What Is a Tender? The Rules Binding Indonesian Banks and Insurers

What is a tender under Indonesian law? Article 22 of Law 5/1999, in its Elucidation, defines it as an offer to submit a price to carry out a piece of work, to supply goods or to provide services (our translation). That is the procurement sense, not tender meat or a share tender offer. The rule most pages quote, Perpres 16/2018, as last amended by Perpres 46/2025, covers ministries, agencies, regional governments, "other institutions" and village governments, and only where the spending comes partly or wholly from APBN, APBD or APB Desa (Pasal 2). A bank, insurer, multifinance company or listed issuer buying a website or app with its own money answers to other rules: the selection duties in POJK 11/2022 and POJK 4/2021, the affiliated-transaction rules in POJK 42/2020, and the bid-rigging ban in Article 22 of Law 5/1999.

We counted the word in the source texts on 4 November 2026. "Tender" and "lelang" (auction) appear 0 times in PADK OJK 1/2026, POJK 11/POJK.03/2022, POJK 4/POJK.05/2021, SEOJK 22/SEOJK.05/2021, POJK 42/POJK.04/2020 and POJK 32/POJK.03/2018. Of the rules we read, only the BUMN Ministry's PER-2/MBU/03/2023 uses it: 11 hits for "tender" and one for "e-tendering". OJK writes "pengadaan" (procurement), "pemilihan" (selection) and "seleksi". So the right compliance question isn't "do we have to run a tender?" It's "which selection duty applies to us, and who is connected to the vendor?"

What is a tender, according to three Indonesian regulations

• Law 5/1999 on monopolistic practices and unfair competition (enacted 5 March 1999, in force 5 March 2000), Elucidation of Article 22: the definition in this article's first paragraph. It says nothing about who the buyer is.
• Perpres 16/2018 on government procurement, Pasal 1 point 36: a tender is the selection method used to obtain a provider of goods, construction works or other services. Point 37 uses "Seleksi" for consulting services. The regulation has been amended twice. Perpres 12/2021 left Pasal 2 alone; Perpres 46/2025 (set and in force 30 April 2025) rewrote it. Cite the amended text, not the 2018 PDF on its own.
• BUMN Ministerial Regulation PER-2/MBU/03/2023, Pasal 152(2): "tender/seleksi umum" (open tender) and "tender terbatas/seleksi terbatas" (restricted tender) as procurement methods for state-owned enterprises.

The amended Pasal 2 matters for scope. Perpres 46/2025 adds "Institusi Lainnya" and defines it as an institution using APBN or APBD other than ministries, agencies, regional and village governments, and BUMN, BUMD and BUMDes. State-owned companies are carved out by name. A private bank, insurer or listed company spending its own money sits outside the Perpres, and so does a state-owned bank, which follows its own procurement rules.

Google's AI Overview for "what is tender" on the Indonesian English-language results page, checked on 4 November 2026, lists the procurement sense as one noun meaning among several, next to legal tender, a ship's boat and chicken tenders. Its sources are dictionaries, two YouTube videos and one procurement-software blog, and none of them is Indonesian. That leaves the question this piece answers unasked: which rule a tender has to satisfy when OJK examines it.

Tender vs auction in Indonesian law

An auction sells. A tender buys. PMK 122/2023 (set 21 November 2023, in force 1 January 2024), Pasal 1 point 1, defines "lelang" as a sale of goods open to the public, with bids rising or falling to reach the highest price, preceded by an auction announcement. Perpres 16/2018 doesn't use the word "lelang" once.

PER-2/MBU/03/2023 shows the split inside a single text. Buying uses "tender/seleksi umum" (Pasal 152); disposing of assets uses an "auction official", pejabat lelang (Pasal 167(3)). When a bank picks a vendor to build its customer portal, it is running a tender. In OJK's vocabulary it is the "proses pemilihan PPJTI", the selection of an IT service provider.

The buyer issues a request: an RFQ asks for a price on a fixed specification, an RFP asks for a solution and its price. The vendor answers with a proposal or bid. We covered what goes into the scope document in terms of reference for a website or app, so this article starts where the proposals arrive.

Which rule binds which buyer

We built this table from texts downloaded from OJK, JDIH and BPK on 4 November 2026.

Commercial banks: the policy is mandatory, the steps are guidance

POJK 11/POJK.03/2022 (set 6 July 2022), Article 29(3)(b), requires a bank to hold policies and procedures covering the "process of selecting IT service providers". Article 30(2) lists four things the bank must at least consider: the vendor's qualifications and competence, its staff included; a cost-benefit analysis that involves the bank's IT unit; prudence and risk management; and an arm's-length relationship where the vendor is a related party of the bank. There is no minimum number of bids and no duty to run an open tender.

Compliance should know about a gap. Article 33(1) sets a written reprimand for breaching "Article 29(2), (3), Article 30(3), Article 31, Article 32(1) and/or (4)". Article 30(2), the list of what a selection must weigh, isn't on that list. On our reading, having no selection policy can be sanctioned directly and the content of the selection can't. That's an inference from the article list, not a statement by OJK.

PADK OJK 1/2026 (set 23 January 2026, in force 1 March 2026, revoking SEOJK 21/SEOJK.03/2017) fills in the detail in Appendix I, Chapter V. It covers one-off projects, because it applies to IT providers used "continuously and/or for a certain period". Section B.2 requires selection "in line with fair practice", with standards matched to the complexity of the service (best fit). It presents four stages that "can serve as a reference for the Bank":

1. Request for proposal: scope of work, service levels, term, cost breakdown, performance measurement, security, business continuity, and access for internal and external auditors and OJK.
2. Due diligence: 13 items, documented and repeated periodically. For the certification item, see how to check a vendor's ISO 27001 certificate.
3. Proposal evaluation: at least technical and financial aspects "for each alternative to be chosen".
4. Choosing the provider: a cost-benefit analysis of each alternative, its reasonableness included, and the arm's length principle with providers "including parties related to the Bank".

The word "including" in stage four widens the scope. Article 30(2)(d) mentions only related vendors; the PADK applies the principle to every provider. Who counts as related follows the legal lending limit rule, POJK 32/POJK.03/2018 Article 9(1). The categories that matter for a vendor are the bank's directors, commissioners and executive officers (point d); companies whose directors or commissioners sit on the bank's board of commissioners (point g); companies controlled by the bank's directors, commissioners or executive officers (point i); and companies with a financial relationship with the bank (point k). POJK 32/2018 was amended by POJK 38/POJK.03/2019. We haven't compared whether Article 9 changed with it.

Insurers and multifinance: a selection for every vendor

Non-bank financial institutions face a firmer duty. POJK 4/POJK.05/2021 (set 9 March 2021) applies to insurers, reinsurers, finance companies, pension funds, venture capital, pawnbrokers, guarantee companies, P2P lenders and others. Article 21(4) reads:

LJKNB wajib melakukan proses seleksi dalam memilih pihak penyedia jasa Teknologi Informasi dengan memperhatikan prinsip kehati-hatian, manajemen risiko, dan didasarkan pada hubungan kerja sama secara wajar.

In English: the institution must run a selection process when choosing an IT service provider, applying prudence and risk management, on an arm's-length basis. The Elucidation defines arm's length as an independent transaction, as between unrelated parties, at a fair market price. Unlike the bank POJK, the condition attaches to every vendor in the body of the regulation itself. Article 34(1) also lists Article 21(4), so a selection breach draws a written warning that stands until the duty is met. SEOJK 22/SEOJK.05/2021 (24 August 2021), Chapter V point 15, adds the content of a procurement guideline. One item is a "comparison of the offers submitted by IT service providers" (point d), so a single bid with nothing to compare it against is hard to defend.

Listed issuers: what matters is who the vendor is

Listed companies have no IT-vendor selection rule. What applies is POJK 42/POJK.04/2020 on Affiliated Transactions and Conflict-of-Interest Transactions (set 1 July 2020). An affiliate includes two companies that share one or more directors or commissioners (Article 1 point 1(c)). For an Affiliated Transaction, Article 4(1) requires an appraiser's fairness opinion, a public announcement, a report to OJK, and approval from independent shareholders at a general meeting once the materiality threshold is met.

Article 6(1)(c) exempts transactions of no more than 0.5% of paid-up capital or Rp5 billion, "whichever is lower". The exemption covers only Article 3 and Article 4(1). Article 6(2) still requires a report to OJK by the end of the second working day after the transaction date.

A worked example (hypothetical). A Jakarta-listed subsidiary of a regional group headquartered in Singapore has paid-up capital of Rp400 billion. Its threshold is 0.5% = Rp2 billion, lower than Rp5 billion. One of its commissioners also sits on the board of commissioners of a software house. A Rp1.8 billion app-build contract with that software house is exempt from the appraiser and the announcement, but must still be reported within two working days. At Rp2.5 billion, the appraiser, the announcement and the OJK report all apply. If the group's procurement team in Singapore runs the tender under its own group policy, that policy doesn't replace any of this: the Indonesian issuer still owes the filing. For a Conflict-of-Interest Transaction, Article 11(1)(d) requires independent shareholder approval with no materiality threshold, subject to the same exemptions in Article 12.

BUMN: PER-2/MBU/03/2023, with a status caveat

PER-2/MBU/03/2023 (set 3 March 2023) is the only procurement rule in this table that calls a tender a tender. Article 145 applies it to procurement funded from the BUMN's own budget. A restricted tender needs "at least 2 (two) bids" (Article 152(2)(b)). Direct appointment is allowed on 12 grounds (Article 155(2)), among them a tender that has failed twice and technical continuation of earlier work. Bidders can object within 2 working days of the award announcement, and the BUMN must decide within 7 working days (Article 156). The BUMN must also identify each provider's beneficial owner (Article 158(2)), and procurement compliance feeds the directors' KPIs (Article 161).

We record its status as conditional. Law 16/2025 gave Danantara power to set guidelines and strategic policy, and press reports say PP 19/2026 (8 April 2026) extends that to procurement; we haven't read the official text of that PP. We found no revocation of PER-2 on BPK or JDIH BUMN, but we can't confirm that no replacement exists. A state-owned bank answers to POJK 11/2022 and, while PER-2 stands, to PER-2 as well. It doesn't answer to the Perpres, whose amended scope excludes BUMN by name.

Every buyer: Article 22 of Law 5/1999

Since Constitutional Court Decision 85/PUU-XIV/2016 (pronounced 20 September 2017), Article 22 reads: a business actor may not conspire "with other business actors and/or parties related to other business actors" to arrange or determine the winner of a tender. The article doesn't limit itself to government buyers, and a private bank is itself a business actor. In our view the ban reaches a private bank's tender. That's a reading, not a ruling. The Court's examples are shaped like government procurement (budget documents, a committee, an owner's estimate), and we haven't searched for a KPPU decision on a purely private tender. KPPU's old guideline on Article 22, Perkom 2/2010, was revoked by KPPU Regulation 1/2023 (15 February 2023). We haven't found a replacement text, which doesn't prove there isn't one.

What compliance should see before the award

In an examination, the examiner's question is rarely whether the bank ran a tender. It's where the selection record is. Before signing off the vendor decision for a website or app, make sure this file exists:

1. The IT-vendor selection policy in force, and evidence this process followed it (POJK 11/2022 Art. 29(3)(b)).
2. A cost-benefit analysis with the IT unit's involvement (POJK 11/2022 Art. 30(2)(b); POJK 4/2021 Art. 21(2)(d)).
3. A technical and financial evaluation matrix for every bid, not only the winner. To test prices against your own estimate, see building an owner's estimate for a website or app.
4. Documented due diligence, including audit access for internal and external auditors and OJK written into the proposal.
5. A related-party screen: the vendor's directors, commissioners and shareholders matched against the bank's related-party list (POJK 32/2018 Art. 9) or the issuer's affiliates (POJK 42/2020 Art. 1 point 1).
6. For a listed issuer: the 0.5%-of-paid-up-capital or Rp5 billion threshold calculated, and the second-working-day report date in the calendar.
7. For a related vendor: evidence of a fair market price, either comparable bids or an appraiser.
8. A conflict-of-interest declaration from every member of the evaluation panel, as a trail against Article 22 risk.
9. Personal-data processing clauses for the vendor, covered in DPIA and vendor clauses under the PDP Law.

What this means for compliance

If you're a bank, the bigger risk usually isn't an informal process. It's a vendor that turns out to be related, at a price you can't show was fair. If you're an insurer or multifinance company, a single bid with no comparison is hard to square with SEOJK 22/2021 Chapter V point 15(d). If you're a listed issuer, run the affiliate threshold before the contract is signed, not after. And if your group procurement manual is written around EU or UK public-tender rules, or the Perpres templates (LPSE, Pokja and the rest), treat it as a working tool, not as the legal basis: none of it is what OJK will test you against.

WEBARQ is a corporate website development and app vendor with 214 clients, 42 of them in banking and financial services, but this article is written from the buyer's side. We compiled it from regulation texts we downloaded and read on 4 November 2026, with AI assistance, not from any particular tender. Check the status of each rule again before relying on it.