In brief
On 24 December 2025, Bank Indonesia (BI) issued BI Regulation No. 10 of 2025 on the Regulating of the Payment System Industry ("PBI 10"), followed by Regulation of the Member of the Board of Governors No. 32 of 2025 ("PADG 32") as the implementing rule. PBI 10 forms part of BI's Indonesian Payment System Blueprint (Blueprint Sistem Pembayaran Indonesia) 2030 agenda to strengthen digital integration, streamline risk‑based supervision, and enhance the resilience and structure of the national payment system industry. In doing so, the new framework revokes BI Regulation No. 22/23/PBI/2020 on Payment Systems and replaces several aspects under BI Regulation No. 23/6/PBI/2021 on Payment Service Providers and BI Regulation No. 23/7/PBI/2021 on Payment Infrastructure Providers (collectively referred to as "PBI 23"). The new regime introduces several concepts and classifications that did not exist previously, such as the TIKMI performance‑assessment, mandatory business planning requirements, a new Payment System Providers (Penyelenggara Jasa Sistem Pembayaran – PSP)‑classification model, and a tiered categorization of supporting providers. Together, these features represent structural regulatory changes that reshape BI's supervisory approach.
Selective key updates from PBI 10 and PADG 32
1. TIKMI (Transaction, Interconnection, Competence, Risk Management, and IT Infrastructure) Assessment
PBI 10 introduces TIKMI, an assessment framework covering transaction, interconnection, competence, risk management, and IT infrastructure. TIKMI serves as BI's tool to evaluate PSP readiness and resiliency. It informs key regulatory decisions, including licensing and authorization, BI's PSP classification, BI's review and approval of the Payment System Business Plan (Rencana Bisnis Sistem Pembayaran – RBSP), and BI's assessment of proposed product, activity, and cooperation developments. PSPs are expected to conduct regular self-assessments against TIKMI and submit them to BI, allowing BI to form an overall view of a PSP's strengths, gaps, and priorities for improvement. BI retains the authority to override the PSP's self‑assessment and determine its own TIKMI rating. Because TIKMI feeds into multiple approval points, it effectively becomes a foundation that can influence how BI responds to a PSP's plans.
This is a meaningful change compared with the previous regime, which many businesses experienced mainly through a risk categorization process for the development of activities, products, and cooperation arrangements. Under the new framework, BI's review is broader: the focus extends beyond the inherent risk of a specific initiative to whether the PSP has the governance, competence, and technology to support it safely. PSPs with stronger TIKMI outcomes may find it easier to explain their plans and obtain regulatory comfort, while weaker results may lead to closer supervisory attention, additional conditions, or longer approval timelines, particularly for more complex cooperation arrangements.
2. PSP Classification
BI introduces a two-tier classification for PSPs, i.e., Primary PSP (PSP Utama) and non‑Primary PSP (PSP selain PSP Utama), with classification determined primarily based on the TIKMI evaluation results. A Primary PSP is broadly one whose size, interconnectedness, and complexity are such that an operational or financial disruption at that entity could materially affect the broader payment system and, in some cases, the financial system, including the risk of partial or broader failure of payment system functions if the PSP experiences severe disruption or failure. Importantly, the regulations do not create an automatic outcome solely because a PSP has a strong market position. The classification remains a matter of BI's assessment and methodology.
This classification is important because it affects what BI expects and how often BI assesses the PSP. For example, Primary PSPs are typically assessed under TIKMI more frequently (every six months), while non‑Primary PSPs are generally assessed once a year. The PSP classification can also have implications beyond the PSP itself, because it may influence how BI categorizes third‑party supporting providers that partner with the PSP.
3. Payment Systems Business Plans
Under PBI 10 and PADG 32, all PSPs must prepare RBSP, and the RBSP requires BI approval. RBSP is particularly important because it becomes the primary channel through which planned cooperation arrangements and key business developments are presented to, and approved by, BI. In reviewing an RBSP, BI may take into account the PSP's TIKMI assessment as part of its overall view of the PSP's readiness and risk profile. As a result, RBSP is not merely a planning document, it functions as a practical "entry point" for the PSP to move forward with product/activity rollouts and partnership plans in a manner aligned with BI's expectations.
4. New Cooperation Classification Rules
Under PBI 23, development of activities/products and cooperation arrangements were classified as low, medium, high risks. Medium and high-risk required prior BI approval, while low risk require reporting to BI. The new framework in PBI 10 and PADG 32 shifts the starting point. Planned cooperation should now be incorporated into the PSP's RBSP, and BI's approval is generally obtained through the RBSP approval process. If the RBSP has not yet been approved, the PSP may need to seek a separate approval for the relevant cooperation. PSPs must submit their first RBSP by 30 April 2026, making RBSP preparation a critical step for any upcoming partnership roadmap.
PADG 32 adds a second filter by classifying cooperation (and development) as either standard or complex. When preparing the RBSP, PSPs must categorize each planned cooperation accordingly. In broad terms, complex cooperation covers arrangements that implicate core payment‑processing stages and/or involve non‑Indonesian counterparties, and it requires additional BI approval even after the RBSP has been approved. By contrast, standard cooperation is handled through reporting once the RBSP is approved. Cooperation or development models that are materially similar to business models previously approved by BI fall under the standard category.
In addition, the new rules introduce a "readiness test" (uji coba kesiapan). A PSP may run this test only once certain conditions are met: BI must first approve the underlying plan through the RBSP or through the PSP's approval request for the relevant development/cooperation. The test must also be confined to specified users or territories and conducted within a fixed period agreed by BI. PSPs are required to submit a test‑plan notice to BI before commencing the test and a closing report after it ends.
5. New Supporting Provider Categories
Under PBI 10 and PADG 32, third parties that support a PSP's payment system operations are now grouped into three categories of supporting providers (critical, important, and standard). The categorization matters because it determines whether the supporting provider is subject to BI registration. In general, the categorization looks at what the supporting provider actually does and where it sits in the payment flow. Where the support is limited to pre‑transaction or post‑transaction activities, the supporting provider falls under the standard category and does not require BI registration. By contrast, supporting services provided at the payment transaction processing stages (initiation, authorization, clearing, and final settlement) fall under the critical or important categories, and both require BI registration.
The difference between critical and important depends on the PSP's classification. A supporting provider that supports a Primary PSP is classified as critical, while one that supports a non‑Primary PSP is classified as important. PSPs are only permitted to engage with supporting providers in the critical or important category once the supporting provider has been duly registered. Critical and important supporting providers must complete BI registration within three years from the effective date of the new regime (i.e., by 31 March 2029), and PSPs are expected to ensure that cooperation with critical or important supporting providers is aligned with the registration requirement.
6. Transitional Provisions
PBI 10 and PADG 32 will take effect on 31 March 2026, while existing licenses, approvals, participant statuses, and applicable standards granted under PBI 23 will continue to remain valid insofar as they are consistent with the new framework. As a result, cooperation arrangements executed/launched before the effective date are generally expected to fall under the PBI 23 regime. However, given the compressed transition timeline and BI's ongoing implementation of TIKMI‑based assessment, RBSP submission (due 30 April 2026), and re‑classification processes, PSPs should anticipate that BI may limit or defer new approvals under the existing rules.
Closing
The issuance of PBI 10 and PADG 32 marks a significant restructuring of Indonesia's payment system regulatory landscape. By introducing a new assessment architecture, expanded planning and reporting obligations, redefined PSP classifications, and clearer requirements for cooperation and supporting providers, BI aims to create a more resilient, transparent, and digitally integrated ecosystem. With the new framework taking effect on 31 March 2026, early preparation and alignment with BI's updated supervisory expectations will be key. We anticipate further implementation guidance from BI, and industry participants should monitor for any such updates as the transition progresses.
* * * * *
Johan Kurnia, Associate Partner, and Valerie Pricillia, Associate have contributed to this legal update.
© 2026 HHP Law Firm. All rights reserved. In accordance with a common terminology used in professional service organizations. reference to a "partner" means a person who is a partner, or equivalent in such a law firm. Similarly reference to an "office" means the office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome