AI Regulation Tracker  /  Regulation in force

Indonesia's OJK P2P Rule (POJK 40/2024) Hardens Credit-Scoring and Risk-Disclosure Duties

Indonesia's financial regulator has replaced its 2022 peer-to-peer lending rule with a tougher instrument that requires a real credit assessment before any loan is funded. Any firm scoring Indonesian borrowers, including foreign-owned platforms, now carries the obligation.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Indonesia's Financial Services Authority, the Otoritas Jasa Keuangan or OJK, has replaced the rulebook that governs the country's peer-to-peer lending industry. OJK Regulation No. 40 of 2024, covering what Indonesian law calls Layanan Pendanaan Bersama Berbasis Teknologi Informasi, or information-technology-based joint funding services, succeeds the earlier POJK 10 of 2022. The sector is known locally as "pindar." The regulation is in force. It matters because it hardens the duties operators owe before money moves and the information they must put in front of the people funding each loan.

The core duty: assess before you disburse

The center of the rule is a strengthened credit-assessment obligation. A P2P operator must run a sound credit assessment before disbursing funds. This is not new in spirit. The 2022 predecessor already expected lenders to look before they leaped. What POJK 40/2024 does is make that obligation firmer and pair it with disclosure requirements aimed squarely at the funding side of the platform.

Operators must display credit-assessment and funding-risk information to lenders, and they must disclose the inherent funding risk that comes with lending through the platform. In practice this pushes the assessment out of the back office and onto the screen. The person deciding whether to fund a loan is meant to see the scoring signal and a plain statement that the money can be lost. Around these specific duties sit broader risk-management and governance obligations that apply to the operator as an institution. Taken together, the changes shift the burden from a light-touch, click-to-fund experience toward one where the platform has to stand behind both its scoring and its warnings.

The reason the sector drew this attention is well known inside Indonesia. Peer-to-peer lending grew fast, reached borrowers the banks did not serve, and produced a run of consumer-protection complaints. A rule that ties funding to a documented assessment and to visible risk information is OJK's answer to that pressure. For a compliance officer, the useful framing is that the regulator now expects evidence, not assurances.

What this rule is, and what it is not

It is worth being precise about the nature of this instrument, because it is easy to overstate. POJK 40/2024 governs credit scoring generally. It is not an AI-specific mandate. It does not, on its own, impose a machine-learning transparency regime or a statutory "right to explanation" on automated lending decisions. Those ideas, automated or AI-based decisioning and a right to explanation, are emerging supervisory themes for the pindar sector rather than hard obligations written into this particular rule. A reader should treat them as direction of travel, not as text to comply with today.

There is a second point of care. The regulation number and the description of its duties reached English-language readers largely through secondary reporting, including Indonesian trade press such as Kontan. The "POJK 40/2024" designation and the specifics should be confirmed against the official text on ojk.go.id before anyone relies on a precise article citation. The substance, a tougher pre-disbursement assessment plus lender-facing risk disclosure, is consistently reported, but the exact promulgation day is unverified.

Some coverage has also mentioned a borrower repayment-ratio cap, a limit on how much of a borrower's income can go to loan repayment, put loosely at somewhere around 30 to 50 percent. That figure is unverified and should not be treated as a fixed threshold. If it matters to your operation, confirm it directly in the regulation rather than from summaries.

Why it reaches beyond Indonesia

For a firm outside Indonesia, the relevant fact is that the duties follow the borrower, not the head office. Foreign-owned platforms operating in the Indonesian market are subject to the same credit-scoring and data duties as domestic operators. A platform that scores Indonesian borrowers from an offshore team still owes the pre-disbursement assessment and the lender disclosures. For US-based fintechs and their advisers, the more useful signal is directional. Indonesia is one of several markets moving from "have a policy" toward "show the assessment and disclose the risk" in consumer and small-business lending, and the emerging talk of explainability for automated decisions previews where supervisory expectations are heading.

The practical read

The operational change is modest but concrete. Credit and compliance teams should be able to point to a documented assessment behind every funded loan, and product teams should ensure lenders see the scoring and funding-risk information at the moment they decide. None of this requires an AI system. It requires a defensible process and honest disclosure. The safest next move is to obtain the official POJK 40/2024 text from ojk.go.id and reconcile it, line by line, against how loans are actually assessed and how risk is actually shown today.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.