AI Regulation Tracker / Regulation in force
Indonesia now licenses AI credit-scoring firms and requires their data to stay onshore
Indonesia's financial regulator has put alternative credit-scoring operators under a formal license, with a capital floor, mandatory local data centers, and breach-notice duties. Foreign vendors that score Indonesian borrowers are pulled inside the perimeter.
Indonesia has closed the gap between experimental fintech and regulated finance for one of the more consequential uses of artificial intelligence in lending: deciding who counts as creditworthy. The country's Financial Services Authority, OJK, has placed alternative credit scoring under a binding license, according to firm briefings reporting the rule as POJK No. 29 of 2024. The regulation converts what had been an innovation activity into a supervised business with a capital floor, model requirements, data-localization duties, and consumer-protection obligations.
Alternative credit scoring, or ACS, is the practice of judging a borrower using data outside the traditional credit file. Instead of a repayment history, an operator reads signals from telecommunications usage, utility payments, and e-commerce behavior to build a score. The appeal is reach: tens of millions of Indonesians are unbanked or underbanked and invisible to conventional bureaus. The risk is that opaque models trained on proxy data make significant financial decisions about people with little recourse. OJK's response has been to license the activity rather than leave it in a sandbox.
What the rule requires
The reported obligations are concrete and testable. An operator must obtain an ACS business license from OJK. It must hold minimum paid-up capital of Rp5 billion. It must run proprietary models built on alternative, non-credit data rather than resell a third party's black box. It must keep both its primary data center and its disaster-recovery center inside Indonesia, a data-localization requirement that reaches straight into how a scoring firm architects its infrastructure. It must comply with Indonesia's Personal Data Protection Law. And it must give affected users written notification when their data is breached.
For firms already operating under the earlier innovative-credit-scoring regime, the transition had a hard edge. The licensing deadline for existing operators was reported as December 18, 2025, a date that has now passed. That makes the current question less about whether the rule is coming and more about who cleared the bar and who did not. A lender that continues to consume scores from an unlicensed provider inherits that provider's regulatory exposure, so the deadline is not only a vendor problem. It is a diligence item for everyone downstream of the score.
The capital floor and the model requirement work together. By setting a Rp5 billion paid-up threshold and insisting operators run proprietary models rather than white-label someone else's engine, OJK is filtering for firms with the balance sheet and the technical accountability to stand behind a credit decision. A scoring business that cannot explain or own its model no longer fits inside the licensed lane.
Where it sits in the framework
POJK 29/2024 does not stand alone. It sits under OJK's financial-technology-innovation umbrella, the ITSK framework established by POJK No. 3 of 2024, which took effect on February 19, 2024. That parent rule sets the sandbox and licensing architecture for technology innovation in the financial sector and traces its authority to the Financial Sector Development and Strengthening Law, UU P2SK No. 4 of 2023. In other words, alternative credit scoring is one licensed lane inside a broader regime OJK built to bring fintech innovation under formal supervision.
What it does not do
The rule is a licensing and prudential instrument, not a comprehensive AI-fairness statute. It does not, on the reported terms, impose a European-style risk classification or algorithmic-audit mandate on scoring models, and it does not resolve the broader procedural questions still pending under Indonesia's data-protection law, whose implementing government regulation has not been signed. What it does do is set a floor: be licensed, be capitalized, own your model, keep the data onshore, and tell users when something goes wrong.
The cross-border angle
For a US reader, the operative feature is data localization. A scoring or AI vendor based outside Indonesia cannot serve Indonesian lenders by processing borrower data on offshore infrastructure and calling it compliant. The requirement to house primary and disaster-recovery systems in-country, paired with the Personal Data Protection Law, effectively pulls foreign vendors inside Indonesia's regulatory perimeter or out of the market. It also previews a pattern other emerging markets are adopting: license the scorer, localize the data, and make the model owner accountable.
One caution on sourcing. The specific regulation number, POJK 29/2024, and the December 18, 2025 licensing deadline reach this piece through law-firm briefings rather than a directly confirmed government PDF, because OJK and the official regulation portal returned access errors on check. Both should be verified against the official text on ojk.go.id or peraturan.bpk.go.id before they are relied on for a compliance decision.
Frequently Asked Questions
What changed for alternative credit-scoring firms in Indonesia?
OJK moved alternative credit scoring from an innovation sandbox into a licensed activity, reported under POJK No. 29 of 2024. Operators must now hold an OJK license, keep minimum paid-up capital of Rp5 billion, run their own models on non-credit data, store data and disaster-recovery systems inside Indonesia, comply with the Personal Data Protection Law, and issue written breach notices.
Who is affected by the rule?
Firms that score borrowers using alternative data such as telecom, utility, and e-commerce records, the lenders that rely on those scores, and any foreign scoring or AI vendor that processes Indonesian borrower data offshore. Existing operators had to be licensed by a deadline reported as December 18, 2025.
Does this rule regulate the fairness of the AI models themselves?
Not directly. It requires operators to run proprietary models on alternative data and to be licensed and capitalized, but on the reported terms it is a licensing and prudential rule rather than a model-audit or risk-tiering mandate. Broader AI-governance expectations for finance sit in separate OJK guidance.
What does data localization mean here in practice?
An operator must keep its primary data center and its disaster-recovery center physically inside Indonesia. A vendor cannot serve Indonesian lenders while processing borrower data purely on offshore infrastructure, which constrains foreign credit-scoring and AI providers.
Sponsored Training
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.