Strengthening Reporting Sanctions and Cyber Protection through PADG 29 of 2026

Introduction

On 25 September 2026, Bank Indonesia enacted Regulation of the Members of the Board of Governors Number 29 of 2026 on Amendments to Regulation of the Members of the Board of Governors Number 24 of 2024 on Information System Security and Cyber Resilience for Payment System Providers, Money Market and Foreign Exchange Market Participants, and Other Parties Regulated and Supervised by Bank Indonesia (“PADG 29/2026”).

PADG 29/2026 amends PADG 24/2024, which serves as the implementing regulation of Bank Indonesia Regulation Number 2 of 2024. These amendments are necessary to strengthen supervisory effectiveness and legal certainty, particularly by providing more detailed and proportionate administrative sanctions based on the degree of delay or non-compliance in submitting annual and incidental reports. In addition, the regulation affirms Bank Indonesia’s authority to designate vital information infrastructure in the financial sector in order to strengthen the protection of strategic assets that affect the continuity of Payment System services and the stability of the Financial System amid increasing Cyber Risks arising from digitalization.

Comparison

PADG 29/2026 amends several provisions of PADG 24/2024, as set out in the following comparison table:

Key Provisions

• Annual Reporting Obligations and Deadlines

Article 52 paragraph (4) requires Providers to submit annual reports containing the KKS maturity level and the results of the identification of vital information infrastructure, as well as incidental reports in the event of a Cyber Incident. Article 53 paragraphs (1)–(3) stipulate that reports must be submitted centrally and must be complete, accurate, up to date, intact, and timely, accompanied by supporting evidence, such as KKS audit reports and penetration test reports.

Article 53 paragraph (4) establishes 31 January as the deadline for submitting the annual report for the preceding reporting period. If that date does not fall on a Bank Indonesia operational business day, the report must be submitted on the preceding operational business day. In addition, pursuant to Article 53 paragraph (9), Bank Indonesia may request an up-to-date KKS maturity report at any time, if necessary.

• Status of “Late” and “Failure to Submit Reports”

Article 53 paragraphs (5) and (6) distinguish between annual reporting non-compliance statuses based on the time at which Bank Indonesia receives the report:

1. 1. Late: A report for the preceding reporting period received after 31 January and up to and including 15 February.

   2. Failure to Submit Reports: A report that has not been received by 15 February.

Pursuant to Article 53 paragraph (7), a Provider declared to have failed to submit a report remains obligated to submit the report. Accordingly, the determining factor for the status is the time at which Bank Indonesia receives the report, rather than the time at which it is sent.

• Designation of Vital Information Infrastructure in the Financial Sector

Article 54 paragraph (1) affirms Bank Indonesia’s authority to designate vital information infrastructure in the financial sector, comprising:

• • Providers;

  • Application systems and/or information technology infrastructure; and

  • A roadmap for the protection of vital information infrastructure.

Pursuant to Article 54 paragraph (2), such designation takes into account the results of the identification of vital information infrastructure reported by Providers in their annual reports. Article 54 paragraph (3) establishes four assessment criteria for determining the Providers and application systems and/or information technology infrastructure to be designated, as follows:

Meanwhile, Article 54 paragraph (4) stipulates that the designation of a roadmap for the protection of vital information infrastructure takes into account the Provider’s KKS maturity level, as reported in the annual report. Accordingly, annual reports serve as the basis for Bank Indonesia to designate vital information infrastructure and determine the roadmap for its protection.

• Administrative Sanctions for Annual Reporting

Article 56A paragraph (1) provides for graduated administrative sanctions for Providers that violate their annual reporting obligations, as follows:

The Elucidation of Article 56 paragraph (1) point c explains that the “activities” subject to suspension include activities and products. Accordingly, suspension is not limited to business activities in general but may also target specific activities or products (in part), or all activities or products. The General Elucidation states that the purpose of this graduated approach is to ensure that sanctions more proportionately reflect the degree of delay and non-compliance.

• Administrative Sanctions for Incidental Reporting of Cyber Incidents

Article 56A paragraph (2) provides for an administrative sanction in the form of an obligation to pay IDR 5,000,000.00 (five million rupiah) for late submission or failure to submit the following incidental reports:

The deadline for the initial notification is calculated from the time the Provider becomes aware of the Cyber Incident, whereas the deadline for the Cyber Incident report is calculated from the time the incident occurs. Sanctions are imposed for late submission or failure to submit the reports within the applicable deadlines.

Closing

PADG 29/2026 strengthens supervision and legal certainty by clarifying reporting obligations, establishing the designation of vital information infrastructure in the financial sector, and introducing more detailed and proportionate administrative sanctions. Providers must ensure that annual and incidental reports are submitted within the applicable deadlines and in accordance with the applicable requirements, given that late submission or failure to submit reports may result in graduated administrative sanctions. In addition, Providers must pay attention to reporting obligations relating to the identification of vital information infrastructure and KKS maturity levels as part of efforts to strengthen information system security and cyber resilience in the financial sector.