Regulation and Utilization of Digital Signatures in Indonesia

Digital signature (digital signatures) began to be discussed a lot in the midst of the rapid increase in the use of digital services, especially in the financial sector such as in banking applications or online banking fintech. With this opportunity, startups that are engaged in providing digital signature platforms are starting to maximize their presence.

According to the definition of the Electronic Certification Center (BSrE), part of the National Cyber ​​and Crypto Agency (BSSN), a digital signature is an electronic signature used to prove the authenticity of the identity of the sender of a message or document. In addition, digital signatures are certified electronic signatures. The main purpose of digital signatures is to secure files or documents from unauthorized parties, including protecting sensitive data and strengthening trust.

Meanwhile, according to Law no. 11 of 2008 concerning Electronic Information and Transactions, electronic signature is a signature consisting of electronic information that is attached, associated or related to other electronic information used as a means of verification and authentication.

Regulations that cover

In Indonesia, digital signature startups can take shelter under three regulators, including the Ministry of Communication and Information, the Financial Services Authority (OJK), and Bank Indonesia (BI).

First at Kominfo, Electronic Certification Organizer (PSrE) is supervised by Information Security Directorate. PSrE was formed and implemented in accordance with government regulation no. 82 of 2012.

Based on these regulations PSrE is divided into two:

• Parent PSrE; electronic certificate organizer/certification authority (CA) which is run by the Indonesian government under the Directorate of Information Security, Kominfo which issues electronic certificates for Parent PSrE,
• Parent PSrE; electronic certificate providers that have been recognized by the Parent PSrE to carry out digital certificate services carried out either by individuals, organizations or business entities providing electronic certificates.

So it can be concluded, under the auspices of Kominfo, startups that play in this area are included as parent PSrE. For the players themselves, the government also divides them into three recognition statuses, as follows:

• Registered; is given after the PSrE meets the registration process requirements stipulated in the Ministerial Regulation.
• Certified; granted after the certificate authority fulfills the certification process requirements regulated in the Ministerial Regulation.
• Parented; awarded after PSrE obtains certified status and obtains a certificate as Parent PSrE; including the audit process.

The following are the players who have registered as PSrE with Kominfo, data accessed as of 18 February 2021:

Second at OJK, The players are currently still under the umbrella of Digital Financial Innovation (IKD) organizers. Based on POJK No. 13/POJK.02/2018, the IKD organizer is currently in the process of researching and deepening its business model through a mechanism regulatory sandbox until finally proceed to the registration and licensing process which will be arranged later.

The specific cluster that facilitates digital signature startups is e-KYC. In this regulation, e-KYC is defined as a platform that helps provide identification and verification services for prospective customers using population data sourced from Dukcapil. This service is integrated with various applications that require transaction processing – several platforms are also starting to place biometric verification as their main basis.

In this cluster, from data updated as of August 2020, four players have been recorded, as follows:

Third in BI, the players take shelter in regulatory sandbox in the Information Technology category. Specifically, BI regulations focus on the use of electronic signatures for applying for banking services such as credit cards. Of the digital signature players operating, there are three names that have received licensed status from BI, including: PT Privy Identity Digital (PrivyID), PT Solusi Net Internusa (Digisign), and PT Indonesia Digital Identity (VIDA).

Digital signature startup development

In Indonesia, PrivyID is a pioneering startup providing digital signature services. To DailySocial, Co-Founder and CEO Private Marshall said that currently its services have been used by around 700 companies with various business scales -- 6 of them 4 national book banks, 3 telecommunications operators, 5 global insurance companies in Indonesia. Apart from that, PrivyID has also expanded the use of their services in other sectors such as education, energy, manufacturing, and recruitment agencies.

Marshall further gave examples of several case studies on how the implementation of digital signatures can provide business efficiency. For example, at Generali, the process of finalizing form illustrations and Life Insurance Request Letters, which previously took 3 to 5 days, can now be shortened to just 1 hour.

Another application at Bank Mandiri, PrivyID supports the account opening process automatically online and makes the process completely paperless. At President University, digital signature services are used for the purposes of signing cooperation agreements, NDAs, etc.; including implementing API integration for signing diplomas and transcripts by the chancellor and dean.

PrivyID records funding A2 series at the end of 2019. The ranks of investors who have supported them include Telkomsel Innovation Partners, Mahanusa Capital, Gunung Sewu Group, MDI Ventures, and Mandiri Capital Indonesia.

Apart from that, there are several similar players who already operate their services. The newest is available SignAja, a j under the umbrella of GDP Venture. They are also based in the same company as the developer of the ASLI RI biometric verification platform (which has been registered in the OJK IKD cluster).

To DailySocial, TekenAja Co-Founder & COO Rionald Soerjanto explained, one of them unique selling point what the company wants to offer is biometric verification capability. According to him, this is relevant to avoid gaps in system security and operational standards which can sometimes still be circumvented – for example by using fake identities or photos.

TekenAja services are currently used by financial services institutions to ensure transactions run smoothly online and safe. Users can later use the application mobile devices to carry out the signature process. On the business side, there are two implementation models, either through a special portal provided or through API integration into the application system. TekenAja consumers are corporations in the banking sector, finance, fintech, and retail companies.

PrivyID and TekenAja have both established strategic collaboration with Dukcapil for population data verification needs.

Penetration of digital signatures in Indonesia

Marshall also said that before the pandemic around 80% of its service users came from financial institutions. This is because OJK policy requires service   apply digital signatures in the system. When the pandemic began, many companies in other sectors began to utilize PrivyID, including those in the telecommunications, logistics, energy, FMCG and health industries.

"During the pandemic, PrivyID recorded an increase in corporate customers of up to 405% year-on-year. [..] It is believed that the use of digital signatures in Indonesia will continue to increase in the future," he said.

Even though it continues to grow, users of signature services in Indonesia are not yet significant in quantity. According to Marshall, this is due to the public's lack of knowledge regarding the legality of digital signatures. Apart from that, there are still many who don't know the benefits that companies can get from digital signatures. For this reason, according to him, user education efforts are still prioritized on the company's agenda.

TekenAja also has the same belief. The Covid-19 pandemic has pushed things to a head contactless. According to Rionald, digital signature services can be an effort to ensure that transactions can still be carried out fully online thus reducing the potential for spreading the virus -- for example the process of visiting to sign directly on paper. Apart from that, to support WFH activities, offices can provide efficient HRD processes for signing permits, applying for leave, etc.

Regarding future challenges, Rionald also considers education on the meaning of digital signatures to be the most important. "According to me, challengesIt's just an understanding of the problem digitalsignature. Actually, it's not new in Indonesia, the OJK has started ordering it to be used in 2016. But the understanding wasn't that deep then. Thanks to the pandemic, people know more because they are forced to make transactions online safer," he added.

He is optimistic about the development of the digital signature ecosystem in Indonesia, because so far the regulator has been quite supportive. "The Indonesian government, both Dukcapil and Kominfo, is quite supportive in terms of implementing biometrics for digital signatures," concluded Rionald.