OJK tells Indonesia's online lenders to plan for fast recovery from hacks

The short version

• OJK has issued new cyber security guidelines for online lending platforms,. OJK is Indonesia's financial regulator.
• Platforms must plan to detect and recover from attacks quickly, because no system can block every attack.
• Lenders and debt collection firms also signed an integrity pact on 10 November, promising to collect debts without threats and to protect borrowers' personal data.

What OJK announced

OJK launched the guidelines in Jakarta on 10 November 2026 and published its press release the next day. BSSN, the national cyber agency, helped draft them. So did the two online lending industry associations and ISACA's Indonesia chapter.

Agusman, who leads OJK's supervision of financing and other non-bank lenders, set out the reasoning. In his words, no system is fully immune to cyberattacks. Platforms must therefore spot attacks early and respond well. They must also restore service quickly.

The guidelines cover five areas:

• governance: who in the company is responsible for cyber security;
• identification: knowing which systems and data matter most;
• protection: the controls that keep attackers out;
• detection and monitoring: spotting an attack early;
• response and recovery: handling an incident and getting service back.

They come with a self-assessment tool. Each platform can use it to measure how mature its security is. It also helps find weak spots and plan the fixes. OJK says the rules apply in proportion to risk. A small platform will not be held to exactly the same bar as a large one.

What is actually new

Agusman said the industry must move away from an approach that focuses only on keeping attackers out. This document puts recovery on an equal footing with prevention.

OJK also made a point about ownership. Agusman said cyber security is not just a job for the IT team. It is part of company governance and risk management. That means the board of directors and the board of commissioners must be actively involved.

BSSN's deputy for economic cyber security, Slamet Aji Pamungkas, added a business framing. He described cyber threats as a business risk. They can cause financial losses and halt operations. They can also damage a company's reputation.

The second half of the event was about how lenders treat borrowers. Online lenders and debt collection firms signed a pact on ethical collection. Agusman said collection must protect consumers and keep personal data confidential. It must also be free of intimidation and violence.

What it means for companies in Indonesia

If you run or invest in an online lending platform, these guidelines show what OJK expects. The self-assessment gives you a ready way to show where you stand.

The board-level point matters most. OJK is saying directors share the responsibility for cyber security, alongside the IT team.

The guidelines also reach beyond lenders. Platforms depend on outside partners, from cloud providers to outsourced debt collectors. Each of those is a way in for an attacker. Lenders are likely to ask their suppliers harder questions, so suppliers should be ready with answers.

Banks and other financial firms may want to read this as a signal too. OJK's wider message is that resilience, meaning how quickly you recover, belongs in governance.

What to do this quarter

• Run OJK's self-assessment and share the results with the board, not only the IT team.
• Write down how long each critical service can be down, then test whether your recovery plan meets that target.
• Review contracts with outside partners for security duties and incident reporting.
• Check that debt collection scripts and agencies follow the new pact, especially on data privacy.
• Run a practice drill that assumes an attacker is already inside, and time how long recovery takes.