Refining Digital Financial Innovation: New OJK Regulation aims to enhance Regulatory Sandbox

Almost six years ago, Indonesia’s Financial Services Authority (Otoritas Jasa Keuangan – “OJK”) introduced a new regulation on digital financial innovation (inovasi keuangan digital – “IKD”) in financial services (“POJK 13/2018”) (see our Advisory on the OJK regulatory sandbox issued in August 2018). The concept of IKD was further developed with the enactment of Law No. 4 of 2023 on Financial Sector Development and Reinforcement (“P2SK Law”) and is now known as technology innovation in the financial sector (inovasi teknologi sektor keuangan – “ITSK”).

Following the enactment of the P2SK Law, the OJK has introduced a new regulation, OJK Regulation No. 3 of 2024 on the Organization of Financial Sector Technology Innovation (“POJK 3/2024”), aimed at further regulating ITSK. This regulation supersedes POJK 13/2018, which previously governed IKD. The OJK has enhanced several aspects of POJK 13/2018 through POJK 3/2024, including the addition of eligibility criteria, the introduction of test plan requirements, and the establishment of procedures for determining results and exiting the sandbox.

ITSK Development

Since its introduction in 2018, the concept of IKD/ITSK has undergone significant development. According to the OJK’s routine official publication on IKD/ITSK, as of November 2023, at least 97 IKD/ITSK organizers (“Organizer”) had been recorded by the OJK and 4 of them have received “Recommended” status from the OJK. These Organizers cover 14 types of IKD/ITSK clusters, including innovative credit scoring, aggregators, transaction authentication, E-KYC, wealth tech, insurance tech, and insurance hubs.

POJK 3/2024 vs. POJK 13/2018: What’s new in POJK 3/2024?

The provisions of POJK 3/2024 on ITSK mostly mirror those of POJK 13/2018. Under POJK 3/2024, Organizers are required to comply with OJK licensing requirements before they commence their business activities. Below are a few of the main differences and updates in the new regulation.

A.   ITSK Organizers

Organizers are parties who organize a technology-based innovation that impacts products, activities, services, and business models in the digital financial ecosystem. They can be either:

1. Financial services institutions (Lembaga Jasa Keuangan); or
2. Other parties conducting activities in the financial sector in accordance with the prevailing laws and regulations.

An ITSK organizer must be a limited liability company or other legal entity recognized under the prevailing laws and regulations.

B.   ITSK Scope

Under POJK 3/2024, there are two main differences in the scope of ITSK activities compared to IKD.

First, the scope of ITSK, that falls under the authority and supervision of the OJK, has been expanded to include activities related to crypto assets, which previously came under the authority of the Commodity Futures Trading Supervisory Agency (Badan Pengawas Perdagangan Berjangka Komoditi – BAPPEBTI).

Second, insurance activities, previously covered in POJK 13/2018, are now not specifically included in the scope of ITSK activities in POJK 3/2024.

The scope of ITSK activities related to digital financial assets under POJK 3/2024 are now as follows:

• the settlement of securities transactions;
• raising capital;
• investment management;
• risk management;
• the collection and distribution of funds;
• providing market support;
• activities related to digital financial assets, including crypto assets; and
• other digital financial services activities.

C.   Regulatory Sandbox Process

POJK 3/2024 uses a similar mechanism for Organizers to participate in the sandbox process. Under the previous regulation (POJK 13/2018), participation in the regulatory sandbox involved the use of the recordation mechanism within the OJK system. Organizers would initially submit a recordation application to the OJK along with the required documents. Following the recording process, the OJK would determine which Organizers could participate in the regulatory sandbox, provided they fulfilled the minimum criteria.

Similarly, POJK 3/2024 requires Organizers to submit an application to join the regulatory sandbox. The difference in POJK 3/2024 is that this ‘application stage’ no longer recognizes the recordation step which was introduced by POJK 13/2018. Now, Organizers who wish to undergo the regulatory sandbox merely apply to become a ‘participant’ in the OJK regulatory sandbox. This application should include an application form, test plan, and other supporting documents. The OJK will then evaluate the test plan of potential participants of the regulatory sandbox. If the OJK deems that improvements are necessary to the test plan, participants must make these improvements and resubmit the revised test plan to the OJK.

In brief, under POJK 3/2024, the updated regulatory sandbox process is as follows:

1. Submission of application documents to become a participant, including the application form, test plan, and supporting documents.
2. Approval by the OJK to participate in the regulatory sandbox.
3. Conducting the regulatory sandbox process, with a maximum duration of one year.
4. Evaluation of the sandbox process results, determining a pass or fail outcome.
5. In the event of a failure result, Organizers must cease all business activities and implement their exit policy program.
6. If the sandbox result is a pass, Organizers must apply for a business license from the OJK.

D.   Test Plan

Before becoming a participant in the sandbox process, Organizers must submit a test plan, which should include, among other details:

• An explanation of the product innovation, activities, services, or business models to be tested and developed.
• Identification of potential risks associated with the innovation of products, activities, services, or business models.
• Implementation plan for mitigating potential risks.
• Limitations of the implementation of the testing and development of innovation, including the testing period required, target consumer profiles, number of consumers, testing and development partners, number of transactions, and other measurable limitations.
• Consumer protection framework, including consumer complaint services and compensation mechanisms.
• Financial readiness and resources available to conduct the testing and development of the innovation.
• Exit and transition policies if the tested and developed innovation cannot continue after the sandbox process.
• Testing and development scenarios for the innovative products, activities, services, or business models to be tested and developed.
• Key performance indicators for the testing and development scenarios.

This test plan requirement is newly introduced in POJK 3/2024 and is a more detailed version of the business plan required under the previous POJK 13/2018 regime.

E.    Eligibility Criteria

POJK 3/2024 introduces a set of criteria used to assess whether an Organizer may participate in the regulatory sandbox. These ‘Eligibility Criteria’ include:

• Innovations with a scope of coverage in the financial services sector, to be used by consumers, partners, or the public in Indonesia.
• Innovations with an element of novelty or a significant differentiating element from existing practices in the financial sector.
• Innovations that provide benefits, improve services, and add value to consumers, the public, or the financial sector ecosystem.
• Innovations that are ready for testing and development.
• Innovations that require trial and development support and have not been regulated or supervised previously under financial sector regulations.
• Other criteria determined by the OJK.

These criteria are established to guide the OJK in determining the eligibility of Organizers’ innovations for participation in the sandbox process. Based on these criteria, the OJK will either approve or reject an Organizer's application. Further provisions regarding eligibility criteria and approval will be issued by the OJK.

ITSK Sandbox Results

The mechanism for determining sandbox results is different under POJK 3/2024 compared to 13/POJK.02/2018. Under POJK 13/2018, the regulatory sandbox results for the Organizer were categorized as (i) recommended, (ii) improvement, or (iii) not recommended. Meanwhile, POJK 3/2024 specifies that the sandbox results are simply categorized as pass or fail, without providing Organizers an opportunity to improve their test results.

Under POJK 3/2024, after conducting tests and developing innovations in the sandbox, an Organizer must submit a final report on the implementation of the innovation testing and the development of its business. Subsequently, the OJK will evaluate the sandbox results and decide whether the Organizer has passed or failed. If the Organizer has passed the sandbox testing, it must apply for a business license from the OJK within the effective term of the approval letter.  This approval letter is not a business license for the Organizer to carry out commercial activities. However, the licensing process is yet to be regulated under POJK 3/2024, which only stipulates that the business licensing process will follow OJK regulations on licensing and supervision for each type of ITSK.

Reporting Obligations

POJK 3/2024 sets out new reporting obligations for organizers registered or licensed by the OJK. The reporting obligations consists of two reports:

• Monthly Report: Organizers must submit a monthly report to the OJK within 10 working days after the reporting period ends.
• Annual Report: An annual report must be submitted no later than April 30 of the following year.

Other Matters and Transitional Provisions

• Organizers registered or licensed by the OJK is required to maintain both a data center and data recovery centers in Indonesia.
• Organizers Undergoing registration application and participants of the regulatory sandbox under POJK 13/2018 after the issuance of POJK 13/2018 are given one of three statuses: (a) recommended with the obligation to register or obtain a license from the OJK; (b) recommended without the obligation to register or obtain a license from the OJK; or (c) not recommended. This must be completed within six months from the effective date of POJK 3/2024.
• The enactment of POJK 3/2024 revokes POJK 13/2018, along with all of its implementing regulations.

-----

Click the "download file" button to read the PDF version.

If you have any questions, please contact:

1. Maria Sagrado, Managing Partner – maria.sagrado@makarim.com
2. Mawira Aruna Sudarmadi, Associate - mawira.sudarmadi@makarim.com
3. Muhammad Alfitras Tavares, Associate - alfitras.tavares@makarim.com

_{M&T Advisory is a digital publication prepared by the Indonesian law firm, Makarim & Taira S. It informs generally on the topics covered and should not be treated as legal advice or relied upon when making investment or business decisions. Should you have any questions on any matter contained in M&T Advisory, or other comments in general, please contact us at the emails provided at the end of this article.}