OJK's Bank IT Rule PADK 1/2026: What It Asks on Vendors and Cloud

What does PADK OJK 1/2026 require of a bank's technology? The regulation, issued by Indonesia's Financial Services Authority (Otoritas Jasa Keuangan, OJK), has applied to every commercial bank in the country since 1 March 2026. It is the detailed rulebook under the 2022 regulation on information technology at commercial banks, and it replaces a circular that had stood since 2017. For banks it changes how technology suppliers are chosen and reviewed, how systems hosted abroad are licensed, and what is reported to the regulator. For the companies that sell technology to banks, it changes what they will be asked to prove.

What the regulation is and when it took effect

According to OJK's regulation page, PADK OJK 1/2026 on the Implementation of Information Technology by Commercial Banks (Penyelenggaraan Teknologi Informasi oleh Bank Umum) was set on 23 January 2026 and took effect on 1 March 2026. It implements POJK 11/POJK.03/2022, and from its effective date the circular SEOJK 21/SEOJK.03/2017 on risk management in the use of IT was revoked. OJK's abstract states that it applies to all commercial banks. The substance sits in four annexes: guidelines for running IT (75 pages), procedures for reports and licence applications (9 pages), report and notification formats (33 pages) and licence application formats (13 pages).

OJK lists nine subjects: IT governance, including the roles of the board of directors, the board of commissioners, the IT steering committee and the IT unit; IT architecture and the IT strategic plan; IT risk management, including information and network security; the use of IT service providers; licensing for placing electronic systems and processing transactions outside Indonesia; data management and personal data protection; IT services provided by banks; internal control and internal audit; and reporting. In its abstract, OJK explains the purpose plainly: greater use of technology brings risks that must be identified and controlled, so banks need stronger governance for technology to add value.

What changed from the 2017 circular

OJK's own list of frequently asked questions, published with the regulation, names the main changes. The first concerns IT service providers: policies and procedures for using them, the use of providers outside Indonesia, and the reassessment of how material a provider is to the bank. The others are standards and procedures for banks that provide IT services themselves, internal control over IT, and adjusted formats for reports and licence applications.

The same document says the regulation adds material that the old circular did not have: on IT governance, on preparing an IT architecture, on data management and personal data protection, and on the procedure for submitting reports and applications. It also reminds banks that two other OJK circulars apply alongside it, one on cyber resilience and security and one on assessing a bank's digital maturity.

IT service providers: due diligence does not end at signing

A legal update published by the Jakarta law firm SSEK on 9 July 2026 sets out the provider rules in more detail. Banks may engage third parties for software, hardware, technical support and consulting, but the underlying 2022 regulation requires due diligence before a provider is selected, and the relationship must be recorded in a written agreement. Providers located outside Indonesia may be used under the same policies and procedures as domestic ones, provided the arrangement does not impede OJK's supervision and examination.

The notable addition is the reassessment of materiality. As SSEK describes it, a bank must look again at a provider when a significant change could affect its ability to serve the bank, such as a change in ownership or financial condition, and decide whether the nature, scale or complexity of the risk has changed. The bank's policies must cover at least the reliability of the provider, when reassessment happens and what follows from it.

Systems hosted abroad: lighter paperwork, same licence

Placing electronic systems in a data centre or disaster recovery centre outside Indonesia still needs OJK's permission, but the FAQ confirms the application is simpler. The bank's summary of an independent audit of the facility's security is now needed only the first time the bank places systems there. Three documents are no longer required: the provider's own risk analysis, the bank's plan for supervising the facility and its plan for building staff capability.

The regulation also gives examples of systems used for internal management, in the context of the criteria for offshore placement: personnel and remuneration systems, internal audit systems, internal document processing, internal collaboration tools and knowledge management applications, including those that use artificial intelligence.

Moving is treated carefully. If a licensed system moves to a data centre OJK has already approved, a notification is enough. If it moves to a facility that has never been approved, a new licence is needed even when the new site is in the same country, because, OJK explains, each location has its own security characteristics and risk profile. The FAQ also separates two ideas that are often blurred: placement is the physical location of the data centre, while transaction processing is the adding, changing, deleting or authorising of data.

Plans, reports and the transition

Banks have been required to use the new report formats and deadlines since 1 March 2026. SSEK lists the formats in the third annex: the IT development plan report, the report on the current condition of IT use, the internal IT audit report, and the initial notification and report of an IT incident. Licence processes that began before 1 March continue under the 2017 circular.

The FAQ answers two practical questions on planning. A bank may change its IT strategic plan mid-period when conditions significantly affect its goals, by filing the change online with its reasons, an evaluation of the previous period, its vision and mission for IT, an analysis of its internal and external environment and its updated objectives. The IT development plan report may be changed up to three times a year for technology-based products, due by the end of March, June and September, but not three times in one quarter.

What banks and their technology suppliers should do now

This part is our analysis, not the regulator's wording. The regulation rewards banks that can describe their technology estate accurately: which systems exist, where they run, who supplies them and how much the bank depends on each supplier. Several practical steps follow.

• Keep one current inventory of systems, hosting locations and providers. Architecture, materiality reviews and offshore licensing all draw on it.
• Define the events that trigger a provider reassessment, such as a change of owner, and who decides the follow-up.
• Check each planned move of a workload against the list of data centres OJK has already approved for the bank, before committing to dates.
• If you supply technology to banks, expect more questions on ownership, financial standing, continuity and where your systems run, and prepare the evidence once.

What to watch next

Two things are worth following. The first is how OJK applies the companion circulars on cyber resilience and digital maturity, which the FAQ says banks must read together with this regulation. The second is practice on offshore licensing: InvestorTrust reported on 1 September 2026 that OJK, in a written statement, again stressed stronger IT governance as the purpose of the rule, but the regulator has not published figures on applications handled under the simplified process. Banks planning cloud or data centre moves in 2027 should confirm current expectations with their supervisor early.