Management of Actor Track Record Information Through the Actor Information System in the Financial Services Sector

COPY
FINANCIAL SERVICES AUTHORITY REGULATION
REPUBLIC OF INDONESIA
NUMBER 28 OF 2024
CONCERNING
THE MANAGEMENT OF ACTOR TRACK RECORD INFORMATION THROUGH THE ACTOR INFORMATION SYSTEM IN THE FINANCIAL SERVICES SECTOR

BY THE GRACE OF THE MOST HIGH GOD,

THE COMMISSIONERS' COUNCIL OF THE FINANCIAL SERVICES AUTHORITY,

Considering:
a. that in order to strengthen supervision and law enforcement and improve the integrity of the financial services sector, it is necessary to provide data and information on the track record of actors in the financial services sector; b. that in order to support the provision of data and information on the track record of actors, it is necessary to have an actor information system in the financial services sector;
c. that the Financial Services Authority has the authority to regulate, develop, and manage data and information on the track record of actors through the actor information system in the financial services sector;
d. that based on the considerations referred to in letters a, b, and c, it is necessary to establish a Financial Services Authority Regulation concerning the Management of Actor Track Record Information through the Actor Information System in the Financial Services Sector;

Recalling:
Law Number 21 of 2011 concerning the Financial Services Authority (State Gazette of the Republic of Indonesia Year 2011 Number 111, Supplement to the State Gazette of the Republic of Indonesia Number 5253) as amended by Law Number 4 of 2023 concerning the Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845);

DECIDES:

To Establish:
FINANCIAL SERVICES AUTHORITY REGULATION CONCERNING THE MANAGEMENT OF ACTOR TRACK RECORD INFORMATION THROUGH THE ACTOR INFORMATION SYSTEM IN THE FINANCIAL SERVICES SECTOR.

https://jdih.ojk.go.id/

CHAPTER I
GENERAL PROVISIONS

Article 1
In this Financial Services Authority Regulation, the following terms are defined as:

1. Financial Services Institution, hereinafter abbreviated as LJK, is an institution that carries out activities in the banking, capital market, insurance, pension fund, venture capital, microfinance institution, financing institution, and other financial services institutions sectors.
2. Actor is a party that commits acts of deviation and/or tolerance with intent to deceive, defraud, or manipulate LJK and/or parties conducting activities in the financial services sector, consumers, or other parties, which occur within the LJK environment and/or parties conducting activities in the financial services sector and/or using LJK facilities and/or parties conducting activities in the financial services sector, resulting in LJK and/or parties conducting activities in the financial services sector, consumers, or other parties suffering losses and/or the actor and/or other parties obtaining direct or indirect benefits.
3. Track Record is information about Actors recorded in the actor information system in the financial services sector.
4. Actor Information System in the Financial Services Sector, hereinafter referred to as SIPELAKU, is an information system containing Track Records managed by the Financial Services Authority to support integrity in the financial services sector.
5. Access Right is the right to use Track Records through SIPELAKU.
6. User is a party granted Access Rights.

Article 2
Actors as referred to in Article 1 Number 2 consist of:
a. individuals; b. corporations;
c. business entities, whether legal entities or non-legal entities; or
d. other bodies.

CHAPTER II
TRACK RECORD USERS

Article 3
Track Record Users in SIPELAKU include:
a. LJK; and b. parties conducting activities in the financial services sector.

https://jdih.ojk.go.id/

Article 4
(1) Users as referred to in Article 3 may access and use Track Records in SIPELAKU as:
a. consideration material in the decision-making process for personnel matters; b. consideration material for profiling potential consumers, and/or other parties, in accordance with risk control policies; and/or
c. application of risk management.
(2) Users are prohibited from accessing and using Track Records in SIPELAKU for purposes other than those referred to in paragraph (1).
(3) The use of Track Records in SIPELAKU by Users for the purposes referred to in paragraph (1) is the sole responsibility of the User.
(4) Users who violate the provisions as referred to in paragraph (2) shall be subject to administrative sanctions consisting of:
a. written warnings; and/or b. fines.
(5) The sanctions as referred to in paragraph (4) letter b may be imposed with or without prior imposition of written warning sanctions as referred to in paragraph (4) letter a. (6) Fine sanctions as referred to in paragraph (4) letter b shall be imposed up to IDR 6,000,000,000.00 (six billion rupiah).

CHAPTER III
SOURCE AND SCOPE OF TRACK RECORDS

Article 5
(1) Track Records in SIPELAKU consist of:
a. data and/or information about Actors submitted by LJK and/or parties conducting activities in the financial services sector to the Financial Services Authority as regulated in Financial Services Authority Regulations concerning the implementation of anti-fraud strategies; and/or b. other data and/or information determined by the Financial Services Authority. (2) The truthfulness of data and/or information submitted by LJK and/or parties conducting activities in the financial services sector to the Financial Services Authority as referred to in paragraph (1) letter a is the sole responsibility of the LJK and/or parties conducting activities in the financial services sector.

Article 6
(1) Track Records as referred to in Article 5 paragraph (1) letter a that can be accessed by Users through SIPELAKU include:
a. Actor profiles; and b. Actor fraud history.

https://jdih.ojk.go.id/

(2) Track Records as referred to in Article 5 paragraph (1) letter b that can be accessed by Users through SIPELAKU include other data and/or information contained by the Financial Services Authority.

CHAPTER IV
ACCESS RIGHTS

Article 7
(1) To obtain Track Records as referred to in Article 5, Users must first:
a. fulfill reporting obligations for anti-fraud strategies as regulated in Financial Services Authority Regulations concerning the implementation of anti-fraud strategies; and b. register for Access Rights to the Financial Services Authority electronically through the Financial Services Authority's licensing system. (2) Access Right registration as referred to in paragraph (1) letter b is carried out by submitting an application completed with information at least:
a. User name; b. name of the Access Right holder;
c. national identity number of the Access Right holder; and
d. a User statement signed by the Board of Directors or equivalent, regarding:
1) commitment to maintain the security and confidentiality of data and/or information obtained in the implementation of Access Rights; and
2) having policies and procedures related to SIPELAKU as regulated in this Financial Services Authority Regulation and commitment to implement the aforementioned policies and procedures.
(3) Employees/officials as Access Right holders as referred to in paragraph (2) letter b include:
a. applicants; and b. verifiers.
(4) Applicants as referred to in paragraph (3) letter a:
a. act as representatives of Users with Access Rights in receiving and conducting searches for Track Records; and b. are responsible for:
1) receiving data and/or information requests for SIPELAKU;
2) ensuring that data and/or information requests for SIPELAKU are accompanied by the name and employee number/identity of the employee, the purpose of use, and supporting documents; and
3) accessing and conducting searches for Track Records in SIPELAKU.

https://jdih.ojk.go.id/

(5) Verifiers as referred to in paragraph (3) letter b are officials/employees with a job level at least 1 (one) level above employees acting as applicants. (6) Verifiers as referred to in paragraph (3) letter b:
a. act as representatives of Users with Access Rights to verify, approve, or reject data requests input by applicants. b. are responsible for:
1) ensuring that data and/or information requests for SIPELAKU are accompanied by the name and employee number/identity of the employee, the purpose of use, and supporting documents;
2) accessing and granting approval if the provisions as referred to in item 1) are met; and
3) accessing and granting rejection if the provisions as referred to in item 1) are not met.
(7) The Financial Services Authority has the authority to determine the number of Access Rights for each User according to the complexity of the User's business.

Article 8
(1) In the event of changes to Access Right holders, Users are required to report to the Financial Services Authority through the Financial Services Authority's licensing system within a maximum of 7 (seven) working days after the change occurs. (2) Users who violate the provisions as referred to in paragraph (1) shall be subject to administrative sanctions consisting of:
a. written warnings; and/or b. fines.
(3) The sanctions as referred to in paragraph (2) letter b may be imposed with or without prior imposition of written warning sanctions as referred to in paragraph (2) letter a. (4) Fine sanctions as referred to in paragraph (2) letter b shall be imposed up to IDR 6,000,000,000.00 (six billion rupiah).

Article 9
In the event of:
a. data leakage; b. misuse of Access Rights;
c. changes in legislation;
d. security disturbances in data; e. Users not implementing policies and procedures; f. Users not fulfilling reporting obligations as regulated in Financial Services Authority Regulations concerning the implementation of anti-fraud strategies for LJK; and/or g. other conditions based on the Financial Services Authority's consideration, the Financial Services Authority may deactivate the SIPELAKU Access Rights of Users.

Article 10
In the event of force majeure, the application for Access Right registration as referred to in Article 7 paragraph (2) and the reporting of Access Right changes as referred to in Article 8 paragraph (1) may be submitted via letter to the Financial Services Authority.

CHAPTER V
GOVERNANCE

First Section
Policies and Procedures

Article 11
Users are required to have and implement policies and procedures related to SIPELAKU as referred to in Article 7 paragraph (2) letter d number 2), which at least include:
a. the authority and responsibility of Access Right holders to submit requests and receive Track Records; b. the procedure for requesting Track Records in SIPELAKU and ensuring their use;
c. the accounting of Track Records obtained from SIPELAKU and supporting documents;
d. the security of Track Records; and e. the destruction of Track Records obtained from SIPELAKU.

Second Section
Use

Article 12
(1) Track Records are confidential and limited data and/or information and may only be used for the interests of Access Right holders as referred to in Article 4. (2) Every party with Access Rights and/or obtaining Track Records is prohibited from distributing obtained Track Records to parties other than those established in the policies and procedures as referred to in Article 11, including data and/or information that are processed results.

Article 13
Users are required to protect the confidentiality of Track Records from the time of receipt until destruction.

https://jdih.ojk.go.id/

Third Section
Supervision

Article 14
(1) Users are required to conduct internal audits on the use of SIPELAKU at least 1 (one) time in 1 (one) year.
(2) For Users who do not have an internal audit work unit, internal audit activities may be carried out by organs implementing internal audit functions.

Article 15
The Financial Services Authority has the authority to supervise the use of SIPELAKU by Users.

Fourth Section
Administrative Sanctions

Article 16
(1) Users who violate the provisions as referred to in Article 11, Article 12 paragraph (2), Article 13, and Article 14 paragraph (1) shall be subject to administrative sanctions consisting of:
a. written warnings; and/or b. fines.
(2) The sanctions as referred to in paragraph (1) letter b may be imposed with or without prior imposition of written warning sanctions as referred to in paragraph (1) letter a. (3) Fine sanctions as referred to in paragraph (1) letter b shall be imposed up to IDR 6,000,000,000.00 (six billion rupiah).

CHAPTER VI
UTILIZATION OF TRACK RECORDS

Article 17
(1) Other institutions besides Users may request Track Records from the Financial Services Authority.
(2) Requests for Track Records by other institutions as referred to in paragraph (1) may be carried out:
a. routinely; or b. incidentally.
(3) Routine requests for Track Records as referred to in paragraph (2) letter a are carried out based on agreements and/or memorandums of understanding between the Financial Services Authority and the aforementioned other institutions. (4) Incidental requests for Track Records as referred to in paragraph (2) letter b are carried out by fulfilling requirements:
a. the Track Record request is submitted in writing to the Financial Services Authority by the authorized party, stating the purpose of using the Track Record; and

https://jdih.ojk.go.id/

b. the applicant states responsibility for all consequences arising related to the use of Track Records.

Article 18
(1) The Financial Services Authority may designate parties other than Users who can use Track Records in SIPELAKU.
(2) Provisions regarding requirements and mechanisms for obtaining, utilizing, governing, and managing Track Records through SIPELAKU for parties other than Users as referred to in paragraph (1) are established in Financial Services Authority regulations.

Article 19
(1) Other institutions obtaining Track Records as referred to in Article 17 must protect the confidentiality of Track Records.
(2) Parties other than Users obtaining Track Records as referred to in Article 18 are required to protect the confidentiality of Track Records. (3) Parties other than Users who violate the provisions as referred to in paragraph (2) shall be subject to administrative sanctions consisting of:
a. written warnings; and/or b. fines.
(4) The sanctions as referred to in paragraph (3) letter b may be imposed with or without prior imposition of written warning sanctions as referred to in paragraph (3) letter a. (5) Fine sanctions as referred to in paragraph (3) letter b shall be imposed up to IDR 6,000,000,000.00 (six billion rupiah).

CHAPTER VII
CLOSING PROVISIONS

Article 20
This Financial Services Authority Regulation shall come into force on the date of its promulgation.

https://jdih.ojk.go.id/

This copy is in accordance with the original
Director of Legal Development
Legal Department
Aat Windradi

In order that everyone may know it, order the promulgation of this Financial Services Authority Regulation by placing it in the State Gazette of the Republic of Indonesia.

Established in Jakarta on December 12, 2024
CHAIRMAN OF THE COMMISSIONERS' COUNCIL
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,
MAHENDRA SIREGAR

Promulgated in Jakarta on December 17, 2024
MINISTER OF LAW OF THE REPUBLIC OF INDONESIA,
SUPRATMAN ANDI AGTAS

STATE GAZETTE OF THE REPUBLIC OF INDONESIA YEAR 2024 NUMBER 40/OJK signed https://jdih.ojk.go.id/

EXPLANATION
OF
FINANCIAL SERVICES AUTHORITY REGULATION
REPUBLIC OF INDONESIA
NUMBER 28 OF 2024
CONCERNING
THE MANAGEMENT OF ACTOR TRACK RECORD INFORMATION THROUGH THE ACTOR INFORMATION SYSTEM IN THE FINANCIAL SERVICES SECTOR

I. GENERAL

Developments in the financial services sector (SJK), both conventional and based on Sharia principles, as well as developments in the digital sector, on one hand also bring negative impacts due to the high growth of fraud incidents with increasingly diverse patterns, harming consumers, financial service business actors, and SJK in general.

The Financial Services Authority as the supervisor of SJK needs to strive to support more effective prevention of fraud incidents by utilizing SIPELAKU, which provides data and/or information about Actors in the past sourced from, among others, reports on LJK anti-fraud strategies. Data and/or information provided in SIPELAKU relates to, among others, fraud incidents occurring in SJK. This data and/or information can serve as consideration material for LJK in conducting business activities with fraud actors.

SIPELAKU is also developed to achieve several key important goals in strengthening the Indonesian financial sector. First, SIPELAKU is intended to increase the overall integrity of SJK. With the existence of SIPELAKU, transparency and accountability in financial activities are expected to increase, thereby strengthening public trust in the financial sector. Second, SIPELAKU also aims to facilitate the dissemination of Track Records in SJK.

With better access to Track Records, Users can take preventive and law enforcement actions against suspicious activities more effectively. This can help reduce the risk of fraud and increase the security and stability of the financial sector as a whole.

In addition, one of the main goals of creating SIPELAKU is to minimize losses borne by the financial services industry due to fraud actions. By utilizing more accurate and detailed Track Records from SIPELAKU, it is hoped that Users can take more effective and quick actions to reduce the impact of financial losses that can be caused by deception or fraud.

To provide a legal basis for Users to access, use, account for, and supervise the use of Track Records in SIPELAKU, a Financial Services Authority Regulation concerning the management of Actor Track Record Information through SIPELAKU is needed.

II. ARTICLE BY ARTICLE

Article 1
Sufficiently clear.

Article 2
Sufficiently clear.

Article 3
Letter a
Sufficiently clear.

Letter b
The term "parties conducting activities in the financial services sector" refers to:

1. parties conducting business activities for fund collection, fund distribution, and fund management in the financial services sector, which are licensed and supervised by the Financial Services Authority based on legislation; and
2. other financial service business actors, including parties implementing financial sector technology innovations in the financial services sector, which are licensed and supervised by the Financial Services Authority based on legislation.

Article 4
Paragraph (1)
Letter a
Sufficiently clear.

Letter b
The term "profiling" refers to the assessment of the credibility of individuals or entities, whether legal entities or non-legal entities, or other bodies. Other parties include, among others, consultants, vendors, and public accountants.

Letter c
Risk management includes the implementation of internal audits.
The application of risk management is carried out for the interests of Users.

Paragraph (2)
Sufficiently clear.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
Sufficiently clear.

Paragraph (5)
Sufficiently clear.

Paragraph (6)
Sufficiently clear.

Article 5
Paragraph (1)
Letter a
Sufficiently clear.

Letter b
Other data and/or information determined by the Financial Services Authority, among others, data and/or information sourced from determinations of Financial Services Authority Regulations and/or Financial Services Authority Circulars.

Paragraph (2)
Sufficiently clear.

Article 6
Paragraph (1)
Letter a
Data and information related to Actor profiles include Actor identities, among others, name, place of birth, date of birth, gender, and its complements.

Letter b
Data and information related to Actor fraud history include, among others, type of fraud, fraud-related activities, time of fraud occurrence, location of fraud occurrence, and date of reporting.

Paragraph (2)
Sufficiently clear.

Article 7
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Sufficiently clear.

Paragraph (3)
Sufficiently clear.

Paragraph (4)
Sufficiently clear.

Paragraph (5)
Sufficiently clear.

Paragraph (6)
Sufficiently clear.

Paragraph (7)
The complexity of the User's business includes, among others, total assets and office network.

Article 8
Sufficiently clear.

Article 9
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
Sufficiently clear.

Letter d
Sufficiently clear.

Letter e
Sufficiently clear.

Letter f
The term "reporting obligations" refers to all reporting in Financial Services Authority Regulations concerning the implementation of anti-fraud strategies for LJK.

Letter g
Other conditions include, among others, reduction of office networks, mergers/acquisitions, and LJK no longer conducting business activities.

Article 10
The term "force majeure" refers to unavoidable conditions, including natural disasters, non-natural disasters, social disasters, strikes, fires, other industrial disturbances, and/or other conditions beyond the control of the Financial Services Authority that result in network and/or application system problems so that the Financial Services Authority's licensing system cannot be used for a certain period requiring special action by the Financial Services Authority. The Financial Services Authority will convey information regarding disturbances and force majeure through announcements on the official website or national mass media. Applications for Access Right registration and reporting of Access Right changes in force majeure are submitted to the Financial Services Authority addressed to the work unit implementing integrated licensing functions.

Article 11
Letter a
The authority and responsibility of Access Right holders to submit requests and receive Track Records include, among others:

1. authority, such as the use of Track Records in SIPELAKU within the scope of use limitations as regulated in this Financial Services Authority Regulation; and
2. responsibility, obligations, and prohibitions as regulated in this Financial Services Authority Regulation.

Letter b
The procedure for requesting Track Records in SIPELAKU and ensuring their use include, among others:

1. applicants and/or verifiers as Access Right holders ensure that data and/or information requests for SIPELAKU are accompanied by employee identity, purpose of use, and supporting documents; and
2. applicants and/or verifiers access/conduct searches for Track Records in SIPELAKU and convey the results to the requesting party (if approved) or convey rejection information for data and information requests (if not approved).

---

Letter c
The management of requests for Track Records obtained from SIPELAKU and supporting documents, among others, includes management both manually and through information technology media for all Track Record requests at least:

1. the date of the request;
2. the name and identity number of the Actor;
3. the purpose of the Track Record; and
4. the name of the employee/third party who submitted the request and received the information, along with the employee/identity number.

Letter d
The security of Track Records, including parties who have the authority to obtain Track Records from SIPELAKU, among others, includes steps for data security measures, access level settings, monitoring of operations including audit trails which are conducted by monitoring logs for every activity in the system, procedures for providing Track Record information, procedures for handling and resolving complaints, implementation of periodic audits and/or evaluations to ensure the use of SIPELAKU data, and data retention schedules.

Letter e
The destruction of Track Records obtained from SIPELAKU, among others, includes schedules for data destruction for data that has exceeded the data retention schedule limits, mechanisms or methods of destruction to be used, and procedures for data destruction as regulated in laws and regulations concerning the management of conventional and electronic archives. Data and/or information destruction regarding Track Records obtained by the Actor is performed for Track Records that have been downloaded/printed.

Article 12
Paragraph (1)
What is meant by "confidential and limited data and/or information" is data and/or information owned by the Access Right holder that can be utilized for interests at that time by the information applicant. Such information is not valid for other parties, either at the same time or at different times.

Paragraph (2)
What is meant by "data and information that are processed results" is data and/or information originating from SIPELAKU that has been processed or processed into forms including but not limited to writing, sound, images, maps, designs, photographs, electronic data interchange (EDI), electronic mail, telegram, telex, telecopy, or similar forms, letters, signs, numbers, codes, symbols, or perforations that have meaning, value, or specific meaning and can be understood by those capable of understanding them.

Article 13
Clearly sufficient.

Article 14
Paragraph (1)
Internal audits can be part of the annual work plan and budget of Users.

Paragraph (2)
Clearly sufficient.

Article 15
Clearly sufficient.

Article 16
Clearly sufficient.

Article 17
Paragraph (1)
What is meant by "other institutions" is ministries/agencies/authorities/law enforcement agencies that require data and/or information included in SIPELAKU.

Paragraph (2)
Track Record requests are submitted in writing through letters established by the head of other institutions to the Board of Commissioners of the Financial Services Authority (OJK).

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Article 18
Paragraph (1)
Parties other than Users, among others, are rating agencies that collect and process credit or financing data and other data to generate credit information. The determination of parties other than Users who can use Actor Track Records in SIPELAKU is in accordance with laws and regulations concerning personal data protection.

Paragraph (2)
Clearly sufficient.

Article 19
Paragraph (1)
Clearly sufficient.

Paragraph (2)
Parties other than Users are parties that have connections with the financial services sector.

Paragraph (3)
Clearly sufficient.

Paragraph (4)
Clearly sufficient.

Paragraph (5)
Clearly sufficient.

Article 20
Clearly sufficient.
SUPPLEMENT TO THE STATE GAZETTE OF THE REPUBLIC OF INDONESIA NUMBER 108/OJK

---