Terms of Reference for a Website or App: OJK's Seven Components

OJK's PADK 1/2026, in force since 1 March 2026, sets seven components for the document the market calls terms of reference. Terms of reference (TOR) are the buyer's written statement of the work it wants from a vendor, and in Indonesia the usual local name is Kerangka Acuan Kerja (KAK). The phrase itself appears 0 times in that OJK regulation, which binds commercial banks only.

This piece is for the Head of Digital or CIO holding a scope document for a website or mobile app, with compliance and security holding the veto behind them. Generic definitions are everywhere. What's missing is a TOR a vendor can price and a bank can use to reject the work, written against the rules an Indonesian financial institution answers to.

Terms of reference is a market term, not a regulatory one

If you've bought software in Singapore or London you'd call this document an RFP annex or a statement of requirements. The rules an Indonesian bank answers to use neither name. On 2 November 2026 we searched the text of five rules that banks and procurement teams deal with, plus one budget rule, for the phrase in both singular and plural:

The zeros are about the word, not the concept. PADK still has a stage called Permintaan Proposal dari PPJTI, a request for proposals from the IT service provider, without ever writing RFP. The phrase "kerangka acuan kerja" is also at 0 in PADK, POJK 11/2022 and SEOJK 22/2021. The shorter "kerangka acuan" shows up once each in PADK and that SEOJK, for information security policy rather than procurement documents.

Are KAK and TOR the same thing?

In state budgeting, yes. In procurement, nothing says so. The Finance Ministry treasury's SPAN glossary treats the two as one activity-planning document, cost estimate included. The revoked PMK 177/PMK.02/2014, a 2014 BA BUN budget rule revoked in 2015, used "Term of Reference" twice in its Lampiran, glossing it as Kerangka Acuan Kerja, for a budget support document and not a procurement document. That count is an OCR text search of the Lampiran only; we couldn't reach the body of the regulation.

We found no procurement article that equates TOR with KAK. LKPP Regulation 3/2026 writes the long form "kerangka acuan kerja" 73 times and never abbreviates it to KAK.

The 26-item KAK form isn't in the current rule

The last official form is a government one. It was Bab IV of the Dokumen Seleksi in the Seleksi Prakualifikasi model for Jasa Konsultansi Badan Usaha (consulting firms), in Lampiran IV of LKPP Regulation 12/2021, with 26 items. The model for individual consultants carries the same 26 at Bab VI. We didn't check whether the 2024 amendment changed the form.

LKPP Regulation 3/2026 (Jakarta JDIH copy), signed on 21 September 2026, revokes LKPP 12/2021 as amended by LKPP 4/2024 through Pasal 11, and it carries no such form. LKPP Circular 3/2026 of 29 October 2026 gives the promulgation date as 22 September 2026, Berita Negara 2026 No. 663. Two transitional limbs survive in Pasal 10. Under huruf a, provider selections carried out before commencement are finished under the old regulation. Under huruf b, contracts already signed stay in force until they end; that clause preserves the contract and doesn't mention 12/2021. So the accurate phrasing is "not in the new regulation", not "abolished".

The circular doesn't fill the gap either. The words "kerangka acuan" don't appear in it, and point 9.a only tells teams to prepare their documents under the new regulation.

Two limits apply. LKPP rules bind government procurement, so a private bank can only use the form as a comparison. It's also specific to consulting services. A website build could equally be classed as Jasa Lainnya (other services), which runs on technical specifications; that's our reading, not the text.

PADK's seven components against the 26 KAK items

The bank version of a TOR sits in PADK 1/2026, issued 23 January 2026, at Lampiran I BAB V B.1. It says the needs definition "harus memuat dokumen yang berisi gambaran secara rinci mengenai keinginan Bank": a document detailing what the bank wants from the IT service provider (PPJTI). The pairing below is ours:

A text search of those 26 items returns 0 hits for security (keamanan, pengamanan), source code (kode sumber), handover (serah terima), acceptance (penerimaan) and testing (uji). The final report is still handed over on "cakram padat (compact disc) (jika diperlukan)". Copy that form into a bank's website TOR and you leave out exactly what the CISO and internal audit (SKAI) will ask about.

One scope note. BAB V applies where a bank uses a provider continuously or for a set period and comes to depend on it. Whether a one-off website build fits that is a matter of interpretation. Our view: a channel the vendor runs after go-live is in, and the seven components still make the right skeleton for a one-off.

Insurers and multifinance companies work from a different text. SEOJK 22/SEOJK.05/2021 of 24 August 2021, Bab V point 15.c, asks that vendor offers be tested against the "spesifikasi kebutuhan". No needs document, nothing to test against. We haven't confirmed this circular's current status with OJK.

What a website or app TOR has to say

Scope, with numbers and exclusions

PADK BAB II huruf j asks for a needs specification that is testable, consistent and clear ("dapat diuji, konsisten, jelas"). Three of our public case studies show what a priceable scope line looks like. They illustrate the kind of line only; they aren't sample TORs or evidence of PADK compliance.

• Quantity, deadline, training. The Angkasa Pura I case study lists 16 integrated websites in one month as a challenge, alongside training airport staff across multiple locations.
• Every outside system by name. CGS International links to bank databases, CGS-CIMB, KSEI (the central securities depository) and DUKCAPIL (the civil registry). Those four links have a price. The word "integration" doesn't.
• A deliberate exclusion. The PFI Mega Life e-policy system doesn't support auto-renewal, to give customers more control. Write decisions like that into the TOR so they can't become a dispute later.

A clear scope also decides how you buy. LKPP Regulation 3/2026, for government purchases, uses lump-sum contracts where scope, schedule and output can be clearly defined. By analogy the logic holds outside government: a fixed price needs a fixed scope. We cover the arithmetic in our guide to the HPS owner estimate for a website or app.

Security and service levels, in your own numbers

We found no Indonesian regulator text that sets a figure for availability, response time or load. PADK names the categories only, so the numbers have to come from the bank. Put the targets in the TOR, then carry them into the contract. Our pieces on service level agreements and OJK clauses and on the penetration testing scope of work for banks cover the shape of each.

Two more lines belong here. POJK 11/POJK.03/2022 Pasal 35(1) requires banks to place Electronic Systems in data centres and disaster recovery centres in Indonesia, and Pasal 35(2) requires OJK approval to place one offshore. So hosting location is a TOR line, worth settling before a regional vendor proposes its usual Singapore region. Law 27/2022 Pasal 51(1) requires a processor to act on the controller's instructions, so any vendor touching customer data needs its role stated.

Acceptance you can test

The TOR sets the exam used at handover. PADK calls for a UAT record approved by users where the system matches "kebutuhan pengguna dan standar pengamanan Bank": user needs and the bank's security standards. That's two conditions, not one. A requirement missing from the TOR can't ground a rejection, so write each deliverable with its pass condition next to it.

Source code, before the contract is signed

Without a clause, copyright can stay with the vendor. Article 36 of Law 28/2014 reads:

Kecuali diperjanjikan lain, Pencipta dan Pemegang Hak Cipta atas Ciptaan yang dibuat dalam hubungan kerja atau berdasarkan pesanan yaitu pihak yang membuat Ciptaan.

In short: unless agreed otherwise, the author and copyright holder of a work made in employment or on commission is the party who made it. Pasal 40(1)s lists computer programs as protected works. Applying that to commissioned software is our reading, and we haven't checked court decisions. OJK is firmer. PADK BAB II.C.2 huruf i says a bank owns the source code of software developed specifically for it, so that it can be reached "untuk kepentingan pemeriksaan dan penyidikan", for examination and investigation. The point is supervision, not just the comfort of changing vendors.

Escrow is conditional. PADK names it as a mitigation available if the bank doesn't own the code. SEOJK 22/2021 Bab VI point 9 is harder on non-banks: make sure an escrow agreement exists for applications deemed important.

Transition and exit

PADK BAB V B.3.a lists 16 standard contract items, applied according to the scheme, service type and complexity. Four should already be visible in the TOR so the vendor prices them:

• Item 9: access for OJK and other authorities to examine.
• Item 10: technical documents handed to the bank.
• Item 13: knowledge transfer to bank staff.
• Item 14: termination, including where OJK orders the bank to stop using the service before the contract ends.

Of the seven Indonesian TOR guides we read for the section below, 0 mention contract termination.

How a TOR differs from a proposal and a contract

Some guides in circulation call a TOR an agreement. Our opinion: it binds only once the contract adopts it as an annex or by reference. Until then it's tender material, and the tender itself is outside this article.

The buyer writes it, and in a bank that shouldn't be one person. PADK puts IT development under the IT unit's control, with a project team drawn at minimum from the IT unit and the users. Applying that to TOR drafting is our reading.

Why 5W1H isn't enough

Who, what, when, where, why and how will get a seminar organised. On 2 November 2026 we read the text of seven pages from the Indonesian results for "apa itu tor": Weefer, Jurnal, Gramedia, Dealls, Moka, Kumparan and Souvia. Result: 0 cite a numbered regulation, 0 discuss security in the body, 0 mention source code, 0 mention UAT. Most of their examples are events, not system purchases. Results shift daily, so those counts hold for that date only. Google's AI Overview for "apa itu tor" that same day still built the document around 5W+1H, citing Gramedia, Jurnal and Accurate among others.

What to do before the TOR goes out

• Head of Digital: make PADK's seven components your chapter headings and throw out the event template.
• CISO: write down the security standard you'll test at UAT, because it's the second pass condition.
• Compliance and SKAI: check the four contract items above and record the legal basis: PADK for commercial banks, SEOJK 22/2021 for insurers and multifinance.
• Legal: settle source code ownership before the tender, not during negotiation.

If your TOR covers website development or a mobile app build, we can work through the scope chapter with your IT team.