Redrawing the Rules: Bank Indonesia’s New Payment System Regime

Issue 6, January 2026

Bank Indonesia has introduced a new regulatory framework for Indonesia’s payment systems industry, which will take effect on 31 March 2026.

The new framework revokes previous “umbrella” regulation that has applied since 1 July 2021, while allowing existing rules for Payment Services Providers (“PJP”) and Payment System Infrastructure Providers (“PIP”) to remain in force, provided they are not inconsistent with the regime. The framework is set out in Bank Indonesia Regulation No. 10 of 2025 and its implementing regulation, Members of the Board of Governors Regulation No. 32 of 2025 (together, the “Regulations”).

Parties that have obtained a PJP license or PIP designation before the Regulations take effect will continue to be recognized as licensed providers. These entities (collectively, Payment Service Providers or “PSPs”), may also continue to apply existing operational standards, provided those standards do not conflict with the Regulations. The same approach applies to Supporting Providers  (a party that conducts activities to support the operation of payment system services and/or payment system infrastructure carried out by PSP).

This Advisory highlights the key new provisions and Bank Indonesia’s updated licensing approach introduced under the Regulations.

A. Recognized Activities

For PIPs, the changes introduced under the Regulations are not particularly significant, as designation as a PIP continues to be granted for clearing activities and final settlement activities. More substantive changes are introduced in relation to PJPs.

Under the previous regulatory regime, Bank Indonesia categorized PJP licenses based on the scope of activities conducted by each PJP. Under the Regulations, this approach has been refined. Rather than issuing licenses by type, Bank Indonesia now determines packages of PJP activities (bundling), structured around the specific activities carried out by the PJP.

Each PJP must hold a license that reflects the relevant activity bundle applicable to its business model, as follows.

Bundling Activity 1
This bundle covers activities that are closest to the core handling of funds and the end-to-end processing of payment transactions, consisting of:

1. Administration of sources of funds, which includes:
   a) administration of payment accounts; and
   b) issuance and/or provision of access to source of funds.
2. Forwarding of payment transactions, which includes:
   a) forwarding of payment transaction data and payment instructions, which may be accompanied by facilitation of receipt of payment proceeds through the provision of sub-accounts to merchants or service providers; and
   b) forwarding of fund transfer instructions, whether conducted digitally or non-digitally.

Bundling Activity 1 consists of two sub-packages:

1. Bundling Activity 1A, which may only be carried out by PJPs classified as primary PSPs, reflecting the higher systemic importance and risk profile associated with these activities; and
2. Bundling Activity 1B, which may be carried out by PJPs classified as non-primary PSPs.

Bundling Activity 2
This bundle covers payment forwarding activities that do not include the administration of sources of funds, consisting of:

1. forwarding of payment transaction data and payment instructions, which may be accompanied by facilitation of receipt of payment proceeds; and
2. forwarding of fund transfer instructions, whether conducted digitally or non-digitally.

Bundling Activity 3
This bundle covers the forwarding of non-digital fund transfer instructions.

B. Transaction, Interconnection, Competence, Risk Management, and Information Technology Infrastructure (TIKMI) Assessment

The Regulations introduce the TIKMI assessment, a new assessment framework used by Bank Indonesia to evaluate a PSP’s performance and to determine its classification as either a primary PSP or a non-primary PSP.

From a procedural perspective, the TIKMI assessment begins with a self-assessment by the PSP, which must be submitted to Bank Indonesia within the prescribed timelines. Bank Indonesia will then conduct its own TIKMI assessment and formally determine the assessment results.

For primary PSPs, the TIKMI assessment is conducted at least once every six months. The self-assessment must be submitted by:
a) 1 February, covering assessment data for July–December of the preceding year; and
b) August, covering assessment data for January–June of the current year.
Bank Indonesia will determine the assessment results in March and September.

For non-primary PSPs, the TIKMI assessment is conducted:
a) at least once every six months for the transaction and interconnection criteria; and
b) at least once a year and at most once every three years for the competence, risk management, and information technology infrastructure criteria.

The self-assessment must be submitted by 1 February, covering data for the January–December period of the preceding year. Bank Indonesia will determine the assessment results in September.

For PSPs that have not yet been classified as either primary or non-primary, the initial TIKMI assessment will be conducted in accordance with the assessment period applicable to non-primary PSPs. The initial determination of the TIKMI assessment results for PSPs will be made by Bank Indonesia no later than 1 April 2027, based on the relevant self-assessment submissions.

C. License Adjustments

Under the Regulations, Bank Indonesia will conduct an evaluation of the activities currently carried out by PSPs. This evaluation will serve as the basis for determining the adjustment of activity bundling and the classification of PSPs, taking into account compliance with applicable licensing requirements and the results of the TIKMI assessment.

Based on the outcome of this evaluation, Bank Indonesia will:

1. align the activities attached to an existing PJP license or PIP designation obtained before the Regulations take effect with the relevant activity bundles (for PJPs) or activities (for PIPs) under the Regulations; and
2. reclassify existing classifications of PJPs and PIPs that were previously designated as systemic, critical, or general payment system operators into the new PSP classifications of primary PSP or non-primary PSP.

Bank Indonesia will communicate the results of this evaluation in writing to the relevant PJP or PIP no later than 31 March 2027.

D. SBP and RBSP Submission

The Regulations introduce a new requirement for PSPs to prepare and submit a Strategic Business Plan (SBP) and a Payment System Business Plan (RBSP) to Bank Indonesia.

Both documents must be submitted to Bank Indonesia but are subject to different regulatory treatments. The SBP will be reviewed by Bank Indonesia and may be subject to revision requests, while the RBSP requires formal approval from Bank Indonesia.

The first submission of the SBP and RBSP must be made no later than 30 April 2026. Thereafter, both must be submitted annually by 30 November. The Regulations do not yet provide specific templates or standard reporting formats for either document.

A PSP may amend its SBP once a year, with any amendment reflected in the corresponding RBSP. The RBSP may also be amended once a year, provided that the amendment is submitted no later than the end of the business day in June of the relevant RBSP period.

The SBP is prepared for a three-year period and must include, at a minimum:

1. vision, mission, and strategic direction;
2. analysis of the business environment, opportunities, and challenges;
3. management policies and strategies;
4. implementation of risk management;
5. business activity plans and strategic development plans; and
6. financial projections, including transaction projections.

The RBSP is prepared for a one-year period and must include, at a minimum:

1. results of supervision by the Board of Commissioners;
2. accountability of the Board of Directors;
3. changes to the SBP;
4. realization of the RBSP for the previous period; and
5. business activity plans and development plans.

The first SBP must cover the 2026–2028 period, while the first RBSP applies to the 2026 period.

E. Ongoing Capital

Under the Regulations, PSPs are required to comply with ongoing capital requirements, broadly in line with the previous payment systems regulatory regime. While the overall framework remains familiar, the Regulations introduce adjustments to capital thresholds through additional capital surcharges based on a PSP’s risk profile.

For PJPs, an additional capital surcharge applies as follows:
a) 1.5% of risk-weighted transactions for PJPs with a transaction and interconnection assessment rating of moderate to high; and
b) 2.5% of risk-weighted transactions for PJPs with a transaction and interconnection assessment rating of high.

For PIPs, the additional capital surcharge applies as follows:
a) 2.5% of risk-weighted transactions for PIPs with a transaction and interconnection assessment rating of moderate to high; and
b) 5% of risk-weighted transactions for PIPs with a transaction and interconnection assessment rating of high.

Notwithstanding these adjustments, the composition of ongoing capital remains broadly consistent with the previous Bank Indonesia regulatory framework.

F. Cooperation with Supporting Providers

Under previous Bank Indonesia regulations, cooperation with Supporting Providers was governed by a risk-based approach. The Regulations refine this approach by introducing a clearer categorization of Supporting Providers, namely:

1. Critical Supporting Providers, being those providing supporting services to primary PSPs and/or PSPs other than primary PSPs above a certain threshold value;
2. Important Supporting Providers, being those providing supporting services to PSPs other than primary PSPs above a certain threshold value; and
3. Standard Supporting Providers, being those providing supporting services that are not related to the stages of payment transaction processing, including initiation, authorization, clearing, and final settlement.

To strengthen supervision over key third-party arrangements, Critical Supporting Providers and Important Supporting Providers must be registered with Bank Indonesia, or another party appointed by Bank Indonesia, within three years from the effective date of the Regulations, i.e. by 31 March 2029. PSPs may only cooperate with Critical or Important Supporting Providers that have been duly registered.

The Regulations also introduce a more structured approval regime for product developments and third-party cooperations. A PSP must obtain Bank Indonesia’s approval for any development or cooperation that affects payment transaction processing (including initiation, authorization, clearing, and final settlement), as well as pre-transaction and post-transaction activities. For this purpose, PSPs must refer to the RBSP approved by Bank Indonesia.

Depending on the nature of the development, approval is obtained through:

1. an approval mechanism for complex developments and developments that result in an increase in the activity bundle; or
2. a reporting mechanism for standard developments, which must be submitted no later than 10 working days after the implementation date.

Following implementation, PSPs must report the realization of approved developments and cooperations, together with supporting documents, to Bank Indonesia through the RBSP for the subsequent period and no later than 10 business days after commencement of the relevant activity or cooperation.

-----

Click the "download file" button to read the PDF version.

If you have any questions, please contact:

1. Maria Sagrado, Managing Partner – maria.sagrado@makarim.com
2. Budhy Apriastuti Evita, Senior Associate – budhy.apriastuti@makarim.com
3. Kaila Arinta Nazneen, Associate – kaila.nazneen@makarim.com

_{M&T Advisory is a digital publication prepared by the Indonesian law firm, Makarim & Taira S. It informs generally on the topics covered and should not be treated as legal advice or relied upon when making investment or business decisions. Should you have any questions on any matter contained in M&T Advisory, or other comments in general, please contact us at the emails provided at the end of this article.}