The Data Sovereignty Dilemma, how Indonesia's OJK Regulations Are Reshaping Enterprise AI Architecture in Southeast Asian Banking
- Alex Raso
- Oct 29
- 15 min read
Updated: 4 days ago
AI Architecture, Alex Raso, Partner, Fractional CISO & Cybersecurity lead, (AI & ML) at H&F Advisers
The Agentic AI for Finance Conference held in Jakarta on October 16th revealed a striking consensus among Southeast Asia's banking leaders. The dominant theme wasn't about whether to adopt AI—that ship has sailed. Instead, every bank executive, every startup founder, and every systems integrator is wrestling with a single, foundational question: how do we build the future of AI-powered banking when our most powerful tools seem to be in direct conflict with the law of the land?
This is the great paradox of modern Indonesian finance. On one hand, you have a nation sprinting into the digital future. Indonesia boasts the world's highest workplace AI adoption rate, a staggering 92%. Its AI market, valued at $2.4 billion today, is projected to explode to $10.88 billion by 2030, a growth rate that leaves most of the world in the dust. Twenty percent of all fintech companies in the entire ASEAN region are based here. This is not a market experimenting with AI; it is a market going all-in.
On the other hand, you have the Otoritas Jasa Keuangan (OJK), Indonesia’s financial services authority. The OJK, through a series of regulations culminating in POJK No. 11/POJK.03/2022, has drawn a clear, unmissable line in the sand: all data centre and disaster recovery centre for banks must be located within Indonesia's borders. All Personally Identifiable Information (PII) of Indonesian citizens must be collected, processed, and stored inside the country. There is no ambiguity here. Data sovereignty is not a guideline; it is a mandate.
This creates a fundamental, architectural dilemma for every CTO and CEO in the sector. The most advanced Large Language Models (LLMs), the most scalable AI platforms, and the most innovative generative AI tools are overwhelmingly cloud-native, residing on servers in Singapore, the United States, or Europe. The desire to innovate is pulling every financial institution towards the public cloud, while the imperative to comply is chaining them to on-premise hardware. This isn't just a technical challenge; it's a strategic crisis. And how Indonesian banks are solving this dilemma is creating a blueprint for the future of regulated AI, not just in Southeast Asia, but across the globe.
The Commercial Imperative: Why Banks Can't Afford to Wait
Before we dissect the architectural solutions, it's critical to understand the commercial stakes. The pressure to adopt AI is not hypothetical; it is a matter of survival and growth. The numbers are stark. Indonesia's financial services sector is already seeing a tangible return on its AI investments, with combined fintech revenues expected to hit $8.6 billion this year, driven largely by AI-powered innovations.
We are seeing concrete, measurable gains that directly impact the bottom line. Machine learning models are improving loan underwriting accuracy by 10-15%, fundamentally changing risk profiles and opening up new customer segments. In insurance, AI is identifying fraudulent or incomplete claims with a precision that is delivering 10-15% in cost savings. These aren't marginal improvements; they are step-changes in operational efficiency.
Look at the leaders. Bank Rakyat Indonesia (BRI), one of the nation's largest banks, has already deployed multiple generative AI applications, including its '''"Sabrina" chatbot, which is already serving millions of customers. Digital wallet platform DANA is using AI to analyze financial behaviors, tailoring products for previously underserved communities and driving the nation's financial inclusion index to nearly 84%. This is AI as a tool for both profit and national progress.
The cost of inaction is just as compelling. Globally, banks are burning billions just to maintain legacy systems, with 70% of IT budgets going to "keeping the lights on" and only 19% to innovation (Accenture, Cloud Survey Fluid AI) . In a market growing at nearly 30% annually, standing still means being left behind. The competitive gap is widening at an accelerating rate. Digital-first banks are launching new products in months, while traditional banks are stuck in 18-month cycles. In this environment, the OJK's regulations are not a brake on progress, but a steering mechanism, forcing a different, more deliberate path to innovation.
The Regulatory Wall: Deconstructing the OJK Mandate
For any CTO operating in Indonesia, POJK No. 11/POJK.03/2022 is not just a document; it is the foundation of their infrastructure strategy. The regulation's core tenets are uncompromising:
Article 21 (1) of POJK 13/2020 states: "Banks are required to place Electronic Systems on Data Centre and Disaster Recovery Centre in the region of Indonesia."
This is the cornerstone of the OJK's stance. It explicitly mandates that the physical hardware on which electronic systems run must be located within the country. This immediately complicates the use of global public cloud providers, whose primary ASEAN data centre are typically located in Singapore. While cloud providers like Google, AWS, and Microsoft have been launching and expanding their Indonesian cloud regions, the challenge for banks is more than just picking a local endpoint.
Financial institutions have a higher burden of proof. They prefer to use data centers and cloud providers that are explicitly OJK-certified. As one infrastructure consultant who has implemented such systems noted, this is because "it becomes easier for them to answer during the audit and certification process". The risk of non-compliance is too high to rely on a provider's self-attestation. This has led to a preference for on-premise or private cloud solutions where the bank has direct control and audibility over the entire stack.
Furthermore, the regulations extend beyond just the primary data center. The requirement for an in-country Disaster Recovery Center (DRC) adds another layer of complexity and cost. Best practices for disaster recovery often involve geographic separation to protect against regional disasters. The OJK-compliant approach requires a second physical site within Indonesia, often at least 40 kilometers from the primary DC, doubling the hardware and infrastructure footprint.
This regulatory framework effectively creates a "digital moat" around Indonesia's banking sector. It forces a fundamental re-evaluation of the cloud-first strategy that has become dogma in much of the world. You cannot simply lift and shift your operations to a hyperscaler. You must build, or partner to build, a compliant foundation from the ground up. This has significant implications for cost, speed, and, most importantly, architecture.
The Architectural Response: Rise of the Hybrid, On-Premise AI Powerhouse
Faced with the immovable object of regulation and the unstoppable force of AI innovation, Indonesian banks are not choosing one over the other. They are choosing both. They are pioneering a hybrid architectural model that keeps sensitive data securely on-premise while still allowing them to tap into the power of advanced AI. This is not a compromise; it is a sophisticated, security-first approach to building enterprise-grade AI.
The architecture, as detailed by firms like Fluid AI who are implementing these systems, is a masterclass in controlled innovation. Here’s how it works:
The Foundation: On-Premise Everything.
At its core, the model involves deploying the entire AI stack within the bank's own data centre. This includes:
This approach completely resolves the data sovereignty issue. No sensitive data ever leaves the bank's firewall. This is the only way to guarantee compliance with the OJK's mandate.
The Process: A Secure, Controlled Workflow
When a customer query enters the system, a carefully orchestrated process unfolds entirely within the bank's secure environment:
This entire process, from query to response, happens in a closed loop. It provides the power of generative AI without the data residency risks of public cloud services.
Table 1: On-Premise vs. Cloud AI Deployment for Indonesian Banking
This architectural shift is profound. It moves the bank from being a consumer of a public AI service to the owner and operator of a private AI utility. The benefits go beyond mere compliance.
From Theory to Practice: On-Premise AI in Action
This is not a theoretical model. Banks and government institutions across Indonesia are already implementing it and seeing remarkable results.
A leading Caribbean bank, facing similar regulatory constraints, deployed an on-premise generative AI solution that now powers both internal and customer-facing applications. The platform is so robust that new use cases can be developed and deployed in as little as one week.
In a more direct parallel to the Indonesian market, a major bank implemented an on-premise AI system to handle customer support.
Time it takes
10
Days Go Live rapid deployment
Impact
45%
Migrated to Automation
(email, live chat, phone)
Future outlook
80%
amount of customer interactions by AI
Even government bodies are leading the way. The Audit Board of Indonesia (BPK), in collaboration with the AI firm Supertype, has integrated AI into its BIDICS platform. The system transforms a vast repository of audit documents into a queryable knowledge base, using an LLM to extract data and generate preliminary analytical insights. This allows auditors to plan and assess risk far more effectively. Crucially, the system maintains a strict human-in-the-loop approach and ensures data access is limited only to authorised auditors, demonstrating that innovation and regulation can coexist.
The Security Imperative: Why On-Premise is a Fortress
The OJK's regulations are not born from a desire to stifle innovation. They are a pragmatic response to a real and growing threat. Southeast Asia has become a global epicenter for sophisticated cybercrime, particularly financial scams. On October 14, the U.S. Department of Justice announced the seizure of approximately $15 billion in Bitcoin, the largest forfeiture in the Department's history, linked to a massive "pig-butchering" scheme operated by a transnational criminal organisation based in Cambodia. These criminal networks use forced labor to carry out cryptocurrency investment scams on a global scale, laundering billions through complex digital channels.
This is the environment in which Indonesian banks operate. The risk of a data breach is 35% higher for financial institutions than for other industries. A breach that exposes sensitive customer data to such criminal networks would be catastrophic, not just for the bank, but for its customers and the nation's financial stability. Seen in this light, the OJK's data sovereignty mandate is not a technical hurdle, but a critical national security measure. An on-premise AI architecture is not just a compliance strategy; it is a fortress. By keeping data within their own firewalls, banks can apply their existing, battle-hardened security protocols to their AI systems, dramatically reducing the attack surface and ensuring that customer data is not exposed on external cloud servers.
The Regulatory Evolution: From Sandbox to Sovereign AI
Indonesia's regulatory approach to AI and digital finance is not static. It is evolving in real-time, reflecting a sophisticated understanding that innovation and oversight must move in lockstep. The OJK and Bank Indonesia (BI) are not simply erecting barriers; they are building guardrails that allow for controlled, secure experimentation.
The Indonesia Payment System Blueprint 2025-2030, driven by Bank Indonesia, is a critical piece of this puzzle. The blueprint establishes frameworks for secure, AI-integrated financial systems, positioning Indonesia at the forefront of financial technology innovation in Southeast Asia. The 2030 Blueprint, which builds on the successes of the 2025 iteration, covers five key initiatives: infrastructure, industry, innovation, international cooperation, and the digital rupiah. This is a comprehensive, forward-looking strategy that recognises AI as a core component of the future financial infrastructure.
One of the most pragmatic tools in the regulator's arsenal is the regulatory sandbox. Both the OJK and Bank Indonesia have established sandbox mechanisms that allow fintech companies and banks to test innovative products and services in a controlled environment, under regulatory supervision but with some relaxation of the normal compliance burden. This is crucial for AI development. It allows institutions to experiment with new AI models, test their effectiveness, and validate their security and compliance posture before committing to a full-scale deployment. The sandbox is a bridge between innovation and regulation, allowing both to co-evolve.
Furthermore, Bank Indonesia has issued Regulation No. 4 of 2025 on Payment System Policy, which reinforces the stability, security, and efficiency of the payment system. This regulation, along with others, signals a clear intent to enable cross-border digital payments and to accommodate the growing complexity of digital finance. The regulatory environment is not frozen in time; it is actively adapting to the realities of a digital, AI-driven economy.
However, the path forward is not without its challenges. As AI capabilities advance, particularly with the rise of agentic AI systems that can autonomously make decisions and take actions, the regulatory framework will need to become even more sophisticated. The current regulations focus primarily on data residency and security. Future regulations will likely need to address issues of algorithmic transparency, bias, accountability, and the ethical use of AI in financial decision-making. As one expert noted, AI-specific banking regulations are expected to emerge in major financial hubs within the next 24 months. Indonesia, given its proactive stance, is likely to be among the first to develop such frameworks.
The concept of a "sovereign AI fund" is also gaining traction. In August 2025, Indonesian authorities proposed a sovereign AI fund to finance the development of AI capabilities within the country. This would be a strategic investment, ensuring that Indonesia is not merely a consumer of foreign AI technology, but a developer and owner of its own AI infrastructure and models. Such a fund could accelerate the development of on-premise AI solutions that are tailored to the specific needs and regulatory requirements of the Indonesian market.
The regulatory evolution is thus a two-way street. Regulators are learning from the innovations of the private sector, and the private sector is adapting its strategies to the evolving regulatory landscape. This dynamic interplay is creating a unique model of regulated innovation that could serve as a template for other emerging markets facing similar challenges.
The Cost-Benefit Equation: Is On-Premise Worth It?
For any CEO evaluating the shift to on-premise AI, the fundamental question is: does the benefit justify the cost? The answer, based on the evidence from early adopters, is a resounding yes, but it requires a long-term perspective and a strategic understanding of the true costs of both on-premise and cloud solutions.
The upfront capital expenditure (CapEx) for on-premise AI is undeniably higher than the initial cost of a cloud subscription. You need to procure high-performance GPUs, build or expand your data center infrastructure, and invest in the specialized talent to deploy and manage the system. However, this initial investment must be weighed against the long-term operational expenditure (OpEx) of cloud-based AI.
Public cloud AI services typically operate on a per-token or per-request pricing model. This can seem attractive at first, as it allows for a low barrier to entry. However, as usage scales, these costs can become unpredictable and, in many cases, prohibitively expensive. A bank that is processing millions of customer queries per month can quickly find itself with a cloud bill that dwarfs the cost of owning its own infrastructure. The predictability of on-premise costs is a major draw for financial institutions that need to manage their budgets with precision.
Furthermore, the on-premise model offers infinite scalability without per-request fees. Once the infrastructure is in place, the bank can expand its AI applications without incurring additional marginal costs for each new use case. This creates a powerful incentive to innovate and to find new ways to leverage AI across the organisation. In contrast, a cloud-based model can create a disincentive to scale, as each new application adds to the variable cost burden.
There is also a hidden cost to cloud-based AI that is often overlooked: vendor lock-in. A survey by McKinsey found that 68% of financial services firms worry about vendor lock-in when using cloud providers. Once a bank has built its AI applications on a specific cloud platform, migrating to a different provider can be extremely complex and costly. The bank becomes dependent on the provider's pricing, service levels, and strategic direction. An on-premise solution, by contrast, gives the bank complete control and the freedom to choose its own technology stack.
The security benefits of on-premise also have a tangible economic value. The cost of a data breach for a financial institution can be catastrophic, not just in terms of direct financial losses, but also in terms of reputational damage, regulatory fines, and loss of customer trust. By keeping data on-premise, banks significantly reduce their attack surface and their exposure to the risks associated with external cloud servers. This risk mitigation has a real, if difficult to quantify, economic value.
Finally, there is the strategic value of owning your AI intellectual property. A bank that develops its own AI models and fine-tunes them on its proprietary data is creating a unique, defensible competitive advantage. This is not something that can be easily replicated by a competitor using the same off-the-shelf cloud AI service. The on-premise model allows for deep customisation and integration with legacy systems, creating a level of sophistication and differentiation that is simply not possible with a generic cloud solution.
Table 2: Total Cost of Ownership (TCO) Comparison: On-Premise vs. Cloud AI (5-Year Projection)
Note: These are illustrative ranges and will vary significantly based on the scale of deployment, usage volume, and specific vendor pricing. Contact team@hfadvisers.com if you'd like a proposal
The table illustrates that while the initial investment for on-premise is higher, the long-term total cost of ownership can be significantly lower, particularly for high-volume use cases. More importantly, the on-premise model offers predictability, control, and strategic value that are difficult to achieve with a public cloud solution.
Key takeaway? The Road Ahead: A New Breed of Banker
The shift to on-premise, hybrid AI is more than an infrastructure project; it is a catalyst for organisational transformation. The future of banking in Indonesia will not be defined by off-the-shelf AI solutions, but by unique, proprietary AI ecosystems that are deeply integrated with each bank's specific data, processes, and "bank language."
This creates both a challenge and an opportunity. The immediate challenge is a skills gap. The talent required to build and manage these sophisticated on-premise AI systems is scarce. Banks must invest heavily in up skilling their workforce, creating a new generation of professionals who are a hybrid of data scientist and financial expert. This is a long-term investment in human capital that will pay dividends for decades to come.
The opportunity is immense. By building their own AI capabilities, Indonesian banks are not just ensuring compliance; they are building a sustainable competitive advantage. They will own their intellectual property. They will control their cost structure, free from the variable and often unpredictable per-token pricing of public cloud models. And they will be able to deliver a level of 24/7, hyper-personalised service that will make today's digital banking look antiquated.
For the CEO, the message is clear: the decision to build an on-premise AI capability is a strategic imperative. It is an investment in security, compliance, and long-term competitive differentiation.
For the engineer, the challenge is exciting: to build a secure, scalable, and powerful AI infrastructure that solves real-world problems within a unique and demanding regulatory framework.
And for the business leader, the path is defined: leverage this new class of on-premise AI to fix critical challenges, drive operational efficiency, and create the next generation of financial products and services for one of the world's most dynamic markets.
Indonesia is showing the world that you don't have to choose between innovation and regulation. With the right architecture, the right strategy, and the right talent, you can have both. The data sovereignty dilemma is not a roadblock; it is a catalyst for building a more secure, more resilient, and ultimately more intelligent financial future.
Author | H&F Advisers, Alex Raso
Alex Raso is a cybersecurity strategist and trusted advisor to governments, financial institutions, and critical infrastructure operators across the Asia-Pacific region.
References
References
[1] Introl. (2025, August 3). Indonesia AI Revolution: $10.88B Market Attracts Global Tech Giants. Retrieved from https://introl.com/blog/indonesia-ai-revolution-infrastructure-investment-2025
[2] Otoritas Jasa Keuangan (OJK). (2022). OJK Regulation No. 11/POJK.03/2022 concerning Implementation of Information Technology by Commercial Banks. Retrieved from https://ojk.go.id/en/regulasi/Documents/Pages/Implementation-of-Information-Technology-by-Commercial-Banks/OJK%20Regulation%2011%202022%20concerning%20Implementation%20of%20Information%20Technology%20by%20Commercial%20Banks.pdf
[3] Google Cloud. (n.d.). OJK Indonesia POJK 13/2020. Retrieved from https://cloud.google.com/security/compliance/pojk_132020_workspace_mapping
[4] 10factorinfra. (2024, August 31). Data Localisation & Residency For OJK Compliance. Retrieved from https://www.10factorinfra.com/post/data-localisation-residency-for-ojk-compliance
[5] World Economic Forum. (2025, February 17). The rise of AI in Indonesia is expanding financial inclusion. Retrieved from https://www.weforum.org/stories/2025/02/rise-of-ai-in-indonesia/
[6] Accenture. (n.d.). Accenture Financial Services Cloud Survey. Data referenced in Fluid AI article.
[7] Fluid AI. (2024, October 25). On-premise GPT Deployment for Banking. Retrieved from https://www.fluid.ai/blog/on-premise-gpt-deployment-for-banking
[8] Rahmadhan, I. (2025, October 22). Agentic AI in Finance: Opportunities and Challenges for Indonesia. Towards Data Science. Retrieved from https://towardsdatascience.com/agentic-ai-in-finance-opportunities-and-challenges-for-indonesia/
[9] Orrick, Herrington & Sutcliffe LLP. (2025, October 27). DOJ and Treasury act against Southeast Asian scam networks, seize $15B in bitcoin linked to pig-butchering scheme. JD Supra. Retrieved from https://www.jdsupra.com/legalnews/doj-and-treasury-act-against-southeast-5667477/
[10] USA ASEAN. (2024, October 14). Indonesia: The 2030 National Payment System Blueprint. Retrieved from https://www.usasean.org/article/indonesia-2030-national-payment-system-blueprint
[11] Otoritas Jasa Keuangan (OJK). (n.d.). Regulatory Sandbox. Retrieved from https://ojk.go.id/en/fungsi-utama/itsk/regulatory-sandbox/default.aspx
[12] Tech for Good Institute. (n.d.). Navigating Innovation: Indonesia's Regulatory Sandbox Journey. Retrieved from https://techforgoodinstitute.org/blog/country-spotlights/navigating-innovation-indonesias-regulatory-sandbox-journey/
[13] ABNR Law. (2025, June 23). Bank Indonesia Strengthens Payment System Governance Under Regulation No. 4 of 2025. Retrieved from https://www.abnrlaw.com/en/news/bank-indonesia-strengthens-payment-system-governance-under-regulation-no-4-of-2025
[14] Business Indonesia. (2025, August 13). Indonesia Plans Sovereign AI Fund to Boost Technology Development. Retrieved from https://business-indonesia.org/news/indonesia-plans-sovereign-ai-fund-to-boost-technology-development
