The Adoption and Regulation of Digital Signature in Indonesia

Digital signatures have started to get more popular amid the rapid increase of digital services, especially in the financial sector, such as in banking applications or fintech. Using this opportunity, startups engaged in providing digital signature platforms are starting to maximize their presence.

According to the Electronic Certification Center (BSrE), part of the National Cyber ​​and Crypto Agency (BSSN), a digital signature is an electronic signature used to prove the authenticity of the sender's identity of a message or document. In addition, a digital signature is an electronic signature that has been certified. The main purpose of the digital signature is to rapidly secure documents or documents from unauthorized/authorized parties, including protecting sensitive data and powering trust.

Meanwhile, according to Law no. 11 of 2008 concerning Electronic Information and Transactions, an electronic signature is a signature consisting of electronic information that is embedded, associated, or related to other electronic information that is used as a verification and authentication tool.

Current regulation

In Indonesia, digital signature startups are involved with three regulators, including the Ministry of Communication and Information, the Financial Services Authority (OJK), and Bank Indonesia (BI).

First, at Kominfo, Electronic Certification Providers (PSrE) is supervised by the Information Security Directorate. PSrE was formed and operated in accordance with government regulation No. 82 of 2012.

Based on these regulations PSrE is divided into two:

• Public PSrE; the operator of an electronic certificate/certification authority (CA) run by the Indonesian government under the Directorate of Information Security, Kominfo, which issues electronic certificates for Public PSrE,
• Private PSrE; electronic certificate operators that have been recognized by the Parent PSrE to run digital certificate services by individuals, organizations, or electronic certificate administering business entities.

Moreover, under the auspices of the Ministry of Communication and Information, startups playing in this area are included as Private PSrE. In terms of players, the government also divides it into three recognition stages, as follows:

• Registered; given after PSrE meets the requirements of the registration process set out in a Ministerial Regulation.
• Certified; given after the certificate authority has met the requirements for the certification process set out in a Ministerial Regulation.
• Parent; given after the PSrE has obtained a certified status and obtained a certificate as Parent PSrE; including the audit process.The following are the players who have registered as PSrE in Kominfo, data accessed as of 18 February 2021:

Second, at OJK, the players are currently hosting Digital Financial Innovation (IKD). Based on POJK No. 13/POJK.02/2018, the IKD organizer is currently in the process of researching and deepening its business model through the regulatory sandbox mechanism until finally proceeding to the registration and licensing process which will be regulated later.

The specific cluster to facilitate digital signature startups is e-KYC. In this regulation, e-KYC is defined as a platform that helps provide identification and verification services for prospective customers using data population from Dukcapil. The service is integrated with various applications that require transaction processing - several platforms are also starting to place biometric verification as their main foundation.

In this cluster, as data updated per August 2020 there are four registered players, as follows:

Third, at BI, the players are under the regulatory sandbox in the Information Technology category. Specifically, BI regulations focus on the use of electronic signatures for submitting banking services such as credit cards. From the current digital signature players, there are three names that have obtained a license from BI, including: PT Privy Identitas Digital (PrivyID), PT Solusi Net Internusa (Digisign), and PT Indonesia Digital Identity (VIDA).

The development of digital signature startup

In Indonesia, PrivyID is a pioneering startup providing digital signature services. The Co-Founder and CEO Marshall Pribadi said to DailySocial that his services have been used by around 700 companies of various business scales -- 6 of which are 4 national book banks, 3 telecommunications operators, 5 global insurance companies in Indonesia. In addition, PrivyID has also expanded the use of its services in other sectors such as education, energy, manufacturing, and recruitment agencies.

Furthermore, Marshall exemplifies several case studies on how the implementation of digital signatures can provide business efficiency. For instance, in Generali, the finalizing process of illustration form and a Life Insurance Request Letter, which previously took 3 to 5 days, can now be shortened to just 1 hour.

Another implementation is at Bank Mandiri, PrivyID supports the online account opening process and makes the process completely paper-free. At President University, digital signature services are used for the purposes of signing cooperation agreements, NDAs, etc .; including conducting API integration for the signing of diplomas and transcripts by the chancellor and dean.

PrivyID secured Series A2 funding at the end of 2019. The list of investors include Telkomsel Mitra Inovasi, Mahanusa Capital, Gunung Sewu Group, MDI Ventures, and Mandiri Capital Indonesia.

PrivyID's Co-Founder & CEO, Marshall Pribadi / PrivyID

In addition, there are some similar players which already run its services. The latest one is TekenAja, a joint venture under GDP Venture. It is based in the same company as the developer of the ASLI RI biometric verification platform (which has been registered in the IKD OJK cluster).

TekenAja's Co-Founder & COO, Rionald Soerjanto explained to DailySocial, one of the unique selling points that his company wanted to present was the biometric verification capability. He said this is relevant to avoid gaps in system security and operational standards that is possibly be tricked - for example by using fake identities or photos.

The TekenAja service is currently used by financial service institutions to keep transactions online and safe. Users can later use the mobile application to carry out the signature process. In terms of business, there are two implementation models, either through a special portal provided or through API integration into the application system. TekenAja consumers are corporations in the banking sector, multi-finance, fintech, and retail companies.

PrivyID and TekenAja have jointly established strategic cooperation with Dukcapil for the needs of data population verification.

Digital signature penetration in Indonesia

Marshall also said that before the pandemic, about 80% of its service users came from financial institutions. It is due to the OJK's policy which requires fintech lending services to apply a digital signature in their system. When the pandemic started, many companies in other sectors started to use PrivyID, including those in the telecommunications, logistics, energy, FMCG, and health industries.

"During the pandemic, PrivyID recorded an increase in corporate subscribers of up to 405% year-on-year. [..] It is ensured that the use of digital signatures in Indonesia will continue to increase in the future," he said.

Although it's getting mature, users of signature services in Indonesia are not very significant in quantity. Marshall said this is due to the lack of public knowledge about the legality of digital signatures. In addition, there are still many who do not know the benefits of digital signatures that companies can get. Therefore, he thought, user education is still being the company's priority.

TekenAja also agreed. The Covid-19 pandemic has accelerated various things to be contactless.  Soerjanto said digital signature services can be an effort to keep transactions fully online, thereby reducing the potential for the spread of viruses - for example, the direct visit for signatures on paper. In addition, to support WFH activities, offices can provide efficient HRD processes for signing permits, applying for leave, and others.

Regarding future challenges, Soerjanto also considers education of digital signatures to be the most important. "In my opinion, the challenge is only in terms of digital signatures. Actually, it is not new in Indonesia, the OJK has started suggesting from 2016. However, it still lacks comprehensive. Thanks to the pandemic, people know better as they are forced in order to make secure online transactions," he added.

He is optimistic about the development of the digital signature ecosystem in Indonesia as the regulators are quite supportive. "The Indonesian government, both Dukcapil, and Kominfo is quite supportive in terms of implementing biometrics for digital signatures," Soerjanto concluded.

– Original article is in Indonesian, translated by Kristin Siagian