Raising the Bar for Consumer Protection: Key Updates Under Bank Indonesia Regulation No. 6 of 2026

Issue 33, September 2026

Bank Indonesia has issued Bank Indonesia Regulation Number 6 of 2026 on Consumer Protection (“BI Reg. 6/2026”), which revokes and replaces Bank Indonesia Regulation Number 3 of 2023 (“BI Reg. 3/2023”). BI Reg. 6/2026 came into effect on 30 June 2026, with a six-month transition period, applicable to the following providers supervised by Bank Indonesia (“Providers”):

1. Providers in the payment system industry, namely: Payment System Providers, Payment Infrastructure Providers, and banks;
2. Providers in the Money Market and Foreign Exchange Market; and
3. Other providers designated by Bank Indonesia.

Compared with BI Reg. 3/2023, BI Reg. 6/2026 expands Providers’ operational obligations and introduces more stringent market conduct oversight before, during, and after the provision of products and services. BI Reg. 6/2026 is also broadly aligned with Indonesia’s personal data protection regime under Law No. 27 of 2022 on Personal Data Protection, and its newly enacted implementing regulation, Government Regulation No. 33 of 2026 (the “PDP Law”). For example, it reinforces a consent-based approach to the processing of consumer data, and is consistent with the principles under the PDP Law concerning data subject rights and the protection of personal data in the context of cross-border transfers. Accordingly, Providers should consider BI Reg. 6/2026 alongside their existing obligations under the PDP Law when reviewing their data protection practices.

This advisory highlights several key changes under BI Reg. 6/2026.

A. Consumer Protection Beyond the End Consumers

BI Reg. 6/2026 broadens the definition of “consumer”, and therefore its interpretation should not be limited to end consumers, but should also include intermediate consumers, i.e. parties that use products and/or services provided by a Provider in the course of providing products and/or services to another party. 

Accordingly, a business customer should not necessarily be regarded as outside the scope of “Consumer” merely because it is not the ultimate end-user of the relevant product and/or service.

B. Strengthened Provisions in the Standard-Form Agreement

BI Reg. 6/2026 introduces more stringent requirements for standard-form agreements, and Providers must align their existing standard-form agreements with the requirements under BI Reg. 6/2026 no later than six months after BI Reg. 6/2026 came into effect. While the prohibited clauses generally remain consistent with those under BI Reg. 3/2023, BI Reg. 6/2026 now expressly prohibits Providers from providing consumers’ data and information to third parties without the consumers’ prior consent, which is in line with the spirit of Indonesia’s personal data protection law.

BI Reg. 6/2026 also introduces minimum requirements for standard-form agreements, together with compliance reviews and adjustments where necessary. Each standard-form agreement must contain the following minimum requirements, which must be clearly disclosed to consumers before they agree to use the relevant product or service:

1. The rights and obligations of the parties;
2. Fees and charges;
3. Consumer data protection;
4. Transaction security;
5. Complaint handling procedures;
6. Dispute resolution mechanisms; and
7. Termination of the agreement.

In relation to complaint handling requirements, BI Reg. 6/2026 now introduces a new authority for Bank Indonesia to appoint third parties to conduct consultation and facilitation processes. While in BI Reg. 3/2023 consumer complaints were already addressed through education, consultation, and facilitation, those processes were carried out by Bank Indonesia without expressly providing for the appointment of third parties.

Providers must also conduct a specific “compliance test” before a standard-form agreement is used and obtain approval from the Board of Directors or its equivalent. The assessment must include, at a minimum:

1. Identification of clauses that could potentially harm consumers;
2. An assessment of the agreement’s readability and comprehensibility; and
3. An evaluation of the proportionality of the parties’ rights, obligations, and responsibilities, as well as the reasonableness of fees, penalties, and changes to the provisions.

C. The Obligation to Establish a Consumer Protection Unit and Conduct Self-Assessments

Under BI Reg. 3/2023, Providers were required to employ competent personnel to perform consumer protection functions, but were not required to establish a separate unit.

BI Reg. 6/2026 now requires Providers to establish a separate consumer protection unit responsible for implementing consumer protection measures. This unit must be established no later than six months after BI Reg. 6/2026 came into effect.

The consumer protection unit is responsible for the comprehensive implementation of consumer protection, including managing consumer-related risks, handling complaints, and overseeing compliance with consumer data and information protection provisions within the Providers’ organization.

BI Reg. 6/2026 also requires Providers to conduct self-assessments of their consumer protection implementation. These self-assessments must be formally documented and reported periodically to Bank Indonesia to ensure continuing compliance.

Based on these reports, Bank Indonesia will validate and map the market conduct profiles of the relevant Providers. This differs from BI Reg. 3/2023, under which oversight of Providers’ market conduct was entirely within Bank Indonesia’s authority and Providers were not expressly required to conduct structured self-assessments. 

D. Implementation and Transition

As BI Reg. 6/2026 has only recently come into effect, there is currently limited practical guidance or enforcement experience regarding its implementation. The regulation also sets out several requirements at a relatively general level. Further guidance and more detailed implementation requirements may therefore be expected through its implementing regulations.

Providers should also take advantage of the six-month transition period to review and align their existing consumer protection framework with BI Reg. 6/2026. In particular, Providers that did not have a dedicated consumer protection unit prior to the enactment of BI Reg. 6/2026 must establish such a unit and comply with the applicable requirements no later than six months from 30 June 2026. Similarly, standard-form agreements entered into before BI Reg. 6/2026 came into force must be brought into compliance within the same six-month period. Accordingly, Providers should consider commencing a gap assessment of their existing consumer protection policies, governance arrangements, and data protection practices while awaiting further implementing guidance from Bank Indonesia.

-----

Click the "download file" button to read the PDF version.

If you have any questions, please contact

1. Frederick Simanjuntak, Partner - frederick.simanjuntak@makarim.com
2. Kaila Arinta Nazneen Z, Associate - kaila.nazneen@makarim.com

_{M&T Advisory is a digital publication prepared by the Indonesian law firm, Makarim & Taira S. It informs generally on the topics covered and should not be treated as legal advice or relied upon when making investment or business decisions. Should you have any questions on any matter contained in M&T Advisory, or other comments in general, please contact us at the emails provided at the end of this article.}