Capex vs Opex for Bank IT: Channel Availability and CET1

Capex vs opex comes down to where a cost lands: opex (operating expenditure) is expensed to profit and loss in the period it's incurred, like a cloud subscription, rent or non-production salaries, while capex is recorded as an asset and then depreciated or amortised. For an Indonesian bank the difference reaches past accounting. Software a bank develops itself and capitalises is deducted from Common Equity Tier 1 (CET1) at its carrying amount less the related deferred tax liability, under the Elucidation to POJK 34/POJK.03/2016. An expensed subscription never becomes an asset, so it is never deducted. On our numbers, as of 24 October 2026, one reference channel on AWS Jakarta with multi-zone and a warm DR site inside Indonesia costs about Rp366 million a year (roughly USD 20,250) before VAT.

This is written for the CFO, financial controller and procurement lead who sign off on how a bank, insurer, multifinance company or listed issuer buys availability for its digital channels. If you sit in a regional head office and approve budgets for an Indonesian subsidiary, the capital rule below is the part your home-country playbook won't cover. The last section is for compliance and risk: the regulatory costs that stay put whichever way you buy.

What is opex, and where does depreciation go?

The pages that explain opex disagree on one point: whether depreciation counts as opex. For a bank's IT spend, OJK has already settled it. Format 3.2.12, "Biaya Teknologi Informasi" (IT costs), in Appendix III of PADK OJK 1 of 2026 (issued 23 January 2026, in force 1 March 2026) splits the charge to profit and loss into two lines, capex and opex. The capex line carries depreciation of investment spend. The opex line carries operating costs. Capex added during the year is reported separately, as a charge to the balance sheet.

So in an OJK report, server depreciation and software amortisation stay capex even as they flow through P&L. They are not opex. In a general income statement both often sit inside "operating expenses", and an EBITDA-style analysis strips them out. Pick one definition and write it into the budget memo. A committee comparing two figures built on different definitions will misread the gap between them.

On salaries: pay for staff not directly involved in production is opex, while direct labour goes into cost of goods sold. For a team building channel software, salaries during the development phase can be capitalised. In a bank, that is exactly the money that later touches capital.

Capex vs opex for IT, line by line

The table below is our reading of the accounting standards, not a quotation from them. The PSAK texts are paywalled and we haven't read them directly. Watch the numbers: IAI renumbered PSAK and ISAK with effect from 1 January 2024. Leases are now PSAK 116, the Indonesian adoption of IFRS 16. Intangible assets are PSAK 238, adopting IAS 38. Website costs fall under ISAK 232, adopting SIC-32. A reference to "PSAK 73" or "PSAK 19" uses the old numbering, and plenty of vendor proposals still do.

One thing the "rent equals opex" pages miss: a colocation contract that gives the bank control of specific racks can meet the definition of a lease. That puts a right-of-use asset and a lease liability on the balance sheet. Have the auditor read the contract before the budget is locked.

How much CET1 capitalised software costs a bank

Article 11(3) of POJK 11/POJK.03/2016 on minimum capital adequacy (KPMM, issued 29 January 2016) sets CET1 at no less than 4.5% of risk-weighted assets (RWA), the Basel III floor. POJK 34/POJK.03/2016 (issued 22 September 2016) amended Article 17(1)(c) so that "all other intangible assets" are deducted from CET1. Its Elucidation names software outright:

Contoh aset tidak berwujud lainnya antara lain copyright, hak paten, dan hak milik intelektual (intellectual property right) lainnya termasuk aplikasi piranti lunak (software) yang dikembangkan oleh Bank.

In our translation: other intangible assets include copyright, patents and other intellectual property rights, including software applications developed by the bank. The deduction is the carrying amount less the related deferred tax liability, so it isn't quite one for one. The second amendment, POJK 27 of 2022 (issued 26 December 2022), leaves Article 17 alone, so that wording still applies.

An illustration with made-up figures: a bank capitalises Rp2 billion (about USD 110,700) of channel development cost, with a related deferred tax liability of Rp100 million. CET1 drops by Rp1.9 billion on day one. At the 4.5% minimum, that Rp1.9 billion of CET1 was supporting Rp42.2 billion of RWA. We haven't modelled the buffers above the minimum here, and a bank running at its own target ratio will lose less RWA headroom per rupiah than this.

A subscription isn't free of capital either. Current-year profit counts towards CET1 as part of other disclosed reserves, under Article 14(1)(a)(2)(d) of POJK 11/POJK.03/2016 as amended by POJK 27 of 2022. Its amended Elucidation defines that profit as what the bank earns in the current financial year after deducting estimated tax and dividend payments. So every cloud invoice reduces capital through profit. The difference is timing: capitalisation takes the full carrying amount at once, while opex takes it month by month. OJK says as much in Appendix I, Chapter III A.1.g of PADK 1/2026, which tells banks to weigh their capital position when allocating IT spend between investment and operating costs. Choosing capex or opex is a capital decision, not an IT team's preference.

Pricing availability: one channel, three tiers

No hyperscaler has a second region in Indonesia. AWS ap-southeast-3 and Azure Indonesia Central each run 3 availability zones in Jakarta, and Azure lists no paired region. A warm DR site in a second region of the same provider therefore means DR offshore. That needs OJK approval under Article 35(2) of POJK 11/POJK.03/2022, and the back end that processes customer data must stay in Indonesia anyway (Elucidation to Article 35(3)(d)). A Singapore DR region, the default in many regional designs, doesn't solve the problem. So our tier 3 puts DR on a second provider inside the country.

Assumptions: 730 hours a month, on-demand list prices as we read them on 24 October 2026, Bank Indonesia's JISDOR rate for 23 October 2026 of Rp18,069 per USD, excluding VAT and support plans.

• Tier 1, single zone on AWS Jakarta: 2 m6i.xlarge VMs ($0.24/hour), 1 PostgreSQL db.m6i.large Single-AZ ($0.247/hour), 200 GB database storage, 100 GB disk per VM, 1 Application Load Balancer (hourly rate only, LCUs excluded), 1 TB internet egress ($0.132/GB after the free 100 GB).
• Tier 2, multi-zone: 4 VMs, 2 per zone, so losing a zone doesn't cut capacity; Multi-AZ database ($0.494/hour, exactly twice Single-AZ); 500 GB of cross-zone traffic ($0.01/GB each way).
• Tier 3, multi-zone plus warm DR on Azure Indonesia Central: 1 D4s_v5 VM ($0.216/hour), PostgreSQL Flexible Server at 2 vCores ($0.1098 per vCore-hour), 200 GB storage, and 300 GB a month of replication egress out of AWS.

Going from tier 1 to tier 2 adds 82% to the bill, almost all of it from doubled VMs and database. Warm DR on a second provider adds another $382.43 a month. Internet egress, $121.97 a month, is the same at every tier. Reserved instances or savings plans would lower these figures, but they also lock in a commitment procurement should read like a multi-year contract. We left out GCP asia-southeast2 because we couldn't read its pricing page as an official list.

One question the table can't answer: do two availability zones in a single Jakarta metro meet the Elucidation to Article 37, which expects the data centre and the disaster recovery centre to have a different risk exposure ("eksposur risiko yang berbeda")? No primary source decides it. It's a question for the bank's own risk assessment and for OJK, and the answer decides whether tier 2 is enough or tier 3 is mandatory.

Against owning hardware in colocation

The ProDC price list for Gedung Cyber 1 in Kuningan Barat, South Jakarta, quotes a full 42U rack at Rp17,000,000 a month including 10 A of power, a half rack at Rp10,000,000, and setup at Rp2,500,000 per rack, all before 11% VAT. Article 35(1) plus the disaster recovery guidance in PADK 1/2026 means two sites with different risk exposure, so two racks.

Those colocation figures cover space and power only. No servers yet, no firewall, no database licences, and no CET1 deduction for capitalised software. We didn't price servers because there's no public price list we could cite; treat the colocation figure as a floor. Rent on two full racks alone already exceeds the whole tier 3 cloud bill. And two racks in the same building don't meet the different-risk-exposure guidance.

Costs that stay, capex or opex

Moving to cloud doesn't move the obligations. The Elucidation to Article 29(1) of POJK 11/POJK.03/2022 says a bank using cloud as its data centre remains the electronic system operator. These lines appear every year in both models; the detail of each obligation is in our piece on what cloud computing leaves with a bank under OJK:

• Disaster recovery plan testing at least once a year for all critical applications and infrastructure, involving IT users (Article 18(3)), plus an annual review (Article 18(4)). PADK 1/2026 adds that when a bank uses an IT service provider, the test involves that provider too, and a failed test has to be repeated.
• Scenario-based cyber security testing at least once a year (Article 25(1)), reported to OJK within 10 working days of completion (Article 25(3)). We cover the scope in our penetration testing scope of work for banks and the cost in vulnerability assessment vs penetration testing cost.
• Placement in Indonesia: the data centre and disaster recovery centre must be in Indonesia (Article 35(1)), and placement offshore needs OJK approval (Article 35(2)).
• A proposal with a cost breakdown: Appendix I, Chapter V B.2.a of PADK 1/2026 requires an IT service provider's proposal to set out a breakdown of service costs, expected service levels and business continuity. To build the comparison figure, see our guide to the owner's estimate (HPS) for website and app projects.
• Reporting: Format 3.1, the IT development plan report, asks for estimated capex and/or opex for the first year after go-live, excluding depreciation, plus the city and country of the data centre and disaster recovery centre.

Two more lines are often budgeted wrong. A provider's service credit refunds part of the hosting fee, not the business loss from a channel going down; the arithmetic is in service level agreements: downtime minutes and cloud credits. A CDN and WAF in front of the origin are a separate cost line that doesn't appear in the tables above; we set out their limits in what a CDN may cache for a bank.

What this means for the CFO and procurement

Our view, for a channel this size: buy the availability as opex, on two providers inside Indonesia. Tier 3 costs less a year than rent on two full racks that don't yet hold a single server. The channel software is a separate call. Capitalising it makes sense if the bank will own and run it for years, provided the CET1 deduction is written into the memo before the committee signs.

• Work out the capital effect before choosing. For every rupiah of channel software you plan to capitalise, write down the CET1 deduction net of deferred tax and the RWA headroom lost at the bank's target ratio, next to the alternative opex bill.
• Compare annual figures on one definition. Use the Format 3.2.12 split: capex depreciation on one line, opex on another, capex additions to the balance sheet kept separate.
• Ask vendors for a price per availability tier, not one number. On our figures the gap between tier 1 and tier 3 is Rp210.3 million a year (about USD 11,640). That's the price of a risk decision the committee has to approve, not something to be absorbed quietly inside a proposal.
• Budget the annual regulatory costs separately from infrastructure: DRP testing, scenario-based cyber testing and the reviews. They don't disappear under either model.

WEBARQ has built websites and applications for 214 clients, 42 of them in banking and financial services. For channel architecture designed from the start with availability tiers you can put a price on, see our cloud native application development and website development services.