Regulation Watch · Business Licensing · Indonesia. The regulation applies nationally to Bank Indonesia payment system supervision. It is relevant to banks, Indonesia-incorporated non-bank payment service providers, payment fintech companies, infrastructure operators, parties connected to Bank Indonesia's payment system data infrastructure, contractors and data processors, and the directors, commissioners, shareholders and foreign investors responsible for governance and capital oversight in these businesses.
Bank Indonesia Sets Payment Data Governance Deadlines
PBI 10/2026 requires payment system providers and connected parties to strengthen customer data governance, fraud controls, impact assessments and data-exchange contracts, with submission deadlines in 2027.
- Published
- PBI 10/2026 was established and promulgated on 29 October 2026 in State Gazette of the Republic of Indonesia 2026 No. 37. The official Indonesian legislation portal records the regulation as in force.
- Effective
- 29 October 2026, the date of promulgation stated in Article 77. The regulation provides staged connection and submission requirements but no general delay to its effective date.
- Added to Watch
- 6 November 2026
Who is affected
Banks and Indonesia-incorporated non-bank legal entities that provide payment services or payment infrastructure; payment fintech companies; parties approved to connect to Bank Indonesia's payment system data infrastructure; contractors, vendors and data processors supporting customer-data processing; directors and commissioners responsible for active oversight; shareholders and foreign investors in regulated payment businesses; and legal, compliance, risk, fraud, technology, data-governance, information-security, product, internal-audit and regulatory-reporting teams.
Practical impact
PBI 10/2026 creates an operating framework for payment system data. Payment system providers must govern the legal basis for customer-data processing, consent and withdrawal, contracts, data-subject rights and cooperation with third parties. Providers must maintain fraud-management policies and risk controls with active oversight by directors and commissioners. Providers and connected parties must perform a customer-data protection impact assessment before processing, and data exchanges outside Bank Indonesia's infrastructure must be supported by contracts covering purpose, duties, governing law, dispute resolution, termination, transfer methods and data-subject remedies. Bank Indonesia may require staged connection to its data infrastructure and may regulate domestic and cross-border data exchange.
Bank Indonesia established and promulgated PBI 10/2026 on 29 October 2026 in State Gazette 2026 No. 37. Article 77 makes the regulation effective on that date. It governs payment system data processing by payment system service providers, parties connected to Bank Indonesia's payment system data infrastructure and other parties within the regulated framework.
The regulation requires payment system providers to control the legal basis for customer-data processing, consent and withdrawal, contractual terms and data-subject rights. Providers must also ensure that parties cooperating with them comply with the relevant governance requirements. Customer rights identified in the regulation include receiving information, withdrawing consent, objecting to decisions based solely on automated processing that produce significant legal effects and seeking compensation under applicable law.
Fraud management becomes a formal governance duty. A provider must maintain policies and risk controls covering prevention, detection, investigation and reporting, monitoring and evaluation, and education. Directors and commissioners must provide active oversight, and the provider must establish clear policies, procedures, organizational responsibility and accountability.
Before processing customer data, a payment system provider or connected party must perform a protection impact assessment. The assessment must describe the processing, test its necessity and purpose, identify risks and record mitigation. The result should support a documented decision on whether the processing may proceed and which controls are required.
The rule also formalizes payment-data exchange. An exchange through Bank Indonesia's infrastructure requires an underlying document and an appointed contact person. For exchange outside that infrastructure, the parties need a contract that covers the scope and purpose, each party's duties, governing law and dispute resolution, termination and amendments, transfer methods and the rights and remedies available to the data subject. Bank Indonesia may set the scope for domestic and cross-border exchange.
Every payment system provider must submit its fraud-management policy and customer-data impact assessment to Bank Indonesia within one year, by 29 October 2027. A provider selected for the first phase under Article 73 has an earlier fraud-policy deadline of 29 January 2027. Any later change to either document must be reported within 10 working days.
Bank Indonesia can require providers to connect to its payment system data infrastructure in stages. The infrastructure may support unique customer identification, transaction-integrity and fraud analysis, data exchange and payment history, storage and other data services. Providers should therefore align legal, fraud, privacy, technology and reporting work rather than treating connection as a purely technical project.
Enforcement can include warnings, fines, temporary suspension of data processing, temporary suspension of infrastructure access and other administrative sanctions, with possible public announcement. The regulation does not provide one fixed fine amount. A controlled implementation program should connect board oversight, data inventory, impact assessments, fraud controls, vendor contracts, exchange records and Bank Indonesia submissions before the first deadline arrives.
Required action
- Map every customer-data processing activity, legal basis, consent flow, withdrawal mechanism, automated decision, third-party transfer and data-subject request process used in the payment business.
- Approve and implement a fraud-management policy covering prevention, detection, investigation and reporting, monitoring and evaluation, and education, with documented oversight by directors and commissioners.
- Complete a customer-data protection impact assessment before starting or materially changing processing, documenting the activity, necessity, purpose, risks and mitigation and using the result to decide whether processing may proceed.
- Review every agreement for payment-data exchange outside Bank Indonesia's infrastructure and add the required scope, purpose, duties, governing law, dispute-resolution, termination, amendment, transfer-method and data-subject remedy terms.
- Appoint contact persons for data exchange, maintain the underlying transaction or cooperation documents, and prepare systems and governance for any staged connection mandated by Bank Indonesia.
- Submit the fraud-management policy and customer-data impact assessment to Bank Indonesia by the applicable deadline, then report any later change within 10 working days.
- Flow the governance requirements into contracts and controls for processors, technology providers and other cooperating parties, and retain evidence that their compliance is monitored.