POJK 10/2022 has been superseded

Peraturan OJK No. 10/POJK.05/2022 on Layanan Pendanaan Bersama Berbasis Teknologi Informasi was set on 29 June 2022, promulgated and in force from 4 July 2022, and ran to 120 articles. Its own Article 118 revoked the earlier POJK 77/POJK.01/2016. It is a real regulation with a real history, and it is no longer the one that governs.

A great deal of English-language guidance on Indonesian fintech lending still presents it as current. If a summary describes POJK 10/2022 as the operative framework, that summary reflects the position before December 2024, whatever its publication date says.

The sequence matters, because the part most relevant to collections died first.

• 22 December 2023: POJK 22/2023 on consumer and public protection in the financial services sector took effect. Its Article 121(f) revoked Articles 102, 103 and 104 of POJK 10/2022 and declared them no longer in force. Those were the collection-conduct articles. The same regulation fully revoked POJK 6/POJK.07/2022.
• 27 December 2024: POJK 40/2024 on information-technology-based collective funding services took effect, having been issued on 24 December 2024, and revoked POJK 10/2022. It was made to implement mandates in Law 4 of 2023 on the development and strengthening of the financial sector that POJK 10/2022 had not accommodated.

So for the whole of 2024, POJK 10/2022 was still the framework regulation while its collection articles were already dead letter. Guidance written in that window can be simultaneously right about the framework and wrong about collections, which is part of why the error propagated so widely.

Indonesia’s national legal database still carries POJK 10/2022 with an active status, and has no entry at all for POJK 40/2024. That combination is exactly how a superseded regulation keeps getting cited as current: the record that exists says it is in force, and the record that would contradict it has not been indexed.

One caveat in the other direction, stated plainly. Because POJK 40/2024 is not in the national database either, its revocation clause has been confirmed through secondary legal reporting and through a later regulation that cites and partially amends it, rather than read directly. The supersession itself is not in doubt. Article-level claims about what POJK 40/2024 contains deserve more caution, and are flagged as such below.

POJK 22/2023 is the live instrument, and it is more specific than what POJK 10/2022 contained.

• Article 60: a warning letter is required before collection proceeds.
• Article 61: a third-party collector must be a legal entity, licensed, with personnel certified by a certification body registered with OJK.
• Article 62(2): no threats, violence, or humiliation; no physical or verbal pressure; no contact with persons other than the consumer; no continuous or harassing contact; contact at the collection address or the consumer's domicile; and contact only Monday to Saturday excluding national holidays, between 08:00 and 20:00 local time.
• Article 62(3): contact outside those hours or that place requires the consumer's prior agreement.

Two points for anyone running an automated contact channel. First, the 08:00 to 20:00 window is real, but it comes from POJK 22/2023 and is paired with a Monday-to-Saturday restriction and a national-holiday exclusion that summaries routinely omit. Second, there is no provision anywhere in these rules addressing robocalls or automated collection as such. The conduct standard is written around the consumer’s experience, and an automated channel is bound by it because it produces the same contact, not because it is separately named.

Indonesian fintech-lending guidance very commonly states that operators may access only a borrower’s camera, microphone and location, and never their contact list, and attributes that rule either to the sectoral regulation or to an OJK circular letter.

The Indonesian words for camera, microphone and contacts appear nowhere in POJK 10/2022. The restriction is not in that regulation. The circular letter usually cited for it could not be verified at source, and the national legal database indexes no circular letter for this sector at all. The underlying supervisory expectation is well established in practice; the citation that travels with it generally is not. If you need to rely on it, obtain the instrument rather than the citation as repeated.

• Funding limits moved from a single Rp2 billion cap to a differentiated structure: Rp2 billion for consumptive funding, and up to Rp5 billion for productive funding subject to conditions.
• Minimum equity was raised to Rp12.5 billion, phased in during 2025.
• Operators may now be cooperatives or state and regional government entities, where the permitted form had been restricted to limited liability companies.
• Implementing instruments issued under the revoked regulation remain valid so far as they do not conflict with the new one.

Nothing located in POJK 40/2024 addresses automated decisioning, algorithmic credit scoring, explainability, or human review. That was also true of POJK 10/2022, whose Article 19(3)(a) barred outsourcing the funding-feasibility assessment and IT functions, and whose elucidation acknowledged alternative credit-scoring providers without regulating how their models reach a decision.

The Personal Data Protection Law, UU 27/2022, is where the automated-decision questions live. Article 10(1) gives a right to object to decisions based solely on automated processing, including profiling, that carry legal consequences or significant effect, and Article 34(2)(a) makes that kind of decisioning a trigger for a data protection impact assessment. Breach notification runs on a 3x24-hour clock under Article 46(1).

Article 75 preserves sectoral data rules so far as they do not conflict with the statute, which sets up a genuine tension worth flagging. POJK 10/2022 Article 48(1) required personal data to be retained for at least five years after the business relationship ended, while UU PDP Article 43(1) provides for erasure. The two are reconciled through the legal-obligation basis in Article 20(2)(c) together with Article 75, rather than by either simply overriding the other.

Bahasa Indonesia is the baseline for customer-facing interactions. Regional languages such as Javanese, Sundanese, Balinese and Minangkabau are welcomed by users, but Bahasa Indonesia is the floor, and an automated agent should default to it and move to a regional language only on a confirmed customer preference.

The conduct envelope an automated collection channel has to respect in Indonesia is now POJK 22/2023 Article 62: a Monday-to-Saturday, 08:00 to 20:00 local window with national holidays excluded, no contact with anyone other than the consumer, and no continuous or harassing contact. Nova for Finance enforces time windows and consumer-only contact in the call flow rather than in agent instructions, and records every interaction with a transcript, timestamp and outcome, so a conduct question is answerable from evidence rather than from a description of intended behaviour.

The retention tension above is the one to raise early in any Indonesian deployment, because it is a data-model decision rather than a configuration one.