An ATM centre in Indonesia. Enterprise compliance software is priced for large commercial banks, leaving the country’s smaller cooperatives and rural banks under the same rules without the tools to meet them. (BPKPD Kabupaten Sragen)
More than 130,000 financial institutions across Southeast Asia still manage risk in Microsoft Excel and new rules now make that a licence problem. Fresh from being named Founder of the Year at the Global Startup Awards in Malta, Founder and CEO of Prospero, Bobby Yulandika Putra, explains what is at stake and how homegrown technology can close the gap.
The View from Valletta
In May 2026, the Global Startup Awards named Bobby Yulandika Putra Founder of the Year on a stage in Valletta, Malta, the first Indonesian to win the title in the platform’s 14-year history, chosen from more than 71,000 nominations across more than 150 countries. It was a proud night for Prospero, the company he founded, and one he hopes counted for Indonesia too.
But the date that matters far more to the regulatory technology (regtech) industry, where Prospero works in, came six weeks later. On July 1, 2026, Indonesia’s Financial Services Authority (OJK)’s POJK 30/2025 came into force. The regulation mandates that fintech operators must run proper, digital risk management as a condition of their licence, with sanctions for those who are not ready. Vietnam’s new bank-wide internal-control rule, SBV Circular 83/2025, took effect on the very same day. Insurers had their turn in January, under POJK 28 and 33/2025. Together they require insurance, guarantee and pension entities to run a documented risk management framework with annual risk profile self-assessments, and to report a risk-based soundness score to the regulator. In the space of 24 months, OJK has rewritten the risk rulebook for nearly every segment it supervises: P2P lenders, multifinance, rural banks and insurers. Through the 2023 P2SK Law, it has also begun bringing cooperatives under its supervision.
Now set those deadlines against the institutions expected to meet them. Indonesia alone has 130,354 registered cooperatives, around 1,470 rural banks, roughly 105 commercial banks, 146 multifinance companies and some 148 insurers. Across this base of more than 130,000 institutions and among their peers in the Philippines, Thailand and Vietnam, risk management today overwhelmingly lives in Microsoft Excel and email. In the region, spreadsheets are still the most common risk tool at every size of bank. Deloitte’s 2025 Southeast Asia risk survey found spreadsheets are still the most common risk tool at every size of bank.
If that sounds abstract, picture a restaurant. The law requires it to keep a written list of everything that could make a customer sick, to log every kitchen accident and what it cost, to keep a to-do list of every fix the health inspector ordered and to hand the inspector a single health grade on demand. Now imagine the restaurant does all of that on paper, and the inspector has just announced that paper will no longer be accepted. That is where most of Asia’s financial institutions stand today.
A spreadsheet costs nothing until it costs a licence. Regulators across the region have just made digital risk management a condition of supervision, and most of the institutions they supervise have nothing of the kind. The question this poses is simple. Will ASEAN keep importing risk infrastructure built around other people’s regulations, or will it finally build its own?
Locked Out Twice
The graph illustrates the global RegTech valuation gap.Global GRC and RegTech benchmarks: Adenza, AuditBoard, OneTrust, Vanta and Quantexa, set against ASEAN’s regional regtech, which has yet to produce a category leader across the OJK, MAS, BNM and BSP regulatory frameworks. (Prospero, compiled from public company announcements)
The first lock on the door is price. Enterprise governance, risk and compliance (GRC) software was built for institutions that treat six figures as a rounding error. Entry-level licences for the global platforms (IBM OpenPages, MetricStream, SAP GRC, Archer) typically start at around 60,000 to 90,000 US dollar a year and climb into the hundreds of thousands once extra modules and implementations are added. Installation takes anywhere from six months to two years, with consultants absorbing much of the budget. For Citibank or HSBC, that is a negligible cost. For a typical Indonesian rural bank, whose minimum core capital is only about 370,000 US dollar, the cheapest foreign licence would consume the entire technology budget several times over.
Bobby Yulandika Putra spent 15 years running risk inside these institutions, at Indonesia’s major banks, including BTPN, at BRI Syariah and Bank of India Indonesia as head of risk, as well as at the insurance giant AIA as country risk manager, writing the OJK submissions this industry runs on. He watched capable institutions struggle through audits not for lack of discipline, but for lack of tooling built for their reality. The industry’s standard answer is to “scale down” an enterprise platform and in practice it does not work. Those systems assume large compliance teams and consultant-heavy configuration. A cooperative with three back-office staff cannot run IBM OpenPages. It was never designed for them.
OJK Commissioner Sophia Wattimena during Indonesia’s Risk and Governance Summit 2026. (OJK)
The cost of spreadsheet-grade risk management is not hypothetical. OJK revoked twenty rural-bank licences in 2024, five times the historical average, then seven more in 2025 and three in early 2026, with the regulator’s leadership publicly attributing most closures to poor governance that opened the door to fraud. Indonesia’s deposit insurer has set aside roughly 900 billion Indonesian rupiah (55 million US dollar) to cover the payouts. The collapse of the KSP Indosurya cooperative, which cost some 23,000 savers roughly 7 billion US dollar, remains the region’s textbook case, and Thailand’s Klongchan credit-union scandal tells the same story. Every failed institution is a community that loses its savings and its access to formal finance.
Chia Der Jiun, Managing Director of Monetary Authority of Singapore (MAS), during the MAS Annual Report 2024/2025. (MAS)
The second lock is regulatory fragmentation, though it is more shallow than it looks. Underneath the different rulebooks, every supervisor in the region asks for the same five things governed by the globally-recognised Basel rules for operational risk: a self-assessment of risks, warning indicators, a record of losses, tracked fixes and a health rating. The names change at each border; the toolkit does not. Yet the global vendors sell each country as a separate, separately priced module and none of them built its architecture from the ground up to serve the OJK, the Monetary Authority of Singapore (MAS), Bank Negara Malaysia (BNM) and the Bangko Sentral ng Pilipinas (BSP) at the same time.
Solving compliance at scale has created some of the software industry’s biggest outcomes elsewhere. Nasdaq bought Adenza for 10.5 billion US dollar in 2023, and AuditBoard, OneTrust, Vanta and Quantexa have all been valued in the billions of dollars. Yet Southeast Asia, home to one of the world’s largest unmet markets for risk infrastructure, has yet to produce a comparable category leader. That is not to say that there is a lack of in-house regional talent, but rather a symptom of a category the global industry never priced, and never built, for this region.
That is beginning to change. Over the past three years, a small but serious group of regional-native platforms has emerged across Southeast Asia, built not by global vendors adapting to the region but by founders who spent their careers inside its risk and compliance functions. In Indonesia, regional-native platforms, Prospero among them, are signing tier-one financial institutions to multi-year contracts. Meanwhile, Singapore has become the industry’s regulatory and funding hub. The building blocks of a homegrown industry are in place. What it still lacks is the policy and capital environment to scale.
Building the Answer
The graph illustrates ASEAN’s RegTech pricing gap. Annual licence pricing: global incumbents (IBM OpenPages, MetricStream, SAP GRC) at roughly 60,000-90,000 US dollar entry level, per independent pricing analyses, against Prospero’s tiered model, from enterprise licences down to cloud subscriptions at 30 US dollar per month for cooperatives and small firms. (Prospero)
Three public measures would speed this up. Regulatory sandboxes should let a platform be tested with several regulators at once, instead of years of one-country-at-a-time approvals. ASEAN has harmonised across borders before, through the ASEAN Banking Integration Framework. Procurement should reward regional builders: state-owned banks and government-linked companies buy hundreds of millions of dollars of compliance technology every year, and a modest preference for ASEAN-built solutions, as South Korea, Israel and the European Union (EU) already practise, would speed the category up without subsidy. And governments should keep investing in cross-border data and regulatory harmonisation, where the legal frameworks still lag the technology.
Private decision-makers matter just as much. Bank and insurance executives should weigh regional fit and total cost of ownership, not global brand recognition alone. And investors can read the numbers plainly: the global exits prove what the category is worth, while ASEAN entrants still raise at a fraction of those valuations.
This is the argument on which Prospero is built. It is one platform that does the five jobs every regulator in the region asks for and it automates the work that used to eat weeks of staff time:
- The risk register and self-assessment (RCSA): a single record of what could go wrong across the institution. Each team answers two questions on the platform, “what could break here and how well are we protected?” The scoring and the company-wide risk profile build themselves, so there are no more spreadsheet rounds.
- Key risk indicators (KRI): an early-warning layer that tracks the numbers that move before a loss does. Live figures pulled straight from the institution’s own systems turn green, amber or red on their own. The figures update automatically and stay current.
- The loss event database (LED): a permanent record of every incident that costs money, logged once, with its cause, the amount lost and recovered and a full audit trail. The loss history regulators require and from which capital is calculated, accumulates automatically.
- Issue and action management (IAM): a closing mechanism for every audit and supervisory finding. Each one becomes an action with a named owner and a deadline and the system chases it until there is proof it was closed. No finding is left unresolved without a record.
- The health score (GCG/TKS): the same soundness grade the regulator uses to judge an institution, computed daily rather than assembled twice a year, with the regulator’s report ready on demand.
Four things separate this from the equivalent software built in the United States or the United Kingdom. First, the rules are built in. These five tools are the regulator’s own framework, produced in the regulator’s own format and language, while the global platforms were written for Western rulebooks and sell local fit as an extra module. The second aspect is speed. A typical deployment goes live in two to four weeks, against the six months to two years of a legacy install. Price is the third reason. Subscriptions start at about 30 US dollar per month, so the same platform serves a village cooperative and a national bank. Fourth is adoption. Line managers work in the system daily, not only the risk function.
The results show up in the numbers. At Prospero’s flagship banking client, regulator reporting is around four times faster, and roughly 90% of incidents are caught before they become losses. In February 2026 the company signed its first reseller agreement in Malaysia, its first step in cross-border distribution.
The same logic also travels beyond finance. Any organisation that must watch its risks, log its incidents and answer to a supervisor or a board runs on the same five tools: hospitals and healthcare groups, state-owned enterprises, government agencies, property developers, universities. Finance is simply where the rules bite first.
For a bank executive, the practical test is straightforward: measure any platform against your own OJK, MAS, BNM or BSP reporting obligations (now that the July deadlines have arrived) and compare the total cost of ownership. For a cooperative or a small firm, the entry point costs less than a monthly utility bill.
The more than 130,000 cooperatives, rural banks and small institutions in Indonesia alone are not waiting to be lectured about compliance. They are waiting for tools that make sense in their world, that work at their price, in their language and in their regulator’s format. ASEAN can keep buying risk management built on someone else’s rules, or it can build its own. That is the work Prospero has chosen. The choice, ultimately, is ours.
About Bobby Yulandika Putra and Prospero
Bobby Yulandika Putra accepts Founder of the Year at the Global Startup Awards 2026 Grand Finale, held at the EU-Startups Summit in Valletta, Malta. He is the first Indonesian winner in the platform’s 14-year history. (EU-Startups Summit)
Bobby Yulandika Putra is Founder and CEO of Prospero and was named Founder of the Year at the Global Startup Awards 2026 in Valletta, Malta, the first Indonesian winner in the platform’s 14-year history. He spent fifteen years running risk inside the institutions he now serves, at several Indonesian banks, including BTPN, BRI Syariah, Bank of India Indonesia, as well as AIA, a Hong Kong-based insurance company. Bobby is currently a PhD candidate in Economics at Universitas Islam Internasional Indonesia (UIII), an Endeavor Indonesia Batch 8 entrepreneur and a member of the Top 10 cohort at Block71 Singapore.
Prospero, headquartered in Jakarta, is a regional-native enterprise GRC platform built for Southeast Asia’s multi-regulator landscape. The platform is live at five institutional clients in banking, insurance and finance, with zero clients lost and average contract lengths above two years, and the company is expanding across ASEAN, beginning with reseller distribution in Malaysia.
Contact
This Sponsored Story was commissioned and paid for by Prospero, a Jakarta-based enterprise GRC platform. Sponsored Stories are the only place in SEA Daily where promotional content appears and they are labelled as such. To enquire, contact contact@sea-daily.com.
About The Author
