Bank Indonesia has issued Bank Indonesia Regulation Number 6 of 2026 on Bank Indonesia Consumer Protection (“PBI 6/2026”), replacing Bank Indonesia Regulation Number 3 of 2023 on Bank Indonesia Consumer Protection (“PBI 3/2023”). PBI 6/2026 came into effect on 30 June 2026, being the date of its promulgation.

Entities Subject to PBI 6/2026

PBI 6/2026 is a sector-specific regulation and does not generally apply to all business operators. It applies to the following entities:

(1) Payment System Providers or Penyelenggara Jasa Sistem Pembayaran (“PSP”): comprising Payment Service Providers (Penyedia Jasa Pembayaran or (“PJP”), Payment Infrastructure Operators (Penyelenggara Infrastruktur Sistem Pembayaran or “PIP”) and commercial banks. In this context, a PSP is defined as a commercial bank or non-bank institution that conducts activities relating to payment system services and/or payment system infrastructure. A PJP is a PSP that provides services to facilitate payment transactions for service users, whereas a PIP is a PSP that operates payment system infrastructure to facilitate the transfer of funds for its participants;

(2) Operators in the Money Market and Foreign Exchange Market (Pelaku Pasar Uang dan Valuta Asing or “PUVA”): comprising of PUVA operators and operators of money market infrastructure established by parties other than Bank Indonesia, as designated by Bank Indonesia; and

(3) Other operators specified and designated by Bank Indonesia,

(the above entities are hereinafter collectively referred to as “Operators”).

Key Provisions

Enhanced Personal Data Protection under PBI 6/2026

PBI 6/2026 introduces a dedicated section on the protection of consumer data and/or information, likely reflecting the personal data protection principles established under Law No. 27 of 2022 on Personal Data Protection (“PDP Law”). For instance, PBI 6/2026 mandates Operators to maintain the confidentiality and security of consumer data and/or information in accordance with applicable laws and regulations on personal data protection. PBI 6/2026 also adopts data protection standards, with reference to the PDP Law, in relation to cross-border data transfers of consumer data and/or information.

In addition to the general data protection obligations under the PDP Law, PBI 6/2026 introduces several other additional compliance obligations, including: (1) Consumers must be informed of the legal consequences of providing their consent; (2) Operators must establish dedicated functions responsible for data protection, maintain reliable information systems and cyber resilience and implement data protection mechanisms; (3) Third parties processing or managing data on behalf of Operators must apply data protection standards that are equivalent to or higher than those applicable to the relevant Operator; and (4) Operators must take immediate measures and notify both the relevant consumer and Bank Indonesia in the event of a data security breach.

Therefore, in practice, Operators subject to PBI 6/2026 must ensure that their data processing complies with the general requirements under the PDP Law while also fulfilling the additional and more specific obligations prescribed under PBI 6/2026.

Standard-Form Agreement

1. Prohibited Standard Clauses

The regulation of standard-form agreement (perjanjian baku) under PBI 6/2026 as well as its predecessor adopts an approach consistent with Law No. 8 of 1999 on Consumer Protection, which does not prohibit standard clauses altogether but instead prohibits specific standard clauses.

The prohibited clauses under PBI 6/2026 generally remain consistent with those under PBI 3/2023, with the addition of prohibition on clauses that allow Operators to provide consumer data and/or information to other parties without the consumer’s prior approval. Accordingly, any existing clause permitting the Operators to unilaterally transfer or disclose consumer data and/or information should be removed or amended.

2. Mandatory Terms

PBI 6/2026 requires standard-form agreements to include, among others, the following terms: (1) Identity of the parties; (2) Scope of the products and/or services; (3) Characteristics, key features, and limitations on the use of the products and/or services; (4) Rights and obligations of the Operators and the consumer; (5) Value or price, costs, fees, penalties, and/or other financial obligations imposed on the consumer; (6) Transaction security requirements and obligations relating to the protection of consumer data and/or information; (7) Mechanisms for conducting transactions, including authorization, correction and/or cancellation of transactions; (8) Allocation of responsibilities in the event of consumer losses arising from system errors, unauthorized transactions and/or other causes; (9) Consumer complaint handling mechanism; (10) Choice of dispute resolution through the courts or an alternative dispute resolution institution in the financial sector; (11) Procedures for amending the terms and conditions of the standard-form agreement; (12) Term of the standard-form agreement; and (13) Procedures for termination of the products and/or services.

For products and/or service that pose a higher risk to consumers, the standard-form agreement must also, at a minimum, cover: (1) provisions for strengthening transaction security measures and mitigating the risk of misuse of products and/or services; and (2) mechanisms for notifying and handling incidents affecting the security of consumer assets or funds and/or consumer data and/or information.

3. Compliance Test and Approval

PBI 6/2026 introduces a mandatory compliance test (uji kepatuhan) for standard-form agreement. This assessment must, at a minimum, cover: (1) identification of clauses that may potentially disadvantage consumers; (2) assessment of the readability and comprehensibility of the agreement and (3) evaluation of the proportionality of the parties’ rights, obligations and liability as well as the reasonableness of fees, penalties and amendments of contractual provisions.

Furthermore, each standard-form agreement must obtain formal approval from the Board of Directors (or equivalent body) prior to its implementation. The results of the compliance test must also be documented.

4. Principles and Readability Requirements

Standard-form agreements must incorporate the principles of balance, fairness and reasonableness throughout all stages, including drafting, execution, modification, replacement and termination. PBI 6/2026 also prohibits provisions whose placement, layout, format or manner of presentation makes them difficult for consumers to see, read or understand, as well as provisions which are ambiguous.

Use of Indonesian Language

PBI 6/2026 requires Operators to provide information to consumer in Indonesian language and in a manner that is clear and easily understood, including information relating to their products and/or services. In addition, Operators are prohibited from providing information, documents and/or agreements that are not prepared in the Indonesian language in accordance with the applicable laws and regulations.

The requirement to use the Indonesian language this time around extends beyond product-related information and also applies to contractual documentation provided to consumers (i.e. agreement or contract). Furthermore, Operators may prepare translations of such information, documents and/or agreements into a foreign language, provided that the applicable requirements regarding the use of Indonesian language are satisfied.

Consumer Complaints and Disputes

PBI 6/2026 differentiates “complaint” (pengaduan) and “dispute” (sengketa). A complaint is defined as an expression of consumer dissatisfaction relating to, among other things, a lack of understanding of a product/service, an alleged violation of Bank Indonesia regulations or actual or potential financial loss. Meanwhile, a dispute refers to a legal disagreement between a consumer and Operators that has undergone the formal complaint-handling process of the relevant Operator.

In the event of complaint, a consumer may pursue the following processes:

(1) Initial complaint to the Operator: The consumer may submit the complaint to the relevant Operators for resolution through the Operator’s internal complaint-handling mechanism;

(2) Further Resolution through Bank Indonesia: If the consumer is dissatisfied with the resolution provided by Operator, the consumer may seek further resolution through Bank Indonesia, including through consultation or facilitation; and

(3) Resolution through LAPS-SK or Other Forums: Following the Operator’s complaint-handling process, the consumer may also submit the dispute to LAPS-SK or pursue resolution through another available forum. Notably, PBI 6/2026 does not require a consumer to first undergo consultation or facilitation with Bank Indonesia before submitting a dispute to LAPS-SK.

It should be noted that LAPS-SK may not handle a dispute that is currently being, or has previously been, examined or adjudicated by a court, arbitration or another alternative dispute resolution institution where such forum has been agreed upon by the consumer and the relevant Operator. Accordingly, once a dispute has been submitted to or is being processed by another forum, the dispute may no longer be eligible for resolutions through LAPS-SK.

Application of PBI 6/2026 to Commercial Banks

PBI 6/2026 has implications for commercial banks in carrying out certain aspects of their business activities, particularly where they act as PSPs and/or PUVA Operators.

In their capacity as PSPs, commercial banks may conduct activities relating to the provision of payment system services and/or the operation of payment system infrastructure, including facilitating payment transactions and/or operating payment system infrastructure. Meanwhile, in their capacity as PUVA Operators, commercial banks may conduct activities in the money market and/or foreign exchange market including, among others: (1) the issuance and trading of financial instruments or debt securities with a tenor of no more than 1 (one) year, (2) money lending and borrowing transactions, (3) interest rate derivative transactions and (4) other transactions that meet the characteristics of the money market.

It is important to note that, while PBI 6/2026 refers to “money lending and borrowing” as one of the activities conducted in the money market, the prevailing money market regulatory framework refers to such activity as money lending and borrowing other than credit transactions (transaksi pinjam-meminjam uang selain kredit) which is further elaborated as “interbank call money transaction”. Such transaction generally constitutes a short-term lending arrangement between banks, typically undertaken to address liquidity needs arising from clearing activities or to obtain additional funding.

Accordingly, the reference to “money lending and borrowing” under PBI 6/2026 should not be construed as encompassing conventional lending activities, namely the provision or granting of credit facilities to debtor consumers. Conventional lending constitutes one of the principal business activities of commercial banks under the Indonesian banking regulatory framework and is distinct from the money market activities contemplated under PBI 6/2026.

Conclusion

PBI 6/2026 establishes a comprehensive consumer protection framework. Compliance with the consumer protection requirements is not limited to the handling of consumer complaint but also encompasses, among others, compliance testing and pre-approval requirement in respect of standard-form agreements, enhanced personal data protection standards and mechanism for the escalation of consumer complaints into disputes. In light of this, Operators should review and, where necessary, align their internal governance, operational processes, and documentations with these requirements at the latest 6 (six) months after the promulgation of this regulation.

In relation to commercial banks, PBI 6/2026 may not, in itself, materially affect the continuation of their conventional lending activities. Commercial banks will, however, remain subject to the applicable Bank Indonesia regulations, including further implementing regulations that may subsequently be issued, applicable to their respective licenses and business activities as determined by Bank Indonesia. The applicability of PBI 6/2026 to a commercial bank should therefore be assessed on a case-by-case basis, having regard to the capacity in which the bank is acting and the nature and characteristics of the relevant product and/or service. At this stage, commercial banks are also advised to continue monitoring any further regulatory developments in this issue.

Finally, we consider the issuance of PBI 6/2026 to be a positive regulatory development, particularly in addressing emerging consumer protection concerns in the financial services sectors, including those relating to the protection of personal data. Data breaches and the unauthorized collection, use and/or sharing of personal data have continued to present challenges within the financial services sectors. In this context, PBI 6/2026 may serve as an important impetus for banks and other Operators to further strengthen their governance and data protection frameworks and to embed principles of responsible business conduct more comprehensively into their respective business operations.

*Shabrina Hanifa (Associate) and Muhammad Alifiyan (Intern) assisted in the preparation of this insight

________________________________________________________________________________________________________________

Disclaimer: The information provided on this website does not, and is not intended to, constitute legal advice; instead, all information, content, and materials available on this site are for general informational purposes only.  Information on this website may not constitute the most up-to-date legal or other information.