Indonesia rolls out cyber resilience guidance and lending collection pact
OJK says fintech lenders must be able to recover from cyber incidents and ensure debt collectors protect borrowers’ data and avoid intimidation.
Indonesia’s Financial Services Authority (OJK) has introduced cybersecurity and resilience guidelines for technology-based lending providers, alongside an integrity pact on debt collection ethics and consumer protection. OJK outlined the initiatives in a statement dated 11 November 2026.
Agusman, OJK’s chief executive overseeing financing institutions, venture capital companies, microfinance institutions and other financial services institutions, said lenders must move beyond cybersecurity alone. They need to anticipate and detect attacks, respond to incidents and restore services quickly, he said, noting that no system is completely immune.
The guidance addresses five areas: cybersecurity governance, identification, protection, detection and monitoring, and incident response and recovery. A self-assessment tool allows firms to evaluate system maturity, identify weaknesses and develop improvements suited to their size and risk.
OJK developed the guidelines with the National Cyber and Crypto Agency (BSSN), industry associations AFPI and AFTECH LPD, and the ISACA Indonesia Chapter.
The integrity pact was signed between technology-based lending providers and debt collection companies. Agusman said collection practices must protect consumers, preserve the confidentiality of personal data and avoid intimidation or violence. He stressed that lenders remain responsible for ensuring collection complies with regulations and ethical principles.
