Payment System Data Governance under Bank Indonesia Regulation No. 10 of 2026

Introduction

On 29 October 2026, Bank Indonesia (“BI”) issued Bank Indonesia Regulation Number 10 of 2026 on Payment System Data Governance (“PBI 10/2026”). PBI 10/2026 is intended to serve as a reference for BI, Payment System Service Providers (“PSSPs”), Connected Parties, and other parties in processing payment system data. In addition, PBI 10/2026 serves as a guideline for the operation of the Payment System Data Infrastructure managed by BI and provides the basis for the formulation of BI technical provisions and industry provisions relating to the processing of payment system data.

The issuance of PBI 10/2026 is based on BI’s need to strengthen the governance of payment system data processing and exchange in line with the increasingly widespread use of digital economic and financial services. These developments have driven increases in the volume and speed of payment transactions, which have also heightened cyber risks, fraud, and threats to transaction integrity. In line with the Indonesia Payment System Blueprint 2030, BI is developing the Payment System Data Infrastructure to strengthen industry risk management and safeguard transaction integrity, with a view to establishing a resilient payment industry structure.

Key Provisions

Parties Subject to the Regulation and Scope of Regulation

As stipulated in Article 4, PBI 10/2026 applies to BI, PSSPs, Connected Parties, and other parties. The Elucidation of Article 4 letter d states that “other parties” include, among others, ministries, institutions, and relevant authorities. Article 1 point 8 defines a Connected Party as a party that has obtained approval to connect to BI’s Payment System Data Infrastructure. Article 5 confirms that BI processes payment system data, which includes service user data and other data relating to the operation of the payment system, and is authorized to consolidate (aggregate) such data. Meanwhile, Article 6 sets out six areas of regulation:

1. payment system data elements;

2. data processing governance;

3. data exchange;

4. Payment System Data Infrastructure;

5. coordination and cooperation; and

6. reporting, supervision, and monitoring.

Data Sources and Obligation to Submit Data to BI

Article 7 paragraph (1) stipulates that payment system data may originate from BI, PSSPs, and other parties. Pursuant to Article 7 paragraph (2), BI obtains such data through the Payment System Data Infrastructure, BI payment system infrastructure (for example, cross-border transaction data, as explained in the elucidation), the submission of reports, or other mechanisms determined by BI. Article 7 paragraphs (3) to (5) authorize BI to request data from PSSPs and other parties. Parties from which data is requested are required to submit such data and bear full responsibility for the accuracy of all data submitted.

Classification of Service User Data

Article 8 divides service user data into individual data and corporate data. The Elucidation of Article 8 further states that such data may be supplemented with metadata, namely information that facilitates data searches and management. Article 9 paragraph (1) authorizes BI to determine the classification of service user data. Based on the Elucidation of Article 9, the three classifications are distinguished according to their respective purposes and bases for exchange:

Data Processing Governance by PSSPs

Article 11 governs BI’s authority to establish policies on the governance of service user data processing by PSSPs, covering the lawfulness of processing, mechanisms for granting and withdrawing consent, contract standards, and the protection of data owners’ rights. PSSPs are also required to ensure that their cooperation partners comply with these provisions. If BI has not yet established such policies, PSSPs are required to formulate their own policies based on laws and regulations and/or SRO technical provisions.

Furthermore, Article 12 requires each Data Controller to ensure that data processing has a lawful basis, namely:

• the performance of a public task;

• compliance with a legal obligation;

• the protection of vital interests;

• the fulfilment of legitimate interests;

• the consent of the data owner; and/or

• the performance of a contract.

Data Processing Mechanisms and Stages

Article 21 requires data processing to be carried out in accordance with its purpose, electronically and/or non-electronically. Article 22 sets out three stages of processing:

Types of Fraud and PSSPs’ Fraud Management Obligations

Article 24 paragraph (2) establishes four types of fraud in the payment system:

1. unauthorised payment transactions;

2. manipulation of payers to induce them to make payments, for example, by persuading victims to transfer funds to the perpetrator’s account (manipulation of payers to issue payment);

3. fraud targeting PSSPs through the misuse of customer data or payment systems; and

4. fraud relating to other products offered by PSSPs.

PSSPs are authorized to determine whether an act constitutes fraud and to identify the perpetrator by taking into account the relevant fraud typology and the losses incurred. Furthermore, pursuant to Article 25, PSSPs are required to:

• formulate and implement fraud management policies covering prevention, detection, investigation and reporting, monitoring and evaluation, as well as education; and

• implement risk management through active oversight by the board of directors and board of commissioners, adequate policies and procedures, and a clear organizational structure and accountability framework.

In addition, Article 26 requires PSSPs to manage transactions relating to the prevention of money laundering, terrorist financing, the financing of the proliferation of weapons of mass destruction, and other transactions prohibited under laws and regulations.

Data Processing Impact Assessment

Article 28 requires PSSPs and Connected Parties to conduct an impact assessment prior to processing service user data in order to identify potential risks and determine mitigation measures to protect data owners’ rights. Such assessment serves as the basis for determining the feasibility of data processing and must, at a minimum, cover:

• a description of the processing activities and purposes;

• an assessment of the necessity and purposes of processing;

• a risk assessment; and

• risk mitigation measures.

Payment System Data Exchange

Article 30 authorizes BI to determine the scope of payment system data exchange, both between BI and PSSPs or other parties and among PSSPs, including cross-border data exchange. Pursuant to Article 32, data exchange may be conducted through or outside the Payment System Data Infrastructure, subject to the following requirements:

• Through the infrastructure: Article 33 requires the existence of an underlying document and a designated contact person, as well as any additional requirements determined by BI.

• Outside the infrastructure: Article 35 requires PSSPs to comply with minimum contract standards and designate a contact person. Such contracts must, at a minimum, contain provisions concerning the scope and purpose of data exchange, the obligations of the parties, dispute resolution, data transfer procedures, and the rights and legal remedies of data owners.

In addition, Article 36 governs the underlying documents for data exchange, which may take the form of a memorandum of understanding, a connection agreement, and/or a cooperation agreement. Article 37 allows for the establishment of a joint task force to coordinate data exchange between BI and ministries or institutions, while Article 38 provides for exemptions from the underlying document requirement for data exchange in certain sectors, provided that such exemptions are stipulated by law.

Functions of the Payment System Data Infrastructure

Article 41 designates BI as the operator of the Payment System Data Infrastructure, which may appoint another party to act for and on behalf of BI. Article 42 paragraph (1) stipulates five functions of the infrastructure, namely:

1. uniquely identifying prospective service users and service users;

2. identifying and measuring the integrity of payment transactions, including through fraud detection at the account and transaction levels and the analysis of ongoing transaction patterns;

3. facilitating data exchange, including through the provision of service users’ payment transaction history;

4. storing data to support the performance of BI’s duties; and

5. providing other data services.

This infrastructure may be connected to other BI payment system infrastructure. Article 42 paragraphs (2) and (3) stipulate that BI will further determine provisions concerning the types of services, Connected Parties, data exchange mechanisms, and data access.

Unique Service User Identification Services

Article 47 paragraph (1) stipulates that BI shall establish and manage a unique identity for each prospective service user and service user. To support this service, Article 47 paragraph (2) requires PSSPs acting as Connected Parties to provide BI with data on prospective service users and service users and to manage such unique identities. This management includes recording the unique identities and notifying the relevant service users thereof.

Suspension of Transactions Suspected of Involving Fraud

Article 48 paragraph (2) requires PSSPs acting as Connected Parties to report service user data relating to transaction integrity, including data on fraud perpetrators identified by the PSSPs, to the Payment System Data Infrastructure.

Furthermore, Article 49 paragraph (1) requires PSSPs to examine transactions suspected of involving fraud. During the examination, Article 49 paragraph (2) authorizes PSSPs to take one of the following actions:

1. defer the crediting of funds; or

2. refrain from processing transactions to and from the recipient’s account or account balance, including outgoing transfers, except for debits relating to fees payable by the account holder.

Article 49 paragraphs (3) to (5) require PSSPs to notify service users of such actions in writing, either by letter or electronic means, at least once. A transaction may be suspended for a maximum period of 5 business days from the date of examination. On the fifth business day, the PSSP is required to decide whether to:

1. proceed with the transaction if the service user is not determined to be a fraud perpetrator; or

2. not proceed with the transaction if the service user is determined to be a fraud perpetrator.

In addition, Article 49 paragraph (6) requires PSSPs to record the examination results, which must, at a minimum, include the identities of the sender and recipient, the transaction date and amount, and the reasons for the examination.

Service Users Recorded in Transaction Integrity Data

Article 50 paragraph (1) requires PSSPs to conduct stricter ongoing monitoring of service users recorded in transaction integrity data and to update their transaction data. Article 50 paragraph (3) also requires the implementation of customer due diligence and/or enhanced due diligence.

Furthermore, Article 51 paragraph (1) requires PSSPs not to proceed with transactions involving such recorded service users, taking into account the service users’ latest status in the Payment System Data Infrastructure. Article 51 paragraphs (2) to (4) require PSSPs to provide written notification of the reasons for transaction rejection and the follow-up actions available to service users, as well as to maintain records of the relevant transaction documents.

Service users who object to being recorded may submit an objection, together with supporting documents, to the PSSP that made the determination. Pursuant to Article 52, PSSPs are required to follow up on such objections in accordance with consumer protection provisions.

In addition, Article 53 stipulates that BI will determine the retention period and the period for which an individual may be recorded in transaction integrity data, which PSSPs are required to implement.

Data Exchange Services and Data Standardisation

Article 54 paragraph (2) requires PSSPs acting as Connected Parties to provide and use data in accordance with the mechanisms determined by BI, including mechanisms for obtaining the data owner’s consent.

In addition, Article 57 paragraph (2) requires PSSPs to comply with the data standardisation established by BI. Based on the Elucidation of Article 57 paragraph (1), such standardisation covers metadata, ISO 20022-based message formats, and data communication through application programming interface (API) standards. Accordingly, PSSPs need to adjust their systems and technologies to comply with these standards.

Termination of Access Rights

Article 55 stipulates that BI may terminate a Connected Party’s access rights upon the Connected Party’s own request, as a follow-up to supervision or monitoring, or as a form of administrative sanction. Access rights shall be terminated after the Connected Party has fulfilled all of its obligations. BI may also announce such termination of access rights through its official website.

Phased Implementation and Obligation to Become a Connected Party

Article 59 stipulates that the implementation of the Payment System Data Infrastructure shall be carried out in phases based on the schedule, scope, and mechanisms determined by BI. Pursuant to Article 59 paragraph (3), BI may require PSSPs to become Connected Parties. Connected Parties are required to comply with the implementation stages as stipulated in Article 59 paragraph (4).

In determining the implementation stages, Article 59 paragraph (5) stipulates that BI shall take into account service readiness, supporting infrastructure, and the readiness of Connected Parties and PSSPs.

Reporting, Supervision, and Monitoring

Article 64 paragraph (2) requires PSSPs and Connected Parties to submit implementation reports to BI, either periodically or at any time upon BI’s request.

Article 66 stipulates that BI shall supervise PSSPs using a risk-based and compliance-based approach. Meanwhile, Article 68 governs the monitoring of Connected Parties in relation to their compliance with the operation of the Payment System Data Infrastructure.

Based on the results of such supervision and monitoring, Article 70 authorizes BI to require supervised parties to undertake or cease certain actions, restrict activities, suspend data processing, and even terminate access rights. BI may also announce such follow-up measures through its official website.

Closing

PBI 10/2026 strengthens the governance of payment system data processing and exchange through the operation of the Payment System Data Infrastructure by BI, which is intended, among other things, to enhance transaction integrity and strengthen fraud prevention and handling.

For PSSPs, these provisions give rise to obligations to adjust their governance, procedures, systems, and technologies, including in relation to compliance with standardisation requirements and data exchange. Accordingly, PSSPs need to pay close attention to the technical provisions and implementation stages to be determined by BI and prepare to fulfil their obligations as Connected Parties.