. General Explanation ................................................................... 64
14. Objectives.................................................................................... 64
15. Implementation of Risk Management ................................................. 64
    F. Reputational Risk .............................................................................. 68
16. General Explanation ................................................................... 68
17. Objectives.................................................................................... 68
18. Implementation of Risk Management ................................................. 68
    G. Strategic Risk............................................................................... 72
19. General Explanation ................................................................... 72
20. Objectives.................................................................................... 72
21. Implementation of Risk Management ................................................. 72
    H. Compliance Risk........................................................................... 78
22. General Explanation ................................................................... 78
23. Objectives.................................................................................... 78
24. Implementation of Risk Management ................................................. 78
    I. Yield Risk .......................................................................... 82
25. General Explanation ................................................................... 82
26. Objectives.................................................................................... 83
27. Implementation of Risk Management ................................................. 83
    J. Investment Risk .............................................................................. 88
28. General Explanation ................................................................... 88
29. Objectives.................................................................................... 88
30. Implementation of Risk Management ................................................. 89

III. GUIDELINES FOR RISK PROFILE ASSESSMENT .................................................. 92

• 4 -

• 5 -

I. GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT IN GENERAL

Based on the Financial Services Authority Regulation Number 65/POJK.03/2016 concerning the Implementation of Risk Management for Islamic Commercial Banks and Islamic Business Units, Banks implement Risk Management effectively which includes at least:

1. active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board (DPS);
2. adequacy of Risk Management policies and procedures and the establishment of Risk limits;
3. adequacy of the process of risk identification, measurement, monitoring, and control, and Risk Management information systems; and
4. a comprehensive internal control system.

The principles of Risk Management are described as follows:

A. Active Supervision by the Board of Directors, Board of Commissioners, and DPS

The Board of Directors, Board of Commissioners, and DPS are responsible for the effectiveness of Risk Management implementation in the Bank. Therefore, the Board of Directors, Board of Commissioners, and DPS must understand the Risks faced by the Bank and provide clear direction, conduct active supervision and mitigation, and develop a Risk Management culture in the Bank. In addition, the Board of Directors and Board of Commissioners must also ensure an adequate organizational structure, establish clear tasks and responsibilities for each working unit, and ensure the adequacy of the quantity and quality of Human Resources (HR) to support the effective implementation of Risk Management, and the DPS evaluates the fulfillment of Sharia Principles in business activities.

1. Authority and Responsibilities of the Board of Directors, Board of Commissioners, and DPS

a. The Board of Directors and Board of Commissioners are responsible for ensuring that the implementation of Risk Management is adequate in accordance with the characteristics, size, complexity of business, and Risk profile of the Bank. b. The Board of Directors and Board of Commissioners must understand well the types and levels of Risks inherent in business activities.
c. The authority and responsibilities of the Board of Directors include at least:

1. formulating written and comprehensive Risk Management policies and strategies, including overall Risk limits, per type of Risk, and per type of functional activity in accordance with the risk appetite and risk tolerance in accordance with the Bank's condition, and considering the impact of Risk on capital adequacy. The formulation of Risk Management policies and strategies is conducted by involving operational working units (risk-taking units) and Risk Management Working Units (SKMR). After receiving approval from the Board of Commissioners, the Board of Directors establishes Risk Management policies and strategies;
2. formulating, establishing, and issuing procedures and tools to identify, measure, monitor, and control Risks;
3. formulating and establishing mechanisms and approval authorities for transactions at each tier of position, including for transactions exceeding limits and authorities;
4. evaluating and deciding on transactions requiring Board of Directors approval;
5. evaluating and issuing Risk Management policies, strategies, and frameworks at least 1 (one) time in 1 (one) year or whenever there are changes affecting business activities, Risk exposures, and/or Risk profiles significantly, including considering the risk appetite;
6. establishing organizational structures, including clear authorities and responsibilities at each tier of position related to the implementation of Risk Management;
7. being responsible for the implementation of Risk Management policies, strategies, and frameworks approved by the Board of Commissioners and the Risk exposures taken by the Bank as a whole, and evaluating and providing direction based on reports submitted by SKMR, including Risk Profile reports;
8. ensuring that all material Risks and impacts---

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 242,636-character original (10% of the document). The remainder was not translated. The complete original-language text is stored with this document.]