Resources
SEA financial regulations and AI compliance.
Plain-language definitions of every Southeast Asian financial regulation Nova Solutions complies with. Each one we have built around has its own page, with the key provisions and how Nova handles it.
Philippines
The pricing, conduct, and consumer-protection rules Philippine lenders, BNPL operators, and their collection agents answer to. The conduct rules apply identically to AI voice and SMS agents.
BSP Circular 1133
Interest Rate and Fee Ceilings (s.2021)
Bangko Sentral ng Pilipinas
Caps the interest rates and fees on small unsecured consumer loans (up to ₱10,000, tenor up to four months) from lending and financing companies and their online platforms. It is a price control, not a collection-conduct rule. Collection conduct, no threats, no third-party contact, restricted hours, identification, and full logging, is governed separately by SEC MC 18 s.2019 and RA 11765, and applies identically to AI voice and SMS agents.
Also: BSP Circular 1133 s.2021 · Lending rate cap (SEC MC 3 s.2022)
RA 11765
Financial Products and Services Consumer Protection Act
Republic of the Philippines
Approved 6 May 2022. Gives the BSP, SEC, Insurance Commission, and CDA common rulemaking, surveillance, enforcement, and adjudication powers over the providers each supervises. On collections it says one sentence, Section 8(d): providers are prohibited from employing abusive collection or debt recovery practices. It does not enumerate prohibited acts, contrary to most summaries of it; that enumeration is SEC MC 18 s.2019. What it adds is Section 13 solidary liability, so a lender answers for its collection agent, automated or human. Implemented for BSP-supervised institutions by BSP Circular 1160 s.2022.
Also: Financial Consumer Protection Act · RA 11765 IRR (BSP Circular 1160 s.2022)
RA 10173
Data Privacy Act of 2012, and automated decisions
National Privacy Commission
Governs the collection, use, and disclosure of personal data and defines data-subject rights. It contains no GDPR Article 22 equivalent and the word "profiling" never appears in it; its two references to automated processing are transparency and access provisions. The operative rule sits in the 2016 IRR at Section 48(b): no decision with legal effects may rest solely on automated processing without the data subject's consent, which is a consent gate rather than an opt-out, with no statutory right to explanation or human review. NPC Advisory 2024-04 (19 December 2024) states how the Commission expects AI systems to comply, but it is interpretive guidance, not a Circular.
Also: Philippine Data Privacy Act · DPA IRR Section 48(b) · NPC Advisory 2024-04
BSP M-2026-031
Governance Principles for AI in Financial Services (STARS)
Bangko Sentral ng Pilipinas
BSP Memorandum M-2026-031 (24 June 2026) issues a nine-page guidance paper setting out five AI governance principles: Sustainability, Transparency, Accountability, Responsibility, and Security. BSP describes them in the same passage as both "non-binding and compliance is voluntary in nature" and as providing "minimum supervisory expectations." The concrete asks are a centralized AI inventory, disclosure of AI use in product terms and conditions, validation by a team independent of the developers, and named human accountability. A companion memorandum, M-2026-034 (6 July 2026), treats frontier AI as a cyber threat. The Model Risk Management framework that would cover algorithmic fairness is still forthcoming.
Also: BSP AI governance framework · STARS principles · BSP M-2026-034
Singapore
The principles-based governance framework MAS uses when it reviews AI deployments by licensed financial institutions.
MAS FEAT
Fairness, Ethics, Accountability, Transparency
Monetary Authority of Singapore
The Monetary Authority of Singapore's principles-based framework for responsible AI in financial services, built on four pillars: Fairness, Ethics, Accountability, and Transparency. Operationalized through the Veritas Initiative. Voluntary by name, but de facto required for any Singapore-licensed financial institution deploying AI in customer-impacting decisions.
Also: FEAT Principles · MAS AI Guidance
SG PDPA
Personal Data Protection Act 2012, and automated decisions
Personal Data Protection Commission
Singapore's data protection law. It contains no GDPR Article 22 analogue: no right against solely automated decisions, no right to an explanation, and no right to human review, with transparency handled as notification at the point of consent. Note that the Data Portability Obligation appears in most published obligation checklists and was never brought into force. PDPC has issued two advisory guidelines on AI, in March 2024 and July 2026, both interpretive rather than binding, and both distinct from IMDA's voluntary Model AI Governance Framework and the AI Verify toolkit.
Also: Singapore PDPA · PDPA 2012 (Act 26 of 2012) · PDPC AI advisory guidelines
Indonesia
The fintech-lending rules, which have been replaced twice since 2023, and the data-protection statute where the automated-decision rules actually live.
OJK POJK 10/2022
Indonesian fintech lending rules, and what replaced them
Otoritas Jasa Keuangan
POJK 10/2022 is no longer operative. Its collection-conduct articles were revoked by POJK 22/2023 with effect from 22 December 2023, and the regulation itself was replaced by POJK 40/2024 from 27 December 2024. Collection conduct now sits in POJK 22/2023 Articles 60 to 62: no contact with anyone other than the consumer, and contact only Monday to Saturday excluding national holidays, between 08:00 and 20:00 local time. Indonesia's national legal database still shows POJK 10/2022 as in force and has no entry for POJK 40/2024, which is how the error keeps spreading.
Also: POJK 10/2022 · POJK 40/2024 (LPBBTI) · POJK 22/2023 (collection conduct)
ID UU PDP
Personal Data Protection Law (UU 27/2022)
Republic of Indonesia
In force since 17 October 2022, not 2024: what ended in October 2024 was the two-year conformity period in Pasal 74. Its supervisory institution has still not been established, and because Pasal 57(4) assigns administrative sanctions to that institution, administrative fines currently cannot be imposed at all, though the criminal provisions are unaffected. Pasal 10 gives an objection right over solely automated decisions including profiling, narrower than GDPR Article 22, and Pasal 34(2)(a) makes such decisioning a trigger for an impact assessment. Implementing regulation PP 33/2026 takes effect in January 2027.
Also: UU PDP · UU 27/2022 · PP 33/2026
Australia
No AI statute, a technology-neutral regulator posture, and one dated disclosure obligation arriving in December 2026.
Where Nova applies this