OJK Tightens Digital Lending: Capital, Conduct, and Credit

Indonesia's digital lending sector stands at a critical juncture, not merely evolving but undergoing a profound regulatory recalibration by the Otoritas Jasa Keuangan (OJK). The era of light-touch supervision is definitively over. Fintech firms must now navigate a far more stringent, yet ultimately more sustainable, operating environment. This isn't just about compliance; it's about redefining the very foundations of digital finance in Southeast Asia’s largest economy.

OJK’s Regulatory Overhaul: A New Era for Digital Lending

The Indonesian Financial Services Authority (OJK) has aggressively updated its regulatory framework for digital lending, moving from a reactive stance to a proactive, comprehensive oversight model. This shift is primarily encapsulated in OJK Regulation No. 40 of 2024 (POJK 40/2024) concerning Information Technology-Based Peer-to-Peer Lending Services (LPBBTI), which superseded earlier regulations like POJK 10/2022 and POJK 77/2016.

POJK 40/2024, effective since December 27, 2024, alongside its implementing circular letter, OJK Circular Letter No. 19/SEOJK.06/2025 (effective July 31, 2025), establishes a robust framework designed to enhance stability, security, and governance within the digital financing industry.

Capital Adequacy and Ownership Structure

One of the most impactful changes under POJK 40/2024 is the significant increase in capital requirements. P2P lending operators are now mandated to maintain a minimum equity of IDR 12.5 billion (approximately USD 800,000) at all times. This represents a substantial leap from previous requirements, signaling OJK's intent to consolidate the market and ensure only well-capitalized entities can operate. Furthermore, operators must maintain an equity to paid-up capital ratio of no less than 50%.

At establishment, a P2P Service Provider must possess a minimum paid-up capital of IDR 25 billion. These funds must be fully paid immediately and placed in a term deposit, explicitly prohibiting capital derived from loans or linked to financial crimes.

POJK 40/2024 also broadens the permissible legal entities for P2P operators to include cooperatives (Koperasi), alongside limited liability companies (PT), a partial return to the flexibility seen in POJK 77/2016. While foreign parties are eligible to participate, limitations are imposed, with direct or indirect foreign ownership not exceeding 85% of paid-up capital until further government regulation.

Lending Limits and Borrower Eligibility

The regulation introduces clear financing limits: a maximum of IDR 2 billion for both consumptive and productive financing to a single borrower. However, qualifying operators can extend productive financing up to IDR 5 billion, provided they maintain a non-performing loan (NPL) ratio below 5% over a six-month period and are free of OJK sanctions.

Borrowers must be Indonesian citizens aged 18 or older (or married), with a minimum average gross income of IDR 3 million per month, or Indonesian legal/business entities, all domiciled in Indonesia. This explicitly prohibits cross-border financing for borrowers. Conversely, lenders can include Indonesian and foreign citizens, legal entities, business entities, and international institutions.

Sharia-Compliant Lending

Significantly, POJK 40/2024 introduces flexibility by allowing P2P lending platforms to operate both conventional and sharia-compliant activities within the same entity through the establishment of a Sharia Unit (Unit Usaha Syariah or UUS). This reverses a prohibition under the previous POJK 10/2022. Sharia finance in Indonesia operates under a dual supervision framework, aligning with both OJK regulations and the fatwas of the Indonesian Ulema Council's National Sharia Board (DSN-MUI). Platforms like ALAMI Sharia, Investree (Sharia Financing), and Ammana exemplify OJK-registered sharia-compliant digital lenders, focusing on ethical financing principles.

Alternative Credit Scoring: Unlocking Financial Inclusion

OJK Regulation No. 29 of 2024 (POJK 29/2024) on Alternative Credit Scoring (ACS) represents a monumental step towards financial inclusion for Indonesia’s unbanked and underbanked populations. Effective December 20, 2024, this regulation establishes a dedicated framework for ACS providers, moving innovative credit scoring (ICS) providers from a regulatory sandbox regime to requiring a formal business license from OJK.

ACS providers must be limited liability companies with a minimum paid-up capital of IDR 5 billion (approximately USD 305,000). Crucially, ACS providers are mandated to use alternative data—data other than traditional credit or financing data—to assess creditworthiness. This includes non-financial data points such as telecom usage, utility payments, and e-commerce behavior, analyzed through AI and machine learning. They are expressly prohibited from using credit or financing data for scoring purposes.

"POJK 29/2024 opens new opportunities for using innovative credit scoring while ensuring transparency. It's a chance for ITSKs to improve credit access and modernize their processes. However, it also brings new compliance challenges."

The regulation emphasizes transparency, requiring credit scores to be accompanied by clear explanations and prohibiting ACS providers from sharing scores with any party other than the relevant customers. This framework aims to bridge the credit gap for millions of Indonesians and MSMEs lacking traditional credit histories, fostering a more data-driven approach to credit evaluation.

Consumer Protection and Ethical Lending

Consumer protection remains a cornerstone of OJK’s regulatory strategy, reinforced by OJK Regulation No. 22 of 2023 on Consumer and Community Protection in the Financial Services Sector, and previously POJK No. 6/POJK.07/2022. These regulations impose stringent requirements on financial service providers, including digital lenders, regarding fair treatment, transparency, and robust complaint handling mechanisms.

Debt collection practices are under intense scrutiny. OJKR 22/2023 sets clear guidelines: third-party collectors must be licensed legal entities, employ certified personnel, and operate under written agreements. Prohibited practices include threats, violence, harassment of third parties, excessive contact, and collections outside permitted hours (Monday–Saturday, 08:00–20:00).

The Personal Data Protection Law (Law No. 27 of 2022) also plays a critical role, stipulating obligations for personal data controllers and processors, ensuring confidentiality and security of user data. OJK also plans to tighten the maximum debt-to-income ratio for borrowers, aiming to ensure the sustainability of the industry and promote prudent lending.

Market Dynamics and Credit Quality Concerns

The Indonesian digital lending market is experiencing rapid growth, with outstanding P2P loans reaching IDR 106.94 trillion (approximately USD 6.9 billion) in August 2026, a 22.07% year-on-year increase. The overall digital lending and credit platforms market is projected to grow from USD 17.4 billion in 2025 to USD 49.2 billion by 2032, at a CAGR of 16.00%. This expansion is fueled by an addressable pool of 85 million internet-enabled credit seekers in 2024, with approximately 30 million remaining unserved.

However, this rapid growth is accompanied by deteriorating credit quality. The 90-day default rate (TWP90) for fintech P2P lending platforms climbed to 5.36% in September 2026, breaching OJK's safety threshold of 5%. This represents a sharp increase from 2.82% in September of the previous year. To address this, OJK is reportedly considering relaxing the definition of a non-performing loan from more than 90 days overdue to more than 180 days, aligning with bank collectability standards. While this might ease reported delinquency pressure, it does not solve the underlying credit risk.

Comparison of Regulatory Approaches and Market Segments

Strategic Implications

For platform operators and lenders, Indonesia’s evolving regulatory landscape demands a fundamental strategic reorientation. The increased capital requirements will inevitably lead to market consolidation, favoring well-funded players or those capable of attracting significant investment. Smaller, undercapitalized firms face immense pressure to merge, seek new funding, or exit the market. This consolidation will likely result in fewer, but more robust, licensed entities.

Consumer protection and responsible lending are no longer optional add-ons but core operational imperatives. Platforms must invest heavily in transparent pricing, ethical debt collection practices, and robust dispute resolution mechanisms. Failure to comply will result in severe sanctions and reputational damage. The planned tightening of the debt-to-income ratio underscores OJK's commitment to preventing over-indebtedness, requiring lenders to refine their underwriting models beyond basic creditworthiness to assess true repayment capacity.

For alternative credit scoring providers, POJK 29/2024 provides much-needed regulatory clarity and legitimacy. This allows for scalability beyond the sandbox, but also introduces significant compliance burdens related to data governance, model validation, and transparency. Developing robust, explainable AI models that strictly adhere to the 'alternative data only' principle will be crucial. Partnerships with financial institutions seeking to leverage these new scoring capabilities will become a key growth driver.

Embedded finance players, while not under a single overarching regulation for their specific model, operate within the broader ITSK framework (POJK 3/2024) and are subject to OJK's consumer protection rules. Their strategic focus must be on seamless integration of financial services while ensuring full compliance with data privacy (PDP Law) and responsible conduct standards. The increasing regulatory emphasis on governance and risk management for ITSK operators (OJK Reg. 30/2025) means embedded finance providers cannot afford a 'move fast and break things' approach.

Ethical and Islamic lending, particularly Sharia-compliant P2P platforms, will see increased opportunities with the ability to operate Sharia Units within conventional entities. This allows for greater market reach while maintaining adherence to Islamic principles. Strategic partnerships with Islamic financial institutions and adherence to DSN-MUI fatwas will be essential for growth and credibility in this niche.

Finally, the proposed relaxation of the NPL definition to 180 days overdue, while potentially improving reported credit quality, should not be misconstrued as a softening of risk management. Instead, it provides a longer window for recovery efforts, demanding more sophisticated early-stage delinquency management and collection strategies from platforms to minimize actual losses. This requires a proactive, data-driven approach to portfolio health.

Implementation Roadmap

Platform operators and lenders must immediately initiate a multi-pronged implementation roadmap to align with OJK's evolving regulatory landscape:

1. Capital Reinforcement & Structure Review (Immediate to Q2 2027): Assess current equity and paid-up capital against POJK 40/2024 and POJK 29/2024 requirements. Develop clear strategies for capital injection, mergers, or strategic partnerships to meet the IDR 12.5 billion minimum equity for P2P and IDR 5 billion for ACS. Ensure legal entity type (PT or Koperasi for P2P, PT for ACS) is compliant.

2. Compliance & Governance Upgrade (Ongoing): Implement robust Good Corporate Governance (GCG) guidelines, including minimum Board of Directors (BOD) and Board of Commissioners (BOC) requirements, and ensure key personnel obtain OJK-registered certifications. Establish dedicated units for consumer protection and ensure compliance with POJK 22/2023.

3. Underwriting & Risk Model Refinement (Q4 2026 to Q3 2027): Revamp credit scoring models to incorporate the new alternative data mandates for ACS, strictly avoiding traditional credit data. For P2P, refine repayment ability assessments, considering the planned tightening of debt-to-income ratios and ensuring compliance with the IDR 2 billion/IDR 5 billion funding limits. Enhance early-stage delinquency detection and recovery strategies in anticipation of the 180-day NPL reclassification.

4. Consumer Journey & Data Privacy Enhancement (Ongoing): Review and update all user agreements, risk warnings, and platform disclosures to ensure transparency as per SEOJK 19/2025. Implement strict data privacy protocols in line with the PDP Law, securing customer consent for data usage and protecting personal information. Optimize complaint handling mechanisms to be easily accessible and promptly resolved.

5. Sharia Unit Establishment (For Islamic Lenders, Q1 2027): For platforms aiming to offer Sharia-compliant products alongside conventional ones, initiate the process for OJK approval to establish a Sharia Unit. Ensure full adherence to DSN-MUI fatwas and OJK's sharia governance guidelines (POJK 2/2024).

6. Technology & Security Audit (Annual): Conduct regular external audits of electronic systems, cybersecurity measures, and data centers (which must be in Indonesia). Ensure robust IT outsourcing policies, especially for non-critical systems, are in place.

7. Lender and Borrower Management (Q1 2027): Implement new lender eligibility criteria, distinguishing professional and non-professional lenders and enforcing respective funding caps (e.g., total non-professional funding not exceeding 20% of outstanding loans by January 1, 2027). Ensure all borrowers meet the updated age, income, and residency requirements.

8. Reporting & Regulatory Dialogue (Ongoing): Establish robust internal reporting frameworks to OJK, including annual reports on governance and risk management (OJK Reg. 30/2025). Maintain open communication channels with OJK to stay abreast of further regulatory developments and seek clarifications.

Conclusion

Indonesia's OJK has unequivocally charted a course toward a more mature, responsible, and resilient digital lending ecosystem. The recent wave of regulations, particularly POJK 40/2024 and POJK 29/2024, signals a pivotal moment for fintech firms. This isn't merely about compliance checklists; it's an opportunity to build trust, expand financial inclusion responsibly, and secure long-term market leadership in a rapidly evolving, high-growth region. Those who adapt swiftly, prioritize ethical operations, and strategically leverage technology will thrive. Those who resist will be left behind. The future of Indonesian digital lending is here, and it is firmly regulated.