Alternative data and thin-file borrowers: where Southeast Asian rules let lenders use it

Implications for lenders

For thin-file applicants, alternative data can support a first decision and a small starting limit that grows with observed repayment, but it does not show other debts, so a bureau check still matters where one is available; in Indonesia, SLIK debtor information no longer covers facilities at or below IDR 1 million. Lenders using alternative data may need documented consent from each data owner, contracts with data sources, and testing of whether each source predicts repayment in their own portfolio.

Implications

Facts

Indonesia: OJK Regulation POJK 29/2024 on Alternative Credit Scoring (Pemeringkat Kredit Alternatif, PKA), established on 18 December and promulgated on 20 December 2024, regulates providers that process data other than credit or financing data into credit scores describing a consumer's creditworthiness, condition or profile. The regulation's general elucidation gives telecommunications, utility and e-commerce data as examples, and OJK's press release of 21 January 2025 names the same three and says PKA may help assess the creditworthiness of unbanked and underbanked people and widen MSMEs' access to financial services. A PKA provider may obtain alternative data through partnerships with data providers or other sources, may not use confidential data that cannot be shared with third parties unless the data owner consents, must ensure the data source has the final data owner's consent before processing, and may not produce a credit score from credit or financing data. Scores may be used by financial services firms, credit information management institutions (private credit bureaus), consumers and other parties. OJK's FAQ says registered innovative credit scoring providers had 12 months from the regulation's effective date to apply for a business licence, and sets minimum paid-up capital of IDR 5 billion ^{1 2}. Separately, since July 2026 SLIK debtor information covers only financing facilities above IDR 1 million ³. On 13 October 2026 Dicky Kartikoyono, OJK's chief executive for market conduct supervision, education and consumer protection, said SLIK alone is not enough to show whether MSMEs are eligible for financing and called for alternative credit assessments that better reflect their real conditions (Kontan).

Thailand: the Bank of Thailand defines a digital personal loan as a supervised personal loan that uses digital technology and alternative data to assess a borrower's ability or willingness to repay, as well as in disbursement, collection and disclosure; loans secured by vehicle registration are excluded. Its list of providers, last updated on 1 August 2026, names 13 companies, several of them marked as not yet in service ⁴.

Philippines: the Credit Information System Act already defines submitting entities broadly. A Credit Information Corporation (CIC) letter circular listing additional submitting entities in production as of 31 May 2024 names telecommunications companies alongside rural banks, cooperatives and lending and financing companies.

Vietnam: Viet Nam News reported on 25 September 2026 that the General Department of Taxation and the National Credit Information Centre (CIC) signed an agreement to exchange data, under which the CIC will use tax data to assess taxpayers' creditworthiness; the full range of data to be connected has not been specified. The State Bank of Vietnam's governor said the banking sector was studying a pilot to analyse cash-flow data for credit evaluation. The CIC collects nine groups of information from credit institutions, and its database does not include card numbers, security codes or payment transaction histories ⁵.

Malaysia: the Consumer Credit Commission's FAQ (updated 24 September 2026) says credit providers should not rely on credit bureau data and scores in isolation.

International guidance: a 2018 guidance note by the International Committee on Credit Reporting, prepared with the World Bank Group, describes alternative data as information readily available in digitised form and collected through technological or electronic platforms, with examples such as utility and telecom payments, mobile money and e-money transactions, e-commerce and P2P platform data, invoices, and accounts payable and receivable. It says such data can promote access to credit for borrowers with no credit files, and lists risks: records that fail to identify the right person, data not originally collected or consented to for credit purposes, discrimination against protected groups, and the need to test whether a source predicts repayment.

Analysis

“What a credit bureau holds, and how each kind of data shapes a lending decision” (the first part of this series) set out what a bureau record contains and how each element enters a decision. A thin-file borrower is one for whom that record is short or empty, so the lender loses the repayment history that “Positive and negative credit data in Southeast Asia: what published sources describe” (the second part) treated as the most informative element. “Who must report to credit bureaus in Southeast Asia, and who may look: the reporting perimeter by country” (the third part) showed that what a bureau can show depends on who reports to it. Alternative data is a way to look beyond that perimeter, and the published rules show three routes.

The first is a separate, licensed scorer outside the bureau. Indonesia's PKA regime is the clearest case: scorers work on telecommunications, utility and e-commerce data, need consent along the data chain, and are barred from scoring credit or financing data. By design, a PKA score sits next to SLIK rather than replacing it, which matters more now that SLIK debtor information leaves out facilities at or below IDR 1 million.

The second is a product rule that asks the lender to use alternative data itself. Thailand's digital personal loan defines the product by the use of alternative data in assessing ability or willingness to repay, so the data choice and the model sit with the licensed lender.

The third brings non-financial data into the bureau. The Philippine CIC list names telecommunications companies as submitting entities, and Vietnam's tax-data agreement would bring government-held tax data on taxpayers into the CIC, whose current information, as described, does not include payment transaction histories.

In T&S's view, the different kinds of alternative data answer different questions. Utility and telecom bills show whether someone pays small recurring obligations on time, which speaks to willingness to pay. Tax filings, invoices and e-commerce sales speak to capacity, especially for SMEs and the self-employed. Neither shows what else the borrower owes; that remains the bureau's job, and for thin-file borrowers it is also where the gap is largest. Across products, the useful data differ: platform and e-commerce data for BNPL and embedded finance, telecom and e-wallet history for small unsecured and microfinance loans, tax and invoice data for SME lending, and employer payroll records for earned wage access. Payroll is not named as a category in the rules and guidance described here, so its use rests on employer arrangements and the general consent and data-protection rules. Vehicle finance relies less on alternative data because the vehicle itself supports the decision.

Counterpoints and uncertainties

Alternative data is not uniformly predictive: the international guidance asks for each source to be tested, and a score that works for one product or population may not carry over. Mismatched identities and incomplete records can exclude creditworthy borrowers or overstate capacity. The rules compared here differ in kind and date, from a 2018 guidance note to a 2026 data-sharing agreement whose scope is not yet specified, and Thailand's provider list includes companies that have not started lending, so the scale of use is unclear. A counterpoint to the T&S view: for very small, short loans, some lenders may find that alternative data alone gives enough signal, and a mandatory bureau check adds cost and delay; Indonesia's SLIK threshold also means that bureau data no longer show the smallest facilities, so neither source alone gives a full picture. Wider use of personal data raises consent, privacy and data-security exposure for lenders and data providers.

This article is based solely on publicly available sources.