OJK Regulation No. 13 of 2025 on Internal Control and Conduct of Securities Companies Acting as Underwriters and Securities Brokers

COPY
FINANCIAL SERVICES AUTHORITY REGULATION
OF THE REPUBLIC OF INDONESIA
NUMBER 13 OF 2025
CONCERNING
INTERNAL CONTROL AND CONDUCT OF SECURITIES COMPANIES ACTING AS UNDERWRITERS AND SECURITIES BROKERS BY THE GRACE OF GOD THE ALMIGHTY

THE COMMISSIONERS OF THE FINANCIAL SERVICES AUTHORITY,

Considering:
a. that the increasing complexity of the business activities of underwriters and securities brokers needs to be balanced with the application of good internal control and conduct to minimize risks and ensure business continuity; b. that there are currently no internal control standards for underwriters that align with their role and risks in conducting business activities, and that the development of service provision to customers by securities brokers needs to be supported by regulations on information technology risk management principles;
c. that the conduct regulations for underwriters and securities brokers need to be improved to adjust to industry practices and developments;
d. that based on the considerations referred to in letters a, b, and c, it is necessary to establish a Financial Services Authority Regulation concerning Internal Control and Conduct of Securities Companies Acting as Underwriters and Securities Brokers;

Recalling:

1. Law Number 8 of 1995 concerning the Capital Market (State Gazette of the Republic of Indonesia Year 1995 Number 64, Supplement to the State Gazette of the Republic of Indonesia Number 3608) as amended by Law Number 4 of 2023 concerning the Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845);

2. Law Number 21 of 2011 concerning the Financial Services Authority (State Gazette of the Republic of Indonesia Year 2011 Number 111, Supplement to the State Gazette of the Republic of Indonesia Number 5253) as amended by Law of the Republic of Indonesia Number 4 of 2023 concerning the Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845);

DECIDING:

Establishing: FINANCIAL SERVICES AUTHORITY REGULATION CONCERNING INTERNAL CONTROL AND CONDUCT OF SECURITIES COMPANIES ACTING AS UNDERWRITERS AND SECURITIES BROKERS.

CHAPTER I
GENERAL PROVISIONS

Article 1
In this Financial Services Authority Regulation, the following terms are defined as:

1. Party is an individual, legal entity, company, joint venture, association, or organized group.

2. Securities are securities or investment contracts, whether in conventional and digital form or other forms in accordance with technological developments, that give the owner the right to directly or indirectly obtain economic benefits from the issuer or from a specific Party based on an agreement and any derivatives of Securities, which can be transferred and/or traded on the capital market.

3. Debt Securities and/or Sukuk without Public Offering, hereinafter referred to as EBUS without Public Offering, are debt securities and/or sukuk issued without a public offering mechanism and meeting established criteria.

4. Securities Transaction is any activity or contract to acquire, dispose of, or use Securities that results in a change of ownership or does not result in a change of ownership on the capital market.

5. Stock Exchange Member is:
a. a securities broker that has obtained a business license from the Financial Services Authority; and b. another Party that has obtained approval from the Financial Services Authority, which has the right to use the stock exchange system and/or facilities in accordance with stock exchange regulations.

6. Securities Company is a Party conducting business as an underwriter of Securities and/or a securities broker or investment manager.

7. Underwriter of Securities, hereinafter abbreviated as PEE, is a Party that enters into a contract with the issuer to guarantee the public offering of the issuer's Securities with or without the obligation to purchase unsold Securities.

8. Securities Broker, hereinafter abbreviated as PPE, is a Party conducting business activities to buy and sell Securities for its own interest or for the interest of another Party.

9. Regional Securities Company, hereinafter abbreviated as PED, is a Securities Company conducting business as a PPE that administers customer Securities accounts and is specifically established in a province.

10. Investment Manager is a Party whose business activity is to manage Securities portfolios, collective investment portfolios, and/or other investment portfolios for the interest of a group of customers or individual customers, except insurance companies, Islamic insurance companies, pension funds, and banks that conduct their own business activities based on legislation.

11. Issuer is a Party conducting a public offering.

12. Issuer is a Party that issues EBUS without Public Offering.

13. Online Trading System is a trading system provided by a PPE through electronic communication media including the internet, short message services, wireless application protocol services, or other electronic media to conduct Securities Transactions.

14. Stock Exchange is a market organizer in the capital market for exchange transactions.

15. Custodian is a Party providing services for the safekeeping of Securities and other assets related to Securities, assets related to collective investment portfolios, and other services, including receiving dividends, interest, and other rights, settling Securities Transactions, and representing account holders who are its customers.

16. Depository and Clearing Institution, hereinafter abbreviated as LPP, is a Party that:
a. organizes central custodian activities for custodian banks, Securities Companies, and other Parties; and b. provides other services that can be applied to support inter-market activities.

17. Underwriter Representative is an individual acting on behalf of the interests of a Securities Company conducting business as a PEE.

18. Securities Broker Representative is an individual acting on behalf of the interests of a Securities Company conducting business as a PPE.

19. Affiliation is:
a. family relationship due to marriage up to the second degree, both horizontally and vertically, namely the relationship of a person with:
1. husband or wife;
2. parents of the husband or wife and the husband or wife of the child;
3. grandparents of the husband or wife and the husband or wife of the grandchild;
4. siblings of the husband or wife along with the husband or wife of the sibling in question; or
5. husband or wife of the sibling of the person in question.
b. family relationship due to descent up to the second degree, both horizontally and vertically, namely the relationship of a person with:
1. parents and children;
2. grandparents and grandchildren; or
3. siblings of the person in question.
c. relationship between a Party and its employees, directors, or commissioners;
d. relationship between 2 (two) or more companies where there is one or more members of the board of directors, management, board of commissioners, or supervisors who are the same; e. relationship between a company and a Party, directly or indirectly, in any way, controlling or being controlled by the company or the Party in determining the management and/or policy of the company or Party in question; f. relationship between 2 (two) or more companies that are controlled, directly or indirectly, in any way, in determining the management and/or policy of the company by the same Party; or g. relationship between a company and a major shareholder, namely a Party that directly or indirectly owns at least 20% (twenty percent) of the shares with voting rights of that company.

20. Public Offering is the activity of offering Securities conducted by the Issuer to sell Securities to the public based on procedures regulated in the Capital Market Law as amended by the Law on the development and strengthening of the financial sector and its implementing regulations.

21. Anti-Money Laundering, Prevention of Terrorism Financing, and Prevention of Financing of Mass Destruction Weapons, hereinafter abbreviated as APU, PPT, and PPPSPM, are efforts to prevent and eradicate the crimes of money laundering, terrorism financing, and/or financing of the proliferation of mass destruction weapons.

22. Registration Statement is a document that must be submitted to the Financial Services Authority by the Issuer in the context of a Public Offering or a public company.

23. Securities Account is a record showing the position of Securities and/or funds of the Parties at the Custodian.

CHAPTER II
INTERNAL CONTROL AND CONDUCT OF SECURITIES COMPANIES ACTING AS UNDERWRITERS AND SECURITIES BROKERS

Section One
Scope and Principles

Article 2
(1) The obligation to apply internal control provisions and conduct provisions applies to Securities Companies:
a. that conduct business as PEE; b. that conduct business as PPE; and
c. that are PED.

(2) Under certain conditions, the Financial Services Authority may exempt Securities Companies as referred to in paragraph (1) from the obligation to apply internal control provisions and conduct provisions of Securities Companies.

Article 3
(1) Securities Companies as referred to in Article 2, in conducting their business activities, are required to apply the following principles:
a. integrity; b. professionalism;
c. prioritizing customer interests;
d. sufficiency of resources; e. information openness; f. conflict of interest; and g. compliance.

(2) In addition to meeting the principles in paragraph (1), Securities Companies conducting business as PEE and/or PPE are required to meet the following principles:
a. APU, PPT, and PPPSPM as regulated in Financial Services Authority Regulations regarding the implementation of APU, PPT, and PPPSPM programs in the financial services sector; b. consumer protection as regulated in Financial Services Authority Regulations regarding consumer and community protection in the financial services sector; and
c. anti-fraud strategy as regulated in Financial Services Authority Regulations regarding anti-fraud strategy.

Article 4
Securities Companies conducting business as PEE and/or PPE are required to ensure the implementation of internal control and conduct to minimize the risk of errors and misuse.

Section Two
Administrative Sanctions

Article 5
(1) Any Party that violates the provisions as referred to in Article 3 and/or Article 4 shall be subject to administrative sanctions.

(2) Sanctions as referred to in paragraph (1) shall also be imposed on Parties that cause the occurrence of violations as referred to in paragraph (1).

(3) Sanctions as referred to in paragraph (1) and paragraph (2) shall be imposed by the Financial Services Authority.

(4) Administrative sanctions as referred to in paragraph (1) consist of:
a. written warning; b. fine, namely the obligation to pay a certain amount of money;
c. restriction of business activities;
d. suspension of business activities; e. revocation of business license; f. cancellation of registration; and/or g. revocation of individual license.

(5) Administrative sanctions as referred to in paragraph (4) letters b, c, d, e, f, or g may be imposed with or without being preceded by the imposition of administrative sanctions in the form of a written warning as referred to in paragraph (4) letter a.

(6) Administrative sanctions in the form of a fine as referred to in paragraph (4) letter b may be imposed separately or together with the imposition of administrative sanctions as referred to in paragraph (4) letters c, d, e, f, or g.

(7) The procedure for imposing sanctions as referred to in paragraph (3) shall be carried out in accordance with the provisions of legislation in the field of capital market.

CHAPTER III
INTERNAL CONTROL OF UNDERWRITERS OF SECURITIES

Section One
Functions at Underwriters of Securities

Article 6
(1) PEE is required to have and implement 5 (five) functions:
a. underwriting function; b. risk management function;
c. accounting function;
d. compliance function; and e. human resource quality management and development function.

(2) In addition to having and implementing functions as referred to in paragraph (1), PEE may have and implement other functions.

Article 7
PEE is required to separate the underwriting function as referred to in Article 6 paragraph (1) letter a from the functions as referred to in Article 6 paragraph (1) letters b through e and other functions as referred to in Article 6 paragraph (2).

Article 8
In the event that PEE has and implements an internal audit function, the internal audit function may be performed concurrently with the compliance function in accordance with the complexity of the Securities Company's business.

Article 9
For PEE that simultaneously conducts business as PPE, then for:
a. risk management function; b. accounting function;
c. compliance function;
d. internal audit function; e. human resource quality management and development function; and f. research function, may be performed concurrently by work units in the same function at PPE.

Article 10
Officials performing the risk management function and/or compliance function may concurrently serve as persons responsible for the implementation of the APU, PPT, and PPPSPM program.

Article 11
(1) In the event that PEE has and implements a research function, the research function must be separated from other functions.

(2) The official in charge of the research function must hold a Securities Company Representative license and a Securities Analyst certificate.

(3) Employees performing the research function must hold a Securities Company Representative license or a Securities Analyst certificate.

(4) In the event that officials and employees performing the research function are working on research for a specific PEE project, they are prohibited from handling PPE research.

(5) PEE is required to formulate and apply written policies and procedures related to research results while maintaining independence over research conducted by officials and employees performing the research function.

(6) Written policies and procedures as referred to in paragraph (5) must at least cover:
a. the reporting flow of officials and employees performing the research function; and b. the basis for calculating compensation for officials and employees performing the research function that can eliminate or significantly limit existing, common, or potential conflicts of interest.

Article 12
Officials and employees at PEE who perform function separation as referred to in Article 7 are prohibited from:
a. concurrently performing other functions; and/or b. performing tasks outside their functional duties and responsibilities without written approval from the Board of Directors.

Section Two
Underwriting Function

Article 13
(1) Directors, responsible officials, and employees performing the underwriting function must hold an Underwriter Representative license.

(2) Work units performing the underwriting function as referred to in Article 6 paragraph (1) letter a are responsible for:
a. conducting offerings, cooperation exploration, and due diligence for PEE acting as the lead underwriter of Securities; b. making an underwriting contract for Securities with the Issuer, which must at least contain:

1. identity of the Parties;
2. disclosure of the existence or non-existence of Affiliation between PEE and the Issuer;
3. the nature of the Affiliation between PEE and the Issuer, if an Affiliation exists;
4. the duties of PEE as the lead underwriter of Securities and PEE as Underwriter of Securities;
5. description of Securities;
6. underwriting, consisting of:
   a) form of underwriting; b) amount of issuance; c) allocation mechanism; and d) share or portion of Securities guaranteed by PEE, which is done individually or with syndication;
7. remuneration:
   a) remuneration as the manager of the Securities issuance; b) remuneration from underwriting performed by each underwriter; and c) remuneration from sales performed by each underwriter.
8. preconditions;
9. validity period and termination of the agreement;
10. description of the approach or method in determining the price of equity Securities, including description of factors and parameters used in determining the price based on market developments at the time of price determination after the initial offering; and
11. description of dispute or litigation settlement between the Parties regarding the fulfillment of rights and obligations in the contract; and
    c. implementing underwriting.

(3) PEE is required to have policies and standard operating procedures in conducting due diligence on Issuers that will conduct a Public Offering.

(4) PEE is required to have policies regarding criteria for Issuers that will conduct a Public Offering.

(5) In the event that PEE conducts activities as the manager of the issuance of Debt Securities and/or Sukuk without Public Offering, PEE is required to perform duties and responsibilities as regulated in Financial Services Authority Regulations regarding the issuance of Debt Securities and/or Sukuk conducted without a Public Offering.

Article 14
(1) The implementation of underwriting activities by the underwriting function as referred to in Article 13 is subject to the following provisions:
a. PEE that is the lead underwriter of Securities must conduct due diligence on the Issuer before the Issuer submits the Registration Statement to the Financial Services Authority; b. in conducting due diligence as referred to in letter a, PEE that is the lead underwriter of Securities must meet:

1. examination of the consistency of information presentation in the Registration Statement document with legislative provisions;
2. confirmation of information presentation in the Registration Statement document with capital market supporting professions and/or the Issuer;
3. ensuring the consistency, completeness, and truthfulness of information disclosure in each Registration Statement document that has been examined by capital market supporting professions;
4. conducting interviews and/or requesting written statements from Parties required to obtain information truthfulness;
5. evaluating documents, at least:
   a) financial statements; b) articles of association; and c) documents providing a company overview, if there are documents providing a company overview;
6. conducting direct review;
7. evaluating the feasibility of the company that will conduct a Public Offering, at least on:
   a) financial conditions and business continuity of the Party that will conduct a Public Offering consisting of:
   1) evaluation of financial conditions sourced from company financial statements in the last 5 (five) years or since the company's establishment if less than 5 (five) years; and
   2) evaluation of company management;
   b) evaluation of the purpose of use of funds from the Public Offering, its impact on the company's business continuity, and the company's financial performance after the Public Offering; c) projection of the Issuer's business performance; and d) interest rates or other yields and the number of shares and/or the number of EBUS to be issued by the Issuer;
8. preparing and storing work papers on the implementation of due diligence for a minimum period of 10 (ten) years from the end of the due diligence implementation; and
9. other matters if required by PEE that is the lead underwriter of Securities in the implementation of due diligence.
   c. in the event that approval from relevant Parties is required for the implementation of underwriting, PEE must obtain approval from relevant Parties before the Issuer submits the Registration Statement to the Financial Services Authority.
   d. in the event that PEE provides advice before conducting underwriting activities, PEE must provide information regarding financing options so that the Issuer can determine the appropriate financing option, which is done through the issuance of Securities or other financing options; e. PEE that is the lead underwriter of Securities must include the name of the lead underwriter of Securities and the name of the Party providing advice to the Issuer in the prospectus, if there are Parties other than PEE; f. PEE and Parties other than PEE as referred to in letter e are responsible for the advice provided; g. PEE must evaluate the feasibility of the Issuer before implementing underwriting based on the results of due diligence conducted by the lead underwriter of Securities; and h. PEE must conduct due diligence on guaranteed allocation investors.

(2) The Financial Services Authority may request work papers on the implementation of due diligence as referred to in paragraph (1) letter b number 8 from PEE to prove that the due diligence has been conducted by PEE.

Article 15
In the event that PEE cooperates with other Parties conducting advisory activities before underwriting Securities, PEE is required to:
a. take full responsibility for the implementation of Securities underwriting activities; and b. ensure the implementation of Securities underwriting activities in accordance with capital market legislative provisions.

Article 16
(1) PEE providing advice to the Issuer and/or other Parties must sign documents regarding the provision of advice.

(2) Documents regarding the provision of advice as referred to in paragraph (1) must be signed by the Chief Executive Director and/or the Director overseeing PEE activities.

Section Three
Risk Management Function

Article 17
(1) Work units performing the risk management function as referred to in Article 6 paragraph (1) letter b are responsible for implementing risk assessments on underwriting activities for a Securities issuance and other underwriting services.

(2) Work units as referred to in paragraph (1) are required to be responsible for:
a. reviewing and assessing the risk of due diligence on Issuers conducted by the underwriting function; b. assessing the underwriting risk from the Issuer;
c. recommending risk handling for underwriting;
d. assessing the risk of potential Issuers of EBUS without Public Offering or other PEE activities; and

---

e. formulating policies and procedures/mechanisms for risk management over securities underwriting activities and/or issuance of Public Offering-Free Corporate Bonds (EBUS) and other PEE activities. (3) The work unit performing risk management functions must provide feasibility recommendations for becoming an Issuer or Issuer of Public Offering-Free Corporate Bonds based on risk assessment.

Article 18
(1) The official in charge overseeing risk management functions must hold a Securities Company Representative License and a Risk Management Certificate. (2) Employees implementing risk management functions must hold a Securities Company Representative License or a Risk Management Certificate.

Article 19
The work unit performing risk management functions as referred to in Article 17 paragraph (2) is also required to be responsible for conducting risk assessments if there are actions by Issuer shareholders that can significantly affect the Issuer's condition during the Issuer's public offering period.

Article 20
(1) In carrying out risk assessments as referred to in Article 17 and Article 19, PEE must compile and store risk assessment working papers for a minimum period of 10 (ten) years from the implementation of the risk assessment. (2) The Financial Services Authority may request the working papers as referred to in paragraph (1) from PEE to prove that the risk assessment has been carried out by PEE.

Article 21
(1) PEE's risk management function must document the results of risk assessments and recommendations regarding the proposed underwriting activities.
(2) The documentation as referred to in paragraph (1) must be signed by the head of the risk management function.
(3) The results of risk assessments and recommendations regarding the proposed underwriting activities as referred to in paragraph (2) must be submitted to the Board of Directors as consideration for their decision-making to proceed or not proceed with the proposed underwriting activities.

Article 22
(1) PEE's work unit performing risk management functions must conduct risk assessments over the administration of Public Offering-Free Corporate Bond issuance activities or other PEE activities.

(2) The risk assessment as referred to in paragraph (1) must contain at least:
a. risk identification with inventory of risks across all company divisions; b. risk measurement by explaining steps for measuring or assessing risks;
c. risk monitoring by explaining monitoring steps and Parties responsible for executing risk monitoring; and
d. risk control by explaining control steps and Parties responsible for executing risk controls.

Fourth Section
Accounting Function

Article 23
The work unit performing accounting functions as referred to in Article 6 paragraph (1) letter c is required to be responsible for:
a. handing over funds from the proceeds of the Public Offering to the Issuer; b. ensuring that definite allotment investors have sufficient funds to place orders by examining bank statements from definite allotment investor recipients;
c. ensuring that funds from investors are received no later than when the Securities are delivered;
d. maintaining company records and books, at least including the general ledger; e. ensuring that the general ledger as referred to in letter d is maintained as regulated in Otoritas Jasa Keuangan regulations concerning Securities Company financial reports; f. recording all transactions manually and/or electronically; g. ensuring that the recording system used has security measures that can prevent risks of forgery and/or misuse of records; h. ensuring that the recording system can provide information that is fast, accurate, and understandable to interested Parties regarding the recording documents; and
i. storing additional records and other supporting documents, including:

1. proof of check disbursement;
2. bank accounts;
3. check cancellations, if there are check cancellations;
4. bank account reconciliations; and
5. balances of all accounts in the general ledger in the form of a trial balance, at least every month.

Fifth Section
Compliance Function

Article 24
(1) The official in charge overseeing compliance functions must hold a Securities Company Representative License and a Compliance Certificate.
(2) Employees implementing compliance functions must hold a Securities Company Representative License or a Compliance Certificate.
(3) Compliance functions may be implemented by a work unit, Board of Directors members, or officials at a level below the Director.
(4) Work units, Board of Directors members, or officials at a level below the Director performing compliance functions as referred to in Article 6 paragraph (1) letter d are required to be responsible for:
a. conducting post-implementation evaluation of a transaction such as securities underwriting to ensure compliance with legislation; b. ensuring that decisions made on transactions such as securities underwriting executed comply with PEE's internal policies and external policies;
c. identifying policies, standard operating procedures, and legislation related to PEE;
d. formulating policies, procedures, and main tasks and functions of the compliance unit; e. ensuring PEE's compliance with policies and standard operating procedures; f. ensuring PEE's compliance with licensing regulations; g. ensuring PEE's compliance with regulations regarding employee supervision; h. ensuring PEE's compliance with internal control regulations;
i. ensuring PEE's compliance with regulations regarding the prevention and eradication of money laundering, terrorism financing, and/or financing of weapons of mass proliferation;
j. handling and administering customer complaints by having special mechanisms to handle and follow up on written customer complaints referring to Otoritas Jasa Keuangan regulations concerning consumer and community protection in the financial services sector; k. supervising business continuity plans;
l. assessing and evaluating the effectiveness, adequacy, and suitability of policies, regulations, systems, and procedures owned by the Securities Company with legislative regulations;
m. reviewing and/or recommending updates and improvements to policies, regulations, systems, and procedures owned by the Securities Company to align with legislative regulations; n. submitting periodic reports at least once per year and incidental reports to the Board of Commissioners and/or Board of Directors, regarding the tasks and responsibilities of the compliance function; o. taking steps to support the creation of a compliance culture in all PEE business activities at every organizational level; and p. performing other tasks related to compliance functions in connection with the application of new regulations from Otoritas Jasa Keuangan.

Article 25
Implementation of compliance functions as referred to in Article 24 paragraph (3) and paragraph (4) must meet the following conditions:
a. the work unit, Board of Directors member, or official at a level below the Director exercising compliance functions must be independent from other functions, yet have unlimited access to other functions related to compliance tasks to ensure PEE compliance; b. the work unit, Board of Directors member, or official at a level below the Director exercising compliance functions must be established as part of PEE's organizational structure;
c. the work unit, Board of Directors member, or official at a level below the Director exercising compliance functions must be designated as the representative assigned by PEE to handle inspection processes from the Financial Services Authority;
d. in establishing a work unit, appointing a Board of Directors member, or appointing an official at a level below the Director exercising compliance functions, PEE considers business complexity and the number of employees; e. the work unit, Board of Directors member, or official at a level below the Director exercising compliance functions must formulate compliance standard operating procedures in accordance with capital market legislative regulations, including but not limited to compliance with regulations regarding:
1) risk and violation identification procedures;
2) risk mitigation and violation indication procedures;
3) reporting procedures, both incidental and periodic, submitted to the Financial Services Authority;
4) supervision procedures to correct violations and ensure violations do not recur; and
5) document maintenance procedures related to compliance function implementation;
f. the authority of the compliance function must be established in a binding deed of agreement covering the work unit, Board of Directors member, or official at a level below the Director exercising compliance functions and other functions; and g. the work unit, Board of Directors member, or official at a level below the Director exercising compliance functions must immediately report confidentially to the Board of Commissioners and the Financial Services Authority if indications of violations of legislative regulations committed by PEE and/or its customers are found.

Article 26
In the event that PEE has obtained a mandate from the Issuer and the said Issuer increases capital with pre-emptive rights or other corporate actions, the compliance function implementer as referred to in Article 24 paragraph (3) must ensure that employees handling the said Issuer do not trade the said Securities until the information regarding capital increase with pre-emptive rights or the said corporate action becomes public information.

Sixth Section
Human Resource Quality Management and Development Function

Article 27
The work unit performing human resource quality management and development functions as referred to in Article 6 paragraph (1) letter e is required to be responsible for:
a. administering the human resource quality development plan; b. submitting the human resource quality development plan as referred to in letter a in the PEE business plan report, for PEEs obligated to submit PEE business plan reports;
c. administering the realization of human resource quality development; and
d. submitting the realization of human resource quality development as referred to in letter c in the PEE business plan realization report, for PEEs obligated to submit PEE business plan realization reports.

Article 28
Implementation of human resource quality management and development functions as referred to in Article 27 is conducted with the following conditions:
a. implementation of human resource quality management and development functions must be coordinated by a coordinator who is a Board of Directors member, responsible official, or employee with at least 1 (one) year of work experience in the human resources field; b. the coordinator of the human resource quality management and development function is required to be responsible for:

1. formulating and implementing training programs to improve employees' technical abilities and compliance with the code of ethics and employee behavioral standards;
2. providing assistance and/or conducting training for employees in work units performing other functions to fulfill compliance with legislative regulations;
3. conducting screening procedures for new employee recruitment in accordance with standard operating procedures and applicable regulations; and
4. maintaining records and documents related to human resource development functions, including but not limited to documents related to training and personnel administration.

Seventh Section
Administrative Sanctions

Article 29
(1) Any Party violating provisions as referred to in Article 6 paragraph (1), Article 7, Article 11 paragraph (1), (2), (3), (4), (5), Article 12, Article 13, Article 14 paragraph (1) letters a, b, c, d, e, f, g, h, Article 15, Article 16 paragraph (1), Article 17 paragraph (2), Article 18, Article 19, Article 20 paragraph (1), Article 21, Article 22 paragraph (1), Article 23, Article 24 paragraph (1), (2), (4), Article 25, Article 26, Article 27, and/or Article 28 shall be subject to administrative sanctions. (2) Sanctions as referred to in paragraph (1) are also imposed on Parties causing the occurrence of violations as referred to in paragraph (1). (3) Sanctions as referred to in paragraph (1) and paragraph (2) are imposed by the Financial Services Authority. (4) Administrative sanctions as referred to in paragraph (1) consist of:
a. written warning; b. fine, namely the obligation to pay a certain amount of money;
c. restriction of business activities;
d. suspension of business activities; e. revocation of business license; and/or f. revocation of individual license.
(5) Administrative sanctions as referred to in paragraph (4) letters b, c, d, e, or f may be imposed with or without prior imposition of administrative sanctions in the form of a written warning as referred to in paragraph (4) letter a. (6) Administrative sanctions in the form of fines as referred to in paragraph (4) letter b may be imposed separately or together with administrative sanctions as referred to in paragraph (4) letters c, d, e, or f. (7) Procedures for imposing sanctions as referred to in paragraph (3) are implemented in accordance with capital market legislative regulations.

CHAPTER IV
CONDUCT OF SECURITIES UNDERWRITERS

First Section
Underwriter Obligations and Prohibitions

Article 30
PEE is required to be responsible for activities in the Public Offering according to the schedule listed in the prospectus, at least:
a. marketing of Securities; b. allotment of Securities; and
c. payment of Public Offering funds received by the lead underwriter to the Issuer and refund of order payments resulting from cancellation of the Public Offering caused by the Company's shares not being recorded on the Stock Exchange.

Article 31
In the event of insufficient purchase demand in the Public Offering, PEE, Securities sales agents, Affiliates of PEE, or Affiliates of Securities sales agents are prohibited from selling Securities already purchased or to be purchased based on securities underwriting agreements until such Securities are recorded on the Stock Exchange.

Article 32
(1) In the event that a Public Offering involves more than 1 (one) PEE, PEE must divide tasks among PEEs that are members of the underwriting syndicate. (2) Task division as referred to in paragraph (1) does not relieve PEE from individual or joint responsibility for organizing the Public Offering.

Article 33
PEE acting as the lead underwriter is required to be responsible for paying Public Offering proceeds to the Issuer in accordance with the underwriter contract.

Article 34
PEE employees holding licenses as Securities Underwriting Representatives who participate in underwriting activities and/or other activities must make records and documentation of all important matters performed related to underwriting activities and/or other activities.

Article 35
(1) PEE is required to be responsible for the Public Offering process based on contracts with the Issuer.
(2) PEE's responsibilities as referred to in paragraph (1) must be stated in the prospectus.

Article 36
(1) PEE acting as the lead underwriter jointly with the Issuer is required to be responsible for the truthfulness and completeness of the Registration Statement submitted to the Financial Services Authority. (2) If the Registration Statement for the Public Offering contains incorrect information regarding material information or facts or fails to disclose material facts in accordance with capital market legislative regulations, thereby misleading the information, then:
a. every Party signing the Registration Statement; b. directors and commissioners of the Issuer at the time the Registration Statement becomes effective;
c. the lead underwriter; and
d. capital market supporting professions or other Parties providing opinions or statements and whose consent is included in the Registration Statement, are required to be responsible, individually or jointly, for losses arising from such acts.

Article 37
PEE must disclose in the prospectus under the securities underwriting section in the event of Affiliate relationships or other material relationships between PEE and the Issuer.

Article 38
In the event of excess demand for Securities in the Public Offering, PEE must prioritize the interests of orders from Parties not affiliated with PEE over the interests of PEE's own orders and orders from Parties affiliated with PEE.

Second Section
Handling Conflicts of Interest
Paragraph 1
Handling Conflicts of Interest During Due Diligence against Issuers and/or Public Offering-Free Corporate Bond Issuers Before the Registration Statement

Article 39
During the due diligence process against Issuers and/or Public Offering-Free Corporate Bond Issuers, PEE must:
a. ensure that employees performing research functions work professionally, independently, and do not receive pressure to give unfair opinions against Issuers and/or Public Offering-Free Corporate Bond Issuers as prospective clients; b. ensure that there are no conflicts of interest other than those related to the issuance process that could affect the execution of Public Offerings, Public Offering-Free Corporate Bond issuances, and/or the Issuer's and/or Public Offering-Free Corporate Bond Issuer's planned use of funds between:

1. PEE and Issuers and/or issuers;
2. PEE and the Board of Directors, Board of Commissioners, controlling shareholders of the Issuer, and/or Public Offering-Free Corporate Bond Issuers and Affiliates of said Parties;
3. the Board of Directors, Board of Commissioners, controlling shareholders, and Affiliates of each respective Party with Issuers and/or Issuers; and
4. PEE as the administrator of issuance with professional investors.

Article 40
PEE must establish information flow boundaries between employees performing research functions and teams handling underwriting until the announcement of information disclosure is made to prevent exchange of information or communication that could cause conflicts of interest.

Paragraph 2
Handling Conflicts of Interest in Price Determination

Article 41
(1) In determining the offer price of Securities, PEE must:
a. conduct analysis and provide considerations regarding:

1. determination of the offer price and the number of Securities to be issued; and/or
2. determination of interest rates or other yields over Securities to be issued by the Issuer;
   b. ensure the Issuer receives information about important matters that could affect the price determination results;
   c. provide information to prospective investors in a timely manner;
   (2) Analysis and provision of considerations regarding offer price determination as referred to in paragraph (1) letter a number 1 must be conducted at least 2 (two) times: initially before the initial offering and at the final price determination after considering the results of the initial offering.

Paragraph 3
Handling Allocation Conflicts of Interest

Article 42
(1) In determining the allotment of Securities, PEE must:
a. have written policies regarding allotment determination to definite allotment investors and investors who will receive allotments from such definite allotments to mitigate conflicts of interest; b. conduct periodic assessments of compliance with policies as referred to in letter a at least once per year;
c. conduct due diligence on definite allotment investors;
d. store records and/or recordings regarding allotment decisions for at least 10 (ten) years from the allotment decision; and e. consider the Issuer's preferences regarding investor profiles and composition when making allotment decisions, if PEE conducts underwriting activities for debt Securities and/or Sukuk issuance. (2) Due diligence on definite allotment investors as referred to in paragraph (1) letter c must be conducted by ensuring at least:
a. the financial capability of definite allotment investors; and b. the parties who are the ultimate beneficial owners.

Third Section
Administrative Sanctions

Article 43
(1) Any Party violating provisions as referred to in Article 30, Article 31, Article 32 paragraph (1), Article 33, Article 34, Article 35, Article 36, Article 37, Article 38, Article 39, Article 40, Article 41, and/or Article 42, shall be subject to administrative sanctions. (2) Sanctions as referred to in paragraph (1) are also imposed on Parties causing the occurrence of violations as referred to in paragraph (1).

(3) Sanctions as referred to in paragraph (1) and paragraph (2) are imposed by the Financial Services Authority.
(4) Administrative sanctions as referred to in paragraph (1) consist of:
a. written warning; b. fine, namely the obligation to pay a certain amount of money;
c. restriction of business activities;
d. suspension of business activities; e. revocation of business license; and/or f. revocation of individual license.
(5) Administrative sanctions as referred to in paragraph (4) letters b, c, d, e, or f may be imposed with or without prior imposition of administrative sanctions in the form of a written warning as referred to in paragraph (4) letter a. (6) Administrative sanctions in the form of fines as referred to in paragraph (4) letter b may be imposed separately or together with administrative sanctions as referred to in paragraph (4) letters c, d, e, or f. (7) Procedures for imposing sanctions as referred to in paragraph (3) are implemented in accordance with capital market legislative regulations.

CHAPTER V
INTERNAL CONTROL OF SECURITIES BROKER INTERMEDIARIES

First Section
Functions of Securities Broker Intermediaries

Article 44
(1) PPE must possess and implement 8 (eight) functions:
a. marketing and trading function; b. risk management function;
c. accounting function;
d. Custodian function; e. information technology function; f. compliance function; g. internal audit function; and h. human resource quality management and development function. (2) Besides possessing and implementing functions as referred to in paragraph (1), PPE may possess and implement other functions.

Article 45
PPE must perform separation of functions as referred to in Article 44 paragraph (1), except:
a. internal audit functions and compliance functions may be performed concurrently; and b. human resource quality management and development functions may be performed concurrently with other functions.

Article 46
Officials of the Securities Company who perform risk management functions and/or compliance functions may concurrently serve as persons responsible for the implementation of the AML, CFT, and PPTSP programs, and the implementation of anti-fraud strategies.

Article 47
(1) In the event that the Securities Company has and performs research functions, the research function must be separated from other functions.
(2) The official responsible for overseeing the research function must possess a Representative of Securities Company license and a Securities Analyst certificate. (3) Employees performing research functions must possess a Representative of Securities Company license or a Securities Analyst certificate. (4) In performing research functions, the Securities Company must formulate and implement written policies and procedures regarding research results so that research conducted by Securities Company analysts to support investment decision-making, providing information, advice, and recommendations to clients, and/or disseminated to the public, is independent. (5) The written policies and procedures referred to in paragraph (4) must cover at least:
a. the reporting flow of officials and employees performing research functions; and b. the basis for calculating compensation for officials and employees performing research functions that can eliminate or significantly limit existing, common, or potential conflicts of interest.

Article 48
Officials and employees of the Securities Company who perform functional separation as referred to in Article 45 must comply with the following provisions:
a. employees performing each of the aforementioned functions are prohibited from:
1. concurrently performing other functions;
2. performing tasks outside their own functional duties and responsibilities without written approval from the Board of Directors; and/or
3. having access to records, books, and accounts of other functions of the Securities Company without written approval from the Board of Directors; and/or
4. having access to or accessing the hardware, software, and documentation of the aforementioned Securities Company, except for employees of the work unit, members of the Board of Directors, or officials at the level below the Board of Directors who perform compliance functions in the course of performing their duties;
and b. in the event that the Securities Company also has business activities as a Securities Brokerage Entity (PEE) and is still integrated with the PEE business activities:
1. operational standard procedures for functions in carrying out activities as a PEE must be separate from the operational standard procedures for the Securities Company functions; and
2. functions in PEE and PPE activities that are the same as referred to in Article 9 and Article 44 paragraph (1) may be carried out by a single work unit.

Article 49
(1) Securities Companies that are Members of the Stock Exchange must submit reports to the Stock Exchange no later than the next business day, with a copy to the Financial Services Authority, if there are problems causing one or more functions of the Securities Company as referred to in Article 44 paragraph (1) to be unable to operate as they should. (2) The report as referred to in paragraph (1) must contain at least:
a. an explanation of the problem that occurred; b. the time the problem occurred;
c. the duration of the problem;
d. the function that experienced the problem and its impact; e. information regarding whether the problem has occurred before; f. the impact of the problem on client interests and the number of clients, if it is possible to calculate; g. steps taken to handle the problem; and h. steps taken to ensure that the same problem does not recur.

Part Two
Marketing and Trading Functions

Article 50
The implementation of marketing and trading functions as referred to in Article 44 paragraph (1) letter a must meet the following provisions:
a. directors, responsible officials, and employees performing marketing and trading functions must possess a Representative of Securities Intermediary Broker license. b. work units performing marketing and trading functions are responsible for:
1. implementing client due diligence as regulated in the Financial Services Authority Regulation regarding the implementation of AML, CFT, and PPTSP programs in the financial services sector;
2. creating regular Securities Account opening contracts with clients;
3. creating financing Securities Account opening contracts with clients, for clients receiving financing facilities in accordance with the Financial Services Authority Regulation regarding Financing of Securities Transactions for clients and short selling transactions by Securities Companies;
4. creating other Securities Account opening contracts with clients, if there are other Securities Account opening contracts with clients;
5. receiving orders and/or instructions for client interests;
6. communicating with clients if there are obstacles in the Online Trading System; and
7. executing Securities Transactions;
c. in creating Securities Account opening contracts with clients as referred to in letter b item 2 and item 3, the Securities Company must comply with the following provisions:
1. Securities Transactions for client interests cannot be executed before the Securities Account is opened in the name of the respective client, except:
a) buying or selling investment products managed by Investment Managers that are not listed on the Stock Exchange; and/or b) buying or selling Securities for the interests of other Securities Companies, banks, insurance companies, pension funds, or other financial institutions;
2. the opening of Securities Accounts must be followed by:
a) the opening of sub-securities accounts at the Securities Custodian and Clearing Institution (LPP); b) the opening of fund accounts in the name of clients at banks for each client, hereinafter referred to as client fund accounts; and c) the creation of a single client identity number at the LPP, for clients who do not yet have a single client identity number;
3. the obligation to open client fund accounts as referred to in item 2 letter b) may be replaced by sub-securities accounts at the LPP for storing and settling client funds;
4. the Securities Account opening contract must contain at least provisions regarding:
a) Securities and/or funds in the client's Securities Account that can be used as collateral for settling obligations only for the respective client against the Securities Company, unless otherwise agreed in a separate agreement from the Securities Account opening contract; b) the Securities Company may request funds and/or Securities from the holder of the Securities Account, before the execution of Securities Transactions; c) funds owned by clients are stored separately in bank accounts for each client in the name of the client or stored in the client's sub-securities account at the LPP; d) Securities owned by clients are stored separately in sub-securities accounts at the Custodian for each client in the name of the client; e) the Securities Company has the right to buy or borrow Securities or sell other Securities owned by the client for the client's Securities Account, with the aim of closing negative Securities balances that are not financed by the Securities Company or not sufficiently guaranteed by the client; f) in the event that funds show a negative balance in the client's regular Securities Account, the Securities Company may:
1) use Securities in the client's Securities Account as collateral for bank loans or other financial institutions; or
2) forcibly sell Securities without client approval,
only for the settlement of the respective client's obligations; g) the authority for forced sale of Securities and the provisions on the order of client Securities sold forcibly, for regular Securities Account opening contracts between the Securities Company and the client. h) for financing Securities Account opening contracts with clients as referred to in letter b item 3, must contain provisions regarding the principal agreement for financing client Securities Transactions as regulated in the Financial Services Authority Regulation regarding Financing of Securities Transactions by Securities Companies for clients and short selling transactions by Securities Companies; i) the client's willingness to grant power of attorney to the Securities Company to:
1) transfer funds in the client's fund account at the bank for the purpose of the client's Securities Transactions; and
2) provide data including mutations and/or fund balances in the fund accounts at the bank as referred to in item 4 letter c) to the LPP;
j) for clients as referred to in item 1 letter b), clients must create a written statement containing at least:
1) the client agrees to guarantee the availability of funds and/or Securities for the purpose of transaction settlement before
placing sell or buy orders; and
2) in the event that the client cannot provide funds and/or Securities, the client agrees to bear and compensate for all losses arising from the failure to settle transactions on the settlement date;
k) provisions and procedures for closing Securities Accounts, including at least provisions for closing Securities Accounts if the balance in the client's Securities Account is nil for a period of at most 6 (six) consecutive months; l) the Securities Account opening contract must contain a client approval or willingness form in the event that there are provisions of legislation requiring the Securities Company to submit certain data and documents related to clients to other Parties; m) the Securities Account opening contract must contain a form prohibiting the granting of transaction power of attorney from the client to the directors, commissioners, and all employees of the Securities Company; n) the client's Securities Account opening contract must contain provisions regarding the client's Securities Account opening contract as regulated in the Financial Services Authority Regulation regarding sub-securities accounts at the LPP; and o) a brief complaint service procedure.
5. special agreements as referred to in item 4 letter a) must contain at least:
a) the main agreement underlying the agreement is a loan agreement; b) benefits obtained by the client; c) procedures agreed upon in the event of a dispute between the client and the Securities Company; d) the duration of the agreement; and e) termination of the agreement;
6. Securities Account opening contract documents as referred to in letter b item 2 and item 3, must be stored in archives at the work unit performing marketing and trading functions, accompanied by documents:
a) related to client acceptance and identification and supporting documents as required in the Financial Services Authority Regulation regarding the implementation of AML, CFT, and PPTSP programs in the financial services sector, and photocopies of the client's single identity number documents; b) related to financing Securities Account opening contracts with clients for clients receiving financing facilities as required in the Financial Services Authority Regulation regarding Financing of Securities Transactions by Securities Companies for clients and short selling transactions by Securities Companies; c) power of attorney from clients that are legal entities granting authority to specific officials of the legal entity to place orders and/or instructions to the Securities Company regarding the client's Securities Account; d) power of attorney from clients granting authority to third parties to place orders and/or instructions to the Securities Company regarding the client's Securities Account if there is a power of attorney granting such authority; e) power of attorney from clients to the Securities Company as referred to in item 4 letter i); f) documents required for the transfer of Securities and/or funds; and g) mutual fund management contracts, collective investment contracts other than mutual funds, and/or other investment products that grant authority to Investment Managers to place orders and/or instructions for the interests of mutual funds, collective investment contracts other than mutual funds, and/or clients of other investment products managed by them;
7. forms for individual clients must contain at least information regarding clients as referred to in the Financial Services Authority Regulation regarding the implementation of AML, CFT, and PPTSP programs:
a) client acceptance and identification; and b) the single client identity number, both for clients who already have a single client identity number and for clients who will have a single client identity number created at the LPP as referred to in item 2 letter c);
8. Securities Account opening contracts as referred to in letter b item 2 and item 3, must be approved by officials and employees in the work unit performing marketing and trading functions; and
9. the Securities Company provides copies of the Securities Account opening contract and bank fund account opening to clients;
d. in performing the responsibility of receiving orders and/or instructions for client interests as referred to in letter b item 5, the Securities Company must comply with at least the following provisions:
1. ensure that clients placing orders and/or instructions have a single client identity number;
2. ensure that client orders and/or instructions to buy and/or sell Securities, change, or cancel other client orders and/or instructions have been verified for identity;
3. create and store records and/or recordings of every client order and/or instruction in chronological order at least regarding:
a) details of orders and/or instructions including:
1) name and type of Securities;
2) quantity of Securities;
3) price of Securities; and/or
4) name and number of the source and destination Securities Accounts;
b) date and time of receipt of orders and/or instructions; c) date and time of every purchase, sale, change, or cancellation of orders and/or instructions; d) requirements for orders and/or instructions; e) client identity code; and f) single client identity number;
4. forward client orders and/or instructions to the work unit performing risk management functions; and
5. all communications related to client orders and/or instructions must be verified and conducted through communication networks and/or electronic media connected to the Securities Company's communication system so that the Securities Company can identify the data of the Party submitting the orders and/or instructions along with other information as regulated in legislation;
e. the Securities Company may open client Securities Accounts electronically by complying with legislative provisions; f. in the organization of electronic opening of client Securities Accounts, the Securities Company must comply with the Financial Services Authority Regulation regarding the implementation of AML, CFT, and PPTSP programs in the financial services sector and legislative provisions regarding electronic information and transactions; and g. the Securities Company, based on the respective risk levels to be taken, may apply specific risk management at least in the form of imposing transaction limits for clients originating from electronic account opening.

Part Three
Risk Management Functions

Article 51
(1) Officials responsible for overseeing risk management functions must possess a Representative of Securities Company license and a risk management certificate. (2) Employees performing risk management functions must possess a Representative of Securities Company license or a risk management certificate. (3) Work units performing risk management functions as referred to in Article 44 paragraph (1) letter b must be responsible for:
a. managing the risk control system; b. formulating transaction parameters and limits;
c. performing verification in processing orders and/or instructions, both for client interests and for the interests of the Securities Company;
d. formulating operational standard procedures related to Securities Transactions carried out for client interests, the Securities Company's own interests, or affiliated Parties of the Securities Company, including but not limited to shareholders, members of the Board of Directors, commissioners, and employees; and e. the implementation of risk management on all activities including functions as referred to in Article 44 which are carried out in accordance with the Financial Services Authority Regulation regarding the implementation of risk management for Securities Companies carrying out business activities as Securities Brokerage Entities and Securities Companies that are Members of the Stock Exchange. (4) The implementation of risk management functions as referred to in paragraph (3) must comply with the following provisions:
a. ensuring the implementation of transaction limit parameters, both for client interests and for the interests of the Securities Company; b. performing verification that the client's Securities Account has been opened and approved by the work unit performing marketing and trading functions;
c. performing verification before executing client orders and/or instructions to ensure the availability of funds and/or Securities in the client's Securities Account for the settlement of the respective Securities Transaction;
d. for clients who do not have a Securities Account at the Securities Company in the condition as referred to in Article 50 letter c item 1 letter b), verification of the availability of funds and/or Securities is done by ensuring that the respective client has created a written statement as referred to in Article 50 letter c item 4 letter j); and e. the implementation of verification against Securities Accounts and the availability of funds and/or Securities as referred to in item 2 and item 3, can be done either manually or electronically through the Securities Company's integrated risk management system. (5) Work units performing risk management functions must be responsible for the implementation of risk management on all activities including functions as referred to in Article 44 paragraph (1) letter b which are carried out in accordance with Financial Services Authority regulations regarding the implementation of risk management for Securities Companies carrying out business activities as Securities Brokerage Entities and Securities Companies that are Members of the Stock Exchange.

Part Four
Bookkeeping Functions

Article 52
The implementation of bookkeeping functions as referred to in Article 44 paragraph (1) letter c must comply with the following provisions:
a. the Securities Company records all transactions carried out every day in accordance with applicable financial accounting standards and Financial Services Authority regulations; b. the work unit performing bookkeeping functions is responsible for maintaining company records and books, at least the general ledger;
c. the general ledger as referred to in letter b is maintained as regulated in the Financial Services Authority Regulation governing the financial reports of Securities Companies;
d. recording as referred to in letter a, can be carried out manually and/or electronically; e. the recording system used has security that can prevent the risk of forgery and/or misuse of records; f. the recording system is able to provide information that is fast, accurate, and understandable by interested Parties regarding the recording documents; g. the work unit performing bookkeeping functions stores additional records and other supporting documents, including:

1. proof of check disbursement;
2. bank accounts;
3. check cancellation, if there is check cancellation;
4. bank account reconciliation;
5. debit and credit notifications of Securities Accounts;
6. balances of all accounts in the general ledger in the form of a trial balance, at least every month;
7. daily records that are proof of all cash debits and credits for that day; and
8. daily reconciliation between the general ledger and the Securities subsidiary ledger; and
   h. information about clients, including transaction activities, is kept confidential by the Securities Company and its employees for at least 10 (ten) years, except with client permission or upon request from competent Parties based on legislation.

Part Five
Custodian Functions

Article 53
The implementation of Custodian functions as referred to in Article 44 paragraph (1) letter d must comply with the following provisions:
a. the work unit performing Custodian functions is responsible for carrying out the Securities Company's obligations as a Custodian as regulated in the Financial Services Authority Regulation regarding Securities Accounts at Custodians; b. the work unit performing Custodian functions is responsible for maintaining company records and books, including:
1. Securities Accounts;
2. Securities subsidiary ledger;
3. Funds subsidiary ledger; and
4. Transaction subsidiary ledger;
c. Securities Accounts as referred to in letter b item 1, contain the following:
1. every Securities Account needs to record:
a) name and address of the account holder; b) Representative of Securities Intermediary Broker or Representative of Underwriter appointed; c) tax identification number; and d) name, address, telephone number, and fax number of the Securities Company;
2. purchases, sales, receipts, and deliveries of Securities and/or funds for each Securities Account, are recorded at least regarding:
a) transaction date; b) transaction description; c) amount of funds, if there is an amount of funds; d) quantity of Securities, if there is a quantity of Securities; and e) transaction exchange rate, if there is a transaction exchange rate;
3. Securities Account reports must contain the client's Securities portfolio position on the report date, and are sent to clients no later than the 10th (tenth) day of every month, including client transaction activities during 1 (one) month; and
4. transactions included in the Securities Account report cover:
a) transactions that have been executed; b) the amount of dividends, bonus shares, interest, pre-emptive rights, and other rights; and c) withdrawal or deposit of funds and/or Securities; d. the Securities subsidiary ledger as referred to in letter b item 2, is created in a double-entry bookkeeping form, containing information as regulated in the Financial Services Authority Regulation regarding the control and protection of Securities stored by Securities Companies; e. the Funds subsidiary ledger as referred to in letter b item 3 contains detailed information describing the following:
1. fund ownership:
a) company; b) clients:
1) affiliated; and
2) non-affiliated;
2. fund storage:
a) details of the balance of each bank account; b) the fund balance of each client every day; and c) the company's fund balance every day;
3. the status of client funds, free or pledged; and
4. the company's funds as referred to in item 1 letter a) are company funds stored and administered by the unit performing bookkeeping functions;
f. the Funds subsidiary ledger report as referred to in letter e is prepared with reference to the Financial Services Authority Regulation regarding the maintenance and reporting of adjusted net working capital; g. the Transaction subsidiary ledger as referred to in letter b item 4, is created no later than the next business day based on written confirmations sent to clients and contains the following:
1. transaction date;
2. type of transaction, e.g., sell or buy;
3. price;
4. commissions and fees;
5. settlement obligation date;
6. client name and code;
7. transaction number;
8. quantity of Securities;
9. settlement method; and
10. information regarding follow-up on transaction settlement, in accordance with the settlement method;
h. the work unit performing Custodian functions must obtain records and/or recordings of conversations regarding Securities Transactions to maintain and organize company records and books as referred to in letter b;
i. recording as referred to in letter b, can be carried out manually, electronically, or other means as long as it does not contradict legislative provisions;
j. the recording system used has sufficient security so as to prevent the risk of forgery and/or misuse

regarding records;

k. the recording system is capable of providing information that is fast, accurate, and understandable to the Parties concerned with the document;

l. the work unit performing the Custodian function stores additional records and other supporting documents, including:

1. Confirmation of Securities Transactions;
2. Notification of debit and credit to Securities Accounts;
3. Contracts for Securities Transactions with other Securities Companies; and
4. Evidence of all bookkeeping for subsidiary Securities books;

m. the work unit performing the Custodian function is responsible for the receipt, delivery, and storage of funds, Securities, and/or documents related to Securities, subject to the following provisions:

1. funds, Securities, and/or documents related to Securities must be stored in a secure iron room, safe, secure iron cabinet, bank, Custodian Bank, or LPP;

2. funds, Securities, and/or documents as referred to in item 1 are calculated and reconciled with the subsidiary Securities book and Securities Account at least:
   a) every day by employees in the work unit performing the Custodian function; b) every month by employees in the work unit performing the compliance function; and c) every year by accountants registered with the Financial Services Authority;

3. funds, Securities, and/or documents as referred to in item 2 owned by the PPE are stored separately from funds, Securities, and/or documents owned by PPE clients, subject to the following provisions:
   a) funds owned by clients are stored separately in bank accounts for each client in the client's name; b) Securities owned by clients are stored separately in subsidiary Securities accounts at the LPP for each client in the client's name; c) documents related to clients are stored in a separate place, subject to the following provisions:
   1) physical documents are stored in a secure place; and
   2) electronic documents are stored in an information technology system that meets the provisions as referred to in this Financial Services Authority Regulation;

4. funds, Securities, and/or documents as referred to in item 1 are secured against misuse, loss, damage, and forgery;

5. records and detailed reports by the work unit performing the Custodian function regarding the receipt and delivery of funds, Securities, and/or documents related to Securities are created and stored by the work unit performing the Custodian function, containing information regarding:
   a) certificate number, if there is a certificate number; b) name and type of Securities; c) Securities code; d) quantity of Securities; e) transaction date; and f) name and identity number of the Securities Account;

6. funds, Securities, and/or documents as referred to in item 1 are prohibited from being withdrawn and/or transferred from the work unit performing the Custodian function, unless based on legitimate authority; and

7. the authority as referred to in item 6 is set forth in standard operating procedures and job descriptions;

n. the work unit performing the Custodian function is responsible for the execution of the settlement of Securities Transactions, including:

1. calculation of rights and obligations for the settlement of Securities Transactions;
2. transfer of Securities and/or funds; and
3. submission of written confirmation to each client; and

o. information about clients, including transaction activities, is kept confidential by the PPE and its employees, except with the client's permission or upon request by the competent Party based on statutory provisions.

Part Six
Information Technology Function
Paragraph 1
Implementation of Information Technology Function
Article 54
(1) The implementation of the information technology function as referred to in Article 44 paragraph (1) letter e must apply and maintain good governance, effective risk management policies, and an internal control system for Information Technology in the use of Information Technology used for the provision of electronic systems for Securities Transactions and/or supporting the business operations of the PPE. (2) The PPE must conduct regular testing of the governance and internal control system for information technology, conducted by itself or by another Party.

Paragraph 2
Implementation of Information Technology Governance
Article 55
(1) The implementation of good governance in carrying out the information technology function includes at least:
a. evaluation of strategy choices, direction of information technology provision strategies, and monitoring of strategy achievement; b. alignment, planning, and organization of all units, strategies, and activities supporting the provision of information technology;
c. definition, acquisition, and implementation of information technology solutions and their integration into the PPE's business processes;
d. provision of operational support for information technology services to stakeholders; and e. monitoring of performance and compliance of information technology provision with internal performance targets, internal controls, and statutory provisions. (2) The implementation of effective risk management in the use of information technology includes at least:
a. active supervision by the Board of Directors and Board of Commissioners; b. adequacy of policies, standards, and procedures for the use of information technology;
c. adequacy of processes for identifying, measuring, monitoring, and controlling risks in the use of information technology; and
d. an internal control system for the use of information technology.

Paragraph 3
Implementation of Information Technology Risk Management
Article 56
(1) PPE that has an electronic system must apply policies, standards, and procedures for the use of information technology at least covering:
a. management; b. development and procurement;
c. information technology operations;
d. communication networks that meet the principles of confidentiality, integrity, and availability; e. information security; f. disaster recovery plans; and g. use of third-party information technology service providers, if the PPE uses other parties as information technology service providers. (2) In the provision of information technology, the PPE must:
a. ensure that data and information security controls are implemented effectively and efficiently; and b. pay attention to at least the aspects of human resources, processes, technology, physical, and environmental, comprehensively, including when the PPE uses electronic financial services. (3) The implementation of data and information security controls as referred to in paragraph (2) letter a is based on the results of risk assessments of the information owned by the PPE. (4) The principles of data and information security controls as referred to in paragraph (2) letter a include at least:
a. confidentiality; b. integrity;
c. availability;
d. authenticity; e. non-repudiation; f. authorization control in systems, databases, and applications; g. separation of duties and responsibilities; and h. maintenance of audit trails. (5) The PPE in operating the electronic system for Securities Transactions must ensure:
a. the implementation of the authenticity principle, at least by establishing 2 (two) authentication factors; b. the implementation of the non-repudiation principle, at least by applying data transmission security and end-to-end encryption;
c. the availability of cyber risk management and/or information security risk management;
d. the continuity and stability of information technology operations used for the provision of electronic systems and/or supporting the business operations of the PPE; and e. mitigation of risks that have the potential to disrupt the provision of electronic systems and/or supporting the business operations of the PPE. (6) The provision of information technology by the PPE can be done independently and/or using third-party information technology service providers.

Article 57
(1) The PPE must place electronic systems in data centers and disaster recovery centers within the territory of Indonesia.
(2) The PPE may place electronic systems in data centers and disaster recovery centers outside the territory of Indonesia after obtaining approval from the Financial Services Authority. (3) Electronic systems that can be placed in data centers and disaster recovery centers outside the territory of Indonesia as referred to in paragraph (2) are:
a. electronic systems used to support integrated analysis for compliance with statutory provisions that include global principles, adopted in cross-border regulations, provided they are not directly related to individual client data and each client's Securities Transaction data; b. electronic systems used for integrated risk management with regional offices or headquarters outside the territory of Indonesia, provided they use aggregated data and are not directly related to individual client data and each client's Securities Transaction data; and/or
c. electronic systems used with regional offices or headquarters outside the territory of Indonesia for communication management and/or internal management that are not related to the electronic system for Securities Transactions and/or systems supporting the business operations of the PPE.
(4) The Financial Services Authority may conduct direct physical inspections to ensure compliance before granting approval as referred to in paragraph (1), paragraph (2), and paragraph (3). (5) Approval from the Financial Services Authority is granted if the PPE:
a. has a written agreement with the electronic system operator containing at least:

1. obligations and rights of the Parties;
2. choice of law clauses in the event of disputes; and
3. confidentiality of data and information;
   b. ensures that the use of electronic systems does not reduce the effectiveness of the Financial Services Authority's supervision, proven by a statement letter;
   c. ensures that the risk management of electronic system provision meets at least the provisions of this Financial Services Authority Regulation; and
   d. submits the results of country risk analysis.

Part Seven
Compliance Function
Article 58
(1) The implementation of the compliance function as referred to in Article 44 paragraph (1) letter f must meet the following provisions:
a. The official in charge of the compliance function must have a Securities Company Representative License and a compliance certificate. b. Employees performing the compliance function must have a Securities Company Representative License or a compliance certificate.
c. The compliance function can be carried out by a work unit, a member of the Board of Directors, or an official at the level below the Board of Directors, subject to the following provisions:

1. the work unit, member of the Board of Directors, or official at the level below the Board of Directors performing the compliance function is independent from other functions, but has unlimited access to other functions related to the compliance function's tasks to ensure the PPE's compliance;
2. the work unit, member of the Board of Directors, or official at the level below the Board of Directors performing the compliance function is established as part of the PPE's organizational structure;
3. the work unit, member of the Board of Directors, or official at the level below the Board of Directors performing the compliance function is designated as a representative entrusted by the PPE to handle examination processes from the Financial Services Authority and the Stock Exchange;
4. in establishing a work unit, appointing a member of the Board of Directors, or appointing an official at the level below the Board of Directors to perform the compliance function, the PPE considers:
   a) the type of products and services offered; b) the type, quantity, and distribution of clients, both retail and institutional clients; c) the organizational structure and distribution of operational activities, including geographical distribution; d) the volume and value of transactions conducted; and e) the number of employees;
5. the work unit, member of the Board of Directors, or official at the level below the Board of Directors performing the compliance function is responsible for at least:
   a) identifying policies, standard operating procedures, and statutory provisions related to the PPE; b) formulating policies, procedures, and the main tasks and functions of the compliance unit; c) ensuring the PPE's compliance with policies and standard operating procedures; d) ensuring the PPE's compliance with licensing provisions; e) ensuring the PPE's compliance with provisions regarding employee supervision; f) ensuring the PPE's compliance with provisions regarding internal controls; g) ensuring the PPE's compliance with provisions regarding the prevention and eradication of money laundering, terrorism financing, and/or financing of weapons of mass destruction; h) ensuring the PPE's compliance with provisions regarding Securities trading, at least by:
   1) preventing the disclosure of confidential data by employees;
   2) detecting, preventing, and handling conflicts of interest;
   3) supervising the opening of new client Securities Accounts;
   4) supervising Securities Transactions, including transactions for the PPE's own interest or its affiliated Parties;
   5) supervising the management of the PPE's portfolio;
   6) supervising any information, advice, recommendations, and/or research results issued by the PPE to be provided to clients and/or disseminated to the public; and
   7) supervising recording and documentation, including storage and prevention of disclosure of records and information that are still confidential;
   i) handling and administering client complaints with a special mechanism to handle and follow up on written complaints from clients referring to the Financial Services Authority Regulation regarding consumer and public protection in the financial services sector; j) supervising business continuity plans; k) assessing and evaluating the effectiveness, adequacy, and compliance of policies, provisions, systems, and procedures owned by the Securities Company with statutory provisions; l) reviewing and/or recommending the updating and refinement of policies, provisions, systems, and procedures owned by the Securities Company to comply with statutory provisions; m) submitting reports regularly at least once (1) per year and ad hoc reports to the Board of Directors and copied to the Board of Commissioners, regarding the tasks and responsibilities of the compliance function; n) taking steps to support the creation of a compliance culture in all PPE business activities at every level of the organization; and o) performing other tasks related to the compliance function in connection with the implementation of new regulations from the Financial Services Authority;
6. the work unit, member of the Board of Directors, or official at the level below the Board of Directors performing the compliance function formulates standard operating procedures for compliance in accordance with statutory provisions in the capital market, at least regarding compliance with provisions on:
   a) procedures for identifying risks and violations; b) procedures for risk mitigation and indications of violations; c) procedures for submitting reports, both ad hoc and regular, to the Financial Services Authority; d) supervision procedures to correct violations and ensure violations do not recur; and e) procedures for maintaining documents related to the implementation of the compliance function; d. the authority of the compliance function must be established in a pact that is legally binding in writing on the work unit, member of the Board of Directors, or official at the level below the Board of Directors performing the compliance function and other functions; and e. the work unit, member of the Board of Directors, or official at the level below the Board of Directors performing the compliance function must immediately report confidentially to the Board of Commissioners and the Financial Services Authority if there are indications of violations of statutory provisions committed by the PPE and/or its clients. (2) The PPE's Board of Commissioners must supervise the implementation of the compliance function's responsibilities and follow up on reports submitted by the work unit, member of the Board of Directors, or official at the level below the Board of Directors performing the compliance function.

Part Eight
Internal Audit Function
Article 59
(1) The official in charge of the internal audit function must have a Securities Company Representative License and an internal audit certificate.
(2) Employees performing the internal audit function must have a Securities Company Representative License or an internal audit certificate.
(3) The implementation of the internal audit function as referred to in Article 44 paragraph (1) letter g must at least include:
a. formulation of internal audit policies; b. testing, evaluation, and recommendations on the compliance of policies, provisions, systems, and procedures owned by the PPE with statutory provisions at least once (1) per year or at a higher frequency, in the event of changes in factors significantly affecting the PPE's business activities; and
c. formulation and implementation of adequate audit programs for all work units, with implementation considering the risk level of each work unit; and
d. monitoring, identification, measurement, and follow-up on matters related to internal audit that require the attention of the Board of Directors.
(4) The work unit, member of the Board of Directors, or official at the level below the Board of Directors performing the internal audit function must submit:
a. regular reports at least once (1) per year; and b. ad hoc reports, if there are ad hoc reports under certain conditions, regarding the implementation of tasks and responsibilities of the internal audit function to the Board of Directors and copied to the Board of Commissioners.

Article 60
The implementation of the internal audit function refers to the Financial Services Authority Regulation regarding the implementation of governance of Securities Companies conducting business as PEE and PPE.

Part Nine
Human Resource Quality Management and Development Function
Article 61
The work unit performing the human resource quality management and development function as referred to in Article 44 paragraph (1) letter h is responsible for:
a. administering the human resource quality development plan; b. submitting the human resource quality development plan as referred to in letter a in the PPE's business plan report, for PPEs obligated to submit the PPE's business plan report; and
c. administering the realization of the human resource quality development plan; and
d. submitting the realization of human resource quality development as referred to in letter c in the PPE's business plan realization report, for PPEs obligated to submit the PPE's business plan realization report.

Article 62
The implementation of the human resource quality management and development function as referred to in Article 61 is subject to the following provisions:
a. the implementation of the human resource quality management and development function must be coordinated by a coordinator who is a member of the Board of Directors, an official in charge, or an employee with at least 1 (one) year of work experience in the human resources field; b. the coordinator of the human resource quality management and development function is responsible for:

1. formulating and implementing training programs to improve employees' technical skills and compliance with the employee code of ethics and behavioral standards;
2. providing assistance and/or conducting training for employees in other work units performing other functions to ensure compliance of other functions with statutory provisions;
3. conducting screening procedures for the acceptance of new employees in accordance with standard operating procedures and applicable provisions; and
4. maintaining records and documents related to the human resource development function, including but not limited to documents related to training and personnel administration.

Part Ten
Securities Broker Procedures
Article 63
(1) The PPE must formulate standard operating procedures for the implementation of functions and ensure that procedures are complied with and implemented by employees performing those functions. (2) In the event of material changes to the standard operating procedures as referred to in paragraph (1), every material change must be submitted to the Financial Services Authority at the latest 7 (seven) days after the material change to the standard operating procedures is made.

Article 64
The PPE must have procedures and notify clients, service providers, and other related Parties regarding the handling of client orders if the PPE's business activities are temporarily suspended.

Part Eleven
Document and/or Data Storage Obligations
Article 65
All documents, data recordings, conversations, and/or recordings of the PPE as referred to in Article 42 paragraph (1) letter d, Article 50 letter d item 3, and Article 53 letter h must be stored for at least 10 (ten) years.

Part Twelve
Functions on PPEs that Limit Their Activities as PPE Marketing Partners
Article 66
(1) PPEs that limit their activities as PPE marketing partners must have and implement 4 (four) functions:
a. marketing and trading function; b. bookkeeping function;
c. compliance function; and
d. human resource quality management and development function.
(2) In addition to having and implementing the functions as referred to in paragraph (1), PPEs may have and implement other functions.

Article 67
PPEs that limit their activities as PPE marketing partners must implement the separation of functions as referred to in Article 66 paragraph (1), except that the human resource quality management and development function can be performed concurrently with other functions.

Article 68
Officials of Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers to the compliance function may concurrently serve as the person responsible for the implementation of the Anti-Money Laundering, Counter-Counter-Terrorism Financing, and Prevention of Proliferation Financing of Weapons of Mass Destruction (APU, PPT, and PPPSPM) programs.

Article 69
(1) Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers may have internal audit functions, information technology functions, and/or research functions. (2) In the event that Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers have and implement internal audit functions as referred to in paragraph (1), the internal audit function may be performed concurrently with the compliance function.

Article 70
(1) In the event that Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers conduct activities using information technology independently, such Securities Companies must have and implement information technology functions in conducting their activities. (2) The information technology function as referred to in paragraph (1) must be separated from other functions.

Article 71
In the event that Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers have research functions, the research function must be separated from other functions.

Article 72
(1) The marketing and trading functions of Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers must be implemented in accordance with the provisions as referred to in Article 50. (2) The accounting functions of Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers must be implemented in accordance with the provisions as referred to in Article 52. (3) The compliance functions of Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers must be implemented in accordance with the provisions as referred to in Article 58. (4) The human resource quality management and development functions of Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers must be implemented in accordance with the provisions as referred to in Article 61 and Article 62. (5) In the event that Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers have internal audit functions, the internal audit functions must be implemented in accordance with the provisions as referred to in Article 59 and Article 60. (6) In the event that Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers have information technology functions, they must:
a. implement information technology functions in accordance with the provisions as referred to in Article 54; b. apply information technology governance in accordance with the provisions as referred to in Article 55;
c. apply information technology risk management in accordance with the provisions as referred to in Article 56; and
d. place electronic systems in data centers and disaster recovery facilities in accordance with the provisions as referred to in Article 57.
(7) In the event that Securities Companies acting as underwriters and securities brokers who limit their activities as underwriters and securities brokers have research functions, the research functions must be implemented in accordance with the provisions as referred to in Article 47.

Thirteenth Part
Administrative Sanctions

Article 73
(1) Any Party violating the provisions as referred to in Article 44 paragraph (1), Article 45, Article 47 paragraph (1), paragraph (2), paragraph (3), paragraph (4), Article 48, Article 49 paragraph (1), Article 50, Article 51, Article 52, Article 53, Article 54, Article 56 paragraph (1), paragraph (2), paragraph (5), Article 57 paragraph (1), Article 58, Article 59, Article 61, Article 62, Article 63, Article 64, Article 65, Article 66 paragraph (1), Article 67, Article 70, Article 71, and/or Article 72, shall be subject to administrative sanctions. (2) Sanctions as referred to in paragraph (1) shall also be imposed on Parties causing the occurrence of violations as referred to in paragraph (1). (3) Sanctions as referred to in paragraph (1) and paragraph (2) shall be imposed by the Financial Services Authority (Otoritas Jasa Keuangan). (4) Administrative sanctions as referred to in paragraph (1) include:
a. written warnings; b. fines, namely the obligation to pay a certain amount of money;
c. restriction of business activities;
d. suspension of business activities; e. revocation of business licenses; f. cancellation of registration; and/or g. revocation of individual licenses.
(5) Administrative sanctions as referred to in paragraph (4) letter b, letter c, letter d, letter e, letter f, or letter g may be imposed with or without prior imposition of administrative sanctions in the form of written warnings as referred to in paragraph (4) letter a. (6) Administrative sanctions in the form of fines as referred to in paragraph (4) letter b may be imposed independently or concurrently with the imposition of administrative sanctions as referred to in paragraph (4) letter c, letter d, letter e, letter f, or letter g.

(7) The procedures for imposing sanctions as referred to in paragraph (3) shall be implemented in accordance with the provisions of legislation in the field of capital markets.

CHAPTER VI
ACCESS RESTRICTIONS

First Part
Access Restrictions on Underwriters and Securities Brokers

Article 74
Parties who are not employees of Underwriters and Securities Brokers are prohibited from:
a. entering the working units' rooms that carry out functions in accordance with the provisions as referred to in Article 6, Article 8, and Article 11 paragraph (1), for Underwriters; b. entering the working units' rooms that carry out functions in accordance with the provisions as referred to in Article 44 and Article 47 paragraph (1), for Securities Brokers, unless supervised strictly and together with authorized Securities Company employees or in the course of exercising their authority based on the provisions of legislation.

Article 75
Any unauthorized Party is prohibited from having access to and/or accessing hardware, computer software, and documentation, except:
a. employees of working units, members of the Board of Directors, or officials at the level below the Board of Directors who carry out compliance and/or internal audit functions, for Underwriters; and b. employees of working units, members of the Board of Directors, or officials at the level below the Board of Directors who carry out compliance and internal audit functions, for Securities Brokers.

Second Part
Administrative Sanctions

Article 76
(1) Any Party violating the provisions as referred to in Article 74 and/or Article 75, shall be subject to administrative sanctions.
(2) Sanctions as referred to in paragraph (1) shall also be imposed on Parties causing the occurrence of violations as referred to in paragraph (1).
(3) Sanctions as referred to in paragraph (1) and paragraph (2) shall be imposed by the Financial Services Authority (Otoritas Jasa Keuangan).
(4) Administrative sanctions as referred to in paragraph (1) include:
a. written warnings; b. fines, namely the obligation to pay a certain amount of money;
c. restriction of business activities;
d. suspension of business activities; e. revocation of business licenses; f. cancellation of approvals; g. cancellation of registration; and/or h. revocation of individual licenses. (5) Administrative sanctions as referred to in paragraph (4) letter b, letter c, letter d, letter e, letter f, letter g, or letter h may be imposed with or without prior imposition of administrative sanctions in the form of written warnings as referred to in paragraph (4) letter a. (6) Administrative sanctions in the form of fines as referred to in paragraph (4) letter b may be imposed independently or concurrently with the imposition of administrative sanctions as referred to in paragraph (4) letter c, letter d, letter e, letter f, letter g, or letter h. (7) The procedures for imposing sanctions as referred to in paragraph (3) shall be implemented in accordance with the provisions of legislation in the field of capital markets.

CHAPTER VII
INTERNAL CONTROL OF REGIONAL SECURITIES COMPANIES

First Part
Functions of Regional Securities Companies (PED)

Article 77
(1) Regional Securities Companies (PED) must have and implement 7 (seven) functions:
a. marketing and trading functions; b. risk management functions;
c. Custodian functions;
d. accounting functions; e. information technology functions; f. compliance functions; and g. human resource quality management and development functions. (2) In addition to having and implementing functions as referred to in paragraph (1), Regional Securities Companies (PED) may have and implement other functions.

Article 78
(1) Regional Securities Companies (PED) must implement the separation of functions as referred to in Article 77 paragraph (1) and other functions as referred to in Article 77 paragraph (2). (2) In the event that Regional Securities Companies (PED) have and implement human resource quality management and development functions as referred to in Article 77 paragraph (1) letter g, such functions may be performed concurrently with other functions as referred to in Article 77 paragraph (1) letter a through letter f.

Article 79
In the event that Regional Securities Companies (PED) have and implement internal audit functions, internal audit functions may be performed concurrently with compliance functions according to business complexity.

Article 80
Officials of Regional Securities Companies (PED) in the risk management and/or compliance functions may concurrently serve as the person responsible for the implementation of the Anti-Money Laundering, Counter-Counter-Terrorism Financing, and Prevention of Proliferation Financing of Weapons of Mass Destruction (APU, PPT, and PPPSPM) programs.

Article 81
In the event that Regional Securities Companies (PED) have and implement research functions, the research functions must be separated from other functions.

Article 82
(1) The marketing and trading functions of Regional Securities Companies (PED) must be implemented in accordance with the provisions as referred to in Article 50. (2) The risk management functions of Regional Securities Companies (PED) must be implemented in accordance with the provisions as referred to in Article 51. (3) The Custodian functions of Regional Securities Companies (PED) must be implemented in accordance with the provisions as referred to in Article 53. (4) The accounting functions of Regional Securities Companies (PED) must be implemented in accordance with the provisions as referred to in Article 52. (5) The information technology functions of Regional Securities Companies (PED) must:
a. implement information technology functions in accordance with the provisions as referred to in Article 54; b. apply information technology governance in accordance with the provisions as referred to in Article 55;
c. apply information technology risk management in accordance with the provisions as referred to in Article 56; and
d. place electronic systems in data centers and disaster recovery facilities in accordance with the provisions as referred to in Article 57.
(6) The compliance functions of Regional Securities Companies (PED) must be implemented in accordance with the provisions as referred to in Article 58.
(7) The human resource quality management and development functions of Regional Securities Companies (PED) must be implemented in accordance with the provisions as referred to in Article 61 and Article 62. (8) In the event that Regional Securities Companies (PED) have and implement internal audit functions, such implementation must be in accordance with the provisions as referred to in Article 59 and Article 60. (9) In the event that Regional Securities Companies (PED) have and implement research functions, such implementation must be in accordance with the provisions as referred to in Article 47.

Second Part
Administrative Sanctions

Article 83
(1) Any Party violating the provisions as referred to in Article 77 paragraph (1), Article 78 paragraph (1), Article 81, and/or Article 82, shall be subject to administrative sanctions. (2) Sanctions as referred to in paragraph (1) shall also be imposed on Parties causing the occurrence of violations as referred to in paragraph (1). (3) Sanctions as referred to in paragraph (1) and paragraph (2) shall be imposed by the Financial Services Authority (Otoritas Jasa Keuangan). (4) Administrative sanctions as referred to in paragraph (1) include:
a. written warnings; b. fines, namely the obligation to pay a certain amount of money;
c. restriction of business activities;
d. suspension of business activities; and/or e. revocation of business licenses; and/or f. revocation of individual licenses.
(5) Administrative sanctions as referred to in paragraph (4) letter b, letter c, letter d, letter e, or letter f may be imposed with or without prior imposition of administrative sanctions in the form of written warnings as referred to in paragraph (4) letter a. (6) Administrative sanctions in the form of fines as referred to in paragraph (4) letter b may be imposed independently or concurrently with the imposition of administrative sanctions as referred to in paragraph (4) letter c, letter d, letter e, or letter f. (7) The procedures for imposing sanctions as referred to in paragraph (3) shall be implemented in accordance with the provisions of legislation in the field of capital markets.

CHAPTER VIII
OUTSOURCING OF REGIONAL SECURITIES BROKER FUNCTIONS

First Part
Outsourcing of Securities Broker (PPE) Functions

Article 84
Outsourcing of Securities Broker (PPE) functions to other Parties must meet the following provisions:
a. PPE may appoint other Parties to perform marketing and trading functions, accounting functions, Custodian functions, and/or information technology functions, with the following provisions:

1. outsourcing of marketing and trading functions refers to Financial Services Authority (Otoritas Jasa Keuangan) regulations regarding underwriters and securities brokers;
2. outsourcing of Custodian functions is conducted to service providers who are Securities Brokers (PPE) or Custodian Banks;
3. outsourcing of information technology functions occurs if:
   a) the information technology operations of PPE are conducted by service providers; and/or b) PPE uses service providers to build and develop applications and/or information technology infrastructure, and information technology operations are conducted by such service providers;
4. In the event that information technology services are conducted by service provider Parties, PPE must:
   a) be responsible for the implementation of risk management; b) appoint a responsible person for the service provision; c) supervise the implementation of PPE activities, which are carried out by service provider Parties; d) periodically evaluate the reliability of service provider Parties concerning performance, provider reputation, and continuity of service provision; e) provide access to internal auditors, external auditors, group internal auditors of PPE, and/or the Financial Services Authority (Otoritas Jasa Keuangan) to obtain data and information whenever needed; f) provide the Financial Services Authority (Otoritas Jasa Keuangan) with timely access to databases, both for current data and for historical data; g) maintain the security of all information, including PPE secrets and customer personal data; h) may only outsource part of the activities based on PPE approval, evidenced by written documents; i) have clear and measurable standard operating procedures in conducting its business; j) conduct selection processes in choosing service providers, considering the principles of prudence and risk management; and k) take certain actions in the event of conditions such as:
   1) deterioration of the performance of information technology services by service providers that has a significant impact on PPE business activities;
   2) service providers become insolvent, in the process of liquidation, or are declared bankrupt by a court;
   3) violations by service provider Parties regarding PPE secrecy obligations and the obligation to keep customer personal data confidential; and/or
   4) conditions causing PPE to be unable to provide data required for supervision by the Financial Services Authority (Otoritas Jasa Keuangan);
5. outsourcing of accounting functions, Custodian functions, and information technology functions is conducted to service providers with the following provisions:
   a) PPE reports information regarding plans to outsource accounting functions, Custodian functions, and/or information technology functions to the Financial Services Authority (Otoritas Jasa Keuangan) using the Functional Outsourcing Plan Report Form contained in the Appendix which is an integral part of this Financial Services Authority Regulation; b) before appointing service providers to perform accounting functions, Custodian functions, and/or information technology functions, PPE conducts due diligence on the service providers, covering at least:
   1) the service providers' high-standard capabilities to perform their functions;
   2) the service providers' ability to fulfill their obligations according to agreements;
   3) operational and financial capability factors, qualitatively and quantitatively;
   4) reputation factors;
   5) coverage of insurance by service providers if insurance is provided by service providers;
   6) the existence of potential conflicts of interest, especially if service providers operate in the same business field; and
   7) the capability and adequacy of resources owned by service providers if they have outsourcing agreements for PPE functions to other Parties with multiple Parties;
   c) PPE conducts periodic reviews of functions performed by service providers to ensure that functions are implemented well and correctly according to the standard operating procedures for the implementation of such functions; d) PPE has written agreements with service providers, at least containing:
   1) party names;
   2) scope, terms, and conditions of PPE functions whose implementation is entrusted to service providers;
   3) responsibilities of PPE and service providers, as well as supervision over the implementation of responsibilities;
   4) service standards and mechanisms to ensure that service standards can be met at all times;
   5) information confidentiality and security;
   6) responsibilities related to information technology system security;
   7) reporting by service providers to PPE;
   8) accountability of service providers to PPE for unsatisfactory services or other violations of the agreement;
   9) guarantees of service quality and compensation;
   10) obligations of service providers to provide any records, information, and/or assistance related to PPE functions implemented by service providers to:
   (a) PPE appointing service providers;
   (b) auditors of the relevant PPE;
   (c) the Financial Services Authority (Otoritas Jasa Keuangan); (d) other Parties appointed by the Financial Services Authority (Otoritas Jasa Keuangan); and/or (e) Stock Exchanges, whenever requested;
   11) prohibitions for service providers to appoint third parties in fulfilling their obligations;
   12) provisions regarding the continuity of PPE functions in the event that service providers experience emergency conditions so that they cannot perform their functions;
   13) termination of agreements, at least including information transfer and steps for agreement termination, and transition procedures;
   14) mechanisms for resolving disputes arising between PPE and service providers; and
   e) In addition to meeting the provisions as referred to in letter d numbers 1) through 14), written agreements for outsourcing information technology functions must also include:
   1) service providers have competent experts supported by skill certificates;
   2) service providers apply adequate information technology control principles, evidenced by audit results by independent Parties; and
   3) service providers provide access for internal auditors, external auditors, group internal auditors of PPE, the Financial Services Authority (Otoritas Jasa Keuangan), and/or other Parties in accordance with the provisions of legislation in order to obtain data and information required whenever needed;
   f) PPE ensures that service providers maintain the confidentiality of information received from PPE; g) PPE reports to Stock Exchanges with copies to the Financial Services Authority (Otoritas Jasa Keuangan) on the next trading day if service providers cannot fulfill their obligations; h) PPE ensures that at all times the Financial Services Authority (Otoritas Jasa Keuangan) and/or other Parties appointed by the Financial Services Authority (Otoritas Jasa Keuangan), as well as Stock Exchanges, can access accounting, records, and documents of service providers related to PPE function outsourcing; and i) PPE appoints service providers whose operational activities are located in Indonesia; b. PPE is responsible for functions whose implementation has been outsourced to other Parties.

Article 85
Securities Brokers (PPE) who limit their activities as underwriters and securities brokers are prohibited from outsourcing to other Parties the implementation of functions that must be possessed.

Second Part
Outsourcing of Regional Securities Company (PED) Functions

Article 86
(1) Regional Securities Companies (PED) may perform outsourcing for the implementation of functions as referred to in Article 77 paragraph (1) to other Parties. (2) The implementation of outsourcing as referred to in paragraph (1) is in accordance with the outsourcing provisions for Securities Brokers (PPE) as referred to in Article 84.

Third Part
Administrative Sanctions

Article 87
(1) Any Party violating the provisions as referred to in Article 84 and/or Article 85, shall be subject to administrative sanctions.
(2) Sanctions as referred to in paragraph (1) shall also be imposed on Parties causing the occurrence of violations as referred to in paragraph (1).
(3) Sanctions as referred to in paragraph (1) and paragraph (2) shall be imposed by the Financial Services Authority (Otoritas Jasa Keuangan).
(4) Administrative sanctions as referred to in paragraph (1) include:
a. written warnings; b. fines, namely the obligation to pay a certain amount of money;
c. restriction of business activities;
d. suspension of business activities; e. revocation of business licenses; f. cancellation of registration; and/or g. revocation of individual licenses.
(5) Administrative sanctions as referred to in paragraph (4) letter b, letter c, letter d, letter e, letter f, or letter g may be imposed with or without prior imposition of administrative sanctions in the form of written warnings as referred to in paragraph (4) letter a. (6) Administrative sanctions in the form of fines as referred to in paragraph (4) letter b may be imposed independently or concurrently with the imposition of administrative sanctions as referred to in paragraph (4) letter c, letter d, letter e, letter f, or letter g. (7) The procedures for imposing sanctions as referred to in paragraph (3) shall be implemented in accordance with the provisions of legislation in the field of capital markets.

CHAPTER IX
CONDUCT OF REGIONAL SECURITIES BROKERS AND REGIONAL SECURITIES COMPANIES

First Part
Obligations and Prohibitions of Securities Brokers (PPE) and Regional Securities Companies (PED)

Article 88
Securities Brokers (PPE) and Regional Securities Companies (PED) must prioritize the interests of their customers before conducting transactions for their own interests.

Article 89
(1) In the event that Securities Brokers (PPE) and Regional Securities Companies (PED) provide recommendations to customers to buy or sell Securities, Securities Brokers (PPE) and Regional Securities Companies (PED) must consider the financial conditions and investment purposes and objectives of the customers. (2) In the event that Securities Brokers (PPE) and Regional Securities Companies (PED) have interests in Securities recommended to their customers, Securities Brokers (PPE) and Regional Securities Companies (PED) must inform customers of the existence of interests in the recommended Securities, before customers buy or sell the recommended Securities.

Article 90
Securities Brokers (PPE) and Regional Securities Companies (PED) must first inform customers if transactions with customers are conducted for their own interests or for the interests of affiliated Parties of Securities Brokers (PPE) and Regional Securities Companies (PED).

Article 91
Securities Brokers (PPE) and Regional Securities Companies (PED) are prohibited from using Securities and/or money received from customers as collateral to obtain loans for their own interests without written consent from customers.

Article 92
Securities Brokers (PPE) and Regional Securities Companies (PED) are prohibited from providing:
a. recommendations to customers to buy, sell, or exchange Securities without considering investment purposes and the financial conditions of customers; and b. guarantees for losses suffered by customers in Securities Transactions.

Article 93
PPE and PEE must include the time, day, and date of customer orders in the order form.

Article 94
(1) PPE and PEE must send confirmations to customers for every transaction on the exchange before the trading day ends.
(2) PPE and PEE must send confirmations to customers for every Securities Transaction that has been executed on the day the Securities Transaction is carried out.

Article 95
PPE and PEE must issue receipts after receiving Securities or funds from customers.

Article 96
Representatives of Securities Brokers are prohibited from:
a. conducting transactions for the benefit of PPE and PEE, which are not recorded in the books of PPE and PEE; and b. conducting transactions in the name of customers without or not in accordance with customer orders.

Article 97
Representatives of Securities Brokers must provide information regarding Securities known to them to customers if requested by customers.

Article 98
Representatives of Securities Brokers are prohibited from directly or indirectly receiving a share of profits from customers for a Securities Transaction.

Article 99
PPE and PEE are responsible for all actions related to activities carried out by the Board of Directors, Board of Commissioners, employees, and/or Third Parties who work for or represent the interests of PPE and PEE.

Article 100
PPE and PEE are responsible for supervising employees working at PPE and PEE in complying with regulations in the capital market sector.

Article 101
PPE and PEE must ensure that their employees have understood the professional code of ethics and received sufficient training related to capital market practices.

Article 102
PPE and PEE are prohibited from only informing customers of the potential returns to be obtained from Securities, products, and/or services offered by PPE and PEE without explaining the risks of each Security, product, and/or service.

Article 103
The Board of Directors, Commissioners, and all employees of PPE and PEE must create a statement letter containing the statements of the Board of Directors, Commissioners, and all employees of PPE and PEE:
a. not currently receiving transaction authority and will not receive transaction authority; and b. will not abuse customer Securities Accounts.

Article 104
In the event that PPE and PEE have a policy to accept customer orders based on transaction authority from customers to other Parties representing customers, PPE and PEE must formulate operational standard procedures for granting authority from customers to other Parties which at least contain:
a. an updated power of attorney at most 1 (one) year from the date of receipt of the power of attorney by PPE and PEE employees; and b. the maximum number of grantors to 1 (one) recipient of authority.

Article 105
Representatives of Securities Brokers are prohibited from acting and/or providing services without the approval of PPE and PEE.

Second Section
Cooperation of PPE and PEE with Social Media Practitioners

Article 106
(1) PPE may cooperate with social media practitioners.
(2) In carrying out cooperation with social media practitioners as referred to in paragraph (1), PPE and PEE must create a written agreement and determine the scope of cooperation with the following choices:
a. social media practitioners conduct activities:

1. providing media for advertisements; and/or
2. conveying general information related to the capital market without offering to prospective customers to become customers of PPE and PEE,
   without involving personal assessment or analysis of specific Securities, products, and/or services from PPE and PEE; b. social media practitioners offer prospective customers to become customers at PPE and PEE; and/or
   c. social media practitioners provide analysis and/or recommendations regarding specific Securities, products, and/or services from PPE and PEE.

Article 107
Social media practitioners who cooperate with PPE and PEE as referred to in Article 106 paragraph (2) letter a are not required to be registered as PPE marketing partners and are not required to have business licenses and/or individual person licenses from the Financial Services Authority.

Article 108
PPE and PEE that cooperate with social media practitioners as referred to in Article 106 paragraph (2) letter b must ensure that social media practitioners have met the Financial Services Authority Regulations regarding PPE marketing partners.

Article 109
PPE and PEE that cooperate with social media practitioners as referred to in Article 106 paragraph (2) letter c must ensure that social media practitioners have licenses as investment advisors.

Article 110
PPE and PEE that cooperate with social media practitioners as referred to in Article 106 paragraph (2) letter a must include disclosures in advertisements that social media practitioners are not employees of PPE and PEE and do not have licenses from the Financial Services Authority.

Third Section
Administrative Sanctions

Article 111
(1) Any Party violating the provisions as referred to in Article 88, Article 89, Article 90, Article 91, Article 92, Article 93, Article 94, Article 95, Article 96, Article 97, Article 98, Article 99, Article 100, Article 101, Article 102, Article 103, Article 104, Article 105, Article 106 paragraph (2), Article 108, Article 109, and/or Article 110, shall be subject to administrative sanctions. (2) Sanctions as referred to in paragraph (1) shall also be imposed on Parties causing the violations as referred to in paragraph (1). (3) Sanctions as referred to in paragraph (1) and paragraph (2) shall be imposed by the Financial Services Authority. (4) Administrative sanctions as referred to in paragraph (1) consist of:
a. written warnings; b. fines, namely the obligation to pay a certain amount of money;
c. business activity restrictions;
d. business activity suspension; e. business license revocation; f. registration cancellation; and/or g. individual person license revocation.
(5) Administrative sanctions as referred to in paragraph (4) letter b, letter c, letter d, letter e, letter f, or letter g may be imposed with or without prior imposition of administrative sanctions in the form of written warnings as referred to in paragraph (4) letter a.

(6) Administrative sanctions in the form of fines as referred to in paragraph (4) letter b may be imposed separately or together with the imposition of administrative sanctions as referred to in paragraph (4) letter c, letter d, letter e, letter f, or letter g. (7) The procedure for imposing sanctions as referred to in paragraph (3) shall be carried out in accordance with regulations in the capital market sector.

CHAPTER X
OTHER PROVISIONS

Article 112
In the event that there are no certification programs at professional certification institutions registered with the Financial Services Authority, directors, responsible officials, and employees of PEE, PPE, and/or PEE are not required to have expertise certificates.

Article 113
In addition to administrative sanctions as referred to in this Financial Services Authority Regulation, the Financial Services Authority may take specific actions against any Party violating the provisions of this Financial Services Authority Regulation.

Article 114
The Financial Services Authority may announce the imposition of administrative sanctions as referred to in this Financial Services Authority Regulation and specific actions as referred to in Article 113 to the public.

CHAPTER XI
TRANSITIONAL PROVISIONS

Article 115
PPE and PEE that have had internal control functions before this Financial Services Authority Regulation was enacted must adjust to the provisions of this Financial Services Authority Regulation for at most 1 (one) year from the time this Financial Services Authority Regulation takes effect.

Article 116
PEE and PPE that limit their activities as PPE marketing partners must have internal control functions in accordance with the provisions of this Financial Services Authority Regulation for at most 1 (one) year from the time this Financial Services Authority Regulation takes effect.

Article 117
(1) PPE that have used electronic systems as referred to in Article 57 paragraph (3) letter a, letter b, and letter c at data centers and disaster recovery centers outside the territory of Indonesia before this Financial Services Authority Regulation was enacted may continue to use electronic systems for at most 1 (one) year from the time this Financial Services Authority Regulation takes effect. (2) The Financial Services Authority may consider extending the time limit for using electronic systems at data centers and disaster recovery centers outside the territory of Indonesia as referred to in paragraph (1) based on requests from PPE.

CHAPTER XII
CLOSING PROVISIONS

Article 118
At the time this Financial Services Authority Regulation takes effect, provisions regarding internal control as regulated in Financial Services Authority Regulation Number 57/POJK.04/2017 concerning the Implementation of Corporate Governance of Securities Companies Conducting Business Activities as Underwriters and Securities Brokers (State Gazette of the Republic of Indonesia Year 2017 Number 211, Supplement to the State Gazette of the Republic of Indonesia Number 6126) and its implementing regulations remain valid as long as they are not inconsistent with the provisions in this Financial Services Authority Regulation.

Article 119
At the time this Financial Services Authority Regulation takes effect, provisions regarding internal control as regulated in the implementing provisions of Financial Services Authority Regulation Number 50/POJK.04/2020 concerning Internal Control of Securities Companies Conducting Business Activities as Securities Brokers (State Gazette of the Republic of Indonesia Year 2020 Number 274, Supplement to the State Gazette of the Republic of Indonesia Number 6587) remain valid as long as they are not inconsistent with the provisions in this Financial Services Authority Regulation.

Article 120
At the time this Financial Services Authority Regulation takes effect:
a. Financial Services Authority Regulation Number 3/POJK.04/2020 concerning the Conduct of Securities Companies Conducting Business Activities as Securities Brokers (State Gazette of the Republic of Indonesia Year 2020 Number 47, Supplement to the State Gazette of the Republic of Indonesia Number 6464); b. Financial Services Authority Regulation Number 4/POJK.04/2020 concerning the Conduct of Securities Companies Conducting Business Activities as Underwriters (State Gazette of the Republic of Indonesia Year 2020 Number 48, Supplement to the State Gazette of the Republic of Indonesia Number 6465); and
c. Financial Services Authority Regulation Number 50/POJK.04/2020 concerning Internal Control of Securities Companies Conducting Business Activities as Securities Brokers (State Gazette of the Republic of Indonesia Year 2020 Number 274, Supplement to the State Gazette of the Republic of Indonesia Number 6587), are revoked and declared invalid.

Article 121
This Financial Services Authority Regulation takes effect 6 (six) months after the date of enactment.

To ensure that everyone knows it, ordering the enactment of this Financial Services Authority Regulation by placing it in the State Gazette of the Republic of Indonesia.

Established in Jakarta on 5 June 2025
CHAIRMAN OF THE BOARD OF COMMISSIONERS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, sd
MAHENDRA SIREGAR

Enacted in Jakarta on 11 June 2025
MINISTER OF LAW OF THE REPUBLIC OF INDONESIA, sd SUPRATMAN ANDI AGTAS

STATE GAZETTE OF THE REPUBLIC OF INDONESIA YEAR 2025 NUMBER 21/OJK

EXPLANATION
OF
FINANCIAL SERVICES AUTHORITY REGULATION
REPUBLIC OF INDONESIA
NUMBER 13 OF 2025
CONCERNING
INTERNAL CONTROL AND CONDUCT OF SECURITIES COMPANIES CONDUCTING BUSINESS ACTIVITIES AS UNDERWRITERS AND SECURITIES BROKERS

I. GENERAL
With the development of the domestic and global economy, as well as the increasing needs of society and investors for financial products, Securities Companies in recent years have gradually undergone transformation through various business development initiatives and services as an effort to accommodate the increasing needs of society for financial products and the demand for easier transactions in the capital market. With the rapid growth of the capital market industry, the implementation of internal control is not only necessary for PPE, but also necessary for PEE in order to maintain independence from potential conflicts of interest.

In addition, Securities Companies also utilize the use of information technology in providing services to customers. Nevertheless, in Financial Services Authority Regulation Number 50/POJK.04/2020 concerning Internal Control of Securities Companies Conducting Business Activities as Securities Brokers, there are no regulations regarding the application of risk management for the use of information technology by users of information technology service providers or electronic or digital system services by PPE.

Considering the increasing complexity of business activities of Securities Companies conducting business activities as PEE and PPE, it needs to be balanced with the implementation of good internal control to minimize risks and maintain the sustainability of Securities Companies. Furthermore, the implementation of internal control of PEE and PEE also needs to be supported by the implementation of good conduct standards in the context of investor protection and maintaining market integrity.

In efforts to improve supervisory activities, the Financial Services Authority needs to refine internal control and conduct regulations for Underwriters and Securities Brokers formulated in one regulation to respond to supervisory attention, the development of legislative regulations, and to accommodate recent development initiatives.

II. ARTICLE BY ARTICLE

Article 1
Sufficiently clear.

Article 2
Paragraph (1)
Sufficiently clear.
Paragraph (2)
Specific conditions include:
a. Securities Companies have licenses as PPE, but the approval letter from the Exchange members has been revoked by the Stock Exchange. b. Securities Companies have licenses as PPE, but have not yet obtained approval letters from the Stock Exchange members.
c. PEE which is also a PPE, but subsequently limits its business activities to not conduct business activities as PPE.

Article 3
Paragraph (1)
Letter a
What is meant by “applying the principle of integrity” is conducting business activities with good faith, upholding honesty, and committing to comply with written agreements and regulations. Letter b What is meant by “applying the principle of professionalism” is conducting business activities professionally. Examples of professionalism:
a. conducting activities in the capital market by always complying with regulations; and b. conducting activities in the capital market by complying with professional codes of ethics and/or regulations governing conduct. Letter c What is meant by “applying the principle of prioritizing customer interests” is prioritizing customer interests before conducting transactions for their own interests. Letter d What is meant by “applying the principle of resource sufficiency” is having and maintaining adequate financial resources, human resources, and other resources in accordance with business activities in accordance with regulations in the capital market sector. Letter e What is meant by “applying the principle of information openness” is providing and/or conveying correct, non-misleading, and non-contradictory information to customers in accordance with regulations. Letter f What is meant by “applying the principle of conflict of interest” is establishing and implementing written policies and procedures regarding actions to avoid conflicts of interest between customer interests and the interests of Securities Companies and Affiliated Parties of such Securities Companies. Letter g What is meant by “applying the principle of compliance” is having and implementing written policies and procedures regarding supervision of the conduct and activities of Securities Companies to support the creation of Securities Companies’ compliance with regulations in the capital market sector as regulated in this Financial Services Authority Regulation and regulations in the capital market sector as well as internal company regulations and/or company operational standard procedures. Paragraph (2) Sufficiently clear.

Article 4
Sufficiently clear.

Article 5
Sufficiently clear.

Article 6
Paragraph (1)
Sufficiently clear.
Paragraph (2)
Other functions include internal audit functions and research functions.

Article 7
Sufficiently clear.

Article 8
Business complexity includes capital and the proportion of the value of Securities underwritten.

Article 9
Sufficiently clear.

Article 10
Sufficiently clear.

Article 11
Paragraph (1)
Sufficiently clear.
Paragraph (2)
Representative licenses in the form of Underwriter Representative licenses and/or Securities Broker Representative licenses.
Securities Analyst Certificates are issued by professional certification institutions registered with the Financial Services Authority.
Paragraph (3)
See the explanation of paragraph (2).
Paragraph (4)
Sufficiently clear.
Paragraph (5)
Research results are used to support corporate investment decisions, provide information, advice, recommendations to customers, and/or disseminate to the public. Paragraph (6) Sufficiently clear.

Article 12
Sufficiently clear.

Article 13
Paragraph (1)
Sufficiently clear.
Paragraph (2)
Letter a
Offers until the exploration of cooperation are known by the term beauty contest.
Number 1
Sufficiently clear.
Number 2
Sufficiently clear.
Number 3
Sufficiently clear.
Number 4
Sufficiently clear.
Number 5
What is meant by “description of Securities” is the type of Securities issued and offered.
Number 6
Letter a)
Sufficiently clear.
Letter b)
Sufficiently clear.
Letter c)
Allocation mechanisms include certain allocation or centralized allocation.
Letter d)
Sufficiently clear.
Number 7
Letter a)
Remuneration as an issuer manager of Securities is known as management fee.
Letter b)
Remuneration from underwriting conducted by each underwriter is known as underwriting fee.
Letter c)
Remuneration from sales conducted by each underwriter is known as selling fee.
Number 8
Sufficiently clear.
Number 9
Sufficiently clear.
Number 10
Initial offers are known as bookbuilding.
Number 11
Sufficiently clear.
Letter c
Sufficiently clear.
Paragraph (3)
Sufficiently clear.
Paragraph (4)
Sufficiently clear.
Paragraph (5)
Sufficiently clear.

Article 14
Paragraph (1)
Letter a
Sufficiently clear.
Letter b
Number 1
Sufficiently clear.
Number 2
Sufficiently clear.
Number 3
In ensuring the consistency of information, PEE which is an issuer manager of Securities coordinates with PEE and all capital market supporting institutions and professions involved and ensures that the information in each document is correct and the same. Number 4 Sufficiently clear. Number 5 Sufficiently clear. Number 6 Direct review is known as on-site visit. Number 7 Sufficiently clear. Number 8 Sufficiently clear. Number 9 Sufficiently clear. Letter c Sufficiently clear. Letter d Sufficiently clear. Letter e Sufficiently clear. Letter f Sufficiently clear. Letter g Sufficiently clear. Letter h Sufficiently clear. Paragraph (2) Sufficiently clear.

Article 15
What is meant by “Other Parties” is Parties other than PEE conducting advisory services to prospective Issuers to be underwritten by PEE.

Article 16
Paragraph (1)
What is meant by “Other Parties” is Parties other than Issuers or closed companies given advice by PEE.
Example: closed companies conducting EBUS Issuance without Public Offers.
Documents that must be signed by PEE providing advice include prospectuses for the issuance of Securities and information disclosure documents in the context of mergers, consolidations, takeovers, restructuring, material transactions, and/or specific transactions involving conflicts of interest of Issuers. Paragraph (2) Sufficiently clear.

Article 17
Paragraph (1)
Other underwriting services include acting as issuer managers for the issuance of debt Securities and/or sukuk without public offers.
Paragraph (2)
Sufficiently clear.
Paragraph (3)
Sufficiently clear.

Article 18
Paragraph (1)
Sufficiently clear.
Paragraph (2)
Risk management certificates are issued by professional certification institutions registered with the Financial Services Authority.

Article 19
Actions by Issuer shareholders that can significantly affect Issuer conditions include plans for changes in control after the Issuer is listed, corporate action plans, and/or corporate restructuring plans. The Issuer offering period covers from the date PEE signs the underwriting contract with the Issuer until the public offering process is complete.

Article 20
Sufficiently clear.

Article 21
Sufficiently clear.

Article 22
Paragraph (1)
Risk assessments for activities as issuer managers for EBUS issuance without Public Offers or other services for EBUS issuers without Public Offers are conducted with reference to regulations. Paragraph (2) Sufficiently clear.

Article 23
Letter a
For PEE that also conducts business activities as PPE, the delivery of proceeds from Public Offers to Issuers can be conducted by the Custodian function. Letter b Ensuring funds from certain allocation investors are conducted by the Custodian function for PEE that is also PPE. Letter c Ensuring funds from investors are received no later than when Securities are delivered by the Custodian function for PEE that is also PPE. Letter d Sufficiently clear. Letter e Sufficiently clear. Letter f Sufficiently clear. Letter g Sufficiently clear. Letter h Sufficiently clear. Letter i Sufficiently clear.

Article 24
Paragraph (1)
Compliance certificates are issued by professional certification institutions registered with the Financial Services Authority.
Paragraph (2)
Sufficiently clear.
Paragraph (3)
Sufficiently clear.
Paragraph (4)
Letter a
Sufficiently clear.
Letter b
“Internal PEE policies” include PEE operational standard procedures.
“External PEE policies” include association codes of ethics.
Letter c
Sufficiently clear.
Letter d
Sufficiently clear.
Letter e
Sufficiently clear.
Letter f
Sufficiently clear.
Letter g
Sufficiently clear.
Letter h
Sufficiently clear.
Letter i
Sufficiently clear.
Letter j
Sufficiently clear.
Letter k
Sufficiently clear.
Letter l
Sufficiently clear.
Letter m
Sufficiently clear.
Letter n
Sufficiently clear.
Letter o
Sufficiently clear.
Letter p
Sufficiently clear.

Article 25
Sufficiently clear.

Article 26
Mandates from Issuers include for PEE to act as standby buyers or financial advisors.
What is meant by “the Securities in question” is Securities that are in the process of preemptive rights or other corporate actions.
Example of Securities in question: restricted list.

Article 27
Sufficiently clear.

Article 28
Sufficiently clear.

Article 29
Sufficiently clear.

Article 30
Letter a
Sufficiently clear.
Letter b
What is meant by “PEE handling Securities allocation” is PEE appointed to conduct allocation of allocation portions in the implementation of Public Offers. Letter c Sufficiently clear.

Article 31
Sufficiently clear.

Article 32
Sufficiently clear.

Article 33
Sufficiently clear.

Article 34
All important matters include reports on due diligence against Issuers and documentation of agreements between PEE and Issuers.
Other activities include advisory services.

Article 35
Sufficiently clear.

Article 36
Sufficiently clear.

Article 37
Other material relationships include:
a. material business relationships between Issuers and PEE such as debt-creditor relationships and the provision of certain services; and/or b. financing relationships including investments, financing, purchases of debt Securities and/or sukuk in Public Offers, EBUS without Public Offers.

Article 38
Affiliated Parties do not include Parties ordering Securities for the benefit of their customers, for example securities located abroad ordering Securities for the benefit of their customers.

Article 39
Letter a
Sufficiently clear.
Letter b
What is meant by conflict of interest is the difference between economic interests:

This copy is consistent with the original
Director of Legal Development
Legal Department sd
Aat Windradi

a. PEE with economic interests of the Issuer and/or the EBUS Issuer without Public Offering, personal economic interests of members of the Board of Directors, members of the Board of Commissioners, major shareholders, or controllers of the Issuer and/or EBUS Issuer without Public Offering; or b. The Issuer and/or EBUS Issuer without Public Offering with the personal economic interests of members of the Board of Directors, members of the Board of Commissioners, major shareholders, or controllers of the Issuer and/or EBUS Issuer without Public Offering. which may harm the aforementioned Issuer and/or EBUS Issuer without Public Offering.

Article 40
Information flow boundaries are known as the term Chinese wall.

Article 41
Paragraph (1)
Letter a
Number 1
The determination of the offering price and the number of Securities to be issued is based on comprehensive analysis, including relevant approaches and benchmarks equivalent to other Issuers. Number 2 Clearly stated. Letter b Important matters that can affect the determination of the price include, among others, bookbuilding results, macroeconomic condition changes, investor demand, the PEE's assessment of stock price estimates in the secondary market, and the PEE's assessment of the industry. Letter c Timely information includes, among others, the provision of all information that may affect the price during the period from the publication of information until the public offering begins. Paragraph (2) See the explanation of Article 13 paragraph (2) letter b number 10.

Article 42
Paragraph (1)
Letter a
Clearly stated.
Letter b
Clearly stated.
Letter c
Clearly stated.
Letter d
The term "notes and/or records" includes, among others, log books and conversation recordings.
Letter e
Clearly stated.

Paragraph (2)
The financial capacity of certain allocation investors is evidenced, among others, by bank statement documents.
Actual owners are known as the term ultimate beneficial owner.

Article 43
Clearly stated.

Article 44
Paragraph (1)
Clearly stated.
Paragraph (2)
Other functions include, among others, research functions.

Article 45
Clearly stated.

Article 46
Clearly stated.

Article 47
Clearly stated.

Article 48
Clearly stated.

Article 49
Clearly stated.

Article 50
Letter a
Number 1
Customer due diligence is known as the term customer due diligence.
The term "customer due diligence" includes enhanced due diligence when PPE customers have high risk.
Number 2
Clearly stated.
Number 3
Clearly stated.
Number 4
Clearly stated.
Number 5
In the event that a PPE that is a stock exchange member receives an order from another PPE that is also a stock exchange member, such order may only be executed for consignment sale and/or consignment purchase as regulated by the Stock Exchange. Number 6 The Online Trading System includes, among others, online trading communication systems and applications. Number 7 Clearly stated. Letter c Number 1 Clearly stated. Number 2 Letter a) Clearly stated. Letter b) Clearly stated. Letter c) The term "single customer identity number" refers to the single investor identification number at the Securities Clearing and Guarantee Corporation (LPP). The single investor identification number is known as the term single investor identification (SID). Number 3 Clearly stated. Number 4 Letter a) Clearly stated. Letter b) Clearly stated. Letter c) Clearly stated. Letter d) Clearly stated. Letter e) Negative balance occurs if the position of the obligation to transfer funds to the customer on the settlement date is greater than the pledged fund balance and the fund balance in the customer's securities sub-account and/or customer fund account. Letter f) Clearly stated. Letter g) Clearly stated. Letter h) Clearly stated. Letter i) Clearly stated. Letter j) Clearly stated. Letter k) Clearly stated. Letter l) Certain data and documents related to the aforementioned customer include, among others:

1. Debtor reports submitted to the Financial Services Authority (OJK) through the Financial Information Services System (SLIK) as referred to in Financial Services Authority regulations regarding the funding quality of Securities Companies.
2. Data or completeness of customer-related documents, including updates, submitted to the customer identification administration service provider (LAPMN) as referred to in Financial Services Authority regulations regarding the administration of customer identification principles.
   Letter m)
   Clearly stated.
   Letter n)
   Clearly stated.
   Letter o)
   Clearly stated.
   Number 5
   Clearly stated.
   Number 6
   Clearly stated.
   Number 7
   Clearly stated.
   Number 8
   Clearly stated.
   Number 9
   Clearly stated.
   Letter d
   Number 1
   Clearly stated.
   Number 2
   Clearly stated.
   Number 3
   See the explanation of Article 42 paragraph (1) letter d.
   Letter a)
   Clearly stated.
   Letter b)
   Clearly stated.
   Letter c)
   Clearly stated.
   Letter d)
   Clearly stated.
   Letter e)
   Customer identity codes include, among others, bofis codes, client codes, or trade IDs.
   Letter f)
   Clearly stated.
   Number 4
   Clearly stated.
   Number 5
   Clearly stated.
   Letter e
   Regulatory provisions include regulations regarding guidelines for opening customer securities accounts and customer fund accounts electronically through Securities Companies conducting business as PPE. Letter f) Clearly stated. Letter g) The level of risk to be taken is known as the term risk appetite.

Article 51
Clearly stated.

Article 52
Clearly stated.

Article 53
Letter a)
Clearly stated.
Letter b)
Clearly stated.
Letter c)
Clearly stated.
Letter d)
Clearly stated.
Letter e)
Clearly stated.
Letter f)
Clearly stated.
Letter g)
Clearly stated.
Letter h)
See the explanation of Article 42 paragraph (1) letter d.
Letter i)
Clearly stated.
Letter j)
Clearly stated.
Letter k)
Clearly stated.
Letter l)
Clearly stated.
Letter m)
Clearly stated.
Letter n)
Clearly stated.
Letter o)
Clearly stated.

Article 54
Clearly stated.

Article 55
Clearly stated.

Article 56
Paragraph (1)
Clearly stated.
Paragraph (2)
Clearly stated.
Paragraph (3)
Clearly stated.
Paragraph (4)
Letter a)
The term "confidentiality" refers to confidentiality aspects in the protection of data, information, communication, and privacy electronically in accordance with regulatory provisions. Letter b) The term "integrity" refers to the legal concept regarding the integrity of electronic information. Letter c) The term "availability" refers to the legal concept regarding the availability of electronic information. Letter d) The term "authenticity" refers to the legal concept regarding authenticity, including the authenticity of the content of electronic information. Letter e) The term "non-repudiation" refers to the non-repudiation of data and information security in accordance with regulatory provisions. Letter f) The term "system, database, and application authorization control" refers to the legal concept regarding authorization based on the scope of tasks and functions within an organization and management. Letter g) The separation of duties and responsibilities includes, among others, the separation of parties performing data input and parties performing data validation. Letter h) The maintenance of audit trails includes, among others, maintaining transaction logs, providing audit trail functions to detect attempts and/or occurrences of intrusions, which must be reviewed or evaluated periodically. Paragraph (5) Letter a) The term "2 (two) factor authentication" refers to something that is a characteristic of the prospective customer (something you are) and something that the prospective customer possesses (something you have), as regulated in Financial Services Authority regulations regarding the implementation of AML, CFT, and PPPSPM programs in the financial services sector. Letter b) Clearly stated. Letter c) Clearly stated. Letter d) Clearly stated. Letter e) Clearly stated. Paragraph (6) Clearly stated.

Article 57
Paragraph (1)
Clearly stated.
Paragraph (2)
Clearly stated.
Paragraph (3)
Clearly stated.
Paragraph (4)
See the explanation of Article 14 paragraph (1) letter b number 6.
Paragraph (5)
Letter a)
Clearly stated.
Letter b)
Clearly stated.
Letter c)
Clearly stated.
Letter d)
The term "country risk" refers to all possibilities arising in a country that may cause losses affecting PPE that places electronic systems in data centers and/or disaster recovery centers in that country, including political and economic instability, disaster-prone areas, and war.

Article 58
Paragraph (1)
Letter a)
Clearly stated.
Letter b)
Clearly stated.
Letter c)
Number 1
Clearly stated.
Number 2
Clearly stated.
Number 3
Clearly stated.
Number 4
Clearly stated.
Number 5
Letter a)
Clearly stated.
Letter b)
Clearly stated.
Letter c)
Clearly stated.
Letter d)
Clearly stated.
Letter e)
Clearly stated.
Letter f)
Clearly stated.
Letter g)
Clearly stated.
Letter h)
Clearly stated.
Letter i)
Clearly stated.
Letter j)
Clearly stated.
Letter k)
Examples of assessment and evaluation:
1. assessing new policy, regulation, system, or procedure designs; and
2. improving policies, regulations, systems, or procedures based on obtained information.
Letter l)
Clearly stated.
Letter m)
Clearly stated.
Letter n)
Steps to support the creation of a compliance culture include, among others, the creation of systems, programs, frameworks, compliance charters, compliance codes of conduct, and/or compliance policies. Letter o) Examples of other tasks related to compliance functions:
1. ensuring PPE compliance with commitments made by PPE to the Financial Services Authority and/or other competent supervisory authorities;
2. socializing to all PPE employees regarding matters related to compliance functions, especially regarding applicable regulations;
and/or
3. acting as a contact person for PPE compliance issues for internal parties and external parties.
Number 6
Clearly stated.
Letter d)
Clearly stated.
Letter e)
Clearly stated.
Paragraph (2)
Clearly stated.

Article 59
Paragraph (1)
Clearly stated.
Paragraph (2)
Clearly stated.
Paragraph (3)
Letter a)
Clearly stated.
Letter b)
Significant changes affecting PPE business operations include, among others, obstacles, indications of violations, or fraud causing operational disruption and/or PPE business continuity. Letter c) The formulation and implementation of adequate audit programs include meeting independence, objectivity, and not limiting the scope and coverage of internal audit. Letter d) Clearly stated. Paragraph (4) Clearly stated.

Article 60
Clearly stated.

Article 61
Clearly stated.

Article 62
Clearly stated.

Article 63
Clearly stated.

Article 64
Clearly stated.

Article 65
Clearly stated.

Article 66
Clearly stated.

Article 67
Clearly stated.

Article 68
Clearly stated.

Article 69
Clearly stated.

Article 70
Clearly stated.

Article 71
Clearly stated.

Article 72
Clearly stated.

Article 73
Clearly stated.

Article 74
Supervision mechanisms conducted by PEE and PPE include, among others, standard operating procedures.

Article 75
Access limitation mechanisms conducted by PEE and PPE include, among others, standard operating procedures.

Article 76
Clearly stated.

Article 77
Clearly stated.

Article 78
Clearly stated.

Article 79
Business complexity includes, among others, the number of customers and transaction values.

Article 80
Clearly stated.

Article 81
Clearly stated.

Article 82
Clearly stated.

Article 83
Clearly stated.

Article 84
Letter a)
Number 1
Clearly stated.
Number 2
Clearly stated.
Number 3
Examples of outsourcing information technology functions:

1. PPE builds, develops, and operates applications and/or information technology infrastructure with the assistance of service providers, but the applications and infrastructure are owned by PPE;
2. PPE uses remote trading mediator services for applications and infrastructure, and operations are performed by service providers; and
3. PPE uses service providers using infrastructure such as cloud computing, and operations are performed by service providers.
   Number 4
   Clearly stated.
   Number 5
   Clearly stated.
   Letter b)
   Clearly stated.

Article 85
Clearly stated.

Article 86
Clearly stated.

Article 87
Clearly stated.

Article 88
Clearly stated.

Article 89
Clearly stated.

Article 90
Clearly stated.

Article 91
Clearly stated.

Article 92
Clearly stated.

Article 93
Clearly stated.

Article 94
Clearly stated.

Article 95
Receipt after receiving Securities or funds from customers in the form of printed documents and/or electronic documents.
Electronic documents include, among others, emails and/or notifications in applications.

Article 96
Clearly stated.

Article 97
Information regarding Securities includes, among others, Security prices, historical price data, and recent developments.

Article 98
Clearly stated.

Article 99
Clearly stated.

Article 100
Clearly stated.

Article 101
Clearly stated.

Article 102
Clearly stated.

Article 103
Clearly stated.

Article 104
The term "other parties representing customers" refers to parties other than directors, commissioners, and employees of the Securities Company.
Examples of other parties representing customers:
a. family; or b. friends, who are granted transaction authority by customers.

Article 105
Prohibitions on providing services without PPE and PED consent include, among others, PPE and PED employees are prohibited from becoming repo arrangers without PPE and PED consent.

Article 106
The term "social media practitioner" refers to parties actively involved in activities related to social media by managing content on various social media platforms. Examples: Instagram influencers, YouTubers, and TikTokers.

Article 107
Business license from the Financial Services Authority refers to investment advisors.
Individual licenses from the Financial Services Authority include, among others, Securities Broker Representatives.

Article 108
Clearly stated.

Article 109
Clearly stated.

Article 110
Clearly stated.

Article 111
Clearly stated.

Article 112
Expertise certificates include, among others, securities analyst certificates, risk management certificates, compliance certificates, and internal audit certificates.

Article 113
Specific actions include, among others, ordering Securities Companies to adjust customer transaction accounting.

Article 114
Clearly stated.

Article 115
Clearly stated.

Article 116
Clearly stated.

Article 117
Clearly stated.

Article 118
Clearly stated.

Article 119
Clearly stated.

Article 120
Clearly stated.

Article 121
Clearly stated.

SUPPLEMENT TO THE GAZETTE OF THE REPUBLIC OF INDONESIA NUMBER 151/OJK

APPENDIX
FINANCIAL SERVICES AUTHORITY REGULATION
REPUBLIC OF INDONESIA
NUMBER 13 YEAR 2025
REGARDING
INTERNAL CONTROL AND CONDUCT OF SECURITIES COMPANIES CONDUCTING BUSINESS AS UNDERWRITERS OF SECURITIES AND SECURITIES BROKERS

OUTSOURCING FUNCTION PLAN REPORT
Number : ...................................... ............, ..................20.....
Attachment : ......................................
Subject : Outsourcing Function Report ...........................
To
The Executive Supervisor of Capital Market, Derivatives, and Carbon Exchange Financial Services Authority in Jakarta

Hereby we submit our company's plan to outsource the function ...........................
As information, attached herewith we submit:

1. Description of the service provider receiving the outsourced function, including:
   a. Name of the service provider; b. Business field of the service provider;
   c. Service provider's capability in high standards to perform its function;
   d. Service provider's capability to fulfill its obligations in accordance with the agreement; e. Operational factors and financial capacity of the service provider qualitatively and quantitatively; f. Service provider's reputation factors; g. Coverage of insurance by the service provider (if any); h. Potential conflicts of interest, especially if the service provider operates in the same business field; and
   i. Capability and adequacy of resources owned by the service provider if it has an outsourcing function agreement with other parties involving multiple parties.

This copy is consistent with the original
Director of Legal Development
Legal Department signed
Aat Windradi
2. Description of the activities to be handed over to the service provider.
This report is submitted, thank you for your attention, Sir/Madam*) *) strike out what is not necessary Board of Directors PT
....................
.....................................
(clear name)

CHAIRMAN OF THE BOARD OF COMMISSIONERS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,
MAHENDRA SIREGAR signed