Fintech Lawyers near Kertajaya

How financial technology rules affect businesses and users in Kertajaya

Kertajaya is a kelurahan in Gubeng, Surabaya. A business operating there may need to address national financial-sector rules alongside ordinary business registration and any applicable Surabaya premises or local business requirements.

The rules depend on what the service actually does. Payment services may fall under Bank Indonesia supervision, while online lending and other financial services may fall under the Financial Services Authority (OJK). A lawyer can identify the right regulatory route, review contracts and data practices, and help distinguish a regulated service from a technology provider serving a regulated business.

There is no separate Kertajaya financial technology licence. Businesses generally handle national regulatory approvals with the relevant authority and use Indonesia’s Online Single Submission (OSS) system for business registration and licensing steps that apply to them.

When a financial technology lawyer may be useful

• You are setting up an online lending business in Kertajaya and need to determine whether the model requires OJK registration or a licence, and what company and operating requirements apply.

• Your Surabaya business plans to process payments, provide a digital wallet, or offer payment services to local shops, and needs to assess Bank Indonesia approval and payment-network arrangements.

• A Kertajaya merchant, platform, or service provider is negotiating a QRIS, payment gateway, or technology contract and needs clear terms on settlement, refunds, fraud, and liability.

• Your business collects customer identity or financial information and needs to review consent, data sharing, security measures, retention, or a suspected data incident.

• A customer or business has a dispute involving an unauthorised transfer, an online loan, a blocked account, or a payment that has not been settled.

• You are opening or changing a business location in Surabaya and need to coordinate the entity’s OSS registration with relevant city-level business or premises requirements.

Key Indonesian laws and regulations

National rules apply in Kertajaya; there is no separate Kertajaya financial technology code. The applicable requirements depend on the service, the parties involved, and whether the business is supervised by OJK or Bank Indonesia.

• Law No. 27 of 2022 on Personal Data Protection. It was enacted on 17 October 2022 and provided a two-year transition period. It is relevant to customer data collection, use, sharing, security, and data-subject rights.

• Bank Indonesia Regulation No. 23/6/PBI/2021 on Payment Service Providers. Effective from 1 July 2021, it sets requirements for payment-service providers, including licensing and operational matters within Bank Indonesia’s remit.

• OJK Regulation No. 40 of 2024 on Information Technology-Based Joint Funding Services (LPBBTI). Promulgated on 27 December 2024, it governs OJK-supervised online lending and funding services. A lawyer should check the current rules and any transition provisions against the proposed business model.

Frequently asked questions

Does every financial technology business need an OJK licence?

No. The regulator depends on the activity, and payment services may instead require Bank Indonesia approval. A technology vendor that does not itself provide a regulated financial service may have different obligations from the financial institution it serves.

Is there a special financial technology permit for Kertajaya?

No separate Kertajaya permit governs financial services. National approvals may apply, while business registration and location-related requirements may involve OSS and Surabaya authorities.

Can an individual start an online lending platform?

OJK-regulated lending providers must meet the applicable entity and licensing requirements. The permitted legal form and other conditions should be checked under the rules in force before accepting customers or funds.

Which regulator should I contact first?

Start by defining the service: lending, payment processing, digital money, or technology support can lead to different regulatory treatment. A lawyer can map the activity to OJK, Bank Indonesia, or another relevant authority before an application is prepared.

What should I bring to an initial lawyer meeting?

Bring a short description of the service, planned customer journey, company documents, draft contracts, pricing, and any regulator correspondence. Include data flows and payment flows if the service handles personal information or money.

How long does regulatory approval take?

There is no single timeline for all financial services. Timing depends on the relevant authority, application completeness, business model, and any follow-up requests, so an adviser should confirm current estimates for the specific route.

How much does a financial technology lawyer cost?

Fees vary with the work, such as a one-time regulatory review, contract drafting, an application, or ongoing compliance support. Request a written scope and fee proposal that identifies disbursements, milestones, and work outside the agreed scope.

Do I need a lawyer for a payment or online-loan complaint?

Not every complaint requires legal representation. First preserve transaction records and communications, then complain to the provider; a lawyer may be useful if the amount is significant, the response is inadequate, or legal proceedings are being considered.

Can a lawyer in Surabaya advise a Kertajaya business?

Yes. Kertajaya is within Surabaya, and many regulatory matters are handled with national authorities rather than a neighbourhood office. Confirm that the lawyer can advise on the relevant Indonesian rules and coordinate any local business requirements.

How do I check whether a lawyer is suitable?

Ask about recent work involving the same service type and regulator, and request a clear explanation of the proposed legal route. Confirm the lawyer’s professional credentials and agree on confidentiality, deliverables, fees, and response times in writing.

What should I do after a suspected data breach?

Secure affected systems, preserve relevant logs, and assess what information and people may be affected. Get prompt legal and technical advice on response duties, communications, and any notification requirements under the applicable rules.

Official resources

• Financial Services Authority (OJK): supervises relevant financial services, including online lending, and provides regulatory information and consumer-protection channels.

• Bank Indonesia: regulates and supervises payment systems and payment-service providers within its remit.

• Surabaya City Investment and One-Stop Integrated Services Office (DPMPTSP): provides information on city-level investment and business licensing matters. Business registration and applicable national licensing steps are also handled through OSS.

Next steps to find and hire a lawyer

1. Define the service. Write down what the business does, who its customers are, how money moves, and what personal data it handles. Allow a day to prepare this summary and collect core documents.

2. Identify the likely regulator. Separate lending, payment, and technology-support functions, then note any existing approvals or regulator contact. This gives prospective lawyers a focused question to assess.

3. Shortlist suitable counsel. Look for Indonesian lawyers who can show relevant regulatory, payments, lending, or data-protection work. Contact several candidates over the next few days and ask about conflicts and availability.

4. Compare initial advice. Ask each candidate to explain the likely regulatory route, main risks, and immediate documents needed. Request a written fee and scope proposal before authorising substantial work.

5. Verify credentials and terms. Confirm professional credentials directly, identify who will handle the matter, and agree in writing on fees, deliverables, confidentiality, and communication.

6. Set priorities after engagement. Ask for a written action plan covering any licence or registration work, contracts, data compliance, and local business steps. Confirm deadlines against the relevant authority’s current requirements rather than assuming a standard approval period.