IndonesiaOJK Regulation on Information Technology in Commercial Banks, Reporting of IT and Cyber Incidents
In force.
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a commercial bank (Bank Umum), conventional or sharia, which includes the branch office of a bank domiciled abroad and a sharia business unit (reached by declaring that you are a bank).
- Where an IT incident has or may have caused a significant loss or disrupted the smooth running of your operations, send the Financial Services Authority an initial notification within 24 hours after the incident becomes known, and an IT incident report within 5 working days after it becomes known (Article 60(1)). An IT incident is a critical event, misuse or crime in the operation of IT, in the form of a cyber incident or a non-cyber incident (elucidation of Article 60(1)).
- Send the initial notification in writing by electronic means, on the basis of the initial information available (Article 60(2)).
- Where another authority's rules set a faster deadline for the notification or report than Article 60(1), also send it to the Financial Services Authority at the same time as you send it to that authority (Article 60(4)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Financial Services Authority (Otoritas Jasa Keuangan), which imposes the administrative sanctions in Article 63 on a bank that is late with its initial notification: a written warning and, where the bank has still not complied, a ban on issuing new products, a freeze on certain business activities, or a lower governance score in its soundness rating.
Settledness
- As of
- Open questions
- What counts as a significant loss for the purposes of the Article 60(1) trigger, given that the Regulation leaves financial and non-financial loss undefined beyond the elucidation's examples?
What this law does
Article 60(1) requires a commercial bank, where an IT incident has or may have caused a significant loss or disrupted the smooth running of the bank's operations, to send an initial notification within 24 hours and an IT incident report within 5 working days after the incident becomes known. Article 60(2) requires the initial notification to be sent to the Financial Services Authority in writing by electronic means, on the basis of the initial information available.
Article 60(4) requires the bank, where another authority sets a faster deadline for the notification or report than Article 60(1), to give the Financial Services Authority the notification and report at the same time as it meets that deadline. The elucidation of Article 60(1) defines an IT incident as a critical event, misuse or crime in the operation of IT, in the form of a cyber incident or a non-cyber incident.
The elucidation of Article 60(1) defines a cyber incident as a cyber threat, in the form of an attempt, activity or act, that causes an electronic system not to function as it should. Article 63 provides for a written warning for a bank that is late in sending the initial notification, and, if the bank has still not complied, a ban on issuing new products, a freeze on certain business activities, or a lower governance score in its soundness rating.
The Regulation applies to a commercial bank, which includes the branch office of a bank domiciled abroad and a sharia business unit. Article 73 provides that the Regulation takes effect after three months from the date of its promulgation. The Regulation was promulgated in Jakarta on .
When LexLint raises it
When your app profile says your app is a bank.