As the year 2023 drew to a close, Indonesia’s Financial Services Authority (Otoritas Jasa Keuangan – “OJK”) issued several new regulations of note, including Regulation No. 22 of 2023 on Consumer and Public Protection Within the Financial Services Sector (“Regulation 22/2023”). This new framework has been issued as a part of efforts to further strengthen consumer and public protection within the financial services sector and to harmonize various OJK regulations that previously addressed similar matters.

The issuance of Regulation 22/2023 has been in the public spotlight recently, as it has the potential to address various existing issues within the public sphere and to adapt to a rapidly developing digital landscape. Provisions introduced under this new regulation emphasize the obligation to ensure the security of information systems and cyber resilience during the organization of financial services business activities. Furthermore, significant public interest has also been shown in the various provisions that set out the requirements and procedures for debt collection activities, as they directly address several cases that have emerged in recent years and that have involved threats, violence and intimidation being used during debt collection activities.

In addition to harmonizing and strengthening the existing OJK provisions on consumer and public protection, Regulation 22/2023 will also hopefully fulfill the various mandates that were originally introduced under the framework of Law No. 4 of 2023 on the Development and Strengthening of the Financial Sector (“P2SK Law”). In this regard, certain provisions originally introduced under the P2SK Law have now been further detailed through an implementing legal framework.

Regulation 22/2023 came into force on 22 December 2023, repealing certain articles related to consumer and public protection that previously featured under the following legal instruments:

1. Regulation of the OJK No. 3 of 2023 on the Enhancement of Financial Literacy and Inclusion Within the Financial Services Sector for Consumers and the General Public (“Regulation 3/2023”);
2. Regulation of the OJK No. 10/POJK.05/2022 of 2022 on Information Technology-Based Co-Funding Services (“Regulation 10/2022”);
3. Regulation of the OJK No. 31/POJK.07/2020  of 2020 on the Organization of Consumer and Public Services by the OJK Within the Financial Services Sector (“Regulation 31/2020”);
4. Regulation of the OJK No. 18/POJK.07/2018 of 2018 on Consumer Complaints Services Within the Financial Services Sector (“Regulation 18/2018”);
5. Regulation of the OJK No. 10/POJK.05/2019  of 2019 on the Organization of Sharia Financing Companies and Sharia Business Units of Financing Companies (“Regulation 10/2019”); and
6. Regulation of the OJK No. 35/POJK.05/2018 of 2018 on the Organization of the Business Activities of Financing Companies (“Regulation 35/2018”).

The provisions introduced under Regulation 22/2023 will apply to various actors operating within the financial services sectors, as detailed below (collectively referred to as “PUJK”):

Regulation 22/2023 encompasses 125 chapters spanning 13 chapters, which address various aspects of consumer and public protection and which feature adjusted provisions, newly introduced provisions, as well as long-standing provisions that apply within the financial services sector. In order to dive deeper into the adjusted and newly introduced provisions that feature under Regulation 22/2023, our analysis has been divided up as follows:

1. General Provisions on PUJK Business Organization

1. Verification of Consumers and Partnerships
2. Legal Protections for PUJK
3. Exchanges and Transfers of Data and/or Information
4. IT Security and Cyber Resilience
5. Financial Literacy and Inclusion
6. Design, Marketing and Dissemination of Information

2. Consumer Protection Aspects of PUJK Business Activities

1. Rights and Obligations of Customers
2. Agreements on the Use of Products and/or Services
3. Protection of Data and Information
4. Provision of Services by PUJK
5. Debt Collection and the Confiscation of Collateral
6. Reporting Channels for Customers

3. Dispute Resolution and Applicable Sanctions

1. Administrative Sanctions
2. Dispute Resolution Mechanisms

 

I.    General Provisions on PUJK Business Organization

 

A.   Verification of Consumers and Partnerships

In order to ensure that the general public is adequately protected, Regulation 22/2023 has introduced a new set of provisions that specifically prohibit PUJK from offering any products and/or services to parties that are not licensed by the OJK or Bank Indonesia (“BI”). This means that PUJK may not take consumers from and/or cooperate with unlicensed parties.

Moreover, the prohibited parties listed in the applicable provisions include individuals, companies, joint ventures, associations and other organized groups that engage in any of the following types of business activities:

1. Collection of funds from the public and/or distribution of funds to the public;
2. Issuance of publicly offered securities;
3. Provision of payment system services and/or products; and
4. Other equivalent activities.

For example, PUJK are prohibited from cooperating with illegal online lending companies (pinjol illegal). However, it should be noted that this prohibition does not apply in cases where said parties are in the process of submitting their license applications (e.g. through the regulatory sandbox).

In cases where PUJK identify unlicensed parties among their consumers, then they are obliged to report said consumers to the OJK.

 

B.   Legal Protections for PUJK

While the majority of the provisions set out under Regulation 22/2023 cover the areas of consumer and public protection, as they relate to PUJK, it is interesting to note that this new framework also ensures that PUJK have the right to enjoy legal protections from consumers that engage in bad faith behavior, such as:

1. Providing inaccurate, invalid, false and/or misleading information and/or documents;
2. Refusing to comply with their obligations, as set out under the relevant agreements, and inciting threats or violence;
3. Handing over collateral for their credits and/or financing to third parties without the permission of PUJK; and
4. Submitting collateral that was obtained through criminal activities.

Accordingly, PUJK have the right to ensure the good faith of their potential consumers and/or consumers by implementing the following measures:

1. Factually reviewing the validity and accuracy of documents that contain information that relates to their consumers and/or prospective consumers;
2. Requesting that their consumers and/or prospective consumers affirm the validity and accuracy of all information and/or documents that are submitted to PUJK; and/or
3. Other measures (e.g. requesting that consumers comply with the terms of agreements or provisions that are set under applicable laws and/or regulations).

 

C.   Exchanges and Transfers of Data and/or Information

Under certain conditions, PUJK are permitted to exchange data and/or information, provided that said exchanges comply with the principles of personal data protection. Said conditions break down as follows:

1. Consumers must provide written consent; and/or
2. PUJK are obliged to complete transfers in accordance with applicable laws and regulations.

Exchanges of consumer data and/or information may be carried out directly by PUJK and/or through the utilization of integrated data processing infrastructure provided by the OJK.

In addition to exchanges of consumer data and/or information, PUJK are also permitted to transfer consumer data and/or information to other parties who are located outside of Indonesian legal jurisdiction. In this regard, said foreign transfers must comply with the following requirements:

1. For the data of individual consumers, transfers must be completed in compliance with the personal data protection principles, as set out under the relevant laws and regulations; and
2. For the data of corporate consumers, PUJK must ensure that the receiving state has an equivalent or higher level of personal data protection in place.*

*) Alternatively, PUJK must ensure the existence of an adequate and binding commitment to personal data protection, as proven through:

• An interstate agreement between the resident state of the PUJK and the receiving state;
• Binding company regulations; and/or
• Other adequate data protection instruments.

In cases where the above-mentioned requirements for transfers of corporate consumers’ data are not met, PUJK must secure customer consent for said transfers.

 

D.   IT Security and Cyber Resilience

During the organization of their business activities, PUJK must safeguard the security of their information systems and their cyber resilience in order to ensure that their consumers are adequately protected. In fulfilling these obligations, PUJK are obliged to perform the following activities:

 

 

It must also be ensured that PUJK have adequate cyber-resilience information systems in place and operate in compliance with the applicable sectoral laws and regulations.

 

E.   Financial Literacy and Inclusion

Financial literacy and inclusion were previously regulated under Regulation 3/2023. In this regard, while the sections above mainly cover newly introduced provisions, it should be noted that provisions relating to this specific area have only been subject to several adjustments. As a result, the framework of Regulation 3/2023 has only been partially revoked and replaced.

Generally speaking, the obligations of PUJK as regards financial literacy and inclusion remain unchanged, as summarized below:

1. Must carry out activities aimed at empowering consumers and/or improving public financial literacy and inclusion as annual programs;
2. Said programs must be implemented once per semester at the minimum;
3. The organization of these activities must be documented; and
4. Must comply with various applicable organizational requirements, as set out under Regulation 3/2023.

In addition, PUJK must also comply with various reporting obligations, which include the submission of the following reports to the OJK:

1. Reports on Financial Literacy Plans;
2. Reports on the Realization of Financial Literacy;
3. Reports on Financial Inclusion Plans; and
4. Reports on the Realization of Financial Inclusion.

Both regulations permit PUJK to make adjustments or changes to plan reports that have already been submitted. In this regard, Regulation 22/2023 has now extended the timeframe during which PUJK may submit proposed changes and adjustments from only 20 days to 30 days.

Furthermore, Regulation 22/2023 also sets out the reporting deadlines for PUJK that will apply during 2024, as summarized in the table below:

It should also be noted that various adjustments have been made to the administrative sanctions that may be imposed in relation to acts of non-compliance with the above-outlined obligations, which will be further elaborated upon along with the harmonization of administrative sanctions in Section III. A below.

 

F.    Design, Marketing and Dissemination of Information

When designing products and/or services, PUJK must ensure their compatibility with their target consumers by taking the following factors into consideration:

1. Consumer needs and capabilities; and
2. Compatibility of features, risks and costs.

In addition to the above-listed obligations on the design of products and/or services, PUJK are also subject to the following obligations:

1. Must perform testing on their products and/or services, evaluate the results of said tests and address any results that could potentially result in consumer losses; and
2. Must have guidelines in place that are capable of determining the values/prices and/or costs of products and/or services.

Furthermore, when marketing their products, PUJK are now obliged to provide summaries of information that relates to their products and/or services (ringkasan informasi produk dan layanan – “RIPLAY”), which must be drawn up in two versions: general version and personalized version, which should be specifically adjusted to the needs of potential customers. This obligation is also applicable to PUJK who provide Investment-Linked Insurance Plans (“Unit Links”).

Generally speaking, RIPLAY must contain information that relates to the relevant products and/or services, as well as simulations/illustrations and/or historical projections of the performances of relevant products and/or services. The content of RIPLAY must be more comprehensive than Unit Link products and must include, for example, the applicable grace periods and free trial periods.

In terms of marketing and the dissemination of information on products and/or services that are provided by PUJK, Regulation 22/2023 sets out several prohibitions and obligations, as summarized in the table below:

 

 

In addition to the above-listed obligations, the marketing of Unit Link products must be undertaken in line with a different set of obligations, as summarized below:

 

 

In terms of obligations, PUJK are prohibited from receiving any premiums or contributions prior to any insurance being provided in accordance with the underwriting requirements of PUJK.

By way of comparison, Regulation 31/2020 previously regulated matters pertaining to consumer protection within the financial services sector, however, Regulation 22/2023 clearly offers a more comprehensive set of provisions with a more extensive breadth of coverage in relation to the subject matter, particularly regarding the design and marketing of products and/or services.

 

II.  Consumer Protection Aspects of PUJK Business Activities

 

A.   Rights and Obligations of Customers

In comparison with Regulation 31/2020, which was the previous OJK legal framework to address the issue of consumer and public protection, Regulation 22/2023 now contains a specific chapter that explicitly addresses the rights and obligations of consumers. Before discussing the organization of consumer protection by PUJK, the following section will first offer a summary of the rights and obligations of consumers, as provided under Chapter IV of Regulation 22/2023.

 

 

In cases where consumers and/or potential consumers fail to comply with the obligations outlined above, then PUJK may delay, limit, reject, refuse to provide services and/or impose fines in accordance with the relevant agreements upon any non-compliant parties.

 

B.   Agreements on the Use of Products and/or Services

When drawing up agreements on the use of products and/or services by consumers, PUJK must comply with a set of provisions that range from the content of agreements to the conduct of PUJK prior to concluding agreements with consumers.  Generally speaking, agreements must be drawn up in a balanced, fair and reasonable manner by PUJK. Said agreements must be provided in written form in Bahasa Indonesia and must contain the following information:

1. Cost of the relevant products and/or services;
2. Commission/fee for the services, as obtained through payments that are made by consumers, if applicable; and
3. Dispute resolution method (i.e. court or alternative means).

While the use of standard agreements that utilize standard clauses is permitted, PUJK must be aware that certain uses of exoneration or exemption clauses are prohibited, for example:

1. Stating that PUJK may unilaterally amend the terms of an agreement after it has been concluded;
2. Limiting the rights of consumers to press charges against PUJK in cases where disputes emerge; or
3. Granting PUJK the authority to prevent or limit the applicability of certain clauses.

Prior to concluding agreements with potential consumers, PUJK are obliged to provide an understanding of the costs, benefits, risks, rights and obligations of said potential consumers. Upon providing such information, potential consumers must be given a proper amount of time in which to gain a full understanding of the relevant clauses. The understanding of potential consumers on the clauses that are contained within agreements must be confirmed by the relevant PUJK through documents or other media prior to the signing of said agreements.

In line with the reasonableness principle, PUJK must provide a minimum of two business days prior to the implementation of an agreement for products and/or services with long applicability periods and/or that are complex in nature. Furthermore, in cases where circumstantial changes could potentially affect the terms of an agreement, PUJK must inform the relevant consumers at least 30 business days prior to the implementation of any such changes.

It should be noted that the content of Unit Link agreements and clauses that are prohibited for use in Unit Link agreements may differ from those that apply in relation to general agreements on the use of products and/or services.

 

C.   Protection of Data and Information

PUJK are obliged to ensure the confidentiality and security of their consumers’ data and/or information by implementing the basic processing principles for personal data protection, as provided under the relevant laws and regulations. This obligation applies to the data and/or information of both individual and corporate consumers.

When processing the data and/or information of consumers, PUJK are permitted to cooperate with third parties, provided that the obligation to ensure the confidentiality and security of data and/or information is fulfilled. Furthermore, PUJK must also grant access to consumers to copies of their data and/or information in accordance with provisions set under relevant laws and regulations.

In terms of the protection of consumers’ data and information, PUJK are prohibited from:

1. Handing over any data and/or information to other parties;
2. Utilizing the data and/or information of consumers who have terminated their agreements with PUJK;
3. Utilizing the data and/or information of potential consumers who have been rejected by PUJK; and/or
4. Utilizing the data and/or information of potential consumers who have withdrawn their applications for the use of PUJK products and/or services; and
5. Requiring potential consumers to agree to data and/or information sharing as part of the terms and conditions for the use of products and/or services.

PUJK may be exempted from the above-listed principles if they have already secured permission for the relevant processing through the provision of written and/or spoken information to consumers that addresses the purposes and consequences for the use of consumer data and/or information. It should also be noted that consumers may withdraw their consent for the use of data and/or information.

 

D.   Provision of Services by PUJK

PUJK are required to treat their consumers properly or in accordance with provisions that are set under applicable laws and regulations. In terms of the provision of services, PUJK are required to comply with several general obligations, which are summarized below:

1. Must guarantee that products and/or services are in accordance with initial agreements with consumers;
2. Must provide information services for consumers that guarantee equal access;
3. Must safeguard the security of any savings, funds or assets of consumers that they exercise responsibility over;
4. Must provide their consumers with proofs of product ownership and/or service use, or access to copies and/or printed copies;
5. Must report the relevant balance positions and mutation of funds, assets or obligations to consumers in a manner that is accurate, valid, punctual and legal;
6. Must carry out the instructions of consumers in accordance with the relevant agreements between PUJK and consumers and/or relevant laws and regulations.

In terms of the various obligations that are outlined above, it should be noted that any failure to comply with the obligation outlined under point (3) above will result in the imposition of sanctions in accordance with the P2SK Law, which include the potential imposition of criminal sanctions.

Furthermore, it should be noted that Regulation 22/2023 emphasizes that PUJK are prohibited from providing any products and/or services that are not in accordance with agreements with consumers, as well as laws and regulations, and information that was provided in the original advertisements and/or promotions.

 

E.   Debt Collection and the Confiscation of Collateral

Regulation 22/2023 has been receiving a lot of attention from Indonesia’s general public, primarily due to a set of provisions on the limits of and requirements for the organization of debt collection by PUJK and/or third parties working in cooperation with PUJK in order to ultimately engage in debt collection activities (“Collectors”).

PUJK are permitted to cooperate with Collectors, provided that said Collectors comply with the applicable obligations. These obligations are summarized in the table below:

 

Prior to carrying out any debt collection activities, PUJK must first issue written warnings within the periods agreed in the relevant financing agreements. Said written warnings should contain the following information at the least:

1. Due repayment date;
2. Total days of late repayment;
3. Principal outstanding;
4. Benefits of economic financing; and
5. Imposable fines and/or compensation.

Furthermore, whenever engaging in any debt collection activities, either with or without Collectors, PUJK must ensure that said activities are carried out in accordance with applicable public norms, as well as with applicable laws and regulations. As a result, the following requirements must be fulfilled:

1. Threats, violence and/or acts of humiliation must not be perpetrated against consumers;
2. Verbal or physical pressure must not be applied;
3. Must not be directed at parties than other consumers;
4. Must not be carried out continuously in a disturbing manner;
5. Must only be carried out at the debt collection address or domicile of the relevant consumers; and
6. Must only be carried out between Monday and Saturday (and not on national holidays) between the hours of 08:00 – 20:00 local time.

In addition to provisions that specifically address debt collection mechanisms, Regulation 22/2023 also sets out procedures that address the confiscation of collateral. These procedures apply to PUJK who provide credit or financing that requires customers to provide collateral. In this case, said PUJK must have sets of internal guidelines in place that address the confiscation or takeover of collateral, which must be drawn up in accordance with the applicable laws and regulations. Prior to carrying out any confiscation, the conditions listed below must be met:

1. Consumers must be in default;
2. Consumers have been sent warning letters; and
3. The relevant PUJK must have a fiduciary guarantee certificate and/or mortgage certificate.

The condition outlined in point (1) above must be proven through a written agreement between the relevant parties, a decision of the court or an Alternative Dispute Resolution Institution Operating Within the Financial Services Sector (Lembaga Alternatif Penyelesaian Sengketa Sektor Jasa Keuangan – “LAPS SJK”) or other mechanism provided under relevant laws and regulations.

The confiscation of any collateral must be recorded as a set of minutes of confiscation, while the relevant confiscation mechanism must be explained to the relevant consumers. The execution of confiscated assets may only be conducted through the following methods:

1. General auction by calculating the repayment from the value of the auction; and/or
2. Private sales that are carried out through agreements between PUJK and consumers, if applicable.

In this case, PUJK must explain the method of sale for execution to the relevant consumers and are obliged to reimburse consumers in cases where execution sales result in any surplus.

 

F.    Reporting Channels for Customers

When handling complaints that are submitted by and disputes with consumers, PUJK are prohibited from charging any fee to consumers. PUJK must initially put in place and implement mechanisms for the handling of consumer complaints, including a brief customer service procedure in the form of an agreement and/or other documents that relate to the use of products and/or services.

In order to be able to receive consumer complaints, PUJK must provide a consumer complaints service, which should at least encompass the receipt, handling and resolution of complaints. In cases where PUJK services are available on a 24-hour basis, then the relevant complaints channels must also be made available on a 24-hour basis. In providing said services, PUJK are bound by certain obligations when carrying out each activity stage, as detailed in the table below:

 

 

It should also be noted that the new framework has now shortened the period for the handling of complaints in comparison with the timeframe set out under Regulation 18/2018, meaning that consumers should have their complaints handled more promptly.

In relation to complaints handling services, PUJK must submit reports on their complaints services to the OJK every semester. Said reports must be submitted by the 10^th day of the month following the end of the relevant reporting semester at the latest. The submission of reports for the year 2024 must be completed by 10 July 2024.

 

III. Dispute Resolution and Applicable Sanctions

 

A.   Administrative Sanctions

As previously highlighted, Regulation 22/2023 compiles various provisions originally set out under a number of different legal frameworks that addressed the issue of consumer protection. In this regard, any non-compliance with said provisions will result in the imposition of various types of administrative sanctions. Through the issuance of Regulation 22/2023, these administrative sanctions have now been harmonized into the following range of sanctions, which may be imposed upon PUJK for the various violations addressed therein:

1. Written warnings;
2. Partial or overall limitation of products and/or services and/or business activities;
3. Partial or overall suspension of business activities;
4. Dismissal of management;
5. Administrative sanctions, up to a maximum of Rp. 15 billion;
6. Revocation of product and/or service licenses; and/or
7. Revocation of business licenses.

It should also be noted that the sanctions that are summarized in points (2) to (7) above may be imposed without any advance written warning being provided. Sanctions are imposed in accordance with the relevant levels of non-compliance and within certain limits of compliance. Furthermore, the OJK is also authorized to publicly announce the imposition of any of the above-listed sanctions.

In terms of the imposition of administrative sanctions for non-compliance with reporting obligations, Regulation 22/2023 has also made a number of notable adjustments that apply to different reporting obligations, depending on the following PUJK categories:

 

The table below sets out the newly adjusted administrative sanctions for non-compliance with the reporting obligations introduced under Regulation 22/2023:

 

 

The various sanctions outlined above apply to the following reporting obligations: financial literacy and inclusion, complaints services and self-assessments. In comparison with the previous legal frameworks, higher administrative fines have now been set under Regulation 22/2023.

Along with the adjustment and harmonization of the available administrative sanctions, PUJK may now submit objections to the OJK in line with the following requirements:

1. Must be written in Bahasa Indonesia;
2. Must include the reason for the objection along with supporting evidence;
3. Must be submitted within 10 business days of the date of the relevant sanction imposition letter; and
4. Must be submitted to the OJK c.q. the relevant official responsible for the imposition of the administrative sanctions.

 

B.   Dispute Resolution Mechanisms

In cases where no agreements are ultimately reached between PUJK and consumers who have submitted complaints, then consumers are permitted to take the following measures:

1. Submit a complaint to the OJK for further handling in line with the OJK’s authority; or
2. Submit a dispute to LAPS SJK, with the approval of the OJK, or to a court.

If any of the above-listed conditions occur, then PUJK have the right to defend themselves, as well as to present evidence before the court. PUJK also have the right to rehabilitate their reputations if it is proven that any losses that are sustained by consumers did not result from the use of their products and/or services.

In addition, it should also be noted that the OJK has the authority to legally defend the interests of consumers and to protect the general public by implementing the following measures:

1. Order or request that PUJK implement certain measures in order to handle the complaints of consumers; and/or
2. File civil lawsuits.

The measure outlined in point (2) above may only be carried out for the following purposes:

1. To recover the assets of any parties who have suffered losses; and/or
2. To secure compensation for losses that were caused by acts of non-compliance.

It should also be noted that civil lawsuits may only be submitted based on the results of evaluations that are undertaken by the OJK and cannot be submitted at the request of consumers. In cases where the handing down of legally binding court decisions ultimately grant the relevant claims, whether partially or in their entirety, then the OJK should inform the relevant consumers while the PUJK concerned draw up plans for the distribution of compensation.

 

Conclusion

In essence, Regulation 22/2023 has been issued in an effort to further strengthen consumer protection within the financial services sector by encouraging adjustments to be made to the internal organizations of PUJK. In this regard, the new framework should hopefully ensure the compliance of PUJK during the provision of their services and/or products to consumers. The analysis of Regulation 22/2023 set out above reveals that this new legal framework is aiming to ensure that various consumer and public protection aspects are prominent throughout the different activities that are implemented by PUJK, commencing from the pre-sale phase (e.g. marketing, product design), through the sale phase (e.g. concluding sales agreements), right through to the provision of products and/or services and also the post-sale phase (e.g. consumer complaints, dispute resolution). The hope is that not only will the new provisions help to guarantee the organization of consumer and public protection by PUJK, but will also ensure that PUJK products and/or services are ultimately marketed in a targeted manner in the interests of both PUJK and consumers themselves.

 

 

Source : hukumonline.com