Regulation Watch · Business Licensing · Indonesia. The regulation implements Bank Indonesia's consumer-protection framework for banks and nonbank entities whose activities are regulated and supervised by Bank Indonesia and whose products or services are used by consumers. It is directly relevant to payment-system providers, money-service providers, money-market and foreign-exchange participants, and other covered operators, including qualifying PT PMA businesses. An ordinary PT PMA that only uses banking or payment services is a consumer, not automatically a regulated operator under this instrument.
BI Sets Consumer Complaint Clocks and 30-Day Change Notices
PADG 32/2026 requires Bank Indonesia-regulated providers to give 30 working days' notice for most product or service changes, meet 5, 10 or 20-working-day complaint clocks, strengthen consumer-protection governance and file recurring reports.
- Published
- PBI 6/2026 was established on 24 June and promulgated on 30 June 2026. Bank Indonesia established and published PADG 32/2026 on 30 September 2026. The Bank Indonesia JDIH record identifies the PADG as a 125-page instrument and does not list a separate State Bulletin number.
- Effective
- PBI 6/2026 took effect on 30 June 2026. The Bank Indonesia JDIH records PADG 32/2026 as effective on 30 September 2026. The PADG closing provisions include operator-specific commencement treatment, so each operator should confirm the obligation matrix and any specific transition rule that applies to its licensed activity.
- Added to Watch
- 16 October 2026
Who is affected
Bank Indonesia-regulated banks and nonbank providers that deal directly with consumers, including payment-service and payment-infrastructure providers, money-service providers, money-market and foreign-exchange participants, qualifying foreign-owned fintech and financial-service companies, their directors, commissioners, controlling shareholders, compliance and risk teams, product and marketing teams, customer-service and complaint teams, data and security teams, and third parties supporting consumer-facing operations.
Practical impact
The new implementation rule replaces PADG 20/2023 and turns PBI 6/2026 into detailed operating requirements. Covered providers must test products against the needs and ability of the target consumer, publish balanced standard agreements, prevent mis-selling, protect consumer assets and data, maintain a dedicated consumer-protection function, control licensed third parties and operate a free complaint channel that is always available. Most changes to product or service information must be notified at least 30 working days before they apply. Complaint handling now has differentiated clocks: 5 working days for information and understanding issues, 10 working days after complete documents for written complaints involving possible regulatory breaches or operational loss, and 20 working days for suspected fraud or scam transactions, subject to the permitted extensions. Providers also face recurring education and complaint-reporting duties and market-conduct self-assessment.
Bank Indonesia published PADG 32/2026 on 30 September as the detailed implementation rule for PBI 6/2026. PBI 6/2026 replaced the 2023 consumer-protection regulation on 30 June. PADG 32/2026 now replaces PADG 20/2023 and supplies the operating procedures, obligation matrices, reporting cycles and sanction process for the strengthened framework.
The scope is the Bank Indonesia supervisory perimeter, not every Indonesian company. It covers banks and nonbank providers whose regulated products or services are used by consumers, including payment-system, money-service, money-market and foreign-exchange operators and other parties regulated by Bank Indonesia. A foreign-owned provider within that perimeter must comply. A normal PT PMA using those services is protected as a consumer but is not made a regulated provider merely because it holds a bank account or accepts payments.
The rule changes the product lifecycle. Information on features, price or fees, benefits, risks, consequences, conditions, usage and complaint services must be clear and available through official channels. Most changes require at least 30 working days' prior notice. Providers must test product suitability for the target consumer, maintain pricing governance, prevent mis-selling, publish balanced standard agreements and apply consumer protection through pre-sale, sale and post-sale activities.
Complaint operations receive firm service levels. Information and understanding complaints carry a 5-working-day clock. Qualifying written complaints about possible Bank Indonesia rule breaches or direct operational loss carry a 10-working-day clock after documents are complete, with a further 10-working-day extension in specified cases. Suspected fraud or scam transactions carry a 20-working-day clock and require immediate verification, customer due diligence, account tracing and use of the relevant data-sharing mechanisms. Extensions involving external parties must be documented and communicated in writing.
Governance is broader than customer service. Providers must maintain a competent consumer-protection function, protect assets, privacy and data, secure internal and third-party access, test cyber controls, manage incidents, reconcile consumer assets, retain evidence, assess market conduct and ensure that cooperating third parties hold the required licence. Directors and commissioners must be able to evidence active oversight through policies, reporting and control review.
The recurring calendar is now a board-level compliance issue. Education plans are due by 30 November before the implementation year, education implementation reports by 28 February after the year, and complaint reports by the 10th of January, April, July and October. Bank Indonesia can also require incident and other reports. Covered operators should map the closing provisions and obligation matrix to their licence before treating any transition as available.
Enforcement can affect the licence itself. Bank Indonesia identifies sanctions ranging from written warnings and restrictions through product or activity freezes, management removal, fines and licence revocation. A reporting fine is not the only exposure because non-reporting breaches can still trigger non-monetary supervisory sanctions, and consumer loss may create compensation and dispute risk.
Required action
- Confirm whether each group entity, licence and consumer-facing product falls within the PADG 32/2026 obligation matrix for payment-system and other operators or for money-market and foreign-exchange operators.
- Update the board-approved consumer-protection policy, governance map, responsible unit, staffing, training records, compliance monitoring, incident escalation and periodic effectiveness review.
- Review product design and testing, target-consumer criteria, pricing governance, marketing, advertisements, sales scripts and approval or rejection notices for clear costs, benefits, risks, consequences, conditions, usage instructions and complaint routes.
- Inventory every planned change to product features, price, fees, risks, conditions, usage or complaint services and build the standard 30-working-day consumer notice into the change-release process, while documenting any daily-product or force-majeure exception.
- Publish and test a free, official complaint channel that is available at all times. Configure case management for the 5, 10 and 20-working-day clocks, complete-document checks, permitted extensions, multi-provider cases, fraud response, written outcomes and record retention.
- Review standard agreements for the required identity, scope, features, rights, obligations, price, fees, penalties, security, data, transaction, liability, complaint, dispute, amendment, duration and termination terms, then publish the current agreement through an official channel.
- Test controls for consumer assets, access, reconciliation, fraud monitoring, privacy choices, consent withdrawal, marketing opt-out, data retention, backups, recovery, cyber security and third-party confidentiality.
- Verify that every third party supporting regulated consumer services holds the licence required from Bank Indonesia or another competent authority and contractually applies the relevant consumer-protection principles.
- Prepare the annual education plan, annual implementation report, quarterly complaint reports, incident reports and market-conduct self-assessment with documented ownership and submission evidence.