FINANCIAL SERVICES AUTHORITY REGULATION

NUMBER 9 /POJK.03/2016

CONCERNING

PRUDENTIAL PRINCIPLES FOR GENERAL BANKS THAT OUTSOURCE PART OF THEIR WORK TO THIRD PARTIES

BY THE GRACE OF THE ALMIGHTY GOD,

THE COMMISSIONERS COUNCIL OF THE FINANCIAL SERVICES AUTHORITY,

Considering:
a. that with the further development of the business world and the tight level of competition, bank business activities have become increasingly complex and diverse; b. that in order to focus more on its main work in carrying out its intermediary function and in accordance with legislation, banks may outsource part of their work to third parties;
c. that the outsourcing of part of work to third parties has the potential to increase risks for banks;
d. that based on considerations as referred to in letters a, b, and c, it is deemed necessary to establish a Financial Services Authority Regulation on Prudential Principles for General Banks That Outsource Part of Their Work to Third Parties;

THE FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA
COPY

Considering:

1. Law Number 7 of 1992 concerning Banking (State Gazette of the Republic of Indonesia Year 1992 Number 31, Supplement to the State Gazette of the Republic of Indonesia Number 3472) as amended by Law Number 10 of 1998 (State Gazette of the Republic of Indonesia Year 1998 Number 182, Supplement to the State Gazette of the Republic of Indonesia Number 3790);
2. Law Number 21 of 2008 concerning Sharia Banking (State Gazette of the Republic of Indonesia Year 2008 Number 94, Supplement to the State Gazette of the Republic of Indonesia Number 4867);
3. Law Number 21 of 2011 concerning the Financial Services Authority (State Gazette of the Republic of Indonesia Year 2011 Number 111, Supplement to the State Gazette of the Republic of Indonesia Number 5253);

DECIDING:
Establishing: FINANCIAL SERVICES AUTHABILITY REGULATION CONCERNING PRUDENTIAL PRINCIPLES FOR GENERAL BANKS THAT OUTSOURCE PART OF THEIR WORK TO THIRD PARTIES.

CHAPTER I

GENERAL PROVISIONS

Article 1

In this Financial Services Authority Regulation, the following terms are meant:

1. Bank is a general bank that conducts business activities conventionally as referred to in Law Number 7 of 1992 concerning Banking as amended by Law Number 10 of 1998, including branch offices of banks located abroad, as well as general Sharia banks and Sharia business units as referred to in Law Number 21 of 2008 concerning Sharia Banking.

2. Outsourcing of Part of Work to Third Parties, hereinafter referred to as Outsourcing, is the outsourcing of part of work to service provider companies through a work contracting agreement and/or through a labor supply service agreement.

3. Service Provider Company is a company that carries out part of the work outsourced by the Bank through a work contracting agreement and/or through a labor supply service agreement.

4. Board of Directors:
   a. for Banks in the form of a Limited Liability Company (Perseroan Terbatas) is the Board of Directors as referred to in Law Number 40 of 2007 concerning Limited Liability Companies; b. for Banks in the form of legal entities:
   1) Regional Public Enterprises or Regional Holding Companies is the Board of Directors as referred to in Law Number 23 of 2014 concerning Regional Government as last amended by Law Number 9 of 2015;
   2) Regional Enterprises is the Board of Directors in Banks that have not yet changed form into Regional Public Enterprises or Regional Holding Companies according to Law Number 23 of 2014 concerning Regional Government as last amended by Law Number 9 of 2015;
   c. for Banks in the form of a Cooperative legal entity is the management as referred to in Law Number 25 of 1992 concerning Cooperatives;
   d. for Banks with the status of branch offices of banks located abroad is the branch office leader and officials one level below the branch office leader.

5. Board of Commissioners:
   a. for Banks in the form of a Limited Liability Company (Perseroan Terbatas) is the Board of Commissioners as referred to in Law Number 40 of 2007 concerning Limited Liability Companies; b. for Banks in the form of legal entities:
   1) Regional Public Enterprises is the Supervisory Board as referred to in Law Number 23 of 2014 concerning Regional Government as last amended by Law Number 9 of 2015;
   2) Regional Holding Companies is the Commissioners as referred to in Law Number 23 of 2014 concerning Regional Government as last amended by Law Number 9 of 2015;
   3) Regional Enterprises is the Supervisors in Banks that have not yet changed form into Regional Public Enterprises or Regional Holding Companies according to Law Number 23 of 2014 concerning Regional Government as last amended by Law Number 9 of 2015;
   c. for Banks in the form of a Cooperative legal entity is the Supervisors as referred to in Law Number 25 of 1992 concerning Cooperatives;
   d. for Banks with the status of branch offices of banks located abroad is the party appointed to carry out supervisory functions.

Article 2

(1) Banks may conduct Outsourcing to Service Provider Companies.
(2) In conducting Outsourcing, Banks are required to apply prudential principles and risk management.

CHAPTER II

OUTSOURCING

Article 3

(1) Outsourcing as referred to in Article 2 paragraph (1) is conducted by Banks through agreements:
a. work contracting; and/or b. labor supply services.
(2) Banks are required to ensure that the outsourced work is carried out in accordance with the agreement made and legislation.
(3) Banks remain responsible for the work outsourced to Service Provider Companies.

Article 4

(1) In the context of Outsourcing, Bank activities are categorized as:
a. business activities; and b. support activities.
(2) In each business activity and support activity as referred to in paragraph (1) consists of a series of core work and supporting work.
(3) Banks may only conduct Outsourcing for supporting work in the Bank's business activity flow and in the Bank's support activity flow.

Article 5

(1) Supporting work as referred to in Article 4 paragraph (3) must at least meet the criteria:
a. low risk; b. does not require high competency qualifications in the banking field; and
c. not directly related to the decision-making process that affects Bank operations.
(2) The criteria as referred to in paragraph (1) must be elaborated in the Bank's policy regarding Outsourcing.
(3) Banks are prohibited from conducting Outsourcing that results in the transfer of responsibility or risk from the object of the outsourced work to the Service Provider Company.

Article 6

Banks may only conduct Outsourcing agreements with Service Provider Companies that meet at least the following requirements:
a. being an Indonesian legal entity; b. having a valid business license from the competent authority according to their business field;
c. having good financial performance and reputation as well as sufficient experience;
d. having human resources that support the execution of outsourced work; and e. having the facilities and infrastructure needed in Outsourcing.

CHAPTER III

APPLICATION OF PRUDENTIAL PRINCIPLES AND RISK MANAGEMENT

First Section

Selection of Service Provider Companies

Article 7

To ensure the fulfillment of requirements in the selection of Service Provider Companies, Banks are required to:
a. examine documents as referred to in Article 6 letters a and b; and b. conduct analysis and assessment of aspects as referred to in Article 6 letters c, d, and e, namely regarding:
1. good financial performance and reputation as well as sufficient experience;
2. human resources that support the execution of outsourced work; and
3. facilities and infrastructure needed in Outsourcing.

Article 8

The results of examination, analysis, and assessment as referred to in Article 7 must be prepared in writing and documented properly.

Article 9

(1) Banks are required to monitor and evaluate the fulfillment of Service Provider Company requirements periodically, at least 1 (one) time in 1 (one) year or whenever there are changes in performance and/or reputation of the Service Provider Company. (2) The results of monitoring and evaluation as referred to in paragraph (1) must be prepared in writing and documented properly.

Second Section

Outsourcing Agreements

Article 10

(1) In conducting Outsourcing, Banks are required to make written agreements with Service Provider Companies.
(2) Outsourcing agreements as referred to in paragraph (1) must at least cover:
a. scope of work; b. agreement duration;
c. contract value;
d. cost structure and payment mechanism; e. rights, obligations, and responsibilities of the Bank or Service Provider Company, including:
1. the Bank's authority to conduct evaluation and examination of the Service Provider Company regarding the execution of the Outsourcing agreement;
2. the obligation of the Service Provider Company, including labor used in Outsourcing, to maintain the confidentiality and security of the Bank's and/or Bank customers' information;
3. the obligation of the Service Provider Company to submit reports and information to the Bank in writing and periodically;
4. the obligation of each party to comply with legislation provisions;
5. the obligation of the parties to protect the rights and interests of Bank customers related to outsourced work;
6. the obligation of the Service Provider Company to have a contingency plan; and
7. the willingness of the Service Provider Company to provide examination access to the Financial Services Authority and/or other competent authorities together with the Bank when necessary;
f. size and standards of work execution; g. criteria or conditions for terminating the agreement before the end of the agreement duration (early termination); h. sanctions and penalties; and
i. dispute resolution.

Third Section

Application of Risk Management

Article 11

(1) Banks are required to apply risk management effectively in conducting Outsourcing according to the scale, characteristics, and complexity of the outsourced work. (2) The application of risk management as referred to in paragraph (1) must at least cover:
a. active supervision by the Board of Directors and Board of Commissioners; b. adequacy of policies and procedures;
c. adequacy of risk identification, measurement, monitoring, and control processes as well as risk management information systems; and
d. internal control systems.

Article 12

Active supervision by the Board of Directors must at least cover:
a. formulating and refining Outsourcing policies; b. establishing Outsourcing procedures;
c. approving the Bank's plan to conduct Outsourcing;
d. monitoring, evaluating, and being responsible for the application of risk management regarding Outsourcing; and e. monitoring and evaluating the overall execution of Outsourcing.

Article 13

Active supervision by the Board of Commissioners must at least cover:
a. approving and evaluating Outsourcing policies including refinements to Outsourcing policies; and b. evaluating the Board of Directors' accountability regarding the application of risk management regarding Outsourcing.

Article 14

(1) Banks are required to have and apply written policies and procedures regarding Outsourcing.
(2) Policies and procedures as referred to in paragraph (1) must at least cover:
a. the purpose of Outsourcing; b. criteria for outsourced work;
c. scope of analysis;
d. risk mitigation policies in the execution of Outsourcing; e. Service Provider Company criteria; f. minimum scope of Outsourcing agreements; g. standard procedures in conducting Outsourcing; and h. the designation of a special unit or function that carries out the Outsourcing process as well as the clarity of duties and responsibilities. (3) Policies and procedures as referred to in paragraph (1) must be reviewed periodically or whenever necessary.

Article 15

(1) Banks are required to conduct identification, measurement, monitoring, and control of all risks that may arise from the execution of Outsourcing.
(2) The execution of identification, measurement, monitoring, and control of risks as referred to in paragraph (1) must be supported by appropriate management information systems that are timely and can provide accurate and informative reports regarding risks in the execution of Outsourcing.

Article 16

(1) Banks are required to implement effective internal control systems over Outsourcing.
(2) Effective internal control systems as referred to in paragraph (1) include among others:
a. supervision of the Outsourcing process; and b. supervision of work execution by Service Provider Companies.
(3) Supervision of the Outsourcing process as referred to in paragraph (2) letter a must be conducted by parties independent of the parties conducting the Outsourcing process.

CHAPTER IV

REPORTING

Article 17

(1) Banks are required to submit reports regarding Outsourcing to the Financial Services Authority completely, correctly, and on time.
(2) Reports as referred to in paragraph (1) cover:
a. Outsourcing plans; and b. problematic Outsourcing.
(3) Reports on Outsourcing plans as referred to in paragraph (2) letter a contain at least information regarding:
a. types of outsourced work; b. general description and scope of work;
c. types of Outsourcing agreements;
d. estimated number of outsourced labor needed; e. agreement duration; f. purpose of Outsourcing; and g. analysis of estimated costs and benefits as well as risks and mitigations. (4) Reports on problematic Outsourcing as referred to in paragraph (2) letter b contain at least information regarding:
a. types of outsourced work; b. name of the Service Provider Company;
c. description of problems occurring; and
d. steps taken by the Bank to overcome problematic Outsourcing.
(5) Reports on Outsourcing plans as referred to in paragraph (2) letter a must be submitted annually at the latest by December 31.
(6) Banks may only add and/or change plans for outsourced work that have already been reported to the Financial Services Authority as referred to in paragraph (5) at most 1 (one) time and must submit the Report on Changes to Outsourcing Plans at the latest by June 30 of the current year. (7) In the event that the deadline for submitting reports as referred to in paragraph (5) and paragraph (6) falls on a Saturday, Sunday, or holiday, the report is submitted on the next working day. (8) Reports on problematic Outsourcing as referred to in paragraph (2) letter b must be submitted at the latest 7 (seven) working days after the Bank becomes aware of the problem.

Article 18

Reports as referred to in Article 17 paragraph (2) and paragraph (6) are submitted to the Financial Services Authority at the following addresses:
a. Related Bank Supervision Department, Sharia Banking Department, or Regional Office 1 Jabodetabek, Banten, Lampung, and Kalimantan, for Banks with headquarters or branch offices of banks located abroad in the Jakarta, Bogor, Depok, Tangerang, and Bekasi (Jabodetabek) area, and Banten Province; or b. Regional Office of the Financial Services Authority or local Financial Services Authority Office for Banks with headquarters outside the Jakarta, Bogor, Depok, Tangerang, and Bekasi (Jabodetabek) area, and Banten Province.

CHAPTER V

SANCTIONS

Article 19

(1) Banks that submit reports as referred to in Article 17 paragraph (2) and/or Article 17 paragraph (6) exceeding the submission deadline as referred to in Article 17 paragraph (5), Article 17 paragraph (6), or Article 17 paragraph (8) are subject to:
a. administrative sanctions in the form of fines of IDR 1,000,000.00 (one million rupiah) per working day of delay if delayed 1 (one) working day up to 10 (ten) working days; b. administrative sanctions in the form of fines as in letter a plus additional administrative sanctions in the form of fines of IDR 1,500,000.00 (one million five hundred thousand rupiah) per working day of delay if delayed 11 (eleven) working days up to 20 (twenty) working days;
c. administrative sanctions in the form of fines as in letters a and b plus additional administrative sanctions in the form of fines of IDR 2,000,000.00 (two million rupiah) per working day of delay, with the maximum total delay sanctions amounting to IDR 100,000,000.00 (one hundred million rupiah) if delayed 21 (twenty-one) working days or more.
(2) Banks known by the Financial Services Authority to have conducted Outsourcing but have not submitted reports on Outsourcing plans as referred to in Article 17 paragraph (2) letter a and/or additions or changes to Outsourcing plans as referred to in Article 17 paragraph (6) are subject to administrative sanctions in the form of fines of IDR 125,000,000.00 (one hundred twenty-five million rupiah).

Article 20

Banks that do not implement provisions as established in Article 2 paragraph (2), Article 3 paragraph (2), Article 4 paragraph (3), Article 5 paragraph (3), Article 6, Article 7, Article 8, Article 9, Article 10 paragraph (1), Article 11 paragraph (1), Article 14 paragraph (1), Article 15, Article 16 paragraph (1), Article 16 paragraph (3), or Article 17 paragraph (1) of this Financial Services Authority Regulation and other related implementation provisions are subject to administrative sanctions including:
a. written warnings; b. reduction of the Bank's health level; and/or
c. suspension of certain business activities.

CHAPTER VI

TRANSITIONAL PROVISIONS

Article 21

(1) Banks that before December 9, 2011 had conducted Outsourcing for work permitted based on this Financial Services Authority Regulation but where the Service Provider Companies and/or scope of Outsourcing agreements did not yet meet the provisions as referred to in Article 6 and/or Article 10 paragraph (2) may continue the execution of Outsourcing until the end of the agreement. (2) In the event that Banks extend the Outsourcing agreements as referred to in paragraph (1), Banks are required to:
a. conduct examination, analysis, and assessment of the fulfillment of Service Provider Company requirements as referred to in Article 6; and/or b. adjust agreements according to Article 10 paragraph (2).

CHAPTER VII

OTHER PROVISIONS

Article 22

(1) Outsourcing conducted by Banks, in addition to being subject to this Financial Services Authority Regulation, is also subject to other provisions related to Outsourcing. (2) Legal entity requirements for Service Provider Companies providing services for the implementation of information technology still refer to provisions regarding the application of risk management in the use of information technology by Banks.

Article 23

The Financial Services Authority has the authority to stop Outsourcing conducted by Banks if, in the Financial Services Authority's assessment, the Outsourcing has the potential to endanger the continuity of the Bank's business.

CHAPTER VIII

CLOSING PROVISIONS

Article 24

Further provisions of this Financial Services Authority Regulation are regulated in a Circular Letter of the Financial Services Authority.

Article 25

(1) At the time this Financial Services Authority Regulation takes effect, Bank Indonesia Regulation Number 13/25/PBI/2011 dated December 9, 2011 concerning Prudential Principles for General Banks That Outsource Part of Their Work to Third Parties (State Gazette of the Republic of Indonesia Year 2011 Number 131, Supplement to the State Gazette of the Republic of Indonesia Number 5263) is repealed and declared invalid. (2) Implementation regulations of Bank Indonesia Regulation Number 13/25/PBI/2011 dated December 9, 2011 concerning Prudential Principles for General Banks That Outsource Part of Their Work to Third Parties remain valid as long as they do not conflict with provisions in this Financial Services Authority Regulation.

Article 26

This Financial Services Authority Regulation takes effect on the date of enactment.

To be known by everyone, ordering the enactment of this Financial Services Authority Regulation by placing it in the State Gazette of the Republic of Indonesia.

Established in Jakarta on December 26, 2016

CHAIRMAN OF THE COMMISSIONERS COUNCIL
FINANCIAL SERVICES AUTHORITY, signed
MULIAMAN D. HADAD

Enacted in Jakarta on January 27, 2016

MINISTER OF LAW AND HUMAN RIGHTS
REPUBLIC OF INDONESIA, signed
YASONNA H. LAOLY

STATE GAZETTE OF THE REPUBLIC OF INDONESIA YEAR 2016 NUMBER 21 Copy matches the original Legal Director 1 Legal Department signed Yuliana

EXPLANATION

OF
FINANCIAL SERVICES AUTHORITY REGULATION
NUMBER 9 /POJK.03/2016
CONCERNING
PRUDENTIAL PRINCIPLES FOR GENERAL BANKS THAT OUTSOURCE PART OF THEIR WORK TO THIRD PARTIES

I. GENERAL

The further development of the business world and the tight level of competition drive the increasingly complex and diverse activities of Banks. This causes Banks to be required to concentrate on their main work and carry out their function as an intermediary institution.

One of the efforts made by Banks to focus more on their main work is by outsourcing part of the supporting work to third parties so that Bank resources can be deployed to core work. The outsourcing of part of work to third parties is also in accordance with legislation.

On the other hand, the outsourcing of part of work to third parties has the potential to increase the risks faced by Banks, so the outsourcing of part of work must be carried out by applying adequate prudential principles and risk management. In addition, the clarity of the Bank's responsibility for work entrusted to third parties and the aspect of customer protection are very important matters to consider.

Strengthening the application of prudential principles and risk management in the outsourcing of part of work to third parties, accompanied by the protection of customer interests, is expected to maintain the integrity of the banking system in particular and the financial system as a whole.

II. ARTICLE BY ARTICLE

Article 1

Clear enough.

Article 2

Paragraph (1)
Bank Outsourcing includes Outsourcing conducted by Sharia business units in general banks that conduct business activities conventionally.

Paragraph (2)
Clear enough.

Article 3

Paragraph (1)
Letter a
This provision does not regulate work contracting where the final result is goods or what is generally known as procurement of goods, such as the procurement of deposit slips, savings books, office inventory, office building construction, and Automated Teller Machines (ATM).

Letter b
Clear enough.

Paragraph (2)
Clear enough.

Paragraph (3)
The execution of Outsourcing does not eliminate the Bank's responsibility for the consequences of actions taken by Service Provider Companies in carrying out work.

transferred, including if there are actions that harm Bank customers.

Article 4
Paragraph (1)
Letter a
The term "business activities" refers to business activities as referred to in Article 6 and Article 7 of Law Number 7 of 1992 concerning Banking as amended by Law Number 10 of 1998, as well as Article 19 and Article 20 of Law Number 21 of 2008 concerning Sharia Banking. Included in business activities are, among others, gathering funds from the public (funding), granting credit or financing (lending or financing), as well as buying, selling, or guaranteeing risks on one's own behalf or for the interest and upon the order of customers.

Letter b
The term "supporting business activities" refers to other activities conducted by the Bank outside of the Bank's business activities. Included in supporting business activities are, among others, activities related to human resources, risk management, compliance, internal audit, accounting and finance, information technology, logistics, and security.

Paragraph (2)
The term "core tasks" refers to tasks that must exist in the flow of business activities or the flow of supporting business activities of the Bank, so that if such tasks are absent, the relevant activities will be severely disrupted or not carried out as they should be. The term "flow" refers to a series of tasks from start to finish of a business activity or supporting business activity, for example, the credit or financing granting flow includes marketing, feasibility analysis, approval, disbursement, monitoring, and

credit or financing collection tasks.
Examples of core tasks in the Bank's business activity flow, for example, the credit or financing granting activity flow include, among others, account officer and credit or financing analyst tasks; in the fund gathering activity flow include, among others, customer service, customer relation, and teller tasks. Examples of core tasks in the Bank's supporting business activity flow, for example, the risk management activity flow include, among others, risk analysis tasks; in the organization development and human resource management flow include, among others, organization planning and development as well as human resource planning tasks; in the information technology management activity flow include, among others, information technology planning and development tasks; and in the internal control activity flow include, among others, internal audit tasks. The term "support tasks" refers to tasks that do not have to exist in the flow of business activities or the flow of supporting business activities of the Bank, so that in the event such tasks are absent, the relevant activities can still be carried out without significant disruption. Examples of support tasks in the Bank's business activity flow, for example, the credit or financing granting activity flow include, among others, call center, marketing (telemarketing, direct sales, or sales representative), and collection tasks; examples in the cash handling activity flow include, among others, Bank cash management service tasks. Examples of support tasks in the supporting business activity flow, for example, tasks performed by secretaries, schedulers, receptionists, cleaning staff, security guards, waiters, couriers, data entry operators, and drivers.

Paragraph (3)
Examples of support tasks in the Bank's business activity flow and in the Bank's supporting business activity flow as referred to in the Explanation of Paragraph (2).

Article 5
Paragraph (1)
Letter a
The term "low-risk tasks" refers to tasks where failure will not significantly disrupt the Bank's operational activities.

Letter b
The term "banking field competency qualifications" includes, among others, formal education and knowledge or experience in the banking field.

Letter c
The decision-making process includes the analysis process and the judgment process in order to make decisions.
"Decisions that affect Bank operations" are decisions that can significantly increase risk and/or disrupt the Bank's operations if not carried out correctly.

Paragraph (2)
Sufficiently clear.

Paragraph (3)
As an example, in the outsourcing of credit or financing collection through a subcontracting agreement, the Bank is not allowed to transfer the credit or financing risk arising from non-payment of credit or financing by using methods such as the mechanism of selling credit or financing claims through a debt collection scheme.

Article 6
Sufficiently clear.

Article 7
Letter a
Document research is conducted on the latest information and conditions of the Service Provider Company. If necessary, confirmation or clarification can be conducted with the competent authority.

Letter b
Analysis and assessment are conducted to ensure that the Service Provider Company has met all established criteria and is capable of performing Outsourcing.
Analysis and assessment use the latest information and conditions of the Service Provider Company.
The depth and intensity of analysis and assessment are adjusted to the scale and complexity of the outsourced work.

Number 1
Assessment of financial performance aims to ensure that the Service Provider Company has financial capabilities that can support the smooth implementation of work according to the agreed contract, which includes, among others, assessment of the Service Provider Company's capital, liquidity, and profitability. Assessment of reputation, including assessment of the Service Provider Company's track record, aims to assess the Service Provider Company's compliance with regulations and/or legislation, which includes, among others:
a. legal issues that have been or are currently faced that can have a negative impact; b. compliance with regulations and/or legislation; and/or
c. compliance with Outsourcing agreements with other Banks or previous employers.
Assessment of the Service Provider Company's experience aims to ensure that the Service Provider Company has adequate experience to carry out the outsourced work, which includes, among others:
a. the company's experience in handling the outsourced work; and/or

b. the company management's experience in handling the outsourced work.

Number 2
Assessment of human resources aims to ensure the fulfillment of the sufficiency of quantity and quality or expertise of human resources.

Number 3
Assessment of facilities and infrastructure aims to ensure the sufficiency of facilities and infrastructure needed in Outsourcing, including the fulfillment of sufficiency of quantity and quality as well as special specifications needed in Outsourcing.

Article 8
Sufficiently clear.

Article 9
Sufficiently clear.

Article 10
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
Sufficiently clear.

Letter d
Included in the cost structure are costs other than the contract value related to the implementation of the work.
The payment mechanism regulates regarding which party must pay such costs and the payment procedure.

Letter e
Number 1
Sufficiently clear.

Number 2
The obligation to maintain customer information confidentiality and security refers to regulations and/or legislation, among others, concerning Bank secrecy, regulations governing Bank product information transparency and the use of customer personal data, as well as regulations governing consumer protection in the financial services sector.

Number 3
Scope and frequency of reports are in accordance with the agreement of the parties.

Number 4
Regulations and/or legislation, among others, in the fields of labor and banking.

Number 5
Protection of customer rights and interests refers to regulations and/or legislation, among others, concerning consumer protection and regulations concerning Bank product information transparency and the use of customer personal data.

Number 6
The term "contingency plan" refers to measures that must be taken by the Service Provider Company to overcome force majeure or significant disruptions in the implementation of work, among others caused by natural disasters, demonstrations, labor strikes, system disruptions, and/or disputes.

Number 7
Examination of the Service Provider Company by other authorities is conducted according to their authority based on regulations related to the outsourcing conducted by the Bank.

Letter f
The size of work implementation includes the size of the quantity and/or quality of the work.
Work implementation standards are procedures that must be met at minimum in the process of implementing outsourced work. The aforementioned standards may also refer to standard operating procedures owned by the Bank.

Letter g
Sufficiently clear.

Letter h
Sufficiently clear.

Letter i
Sufficiently clear.

Article 11
Paragraph (1)
Principles of risk management application refer to regulations governing the application of risk management for Banks.

Paragraph (2)
Sufficiently clear.

Article 12
Sufficiently clear.

Article 13
Sufficiently clear.

Article 14
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Letter a
The purpose of Outsourcing includes elaboration of the results to be achieved through the implementation of Outsourcing, in accordance with the Bank's overall strategy and business objectives.

Letter b
Criteria for work that can be outsourced refer at least to the criteria as referred to in this Financial Services Authority Regulation.

Letter c
The scope of analysis includes aspects such as risk, cost, and benefits arising from Outsourcing.
In the benefit and cost analysis, the implementation of prudential principles and supervision by the Bank over the Outsourcing must also be considered.

Letter d
Risk mitigation policy covers the types of work that require risk mitigation efforts as well as the mitigation efforts that can be taken for such work.

Letter e
Criteria for Service Provider Companies refer at least to the criteria as referred to in this Financial Services Authority Regulation.

Letter f
The minimum scope of the Outsourcing agreement refers at least to the scope as referred to in this Financial Services Authority Regulation.

Letter g
Standard procedures in conducting Outsourcing include, among others, procedures for selecting and appointing the Service Provider Company, binding the agreement, and supervising the implementation of Outsourcing.

Letter h
The special unit or function may stand alone or be part of the unit that outsources its work.

Paragraph (3)
The frequency of review is conducted according to the Bank's needs and the development of the Bank's activities, especially to ensure alignment with the Bank's overall strategy and business objectives.

Article 15
Sufficiently clear.

Article 16
Paragraph (1)
Sufficiently clear.

Paragraph (2)
Letter a
The Outsourcing process is a series of processes that must be conducted in the appointment and use of the Service Provider Company in Outsourcing.

Letter b
Supervision of work implementation is supervision over the fulfillment of the Outsourcing agreement, including the fulfillment of the size and standards established.

Paragraph (3)
The term "independent party" refers to:
a. a work unit or special function within the Bank that is not related to the Outsourcing process, which may stand alone or may be part of a special unit or function that stands alone as referred to in the Explanation of Article 14 Paragraph (2) Letter h; or b. a part of a work unit or special function within the Bank that conducts independent supervision, among others internal audit, risk management, or compliance.

Article 17
Paragraph (1)
Reports include the Bank's consolidated reports for all Bank offices. Reports are submitted by Banks that have conducted or plan to conduct Outsourcing.

Paragraph (2)
Letter a
The Outsourcing plan report contains the Outsourcing plan for work that has never been outsourced before.
Extending the Outsourcing agreement is not included in work that has never been outsourced before.

Letter b
Outsourcing is considered problematic in the event of issues in the implementation of Outsourcing or in the Service Provider Company that have the potential to significantly increase the Bank's risk and/or will disrupt the continuity of the implementation of outsourced work, regardless of whether it results in the termination of the agreement and/or replacement of the Service Provider Company. Examples of issues:
Violation of regulations and/or legislation, violation of agreements, lawsuits, customer complaints, internal disputes within the Service Provider Company, both among management and between management and employees.

Paragraph (3)
Letter a
Sufficiently clear.

Letter b
The general overview and scope of work briefly describe the outsourced work and the office location where the outsourced work is located.

Letter c
The Outsourcing agreement made is in the form of a subcontracting agreement and/or labor service provision agreement.

Letter d
Sufficiently clear.

Letter e
Sufficiently clear.

Letter f
Sufficiently clear.

Letter g
Sufficiently clear.

Paragraph (4)
Letter a
Sufficiently clear.

Letter b
Sufficiently clear.

Letter c
The description of issues briefly describes the issues that occurred, the potential risks arising, the location, the time the issue occurred, and the time the issue was discovered.

Letter d
Sufficiently clear.

Paragraph (5)
The submitted report covers the Outsourcing plan to be conducted during the next 1 (one) year.

Paragraph (6)
The Outsourcing Plan Change Report contains at least the information as referred to in Article 17 Paragraph (3) as well as a brief description of the background and purpose of the addition and/or change of the Outsourcing plan.

Paragraph (7)
The term "holiday" refers to national holidays established by the central government and/or local holidays established by the local government.

Paragraph (8)
Sufficiently clear.

Article 18
Sufficiently clear.

Article 19
Sufficiently clear.

Article 20
Sufficiently clear.

Article 21
Sufficiently clear.

Article 22
Sufficiently clear.

Article 23
Sufficiently clear.

Article 24
Sufficiently clear.

Article 25
Sufficiently clear.

Article 26
Sufficiently clear.

ADDITIONAL SHEET OF THE STATE GAZETTE OF THE REPUBLIC OF INDONESIA NUMBER 5845