Changes to the Business Plan Requirements for Commercial Banks through POJK 17 of 2026

Introduction

On 21 September 2026, the Financial Services Authority (“OJK”) issued Financial Services Authority Regulation of the Republic of Indonesia Number 17 of 2026 on Business Plans for Commercial Banks (“POJK 17/2026”), which took effect on 30 September 2026. POJK 17/2026 regulates the obligations of commercial banks, including conventional commercial banks, Islamic commercial banks, and branch offices of banks domiciled outside Indonesia (“KCBLN”), in preparing, implementing, amending, adjusting, and reporting their Business Plans. With the enactment of POJK 17/2026, OJK Regulation Number 5/POJK.03/2016 concerning Business Plans for Banks is revoked and declared no longer valid.

POJK 17/2026 was established to strengthen strategic banking planning that is focused, measurable, sustainable, and risk-based, while also adapting the provisions to developments in regulations, information technology, and the complexity of banking business activities. In the context of digital transformation, product diversification, and the increasingly broad financial ecosystem, POJK 17/2026 promotes Business Plans that are more comprehensive and adaptive while continuing to take into account the business scale, complexity of activities, and business focus of each bank.

Key Provisions

• Preparation and Approval of the Business Plan

Article 2 paragraph (1) requires a Bank to prepare a realistic Business Plan annually. The term “realistic” is explained as meaning specific, measurable, achievable, relevant, and having clear time-bound targets. The Business Plan must take into account external and internal factors, prudential principles, governance, risk management, and sound banking principles. The Board of Directors prepares the Business Plan and the Board of Commissioners approves it. Conventional commercial banks that have an Islamic business unit must include a specific business plan for such unit. The Sharia Supervisory Board (“DPS”) is required to provide an opinion on the Business Plan, both for Islamic banks and conventional banks having an Islamic business unit, as required under Article 2 paragraph (5).

• Alignment with Strategic Plans

Article 2 paragraphs (6) and (7) require the Business Plan to be aligned with four documents:

1. 1. corporate plan;

   2. information technology strategic plan;

   3. sustainable finance action plan; and

   4. other strategic plans in accordance with OJK criteria.

The Business Plan must be prepared in alignment with the Bank’s long-term development direction, information technology readiness, and sustainability principles as required in the Elucidation.

• Implementation and Supervision

The Board of Directors is required to implement the Business Plan effectively. The Elucidation to Article 3 paragraph (2) distinguishes two types of deviation:

1. 1. Immaterial deviation, namely a variance that does not have a significant impact on the Bank’s performance, risk profile, or financial condition.

   2. Material deviation, namely a variance that has the potential to affect such matters.

The Board of Directors is also required to communicate the Business Plan to shareholders and all levels of the organization (Article 3 paragraph (3)). The Board of Commissioners is required to supervise its implementation (Article 4).

• Minimum Scope of the Business Plan

Based on Article 6 of POJK 17/2026, the Business Plan must contain at least 13 components covering strategic, financial, funding, capital, organizational, product, office network, and other information aspects. The details of each component are further regulated in Articles 7 through 19.

Article 20 further grants OJK the authority to determine the details of the contents and procedures for preparing the Business Plan, meaning that further technical provisions must continue to be taken into consideration by the Bank.

• Strategic Matters to Be Considered

Article 8 and its Elucidation require the Bank to describe its digitalization strategy, including plans to become a digital bank, channeling, executing, and joint financing business models, partnerships within the digital financial ecosystem, and investments in cyber resilience and security. The Bank must also describe plans for mergers, consolidations, acquisitions, the direction of financial conglomerates, remuneration policies, and dividend policies (or profit repatriation for KCBLN). Article 9 requires a description of cyber risks, implementation of anti-money laundering and counter-terrorism financing programs, governance, and realization of MSME lending.

• Provision of Funds and Capital

Article 13 regulates plans for the provision of funds to related parties and core debtors, based on business sectors and provinces, as well as for MSMEs, exports and imports, and Kredit Usaha Rakyat. The Elucidation defines a “core debtor” as a debtor or group outside related parties that is among the 25 largest recipients of funds. Article 14 paragraph (3) regulates divestment plans, including the reasons for the divestment, share percentage, estimated funds to be obtained, and its impact on the Bank’s performance, while Article 15 requires projections of compliance with minimum capital adequacy requirements.

• Amendment of the Business Plan

A Bank may amend its Business Plan where there are significant external and internal factors affecting the Bank’s operations or performance. An amendment may only be made once and no later than 30 June, and may only be implemented at the earliest 20 working days after being submitted to OJK, as regulated under Article 22. The Elucidation to Article 22 provides the example that an amendment submitted on 15 June 2027 containing a plan to open a new branch office may be implemented at the earliest on 13 July 2027. Article 23 requires changes to plans for the employment of foreign workers to also be included in an amendment to the Business Plan.

• Adjustment at the Request of OJK

Based on Article 24 paragraph (1), OJK may require a Bank to adjust its Business Plan or any amendment thereto. Based on Article 24 paragraph (2), the Bank is required to submit such adjustment no later than 20 working days from the date of the meeting with OJK or the date of OJK’s letter.

• Reporting

Article 27 provides that all documents are submitted through the OJK reporting system with the following deadlines:

• Sanctions

POJK 17/2026 distinguishes sanctions based on the type of violation as follows:

Closing

POJK 17/2026 strengthens the Bank’s obligation to prepare a Business Plan that is more integrated, measurable, adaptive, and risk-based. In addition to expanding the scope of matters required to be included, these provisions also emphasize the linkage of the Business Plan with corporate strategy, information technology, sustainability, risk management, governance, and the development of the Bank’s products and network.

The Bank needs to ensure that the processes for preparing, implementing, amending, adjusting, and reporting the Business Plan have been aligned with POJK 17/2026, including by taking into account reporting deadlines and the consequences of sanctions for non-compliance.