Implementation of Risk Management for Nonbank Financial Service Institutions

FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA
COPY
FINANCIAL SERVICES AUTHORITY REGULATION
REPUBLIC OF INDONESIA
NUMBER 44 /POJK.05/2020
CONCERNING
THE IMPLEMENTATION OF RISK MANAGEMENT FOR
NONBANK FINANCIAL SERVICE INSTITUTIONS
BY THE GRACE OF GOD THE ALMIGHTY
THE COMMISSIONERS OF THE FINANCIAL SERVICES AUTHORITY, Considering :
a. that the increasing business activities of nonbank financial service institutions with increasingly complex risks must be accompanied by the implementation of risk management; b. that the development of nonbank financial service institutions requires the implementation of adequate, effective, and measurable risk management;
c. that the Financial Services Authority Regulation Number 1/POJK.05/2015 concerning the Implementation of Risk Management for Nonbank Financial Service Institutions no longer accommodates the development of legal needs for improving the quality of risk management implementation for nonbank financial service institutions, so it needs to be replaced;
d. that based on considerations as referred to in letters a, b, and c, it is necessary to establish a Financial Services Authority Regulation concerning

The Implementation of Risk Management for Nonbank Financial Service Institutions; Recalling : 1. Law Number 11 of 1992 concerning Pension Funds (State Gazette of the Republic of Indonesia Year 1992 Number 37, Supplement to the State Gazette of the Republic of Indonesia Number 3477);
2. Law Number 21 of 2011 concerning the Financial Services Authority (State Gazette of the Republic of Indonesia Year 2011 Number 111, Supplement to the State Gazette of the Republic of Indonesia Number 5253);
3. Law Number 40 of 2014 concerning Insurance (State Gazette of the Republic of Indonesia Year 2014 Number 337, Supplement to the State Gazette of the Republic of Indonesia Number 5618);
DECIDING:
Establishing : FINANCIAL SERVICES AUTHORITY REGULATION CONCERNING THE IMPLEMENTATION OF RISK MANAGEMENT FOR NONBANK FINANCIAL SERVICE INSTITUTIONS.

CHAPTER I
GENERAL PROVISIONS
Article 1
In this Financial Services Authority Regulation, the following terms are meant:

1. Nonbank Financial Service Institutions, hereinafter referred to as LJKNB, are institutions that carry out activities in the insurance, pension fund, and financing institution sectors.

2. Risk is the potential for losses that cannot be controlled and/or can be controlled due to the occurrence of a certain event.

3. Risk Management is a series of procedures and methodologies used to identify, measure, control, and monitor Risks arising from all business activities of LJKNB.

4. Strategic Risk is Risk due to inaccuracy in making and/or implementing a strategic decision and failure to anticipate changes in the business environment.

5. Operational Risk is Risk due to inadequacy and/or malfunction of internal processes, human error, system failure, and/or the existence of external events affecting LJKNB operations.

6. Insurance Risk is the Risk of failure of insurance companies, reinsurance companies, Sharia insurance companies, and Sharia reinsurance companies to meet obligations to policyholders, insured parties, or participants as a result of inadequate risk selection (underwriting) processes, premium or contribution setting, use of reinsurance, and/or claim handling.

7. Credit Risk is Risk due to the failure of other parties to meet obligations to LJKNB.

8. Market Risk is Risk on asset, liability, equity, and/or administrative account positions, including derivative transactions, due to overall changes in market conditions.

9. Liquidity Risk is Risk due to LJKNB's inability to meet maturing liabilities from cash flow funding sources and/or from liquid assets that can be easily converted into cash, without disrupting LJKNB's activities and financial conditions.

10. Legal Risk is Risk arising from legal claims and/or weaknesses in legal aspects.

11. Compliance Risk is Risk due to LJKNB not complying with and/or not implementing applicable laws and regulations and provisions applicable to LJKNB.

12. Reputational Risk is Risk due to a decrease in the level of trust of stakeholders stemming from negative perceptions of LJKNB.

13. Board of Directors is the company organ authorized and fully responsible for managing the company for the benefit of the company, in accordance with the company's purpose and objectives, and representing the company, both inside and outside the court, in accordance with the articles of association for LJKNB in the form of a limited liability company or equivalent to the Board of Directors for LJKNB in the form of a cooperative, joint venture, and pension fund legal entity.

14. Board of Commissioners is the company organ tasked with conducting general and/or specific supervision in accordance with the articles of association and providing advice to the Board of Directors for LJKNB in the form of a limited liability company legal entity or equivalent to the Board of Commissioners for LJKNB in the form of a cooperative, joint venture, and pension fund legal entity.

15. Sharia Supervisory Board is a board that has the task and function of supervision and providing advice to the Board of Directors regarding the implementation of LJKNB activities to be in accordance with Sharia principles.
    Article 2
    LJKNB as referred to in Article 1 number 1 includes:
    a. insurance companies, consisting of:

16. insurance companies, including those conducting part of their business based on Sharia principles;

17. reinsurance companies, including those conducting part of their business based on Sharia principles;

18. Sharia insurance companies;

19. Sharia reinsurance companies;

20. insurance brokerage companies;

21. reinsurance brokerage companies; and

22. insurance loss appraiser companies,
    as referred to in legal provisions concerning insurance; b. pension funds as referred to in legal provisions concerning pension funds, including those conducting all or part of their business with Sharia principles; and
    c. financing institutions, consisting of:

23. financing companies as referred to in legal provisions concerning financing companies, including those conducting part of their business based on Sharia principles; and

24. Sharia financing companies as referred to in legal provisions concerning Sharia financing companies.

CHAPTER II
IMPLEMENTATION OF RISK MANAGEMENT
Article 3
(1) LJKNB is required to implement Risk Management effectively.
(2) The implementation of Risk Management as referred to in paragraph (1) must at least cover:
a. active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board; b. adequacy of Risk Management policies and procedures as well as the establishment of Risk limits;
c. adequacy of the process for identifying, measuring, controlling, and monitoring Risk, as well as the Risk Management information system; and
d. a comprehensive internal control system.

Article 4
The implementation of Risk Management as referred to in Article 3 must be adjusted to the objectives, business policies, size, and complexity of LJKNB's business.
Article 5
(1) Risk Management as referred to in Article 3 paragraph (1) for LJKNB as referred to in Article 2 letter a numbers 1 to 4, letter b, and letter c must be applied for:
a. Strategic Risk; b. Operational Risk;
c. Insurance Risk, for:

1. insurance companies, including those conducting part of their business based on Sharia principles;
2. reinsurance companies, including those conducting all or part of their business with Sharia principles;
3. Sharia insurance companies; and
4. Sharia reinsurance companies;
   d. Credit Risk; e. Market Risk; f. Liquidity Risk; g. Legal Risk; h. Compliance Risk; and
   i. Reputational Risk.
   (2) Risk Management as referred to in Article 3 paragraph (1) for LJKNB as referred to in Article 2 letter a numbers 5 to 7 must be applied for:
   a. Strategic Risk; b. Operational Risk;
   c. Legal Risk;
   d. Compliance Risk; and e. Reputational Risk.

CHAPTER III
ACTIVE SUPERVISION BY THE BOARD OF DIRECTORS, BOARD OF COMMISSIONERS, AND SHARIA SUPERVISORY BOARD
Section One
General
Article 6
LJKNB is required to establish clear authorities and responsibilities at every level of position related to the implementation of Risk Management as referred to in Article 3.
Section Two
Authorities and Responsibilities of the Board of Directors
Article 7
(1) The authorities and responsibilities as referred to in Article 6 for the Board of Directors must at least:
a. formulate written and comprehensive Risk Management policies and strategies; b. be responsible for the implementation of Risk Management policies and the Risk exposure taken by LJKNB as a whole;
c. evaluate and decide on transactions and Risk limits requiring Board of Directors approval;
d. develop a Risk Management culture at all levels of the organization; e. ensure the improvement of human resources competence related to Risk Management; f. ensure that the Risk Management function has operated independently; and g. conduct periodic reviews to ensure:

1. the accuracy of Risk assessment methodologies;

2. the adequacy of the Risk Management information system implementation; and

3. the appropriateness of Risk Management policies and procedures as well as the establishment of Risk limits.
   (2) The Risk Management policies and strategies as referred to in paragraph (1) letter a must be evaluated periodically at least 1 (one) time in 1 (one) year and at any time if there are factors significantly affecting LJKNB's business activities. (3) The Board of Directors' responsibility for the implementation of Risk Management policies as referred to in paragraph (1) letter b includes:
   a. evaluating and providing direction based on reports submitted by the Risk Management function; and b. submitting accountability reports to the Board of Commissioners and Sharia Supervisory Board at least 1 (one) time in 6 (six) months. (4) In order to carry out the authorities and responsibilities as referred to in paragraph (1), the Board of Directors must have an understanding of the Risks inherent in all functional activities of LJKNB and be able to take necessary actions in accordance with LJKNB's Risk profile.
   Section Three
   Authorities and Responsibilities of the Board of Commissioners
   Article 8
   (1) The authorities and responsibilities as referred to in Article 6 for the Board of Commissioners must at least:
   a. approve and evaluate Risk Management policies; b. evaluate the Board of Directors' accountability for the implementation of Risk Management policies as referred to in letter a; and

c. evaluate and decide on Board of Directors' requests related to transactions and Risk limits requiring Board of Commissioners approval.
(2) The evaluation of Risk Management policies as referred to in paragraph (1) letter a is conducted at least 1 (one) time in 1 (one) year and at any time if there are factors significantly affecting LJKNB's business activities. (3) The evaluation of the Board of Directors' accountability for the implementation of Risk Management policies as referred to in paragraph (1) letter b is conducted at least 1 (one) time in 6 (six) months.
Section Four
Authorities and Responsibilities of the Sharia Supervisory Board
Article 9
(1) The authorities and responsibilities as referred to in Article 6 for the Sharia Supervisory Board must at least:
a. evaluate Risk Management policies related to the fulfillment of Sharia principles; and b. evaluate the Board of Directors' accountability for the implementation of Risk Management policies related to the fulfillment of Sharia principles as referred to in letter a. (2) The evaluation of Risk Management policies as referred to in paragraph (1) letter a is conducted at least 1 (one) time in 1 (one) year and at any time if there are factors significantly affecting LJKNB's business activities. (3) The evaluation of the Board of Directors' accountability for the implementation of Risk Management policies related to the fulfillment of Sharia principles as referred to in paragraph (1) letter b is conducted at least 1 (one) time in 6 (six) months.

CHAPTER IV
ADEQUACY OF RISK MANAGEMENT POLICIES AND PROCEDURES AS WELL AS ESTABLISHMENT OF RISK LIMITS
Section One
Risk Management Policies
Article 10
Risk Management policies as referred to in Article 3 paragraph (2) letter b must at least contain:
a. the establishment of Risks related to LJKNB's business activities; b. the establishment of the use of measurement methods and Risk Management information systems;
c. the establishment of the level of Risk to be taken, the establishment of Risk tolerance, and the determination of Risk limits;
d. the establishment of Risk rating assessments; e. the preparation of emergency plans in worst-case conditions; and f. the establishment of an internal control system in the implementation of Risk Management.
Section Two
Risk Management Procedures and Establishment of Risk Limits
Article 11
(1) Risk Management procedures and the establishment of Risk limits as referred to in Article 3 paragraph (2) letter b must be adjusted to the level of Risk to be taken against LJKNB's Risks. (2) Risk Management procedures and the establishment of Risk limits as referred to in paragraph (1) must at least contain:
a. clear accountability and levels of delegation of authority;

b. periodic review of Risk Management procedures and the establishment of Risk limits; and
c. adequate documentation of Risk Management procedures and the establishment of Risk limits.
(3) The establishment of Risk limits as referred to in paragraph (2) must cover:
a. overall limits; b. limits per type of Risk; and
c. limits per functional activity and specific transactions with Risk exposure.

CHAPTER V
ADEQUACY OF THE PROCESS OF IDENTIFICATION, MEASUREMENT, CONTROL, AND MONITORING OF RISK, AS WELL AS RISK MANAGEMENT INFORMATION SYSTEM
Section One
General
Article 12
(1) LJKNB is required to carry out the process of identification, measurement, control, and monitoring of Risk as referred to in Article 3 paragraph (2) letter c against Risk factors that are material. (2) The implementation of the process of identification, measurement, control, and monitoring of Risk as referred to in paragraph (1) must be supported by:
a. timely management information systems; b. accurate and informative reports regarding financial conditions, functional activity performance, and LJKNB's Risk exposure; and
c. human resources with competence in the field of Risk Management.

Section Two
Process of Identification, Measurement, Control, and Monitoring of Risk
Article 13
(1) To carry out the Risk identification process, LJKNB must conduct analysis at least against:
a. the characteristics of Risks inherent in LJKNB; and b. Risks from LJKNB's business activities.
(2) To carry out Risk measurement, LJKNB must conduct at least:
a. periodic evaluation of the suitability of assumptions, data sources, and procedures used to measure Risk; and b. adjustment to the Risk measurement process in the event of changes in LJKNB's business activities and material Risk factors. (3) LJKNB is required to carry out the Risk control process to manage certain Risks that can endanger the continuity of LJKNB's business. (4) To carry out Risk monitoring, LJKNB must conduct at least:
a. evaluation of Risk exposure; and b. adjustment to the reporting process in the event of changes:

1. business activities;
2. Risk factors;
3. information technology; and
4. LJKNB's Risk Management information system,
   that are material.
   Section Three
   Risk Management Information System
   Article 14
   (1) The Risk Management information system as referred to in Article 3 paragraph (2) letter c must be supported by human resources with competence in the field of Risk Management information systems. (2) The Risk Management information system as referred to in Article 3 paragraph (2) letter c must include reports or information at least regarding:
   a. Risk exposure; b. compliance with Risk Management policies and procedures as well as the establishment of Risk limits as referred to in Article 10 and Article 11; and
   c. the realization of Risk Management implementation compared to established targets.
   (3) Reports or information generated from the Risk Management information system as referred to in paragraph (1) must be submitted regularly to the Board of Directors.

CHAPTER VI
INTERNAL CONTROL SYSTEM
Section One
General
Article 15
LJKNB is required to implement an internal control system effectively against Risks inherent in the implementation of business activities at all levels of LJKNB's organization.
Article 16
(1) The implementation of the internal control system as referred to in Article 15 must at least be able to timely detect weaknesses and deviations that cause or affect Risk exposure. (2) The internal control system as referred to in paragraph (1) must ensure:

a. compliance of LJKNB management levels with Risk Management policies and procedures as well as laws and regulations and internal policies or provisions of LJKNB; b. the compliance and effectiveness of the Risk Management function in designing and implementing Risk Management strategies and policies;
c. the availability of complete, accurate, useful, and timely financial and management information;
d. effectiveness and efficiency in business and operational activities; and e. the effectiveness of Risk culture throughout the LJKNB organization.
Section Two
Internal Control System in the Implementation of Risk Management
Article 17
(1) The comprehensive internal control system as referred to in Article 3 paragraph (2) letter d in the implementation of Risk Management must at least contain:
a. the suitability of the internal control system with the type and level of Risks inherent in LJKNB's business activities; b. the establishment of authorities and responsibilities for monitoring compliance with Risk Management policies and procedures, as well as the establishment of Risk limits as referred to in Article 10 and Article 11;
c. the establishment of clear reporting lines and separation of functions from operational functions to Risk control functions;
d. an organizational structure that clearly depicts LJKNB's business activities;

e. accurate and timely financial and operational activity reporting; f. adequate procedures to ensure LJKNB's compliance with legal provisions and provisions applicable to LJKNB; g. effective, independent, and objective review of procedures for assessing LJKNB's operational activities; h. adequate testing and review of the Risk Management information system;
i. complete and adequate documentation of operational procedures, scope, and audit findings, as well as the response of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board of LJKNB based on audit results; and
j. periodic and continuous verification and review of the handling of material weaknesses of LJKNB and the actions of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board of LJKNB to correct deviations that occurred. (2) The assessment of the internal control system in the implementation of Risk Management as referred to in paragraph (1) must be conducted by the internal audit function.

CHAPTER VII
ORGANIZATION AND RISK MANAGEMENT FUNCTION
Section One
General
Article 18
For the implementation of effective Risk Management processes and systems as referred to in Article 3, LJKNB is required to form:
a. a Risk Management Committee; and b. a Risk Management function.

Section Two
Risk Management Committee
Article 19
(1) The Risk Management Committee as referred to in Article 18 letter a must consist of at least:
a. half of the Board of Directors members; and b. relevant executive officials.
(2) One of the Board of Directors members as referred to in paragraph (1) letter a is a Board of Directors member who oversees the Risk Management function. (3) The authorities and responsibilities of the Risk Management Committee as referred to in paragraph (1) provide recommendations to the Chief Executive or equivalent, at least containing:
a. the formulation of policies, strategies, and guidelines for the implementation of Risk Management; b. improvement or adjustment of Risk Management implementation based on the results of Risk Management implementation evaluation; and
c. the establishment of matters related to business decisions that deviate from normal procedures.
Section Three
Risk Management Function
Article 20
(1) The organizational structure of the Risk Management function of LJKNB as referred to in Article 18 letter b is adjusted to the size and complexity of LJKNB's business and the Risks inherent in LJKNB. (2) The Risk Management function as referred to in paragraph (1) must be independent from business and operational functions and from the internal control function.

(3) The Risk Management function as referred to in paragraph (1) is directly responsible to the Chief Executive or equivalent, or a Board of Directors member who oversees the Risk Management function. (4) The authorities and responsibilities of the Risk Management function include:
a. identifying Risks including Risks inherent in LJKNB's business activities; b. formulating Risk measurement methods;
c. monitoring the implementation of Risk Management strategies formulated by the Board of Directors;
d. monitoring overall Risk position, per type of Risk, and per type of functional activity, and conducting testing using scenario/assumptions of abnormal conditions and testing using historical data; e. periodically reviewing the Risk Management process; f. reviewing proposals for the development or expansion of business activities; g. evaluating the accuracy of models and validity of data used to measure Risk, for LJKNB using models for internal purposes; h. providing recommendations to business and operational functions and/or to the Risk Management Committee, according to the authority possessed; and
i. formulating and submitting Risk profile reports to the Chief Executive or equivalent, or a Board of Directors member who oversees the risk management function and the Risk Management Committee periodically.

Section Four
Relationship between Business and Operational Functions and Risk Management Function
Article 21
Business and operational functions as referred to in Article 20 paragraph (2) are required to inform the Risk Management function of inherent Risk exposure periodically.

CHAPTER VIII
MANAGEMENT OF RISKS IN THE DEVELOPMENT OR
EXPANSION OF BUSINESS ACTIVITIES
Article 22
(1) LJKNB is required to have written policies and procedures to manage Risks inherent in the development or expansion of LJKNB's business activities. (2) The policies and procedures as referred to in paragraph (1) must at least cover:
a. systems, procedures, and authorities in the management of business development or expansion; b. identification of all Risks inherent in the development or expansion of business activities, both related to LJKNB and consumers;
c. trial period for measurement and monitoring methods of Risk against the development or expansion of business activities;
d. accounting information systems for the development or expansion of business activities; e. legal aspect analysis for the development or expansion of business activities; and f. transparency of information to consumers. (3) LJKNB's business activities constitute a form of development or expansion of business activities if they meet the criteria:

---

a. has never been done before by LJKNB; or b. has been implemented previously by LJKNB but involves development that changes or increases exposure to certain Risks in LJKNB.

Article 23
LJKNB is prohibited from assigning or approving the Board of Directors, Board of Commissioners, Sharia Supervisory Board, and/or employees of LJKNB to carry out activities that are not the business activities of LJKNB using the facilities or infrastructure of LJKNB.

CHAPTER IX
OTHER PROVISIONS

Article 24
(1) In the event that LJKNB applies Integrated Risk Management as referred to in the Financial Services Authority Regulation regarding the implementation of Integrated Risk Management for financial conglomerates, the Risk Management function as referred to in Article 18 letter b may be merged with the Risk Management function in the structure of the financial conglomerate of the respective LJKNB. (2) The implementation of Risk Management for financial institution pension funds may be merged with the implementation of Risk Management by the founder.

Article 25
Further provisions regarding the implementation of Risk Management as referred to in Article 3, the organizational structure of the Risk Management Committee as referred to in Article 19, the organizational structure of the Risk Management function as referred to in Article 20, the relationship between business and operational functions and the Risk Management function as referred to in Article 21, and the management of Risks related to the development or expansion of business activities as referred to in Article 22, shall be determined by the Financial Services Authority.

CHAPTER X
COMPLIANCE ENFORCEMENT

First Section
Administrative Sanctions

Article 26
(1) LJKNB that commits violations against the provisions as regulated in Article 3 paragraph (1), Article 4, Article 5, Article 6, Article 11 paragraph (1) and (3), Article 12, Article 13, Article 14 paragraph (1), Article 15, Article 16 paragraph (2), Article 17 paragraph (2), Article 18, Article 21, Article 22 paragraph (1), and Article 23, shall be subject to administrative sanctions in the form of a written warning. (2) In the event that LJKNB has fulfilled the provisions as referred to in paragraph (1), the Financial Services Authority shall revoke the written warning sanction.

Second Section
Downgrade of Health Assessment Results and Re-evaluation of Principal Parties of LJKNB

Article 27
In the event that the Financial Services Authority has imposed administrative sanctions as referred to in Article 26 paragraph (1) and LJKNB does not fulfill the provisions that caused the imposition of administrative sanctions, the Financial Services Authority may:
a. downgrade the health assessment results of LJKNB in insurance companies, reinsurance companies, pension funds, and financing companies, including those that carry out all or part of their business using Sharia principles; and/or b. conduct a re-evaluation of the principal parties of LJKNB.

CHAPTER XI
TRANSITIONAL PROVISIONS

Article 28
For LJKNB that have obtained business licenses before this Financial Services Authority Regulation is promulgated, the provisions on administrative sanctions as referred to in Article 26 shall be effective 1 (one) year from the date this Financial Services Authority Regulation is promulgated.

CHAPTER XII
CLOSING PROVISIONS

Article 29
(1) At the time this Financial Services Authority Regulation comes into force, the Financial Services Authority Regulation Number 1/POJK.05/2015 regarding the Implementation of Risk Management for Non-Bank Financial Service Institutions (State Gazette of the Republic of Indonesia Year 2015 Number 69, Supplement to the State Gazette of the Republic of Indonesia Number 5682), is repealed and declared invalid. (2) Implementing regulations of the Financial Services Authority Regulation Number 1/POJK.05/2015 regarding the Implementation of Risk Management for Non-Bank Financial Service Institutions shall remain in force insofar as they do not conflict with this Financial Services Authority Regulation.

Article 30
This Financial Services Authority Regulation comes into force on the date of its promulgation.

This copy is consistent with the original
Director of Law 1
Legal Department signed
Mufli Asmawidjaja

To ensure that everyone knows it, order the promulgation of this Financial Services Authority Regulation by placing it in the State Gazette of the Republic of Indonesia.

Established in Jakarta on August 28, 2020
CHAIRMAN OF THE COMMISSIONERS BOARD
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
WIMBOH SANTOSO

Promulgated in Jakarta on September 2, 2020
MINISTER OF LAW AND HUMAN RIGHTS
REPUBLIC OF INDONESIA, signed
YASONNA H. LAOLY

STATE GAZETTE OF THE REPUBLIC OF INDONESIA YEAR 2020 NUMBER 200

EXPLANATION
OF
FINANCIAL SERVICES AUTHORITY REGULATION
REPUBLIC OF INDONESIA
NUMBER 44 /POJK.05/2020
REGARDING
THE IMPLEMENTATION OF RISK MANAGEMENT FOR
NON-BANK FINANCIAL SERVICE INSTITUTIONS

I. GENERAL
In facing the dynamic development of the financial industry in Indonesia, LJKNB is continuously faced with various challenges and Risks. For their business to run continuously (business sustainability), LJKNB are required to be able to manage Risks that can disrupt business sustainability and the business objectives to be achieved. Through the implementation of Risk Management, LJKNB are expected to be able to identify, measure, control, and monitor Risks faced in conducting their business activities more effectively. This effort to implement Risk Management is not only intended for the interest of LJKNB, but also for the interest of the public using the services and facilities of LJKNB. Thus, LJKNB can conduct business activities in accordance with laws and regulations as well as standards, principles, and practices of healthy business organization, including always being able to fulfill obligations to consumers as agreed. The Financial Services Authority has had provisions regarding Risk Management as regulated in the Financial Services Authority Regulation Number 1/POJK.05/2015 regarding the Implementation of Risk Management for LJKNB. Subsequently, to improve the quality of the implementation of LJKNB Risk Management, it is necessary to replace the provisions on the implementation of Risk Management for LJKNB. This Financial Services Authority Regulation contains regulations regarding:
a. the scope of implementation of Risk Management; b. active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board;
c. Risk Management policies and procedures as well as the establishment of Risk limits;
d. the process of identification, measurement, control, and monitoring of Risks, as well as the Risk Management information system; e. the internal control system; f. the organization and function of Risk Management; and g. the management of Risks related to the development or expansion of business activities.

II. ARTICLE BY ARTICLE

Article 1
Clearly sufficient.

Article 2
Clearly sufficient.

Article 3
Paragraph (1)
The implementation of Risk Management includes the implementation of anti-money laundering and counter-terrorism financing programs.
Paragraph (2)
Clearly sufficient.

Article 4
Business complexity includes diversity in types of transactions, products or services, and business networks.

Article 5
Paragraph (1)
Letter a
Strategic Risks arise, among others, because:
a. LJKNB establishes strategies that are not aligned with the vision and mission of LJKNB; b. LJKNB conducts strategic environment analysis that is not comprehensive;
c. there is a mismatch of strategic plans (strategic plan) between strategic levels; and
d. failure to anticipate changes in the business environment such as changes in technology, changes in macroeconomic conditions, market competition, and changes in relevant authority policies. Letter b Operational Risks in insurance companies, reinsurance companies, and employer pension funds that administer defined benefit pension programs also include risks arising from insufficient liabilities caused by weaknesses in the process of setting actuarial assumptions and/or the inability of actuaries to set actuarial assumptions appropriate to the conditions faced. Letter c Clearly sufficient. Letter d Examples of Credit Risk, among others, are credit concentration risk, counterparty credit risk, and settlement risk. Credit concentration risk is a Risk that arises due to the concentration of fund provision to 1 (one) party or a group of parties, industry, sector, and/or specific geographic area that has the potential to cause significant losses that can threaten the sustainability of LJKNB business. Counterparty credit risk is a Risk that arises due to the failure of the counterparty to fulfill its obligations and arises from transaction types that have certain characteristics, for example, transactions influenced by fair value or market value movements. Settlement risk is a Risk that arises due to the failure to deliver cash and/or financial instruments on the agreed settlement date from the sale and/or purchase of financial instruments transactions. Letter e Market Risks include Interest Rate Risk, Exchange Rate Risk, Commodity Risk, and Equity Risk. Letter f Liquidity Risk in employer pension funds that administer defined benefit pension programs also includes risks arising from the inability of the pension fund to provide assets to finance liabilities due to insufficient contribution setting. Letter g Legal Risks arise, among others, due to the absence of supporting laws and regulations or weaknesses in agreements such as the non-fulfillment of contract validity requirements or imperfect collateral binding. Letter h Clearly sufficient. Letter i Reputational Risks arise, among others, due to negative media coverage and/or rumors regarding LJKNB, as well as ineffective LJKNB communication strategies. Paragraph (2) Clearly sufficient.

Article 6
What is meant by "every level of position" is the Board of Directors, Board of Commissioners, Sharia Supervisory Board, and all other positions related to the implementation of Risk Management.

Article 7
Paragraph (1)
Letter a
Included in the Risk Management policy and strategy is the establishment and approval of Risk limits, both overall Risk (composite), per type of Risk, per functional activity, or per material/significant transaction. Letter b Clearly sufficient. Letter c Transactions requiring Board of Directors approval include transactions that have exceeded the authority of LJKNB officials one level below the Board of Directors, in accordance with the internal policies and procedures of LJKNB in force. Letter d The development of Risk Management culture includes, among others, adequate communication to all levels of the organization regarding the importance of effective internal control. Letter e Increasing human resource competence includes, among others, through continuous education and training programs regarding the implementation of Risk Management. Letter f What is meant by independent includes, among others, the separation of functions between the Risk Management function that conducts identification, measurement, control, and monitoring of Risks and the function that conducts and completes business and operational activities. Letter g Periodic review is intended, among others, to anticipate if there are changes in external and internal factors. Paragraph (2) The frequency of periodic evaluation is adjusted to the needs of LJKNB by considering the size and complexity of LJKNB, with at least 1 (one) time in 1 (one) year. In the event that there are internal and/or external factors that significantly affect the business activities of LJKNB, LJKNB may conduct evaluation of Risk Management policies and strategies outside of periodic evaluation. Paragraph (3) Clearly sufficient. Paragraph (4) Risks that are inherent are known as inherent risk.

Article 8
Paragraph (1)
Letter a
Clearly sufficient.
Letter b
Clearly sufficient.
Letter c
What is meant by "transactions requiring Board of Commissioners approval" are business or operational activities that have exceeded the authority of the Board of Directors to decide on the matter, in accordance with the internal policies and procedures of LJKNB in force. Paragraph (2) Clearly sufficient. Paragraph (3) Clearly sufficient.

Article 9
Clearly sufficient.

Article 10
Risk Management policies are established, among others, by formulating Risk Management strategies to ensure that:
a. LJKNB continues to maintain Risk exposure in accordance with internal LJKNB policies and procedures, laws and regulations, and other provisions; and b. LJKNB is managed by human resources who have knowledge, experience, and expertise in Risk Management in accordance with the complexity of LJKNB business. The formulation of Risk Management strategies is carried out by considering the financial conditions of LJKNB, the organization of LJKNB, and Risks arising as a result of changes in external and internal factors. Letter a Clearly sufficient. Letter b Clearly sufficient. Letter c The level of Risk to be taken (risk appetite) considers the experience owned by LJKNB in managing Risks and the capitalization ability of LJKNB to absorb Risks. Risk tolerance (risk tolerance) is the potential loss that can be absorbed by the capitalization of LJKNB. Letter d The establishment of Risk rating assessment is the basis for LJKNB to categorize the Risk rating of LJKNB. Risk ratings for LJKNB are categorized into 5 (five) ratings, namely:

1. rating 1;
2. rating 2;
3. rating 3;
4. rating 4; and
5. rating 5.
   Letter e
   The formulation of emergency plans is known as contingency plan.
   The worst condition is known as worst case scenario.
   Letter f
   Clearly sufficient.

Article 11
Paragraph (1)
Clearly sufficient.
Paragraph (2)
Letter a
Clearly sufficient.
Letter b
The definition of periodically is at least 1 (one) time in 1 (one) year or a higher frequency, depending on the type of Risk, needs, and development of LJKNB. Letter c What is meant by adequate documentation is written, complete documentation that facilitates the ability to conduct an audit trail for the purposes of internal control of LJKNB. Paragraph (3) Clearly sufficient.

Article 12
Paragraph (1)
What is meant by "Risk factors" are various parameters that affect Risk exposure.
What is meant by "material Risk factors" are Risk factors, both quantitative and qualitative, that have a significant impact on the financial conditions of LJKNB. Paragraph (2) Letter a Clearly sufficient. Letter b What is meant by "informative" includes, among others, being easy to understand. Letter c What is meant by "having competence in the field of Risk Management" includes, among others, having expertise certificates and proof of having attended training in the field of risk management.

Article 13
Paragraph (1)
The Risk identification process can be based, among others, on the loss experience of LJKNB that has occurred.
Paragraph (2)
To carry out Risk measurement, LJKNB can use various approaches, both qualitative and quantitative, adjusted to the business objectives, and the complexity of LJKNB business. Letter a The definition of periodically is at least 1 (one) time in 6 (six) months or a higher frequency, depending on the development of LJKNB business and external conditions that directly affect the conditions of LJKNB. Letter b What is meant by "changes that are material" are changes in LJKNB business activities and Risk factors, which can affect the financial conditions of LJKNB. Paragraph (3) Risk control can be carried out, among others, by hedging, Risk mitigation methods, and adding capital to absorb potential losses. Paragraph (4) Letter a Evaluation of Risk exposure is carried out by monitoring and reporting on material Risks or those that impact the capitalization/funding conditions of LJKNB, which is based, among others, on the assessment of potential Risks using historical trends. Letter b Clearly sufficient.

Article 14
Paragraph (1)
What is meant by "having competence in the field of Risk Management information systems" includes, among others, having expertise certificates and proof of having attended training in the field of Risk Management information systems. Paragraph (2) Letter a Reports or information on Risk exposure cover quantitative and qualitative exposure, both overall (composite) and details per type of Risk and per type of functional activity. Letter b Clearly sufficient. Letter c Clearly sufficient. Paragraph (3) What is meant by "regularly" is the frequency of Reports or information submitted to the Board of Directors adjusted to the needs of LJKNB.

Article 15
Clearly sufficient.

Article 16
Paragraph (1)
Clearly sufficient.
Paragraph (2)
Letter a
Clearly sufficient.
Letter b
Clearly sufficient.
Letter c
Complete, accurate, useful, and timely financial and management information is needed in order to make appropriate and accountable decisions, and communicated to interested parties. Letter d Effectiveness and efficiency in business and operational activities are needed, among others, to protect the assets and other resources of LJKNB from related Risks. Letter e The effectiveness of Risk culture (risk culture) is intended to identify weaknesses and deviations earlier and to continuously re-evaluate the fairness of existing policies and procedures at LJKNB.

Article 17
Clearly sufficient.

Article 18
Letter a
The Risk Management Committee must be non-structural.
Letter b
Clearly sufficient.

Article 19
Paragraph (1)
Letter a
Clearly sufficient.
Letter b
What is meant by "relevant executive officials" are officials who are directly responsible to the Board of Directors or have significant influence on the policies and/or operations of LJKNB related to the implementation of Risk Management, such as division heads, office heads, heads of risk management work units, heads of compliance work units, and heads of internal audit work units. Paragraph (2) Clearly sufficient. Paragraph (3) Letter a Clearly sufficient. Letter b Clearly sufficient. Letter c Included in business decisions that deviate from normal procedures include significant expansion of business beyond the LJKNB business plan and taking positions or Risk exposures that deviate from established limits and exceed the capitalization ability of LJKNB to absorb Risks.

Article 20
Paragraph (1)
LJKNB determines the appropriate organizational structure in accordance with the conditions of LJKNB, including financial capabilities and human resources. Paragraph (2) The definition of independence is reflected, among others, in the existence of:
a. separation of functions and tasks between the Risk Management function and the business and operational functions (risk-taking function) and the internal control function; and b. a decision-making process that is impartial or does not favor certain business and operational functions or ignores other operational functions. Paragraph (3) Clearly sufficient. Paragraph (4) The authority and responsibility of the Risk Management function are adjusted to the business objectives and complexity of LJKNB business. Letter a Risk identification includes coordinating with all work units present in LJKNB. Letter b Clearly sufficient. Letter c Clearly sufficient. Letter d Overall Risk, known as "composite risk," is the Risk faced by LJKNB by taking into account all types of Risks in LJKNB. Testing using abnormal condition assumptions, known as "stress testing," is a test of Risk positions using several abnormal condition assumptions to know the impact of those abnormal conditions on Risk positions at LJKNB. Testing using historical data, known as "back testing," is a test of Risk positions using historical data to know the effectiveness of Risk Management. Letter e Reviews are carried out, among others, based on internal audit findings and/or the development of internationally applicable Risk Management practices. Letter f Included in those studies are assessments of LJKNB's ability to carry out the development or expansion of business activities and studies of proposed system and procedure changes. Letter g Models for internal purposes are known as internal models. Letter h Recommendations include, among others, recommendations related to the magnitude or maximum Risk exposure that must be maintained by LJKNB. Letter i Risk Profile is a comprehensive overview of the magnitude of potential Risks inherent in the entire portfolio or exposure of LJKNB. The frequency of report submission can be increased in the event that market conditions change rapidly.

Article 21
The frequency of submitting Risk exposure information is adjusted to the characteristics of the type of Risk.

Article 22
Paragraph (1)
Clearly sufficient.
Paragraph (2)
Letter a
Clearly sufficient.
Letter b
Clearly sufficient.
Letter c
The trial period is intended to ensure that Risk measurement and monitoring methods have been tested.
Letter d
The accounting information system must at least describe the Risk profile and the level of profit or loss for the development or expansion of business activities accurately. Letter e Legal aspect analysis covers the possibility of Legal Risks arising from the development or expansion of business activities as well as compliance with laws and regulations. Letter f Aspects in applying information transparency to consumers pay attention to at least:

1. information provided is complete, correct, and not misleading to consumers;
2. balanced information between potential benefits that may be obtained and Risks that may arise for consumers; and
3. information provided does not obscure, reduce, or cover up important matters related to Risks that may arise.
   Paragraph (3)
   Letter a
   Included in the criteria of never done before are business activities that have been carried out by other LJKNB but have never been done by the respective LJKNB, referring to the respective laws and regulations of each LJKNB. Letter b Clearly sufficient.

Article 23
Included in the category of approving actions is knowing but not prohibiting or allowing the occurrence of activities that are not the business activities of LJKNB using the facilities or infrastructure of LJKNB by the Board of Directors, Board of Commissioners, Sharia Supervisory Board, and/or employees.

Article 24
Clearly sufficient.

Article 25
Clearly sufficient.

Article 26
Clearly sufficient.

Article 27
Letter a
What is meant by "LJKNB health level" is the health level as referred to in the Financial Services Authority Regulation regarding the Health Assessment of Non-Bank Financial Service Institutions. Letter b What is meant by "principal parties of LJKNB" is the principal parties as referred to in the Financial Services Authority Regulation regarding the Fit and Proper Test for Principal Parties of Financial Service Institutions.

Article 28
Clearly sufficient.

Article 29
Clearly sufficient.

Article 30
Clearly sufficient.

SUPPLEMENT TO THE STATE GAZETTE OF THE REPUBLIC OF INDONESIA NUMBER 6552