Indonesia - AI Governance for Banking

Overview

The Buku Panduan Tata Kelola Kecerdasan Artifisial Perbankan Indonesia, published on 29 April 2025 by the Financial Services Authority (OJK), provides banks with a sector-specific, lifecycle-based approach to govern AI systems. The Guidance is intended as a minimum benchmark that complements existing OJK IT and cyber regulations and Indonesia’s Personal Data Protection Law. It frames responsible AI adoption through three core principles: reliability (ensuring outcomes are consistent with bank objectives), accountability (clear assignment of roles, responsibilities and auditability) and human oversight (ensuring adequate human control and escalation points). The document emphasizes end-to-end governance across initiation, design, validation, deployment, monitoring, maintenance and audit. The full OJK publication and press materials are available from the OJK portal: OJK - Tata Kelola Kecerdasan Artifisial Perbankan Indonesia.

Definitions

The Guidance defines key terms used in the manual to ensure consistent application across banks. Important definitions include 'AI system' (systems that perform tasks by processing data through machine learning or rule-based models); 'advanced AI systems' (large-scale or emergent-capability models with significant autonomy or complexity); 'AI lifecycle' (phases including scoping, design, development, testing, deployment, monitoring and retirement); 'AI committee' (an internal governance body overseeing AI use); 'data controller/processor' (terms aligned with national data protection law); and 'material impact' (customer or market-facing effects that are measurable or could cause reputational, financial or legal harm). Definitions are harmonized with OJK IT rules and national PDP law to reduce regulatory friction.

Governance and Institutional Framework

The Guidance instructs banks to embed AI governance into existing corporate governance structures. Key governance expectations include establishing an AI Committee or integrating AI oversight into an existing technology or risk committee, with representation from legal, compliance, risk, data science, information security and customer experience functions. Senior management must articulate strategy and risk appetite for AI and ensure board-level visibility. The Guidance recommends role profiles (AI owner, model owner, business owner, data steward, model validator, independent auditor) and requires documented delegations of authority and escalation paths. Vendor management must include due diligence, contractual clauses on data protection and model transparency, and rights to audit third-party AI models. The Guidance links to OJK’s IT regulation, POJK No. 11/POJK.03/2022, and advises banks to align committee mandates with extant statutory obligations; see the POJK text: POJK No.11/POJK.03/2022 (implementation of IT by commercial banks).

Key Focus Areas

The Guidance sets out thematic priorities across multiple domains. Data governance and privacy: banks must maintain data lineage, ensure lawful basis under UU No.27/2022 (Personal Data Protection), implement minimization and retention policies, and perform Data Protection Impact Assessments for high-risk processing. Model development and testing: banks should document model design, training data characteristics, bias and fairness assessments, performance metrics across segments, and conduct robustness checks (including out-of-sample, adversarial and scenario testing). Transparency and explainability: banks must provide decisioning explanations proportionate to risk, internal interpretability tools and customer-facing disclosure where automated decisions materially affect customers. Operational resilience and security: embed secure development lifecycle practices, model access controls, encryption, and incident response. Monitoring and governance: continuous performance monitoring for data drift, concept drift and errors; threshold-based alerts; and scheduled review cycles. Human oversight: define where humans must approve, override or review system outputs. Vendor/supply-chain risks: contractual SLAs, technical validation rights and remediation clauses are required. International benchmarking and supervisory coordination: the Guidance references the EU AI Act and BCBS guidance to promote cross-border supervisory compatibility (OJK press release).

Implementation Framework

The Guidance proposes a practical implementation model banks should adapt proportionally to the scale and impact of their AI uses. Implementation steps include (1) inventory and risk classification of AI systems (low/medium/high), (2) policy and standards development (coding, data, security), (3) role assignment and capacity building (training programs for data scientists, risk and compliance), (4) model development and documentation standards (model cards, datasheets), (5) pre-deployment testing and independent validation, (6) deployment controls (canary release, phased rollout, rollback mechanisms), (7) real-time monitoring and periodic revalidation, and (8) audit and record-keeping for supervisory inspection. The Guidance highlights that high-impact models require additional governance gates such as independent model validation and board-level sign-off. It also recommends integration with existing SIKePO and OJK supervisory workflows and digital maturity assessments (SEOJK DMAB).

Monitoring and Evaluation

OJK expects banks to implement both continuous monitoring and periodic independent evaluation. Continuous monitoring must track technical metrics (accuracy, false positive/negative rates, drift indicators), operational metrics (latency, uptime), and business KPIs (customer complaint rates, conversion, loss metrics). Banks must define alert thresholds and automated remediation runbooks. Periodic evaluation includes scheduled model revalidation, independent audits (internal or third-party), ethical reviews and compliance checks against data protection standards. The Guidance instructs banks to prepare supervisory packs — concise dossiers for OJK review containing model documentation, test results, incident logs and board minutes — and to report material incidents per OJK incident protocols. Monitoring should be proportionate to risk and reflect the bank’s digital maturity and AI exposure.

Penalties, Liability, and Appeals

While the Guidance itself is not a statutory law, OJK will use it as a supervisory benchmark. Non-compliance can lead to OJK supervisory measures under its statutory powers and relevant POJKs and laws, including corrective directives, public admonitions and administrative sanctions described in broader OJK enforcement frameworks. Banks remain subject to legal liability under national laws, notably UU No. 27/2022 on Personal Data Protection (which sets civil and criminal liabilities for personal data violations) and financial sector statutes such as UU No.4/2023 concerning financial sector governance, which enables OJK enforcement. The Guidance also highlights contractual and civil liability exposure from harms caused by AI systems (consumer loss, discriminatory outcomes, fraud). Banks are advised to maintain redress channels and to document appeals and remediation for customers affected by automated decisions; see the Personal Data Protection law details at the official legislation portal: UU No.27/2022 (Personal Data Protection).

Relationship to Other Instruments

The Guidance is explicitly designed to complement and not replace existing OJK regulations and national laws. It references, inter alia, POJK No.11/POJK.03/2022 on IT implementation by commercial banks, SEOJK 24/SEOJK.03/2023 on digital maturity assessment, SEOJK 29/SEOJK.03/2022 on cyber resilience, and the national Personal Data Protection Law (UU No.27/2022). Banks should map AI governance processes to these instruments to avoid duplication and ensure consistent supervisory evidence. The Guidance also situates itself within OJK’s broader digital transformation roadmap and resilience guidance, recommending coordination with SIKePO and other supervisory toolsets. Links to relevant OJK documents and regulatory pages are provided throughout the Guidance and on the OJK portal: OJK - Guidance page.

International Alignment

OJK structured the Guidance with explicit international benchmarking. It cites the EU Artificial Intelligence Act and supervisory expectations from the Basel Committee on Banking Supervision (BCBS) as reference points for risk classification, testing and documentation. The Guidance also considers supervisory practice from the United States (including OCC guidance on model risk and AI use) and relevant frameworks from Singapore, Japan and China. The intent is to promote interoperability with global standards while reflecting Indonesia’s legal and cultural context. OJK encourages banks engaged in cross-border operations or sourcing third-party models to consider extraterritorial legal obligations and to ensure vendor contracts allow necessary access and validation rights for Indonesian supervisors. The OJK press release and annexes summarize the international sources and benchmarking used by the drafters: OJK press release (29 April 2025).

Implementation Timeline

Sources and References