BI Strengthens Security Protection for ATM and Debit-Card Technologies

Bank Indonesia (BI) recently issued Circular No. 17/52/DKSP dated 30 December 2015 on the Implementation of National Standards for Chip Technologies and the Utilization of Six-Digit Online Personal-Identification Numbers for ATM and/or Debit Cards Issued in Indonesia (“2015 Circular Letter”).
 
The 2015 Circular aims to strengthen the security of Card-Based Payment Instruments (Alat Pembayaran dengan Menggunakan Kartu – “APMK”) by mandating that the owners of Automated Teller Machines (ATM) and/or the issuers of debit cards incorporate chips, magnetic strips and six-digit personal identification numbers (PIN) into their ATM and debit cards.
 
Prior to the Circular, these same matters were regulated under BI Circular Letter No. 13/22/DASP dated 18 October 2011 on the Implementation of Chip Technologies and the Utilization of Personal Identification Numbers for ATM and/or Debit Cards Issued in Indonesia, as amended by BI Circular Letter No. 14/23/DASP dated 31 August 2012 (together referred to as the“2011 Circular Letter”).
 
The 2015 Circular is of relevance to BI, as well as parties offering or organizing card-based payment facilities.
 
New ATM and Debit-Cards Technologies
Principals,[1] issuers,[2] acquirers,[3] clearance organizers,[4] and/or final settlement organizers[5] of ATM and/or debit cards (together referred to as “providers”) are required to equip their ATM and/or debit cards with chip technology and six-digit online PINs. Note that the Circular stipulates an exemption regarding the obligation to employ magnetic-strip security technology, and this exemption still applies if the following criteria are satisfied (“Exemption Criteria”):