Mobile Banking in Indonesia: What POJK 21/2023 Makes Banks Decide

OJK's consumer-education site, Sikapi Uangmu, defines mobile banking as a bank service for transacting through an app downloaded to a smartphone. The rule that actually binds Indonesian banks never uses the term in its operative text: POJK 21 of 2023 on Digital Services by Commercial Banks, in force since 22 December 2023, does not say "mobile banking" once in its 40 articles. To OJK, your app is a Layanan Digital (Digital Service), and that label comes with decisions the bank has to make and document itself: a unit that runs it, a product licence where one applies, ownership of the source code, and a complaints function that runs 24 hours a day.

We wrote this for the Head of Digital or CIO who decides what a bank's mobile and internet channels must cover, with compliance as the second reader. The pages Google shows for this query explain app features to customers. We read the regulation from the institution's side.

What mobile banking means to OJK

The consumer definition sits in an OJK Sikapi Uangmu article: a service a bank provides for various transactions through features or menus in an app downloaded and installed on a smartphone. That page is education material, not regulation, and it carries no date.

The legal definition is in Article 1 point 4 of POJK 21/2023. Our translation of the Indonesian text:

Digital Service is a Bank product in the form of a service provided by the Bank using IT through electronic media to give customers and/or prospective customers access to Bank products as well as products and/or services of the Bank's partners, and which customers and/or prospective customers can use on their own.

We counted the terms in the official text of POJK 21/2023. "Mobile banking" appears 5 times, all in the Penjelasan (the official Elucidation that accompanies an Indonesian regulation), and 0 times in the articles or the Appendices. "Internet banking" appears twice, also only in the Elucidation. "Layanan Digital" appears more than 140 times. The General Elucidation treats internet banking and mobile banking as the bank's own delivery channels. So when OJK examiners arrive, they aren't examining "the mobile banking app". They're examining how the bank operates its Digital Services.

Article 4 draws one line worth knowing. A service that only publishes public information and communicates with customers, with no transactions and no account access, is not a bank product. The Elucidation gives a contact centre and a chatbot as examples. The moment a site or app shows a balance, it falls under the Digital Services regime.

On scope: POJK 21/2023 binds Commercial Banks only. That covers conventional banks, sharia banks, branches of foreign banks and sharia business units (UUS). Insurers and multifinance companies are outside it.

Mobile banking vs internet banking, as the regulator sees them

For OJK they are one category. The report formats in Appendix III of PADK 1 of 2026 on IT Operation by Commercial Banks (OJK's implementing guidance, issued 23 January 2026, effective 1 March 2026) list the types of electronic banking terminal as "Phone Banking; SMS Banking; Internet/Mobile Banking". One row covers both, reported each year by frequency, value and number of users.

Format 3.2.17 in the same PADK goes further. The identification list for vital information infrastructure names only two system types: Core Banking System and Internet banking and/or mobile banking. Your digital channel sits next to core banking as a candidate vital system.

So the difference lies in the device and the interface, not in the rulebook. That's our reading, not OJK's wording. One detail still deserves a note: the Elucidation of Article 13(4)(a) of POJK 21/2023 uses transactional internet banking as its example of a Digital Service a bank launches for the first time, which must be reviewed by an independent party outside the bank, such as an IT security consultancy. The example covers financial transactions (transfer, pay, buy) and non-financial ones (balance check, statement).

On which channel is safer, only one ranking page takes a side. pasartrainer (17 February 2025) says mobile banking is more secure than internet banking. Dealls (18 February 2025) lists security features and phishing risks for both but doesn't say either is more secure. We couldn't read the body of BTN's page (5 December 2024), so its position is unverified. In our view the question is the wrong one anyway. Security comes from the authentication design the bank chooses, not from the channel type. Article 9(1) requires at least two authentication factors to verify financial transactions, on any channel.

Features an app "has" vs decisions the bank must make

The table sets the claims common in consumer articles against what POJK 21/2023 and PADK 1/2026 require the bank to decide and document. The last column gives the legal basis.

We read the 11 pages that ranked for, or were cited by the AI Overview on, the Indonesian query "mobile banking adalah" (what is mobile banking) on 9 November 2026. Not one mentions OJK, a POJK or the PADK.

Transaction scope and product licensing

Article 11 of POJK 21/2023 makes payment-system services licensed by Bank Indonesia a "basic Bank product". The Elucidation names QRIS (Indonesia's national QR payment standard) and e-wallets, with the example of adding QRIS payment to an existing mobile banking app. A service that meets the criteria for a new product is another matter. It needs an OJK licence (Article 12), with a statement signed by the compliance director and the director in charge (Article 13(2)), plus an independent review of the product's characteristics, the adequacy of its IT security and its compliance. For an added feature the review may be internal, but the reviewer must not have helped design or build the app. A vendor's team can't review its own work.

After go-live, the realisation report is due no later than 5 working days after implementation and the evaluation report within 3 months (Article 32). A late evaluation report costs Rp1,000,000 per working day, capped at Rp50,000,000 per report (Article 36). Under Appendix IV, the evaluation covers system performance, customer complaints, fit with user requirements and how well the security controls work. That's where usability testing before go-live produces evidence you can attach.

A limit is a risk decision, not a constant

POJK 21/2023 sets no transaction ceiling. Its only rupiah figure, Rp500,000, is an example in the Elucidation of Article 9(2): transactions below it need not prompt for the password again, provided the bank bases that on its own risk analysis and the customer's consent. It illustrates a principle. It is not a cap.

Published limits show what follows. The m-BCA limit table on BCA's mobile banking page varies by account type: Rp50–150 million for transfers between BCA accounts and Rp20–50 million to other banks, and those limits are shared with the ATM transfer limit. The table is marked "Update: 8 Oktober 2021", while the SMS tariff on the same page was updated on 13 October 2025. A limit is a product parameter that needs an owner, a review schedule and an approval trail. Not a figure left on a website for five years.

Onboarding inside the app

Article 5(3) allows three verification paths: in-person face to face, electronic face to face (a video call), and electronic without face to face. For both electronic paths, paragraph (7) requires a "something you are" factor, meaning biometrics, as one of the two factors. The bank's decision is which paths the app opens and which stay tied to a branch. We cover each step in the legal basis for KYC and digital onboarding in Indonesia.

Availability as an obligation

In consumer articles, "available 24 hours" is a feature. In POJK 21/2023 it is a duty. Article 21 puts availability among nine security control principles, and Article 26 requires an enquiry and complaints function running 24 hours a day, every day, holidays included. PADK 1/2026 adds a deadline for the initial IT incident notification to OJK: no later than 24 hours after the incident is discovered. Neither text sets an uptime figure or an RTO. Those are the bank's call and belong in the contract, as we explain in SLA downtime minutes and OJK clauses and in what bank channel availability costs.

Who owns the channel when a vendor builds it

Article 18 of POJK 21/2023 requires the bank to set up a unit or function that handles its Digital Services, with seven duties, including monitoring financial transaction data. An existing unit can hold the role, but it has to be designated. The Elucidation of Article 2(1) states that providing IT services, such as switching and APIs, is not a Digital Service. An IT vendor is not a partner; the service stays the bank's.

PADK 1/2026 turns that into things an examiner can check:

• The bank must own the source code of software developed specifically for it, so that it can be accessed for examination and investigation (Appendix I, Chapter II.C.2(i), page 14).
• An escrow agreement is only a mitigation where the bank doesn't own the source code of an application run by an IT service provider, or PPJTI (Chapter V, page 60).
• The bank remains responsible for transaction processing carried out by the PPJTI (Chapter VI, page 63), in line with Article 39 of POJK 11/POJK.03/2022, which requires IT-based transaction processing to take place in Indonesia.
• The Application List report asks, for every application in category "06: Layanan Digital", for the developer ("inhouse" or the PPJTI's name) and a status of "Sewa" (leased) or "Beli Putus" (bought outright).

That last item is the one procurement most often misses. If the vendor contract doesn't settle those two columns, the annual report to OJK will force the question. How to write it into the tender documents is in the seven parts of a ToR for a bank website or app, and data placement is covered in what OJK requires of banks using cloud.

How much volume the channel carries

According to Bank Indonesia Press Release No. 28/233/DKom of 21 October 2026, digital payment transactions reached 18.09 billion in Q3 2026, up 39.24% year on year. Volume through internet payments grew 14.26% and through mobile payments 45.55%. BI defines digital payments as transactions through mobile banking, internet banking and server-based e-money, so the mobile payments figure isn't purely mobile banking. The direction is still clear: the mobile channel grew about three times as fast as the web channel.

Insurers and multifinance companies

POJK 21/2023 doesn't apply to them. For insurers selling products digitally, Article 58(2) of POJK 8 of 2024 (promulgated 29 April 2024, effective six months later) requires registration as an electronic system operator (PSE) and an IT risk-management policy, and Article 60 limits digitally sold products to individual policies with simple risk selection. That rule governs selling. We haven't found an OJK text governing a policyholder service app that doesn't sell, so don't assume such an app falls under POJK 8/2024 by default. For multifinance, we haven't re-checked the channel rules and won't guess.

WEBARQ's experience in this sector is web channels for financial institutions, not mobile banking apps. For MSIG, online insurance purchase connects directly to core financial systems for policy sales and premium collection, with e-policies issued automatically. For PFI Mega Life, online purchase connects to the internal ERP, and e-policy management deliberately leaves out auto-renewal so the customer stays in control. That kind of core-system integration is also what shapes a bank channel's architecture. Appendix I of POJK 21/2023 asks a licence application to describe the IT architecture and how it connects to the core banking system.

What the Head of Digital needs on the desk before the next meeting

1. The name of the unit or function that holds Digital Services under Article 18, with its seven duties in the job descriptions.
2. A feature map: which items are basic products and which need an OJK licence and an independent review.
3. The risk analysis behind every limit, with the date it was last reviewed.
4. For each application: the developer, the leased or bought-outright status, and where the source code lives.
5. Evidence that the complaints function runs 24 hours on holidays, and the procedure for the 24-hour incident notification to OJK.
6. A feature that lets customers revoke a partner's access to their data (Article 29(3)).

If you're planning a new channel or replacing a vendor, WEBARQ's mobile app development team can help set a scope that answers this list from the tender documents onward, not when the annual report falls due.