OJK issues a cyber-resilience guideline for online lenders and tells banks to review fintech lending partnerships

Implications for lenders

With online-lending TWP90 at 5.36%, banks funding platforms may now pause lending through a partner whose portfolio NPLs jump, so platforms may need more than one funding source and partnership-level arrears reporting. Online lending platforms may also need to show cyber-incident handling and recovery plans, and a cyber-maturity self-assessment, to OJK and bank partners.

Implications

Facts

Cyber guideline: on 11 November 2026 the Financial Services Authority (OJK) launched a Cyber Security and Resilience Guideline (Pedoman Keamanan dan Ketahanan Siber) for information-technology-based lending services (LPBBTI, known as pindar), according to Kontan, citing an OJK official statement. The guideline covers five areas: cyber security governance; identification; protection; detection and monitoring; and incident handling and recovery. It includes a self-assessment instrument for measuring cyber maturity and is to be applied proportionally and on a risk basis. The national cyber and crypto agency (BSSN), the fintech lending association AFPI, AFTECH and ISACA Indonesia contributed to the drafting. At the same event, platforms and debt-collection firms signed an integrity pact on collection ethics and consumer protection. Agusman, OJK's chief executive for finance companies, venture capital, microfinance and other institutions, said cyber resilience is "an important foundation" for the industry.

Bank partnerships: speaking at a CNBC Indonesia forum on 10 November, Dian Ediana Rae, OJK's chief executive for banking supervision, said banks should not partner with fintech lenders carelessly, according to CNBC Indonesia. He said OJK has issued specific guidance on bank–fintech cooperation; the report gives no title or number for it. Banks are to evaluate all fintech partnerships and partner performance periodically, tighten supervision of lending through digital platforms, temporarily stop lending through a linked platform if NPLs on the partnership portfolio rise significantly, and stay within their risk acceptance criteria (RAC). The report gives no NPL threshold.

Context: online-lending outstanding was IDR 106.48 trn in September, IDR 106.94 trn reported for end-August, ¹ and the share more than 90 days past due (TWP90) was 5.36%, up from 4.73% in August. ² OJK uses 5% as the level for flagging platforms. ³

Analysis

Time series: TWP90 has risen from 4.26% in June to 4.73% in August and 5.36% in September, crossing the 5% flag level for the sector as a whole. The two November messages address different channels of that risk: the guideline targets operational and data risk inside the platforms, while the instruction to banks targets the funding side, where banks lend through or alongside platforms. A bank that pauses a partnership when NPLs jump would cut funding to that platform at the point its loans are deteriorating, which can tighten credit to the platform's borrowers.

Cross-country: Malaysia's credit bureau CTOS suspended some reports after unauthorised access in September and restored them in early November, an example of how a cyber incident at one shared provider can interrupt credit checks across many lenders. OJK's guideline applies to the platforms themselves; it does not, as reported, set rules for the vendors and data providers they depend on.

Counterpoints and uncertainties

The guideline's text, document number and compliance deadlines are not given in the press reports, and OJK's bank–fintech guidance has no stated NPL trigger, so how strictly banks will apply pauses is unclear. Proportional, risk-based application means smaller platforms may face lighter requirements, which could leave gaps. Higher sector TWP90 partly reflects a slowing book (outstanding fell from August to September), not only more defaults.