Digital Bank in Indonesia: Not an OJK Licence, a Set of Duties

In Indonesia, a digital bank is not a licence. OJK says so in its official FAQ: it "tidak menerbitkan izin (lisensi) Bank Digital secara khusus", it issues no specific digital bank licence. A digital bank is a way for an Indonesian-incorporated commercial bank (a Bank BHI) to operate, governed by Articles 23 to 31 of POJK 12/POJK.03/2021 on Commercial Banks, promulgated 30 July 2021. It runs its business mainly through electronic channels, must still keep one physical head office, and has to keep meeting six conditions for as long as it calls itself a digital bank. A bank that runs an app without meeting those six is, in OJK's words, "baru sebatas" (merely) a bank providing digital banking services. That's a different regulation: POJK 21 of 2023.

We wrote this for heads of compliance and risk at Indonesian commercial banks, and for the regional compliance teams of foreign banking groups with an Indonesian presence. The CRO and legal are the second readers. Google's results for "digital bank" in Indonesia are lists of apps for savers. We read the regulation from the side of the bank that has to defend the label in front of OJK's examiners.

What POJK 12/POJK.03/2021 means by a digital bank

The definition sits in Article 1 point 22:

Bank Digital adalah Bank BHI yang menyediakan dan menjalankan kegiatan usaha terutama melalui saluran elektronik tanpa kantor fisik selain KP atau menggunakan kantor fisik terbatas.

In our translation: a digital bank is a Bank BHI that provides and runs its business mainly through electronic channels, with no physical office other than its head office (KP), or with limited physical offices. The operative word is "mainly", not "entirely". Several explainer pages in the search results say a digital bank runs fully online with no office. Article 23(2) disagrees: a digital bank "wajib memiliki 1 (satu) kantor fisik sebagai KP", it must have one physical office as its head office. The elucidation of Article 23(3) allows further physical offices, as long as they're limited in number, type or location.

Readers used to markets where the regulator hands out a named digital bank licence tend to look for the Indonesian equivalent. There isn't one. Two scope limits matter more. First, "Bank" in POJK 12/2021 means a conventional commercial bank. Islamic commercial banks read the parallel provisions in POJK 16 of 2022 on Islamic Commercial Banks (promulgated 31 August 2022), Article 1 point 20 and Articles 22 to 27. The text runs parallel, except that the inclusion condition reads "Islamic financial inclusion". Second, a branch office of a foreign bank (KCBLN) can't operate as a digital bank, according to answer 5e of OJK's FAQ on POJK 12/POJK.03/2021. A foreign group that wants a digital bank in Indonesia needs a locally incorporated bank, not a branch.

Status as of 11 November 2026: BPK's legal database (JDIH BPK) lists POJK 12/2021 as "Berlaku" (in force) with no amending regulation. That's one catalogue's record, not proof that nothing has amended it.

Two terms, two regulations: our count

We counted three terms in the official text of three regulations, downloaded from ojk.go.id on 11 November 2026. Method: text extracted from the PDFs, whitespace and line breaks normalised so a phrase broken across lines still counts, case-insensitive search. The terms are counted in Indonesian, because that's the only legally binding text. "Digital Bank" in reverse order (as in "Maturitas Digital Bank") wasn't counted.

The two terms live in two regulations that don't use each other's category. POJK 21 of 2023 on Digital Services by Commercial Banks (promulgated and in force 22 December 2023) doesn't mention "Bank Digital" once. POJK 12/2021 uses "digital banking service" exactly once, in its list of sanctions.

The single "Bank digital" in PADK 1 of 2026 on IT Operation by Commercial Banks (issued 23 January 2026, in force 1 March 2026) is in Annex I, in the part on changing the IT Strategic Plan (RSTI). "A change in the Bank's business model to a digital bank" is listed as one of the significant conditions that allow a bank to revise its RSTI mid-period. For a compliance team that's a practical pointer: a decision to become a digital bank is an IT document too, not just a business one.

Digital bank vs digital services: what each obliges

The table sets what POJK 12/2021 requires of a bank operating as a digital bank against what POJK 21/2023 requires of every bank that runs a Digital Service. We covered the digital-services side in detail in mobile banking in Indonesia under POJK 21/2023; here it stays at the level of the category.

The six conditions in Article 24(1) are: a business model with innovative and secure technology; the ability to run a digital business model prudently and sustainably; adequate risk management; governance, including directors competent in IT; protection of customer data security; and a contribution to the digital financial ecosystem or financial inclusion. Article 24(2) makes them continuing: the bank "wajib menjaga pemenuhan persyaratan", it must keep meeting them, for as long as it operates as a digital bank. Falling short opens the sanction ladder in Article 31, from a written warning up to barring the controlling shareholders, directors and commissioners from acting as principal parties.

On the digital-services side, a late evaluation report costs Rp1 million per working day, capped at Rp50 million per report (Article 36). Two-factor verification, and the requirement that one factor be biometric for remote verification (Article 5(6)–(7)), are the subject of Friday's article on authentication.

The two categories stack; they aren't alternatives. That's our reading of Article 30 of POJK 12/2021, which requires a digital bank to meet every provision that applies to a Bank BHI. A digital bank is still a commercial bank, so its app is still a Digital Service under POJK 21/2023. Every bank sits in the right-hand column. A digital bank sits in both.

Two routes to becoming a digital bank, and a capital figure often misquoted

Article 25 opens two routes: establishing a new Bank BHI as a digital bank, or transforming an existing bank. The elucidation describes transformation as a bank that "changes its business strategy into a Digital Bank".

• New establishment. Article 12(1) sets paid-up capital of at least Rp10 trillion to establish a Bank BHI. That floor belongs to establishment in general, not to digital banks, and it isn't absolute: under Article 12(2) OJK may set a different amount on specific grounds, and under Article 11(2) the establishment requirements don't apply to a bank perantara (bridge bank). What's specific to digital banks is in Article 26(2): only 30% of the capital has to be deposited when applying for in-principle approval, against 40% for a new conventional bank (Article 15(1)(i)).
• Transformation. The bank sets out how it will meet Article 24 in its Bank Business Plan (Article 27(2)). Once it meets them, it may keep its offices and electronic terminals, close them all at once or in stages, or add more (Article 27(3)).

For transformation, OJK's FAQ (answer 5d) cites core capital of Rp3 trillion, or Rp1 trillion for a bank that belongs to a banking group, and says the figure follows POJK 12/POJK.03/2020 on Bank Consolidation. So it's the general core-capital floor from consolidation, not an extra digital-bank condition. We haven't read POJK 12/POJK.03/2020 itself, so we quote the figure as the FAQ's statement. Digital bank lists that cite "Rp10 trillion" as the price of becoming a digital bank mix the two up.

The two "POJK 12" trap

OJK has two regulations numbered 12 that both deal with digital, and only one of them is in force:

• POJK 12/POJK.03/2018 on Digital Banking Services by Commercial Banks. Revoked by Article 39 of POJK 21/2023 as of 22 December 2023.
• POJK 12/POJK.03/2021 on Commercial Banks, which contains the digital bank category. In force since 30 October 2021, three months after promulgation (Article 160).

One of the pages Google's AI Overview cites for this topic, a post on a city government's legal-information (JDIH) site drawn from a 2023 webinar, defines digital banking from the 2018 regulation. Any internal policy, group compliance manual or training deck that cites "POJK 12" for digital services without a year needs checking: it very likely points at a dead rule. Article 37 of POJK 21/2023 gave banks that already ran digital services 3 months to align policies and procedures and 1 year for IT infrastructure. Counted from 22 December 2023, both deadlines have passed.

Which one applies to our bank?

OJK's FAQ, answer 5b, says the label from OJK is "bukan suatu hal yang prinsip", not a matter of principle. What OJK cares about is the claim: a bank that calls itself a digital bank must meet the rules, "bukan menjadikan label Bank Digital hanya sebagai gimmick bisnis semata" (rather than using the label as a mere business gimmick). The questions follow from that, in order:

1. Does the bank run an app, internet banking or another service that gives access to transactions or accounts? Then POJK 21/2023 applies. A website carrying only public information, with no transactions or account access, is not a bank product (Article 4).
2. Does the bank call itself a digital bank in marketing, its business plan or its annual report? Then Articles 23 to 31 of POJK 12/2021 apply as well, including the six continuing conditions and the Article 31 sanctions.
3. Is it a KCBLN, a foreign bank's branch? It can't become a digital bank, but it's still bound by POJK 21/2023.
4. Is it an Islamic commercial bank? Read POJK 16/2022 Articles 22 to 27, not POJK 12/2021.
5. Is it a BPR (rural bank)? Both POJKs regulate commercial banks, so neither applies.

The position easiest to defend in front of the board and the examiners: most conventional banks sit only in the right-hand column, and the words "digital bank" in a campaign aren't the marketing team's call. They're a regulatory claim that has to pass compliance review. Our view goes further. If compliance can't put a file on the table today showing all six Article 24 conditions met, the bank shouldn't use the label at all. Pulling it from a campaign costs far less than explaining it to an examiner. That review also runs into the consumer-protection duties of POJK 22/2023.

Insurers and multifinance companies

In the two POJKs we read, insurance and multifinance have no institutional counterpart to the digital bank; what they have are service categories. Insurers have Digital Insurance Services: Article 52B of POJK 36 of 2024 (promulgated 23 December 2024) bars running them before OJK approves, and Article 52A limits them to selling products whose whole process is digital, with no face-to-face meeting. Finance companies have Digital Financing Services, introduced by POJK 46 of 2024 (promulgated 31 December 2024). POJK 46/2024 has since been amended by POJK 35 of 2025, which we haven't read, so we don't cite its article numbers. Nor have we checked every licensing POJK in either sector.

A list of OJK-registered digital banks: there is none, and there won't be

Because OJK issues no digital bank licence (FAQ 5e), it keeps no register of digital banks either. Every "digital banks in Indonesia" list online is a collection of the banks' own claims, compiled by the writer, and usually mixes digital banks with apps run by conventional banks. The top-ranking list for this query is dated March 2023 and doesn't mention OJK at all. We haven't built a rival list, because no OJK source exists to date it against.

What can be checked is the commercial bank's licence, not the digital label. The AI Overview for the Indonesian query "bank digital adalah" also cites a document titled "Draft CP Digital Banking". We couldn't find it on ojk.go.id as of 11 November 2026. Its own title says draft: even if it exists, it's a consultation draft, not a regulation, and no compliance position can rest on it.

What the compliance team should do

• Inventory every place the bank calls itself a "digital bank": website, app, ads, business plan, annual report, and any group-level investor material that describes the Indonesian entity. Each one is a claim that Article 24 compliance has to back.
• Replace any "POJK 12" reference without a year in internal policy with the full number.
• If the board decides to transform, note that PADK 1/2026 names that decision as grounds for revising the RSTI. The business plan and the IT plan change together.
• For customer onboarding in the app, the AML/CFT duties for digital onboarding and the bank's obligations on cloud apply in both categories.

The "digital bank" claim is born most often on the website and in product material, not in the business plan, which is why content approval workflows matter to compliance. WEBARQ built the websites of three BCA Group entities, BCA Sekuritas, BCA Syariah and BCA Insurance, on a CMS with drafts, preview, merge and multi-layer approval. 42 of our 214 clients are in banking and financial services. We don't handle digital bank licensing; we do website development for regulated financial institutions.

This article was prepared with AI assistance and checked against the regulation texts from ojk.go.id. Quotations from the regulations and the FAQ are in the original Indonesian, with our translation. The term count was run on 11 November 2026.