OJK Cyber Security Compliance in Indonesia: The 2026 Guide for Financial Institutions

Last updated: 26 October 2026

Indonesia's financial regulator has spent the last four years turning cyber resilience from good practice into hard obligation. The Otoritas Jasa Keuangan (OJK) now sets clear cyber rules for commercial banks and other financial institutions. They must run formal cyber risk assessments and set up an independent cyber security function. They must also test their defences and report incidents. A new IT governance regulation took effect on 1 March 2026 and raises the bar again. New data protection rules under GR 33/2026 follow from 16 January 2027.

This guide explains the OJK cyber framework as it stands in 2026: the core regulations, what they require in practice, the recent changes financial institutions need to plan around, and how to approach compliance. It is written for boards, IT and risk teams, and security leaders at banks, digital banks, and financial technology firms operating in Indonesia.

What is OJK, and why does cyber compliance matter?

The Otoritas Jasa Keuangan is Indonesia's Financial Services Authority, the body that regulates and supervises the banking, capital markets, and non-bank financial sectors. As Indonesia's digital financial ecosystem has grown, OJK has treated cyber risk and IT governance as strategic priorities. It issued a connected set of regulations. Together they make sound technology risk management a licensing-level expectation, not an optional extra.

For financial institutions, the consequence is clear. Cyber security in Indonesia is now measured against specific regulatory requirements, assessed annually, and reported to the regulator. Some institutions treat it as an IT housekeeping task instead of a governed, board-level programme. That leaves them exposed to supervisory action. It also leaves them exposed to the operational risk the rules are meant to reduce.

The core OJK cyber regulations

Three instruments form the backbone of the current framework, with two more recent additions extending it.

POJK No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks is the foundation. It sets out the general framework, principles, and requirements for how banks govern and use information technology, covering:

• IT governance and IT risk management
• Cyber security and cyber resilience
• The engagement of IT service providers
• The location of electronic systems
• The assessment of a bank's digital maturity

It replaced the earlier POJK 38/2016 on IT risk management.

SEOJK No. 29/SEOJK.03/2022 on Cyber Security and Resilience for Commercial Banks, issued in December 2022, is the implementing circular that puts detail behind POJK 11. It was Indonesia's first cyber security regulation written specifically for banks, and it defines cyber resilience, cyber security, inherent risk parameters, and incident reporting. It runs to ten chapters and functions as a practical reference for implementation, not just a rulebook.

SEOJK No. 24/SEOJK.03/2023 on the Assessment of Digital Maturity of Commercial Banks adds the maturity dimension. It requires institutions to evaluate themselves across leadership, governance, operational monitoring, training, resilience, and data protection.

Two newer developments extend the framework and should be on every compliance plan:

BOC OJK Regulation No. 1 of 2026 on Information Technology Governance for Commercial Banks took effect on 1 March 2026, revoking and replacing the older OJK Circular Letter 21/2017. As an implementing regulation of POJK 11/2022, it gives more detailed guidance on IT governance, IT risk management, and cyber security. It also covers cyber resilience, IT service provider engagement, electronic system location, IT-based transactions, and digital maturity assessment.

It also adjusts report and licensing application formats. From the effective date, institutions must submit reports in the new format and within the new timelines.

POJK No. 30 of 2025 on Governance and Risk Management for Financial Sector Technology Innovation organisers introduces stricter governance and risk management standards for financial technology firms. It took effect on 1 July 2026 and applies to financial sector technology innovation platforms that hold an OJK business licence.

What OJK actually requires

Underneath the regulations sit a set of concrete obligations. These are the ones financial institutions most need to operationalise.

An independent cyber security function

SEOJK 29 requires banks to have a cyber security unit or function that is independent from the IT management function. The separation matters: the team responsible for defending and challenging the bank's security posture should not sit inside the same function it is meant to hold to account. For many institutions, standing up or formalising this independent function is the first structural change the rules demand.

Annual cyber risk assessment

Banks must identify their cyber security inherent risk through a series of assessments and processes conducted on an annual basis. Inherent risk is judged against parameters including technology, products, organisational characteristics, and the institution's track record of cyber incidents. This is a recurring, evidenced exercise, not a one-time baseline.

Cyber security testing

Institutions must test their defences. The results must be included in the report on the current condition of the bank's IT system implementation. That report goes to OJK. In practice this means a disciplined programme of vulnerability assessment and penetration testing, with findings documented to a standard a regulator will read.

Incident reporting to OJK

Cyber incidents must be reported to OJK. The circular treats a cyber incident as a threat, activity, or action that causes an electronic system to fail. It names malware, web defacement, denial of service, and distributed denial of service as examples. Institutions need an incident response process that can detect, classify, and report incidents within the regulator's expectations. That takes monitoring and detection capability, not paperwork alone.

Timing matters. SEOJK 29/2022 sets an early notice within 1 x 24 hours and a full report within 5 working days. BOC OJK Reg 1/2026 has its own reporting timelines in its annexes, so confirm the current ones with OJK.

IT governance and third-party risk

POJK 11 requires good IT governance with clear duties at board and director level. It also requires due diligence before selecting an IT service provider. With banks increasingly dependent on cloud and outsourced technology, third-party and supply chain risk management is a first-order compliance concern, not a procurement afterthought.

Digital maturity and data protection

The digital maturity assessment ties these threads together, evaluating the institution across governance, operational monitoring, resilience, and data protection. Consumer protection rules, including POJK 22/2023, reinforce the expectation that financial services businesses secure their information systems and maintain cyber resilience to protect consumers.

How to approach OJK compliance

A practical sequence starts with governance. Establish or formalise the independent cyber security function. Confirm board-level ownership of technology risk. The structure has to exist before the controls beneath it can be assured. Then build the recurring assessment engine: the annual inherent-risk assessment, the digital maturity evaluation, and the testing programme whose results feed the reports OJK expects.

The capability that most often needs strengthening is detection and response. The incident reporting obligation only works if the institution can detect incidents quickly and classify them accurately. That depends on continuous monitoring across the environment. Finally, review IT service provider arrangements against the due diligence and third-party risk requirements. Also make sure the reporting formats under BOC OJK Reg 1/2026, in force since 1 March 2026, are reflected in how the institution reports to OJK.

Where a managed security partner fits

Several OJK obligations are, at their core, security operations capabilities. Continuous monitoring, incident detection, and the ability to report incidents to OJK on time align with a managed detection and response and security operations centre model. The cyber security testing requirement aligns with breach and attack simulation and penetration testing services. Third-party and IT service provider risk aligns with threat intelligence and attack surface monitoring. Governance, assessment, and regulator-ready reporting align with a structured security services programme.

Primary Guard delivers cybersecurity services in Indonesia, Malaysia, and Thailand, pairing regional security operations with governance and testing services suited to regulated financial institutions. Banks and fintech firms may be weighing whether to build these capabilities in-house or partner. A free assessment is a practical way to benchmark current posture against OJK's expectations. Institutions regulated in more than one ASEAN market may also want to read this alongside our BNM RMiT compliance guide. The Malaysian and Indonesian financial cyber regimes share much of the same DNA.

Data protection: GR 33/2026

OJK rules cover cyber security. Personal data has its own law. Government Regulation 33 of 2026 (GR 33/2026) is the implementing regulation of Indonesia's Personal Data Protection (PDP) Law. It was signed on 16 July 2026 and takes effect on 16 January 2027. Banks and fintech firms that hold customer data should plan for it now.

Fines. Administrative fines of up to 2% of annual revenue.

DPIA. A data protection impact assessment is required before high-risk processing. The Authority's technical rules on DPIAs are still to come.

Breach notice. Notify within 3 x 24 hours (72 hours), counted from when the breach is established with reasonable certainty.

DPO. A data protection officer is required when any one of the legal conditions is met. They come from the PDP Law and include public services, large-scale monitoring, and large-scale processing of specific or criminal data.

PDP Authority. Not yet established. It still needs a Presidential Regulation.

GR 33/2026 sits beside the OJK rules, not in place of them.

Pending laws: not in force yet

Two proposals are still not law: the Cybersecurity and Resilience Bill, and the amendment to the PDP Law. Both are on the 2026 legislative priority list. Do not plan as if either is in force. We will update this guide if that changes.

Key takeaways

Indonesia's OJK framework has made cyber resilience a governed, annually assessed, and regulator-reported obligation for financial institutions. The essentials are an independent cyber security function, recurring risk assessment, tested defences, and timely incident reporting, with the 2026 additions raising governance expectations further. GR 33/2026 adds data protection duties from 16 January 2027. Treat this as a continuous security operations programme, not an annual documentation exercise. That is how institutions satisfy OJK and reduce real risk at the same time.

Sources: DFDL, 2026 | Rajah & Tann, 2026 | SSEK, Jul 2026 | OJK, Feb 2026 | KPMG Indonesia, Jan 2023 | Indonesia Business Post, Jun 2026

---

This article is provided for general information and does not constitute legal or regulatory advice. Financial institutions should refer to the relevant OJK regulations and circulars and consult qualified advisers on their specific obligations.