Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection

INTERNATIONAL JOURNAL OF MULTIDISCIPLINARY RESEARCH AND ANALYSIS ISSN(print): 2643-9840, ISSN(online): 2643-9875 Volume 08 Issue 11 November 2025 DOI: 10.47191/ijmra/v8-i11-71, Impact Factor: 8.266 Page No. 6525-6533 IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6525 Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection Benedictus Satryo Wibowo Faculty of Law, Universitas Diponegoro, Jl. dr. Antonius Suroyo, Tembalang, Semarang, Indonesia ABSTRACT: Artificial Intelligence (AI) based credit scoring systems have rapidly transformed lending practices in Indonesian banking. AI enables automated assessment using non-traditional variables, including digital footprints, e-commerce behavior, and mobile device metadata. While this innovation enhances efficiency and financial inclusion, it also creates significant legal and ethical challenges. Existing regulations, Bank Indonesia regulations, OJK regulations on risk management, and the Personal Data Protection Law have not yet provided a comprehensive and specific framework for algorithmic transparency, fairness, and liability in automated decision-making. This article examines the regulatory gaps in Indonesian laws related to AI-driven credit scoring, evaluates the risks of algorithmic bias, and formulates a normative model for consumer protection. Using a normative juridical method, this paper compares Indonesia’s regulatory landscape with global frameworks such as the EU Artificial Intelligence Act, OECD AI Principles, and U.S. fair lending rules. The study finds that the Indonesian financial regulatory regime lacks clear provisions on explainability, auditability, and accountability for AI decisions. It concludes that regulatory reform is required to mitigate discrimination risks and strengthen legal certainty for consumers and financial institutions. KEYWORDS: AI credit scoring, banking law, algorithmic bias, consumer protection, financial regulation. I. INTRODUCTION Artificial Intelligence (AI) has increasingly become a foundational element of modern financial services, particularly in the domain of credit risk assessment. Across global financial markets, banks, digital lenders, and fintech platforms now rely on machine-learning algorithms and predictive analytics to evaluate borrower creditworthiness in ways that traditional models could not achieve. Whereas conventional credit scoring relied heavily on static metrics such as income stability, loan repayment history, collateral, or financial statements, AI-driven scoring incorporates a wide range of alternative data including digital footprints, online behavioral patterns, e-commerce transactions, device metadata, psychometric indicators, and even network-based social interactions. This technological shift has enabled faster, scalable, and more dynamic lending decisions, reshaping the structure of global credit markets (Prahastiwi et al., 2025). Indonesia reflects this global transformation. The rapid emergence of digital banks such as Bank Jago, SeaBank, Line Bank, and Allo Bank, together with the expansion of fintech lending platforms regulated under OJK, has intensified the use of AI-based credit scoring in the national financial ecosystem. The Financial Services Authority (OJK) has formally recognized this development, noting that the Indonesian banking industry is entering an “AI-integrated digital transformation phase” and emphasizing that artificial intelligence must be governed responsibly to ensure prudence and consumer protection (OJK, Tata Kelola Kecerdasan Artifisial Perbankan Indonesia, 2023). In its roadmap for digital finance, OJK highlights credit scoring as a critical component of risk management and encourages the use of advanced analytics to expand financial inclusion. In the fintech sector, the obligation to implement credit scoring was reinforced through POJK No. 40 of 2024, which mandates risk-based assessments for digital lending providers as part of a broader push to minimize default risk and improve market discipline. However, the adoption of AI-driven scoring also brings significant regulatory and ethical dilemmas. Automated decisions in lending directly affect an individual’s access to finance, economic mobility, and long-term credit trajectory. Scholars have long warned that algorithmic systems may perpetuate or even amplify historical inequalities embedded in the data used to train them (Barocas & Selbst, 2016; O’Neil, 2016). Internationally, concerns have been raised about discriminatory outcomes in AI-generated credit assessments such as the 2019 Apple Card controversy in the United States (Chopra, 2021), where algorithmic bias was alleged to produce gender-disparate credit limits, prompting regulatory inquiry by the New York Department of Financial Services Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6526 (NYDFS, 2021). These cases illustrate the broader risk: even when protected attributes are not explicitly used, AI models may rely on proxy variables that lead to unfair or opaque decisions. In Indonesia, the regulatory debate is still at an early stage. OJK’s AI governance framework provides principles for responsible AI but stops short of regulating core issues such as explainability, auditability, or liability in automated credit decisions. The Personal Data Protection Law (Law No. 27/2022) establishes essential data governance principles, yet it does not explicitly regulate automated profiling nor guarantee a right to explanation unlike the EU’s General Data Protection Regulation (GDPR), which grants individuals the right not to be subject solely to automated decision-making with legal effects (GDPR, Art. 22). Likewise, Indonesian banking regulations including POJK No. 17/POJK.03/2023 on Risk Management and BI Regulation No. 14/15/PBI/2012 on Credit Risk were not designed with AI-based systems in mind. They assume a human-centered credit assessment process and contain no explicit standards for algorithmic fairness, model governance, or dataset quality. This regulatory lag is mirrored in academic discourse. Existing Indonesian scholarship has focused largely on two clusters. The first examines digital-lending frameworks and personal data protection, such as the works of Wicaksono (2021) and Hidayat (2020), which analyze the misuse of borrower data, the legality of data scraping, and consent mechanisms on digital platforms. These studies, however, do not engage substantively with the algorithmic mechanics of credit scoring nor evaluate the legal implications of automated decision-making. The second cluster centers on traditional credit appraisal methodologies for example Suryani (2017) and Priyono (2018), who analyze SME financing, bank prudential principles, and conventional scoring mechanisms. These contributions remain tied to non-algorithmic models and therefore do not reflect the emerging realities of machinelearning-based risk assessment. As a result, several critical questions remain underexplored in Indonesian legal research: How do AI-based models potentially generate biased or discriminatory outcomes in lending? To what extent do existing financial regulations accommodate or fail to accommodate requirements for algorithmic transparency, fairness, and human oversight? What liability framework applies when automated systems produced by third-party vendors or used by banks generate harmful decisions or erroneous credit denials? And how can Indonesia draw from global regulatory developments, such as the EU Artificial Intelligence Act (2024), the OECD AI Principles (2019), and U.S. fair-lending rules under ECOA and FCRA (Basha & Rajput, 2019), to construct a robust legal system for AI-based lending? This study addresses those gaps by presenting a comprehensive normative analysis that integrates banking law, consumer protection law, data privacy regulation, and AI ethics. By examining both Indonesian and international regulatory frameworks, this research builds a coherent legal foundation for governing AI-driven credit scoring in Indonesia. The goal is to propose a regulatory model capable of safeguarding consumer rights, ensuring accountability, and supporting responsible innovation within the fastevolving digital financial landscape. II. RESEARCH METHODS The researcher employed a normative juridical approach with the objective of examining statutory regulations, legal doctrines, and relevant jurisprudence that govern the use of Artificial Intelligence (AI) in credit scoring within the Indonesian financial system. This method was chosen because the regulatory issues surrounding automated decision-making, data governance, and consumer protection are fundamentally normative questions relating to the validity, adequacy, and coherence of existing legal norms. To achieve this objective, the researcher conducted an extensive literature study, collecting and analyzing statutory materials, regulatory documents, scholarly articles, and comparative international frameworks. These materials were then systematically integrated to produce a logical, comprehensive, and structured analysis of the legal challenges associated with AI-based credit scoring. The research specification used in this study is descriptive-analytical, which aims to describe, explain, and analyze the legal issues in depth, following the descriptive-analytical model as outlined by Fajar & Achmad (2010). This study relies on secondary data as the principal source of normative legal material. The use of secondary data is intended to provide supporting information that complements statutory and regulatory materials, thereby strengthening the conceptual and analytical foundation of the research. Sources were obtained through library research, including academic journals, monographs, regulatory reports, official publications from OJK and OECD, institutional documents, and other authoritative references, consistent with the principles of normative legal research emphasized by (Soekanto, 1986). Following the data collection process, the researcher conducted qualitative data analysis to identify legal problems, assess regulatory gaps, and formulate coherent arguments and conclusions. The analysis employed a deductive reasoning method, beginning with general legal principles such as fairness, accountability, transparency, and consumer protection and moving toward Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6527 specific conclusions relating to the governance of AI-driven credit scoring in Indonesia. This analytical structure is consistent with normative legal reasoning methods as described by (Suteki, 2018). III. DISCUSSION A. Legal and Regulatory Context of AI-Driven Credit Scoring in Indonesia Artificial Intelligence (AI) has transformed contemporary credit evaluation practices worldwide, including in Indonesia, where banks and fintech lenders increasingly integrate automated decision-making systems into their lending processes. While this development promises efficiency and enhanced financial inclusion, it simultaneously presents a unique set of legal, ethical, and regulatory challenges that existing financial laws have not yet fully addressed. Understanding the Indonesian regulatory landscape requires an examination of multilayered norms issued by the Financial Services Authority (Otoritas Jasa Keuangan, OJK), Bank Indonesia (BI), and cross-cutting legislation such as the Personal Data Protection Law (UU PDP 2022), followed by a comparative analysis against international frameworks. This section elaborates the state of regulation in Indonesia, its limitations, and lessons Indonesia may draw from global governance models. Indonesian Financial Regulations Relevant to Credit Scoring The regulatory architecture governing financial services in Indonesia is characterized by a multi-layered framework that encompasses sector-specific rules issued by the Financial Services Authority (Otoritas Jasa Keuangan, OJK), macro-prudential regulations from Bank Indonesia (BI), and national credit-information governance administered through the Sistem Layanan Informasi Keuangan (SLIK). Although these regulations collectively establish prudential norms for the financial sector, they were developed within a paradigm where human judgment remains the core of credit evaluation. As a result, they have not evolved in tandem with the contemporary shift toward data-driven, algorithmically automated credit-scoring practices deployed by both banks and fintech lenders. This regulatory misalignment creates structural vulnerabilities, including gaps in accountability, transparency, and consumer protection. One of the most pivotal instruments in this framework is OJK Regulation No. 17/POJK.03/2023 on Risk Management for Commercial Banks, which mandates comprehensive prudential obligations for banks. The regulation requires financial institutions to identify, measure, monitor, and control risks across operational, credit, market, and strategic domains. However, despite its broad scope, the regulation implicitly presumes traditional risk models grounded in linear statistical techniques and manual expert judgment. Nowhere does the regulation reference modern AI concepts such as algorithmic explainability, dataset representativeness, model-drift monitoring, or fairness and bias-testing standards. This omission is consequential because AIdriven credit-scoring models differ fundamentally from conventional credit-risk tools: they rely on high-dimensional data inputs, continuously evolving predictive patterns, and complex model architectures such as gradient boosting machines or neural networks that cannot be adequately governed under frameworks designed for deterministic statistical models. Consequently, POJK 17/2023 does not articulate the responsibilities of banks regarding the governance of automated decision systems, nor does it establish ex-ante controls to prevent discriminatory or erroneous algorithmic outputs that may restrict consumer access to credit(suhartono & Diaprina, 2014). A parallel regulatory shortcoming appears in POJK 10/POJK.05/2022 on IT-Based Credit Scoring Operators, a regulation meant to govern the growing ecosystem of independent scoring providers (Lembaga Skoring Kredit). Although this regulation introduces important governance requirements such as licensing, minimum capital, operational standards, and consumer-data safeguards it remains anchored in a compliance model that treats credit scoring as a deterministic computational service. It emphasizes the legality of data acquisition, accuracy of collected data, consumer consent, and limitations on data use. Yet it notably omits explicit provisions related to algorithmic accountability, transparency of scoring models, mandatory bias audits, requirements to document model logic, or obligations to ensure human oversight (human-in-the-loop) in consequential decisions. This is problematic because credit-scoring algorithms often rely on behavioral and alternative data types, employ non-linear prediction methods, and may inadvertently encode discriminatory patterns. Without regulatory instructions on algorithmic explainability, error-correction pathways, or consumer rights to contest automated decisions, the regulation provides insufficient safeguards for borrowers adversely affected by scoring outcomes. Furthermore, Bank Indonesia Regulation No. 14/15/PBI/2012 on Credit Risk Management though foundational in the national credit-risk architecture predates the emergence of machine-learning-based risk assessment tools. The regulation was created in an era where credit evaluation involved standardized financial ratios, collateral-based assessments, and qualitative judgments by credit officers. It does not recognize contemporary issues such as real-time predictive analytics, dynamic risk modeling, automated decisioning, or the integration of alternative behavioral data. While technically still in force, the regulation is misaligned with current industry practices, leaving BI without an explicit legal instrument to oversee or audit AI-driven credit- Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6528 risk models. This gap becomes especially critical as digital banks and fintech lenders increasingly depend on algorithmic systems that operate with minimal human input, raising concerns about regulatory lag and oversight capacity. The national credit-information system, SLIK, established under PBI No. 14/7/PBI/2012 and administered by OJK, plays an essential role in centralizing borrower credit histories. SLIK provides structured, conventional data such as outstanding loans, repayment histories, collateral information, and non-performing loan (NPL) records. While effective for traditional credit underwriting, SLIK was not designed to support or regulate the fusion of conventional credit data with vast volumes of behavioral, transactional, and alternative data increasingly used by AI-based models. Digital lenders and scoring providers now supplement SLIK information with e-commerce purchase records, mobile-device metadata, location analytics, and psychometric patterns. These data categories fall entirely outside the scope of SLIK governance (Ashofteh & Bravo, 2021). As a result, a significant regulatory blind spot emerges: although SLIK data is governed by standardized rules with clear supervisory mechanisms, the integration of unregulated alternative datasets introduces opaque profiling practices beyond the reach of existing financial oversight. This creates the risk that AI-generated credit scores may rely on data sources that are unverified, intrusive, or discriminatory, without any clear legal avenue for consumers to contest their use. Taken together, the Indonesian regulatory landscape illustrates an inherent structural lag between the pace of technological innovation and the evolution of financial governance. OJK and BI regulations establish solid foundations for prudential risk management, but they are insufficiently equipped to address the distinctive risks posed by machine-learning algorithms, including opacity, non-predictability, overfitting, proxy discrimination, and susceptibility to data bias. The absence of explicit obligations for algorithmic transparency, fairness testing, human oversight, model-documentation standards, and auditability leaves the Indonesian financial sector vulnerable to systemic risks and consumer-rights violations. As AI-driven credit scoring becomes more pervasive particularly within digital banks and fintech platforms the need for a dedicated regulatory framework becomes increasingly urgent (suhartono & Diaprina, 2014). Personal Data Protection Law (UU PDP 2022) The Personal Data Protection Law (Law No. 27 of 2022) constitutes Indonesia’s first comprehensive data-protection framework and serves as a foundational legal instrument for the governance of digital activities, including the growing use of artificial intelligence in credit assessment. The statute introduces fundamental principles such as fairness, transparency, purpose limitation, data minimization, accuracy, and accountability that, in theory, should provide essential safeguards for individuals whose data are subjected to automated processing. These principles reflect global data-protection norms and are intended to ensure that personal data are processed responsibly, lawfully, and proportionately. In the context of AI-driven credit scoring, these principles should ideally function as the normative basis for regulating automated decision-making systems that directly influence individuals’ access to financial services. However, despite its structural comprehensiveness, the PDP Law contains significant doctrinal and operational gaps concerning automated decision-making, algorithmic profiling, and predictive analytics. These gaps undermine the law’s ability to address the unique risks posed by AI systems, particularly when such systems are used to determine eligibility for credit a domain with clear economic, social, and even constitutional implications. First, the PDP Law does not expressly provide individuals with a right to object to decisions made solely through automated processing, in stark contrast with Article 22 of the EU General Data Protection Regulation (GDPR). Under the GDPR framework, individuals have the explicit right not to be subject to decisions that produce legal or similarly significant effects when such decisions are made without meaningful human involvement. The absence of this provision in Indonesian law is consequential: AIbased credit scoring frequently relies on automated, high-volume, high-speed decision-making, often involving minimal or no human intervention. Without a statutory right to contest or refuse automated decision-making, Indonesian consumers effectively have no direct remedy against algorithmic determinations that may affect their access to credit, interest rates, or financial mobility (Wijaya, 2023). Second, the PDP Law fails to mandate algorithmic impact assessments (AIAs), despite the fact that credit scoring constitutes a high-risk category of automated decision-making under global standards. AIAs are essential tools for identifying, mitigating, and documenting risks relating to fairness, accuracy, discrimination, and privacy. The EU AI Act, Canada’s Directive on Automated Decision-Making (DADM), and Australia’s AI Ethics Framework each require some form of pre-deployment assessment for highrisk systems. By contrast, Indonesia’s PDP Law does not oblige data controllers or financial institutions to conduct any form of exante or ongoing evaluation of algorithmic models. This omission leaves data controllers without a statutory duty to assess how AI systems may affect individuals disproportionately or unfairly. Third, the law imposes no obligation to provide clear explanations for automated decisions that significantly impact individuals. This is a critical weakness in the context of credit scoring: borrowers frequently need to understand the underlying Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6529 reasons for their rejection in order to contest incorrect data, rectify inaccuracies, or seek alternative forms of financing. In the absence of a right to explanation, transparency becomes a purely theoretical principle with no enforceable mechanism. This regulatory gap permits a “black box” environment in which consumers remain uninformed about the data variables, model logic, or algorithmic inferences used in credit-scoring decisions. Fourth, although the PDP Law references “profiling,” its provisions are abstract and insufficiently detailed for modern AI systems. The law does not define automated profiling, nor does it restrict its use in high-impact decision contexts such as credit scoring, insurance underwriting, or employment screening. As a result, scoring providers and lenders may combine behavioral data (such as smartphone usage patterns), alternative data (e-commerce transactions, geolocation, power consumption), and conventional credit information without clear legal boundaries. These practices enable forms of AI-enabled microprofiling that may be intrusive, opaque, or discriminatory yet remain technically lawful under current Indonesian legislation. Moreover, the PDP Law’s enforcement structure raises additional concerns. While the law establishes both administrative and criminal sanctions, its implementation heavily depends on secondary regulations and institutional readiness of the Data Protection Authority (DPA), which is still undergoing development. Until the DPA becomes fully operational and equipped with technical expertise in AI governance, the enforcement of rights related to algorithmic processing remains uncertain. This institutional gap further weakens the law’s capacity to protect consumers from algorithmic harms in credit scoring (Ardan Rinaldi & Razie Hendrawan, 2024). Taken together, these regulatory shortcomings demonstrate that AI-based credit scoring in Indonesia is largely unregulated from the standpoint of individual rights. While the PDP Law introduces important general principles, it does not articulate the specific obligations necessary to govern automated decision-making systems in high-risk sectors. Without explicit rights to explanation, contestation, human intervention, and algorithmic transparency, Indonesian consumers remain vulnerable to opaque, intrusive, and potentially discriminatory practices embedded within AI-driven credit-scoring mechanisms. The law’s current structure provides insufficient guarantees of fairness and accountability, underscoring the urgent need for a more specialized regulatory framework aligned with global best practices. B. Comparative Insights from Global AI Governance Frameworks As Indonesia’s regulatory landscape continues to rely on traditional, human-centric conceptions of creditworthiness, developments in global AI governance demonstrate a markedly different trajectory one that centers on fundamental rights, algorithmic accountability, and rigorous oversight mechanisms tailored specifically for automated decision-making. These international frameworks reflect a growing recognition that AI-driven credit scoring, by its very nature, carries significant legal and ethical risks that cannot be adequately addressed through conventional financial or data-protection laws alone. Examining these global approaches is therefore essential not only for benchmarking Indonesia’s regulatory position but also for identifying normative principles that may inform future domestic reforms (Prahastiwi et al., 2025). The most comprehensive regulatory model is the European Union Artificial Intelligence Act (AI Act, 2024), the first horizontal AI legislation in the world. The AI Act adopts a risk-based regulatory architecture, categorizing AI systems into unacceptable risk, high risk, limited risk, and minimal risk. Within this classification, AI systems used for creditworthiness assessment or credit scoring are explicitly designated as “high-risk.” This categorization reflects the EU’s recognition that credit-scoring systems shape individuals’ socio-economic opportunities, long-term financial access, and even intergenerational mobility. As high-risk systems, AI-based credit-scoring tools must comply with a wide-ranging set of ex-ante and ongoing obligations. These include (Amalina et al., 2020): 1. Dataset Quality Requirements: Providers must ensure that training and testing datasets are accurate, representative, complete, and free from discriminatory patterns. This requirement is grounded in the understanding that biased datasets inevitably produce biased predictions, regardless of whether sensitive attributes are explicitly used. 2. Technical Documentation and Traceability: Providers must maintain detailed documentation of model design, training processes, performance metrics, and monitoring procedures. This allows regulators to trace the system’s logic and verify compliance, effectively preventing the deployment of “black-box” systems in consequential domains. 3. Robust Risk-Management Systems: Providers must perform continuous testing, post-market monitoring, and periodic reassessment to detect model drift, discriminatory outputs, or adverse impacts on fundamental rights. 4. Human Oversight: Even when automated scoring tools are used, providers must ensure that qualified personnel retain meaningful oversight and the authority to intervene or override algorithmic outputs. 5. Transparency Obligations: Individuals affected by AI-driven credit decisions must be informed of the system’s use, its purpose, and their rights to seek clarification or contest decisions. Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6530 These obligations collectively form a preventive regulatory regime, aimed at mitigating algorithmic harms before they occur. Non-compliance attracts substantial administrative fines up to EUR 35 million or 7% of global annual turnover underscoring the EU’s prioritization of fundamental rights protection over mere technological acceleration. In contrast, the United States adopts a distinct approach rooted in traditional civil rights, anti-discrimination principles, and consumer-protection laws, rather than a unified AI statute. The Equal Credit Opportunity Act (ECOA) prohibits discrimination in credit decisions based on race, sex, religion, national origin, marital status, age, or the receipt of public assistance. The U.S. Consumer Financial Protection Bureau (CFPB) has explicitly clarified that the use of machine-learning tools does not absolve lenders from ECOA liability; algorithmic bias, even if unintended, may constitute unlawful disparate impact. This position has compelled lenders to adopt robust fairness-testing methods, including disparate-impact analysis and proxy-variable detection, to ensure compliance. The Fair Credit Reporting Act (FCRA) further strengthens procedural fairness by requiring lenders to issue adverse action notices clear explanations of the principal factors that contributed to the denial of credit. This requirement effectively pressures lenders to ensure that AI systems are sufficiently interpretable to extract meaningful “reason codes.” As a result, even without AIspecific legislation, U.S. lenders face strong incentives to deploy models with higher degrees of explainability and transparency. The U.S. approach reveals an important insight: AI governance can progress significantly through strong enforcement of existing anti-discrimination and consumer-protection laws, even in the absence of comprehensive AI legislation (Ashofteh & Bravo, 2021). A third influential framework is found in the OECD AI Principles (2019), adopted by 42 member and partner countries, including major global economies. Though non-binding, the OECD Principles constitute one of the most widely adopted normative foundations for ethical AI governance. These principles articulate five core obligations: (1) AI should benefit people and the planet by driving inclusive growth and well-being; (2) AI systems should respect human-centered values and fairness; (3) transparency and responsible disclosure should be maintained; (4) AI systems should be robust, secure, and safe; and (5) organizations and individuals involved in AI development and use should be accountable for proper functioning. Unlike sector-specific regimes, the OECD framework adopts a holistic, cross-sector lens, shaping the baseline expectations that many countries including the EU, Japan, Canada, and Korea—now embed in binding regulations. Notably, the OECD model places strong emphasis on human rights, inclusivity, and proportionality, values that are essential for sectors such as credit scoring where algorithmic decisions have farreaching socio-economic consequences. Taken together, these international frameworks reveal a striking divergence from Indonesia’s regulatory posture. While the EU mandates extensive ex-ante controls and the U.S. enforces strong anti-discrimination and transparency norms, Indonesia has not yet incorporated equivalent safeguards either through sectoral financial regulations or through the Personal Data Protection Law. Additionally, Indonesia has yet to adopt ethical principles comparable to the OECD model in binding form or to articulate AI governance standards that address algorithmic bias, explainability, model documentation, or accountability structures (Basha & Rajput, 2019). As a result, Indonesian consumers navigating AI-driven credit markets remain significantly less protected than their counterparts in jurisdictions that have embraced rights-based AI governance. This comparative insight underscores the urgent need for Indonesia to develop a comprehensive, future-ready regulatory approach capable of balancing innovation with the protection of consumer rights and socio-economic equity. C. Legal Risks Emerging from AI-Driven Credit Scoring The comparative overview of global AI governance reveals several critical legal risks that Indonesia faces as financial institutions increasingly adopt AI-driven credit-scoring systems. These risks are structural, intersectional, and deeply embedded in the technological and regulatory environment in which automated decision-making occurs. Without targeted regulatory interventions, AI-based credit scoring threatens to reproduce and even intensify existing socio-economic inequalities, undermine consumer protections, and weaken public trust in the financial system. Four major categories of legal risk emerge: algorithmic bias, opacity and lack of explainability, liability gaps, and excessive or intrusive data collection practices. The first and most pervasive risk concerns algorithmic bias and discriminatory outcomes. Even when AI systems are designed to avoid the use of explicitly sensitive variables such as ethnicity, religion, or gender, they remain susceptible to indirect discrimination through biased datasets or proxy variables. Machine-learning models fundamentally “learn” from historical data; thus, if historical lending practices reflect unequal access to credit for example, lower loan approval rates in rural, remote, or economically disadvantaged regions these patterns may be inadvertently encoded into the model. In Indonesia, financial inclusion remains uneven across regions, with rural and eastern Indonesia populations often underrepresented in formal lending data (Prahastiwi et al., 2025). When such groups are underrepresented in training datasets, the model may treat them as “high risk” due purely to lack of representation rather than genuine financial behavior. Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6531 In addition, the use of proxy variables such as postal codes, mobile-device characteristics, spending patterns, or networkusage data can unintentionally produce discriminatory classifications. For instance, the ownership of older or low-cost smartphones may be incorrectly interpreted as a negative financial indicator, even though it is unrelated to loan repayment capacity. These forms of proxy discrimination echo concerns seen internationally: U.S. regulators have noted that certain fintech scoring models indirectly reproduced racial disparities through variables that correlated with segregated neighborhoods, despite the absence of race as an explicit input. Similar patterns are possible in Indonesia, where socio-economic status, geographic inequality, and digital divides closely correlate (Ardan Rinaldi & Razie Hendrawan, 2024). The risk is further amplified by disparities in digital literacy; individuals lacking access to stable internet connections or high-quality devices may generate sparse digital footprints, leading AI models to rate them as less creditworthy simply due to data scarcity. A second major legal risk arises from the opacity and non-explainability of AI systems, particularly those using complex architectures such as deep neural networks or ensemble models like random forests and gradient-boosted trees. These systems are often not inherently interpretable, meaning that even their developers may be unable to pinpoint precisely how certain variables interact to produce outcomes. This “black-box problem” creates significant tensions with well-established principles of administrative and financial law, particularly the requirement that decisions affecting rights be reasoned, transparent, and capable of review. In credit markets, explainability is essential: borrowers must be able to understand why their loan applications were accepted or rejected to correct erroneous data, challenge unfair outcomes, or improve their financial standing (Khalimi & Alam, 2022). Regulators also require explainability to audit models and ensure that discriminatory patterns are not embedded within automated systems. Without meaningful transparency obligations, opacity shields AI systems from oversight and allows systemic errors or biases to propagate unchecked, undermining accountability at multiple institutional levels. The third category of risk relates to liability and accountability gaps within the multi-actor ecosystem in which AI creditscoring operates. Modern scoring systems typically involve banks, fintech lenders, AI vendors, machine-learning model developers, third-party data aggregators, cloud-service providers, and sometimes external scoring platforms. Each layer introduces potential points of failure: flawed model design, inaccurate data ingestion, biased feature engineering, faulty algorithm updates, or breaches in data security. Indonesian civil law and consumer-protection frameworks (such as the Consumer Protection Law and general tort provisions) are premised on human-directed decision-making and linear chains of causation. These laws do not yet contemplate composite responsibility in automated decision systems or the possibility that harm may arise from algorithmic processes rather than human intent. As a result, when inaccurate or discriminatory AI decisions occur such as wrongful loan rejections, inflated interest rates, or misclassification of risk profiles consumers may struggle to identify the responsible party. Banks may shift blame to vendors; vendors may argue that models behaved as designed; data providers may deny liability for inaccuracies. This diffusion of responsibility leaves consumers in a legal vacuum with no clear remedial avenue (Clifford et al., 2019). A fourth and increasingly concerning risk involves excessive or intrusive data collection practices, driven by the data-hungry nature of machine-learning systems. To maximize predictive accuracy, algorithmic systems often demand large volumes of granular data encompassing behavioral, transactional, spatial, psychometric, or device-level metadata. In Indonesia, the rapid expansion of fintech lending between 2017 and 2021 revealed widespread abuses by some operators, who collected invasive data such as contact lists, photographs, geolocation histories, and SMS logs. OJK interventions curbed some of the most extreme practices, yet there remains no unified, cross-sector prohibition on the collection of sensitive behavioral or device data for scoring purposes. This regulatory fragmentation creates tension with the data minimization principle enshrined in the Personal Data Protection Law (UU PDP 2022), which states that personal data collection must be relevant, proportional, and necessary for specified purposes (Kenotariatan et al., 2018). However, AI scoring models often exceed these limits by treating data maximization as inherently beneficial for predictive performance. This raises not only privacy concerns but also deeper questions about autonomy and dignity: individuals may be profiled based on deeply personal or contextually irrelevant signals, such as typing speed, browsing habits, or app usage frequency. These practices can lead to hyper-personalized risk profiles that consumers neither understand nor consent to in a meaningful way. Taken together, these legal risks bias, opacity, accountability gaps, and data overreach highlight the limitations of Indonesia’s existing regulatory architecture in addressing the realities of AI-driven credit scoring. Without a more comprehensive, rights-oriented regulatory framework, automated credit systems may perpetuate unfairness, erode consumer trust, and undermine the broader goals of equitable financial inclusion (Hukum Bagi Nasabah Bank Selaku Konsumen Ditinjau dari UndangUndang Nomor et al., 2024). Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6532 D. Implications for Indonesia and Proposed Regulatory Model Given the regulatory gaps, comparative lessons, and legal risks identified above, Indonesia requires a comprehensive regulatory model that balances innovation, consumer protection, and institutional accountability. The first pillar of this model should be the establishment of meaningful human oversight over AI-driven credit decisions. This safeguards individuals from being subjected exclusively to automated profiling and ensures that algorithms function as decision-support tools rather than autonomous arbiters of financial access. A second pillar involves imposing transparency and explainability requirements on financial institutions and credit-scoring operators. These obligations should include disclosure of key variables influencing credit outcomes, availability of explanation mechanisms for adverse actions, and clear pathways for consumers to dispute erroneous or unfair assessments. This aligns with global standards under the EU AI Act and U.S. FCRA, which treat transparency as essential to procedural fairness. Third, Indonesia should institutionalize mandatory algorithmic audits and impact assessments. These audits should evaluate dataset quality, detect discriminatory patterns, and assess model robustness. Regular assessments would help ensure that systems remain compliant with consumer-protection norms and adapt to evolving risk environments. Such measures would also encourage credit providers to maintain detailed model documentation and increase regulatory visibility into automated decision-making processes (Khalimi & Alam, 2022). A fourth component is the establishment of a liability framework tailored to AI-driven financial services. Banks must retain ultimate responsibility for credit decisions, given their position as licensed financial institutions. However, vendors should bear derivative liability for defective algorithms or inadequate system safety, reflecting the shared nature of technological risk. This dual-layer model encourages all actors within the AI ecosystem to uphold rigorous standards of care. Finally, Indonesia should adopt strict data-minimization and sensitive-data restrictions, prohibiting the use of religious markers, biometric data unrelated to creditworthiness, political opinions, or behavioral indicators not demonstrably relevant to credit risk. Such restrictions align with the principles of proportionality and necessity in data governance and would prevent the emergence of intrusive or discriminatory profiling practices (Baidhowi et al., 2025). Collectively, these reforms would move Indonesia toward a more coherent, rights-protective framework for governing AIdriven credit scoring. They would strengthen consumer protection, enhance regulatory capacity, and promote responsible innovation within the digital financial sector. IV. CONCLUSION The rapid adoption of AI-driven credit scoring in Indonesia marks a pivotal shift in the country’s financial landscape, offering the promise of enhanced efficiency, broader financial inclusion, and data-driven lending practices. Yet, this technological advancement has outpaced the development of Indonesia’s legal and regulatory frameworks. Existing regulations ranging from OJK’s risk-management rules to Bank Indonesia’s credit-risk provisions and the Personal Data Protection Law remain rooted in conventional, human-centered conceptions of credit assessment. They do not yet anticipate the complex dynamics, opacity, or potential discriminatory impacts inherent in contemporary machine-learning systems. A comparative analysis with global AI governance frameworks reveals significant gaps. The EU AI Act imposes strict ex-ante obligations on high-risk AI systems; U.S. fair-lending laws ensure strong anti-discrimination and transparency standards; and the OECD AI Principles articulate a coherent normative foundation for responsible and human-centered AI deployment. Indonesia, in contrast, lacks legally binding requirements for explainability, algorithmic audit, bias testing, human oversight, or liability allocation in multi-party AI ecosystems. As a result, Indonesian borrowers face considerable risks: algorithmic bias, opaque decision-making, intrusive data practices, and uncertainty regarding avenues for redress. The absence of these safeguards poses not only legal and ethical challenges but also broader socio-economic implications. Without adequate regulation, automated credit scoring may reinforce existing inequalities, undermine trust in financial institutions, and expose consumers to unjust or unchallengeable decisions that materially affect their access to essential financial services. The risks are exacerbated for vulnerable populations those with limited digital footprints, lower digital literacy, or socioeconomic characteristics susceptible to proxy discrimination. To ensure that AI serves as an instrument of financial inclusion rather than exclusion, Indonesia must adopt a forward-looking regulatory approach. This includes establishing meaningful human oversight, mandating transparency and explainability obligations, institutionalizing algorithmic audits and impact assessments, clarifying shared liability between banks and AI vendors, and enforcing strict data-minimization principles. Implementing such measures will harmonize domestic regulations with global best practices while safeguarding fundamental rights and reinforcing public trust in AI-enabled financial services. Regulatory Challenges of AI-Driven Credit Scoring in Indonesian Banking: Between Algorithmic Bias and Consumer Protection IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6533 In conclusion, AI-driven credit scoring represents both an opportunity and a challenge for Indonesia. Its potential can only be realized if accompanied by a robust, adaptive, and rights-protective regulatory framework. By integrating international standards and strengthening national governance, Indonesia can ensure that technological innovation aligns with principles of fairness, accountability, and consumer protection advancing a more equitable and trustworthy digital financial ecosystem. REFERENCES 1) Amalina, F., Targio Hashem, I. A., Azizul, Z. H., Fong, A. T., Firdaus, A., Imran, M., & Anuar, N. B. (2020). Blending Big Data Analytics: Review on Challenges and a Recent Study. IEEE Access, 8, 3629–3645. https://doi.org/10.1109/ACCESS.2019.2923270 2) Ardan Rinaldi, F., & Razie Hendrawan, R. (2024). Analisis Yuridis Penerapan Prinsip Kehati-hatian Untuk Meminimalisir Kredit Macet Pada Pembiayaan Online. Indonesian Journal of Law and Justice, 2(2), 10–10. https://doi.org/10.47134/IJLJ.V2I2.3377 3) Ashofteh, A., & Bravo, J. M. (2021). A conservative approach for online credit scoring. Expert Systems with Applications, 176, 114835. https://doi.org/10.1016/J.ESWA.2021.114835 4) Baidhowi, Ramadhani, R., & Yudhayana, S. W. (2025). Implementasi Prinsip Kehati-hatian dalam Praktik Kredit Perbankan: Tinjauan Yuridis terhadap Tanggung Jawab Bank. PENG: Jurnal Ekonomi Dan Manajemen, 2(3), 3407–3416. https://doi.org/10.62710/GMCQNV91 5) Basha, S. M., & Rajput, D. S. (2019). Survey on Evaluating the Performance of Machine Learning Algorithms: Past Contributions and Future Roadmap. Deep Learning and Parallel Computing Environment for Bioengineering Systems, 153– 164. https://doi.org/10.1016/B978-0-12-816718-2.00016-6 6) Chopra, S. (2021). Current Regulatory Challenges in Consumer Credit Scoring Using Alternative Data-Driven Methodologies. Vanderbilt Journal of Entertainment & Technology Law, 23(3), 625. https://scholarship.law.vanderbilt.edu/jetlaw/vol23/iss3/4 7) Clifford, D., Graef, I., & Valcke, P. (2019). Pre-formulated Declarations of Data Subject Consent—Citizen-Consumer Empowerment and the Alignment of Data, Consumer and Competition Law Protections. German Law Journal, 20(5), 679–721. https://doi.org/10.1017/GLJ.2019.56 8) Hukum Bagi Nasabah Bank Selaku Konsumen Ditinjau dari Undang-Undang Nomor, P., Perlindungan Konsumen Rafela Ashyla Zahra, T., Abdurrahman, L., & Asmak Ui Husnoh, dan. (2024). Perlindungan Hukum Bagi Nasabah Bank Selaku Konsumen Ditinjau dari Undang-Undang Nomor 8 Tahun 1999 Tentang Perlindungan Konsumen. Indonesian Journal of Law and Justice, 1(4), 9–9. https://doi.org/10.47134/IJLJ.V1I4.2376 9) Kenotariatan, J. H., Ke-Ppat-An, D., Mulyati, E., Dwiputri, F. A., Program, B., Kenotariatan, S. M., Padjadjaran, U., & Penulis, K. (2018). PRINSIP KEHATI-HATIAN DALAM MENGANALISIS JAMINAN KEBENDAAN SEBAGAI PENGAMAN PERJANJIAN KREDIT PERBANKAN. ACTA DIURNAL Jurnal Ilmu Hukum Kenotariatan, 1(2), 134–148. https://jurnal.fh.unpad.ac.id/index.php/acta/article/view/164 10) Khalimi, K., & Alam, K. (2022). PENEGAKAN HUKUM TERHADAP PELANGGARAN PRINSIP KEHATI-HATIAN DALAM PEMBERIAN KREDIT PERBANKAN. Yustitia, 8(1), 15–35. https://doi.org/10.31943/YUSTITIA.V8I1.152 11) Prahastiwi, N. A., Lubis, M., & Fakhrurroja, H. (2025). The Ensemble Supervised Machine Learning for Credit Scoring Model in Digital Banking Institution. Indonesian Journal of Artificial Intelligence and Data Mining, 8(2), 466–477. https://doi.org/10.24014/IJAIDM.V8I2.37677 12) Soekanto, S. (1986). Pengantar Penelitian Hukum. UI Press. 13) suhartono, S. (suhartono), & Diaprina, S. R. (Sistya). (2014). Analisis Klasifikasi Kredit Menggunakan Regresi Logistik Biner dan Radial Basis Function Network di Bank €˜X€™ Cabang Kediri. Jurnal Sains Dan Seni ITS, 3(2), 15522. https://doi.org/10.12962/J23373520.V3I2.8139 14) Suteki. (2018). Metode Penelitian Hukum Filsafat Teori dan Praktik (G. Taufani, Ed.). Rajawali Pers. 15) Wijaya, T. (2023). Berkembangnya Sistem Innovative Credit Scoring di Indonesia. Center For Indonesian Policy Studies.