BI Strengthens Security Protection for ATM and Debit-Card Technologies

Bank Indonesia (BI) recently issued Circular No. 17/52/DKSP dated 30 December 2015 on the Implementation of National Standards for Chip Technologies and the Utilization of Six-Digit Online Personal-Identification Numbers for ATM and/or Debit Cards Issued in Indonesia (“2015 Circular Letter”).The 2015 Circular aims to strengthen the security of Card-Based Payment Instruments (Alat Pembayaran dengan Menggunakan Kartu–“APMK”) by mandating that the owners of Automated Teller Machines (ATM) and/or the issuers of debit cards incorporate chips, magnetic strips and six-digit personal identification numbers (PIN) into their ATM and debit cards.Prior to the Circular, these same matters were regulated under BI Circular Letter No. 13/22/DASP dated 18 October 2011 on the Implementation of Chip Technologies and the Utilization of Personal Identification Numbers for ATM and/or Debit Cards Issued in Indonesia, as amended by BI Circular Letter No. 14/23/DASP dated 31 August 2012 (together referred to as the“2011 Circular Letter”).The 2015 Circular is of relevance to BI, as well as parties offering or organizing card-based payment facilities.New ATM and Debit-Cards TechnologiesPrincipals, [1] issuers, [2] acquirers, [3] clearance organizers, [4] and/or final settlement organizers [5] of ATM and/or debit cards (together referred to as“providers”) are required to equip their ATM and/or debit cards with chip technology and six-digit online PINs. Note that the Circular stipulates an exemption regarding the obligation to employ magnetic-strip security technology, and this exemption still applies if the following criteria are satisfied (“Exemption Criteria”):