BPK Finds BI-FAST Fraud Detection Weaknesses and Flags Rp4.83 Trillion Pension Contribution

Audit Flags Undetected Fraud and Wider Control Problems

Indonesia's Supreme Audit Agency, Badan Pemeriksa Keuangan (BPK), has found that Bank Indonesia's fraud detection system for BI-FAST was ineffective at detecting and preventing abnormal transactions. The finding forms part of a wider examination that also flagged a Rp4.83 trillion additional pension contribution, weaknesses in exchange rate data and problems with the allocation of central bank reserves.

The examination of Bank Indonesia's 2025 annual financial statements produced 16 findings containing 20 problems, according to findings described in BPK's Summary of Audit Results for the First Semester of 2026, known as IHPS I 2026. Seventeen problems concerned weaknesses in internal controls, while three involved noncompliance.

That means internal control weaknesses accounted for 85% of the problems identified, compared with 15% involving noncompliance. The distinction matters: internal controls are the procedures and systems intended to prevent errors, detect suspicious activity and keep financial operations within established rules. A weakness in those controls does not automatically establish a financial loss or a legal violation.

BPK said the problems did not materially affect the fair presentation of Bank Indonesia's 2025 financial statements. That conclusion concerns the accounts, however, and does not erase the separate findings about payment security, data quality and financial management.

The findings were quoted publicly on October 13, 2026. The account does not establish that date as the publication date of BPK's summary. It also gives no amount for losses associated with the BI-FAST fraud incidents, no number of affected customers and no deadline for completing corrective measures.

What Failed in BI-FAST Fraud Detection?

BPK's central finding concerns both the design and implementation of BI-FAST's Fraud Detection System (FDS). Such a system examines account activity or transactions for patterns that may signal fraud. An anomaly is activity that departs from expected patterns, although an unusual transaction is not necessarily fraudulent.

BPK, the public body responsible for the audit, described the weakness in these terms:

Desain dan implementasi Fraud Detection System (FDS) Bank Indonesia-Fast Payment (BI-FAST) tidak efektif dalam mendeteksi dan mencegah anomali transaksi.

In English, the finding says that the design and implementation of the BI-FAST fraud detection system were ineffective at detecting and preventing transaction anomalies. BPK also stated that fraud incidents involving anomalies went undetected and that similar incidents could recur.

This is more specific than a general warning about possible payment fraud. The audit identifies a failure to detect incidents and connects that failure to the risk of repetition. It does not, however, explain the transactions involved, the detection rules used, the timing of the incidents or whether the weakness arose from software settings, information gaps or operational procedures.

BPK asked the governor of Bank Indonesia to conduct a comprehensive evaluation of BI-FAST's reliability and security. That recommendation extends beyond checking an individual alert: it calls for an examination of the service's ability to operate reliably and protect transactions. No completed evaluation or Bank Indonesia response is described in the reported findings.

The Payment Rules Already Address Fraud

Bank Indonesia's 2020 Payment System Regulation, formally Regulation No. 22/23/PBI/2020, provides a concrete framework for understanding the audit concerns. Article 2 sets the objective of a payment system that is fast, easy, affordable, secure and reliable, while taking account of wider access and consumer protection.

Under Article 31, licensed payment service providers must meet obligations covering governance, risk management, information system security, interconnection and interoperability, and compliance with legislation. Article 34 includes fraud management and periodic information system audits among the security requirements.

The explanation accompanying Article 34 sets out four stages of fraud management: prevention, detection, response and monitoring. It also states that an FDS can operate at both account and transaction level. This distinction is useful because suspicious behavior may emerge across an account's activity even when an individual payment appears ordinary.

The regulation also addresses payment infrastructure operators. Articles 38 and 41 establish obligations covering governance, risk management and information security, including fraud management and periodic audits. These provisions show that fraud controls sit within a broader set of operational responsibilities.

The categories should not be treated as interchangeable. Article 88 distinguishes supervision of payment service providers and infrastructure operators from monitoring of payment infrastructure operated by Bank Indonesia itself. The regulation therefore expressly includes central bank payment infrastructure within its monitoring framework, without requiring the reader to assume that every rule for a licensed provider applies to Bank Indonesia in exactly the same way.

The regulation's cybersecurity explanation includes identification, protection and detection within prevention measures. Its explanation of Article 90 also identifies information system and cyber risks as operational risks. Together, these provisions make detection a defined part of payment security, rather than an optional addition to transaction processing.

Exchange Rate Data Also Came Under Scrutiny

BPK's findings extended to the Jakarta Interbank Spot Dollar Rate (JISDOR), Bank Indonesia's reference exchange rate for the US dollar against the rupiah. The concern was whether the information used to calculate that rate was correct and complete.

The audit identified weaknesses in data obtained through the JISDOR module of the Sistem Monitoring Transaksi Valuta Asing terhadap Rupiah (Sismontavar), the system used to monitor foreign exchange transactions against the rupiah. BPK found that the reference rate was not fully derived from correct and complete data.

A spot foreign exchange transaction is an exchange of currencies for settlement over a short period, rather than a contract for delivery much later. A reference rate based on those transactions depends on both the quality of the records and which eligible transactions enter the calculation.

BPK warned that the published JISDOR rate might not reflect all actual spot transactions that should form its calculation base. It requested adjustments to the timing of transactions, transaction confirmations and publication of the rate.

That timing recommendation is a distinct part of the finding. A transaction may occur before its confirmation becomes available, so the relationship between the transaction window, confirmation process and publication time can affect the records included. BPK's recommendation points to that relationship, but does not specify a revised timetable.

The findings do not quantify any difference between published JISDOR values and a recalculated rate. They also do not identify particular dates on which the rate was incorrect. The supported conclusion is that data quality and completeness required attention, not that every published rate was wrong.

Rp4.83 Trillion Pension Payment Raises Funding Concerns

The largest explicit monetary figure in the findings is the Rp4.83 trillion additional contribution to Dana Pensiun Bank Indonesia (Dapenbi), the central bank's pension fund. BPK questioned the adequacy of Bank Indonesia's arrangements for that payment and for setting investment loss limits in its role as the fund's founder.

An additional pension contribution is money supplied beyond regular funding. In this case, BPK connected its concerns to the possibility that Bank Indonesia could again need to make additional payments to cover a funding deficit. A funding deficit means that a pension fund lacks sufficient resources under the relevant assessment to meet its obligations.

BPK also identified potential losses when Dapenbi disposes of investments using its investment loss limit mechanism. A loss limit sets a boundary for investment losses or related decisions. Its effectiveness depends on how it is established and applied, but the reported findings do not disclose Dapenbi's thresholds or individual investment positions.

The Rp4.83 trillion figure should not be described as a proven fraud loss. It is the amount of an additional pension contribution highlighted by the audit. Similarly, the warning about losses from investment disposals concerns a risk identified by BPK, not a quantified total of realized losses.

BPK recommended an examination of Dapenbi's investment management, governance and investment performance, along with an evaluation of the established loss limits. Those recommendations address both the reasons additional funding might recur and the decisions that could expose the fund to investment losses.

Reserve Allocation Requires a Separate Correction

Another finding concerned the transfer of realized amounts from Cadangan Tujuan, or purpose reserves, into Cadangan Umum, or general reserves. BPK found that the addition did not conform to the rules governing the distribution of surplus from Bank Indonesia's activities.

In plain terms, this issue concerns how surplus is allocated between reserve categories. It is separate from the BI-FAST detection failure and the pension fund contribution, even though all three were identified in the same financial statement examination.

BPK said the resulting accumulation of general reserves was not consistent with the applicable surplus distribution arrangements. It asked the governor of Bank Indonesia to establish arrangements for general reserve allocation that comply with those rules.

The reported finding does not provide the amount of the reserve allocation at issue or a calculation of its effect. There is therefore no basis for combining it with the Rp4.83 trillion pension contribution to produce a total financial exposure.

Why Fair Financial Statements Do Not Settle the Findings

BPK stated that the control weaknesses and noncompliance did not materially affect the fair presentation of Bank Indonesia's 2025 annual financial statements. Materiality concerns whether an error or omission is important enough to affect a reader's understanding or decisions about the accounts.

That conclusion and the operational findings answer different questions. Financial statements can fairly present an institution's financial position while an audit still identifies weaknesses in its fraud controls, data processes or compliance arrangements.

The figures also require careful reading. Sixteen findings containing 20 problems means that a finding can contain more than one problem. It does not mean that BPK identified 20 separate fraud incidents, and the 17 internal control problems should not all be attributed to BI-FAST.

The four areas described publicly require different corrective work: payment security evaluation for BI-FAST, data and timing adjustments for JISDOR, investment and governance examination for Dapenbi, and compliant allocation arrangements for general reserves. Treating them as a single technology problem would miss much of the audit's scope.

Timeline and Unanswered Questions

The dates distinguish the regulatory framework, the financial period examined and the later reporting of the findings:

• 2020: Bank Indonesia issued Regulation No. 22/23/PBI/2020 on the payment system.
• 2025: The annual financial statements examined by BPK covered this financial year.
• First semester of 2026: The findings appeared in BPK's IHPS I 2026 summary.
• October 13, 2026: The audit findings were quoted publicly.

No subsequent hearing, implementation deadline or scheduled progress report is identified. The status of the requested BI-FAST evaluation, JISDOR timing adjustments, pension investment examination and reserve allocation changes is also not established.

For payment users, the unresolved details include the scale of the undetected fraud, any associated losses and what corrective controls have been introduced. For the pension fund, the missing information includes its funding position, the investment loss thresholds and whether further contributions are expected.

The payment regulation identifies consumer complaints, fraud, cyber incidents and disruptions as relevant information under Article 105. It also identifies information about governance, operations and fraud in monitoring participants in Bank Indonesia's payment infrastructure. Those categories provide a concrete basis for assessing corrective action, although the reported findings contain no results from such a follow-up assessment.

Key Points

• BPK identified 16 findings containing 20 problems in its examination of Bank Indonesia's 2025 financial statements.
• Seventeen problems involved internal control weaknesses and three involved noncompliance.
• The audit found BI-FAST's fraud detection system ineffective at detecting and preventing transaction anomalies.
• BPK requested a comprehensive evaluation of BI-FAST's reliability and security.
• JISDOR data quality and the timing of transactions, confirmations and rate publication also required attention.
• A Rp4.83 trillion additional pension contribution and investment loss limits prompted recommendations for further examination.
• BPK found that additions to general reserves did not conform to surplus distribution rules.
• The findings did not materially affect the fair presentation of the 2025 financial statements, and no corrective action deadline was identified.