SEOJK No. 4/SEOJK.05/2015 on Risk Level Assessment for Financing Companies — OJK — ID

To:
Directors or equivalents of Financing Companies at their respective locations.

COPY
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 4/SEOJK.05/2015 ON RISK LEVEL ASSESSMENT FOR FINANCING COMPANIES

In accordance with the mandate of Article 5 paragraph (4), Article 7 paragraph (3), and Article 8 paragraph (6) of Financial Services Authority Regulation Number 10/POJK.05/2014 concerning Risk Level Assessment for Non-Bank Financial Institutions (State Gazette of the Republic of Indonesia Year 2014 Number 197, Supplement to the State Gazette of the Republic of Indonesia Number 5575), it is necessary to regulate implementation provisions regarding risk level assessment, formats and procedures for submitting risk assessment result reports, as well as formats and procedures for submitting follow-up plans based on risk level assessments for financing companies in this Circular Letter of the Financial Services Authority as follows:

I. GENERAL PROVISIONS

Financing Companies are financing companies as referred to in legislation in the field of financing institutions, excluding financing companies whose entire business activities are conducted based on Sharia principles.
Financial Services Authority, hereinafter abbreviated as OJK, is an independent institution free from the interference of other parties, which has the functions, duties, and authority for regulation, supervision, examination, and investigation as referred to in Law Number 21 of 2011 concerning the Financial Services Authority.

II. GUIDELINES FOR RISK LEVEL ASSESSMENT AND PREPARATION OF RISK ASSESSMENT RESULT REPORTS

Risk level assessment for Financing Companies is conducted by considering the materiality and significance of a type of risk to the total risk of the Financing Company.
Risk level assessment for Financing Companies is conducted by considering the history of risks that have occurred and the probability of a risk occurring in the future.
Risk level assessment for each type of Financing Company is prepared in accordance with the guidelines as referred to in Appendix I, which is an integral part of this OJK Circular Letter.
Risk Assessment Result Reports must be prepared and signed by the director or equivalent who oversees the risk management function and acknowledged by the President Director or equivalent.
Risk Assessment Result Reports for Financing Companies must be prepared in accordance with the format as referred to in Appendix II, which is an integral part of this OJK Circular Letter.

III. GUIDELINES FOR PREPARING FOLLOW-UP PLANS BASED ON RISK LEVEL ASSESSMENT

Follow-up plans based on risk level assessments are signed by the Board of Directors or equivalents.
Follow-up plans for Financing Companies are prepared in accordance with the format as referred to in Appendix III, which is an integral part of this OJK Circular Letter.

IV. PROCEDURES FOR SUBMITTING RISK ASSESSMENT RESULT REPORTS AND FOLLOW-UP PLANS BASED ON RISK LEVEL ASSESSMENT

Risk assessment result reports and follow-up plans based on risk level assessments are submitted to OJK online through the OJK data communication network system.
In the event that the OJK data communication network system is not yet available, risk assessment result reports and follow-up plans based on risk level assessments are submitted online via the official email of the Financing Company by attaching a softcopy of the risk assessment result reports and follow-up plans based on risk level assessments in spreadsheet format to rbs.pembiayaan@ojk.go.id.
In the event that OJK experiences technical difficulties during the deadline for submitting risk assessment result reports or follow-up plans based on risk level assessments, such that:
a. Financing Companies are unable to submit risk assessment result reports or follow-up plans based on risk level assessments online as referred to in paragraph 1 or paragraph 2; and/or b. OJK is unable to receive risk assessment result reports or follow-up plans based on risk level assessments online as referred to in paragraph 1 or paragraph 2, OJK announces in writing to Financing Companies on the same day after the technical difficulties occur, and Financing Companies are required to submit softcopy risk assessment result reports or follow-up plans based on risk level assessments in spreadsheet format offline no later than the next working day.
In the event of technical difficulties as referred to in paragraph 3, Financing Companies submit softcopy risk assessment result reports and follow-up plans based on risk level assessments in spreadsheet format offline as referred to in paragraph 3, via a letter signed by the Board of Directors or equivalents and addressed to:
Financial Services Authority u.p. Director of Supervision of Financing Institutions Sumitro Djojohadikusumo Building Jl. Lapangan Banteng Timur No. 2—4 Jakarta 10710
Submission of softcopy risk assessment result reports and follow-up plans based on risk level assessments in spreadsheet format offline as referred to in paragraph 3, can be done in one of the following ways:
a. handed in directly to the OJK office as referred to in paragraph 4; b. sent via registered postal office; or
c. sent via courier/delivery service companies.
Financing Companies are deemed to have submitted risk assessment result reports and follow-up plans based on risk level assessments with the following provisions:
a. for online submission through the OJK data communication network system, evidenced by an acknowledgment receipt from OJK; b. for online submission via email, evidenced by an email acknowledgment receipt from OJK;
c. for offline submission, evidenced by:
1) an acknowledgment receipt letter from OJK, if the reports are handed in directly to the OJK office as referred to in paragraph 4; or
2) a delivery receipt from the postal office or courier/delivery service companies, if the reports are sent via postal office or courier/delivery service companies.

V. CLOSING

Provisions in this Circular Letter of the Financial Services Authority shall come into force on the date of establishment.

To ensure that everyone knows, order the announcement of this Circular Letter of the Financial Services Authority by placing it in the State Gazette of the Republic of Indonesia.

Established in Jakarta on Date 29 January 2015 EXECUTIVE HEAD OF INSURANCE, PENSION FUND, FINANCING INSTITUTIONS, AND OTHER FINANCIAL INSTITUTIONS SUPERVISORS FINANCIAL SERVICES AUTHORITY, Signed, FIRDAUS DJAELANI

STATE GAZETTE OF THE REPUBLIC OF INDONESIA YEAR 2015 NUMBER 11 DATE 6 FEBRUARY 2015

Copy matches the original
Director of Law I
Department of Law,
Signed,
Signed,
Sudarmaji

APPENDIX I
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 4/SEOJK.05/2015 ON RISK LEVEL ASSESSMENT FOR FINANCING COMPANIES

GUIDELINES FOR RISK LEVEL ASSESSMENT
FOR FINANCING COMPANIES

TABLE OF CONTENTS
CHAPTER I: INTRODUCTION......................................................................2
A. Definition and Scale of Risk Level Assessment .................... 2
B. Objectives of Risk Level Assessment Guidelines........................... 3
C. General Principles of Risk Level Assessment............................. 3
CHAPTER II: RISK LEVEL CALCULATION PROCESS............................5
A. Overview of Risk Level Calculation .................... 5
B. Inherent Risk Assessment..................................................... 5
C. Management and Control Assessment.............................. 6
D. Determination of Net Risk Value............................................. 6
E. Determination of Capital Support Risk Value (Capitalization) ........ 7
F. Determination of Overall Risk Value ................................... 8
CHAPTER III: RISK LEVEL ASSESSMENT PER RISK TYPE.................10
A. Management Risk .......................................................... 10
B. Governance Risk ............................................................... 12
C. Strategy Risk..................................................................... 14
D. Operational Risk .............................................................. 17
E. Asset and Liability Risk .................................................... 22
F. Financing Risk.............................................................. 25
G. Capital Support Risk (Capitalization).................................. 29
Example of Risk Level Calculation for Financing Companies ...........31

CHAPTER I
INTRODUCTION

A. DEFINITION AND SCALE OF RISK LEVEL ASSESSMENT

In business operations, companies face various risks that can result in the failure to achieve company objectives. Companies need to apply risk management to minimize the risks faced. One part of risk management is conducting risk measurement and assessment. The objective of risk assessment is to determine the probability of the company experiencing failure. Risk assessment activities should be conducted continuously and always updated periodically by the company. In accordance with regulations, companies are required to submit risk assessment results to OJK at least once a year.

The probability of the company experiencing failure is reflected in the risk value and risk level. Risk levels are grouped into five levels: low, medium-low, medium-high, high, and very high. Risk values have a range of 0 to 4. The higher the risk value, the greater the likelihood of the company experiencing failure. Conversely, if the risk value is lower, the likelihood of company failure is also smaller. Risk values and risk levels can be seen in Table 1.

Table 1
Risk Value and Risk Level for Financing Companies

Risk Value
(NR)
Risk Level
Explanation
0 < NR < 1
Low
The probability of the company failing to meet its obligations is relatively low. The company is indicated as very healthy and has the ability to meet its obligations. 1 < NR < 1,5 Medium Low The probability of the company failing to meet its obligations is at a medium to low level. Generally the company is healthy but there is potential failure to meet its obligations. 1,5 < NR < 2 Medium High The probability of the company failing to meet its obligations is at a medium to high level. Generally the company is less healthy and there is a quite small potential failure to meet its obligations. 2 < NR < 3 High The probability of the company failing to meet its obligations is at a high level. Generally the company is not healthy and has a quite large potential failure in meeting its obligations. 3 < NR < 4 Very High The probability of the company failing to meet its obligations is at a very high level. Generally the company is not healthy and has a very large potential failure in meeting its obligations.

B. OBJECTIVES OF RISK LEVEL ASSESSMENT GUIDELINES

These guidelines aim to provide guidance for company management in conducting risk level assessments.

C. GENERAL PRINCIPLES OF RISK LEVEL ASSESSMENT

Company management needs to pay attention to the following general principles:

Risk-based
Risk level assessment is conducted by identifying various factors that can affect the probability of the company failing to achieve its objectives.
Materiality
Companies need to consider the materiality and significance of inherent risk and management controls for each type of risk present. The determination of materiality and significance is based on adequate data and information regarding factors affecting the company's risk level.
Comprehensive
The risk level assessment process is conducted across all company risk areas through structured and integrated analysis.

CHAPTER II
RISK LEVEL CALCULATION PROCESS

A. OVERVIEW OF RISK LEVEL CALCULATION

Risk level calculation is based on the following factors:

Inherent risk, which is all risks embedded in each type of company activity;
Management and control, which are actions that can be taken by the Board of Directors and Board of Commissioners or equivalents to minimize inherent risk levels; and
Capital support, which is available funding or capitalization that describes the company's ability to meet its obligations and sustain its business.

The risk assessment system framework can be described as follows:

Strategy
Operational
Asset and
Liability
Inherent Risk
Management &
Control
Capital Support
(Capitalization)
Overall Risk Value
Net Risk
Management
Governance
Financing

B. INHERENT RISK ASSESSMENT

Inherent risk is risk embedded in company activities, without considering the management and control aspects conducted by the company. All inherent risks that affect the company's ability to meet its obligations, especially financially, fall into this inherent risk measure.

The company's inherent risk is greatly influenced by the company's characteristics and complexity, the company's business lines, and the types of financing offered. Inherent risk is also influenced by the company's operational activities. The more diverse and higher the volume of operational activities, the higher the company's inherent risk. Moreover, the company's risk profile determines how much inherent risk level is willing to be accepted considering the capital support required.

The company's inherent risk assessment is conducted separately from the management and controls implemented to reduce that risk. In other words, in this inherent risk assessment, management only assesses risks that may arise in the operation of a company without considering whether those risks actually occur or do not occur due to strong risk management and controls.

C. MANAGEMENT AND CONTROL ASSESSMENT

The management and control aspect refers to how the company identifies, measures, monitors, and controls its inherent risks. In practice, this is done through a series of policies and procedures, applied systems, administrative practices, and supervision implemented.

The management and control assessment aims to assess the mechanisms or management and control systems for each inherent risk exposed to the company. Aspects considered in this assessment include management's concern for risk and the control systems it possesses, including the risk management framework owned and implemented by the company. The results of the management and control assessment will become a risk reduction factor to become net risk.

D. DETERMINATION OF NET RISK VALUE

The determination of net risk value is conducted in two stages: measuring the net risk value for each type of risk and measuring the total net risk value.

Measuring net risk value for each type of risk
Net risk value is essentially the inherent risk value after considering management and control. Net risk value is mathematically calculated using the average value of inherent risk value plus management and control value.

Net Risk = (Inherent Risk + Management and Control) The above net risk calculation is conducted for strategy risk, operational risk, asset and liability risk, and financing risk. Governance risk and management risk are net risk values and have no reduction from management and control.

Measuring total net risk value
After net risk values are obtained for all types of risk, total net risk value is measured by weighting each type of risk. Weights for each type of risk are presented in the following table:

Table 2
Risk Weights
No. Type of Risk Weight (%)
1 Management 10
2 Governance 15
3 Strategy 10
4 Operational 20
5 Asset and Liability 15
6 Financing 30
TOTAL 100

Total net risk value is calculated using the following formula.
Total Net Risk Value =
∑ (i=1 to 4) NRi x Weight i is the type of risk as listed in Table 2.

E. DETERMINATION OF CAPITAL SUPPORT RISK VALUE (CAPITALIZATION)

Capital support value reflects the company's ability to absorb unexpected losses arising from the management of the company's assets and liabilities. In determining capital support, companies consider capitalization ability and additional capitalization aspects.

Capital support risk value is calculated by weighting the capitalization ability and additional capitalization aspects. Weighting of capitalization ability and additional capitalization is conducted according to the following table:

Table 3
Capital Support Risk (Capitalization) Weights
No. Component Weight (%)
1 Funding Ability (Capitalization) 50
2 Additional Funding (Capitalization) 50
TOTAL 100

Total Capital Support Risk Value (Capitalization) = ∑ (i=1 to 4) NRi x Weight i is the capital support component as listed in Table 3.

F. DETERMINATION OF OVERALL RISK VALUE

Overall risk value reflects the probability of the company's overall failure. Overall risk value is calculated based on total net risk value considering the company's capital support (capitalization) risk.

Weights for calculating the overall risk value for Financing Companies are:

Table 4
Weights for Total Net Risk Value and Capital Support Risk Value (Capitalization) No. Component Weight (%) 1 Total Net Risk Value 66,67 2 Capital Support Risk Value (Capitalization) 33,33 TOTAL 100

Next, overall risk value is calculated by summing and weighting total net risk value with capital support risk value using the following formula. NRK = √(TNRB^4 x WeightTNRB) + (NRDD^4 x WeightNRDD )

NRK = Overall Risk Value
TNRB = Total Net Risk Value
NRDD = Capital Support Risk Value

In full, the Overall Risk Value calculation formula is presented in the following table:

Table 5
Risk Assessment
Type of Risk
Inherent Risk
(RB)
Management &
Control
(MP)
Net Risk
Weight
Risk
(%)
1. Management (0-4) 10
2. Governance (0-4) 15
3. Strategy (0-4) (0-4) (0-4) 10
4. Operational (0-4) (0-4) (0-4) 20
5. Asset and Liability (0-4) (0-4) (0-4) 15
6. Financing (0-4) (0-4) (0-4) 30
Total Net Risk Value 100
1. Funding Ability
(Capitalization)
(0-4) 50
2. Additional Funding
(Capitalization)
(0-4) 50
Capital Support (Capitalization) 100
1. Total Net Risk Value (0-4) 66,7
2. Total Capital Support
Risk Value
(Capitalization)
(0-4) 33,3
Overall Risk Value (0-4) 100

CHAPTER III
RISK LEVEL ASSESSMENT PER RISK TYPE

This chapter provides guidelines for companies in conducting risk level assessments per risk type. Types of risks present in Financing Companies are management risk, governance risk, strategy risk, operational risk, asset and liability risk, financing risk, and capital support (capitalization) risk.

A. MANAGEMENT RISK

Management risk is the risk of company failure to achieve company objectives due to the company's failure to maintain the best composition of management with high competence and integrity. Management referred to in these guidelines includes the Board of Directors and Board of Commissioners or equivalents. Risks arising from management will affect the company's ability to meet its obligations to the company's stakeholders.

Topics assessed in this risk are as follows:

1) Appointment and dismissal
In this topic, assessed areas include procedures and legality of documents related to such appointments and dismissals.

2) Composition and proportion
Matters to be assessed include the adequacy of the number and composition of management and clarity of structure and job descriptions.

3) Competence and integrity
In this topic, assessed areas include the results of fitness and propriety tests, work experience, education and training, and management behavior.

4) Leadership
In leadership, assessed areas include vision and mission as well as characteristics of management.

The following are general indications of management risk for each risk value range:

Indications of Companies with Low Management Risk (0 < NR ≤ 1)
a. Appointment and/or dismissal of management is very adequate. b. Management composition and proportion are sufficient and in accordance with company needs.
c. Management competence and integrity are very adequate and support management duties and authorities.
d. Management leadership is very good.
Indications of Companies with Medium-Low Management Risk (1 < NR ≤ 1,5)
a. Appointment and/or dismissal of management is conducted adequately. b. Management composition and proportion are sufficient, but there are indications of being less suitable for company needs.
c. Management competence and integrity are adequate and support management duties and authorities.
d. Management leadership is good.
Indications of Companies with Medium-High Management Risk (1,5 < NR ≤ 2)
a. Appointment and/or dismissal of management is conducted less adequately. b. Management composition and proportion are less sufficient.
c. Management competence and integrity are less adequate and less support management duties and authorities.
d. Management leadership is adequate.
Indications of Companies with High Management Risk (2 < NR ≤ 3)
a. Appointment and/or dismissal of management is conducted with inadequate processes and documentation. b. Management composition and proportion are insufficient.
c. Management competence and integrity are inadequate and do not support management duties and authorities.
d. Management leadership is less good.
Indications of Companies with Very High Management Risk (3 < NR ≤ 4)
a. Appointment and/or dismissal of management is conducted with very inadequate processes and documentation. b. Management composition and proportion are very insufficient for company needs.
c. Management competence and integrity are very inadequate and hinder the implementation of management duties and authorities.
d. Management leadership is not good.

B. GOVERNANCE RISK
Governance risk is the potential failure in the implementation of good governance, inappropriate management style, control environment, and behavior of every party involved directly or indirectly with the company. The topics assessed in this risk are as follows:
1) Governance guidelines
Areas that must be assessed include the availability and completeness of governance guidelines, the process of formulating governance guidelines, the implementation of governance guidelines, and the evaluation of the implementation of governance guidelines.
2) Transparency (transparency)
In this topic, what is assessed includes transparency in the decision-making process, and transparency in the disclosure and provision of relevant information regarding the company.
3) Accountability
Matters that must be assessed include the determination of functions, activities, and tasks, code of conduct, early detection system, rewards and punishments, and internal control structure.
4) Responsiveness (Responsibility)
In this topic, matters that need to be assessed include responsibility to shareholders or equivalents, and social responsibility.
5) Independence
Areas that must be assessed include the existence or non-existence of conflict of interest and intervention by shareholders and the board of commissioners or equivalents, and/or other parties.
6) Fairness and Equity
In this topic, what is assessed includes cooperation with business partners, treatment of debtors, and treatment of employees.
7) Risk management
Matters to be evaluated for this topic include the availability of risk management guidelines, risk management control units, and the implementation of risk management.

The following are general indications of governance risk for each risk value range:

Criteria for Companies with Low Governance Risk
(0 < NR ≤ 1) a. The governance guidelines owned by the company are very adequate. b. The company implements the transparency principle very well.
c. The company implements the accountability principle very well.
d. The company implements the responsibility principle very well. e. The company implements the independence principle very well. f. The company implements the fairness and equity principle very well. g. The company implements the risk management principle very well.
Criteria for Companies with Low-Medium Governance Risk
(1 < NR ≤ 1,5) a. The governance guidelines owned by the company are adequate. b. The company implements the transparency principle well.
c. The company implements the accountability principle well.
d. The company implements the responsibility principle well. e. The company implements the independence principle well. f. The company implements the fairness and equity principle well. g. The company implements the risk management principle well.
Criteria for Companies with Medium-High Governance Risk
(1,5 < NR ≤ 2) a. The governance guidelines owned by the company are moderately adequate. b. The company implements the transparency principle moderately well.
c. The company implements the accountability principle moderately well.
d. The company implements the responsibility principle moderately well. e. The company implements the independence principle moderately well. f. The company implements the fairness and equity principle moderately well. g. The company implements the risk management principle moderately well.
Criteria for Companies with High Governance Risk (2 < NR ≤ 3)
a. The governance guidelines owned by the company are inadequate. b. The Financing Company implements the transparency principle poorly.
c. The Financing Company implements the accountability principle poorly.
d. The Financing Company implements the responsibility principle poorly. e. The Financing Company implements the independence principle poorly. f. The Financing Company implements the fairness and equity principle poorly. g. The Financing Company implements the risk management principle poorly.
Criteria for Companies with Very High Governance Risk
(3 < NR ≤ 4) a. The company's governance guidelines are unavailable or tend to be inadequate. b. The company does not implement the transparency principle to company stakeholders.
c. The company does not implement the accountability principle in the conduct of the company.
d. The company does not implement the responsibility principle in the conduct of the company. e. The company does not implement the independence principle in the conduct of the company. f. The company does not implement the fairness and equity principle in the conduct of the company. g. The company does not implement the risk management principle in the conduct of the company.
C. STRATEGY RISK
Strategy risk is the potential failure of the company in achieving company objectives due to the unfeasibility or failure in planning, setting, and implementing strategy, making appropriate business decisions, and/or the company's lack of responsiveness to external changes.

The assessment of strategy risk consists of inherent risk assessment and management control assessment.
The topics assessed in the inherent risk of strategy risk are as follows:
1) Alignment of strategy with business environment conditions
In this topic, matters that need to be assessed include the alignment of the company's vision, mission, and business direction, the company's internal readiness in developing business, and the consideration of external factors in the company's business development.
2) Strategic position of the company
What needs to be assessed is the adequacy of competitor analysis, the company's readiness to face macroeconomic changes, reputation risk, and the diversification plan to be carried out by the company. The topics assessed in management and control are as follows:
1) Strategy formulation and setting process
In this topic, matters that need to be assessed include the evaluation of the level of risk to be taken and the acceptable risk tolerance, and active supervision by the board of directors and the board of commissioners or equivalents.
2) Implementation of strategic plans
This can be assessed from the understanding of the board of directors or equivalents and officials one level below them, and success indicators (key performance indicator). The following are general indications of strategy risk for each risk value range in inherent risk as well as management and control:
INHERENT RISK
1. Indication of Strategy Risk for Companies with Low Inherent Risk
(0 < NR ≤ 1) a. The strategy owned and implemented by the company is very aligned with its environmental conditions. b. The company's policies implemented are very aligned with the company's strategic position.

2. Indication of Strategy Risk for Companies with Low-Medium Inherent Risk (1 < NR ≤ 1,5)
a. The strategy owned and implemented by the company is aligned with its environmental conditions. b. The company's policies implemented are aligned with the company's strategic position.
3. Indication of Strategy Risk for Companies with Medium-High Inherent Risk (1,5 < NR ≤ 2)
a. The strategy owned and implemented by the company is moderately aligned with its environmental conditions. b. The company's policies implemented are moderately aligned with the company's strategic position.
4. Indication of Strategy Risk for Companies with High Inherent Risk
(2 < NR ≤ 3) a. The strategy owned and implemented by the company is less aligned with its environmental conditions. b. The company's policies implemented are less aligned with the company's strategic position.
5. Indication of Strategy Risk for Companies with Very High Inherent Risk (3 < NR ≤ 4)
a. The strategy owned and implemented by the company is not aligned with its environmental conditions. b. The company's policies implemented are not aligned with the company's strategic position. MANAGEMENT AND CONTROL
1. Indication of Companies with Very Strong Management and Control over Strategy Risk (0 < MP ≤ 1)
a. The strategy formulation and setting process carried out by the company is very good. b. The implementation of the company's strategic plan is done very well.
2. Indication of Companies with Strong Management and Control over Strategy Risk (1 < MP ≤ 1,5)
a. The strategy formulation and setting process carried out by the company is good. b. The implementation of the company's strategic plan is done well.

3. Indication of Companies with Management and Control over Strategy Risk Adequate (1,5 < MP ≤ 2)
a. The strategy formulation and setting process carried out by the company is moderately good. b. The implementation of the strategic plan by the company is moderately good.
4. Indication of Companies with Management and Control over Strategy Risk Weak (2 < MP ≤ 3)
a. The strategy formulation and setting process carried out by the company is less good. b. The implementation of the strategic plan by the company is less good.
5. Indication of Companies with Management and Control over Strategy Risk Very Weak (3 < MP ≤ 4)
a. The company does not have a strategy in conducting its business. b. There is no strategic plan made by the company. D. OPERATIONAL RISK Operational risk is the potential failure of the company in fulfilling its obligations as a result of the unfeasibility or failure of internal processes, humans, information technology systems, and/or events originating from outside the company environment. The assessment of operational risk consists of inherent risk assessment and management and control assessment. The topics assessed in the inherent risk of operational risk are as follows:
1) Company complexity
Matters that must be assessed on this topic include the size and organizational structure, human resources, volume and workload, corporate action and new business development, and sources and lines of business or financing offered.
2) Information technology systems
Matters that must be assessed include the reliability of information technology systems, changes in information technology systems, and infrastructure.
3) Fraud and legal issues
In this topic, areas that must be assessed include the company's history of internal fraud and legal issues with debtors.
4) Business disruption to the company
Matters that must be assessed include the frequency and materiality of external events, the location and geographical conditions of the company, and the use of third-party services. The topics assessed in management and control are as follows:
1) Policies and procedures
Matters that must be considered include the formulation of policies and decision-making processes, standard operating procedures (SOP), policy communication and documentation, and risk management.
2) Administrative activities
In this topic, matters that must be considered include the budgeting cycle and activity plans, debtor administration, recording, bookkeeping, and transaction reporting, as well as archives and documentation.
3) Management of information technology systems
In this topic, areas that must be assessed include the management of information technology systems and infrastructure, blueprints and application change management, data security management, database (database) and information management, and backup procedures and disaster recovery plan.
4) Prevention of fraud and legal issues
Areas that must be assessed include the internal control structure and supervision by the audit committee/board of commissioners or equivalents.
5) Human resource management
Areas that must be assessed include human resource planning and strategy, recruitment process, career development, payroll, and labor compensation, and employee renewal and replacement.
6) Management of third-party service usage
In this topic, what is assessed includes third-party service usage policies, appointment of service providers, reporting and accountability, and control over the cost of using third-party services.

The following are general indications of operational risk for each risk value range in inherent risk as well as management and control:
INHERENT RISK

Indication of Operational Risk for Companies with Low Inherent Risk
(0 < NR ≤ 1) a. The company has an organizational structure, human resources, volume, and workload with very low complexity. b. The company has very adequate technology and information systems capable of supporting the conduct of the company.
c. The company has never had a history of internal fraud or experienced legal issues with debtors.
d. The company has no disruption in the conduct of the company.
Indication of Operational Risk for Companies with Low-Medium Inherent Risk
(1 < NR ≤ 1,5) a. The company has an organizational structure, human resources, volume, and workload with low complexity. b. The company has adequate technology and information systems capable of supporting the conduct of the company.
c. The company hardly ever has a history of internal fraud or experienced legal issues with debtors.
d. There are minor disruptions occurring in the company.
Indication of Operational Risk for Companies with Medium-High Inherent Risk (1,5 < NR ≤ 2)
a. The company has an organizational structure, human resources, volume, and workload with moderate complexity. b. The company has less adequate technology and information systems capable of supporting the conduct of the company.
c. The company rarely has a history of internal fraud or experienced legal issues with debtors.
d. Disruptions occurring in the company are quite significant.
Indication of Operational Risk for Companies with High Inherent Risk
(2 < NR ≤ 3) a. The company has an organizational structure, human resources, volume, and workload with high complexity.

b. The company has inadequate technology and information systems.
c. The company often has a history of internal fraud or experienced legal issues with debtors.
d. Disruptions occurring in the company are significant.
5. Indication of Operational Risk for Companies with Very High Inherent Risk (3 < NR ≤ 4)
a. The company has an organizational structure, human resources, volume, and workload with very high complexity. b. The company has very inadequate technology and information systems.
c. The company frequently has a history of internal fraud or experienced legal issues with debtors.
d. Disruptions occurring in the company are very significant.
MANAGEMENT AND CONTROL

Indication of Companies with Very Strong Management and Control over Operational Risk (0 < MP ≤ 1)
a. The company's policies and procedures are very adequate. b. The company's administrative activities are very good.
c. The company's management of information technology systems is very good.
d. The company's mechanisms and policies to prevent internal fraud and legal issues are very good. e. The company's human resource management is very good. f. The company's management of third-party services is very good.
Indication of Companies with Strong Management and Control over Operational Risk (1 < MP ≤ 1,5)
a. The company's policies and procedures are adequate. b. The company's administrative activities are good.
c. The company's management of information technology systems is good.
d. The company's mechanisms and policies to prevent internal fraud and legal issues are good. e. The company's human resource management is good. f. The company's management of third-party services is good.
Indication of Companies with Management and Control over Operational Risk Adequate (1,5 < MP ≤ 2)
a. The company's policies and procedures are adequate but there are several matters that need improvement. b. The company's administrative activities are moderately good but there are several matters that need improvement.
c. The company's management of information technology systems is moderately good but there are several matters that need improvement.
d. The company's mechanisms and policies to prevent internal fraud and legal issues are moderately good but there are several matters that need improvement. e. The company's human resource management is moderately good but there are several matters that need improvement. f. The company's management of third-party services is moderately good but there are several matters that need improvement.
Indication of Companies with Management and Control over Operational Risk Weak (2 < MP ≤ 3)
a. The company's policies and procedures are inadequate. b. The company's administrative activities are poor.
c. The company's management of information technology systems is not good.
d. The company's mechanisms and policies to prevent internal fraud and legal issues are not good. e. The company's human resource management is not good. f. The company's management of third-party services is poor.
Indication of Companies with Management and Control over Operational Risk Very Weak (3 < MP ≤ 4)
a. The company's policies and procedures are very inadequate. b. The company's administrative activities are very poor.
c. There is no management of the company's information technology systems.
d. There are no mechanisms and policies of the company to prevent internal fraud and legal issues. e. There is no human resource management in the company. f. The company's management of third-party services is very poor.

E. ASSET AND LIABILITY RISK
Asset and liability risk is the risk that occurs due to the potential failure in the management of assets and the management of liabilities of the Financing Company, which results in a lack of funds to fulfill the company's obligations. The assessment of asset and liability risk consists of inherent risk assessment and management and control assessment. The topics assessed in the inherent risk of asset and liability risk are as follows:
1) Asset management
Matters assessed on this topic include (reliability and valuation of assets), assessment of asset exposure with interest rate risk, assessment of asset exposure with exchange rate risk, and assessment of potential loss due to interest rate and exchange rate risks.
2) Liability management
Matters assessed on this topic include assessment of liability exposure with interest rate risk, assessment of liability exposure with exchange rate risk, and assessment of potential loss due to interest rate and exchange rate risks.
3) Mismatch between assets and liabilities
Matters assessed on this topic include the mismatch of asset and liability maturity/duration, mismatch between assets and liabilities in foreign currency (currency gap), and the level of liquidity. The topics assessed in management and control are as follows:
1) Concern from the board of directors or equivalents
Matters assessed on this topic include the adequacy of the determination of the level of risk to be taken (risk appetite) and risk tolerance, the concern of the board of directors and the board of commissioners or equivalents regarding asset management objectives, and concern regarding asset risk issues.
2) Asset and liability risk management
Matters assessed on this topic include risk management for asset and liability management in financing distribution and non-financing assets, and control in asset assessment.

3) Control in conducting asset valuation
Matters assessed on this topic include valuation policies, independent assessment, and human resource expertise. The following are general indications of asset and liability risk for each risk value range in inherent risk as well as management and control:
INHERENT RISK

Indication of Asset and Liability Risk for Companies with Low Inherent Risk
(0 < NR ≤ 1) a. The company manages assets very well. b. The company manages liabilities very well.
c. The alignment of assets and liabilities is very adequate.
Indication of Asset and Liability Risk for Companies with Low-Medium Inherent Risk
(1 < NR ≤ 1,5) a. The company manages assets well. b. The company manages liabilities well.
c. The alignment of assets and liabilities is adequate.
Indication of Asset and Liability Risk for Companies with Medium-High Inherent Risk (1,5 < NR ≤ 2)
a. The company manages assets less well. b. The company manages liabilities less well.
c. The alignment of assets and liabilities is less adequate.
Indication of Asset and Liability Risk for Companies with High Inherent Risk
(2 < NR ≤ 3) a. The company manages assets poorly. b. The company manages liabilities poorly.
c. The alignment of assets and liabilities is inadequate.
Indication of Asset and Liability Risk for Companies with Very High Inherent Risk (3 < NR ≤ 4)
a. The company manages assets very poorly. b. The company manages liabilities very poorly.
c. The alignment of assets and liabilities is very inadequate.

MANAGEMENT AND CONTROL

Indication of Companies with Very Strong Management and Control over Asset and Liability Risk (0 < MP ≤ 1)
a. The board of directors and the board of commissioners or equivalents have very high concern for the objectives of asset and liability management. b. The company has very adequate asset and liability management.
c. The company has very strong control in conducting asset valuation.
Indication of Companies with Strong Management and Control over Asset and Liability Risk (1 < MP ≤ 1,5)
a. The board of directors and the board of commissioners or equivalents have high concern for the objectives of asset and liability management. b. The company has adequate asset and liability management.
c. The company has strong control in conducting asset valuation.
Indication of Companies with Management and Control over Asset and Liability Risk Adequate (1,5 < MP ≤ 2)
a. The board of directors and the board of commissioners or equivalents have moderate concern for the objectives of asset and liability management. b. The company has asset and liability management that is adequate but there are several matters that need improvement.
c. The company has moderately strong control in conducting asset valuation.
Indication of Companies with Management and Control over Asset and Liability Risk Weak (2 < MP ≤ 3)
a. The board of directors and the board of commissioners or equivalents have less concern for the objectives of asset and liability management. b. The company has asset and liability management that is inadequate.
c. The company has weak control in conducting asset valuation.
Indication of Companies with Management and Control over Asset and Liability Risk Very Weak (3 < MP ≤ 4)
a. The board of directors and the board of commissioners or equivalents have no concern for the objectives of asset and liability management.

b. The company has very inadequate asset and liability management.
c. The company has very weak controls in asset valuation.

F. FINANCING RISK
Financing risk is the risk arising from the failure of the company's debtors to repay installment obligations for financing received by the Financing Company. This financing risk is the largest risk that can be the main cause of the failure of Financing Companies. This is because the majority of Financing Companies' assets are financing receivables. The assessment of financing risk consists of inherent risk assessment and management and control assessment. The topics assessed in the inherent risk of financing risk are as follows:
1) Composition of financing receivable portfolio and concentration level
Items assessed on this topic include the types of financing exposures owned by the company, and the level of financing distribution concentration based on counterparty (debtor), geographic location, economic sector, target market, or other diversification.
2) Financing distribution strategy
Items assessed on this topic include the company's financing distribution process, the growth rate of financing receivables, and financing strategies and products.
3) Quality of financing receivables and adequacy of provisions
Items assessed on this topic include the level of problematic financing receivables (Non Performing Financing) and the adequacy of provisions formed by the company against potential losses faced by the Financing Company.
4) External factors
Items assessed on this topic include factors such as changes in economic conditions, technological changes, or regulations that can affect interest rates, exchange rates, debtor business cycles, and other matters that ultimately can impact the debtor's ability to repay installments.

The topics assessed in the management and control of financing risk are as follows:
1) Financing risk management
Items assessed in this topic include the company's policy in setting the level of risk to be taken (risk appetite) and risk tolerance, and the supervision of the board of directors and board of commissioners or equivalent in understanding and managing financing risk inherent in financing business activities.
2) Financing risk management framework
The financing risk management framework refers to the entire organizational structure, policies, procedures, systems, models, methodologies, authorities, and other matters that affect the management of financing risk. Items assessed in this topic include (i) financing risk management strategy adjusted to the level of risk to be taken (risk appetite) and the company's risk tolerance; (ii) risk management organization capable of promoting effective segregation of duties, independence, and dual control; (iii) high-quality and very adequate Financing Company policies and procedures; and (iv) reliability of the financing limit setting process for certain debtor groups.
3) Risk management process, management information systems, and human resources
Items assessed in this topic include (i) financing risk management process, which covers the financing risk identification and measurement process, monitoring of risk on financing distribution and account management, and the reliability of control actions against financing risk and its consistency with the level of risk to be taken (risk appetite) and risk tolerance; (ii) adequacy of management information systems and (iii) adequacy of human resources to ensure separation between business unit functions and risk management units and compliance work units.
4) Financing risk control system
Items assessed in this topic include the adequacy of independent internal review systems for all financing distribution business activities and financing risk management processes; adequacy of segregation of duties and authorities (segregation of duties) and dual control.

The following are general indications of financing risk for each risk value range in inherent risk as well as management and control:

INHERENT RISK

Criteria for Financing Companies with Low Inherent Risk in Financing Risk (0 < NR ≤ 1)
a. The composition of financing receivable portfolios has very small nominal exposure and a very low level of portfolio concentration in one sector/area. b. Financing distribution strategy is very adequate.
c. Financing receivable quality is very good and the adequacy of provisions made by the company is very adequate.
d. External factors that can impact debtor ability are very small.
Criteria for Financing Companies with Low-Medium Inherent Risk in Financing Risk (1 < NR ≤ 1.5)
a. The composition of financing receivable portfolios has small nominal exposure and a low level of portfolio concentration in one sector/area. b. Financing distribution strategy is adequate.
c. Financing receivable quality is good and the adequacy of provisions made by the company is adequate.
d. External factors that can impact debtor ability are small.
Criteria for Financing Companies with Medium-High Inherent Risk in Financing Risk (1.5 < NR ≤ 2)
a. The composition of financing receivable portfolios has medium nominal exposure and a medium level of portfolio concentration in one sector/area. b. Financing distribution strategy is less adequate.
c. Financing receivable quality is medium and the adequacy of provisions made by the company is less adequate.
d. External factors that can impact debtor ability are medium.
Criteria for Financing Companies with High Inherent Risk in Financing Risk (2 < NR ≤ 3)
a. The composition of financing receivable portfolios has large nominal exposure and a high level of portfolio concentration in one sector/area. b. Financing distribution strategy is inadequate.
c. Financing receivable quality is low and the adequacy of provisions made by the company is inadequate.
d. External factors that can impact debtor ability are large.
Criteria for Financing Companies with Very High Inherent Risk in Financing Risk (3 < NR ≤ 4)
a. The composition of financing receivable portfolios has very large nominal exposure and a very high level of portfolio concentration in one sector/area. b. Financing distribution strategy is very inadequate.
c. Financing receivable quality is very low and the adequacy of provisions made by the company is very inadequate.
d. External factors that can impact debtor ability are very large.

MANAGEMENT AND CONTROL

Criteria for Financing Companies with Very Strong Financing Risk Management and Control (0 < MP ≤ 1)
a. Financing risk management is very adequate. b. Financing risk management framework is very adequate.
c. Risk management process, management information systems, and human resources are very adequate.
d. Financing risk control system is very adequate.
Criteria for Financing Companies with Strong Financing Risk Management and Control (1 < MP ≤ 1.5)
a. Financing risk management is adequate. b. Financing risk management framework is adequate.
c. Risk management process, management information systems, and human resources are adequate.
d. Financing risk control system is adequate.
Criteria for Financing Companies with Adequate Financing Risk Management and Control (1.5 < MP ≤ 2)
a. Financing risk management is less adequate. b. Financing risk management framework is less adequate.
c. Risk management process, management information systems, and human resources are less adequate.
d. Financing risk control system is less adequate.
Criteria for Financing Companies with Weak Financing Risk Management and Control (2 < MP ≤ 3)
a. Financing risk management is inadequate. b. Financing risk management framework is inadequate.
c. Risk management process, management information systems, and human resources are inadequate.
d. Financing risk control system is inadequate.
Criteria for Financing Companies with Very Weak Financing Risk Management and Control (3 < MP ≤ 4)
a. Financing risk management is very inadequate. b. Financing risk management framework is very inadequate.
c. Risk management process, management information systems, and human resources are very inadequate.
d. Financing risk control system is very inadequate.

G. CAPITAL SUPPORT RISK (CAPITALIZATION)
Company capitalization represents the company's ability to absorb unexpected losses resulting from the management of the company's assets and liabilities. The topics assessed in this risk are as follows:
1) Funding Ability (capitalization)
Items assessed on this topic include the nominal value of equity and the size of the capital adequacy ratio owned by the company.
2) Additional Funding (capitalization)
Items assessed on this topic include:
(i) the company's profitability level, which includes profit trends, the size of current year profits, future profit projections, and general provisions from net profit; and (ii) additional capital sources, which include the financial conditions of the main controlling entity, the company group, and other shareholders or equivalents.

The following are general indications of capital support (capitalization) risk for each risk value range.

Indication of Companies with Very Strong Capital Strength (0 < NR ≤ 1)
a. The company's capitalization ability is very strong. b. The company's capital addition sources are very high.
Indication of Companies with Strong Capital Strength (1 < NR ≤ 1.5)
a. The company's capitalization ability is strong. b. The company's capital addition sources are high.
Indication of Companies with Adequate Capital Strength (1.5 < NR ≤ 2)
a. The company's capitalization ability is adequate. b. The company's capital addition sources are adequate.
Indication of Companies with Weak Capital Strength (2 < NR ≤ 3)
a. The company's capitalization ability is weak. b. The company's capital addition sources are low.
Indication of Companies with Very Weak Capital Strength Risk (3 < NR ≤ 4)
a. The company's capitalization ability is very weak. b. The company's capital addition sources are very low.

Example Calculation of Financing Company Risk Level

Risk Type | Risk Value (C) | Weight (D) | Net Risk Value (E) --- | --- | --- | ---

Governance | 1.5 | 10% | 0.51
Corporate Governance | 1.6 | 15% | 0.98
Strategy | 2.7 | 10% | 5.31
3.1 Inherent Risk (A) | 2.9 | |
3.2 Management & Control (B) | 2.5 | |
Operational | 1.6 | 20% | 1.31
4.1 Inherent Risk | 1.1 | |
4.2 Management & Control | 2.1 | |
Assets and Liabilities | 3.0 | 15% | 12.15
5.1 Inherent Risk | 2.9 | |
5.2 Management & Control | 3.1 | |
Financing | 2.0 | 30% | 4.8
6.1 Inherent Risk | 2.9 | |
6.2 Management & Control | 1.1 | |
(F) | 100% | | 25.06
Total Net Risk Value (G) | | | 2.24

Capital Support (Capitalization) a. Funding Ability (Capitalization) | 1.2 | 50% | 1.04 b. Additional Funding (Capitalization) | 1.3 | 50% | 1.43 (H) | 100% | | 2.46 Total Capital Support Risk Value (I) | | | 1.25

Weight of Net Risk Value and Capital Support Risk Value | 2/3 : 1/3 Overall Risk Value (J) | | | 2.05 Risk Level: High

Notes:
A: inherent risk value
B: management & control value
C: risk test value = (A+B)/2
D: risk weight
E: combined risk value = C x D
F: sum of combined values = Σ Ci x Di
G: total net risk value = F / 4
H: sum of combined funding values = Σ Ci x Di
I: total capital support risk value = H / 4
J: overall risk value = (G x 4 + I x 4) / 4

Determined in Jakarta on January 29, 2015
EXECUTIVE HEAD OF SUPERVISOR OF
INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY,
Signed.
FIRDAUS DJAELANI
Legal Director I
Legal Department,
Signed.
Sudarmaji

APPENDIX II
FINANCIAL SERVICES AUTHORITY CIRCULAR LETTER
NUMBER 4 /SEOJK.05/2015
CONCERNING
RISK LEVEL ASSESSMENT OF FINANCING COMPANIES

Financing Company Risk Level Assessment Result Report Company Name :
Company Status : (1) Joint Venture (2) National Private (3) State-Owned Enterprise Assessment Date :
Report Date :
A. General Information
Shareholders or equivalents :

Name	Ownership Value	Ownership Percentage
Directors or equivalents :
Name	Position	Term of Office
---	---	---
Commissioners Board or equivalents :
Name	Position	Term of Office
---	---	---

Financial Information as of Assessment Date

Description	Value (Thousand Rupiah)*
Assets
Financing Receivables
Loans
Equity Value
Current Profit/Loss
Capital Adequacy Ratio
Equity to Paid-up Capital Ratio
Financing to Asset Ratio (FAR)
Non Performing Financing (NPF)
Gearing Ratio
Number of Debtors
*except for financial ratios and number of debtors For the one-year period prior to the assessment date

B. Summary of Risk Level Assessment
Risk Type | Risk Value | Risk Weight | Net Risk Value --- | --- | --- | ---
1. Governance | | |
2. Corporate Governance | | |
3. Strategy | | |
3.1 Inherent Risk | | |
3.2 Management and Control | | |
4. Operational | | |
4.1 Inherent Risk | | |
4.2 Management and Control | | |
5. Assets and Liabilities | | |
5.1 Inherent Risk | | |
5.2 Management and Control | | |
6. Financing | | |
6.1 Inherent Risk | | |
6.2 Management and Control | | |
Total Net Risk Value | | |
1. Funding Ability (Capitalization) | | |
2. Additional Funding (Capitalization) | | |
Capital Support (Capitalization) | | |
1. Total Net Risk Value | | |
2. Total Capital Support Risk Value (Capitalization) | | |
Overall Risk Value | | |
Risk Level | | |

C. Risk Description
General Description

Description per Risk Type
Governance Risk Risk Value:.... Risk Level:....
Notes:
Corporate Governance Risk Risk Value: .... Risk Level:....
Notes:
Strategy Risk Risk Value: .... Risk Level:....
Inherent Risk Value:
Notes:
Management and Control Value:
Notes:
Operational Risk Risk Value: .... Risk Level:....
Inherent Risk Value:
Notes:
Management and Control Value:
Notes:
Assets and Liabilities Risk Risk Value: .... Risk Level:....
Inherent Risk Value:
Management and Control Value:
Notes:
Financing Risk Risk Value: .... Risk Level:....
Inherent Risk Value:
Notes:
Management and Control Value:
Notes:
Capital Support (Capitalization) Risk Value: .... Risk Level:....
Funding Ability (Capitalization) Value:
Notes:
Additional Funding (Capitalization) Value:
Notes:
Acknowledged,
Name:
Position:
Prepared by:
Name:
Position:
Determined in Jakarta on January 29, 2015
EXECUTIVE HEAD OF SUPERVISOR OF
INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY,
Signed.
FIRDAUS DJAELANI
Legal Director I
Legal Department,
Signed.
Sudarmaji

APPENDIX III
FINANCIAL SERVICES AUTHORITY CIRCULAR LETTER
NUMBER 5/SEOJK.05/2015
CONCERNING
RISK LEVEL ASSESSMENT OF FINANCING COMPANIES

FOLLOW-UP PLAN FOR RISK LEVEL ASSESSMENT
OF FINANCING COMPANIES
1. Name :
2. Status : (1) Joint Venture
(2) National Private
(3) State-Owned Enterprise
3. Risk Level Assessment Date :
4. Report Date :
5. Risk Level: 6. Risk Value :
7. Risk Type 8. Risk Cause
9. Follow-up Plan
10. Target Time
11. PIC
Prepared by
12. Name : 13. Signature
14. Position :
Acknowledged
15. Name : 16. Signature
17. Position :
Filling Guidelines:
1. Fill in the financing company name.
2. Fill in the financing company type by selecting one from the existing list.
3. Fill in the risk level assessment date that serves as the basis for the follow-up plan.
4. Fill in the date the risk level assessment report was signed.
5. Fill in the financing company's risk level according to the risk level assessment results as referred to in item 3.
6. Fill in the financing company's risk value according to the risk level assessment results as referred to in item 3.
7. Fill in the risk type as referred to in POJK number 10/POJK.05/2014 concerning Risk Level Assessment of Non-Bank Financial Service Institutions.
8. Fill in the risk cause.
9. Fill in the plan for various follow-up steps to be taken to reduce the risk level for each risk area type.
10. Fill in the target time for implementing follow-up actions to be taken for each follow-up step, which can be the completion date of the follow-up or the start and end dates of the follow-up if the target time for starting the follow-up is not immediately after the follow-up plan is drawn up.
11. Fill in the unit responsible for implementing the follow-up.
12. Fill in the name of the official preparing the follow-up plan for the financing company's risk level assessment.
13. Fill in the signature of the official preparing the follow-up plan.
14. Fill in the position name of the official preparing the follow-up plan for the financing company's risk level assessment.
15. Fill in the name of the directors or equivalents in the financing company handling the company's risk management.
16. Fill in the signature of the directors or equivalents in the financing company handling risk management.
17. Fill in the position name of the directors or equivalents in the financing company handling the company's risk management.
Determined in Jakarta on January 29, 2015
EXECUTIVE HEAD OF SUPERVISOR OF
INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY,
Signed.
FIRDAUS DJAELANI
Legal Director I
Legal Department,
Signed.
Sudarmaji