Indonesia's Banking Digital Ecosystem in 2026: From Feature Expansion to Infrastructure Discipline

Key Findings

• Commercial-bank credit and third-party-deposit growth remained positive in Q2 2025 but slowed to 7.77% and 6.96% year on year, respectively, from 12.36% and 8.45% in Q2 2024. [1]
• Bank Indonesia's payment framework, effective from 31 March 2026, links provider classification and ongoing capital to risk-based criteria; the first classification determination is due by 31 March 2027. [2]
• SNAP makes open-API technical and governance standards part of phased mandatory payment connectivity, while Project Nexus remains pre-live comparator evidence rather than an Indonesian production outcome. [3, 4]
• Cyber-resilience duties extend across commercial-bank and rural-bank categories, while personal-data penalties are statutory maxima rather than evidence of enforcement frequency. [5, 6, 7]
• The evidence supports a shift toward infrastructure-and-governance discipline, but it does not establish uniform implementation, proven customer benefits, or sector-wide outcomes.

The available evidence indicates that Indonesia's banking digital ecosystem is moving from expansion-by-access toward infrastructure-and-governance discipline: sector growth remained positive but moderated, while payment oversight, open-API standards, systemic payment rails, cyber-resilience obligations, and personal-data sanctions became more explicit. The evidence does not establish uniform implementation or customer outcomes across institutions.

Commercial-bank credit grew 7.77% year on year in Q2 2025, compared with 12.36% in Q2 2024, while third-party deposits grew 6.96%, down from 8.45% a year earlier [1] . Growth remained positive throughout, not contractionary.

Against that moderated but still-expanding baseline, Bank Indonesia's payment-system regulation introduced risk-based provider classification and capital requirements, effective from 31 March 2026 [2] , together with implementing provisions described in Bank Indonesia's payment-system industry announcement . The framework builds on the National Open API Payment Standard (SNAP) , enacted in 2021 for phased mandatory implementation.

Cyber-resilience duties have also become more explicit under OJK Regulation 11/POJK.03/2022 on information technology implementation by commercial banks . Indonesia's Personal Data Protection Act made personal-data sanctions more explicit, as summarized by the Library of Congress, Indonesia: Personal Data Protection Act Enters into Force .

The Sector Baseline: Positive Growth, Slower Momentum

Before infrastructure and governance, the commercial-banking environment itself showed continued expansion at a slower pace, not contraction.

Commercial-bank credit growth reached 7.77% year on year in the second quarter of 2025, down from 12.36% in the same quarter of 2024 [1] . Third-party deposits followed a comparable pattern, growing 6.96% year on year in Q2 2025 against 8.45% in Q2 2024. Both measures use the same quarterly and publisher basis, which makes the comparison legible without adjustment.

Prudential indicators, considered separately from growth rates, remained broadly stable. Commercial-bank capital adequacy stood at 25.81% in Q2 2025, slightly below the 26.09% recorded a year earlier, while gross non-performing loans were reported at 2.22% and net non-performing loans at 0.84% [1] . These figures describe capital and asset-quality conditions, not growth momentum, and should not be folded into a single composite assessment.

Capital strength also varied by institutional category at the same point in time. Rural banks (BPR) reported a capital adequacy ratio of 30.54% in Q2 2025, while sharia rural banks (BPRS) reported 20.53%, compared with the 25.81% recorded for commercial banks [1] . This is a point-in-time comparison across categories with different regulatory and portfolio structures; it does not establish a persistent hierarchy or any link to digital capability.

Commercial-Bank Credit and Deposit Growth, Q2 2024 vs Q2 2025

The grouped bar chart compares the audited year-on-year growth rates for commercial-bank credit and third-party deposits. Both measures remained positive across the two periods but were lower in Q2 2025 than in Q2 2024.

Interpretation: The data do not show absolute contraction in lending or deposits, and they do not establish a causal relationship with the payment, interoperability, or data-governance developments discussed later in this article.

Source: [1] .

Underlying data

Underlying data for commercial-bank credit and third-party-deposit growth in Indonesia, Q2 2024 and Q2 2025

Category / Period	Series	Value	Unit	Geography / Segment	Source
Commercial-bank credit growth	Q2 2024	12.36	Percent, year-on-year	Indonesia, commercial banks	OJK LSPI Q2 2025
Commercial-bank credit growth	Q2 2025	7.77	Percent, year-on-year	Indonesia, commercial banks	OJK LSPI Q2 2025
Third-party-deposit growth	Q2 2024	8.45	Percent, year-on-year	Indonesia, commercial banks	OJK LSPI Q2 2025
Third-party-deposit growth	Q2 2025	6.96	Percent, year-on-year	Indonesia, commercial banks	OJK LSPI Q2 2025

Moderated growth did not remove the structural relevance of scalable shared infrastructure. The next section examines those payment rails and their scale.

Systemic Rails Beneath Digital Banking

Digital banking in Indonesia rests on payment and settlement systems whose scale is best understood as institutional infrastructure rather than as a consumer-facing feature. An assessment of Indonesia's securities settlement system against international principles for financial market infrastructure offers a useful, if dated, illustration of that scale.

Bank Indonesia's real-time gross settlement system, BI-RTGS, settled transactions valued at Rp201,861 trillion in 2022, a figure the assessing authorities equated to 9.8 times Indonesia's gross domestic product that year [9] . That figure is one 2022 system value expressed two ways, an absolute settled amount and a GDP-relative multiple, not two separate measurements.

A related but distinct measure comes from Indonesia's central securities depository and settlement system, BI-SSSS, which held securities valued at Rp4,841 trillion as of 2021 [9] . That figure is a stock measure from a different year than the BI-RTGS flow figure above, and the two should not be summed or ranked against one another.

QRIS, Indonesia's national QR-payment standard, offers a third and again distinct type of indicator: participation rather than value. More than 80 payment service providers had adopted QRIS as of the assessment's October 2023 reference point [9] . A provider count says nothing about transaction volume, merchant distribution, or customer-level usage; it demonstrates only that a wide base of institutions had connected to the standard by that date.

Scale Indicators for Indonesia's Core Payment Infrastructure

The table below keeps these three infrastructure measures separate because they describe different systems, use different units, and refer to different reference periods. Treating them as directly comparable would overstate what the evidence supports.

Scale Indicators for Indonesia's Core Payment Infrastructure

System / Infrastructure	Indicator	Reported Value	Unit	Reference Period	Functional Role
BI-RTGS	Settled transaction value	201,861	Rp trillion	2022	Real-time gross settlement of large-value payments
BI-RTGS	Value relative to GDP	9.8	Times GDP	2022	Contextualizes settlement scale against the national economy
BI-SSSS	Securities held	4,841	Rp trillion	2021	Central securities depository and settlement
QRIS	Participating payment service providers	>80	Providers	As of October 2023 assessment	Breadth of institutional adoption of the national QR standard

Interpretation: Each row demonstrates that a different layer of Indonesia's payment infrastructure operated at institutionally significant scale as of its respective reference date. The table does not establish current 2026 values, customer-level usage, service quality, or a ranking among the three systems.

Source: [9] .

Infrastructure of this scale creates its own governance demands: who may connect to it, under what capital and risk conditions, and with what oversight. Those questions of participation come next.

Payment Participation Becomes Risk-Based

The clearest regulatory shift documented in the reviewed evidence concerns how payment providers are assessed, classified, capitalized, and monitored. Bank Indonesia's PBI 10/2025, together with implementing provisions under PADG 32/2025, establishes a more explicit structure built around a five-criterion assessment known as TIKMI [2, 8].

TIKMI assesses five dimensions of a provider's activity and capability: transaction, interconnection, competence, risk management, and IT infrastructure. Based on this assessment, Bank Indonesia classifies payment-system providers (Penyelenggara Sistem Pembayaran, PSP) into one of two official tiers: PSP Utama and PSP selain PSP Utama [2] . The regulation took effect on 31 March 2026, and the first classification determination is required within one year of that date, by 31 March 2027 [2] .

Capital requirements follow a similar logic of explicit, risk-linked thresholds. Payment service providers (PJP) and payment infrastructure providers (PIP) must maintain ongoing capital of at least 10% of risk-weighted transactions [2] . On top of that common minimum, PJP face an additional surcharge ranging from 1.5% to 2.5% of risk-weighted transactions, while PIP face a wider surcharge range of 2.5% to 5% [2] . These figures should be read as distinct regulatory parameters rather than summed into a single implied capital burden, since the regulation does not specify that they combine additively for every provider.

Bank Indonesia has described the framework's scope as covering assessment, classification, participation, cooperation, oversight, and monitoring of payment-system providers [8] .

Payment-System Classification, Capital, and Implementation Requirements

The table consolidates the regulatory design into one view. It reflects rules that take effect from 31 March 2026 onward, not observed classifications, market exits, or compliance outcomes.

Payment-System Classification, Capital, and Implementation Requirements

Requirement Layer	Provider Type	Classification / Assessment	Minimum Ongoing Capital	Surcharge Range	Effective Date	Initial Deadline
Assessment	PJP and PIP	TIKMI: transaction, interconnection, competence, risk management, IT infrastructure	-	-	31 March 2026	-
Classification	PJP and PIP	Two tiers: PSP Utama; PSP selain PSP Utama	-	-	31 March 2026	By 31 March 2027
Capital - base	PJP and PIP	-	≥10% of risk-weighted transactions	-	31 March 2026	-
Capital - surcharge	PJP	-	-	1.5%-2.5% of risk-weighted transactions	31 March 2026	-
Capital - surcharge	PIP	-	-	2.5%-5% of risk-weighted transactions	31 March 2026	-

Interpretation: The table shows a regulatory design that makes provider assessment, classification, capital, and timing explicit, effective from 31 March 2026. It does not show completed classifications, actual compliance costs, market exits, or the framework's effect on competition.

Sources: [2, 8].

Classification and capital govern who may participate and on what financial footing. The next question is how participants are expected to connect to one another technically.

Interoperability Moves into the Core Architecture

Governance of who may participate is complemented by standards for how participants connect. Indonesia's National Open API Payment Standard, known as SNAP, was enacted by Bank Indonesia Governor Decree on 16 August 2021 for phased mandatory implementation of open-API payment services [3] . SNAP combines two broad components: technical, security, data, and specification standards on one side, and governance guidelines for interconnected and interoperable open-API payments on the other [3] .

Beyond Indonesia's domestic standard, global evidence illustrates a broader shift toward interlinking payment systems rather than relying solely on bilateral connections. The Bank for International Settlements designed Project Nexus so that domestic instant-payment systems connect once to a common platform, rather than maintaining separate bilateral links with every partner system [4] .

Project Nexus targets cross-border settlement typically within 60 seconds. This is a design target, not an observed Indonesian settlement time. The same BIS source notes that domestic instant payments already settle within seconds in more than 70 countries [4] .

A separate global survey conducted by the BIS Committee on Payments and Market Infrastructures found that 65% of surveyed payment-system operators reported current use of APIs, while a further 20% reported plans to adopt them [10] . Those are two distinct survey categories (actual use and planned adoption), and should not be combined without confirming the survey's methodology treats them as mutually exclusive. Neither figure is Indonesia-specific.

Bank Indonesia held special-observer status in Project Nexus, not founding-member status, during the implementation stage toward future live operation. Project Nexus itself remained pre-live as of the source's August 2025 update.

The Nexus Scheme Organisation was intended to be based in Singapore, with BIS serving as technical adviser rather than owner or operator [4] . These statements describe institutional and governance roles, not a production deployment timeline for Indonesia.

Open-API and Payment-Interlinking Evidence by Implementation Stage

Open-API and Payment-Interlinking Evidence by Implementation Stage

Jurisdiction / Scope	Standard or Initiative	Evidence Form	Implementation Stage	Reported Requirement / Metric / Role	Period
Indonesia	SNAP	Regulatory standard	Phased mandatory implementation	Technical/security/data/specification standards plus governance guidelines	Enacted 16 August 2021, ongoing
Global	Project Nexus	Project design	Pre-production	Common-platform interlinking model (vs. bilateral links)	As of August 2025 update
Global	Project Nexus	Design target	Pre-production	Settlement typically within 60 seconds	As of August 2025 update
Global (>70 countries)	Domestic instant payments	Actual observation	Operational	Settlement within seconds domestically	As of August 2025 update
Global (CPMI survey)	Payment-system operators	Actual observation	Survey snapshot	65% reported current API use	CPMI survey, referenced July 2022
Global (CPMI survey)	Payment-system operators	Planned adoption	Survey snapshot	20% reported planned API adoption	CPMI survey, referenced July 2022
Indonesia / Project Nexus	Bank Indonesia	Institutional role	Observer stage	Special-observer status (not founding member)	As of August 2025 update
Singapore / Global	Nexus Scheme Organisation	Governance design	Planned	Intended Singapore-based location; BIS as technical adviser	From July 2024 planning

Interpretation: The table separates Indonesia's own mandatory domestic standard from global survey evidence and from Project Nexus design targets and governance roles. None of the global or Nexus rows describes an Indonesian production outcome, and current API use should not be added to planned adoption without confirming the underlying survey categories are mutually exclusive.

Sources: [3, 4, 10].

Greater standardization and interconnection widen the number of systems, data flows, and third-party relationships that require active governance. That expanded perimeter of trust and control comes next.

Connectivity Expands the Trust and Control Perimeter

As banks and payment providers connect more, cyber-resilience obligations have become more explicit. Commercial banks are required to maintain cyber resilience and to complete self-assessments of cybersecurity and digital maturity following further OJK stipulation [5] .

That control perimeter extends beyond commercial banks. OJK's newer regulation for conventional and sharia rural banks, POJK 34/2025, includes cyber-defence and cybersecurity provisions explicitly responding to those institutions' increased connectivity with third parties [6] . That extension confirms cyber-governance obligations are following connectivity across institution categories, not remaining confined to commercial banks alone.

National monitoring data provide context for the environment in which these obligations operate, though the scope is economy-wide rather than banking-specific. Indonesia's national cybersecurity authority recorded 403,990,813 traffic anomalies across the country in 2023, of which malware activity accounted for 44.49% [11] . These two indicators describe national monitoring conditions, not banking-sector attacks, losses, or customer harm.

The same report separately recorded 1,674,185 potential data-leak findings affecting 347 stakeholders, 1,101 web defacements, 13,309 vulnerabilities identified through IT security assessment of 586 tested electronic systems, and 83 incident-response assistance activities extended to 74 stakeholders [11] . These are distinct, non-additive indicators from a single cross-sectional year; they do not measure banking-sector attacks, losses, or customer harm.

Personal-data governance has followed a parallel trajectory from general obligation toward enforceable sanction. Indonesia's Personal Data Protection Act entered into force on 17 October 2022 [7] . The Act permits administrative fines of up to 2% of a violator's annual income, alongside criminal penalties of up to five years' imprisonment and a fine of up to Rp5 billion for the unlawful collection or use of personal data for personal benefit [7] . The Act gave organizations, including banks, a two-year transition period to come into compliance [7] . Those figures are statutory maximums, plus a transition timeline, not evidence of how frequently the provisions have been enforced.

Banking Cyber Requirements and Selected National Cyber Indicators

The table below keeps bank-specific regulatory obligations separate from national, economy-wide monitoring indicators; combining them would misrepresent the scope of each.

Banking Cyber Requirements and Selected National Cyber Indicators

Evidence Layer	Scope	Requirement or Indicator	Reported Value	Unit	Period
Regulatory obligation	Commercial banks	Cyber resilience and maturity self-assessment	Required	Categorical	POJK 11/2022; self-assessment after further OJK stipulation
Regulatory obligation	BPR / BPRS	Cyber-defence and cybersecurity provisions	Required	Categorical	POJK 34/2025, promulgated December 2025
National indicator	Indonesia, economy-wide	Traffic anomalies	403,990,813	Count	2023
National indicator	Indonesia, economy-wide	Malware share of traffic anomalies	44.49	Percent	2023
National indicator	Indonesia, economy-wide	Stakeholders with potential data-leak findings	347	Count	2023
National indicator	Indonesia, economy-wide	Potential data-leak findings	1,674,185	Count	2023
National indicator	Indonesia, economy-wide	Web defacements	1,101	Count	2023
National indicator	Indonesia, economy-wide	Vulnerabilities identified	13,309	Count	2023
National indicator	Indonesia, economy-wide	Electronic systems tested	586	Count	2023
National indicator	Indonesia, economy-wide	Incident-response assistance activities	83	Count	2023
National indicator	Indonesia, economy-wide	Stakeholders assisted	74	Count	2023

Interpretation: Banking regulation establishes explicit cyber-resilience obligations across commercial banks and rural-bank segments. The national indicators describe the broader monitoring environment in which those obligations sit; they are not measures of banking-sector incidents, financial losses, or customer harm, and they should not be totaled into a single figure.

Sources: [5, 6, 11].

A shared control environment of this kind does not, by itself, guarantee uniform institutional outcomes. That distinction is tested directly next.

Shared Infrastructure, Uneven Institutional Outcomes

Common infrastructure and common regulatory obligations do not imply a single financial trajectory across institutions. Selected disclosures from BNI and Bank Jago illustrate different patterns. Those are bounded, institution-specific cases, not a comparative ranking, since the two banks differ in scale, business model, and reporting scope.

BNI: Funding Mix, Margin, and Efficiency Endpoints

PT Bank Negara Indonesia (BNI) reported a funding mix that remained heavily weighted toward current and savings accounts (CASA) throughout 2021-2025, with the CASA ratio staying within a 69.4%-72.4% range across that period [12] . Annual CASA growth, however, was more volatile: -2.5% in 2024, followed by 28.9% in 2025 [12] . CASA composition is a funding-mix metric, not a direct measure of digital-channel engagement, and should not be read as such.

Two further BNI ratios moved in a less favorable direction across the same endpoints. Net interest margin fell from 4.7% in 2021 to 3.8% in 2025, while the cost-to-income ratio rose from 43.3% to 46.5% over the same span [12] . Those are endpoint comparisons across a five-year window and do not establish a continuous trend across every intervening year, nor do they attribute cause to digital investment, platform ownership, or regulatory change.

Bank Jago: Asset and Profitability Changes in the Reported Periods

PT Bank Jago (ARTO), operating on a different scale and model, reported a different pattern over a shorter, more recent window. Total assets grew from Rp28,542,712 million at 31 December 2024 to Rp34,497,083 million at 30 September 2025 [13] . Over the comparable nine-month periods, return on assets improved from 0.62% to 1.05%, and return on equity improved from 1.73% to 4.16% [13] . Those figures describe Bank Jago specifically; they should not be generalized to digital banks as a category.

Read together, these two bounded cases show variation rather than a single outcome. BNI's data reflect funding-mix stability alongside margin and efficiency pressure; Bank Jago's data show total assets increasing between 31 December 2024 and 30 September 2025 and selected profitability ratios improving across comparable nine-month periods. Neither case should be read as representative of the sector, nor as evidence that shared infrastructure and governance rules cause any particular financial result.

The shared infrastructure and rules examined in the preceding sections coexist with this institutional variation, and with limits on what the wider evidence base can establish. Those limits are defined next.

What the Evidence Supports-and What It Does Not

The preceding sections point toward a structural interpretation: infrastructure, interoperability, capital, cyber resilience, and data governance are becoming more explicit conditions of participating in Indonesia's banking digital ecosystem. Comparator and early-signal material helps mark what the evidence does not establish.

Singapore as a Regulatory Comparator

Singapore's digital-bank licensing framework offers a jurisdiction-specific contrast, not a template for Indonesia. The Monetary Authority of Singapore issued four digital-bank licences in 2020 under a framework with restricted and full-functioning stages [14] . A restricted Digital Full Bank must hold minimum paid-up capital of S$15 million, rising to S$1.5 billion once fully functioning, and is subject to an aggregate deposit cap of S$50 million and an individual depositor cap of S$75,000 during the restricted phase [15] . MAS generally expects a Digital Full Bank to become fully functioning within three to five years of commencing business [15] . Those figures are structurally informative but belong to a different licensing category than Indonesia's payment-provider capital rules, and the two should not be ranked against one another as equivalents.

AI as an Early Signal

Artificial intelligence appears in the evidence archive only as an early signal, not as a documented industry-wide transformation. OJK's fourth-quarter 2025 bank survey reported that some banks had used AI in several business processes, citing efficiency gains, fraud detection, and cost reduction as reported benefits, alongside job displacement, cybersecurity dependence, data-privacy, and ethical risks as reported concerns [16] . This statement covers "some banks" in qualitative terms; it does not provide an adoption denominator, name specific institutions, or quantify scale or net value, and it should not be read as evidence of sector-wide AI maturity.

Evidence Gaps and Claim Boundaries

Beyond these bounded comparator and early-signal points, the approved evidence archive does not provide a sufficient core-eligible foundation for broader conclusions in several areas readers might otherwise expect covered: financial inclusion outcomes, digital-lending performance, digital identity and onboarding experience, broad customer-facing outcomes, and workforce transformation. That is a limitation of the available evidence archive, not a market finding: the absence of sufficient eligible evidence on these themes does not indicate that no activity or progress exists in them.

The strongest interpretation the evidence supports concerns the conditions of participation and control: who may connect to Indonesia's payment infrastructure, under what capital and classification terms, through what technical standards, and under what cyber and data-governance obligations. It does not support a claim of uniform implementation, proven customer benefit, or a settled outcome for any individual institution.

Conclusion

The evidence reviewed here describes a banking digital ecosystem whose center of gravity is shifting from visible, customer-facing expansion toward the infrastructure and governance conditions that make participation scalable and controllable. Commercial-bank growth remained positive in Q2 2025 but moderated from the year before, while capital and asset-quality conditions differed across commercial banks, rural banks, and sharia rural banks [1] .

That sector baseline sits beneath payment infrastructure operating at institutionally significant scale [9] . It also sits beneath a regulatory framework that makes provider classification, capital requirements, and implementation timing more explicit [2, 8].

Interoperability standards are becoming structural components of payment architecture rather than optional bilateral arrangements. Indonesia's SNAP framework establishes the domestic standard, while Project Nexus provides global comparator evidence about common-platform interlinking and remains distinct from Indonesian production outcomes [3, 4].

Greater connectivity is matched by more explicit cyber-resilience duties across institution categories [5, 6]. Personal-data sanctions are also enforceable, although the reviewed evidence does not establish their enforcement frequency [7] .

These shared conditions do not produce one uniform institutional result. BNI and Bank Jago disclose different financial patterns across different scales, models, metrics, and reporting periods [12, 13]. Singapore's licensing framework and OJK's early AI signal provide contrast and possibility, not proof of transferable models or industry-wide transformation [14, 16].

The most defensible reading is therefore bounded: Indonesia's next phase of banking digital evolution is better understood through the discipline of shared infrastructure and governance than through counts of customer-facing features or claims of uniform transformation. Financial inclusion, digital lending, onboarding experience, and workforce effects remain outside what the approved evidence archive can substantiate at scale. As an evidence-based inference rather than an established forecast, observable outcomes will depend on how institutions translate interoperability, capital, cyber-resilience, and data-governance requirements into operating systems.

References

1. Otoritas Jasa Keuangan (OJK). (2025). Laporan Surveillance Perbankan Indonesia (LSPI) – Triwulan II 2025. Executive Summary, page ix; Table 6, page 24; infographic tables pages xi-xiv. Official source .
2. Bank Indonesia (BI). (2025). Peraturan Bank Indonesia Nomor 10 Tahun 2025 tentang Pengaturan Industri Sistem Pembayaran (PBI PISP). Official BI summary, “Materi Pengaturan”; PSP classification and capital provisions. Official source .
3. Bank Indonesia (BI). (2021, ongoing). National Open API Payment Standard (SNAP). SNAP official page. Official source .
4. Bank for International Settlements (BIS) Innovation Hub (BISIH). (2024, updated 27 August 2025). Project Nexus: Enabling Instant Cross-Border Payments. Project overview, participant-status, and governance sections. Official source .
5. Otoritas Jasa Keuangan (OJK). (2022). POJK Nomor 11/POJK.03/2022 — Penyelenggaraan Teknologi Informasi oleh Bank Umum. Articles 21-22, Chapter V; Articles 66 and 70. Official source .
6. Otoritas Jasa Keuangan (OJK). (2026). OJK Issues Regulation On Information Technology Implementation For Conventional Rural Banks and Sharia Rural Banks — Digital Security Strengthening. (Press Release SP 4/GKPB/OJK/I/2026). Items 4-5. Official source .
7. Library of Congress (Law Library of Congress, Global Legal Monitor). (2022). Indonesia: Personal Data Protection Act Enters into Force. Introductory section; “Penalties for Prohibited Use of Data,” Articles 57 and 67; “Implementation of the Act.” Official source .
8. Bank Indonesia (BI). (2026). Bank Indonesia Strengthens Structure of Payment System Industry to Create a Reliable Digital Economy. (Press Release No. 28/16/DKom). Official source .
9. World Bank / IMF FSAP. (2024). Assessment of the BI-SSSS Based on CPMI/IOSCO Principles for Financial Market Infrastructure. Assessment background statistics and contextual discussion. Official source .
10. Bank for International Settlements (BIS) - Committee on Payments and Market Infrastructures (CPMI). (2022). Interlinking Payment Systems and the Role of Application Programming Interfaces: A Framework for Cross-Border Payments. (CPMI Papers No. 205). Section 4.2. Official source .
11. Badan Siber dan Sandi Negara (BSSN) / Id-SIRTII/CC. (2023/2024). Lanskap Keamanan Siber Indonesia 2023. Ringkasan, pages 8-9; Highlight IT Security Assessment. Official source .
12. PT Bank Negara Indonesia (Persero) Tbk (BNI). (2026). Financial Reports Portal (Balance Sheet 2021–2025). 5 Years Financial Highlights - Financial Ratios. Official source .
13. PT Bank Jago Tbk (ARTO). (2025). Financial Statements as of 30 September 2025. Statements of Financial Position, page 1; Financial Ratios table. Official source .
14. Monetary Authority of Singapore (MAS). (2020, ongoing). Digital Bank Licence — Eligibility Criteria and Requirements. Opening summary. Official source .
15. Monetary Authority of Singapore (MAS). (2019). Eligibility Criteria and Requirements for Digital Banks. Section II(c); Section III/1. Official source .
16. Otoritas Jasa Keuangan (OJK). (2025). Survei Bank Perkiraan Objektif (SBPO) — Triwulan IV 2025. Anecdotal Information section. Official source .