OJK Regulation No. 34 of 2025 on Information Technology Management by Rural Banks and Sharia Rural Banks

FINANCIAL SERVICES AUTHORITY REGULATION
OF THE REPUBLIC OF INDONESIA
NUMBER 34 OF 2025
CONCERNING
THE MANAGEMENT OF INFORMATION TECHNOLOGY BY RURAL BANKS AND SHARIA RURAL BANKS

BY THE GRACE OF GOD THE ALMIGHTY

THE COMMISSIONERS OF THE FINANCIAL SERVICES AUTHORITY,

Considering: a. that in order to support the business process in carrying out operational activities to improve banking services to the community, it is necessary to increase the utilization of information technology by rural banks and sharia rural banks; b. that in order to reduce potential risks related to the utilization of information technology, it is necessary to strengthen regulations regarding governance aspects, risk management, as well as cyber resilience and security in the management of information technology so that the Financial Services Authority Regulation Number 75/POJK.03/2016 concerning Standards for the Management of Information Technology for Rural Credit Banks and Sharia Rural Financing Banks needs to be replaced;
c. that based on considerations as referred to in letters a and b, it is necessary to establish a Financial Services Authority Regulation concerning the Management of Information Technology by Rural Banks and Sharia Rural Banks;

Recalling: 1. Law Number 7 of 1992 concerning Banking (State Gazette of the Republic of Indonesia Year 1992 Number 31, Supplement to the State Gazette of the Republic of Indonesia Number 3472) as amended several times, lastly with Law Number 4 of 2023 concerning Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845);
2. Law Number 21 of 2008 concerning Sharia Banking (State Gazette of the Republic of Indonesia Year 2008 Number 94, Supplement to the State Gazette of the Republic of Indonesia Number 4867) as amended several times, lastly with Law Number 4 of 2023 concerning Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845);
3. Law Number 21 of 2011 concerning the Financial Services Authority (State Gazette of the Republic of Indonesia Year 2011 Number 111, Supplement to the State Gazette of the Republic of Indonesia Number 5253) as amended with Law Number 4 of 2023 concerning Development and Strengthening of the Financial Sector (State Gazette of the Republic of Indonesia Year 2023 Number 4, Supplement to the State Gazette of the Republic of Indonesia Number 6845);

DECIDES:
Establishes: A FINANCIAL SERVICES AUTHORITY REGULATION CONCERNING THE MANAGEMENT OF INFORMATION TECHNOLOGY BY RURAL BANKS AND SHARIA RURAL BANKS.

CHAPTER I
GENERAL PROVISIONS

Article 1
In this Financial Services Authority Regulation, the following terms are defined:

1. Rural Bank which hereinafter shall be abbreviated as BPR is a type of conventional bank that does not provide payment services directly in its activities.
2. Sharia Rural Bank which hereinafter shall be called BPR Syariah is a type of sharia bank that does not provide payment services directly in its activities.
3. Information Technology which hereinafter shall be abbreviated as IT is a technique to collect, prepare, store, process, announce, analyze, and/or disseminate information.
4. Electronic System is a series of electronic devices and procedures that function to prepare, collect, process, analyze, store, display, announce, send, and/or disseminate electronic information.
5. Core Banking Application is an Electronic System in the form of an application for the final processing of all banking transactions that occur throughout the day, including data entry in the accounting books of BPR or BPR Syariah, which at least covers customer functions, deposits, loans, accounting, and reporting.
6. Data Center is a facility used to place Electronic Systems and their related components for the purpose of placement, storage, and data processing.
7. Disaster Recovery Center is a facility used to restore data or information and important functions of Electronic Systems that are disturbed or damaged due to disasters caused by nature or humans.
8. Disaster Recovery Plan is a document containing plans and steps to replace and/or restore access to data, hardware, and software required, so that BPR or BPR Syariah can carry out critical business operational activities after disturbances and/or disasters.
9. Board of Directors is the board of directors for BPR or BPR Syariah in the form of a limited liability company, regional public enterprise, regional joint-stock company, regional enterprise, or management for BPR or BPR Syariah in the form of a cooperative legal entity.
10. Board of Commissioners is the board of commissioners for BPR or BPR Syariah in the form of a limited liability company, commissioner for BPR or BPR Syariah in the form of a regional joint-stock company legal entity, supervisory board for BPR in the form of a regional public enterprise and regional enterprise legal entity, and supervisor for BPR or BPR Syariah in the form of a cooperative legal entity.

CHAPTER II
IT GOVERNANCE OF BPR AND BPR SYARIAH

First Section
Implementation of IT Governance for BPR and BPR Syariah

Article 2
(1) BPR and BPR Syariah must implement good IT governance in the management of IT.
(2) In implementing good IT governance as referred to in paragraph (1), BPR and BPR Syariah consider at least factors:
a. the business strategy and objectives of BPR and BPR Syariah; b. the scale of business and complexity of BPR and BPR Syariah business;
c. the role of IT for BPR and BPR Syariah;
d. methods for procuring IT resources; e. risks and problems related to IT; f. practices or standards applicable nationally or internationally; and g. provisions of legislation. (3) In implementing good IT governance as referred to in paragraph (1), BPR and BPR Syariah carry out at least activities:
a. planning and execution of activities supporting IT management activities; b. optimal implementation of IT management to be integrated into the business processes of BPR and BPR Syariah; and
c. provision of IT operational support to all IT service users.

Article 3
BPR and BPR Syariah must determine clear authority and responsibility for:
a. Board of Directors; b. Board of Commissioners; and
c. executive officials or employees handling IT management,
regarding the implementation of IT governance.

Article 4
The authority and responsibility of the Board of Directors as referred to in Article 3 letter a includes at least:
a. determining the IT development plan and IT procurement for BPR and BPR Syariah; b. determining policies and procedures related to IT management that are adequate and communicating them effectively, both to the managing unit and IT users;
c. monitoring the adequacy of IT management performance and improvement efforts; and
d. ensuring that:

1. IT used supports business development, achievement of business objectives, and continuity of service to customers of BPR and BPR Syariah;
2. adequate resources related to IT management are available to support BPR and BPR Syariah business effectively and efficiently;
3. an effective information security management system is available and communicated to the managing unit and IT users; and
4. IT management policies and procedures are implemented effectively.

Article 5
The authority and responsibility of the Board of Commissioners as referred to in Article 3 letter b includes at least:
a. directing and monitoring fundamental IT development plans and IT procurement for BPR and BPR Syariah; b. evaluating the accountability of the Board of Directors related to IT management of BPR and BPR Syariah; and
c. directing and monitoring the implementation of IT governance for BPR and BPR Syariah.

Article 6
(1) BPR and BPR Syariah must have and implement IT management policies and procedures.
(2) The IT management policies and procedures as referred to in paragraph (1) include at least:
a. authority and responsibility of the Board of Directors, Board of Commissioners, and units or employees responsible for IT management; b. development and procurement;
c. IT operations;
d. communication networks; e. information security; f. Disaster Recovery Plan; g. IT internal audit; and h. use of third-party IT service providers.
(3) BPR and BPR Syariah must periodically review and update policies and procedures as referred to in paragraph (1).

Second Section
Managing Units and Functions of IT Management

Article 7
(1) BPR and BPR Syariah must appoint a unit or function responsible for IT management.
(2) The unit or function responsible for IT management as referred to in paragraph (1) is placed in the operational function according to the Financial Services Authority Regulation regarding governance for BPR and BPR Syariah. (3) IT management as referred to in paragraph (1) consists of at least activities:
a. planning IT infrastructure needs; b. drafting or developing IT;
c. operating IT; and
d. monitoring IT management activities.
(4) BPR and BPR Syariah that provide digital services must have an IT management unit led by an executive official.
(5) The IT management unit of BPR and BPR Syariah as referred to in paragraph (1) and paragraph (4) is adjusted to the scale of business and IT complexity of BPR and BPR Syariah. (6) The unit or function responsible for IT management as referred to in paragraph (1) must be independent from fundraising activities, fund disbursement, accounting, compliance, and/or internal audit.

Article 8
Provisions regarding the implementation of IT governance for BPR and BPR Syariah are determined by the Financial Services Authority.

Article 9
(1) BPR or BPR Syariah violating provisions as referred to in Article 2 paragraph (1), Article 3, Article 6 paragraph (1), paragraph (3), Article 7 paragraph (1), and/or paragraph (4) shall be subject to administrative sanctions in the form of written reprimands. (2) In the event that BPR or BPR Syariah has been subjected to administrative sanctions as referred to in paragraph (1) and has not yet fulfilled the provisions as referred to in Article 2 paragraph (1), Article 3, Article 6 paragraph (1), paragraph (3), Article 7 paragraph (1), and/or paragraph (4), BPR or BPR Syariah shall be subject to administrative sanctions in the form of:
a. temporary suspension of some operational activities of BPR or BPR Syariah; b. prohibition on expanding business activities; and/or
c. downgrade of health level.

CHAPTER III
IT ARCHITECTURE OF BPR AND BPR SYARIAH

Article 10
(1) BPR and BPR Syariah that provide digital services must have IT architecture.
(2) BPR and BPR Syariah in compiling IT architecture as referred to in paragraph (1) consider the business plan of BPR and BPR Syariah.
(3) BPR and BPR Syariah must update IT architecture in accordance with the procedures and policies of BPR and BPR Syariah.
(4) IT architecture and changes to IT architecture that have been updated are approved by the Board of Directors of BPR and BPR Syariah.

Article 11
IT architecture as referred to in Article 10 can be compiled by BPR and BPR Syariah independently and/or in cooperation with third parties.

Article 12
Provisions regarding the compilation of IT architecture for BPR and BPR Syariah are determined by the Financial Services Authority.

Article 13
(1) BPR or BPR Syariah violating provisions as referred to in Article 10 paragraph (1) and/or paragraph (3) shall be subject to administrative sanctions in the form of written reprimands. (2) In the event that BPR or BPR Syariah has been subjected to administrative sanctions as referred to in paragraph (1) and has not yet fulfilled the provisions as referred to in Article 10 paragraph (1) and/or paragraph (3), BPR or BPR Syariah shall be subject to administrative sanctions in the form of:
a. temporary suspension of some operational activities of BPR or BPR Syariah; b. prohibition on expanding business activities; and/or
c. downgrade of health level.

CHAPTER IV
IMPLEMENTATION OF IT MANAGEMENT RISK MANAGEMENT FOR BPR AND BPR SYARIAH

First Section
General

Article 14
(1) BPR and BPR Syariah must implement risk management effectively in IT management.
(2) In implementing risk management as referred to in paragraph (1), BPR and BPR Syariah carry out at least processes:
a. risk identification; b. risk measurement;
c. risk monitoring; and
d. risk control.
(3) BPR and BPR Syariah must ensure the adequacy of the risk management information system in IT management.

Second Section
Information Security in IT Management of BPR and BPR Syariah

Article 15
(1) BPR and BPR Syariah must ensure that information security is carried out effectively and efficiently by applying the principles of confidentiality, integrity, and availability. (2) Information security as referred to in paragraph (1) is carried out against human resource, process, technology, and physical or environmental aspects, in the comprehensive management of IT. (3) BPR and BPR Syariah must perform authorization controls in IT management.

Article 16
(1) BPR and BPR Syariah must have a Disaster Recovery Plan.
(2) BPR and BPR Syariah must ensure that the Disaster Recovery Plan as referred to in paragraph (1) can be implemented effectively so that BPR and BPR Syariah operations continue during disturbances and/or disasters to the IT facilities used. (3) BPR and BPR Syariah must conduct tests on the Disaster Recovery Plan for all critical applications and infrastructure according to the results of the business impact analysis, at least:
a. 1 (one) time within a period of 2 (two) years, for BPR and BPR Syariah that provide digital services; or b. 1 (one) time within a period of 3 (three) years, for BPR and BPR Syariah other than those referred to in letter a, with the involvement of IT users. (4) BPR and BPR Syariah must review the Disaster Recovery Plan, at least:
a. 1 (one) time within a period of 2 (two) years, for BPR and BPR Syariah that provide digital services; or b. 1 (one) time within a period of 3 (three) years for BPR and BPR Syariah other than those referred to in letter a, considering the results of the test as referred to in paragraph (3).

Article 17
(1) BPR and BPR Syariah that:
a. have core capital of at least Rp50,000,000,000.00 (fifty billion rupiah); and/or b. provide digital services, must provide a Disaster Recovery Center.
(2) The Disaster Recovery Center as referred to in paragraph (1) can be owned by BPR and BPR Syariah independently and/or in cooperation with an IT service provider.

Article 18
(1) BPR and BPR Syariah must ensure:
a. the availability of Core Banking Applications; and b. data backup, in managing IT independently and/or in cooperation with third-party IT service providers. (2) BPR and BPR Syariah must ensure that data backup as referred to in paragraph (1) letter b is carried out every end of day for all data activities of BPR or BPR Syariah. (3) BPR and BPR Syariah must store activity data as referred to in paragraph (2) for a period in accordance with the provisions of legislation.

Article 19
In the context of IT management, BPR and BPR Syariah must record all transactions in the accounting books of BPR and BPR Syariah on the same end of day.

Third Section
Prohibitions in IT Management of BPR and BPR Syariah

Article 20
BPR and BPR Syariah are prohibited from carrying out IT service provision activities to third parties, except related to products and services provided by BPR and BPR Syariah.

Article 21
Provisions regarding the implementation of risk management in IT management for BPR and BPR Syariah are determined by the Financial Services Authority.

Article 22
(1) BPR or BPR Syariah violating provisions as referred to in Article 14 paragraph (1), paragraph (3), Article 15 paragraph (1), paragraph (3), Article 16, Article 17 paragraph (1), Article 18, Article 19, and/or Article 20 shall be subject to administrative sanctions in the form of written reprimands. (2) In the event that BPR or BPR Syariah has been subjected to administrative sanctions as referred to in paragraph (1) and has not yet fulfilled the provisions as referred to in Article 14 paragraph (1), paragraph (3), Article 15 paragraph (1), paragraph (3), Article 16, Article 17 paragraph (1), Article 18, Article 19, and/or Article 20, BPR or BPR Syariah shall be subject to administrative sanctions in the form of:
a. temporary suspension of some operational activities of BPR or BPR Syariah; b. prohibition on expanding business activities; and/or
c. downgrade of health level.

CHAPTER V
CYBER RESILIENCE AND SECURITY

Article 23
(1) BPR and BPR Syariah must maintain cyber resilience and security.
(2) To maintain cyber resilience and security as referred to in paragraph (1), BPR and BPR Syariah carry out at least processes:
a. identification of assets, threats, and vulnerabilities; b. asset protection;
c. detection of cyber incidents; and
d. handling and recovery of cyber incidents.
(3) BPR and BPR Syariah ensure that the process to maintain cyber resilience and security as referred to in paragraph (2) is supported by adequate information systems.

Article 24
(1) BPR and BPR Syariah conduct annual cybersecurity maturity assessments for the position at the end of December.
(2) BPR and BPR Syariah document the results of the cybersecurity maturity assessment as referred to in paragraph (1).
(3) The OJK may at any time request the results of the cybersecurity maturity assessment as referred to in paragraph (1).

Article 25
Provisions regarding cyber resilience and security as well as cybersecurity maturity assessment for BPR and BPR Syariah are determined by the Financial Services Authority.

Article 26
(1) BPR or BPR Syariah violating provisions as referred to in Article 23 paragraph (1) shall be subject to administrative sanctions in the form of written reprimands. (2) In the event that BPR or BPR Syariah has been subjected to administrative sanctions as referred to in paragraph (1) and has not yet fulfilled the provisions as referred to in Article 23 paragraph (1), BPR or BPR Syariah shall be subject to administrative sanctions in the form of:
a. temporary suspension of some operational activities of BPR or BPR Syariah; b. prohibition on expanding business activities; and/or
c. downgrade of health level.

CHAPTER VI
USE OF THIRD-PARTY IT SERVICE PROVIDERS IN IT MANAGEMENT OF BPR AND BPR SYARIAH

Article 27
(1) BPR and BPR Syariah may use third-party IT service providers in IT management.
(2) In the use of third-party IT service providers as referred to in paragraph (1), BPR and BPR Syariah must:
a. be responsible for IT management; b. have the ability to supervise and conduct supervision over the IT management of BPR and BPR Syariah carried out by third-party IT service providers;
c. monitor the reputation of third-party IT service providers and the continuity of service provision to BPR and BPR Syariah;
d. select third-party IT service providers based on cost-benefit analysis, involving units or employees responsible for IT management; e. conduct selection processes and conduct transactions with IT service providers by paying attention to the principle of prudence, risk management, and based on an arm's length working relationship, including when the IT service provider is a related party to BPR and BPR Syariah; f. provide access to the Financial Services Authority to the database of BPR and BPR Syariah in a timely manner, both for current data and past data; g. ensure that the third-party IT service provider:

1. has adequate qualifications and competencies of human resources;
2. applies adequate IT control principles;
3. provides data and information required in a timely manner whenever needed by BPR or BPR Syariah, the Financial Services Authority, and/or other parties according to their authority in the provisions of legislation;
4. states no objection if the Financial Services Authority and/or other competent parties according to the provisions of legislation conduct examinations of the service provision activities provided;
5. maintains the confidentiality and security of all data and/or information including customer personal data;
6. informs BPR or BPR Syariah of every critical incident that could cause financial losses and/or disrupt the operational continuity of BPR or BPR Syariah;
7. provides a tested and adequate Disaster Recovery Plan;
8. has a mechanism for terminating the cooperation (exit clause) between BPR or BPR Syariah and the third-party IT service provider;
9. has obtained approval from BPR or BPR Syariah proven by written documents, in the event that the IT service provider outsources part of the activities or subcontracts;
10. is willing to agree to the possibility of terminating the cooperation agreement before the end of the agreement period (early termination) in the event that the cooperation agreement causes or is indicated to cause difficulties in the implementation of the Financial Services Authority's supervision duties; and
11. meets the service level in accordance with the service level agreement between BPR or BPR Syariah and the third-party IT service provider.
    (3) BPR and BPR Syariah in using third-party IT service providers as referred to in paragraph (1) must be based on a cooperation agreement containing at least:
    a. scope of work or services in IT management; b. rights and obligations of BPR or BPR Syariah and the third-party IT service provider; and
    c. main points of the cooperation agreement, including provisions as referred to in paragraph (2) letter g.
    (4) For BPR Syariah, the use of third-party IT service providers in IT management must be accompanied by the opinion of the Sharia Supervisory Board and/or the results of the Sharia compliance function review in the event there are Sharia principles that must be fulfilled. (5) BPR and BPR Syariah must ensure that the IT service provider as referred to in paragraph (1) is a legal entity located within the territory of Indonesia.

Article 28
(1) In the event that certain conditions cause disturbance or cessation of IT service provision from third-party IT service providers to BPR and BPR Syariah, BPR and BPR Syariah must take at least actions:
a. report to the Financial Services Authority within a maximum period of 3 (three) working days after the certain condition is known by BPR and BPR Syariah; b. decide on the follow-up action to be taken to overcome the problem, including termination of the use of third-party IT service providers if necessary; and
c. report to the Financial Services Authority within a maximum period of 10 (ten) working days after BPR and BPR Syariah stops using the third-party IT service provider before the end of the agreement period, in the event that BPR and BPR Syariah decides to stop using the third-party IT service provider.
(2) Certain conditions as referred to in paragraph (1) include:
a. worsening of IT management performance by the third-party IT service provider that has the potential to cause and/or

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 65,047-character original (37% of the document). The remainder was not translated. The complete original-language text is stored with this document.]