POJK 22/2023: OJK Consumer Protection Rules, Screen by Screen

POJK 22/2023 is the OJK consumer protection regulation in force in Indonesia today: Peraturan OJK Nomor 22 Tahun 2023 on Consumer and Public Protection in the Financial Services Sector, signed 20 December 2023, promulgated and effective 22 December 2023 (Article 125). It sets seven principles, not five. An oral complaint is closed in 5 working days and a written one in 10 working days, extendable by 10 more. Administrative fines run to a maximum of Rp15 billion per article.

This piece is for compliance and consumer-protection functions at banks, insurers, securities firms and multifinance companies operating in Indonesia, including regional teams who work in English. We read the body and its Elucidation (Penjelasan) in the text hosted by BPK on 14 October 2026 and rearranged it as a screen specification: what has to be shown, when, and what has to be kept afterwards. Article numbers follow the Indonesian text, so "Article 33(7)" is Pasal 33 ayat (7). Translations of quoted passages are ours. WEBARQ builds websites and apps and isn't a law firm. This is working material for your internal audit unit (SKAI), not a legal opinion.

What summaries still say, and what the text says

Leaving aside OJK's own document, the Indonesian summaries we read on page one of Google for "pojk perlindungan konsumen" on 10 October 2026 don't cite a single POJK 22 article number. On the six points below, the text says something else.

RIPLAY is the product and service information summary, in two versions

RIPLAY stands for Ringkasan Informasi Produk dan/atau Layanan, the product and/or service information summary. It's the nearest Indonesian counterpart to a key facts statement. Article 30(1) fixes its contents: product name and type, issuer name, main features, benefits, risks, requirements and procedure, costs, additional information, and a simulation or historical data for products that collect, channel or manage funds. Article 30(2) splits it into a general version and a personal version.

Two points in the screen flow

• The general version is shown before the prospective consumer decides to use the product (Article 33(1)).
• The personal version is shown before the agreement is signed (Article 33(2)). The Elucidation of Article 32(2)(b) says signing "mencakup pula konfirmasi persetujuan atau otorisasi dari Konsumen" (also covers the consumer's confirmation of consent or authorisation) and may happen through electronic media. The "Setuju" (Agree) button is that signature.
• The Elucidation of Article 33(5) describes electronic media as "antara lain dalam bentuk aplikasi, perangkat, media/alat bantu penyampaian secara digital, ataupun situs berbasis web": among others, an app, a device, a digital delivery aid, or a web-based site.

The format of RIPLAY and of advertising is now governed by PADK 37/PADK.08/2025, effective 2 December 2025, which revokes SEOJK 12/SEOJK.07/2014. Its FAQ no. 8 allows 6 months to conform; by our count that fell on 2 June 2026. We read only its abstract and FAQ, not the format annexes, so we don't describe the template here.

Confirmation of understanding: questions, with the answers kept

Article 33(7) requires confirmation that the consumer understood the personal RIPLAY. Its Elucidation: "Konfirmasi dilakukan dengan memberikan pertanyaan mengenai pemahaman calon Konsumen" (confirmation is carried out by asking questions about the prospective consumer's understanding). Paragraph (8) requires the result to be set down in a document or other medium usable as evidence. Article 45(3) and (4) repeat the duty for contract clauses, with questions covering the breakdown of costs, benefits, risks, and rights and obligations.

The words "centang" (tick) and "checkbox" don't appear once in POJK 22. Our reading: a single "I have read and understood" tick-box is hard to defend as "asking questions". That's an interpretation, not the wording of the rule, and PADK 37's FAQ no. 3 does accept confirmation "dalam bentuk tanda tangan dan/atau pernyataan (baik cetak maupun elektronik)", a signature and/or statement, printed or electronic.

If the call were ours, we'd ask the questions. Two or three short ones on cost and risk, with the answers, the time and the document version logged. The reason is plain: it costs one extra screen in the flow, and a tick-box proves only that the box was tapped.

The terms and conditions screen: 12 banned clauses

Article 46(2) bars a standard-form agreement from containing 12 kinds of exoneration clause, letters a to l. Under the Elucidation of paragraph (1) that "termasuk perjanjian dalam bentuk elektronik": it includes agreements in electronic form. In short, a financial services provider (PUJK, Pelaku Usaha Jasa Keuangan) may not:

1. shift its responsibility or obligations to the consumer;
2. take a power of attorney to act unilaterally over collateral, unless a statute provides for it;
3. place the burden of proof on the consumer;
4. reduce the usefulness of the product or of the consumer's assets;
5. take a power of attorney to encumber goods bought on instalment with a security right;
6. change the rules unilaterally after the agreement is concluded;
7. bind the consumer to those unilateral changes;
8. avoid or limit the enforceability of a clause;
9. interpret the agreement unilaterally;
10. limit liability for the fault of its employees or third parties;
11. limit the consumer's right to sue;
12. limit the evidence the consumer may submit.

Article 47(1) requires access to obtain and/or print a copy of the standard agreement. A download button, in other words, isn't a design option. Article 49(2) requires notice of a change at least 30 working days before it takes effect.

There's a tension inside the text. Letters f and g ban unilateral-change clauses, while Article 49(6) says a consumer who stays silent is deemed to agree. Credit and financing are different again: a change that adds obligations or reduces benefits needs a documented accept-or-reject confirmation (Article 50(1)). The change-of-terms screen for a loan product can't be the same one used for a savings account.

Data consent and offers through personal channels

Two anti-bundling rules stand side by side. Article 22(2) bars a PUJK from requiring a prospective consumer to agree to data sharing as a condition of using a product. Article 39(2) bars the same for consent to receive offers. On a registration form, both are choices separate from agreement to the product itself. Three consents, not one. A team used to GDPR will recognise the shape, but the source is a sector rule with its own sanctions, not the data protection statute. Withdrawal of data consent is made in writing or electronically (Article 23(4)). We cover the lawful basis for processing under Indonesia's Personal Data Protection Law in our article on DPIA in Indonesia; where product disclosure meets customer due diligence is in the article on AML/CFT and POJK 8/2023.

Banks carry an extra duty from POJK 21 of 2023 on Digital Services by Commercial Banks (signed 19 December 2023): Article 29(3) requires a feature that lets customers manage, by themselves, the access a bank's partners have to their data.

Offers through personal communication channels are allowed only with consent (Article 39(1)), Monday to Saturday outside national holidays, 08.00–18.00 local time (paragraph (4)(a)). Collection hours differ: 08.00–20.00 (Article 62(2)(f)). The Elucidation of Article 33(5) lists telephone, SMS, email, video call and instant messaging apps, among others. Push notifications aren't on that list, but the list isn't closed. Their status is unsettled.

Our position: until OJK says otherwise, treat a push notification that carries an offer as a personal communication channel. It lands on the same device as an SMS, and caution costs one sending-hours rule and one consent toggle.

The cooling-off period starts at the tap on "Agree"

Article 51(2) gives a cooling-off period of at least 2 working days from the moment the consumer agrees to the contract, and its Elucidation names agreement "melalui media elektronik (laman, telepon, aplikasi)": through electronic media (web page, telephone, app). The duty applies only to products with a term over 1 year or to complex products such as PAYDI, the Indonesian term for investment-linked insurance. Cancelling inside the period carries no penalty (paragraph (10)). The exemption that matters for flow design: no cooling-off period is required if the prospective consumer was already given at least 2 working days before signing (paragraph (7)(d)).

The complaint clock is set by the channel

The Elucidation of Article 70(2) classes telephone and SMS as oral complaints. Letters, email, fax, the PUJK's website and its official electronic media count as written, and so does a consumer who walks in. The consequence for digital channels: a web form and an in-app complaint feature run on the 10 + 10 working-day clock, counted from complete documents, not from the moment "send" is pressed.

For banks, POJK 21/2023 Article 26 requires a function that answers questions and follows up complaints 24 hours a day. Every oral complaint service delivered through a personal communication channel must be recorded (POJK 22 Article 78(5)).

Disability and old age: what is mandatory is the written policy

Article 8(1) requires written policies and procedures, and paragraph (3)(b) requires them to include special services for persons with disabilities and the elderly (60 or older). Article 54(3) is softer: a PUJK "mempunyai tanggung jawab untuk mendukung" (has a responsibility to support) those special services, and the sanction in paragraph (4) reaches only paragraphs (1) and (2). App features appear as one of seven examples in the Elucidation. "WCAG" isn't mentioned at all. A group that already holds its European or US properties to WCAG can't cite POJK 22 as the reason to do the same in Indonesia. The technical standard is the institution's choice, written into the Article 8 policy.

The evidence file and the reporting calendar

The word "aplikasi" (app) appears 7 times in the whole text. "Retensi" (retention) appears 0 times. Yet 11 provisions require a record (our count over the full text, 14 October 2026):

• delivery of product information: Article 32(3);
• confirmation of understanding of the personal RIPLAY: 33(8);
• confirmation of understanding of clauses: 45(4);
• assessment of the product's fit with the consumer's needs and capacity: 37(3);
• recordings of voice or video offers: 39(5), (7);
• consent to a change in credit terms: 50(1);
• confirmation of PAYDI suitability after the policy is issued: 51(5), (6);
• results of testing new products and services against the risk of consumer loss: 26(4);
• logging of every complaint: 70(1);
• recordings of oral complaint services: 78(5);
• a third party's written statement that consent was obtained for transferred data: 23(3).

POJK 22 sets no retention period. The only storage provision, for PAYDI, reads "sesuai dengan kebijakan PUJK", in line with the PUJK's own policy (Article 51(6)); PADK 37's FAQ no. 7 points to "masa retensi sesuai ketentuan perundang-undangan yang berlaku", a retention period under prevailing laws and regulations. The number of years has to be set by the institution, and written down.

The self-assessment format is in SEOJK 18/SEOJK.08/2024 (10 December 2024). From 1 January 2027, SEOJK 20/SEOJK.08/2025 (signed 8 September 2025) applies.

Sanctions: the Rp15 billion cap doesn't reach everything

The two provisions most often summarised next to the Rp15 billion figure sit outside that cap. Article 39(9) imposes administrative sanctions for breaches of paragraphs (2) to (8); the core prohibition in paragraph (1), offering without consent, is routed by paragraph (12) to sanctions under the law on financial sector development and strengthening. Article 54(3) carries no sanction. The Rp15 billion limit isn't new either; OJK's FAQ no. 29 says POJK 6/2022 already had it.

Enforcement figures from OJK press release SP 185/OJK/DKPU/X/2026 (5 October 2026):

• 1 January–13 September 2026: 141 written warnings to 101 PUJK, 6 written instructions, and 52 fines on 44 PUJK;
• 157 PUJK compensated consumer losses worth Rp82.96 billion;
• to 30 September 2026: 43 fines worth Rp8.73 billion over information in advertising, collection officers and transparency, an average of about Rp203 million per fine (our arithmetic).

POJK 38 of 2025 (signed 18 December 2025) adds another route: OJK can sue a PUJK in tort without a special power of attorney from consumers (Article 4). Its Article 20 also revokes Article 98(1)(b), Article 99 and Article 100 of POJK 22. For payment system services, Bank Indonesia issued PBI 6 of 2026 on Bank Indonesia Consumer Protection on 24 June 2026, revoking PBI 3/2023 and carrying the same seven principles.

Five decisions for the compliance function

1. Fix the form of the confirmation of understanding per product, questions or statement, and record the reason.
2. Check the electronic terms and conditions against the 12 letters of Article 46(2), one at a time.
3. Separate three consents on the form: product, data sharing, offers.
4. Write down a retention period for the 11 record types above, because the rule is silent.
5. Decide the status of push notifications and their sending hours.

Two observations from our own work, not compliance claims. On the insurance purchase sites we built for PFI Mega Life and MSIG, policy management was made without automatic renewal; the PFI Mega Life case study gives the reason as handing customers more control over their policies. BCA Group's CMS passes content through layered approval before it goes live. None of those case studies mentions a POJK. Decisions like these get made while designing a financial institution's website or its mobile app, not after an examination finding. The governance side, who owns the customer's experience and how it's measured, is in our article on customer experience under OJK supervision.