About Bank BRI

Bank Rakyat Indonesia is one of the largest banks in Indonesia and is committed to increasing financial inclusions among un-banked Indonesians. Bank BRI specializes in using modern digital banking to facilitate microfinance lending across its network of over 10,000 branches and thousands of branchless agents.

Google Cloud Results

• Contributes $50M in revenue through the Apigee monetization feature
• Wins recognition for best digital bank in Indonesia from The Asian Banker in 2019
• Achieves ISO 27001 information security for open APIs, earning distinction as the only bank in ASEAN to receive certification to date
• Reduces partner onboarding from 6 months to under 1 hour with Apigee developer portal

Bank Rakyat Indonesia is making waves in Asia with its award-winning digital strategy. As a government-owned bank, Bank BRI is dedicated to changing the lives of its customers through accelerating financial inclusion across Indonesia. With an aggressive target of 84 percent of Indonesians participating in the banking system by 2022, Bank BRI is leapfrogging fintech competition thanks to its innovative digital strategy that has APIs at its core. By the end of 2019, Bank BRI expects to have reached a 70 percent financial inclusion rate among the country’s population, in part due to the adoption of the Cloud Apigee API Management Platform as the bank’s digital nucleus.

Transforming a legacy into a digital future

In the banking business, trust is essential, not only between the bank and its customers, but also between the bank and its partners. Recognizing that gaining and maintaining this trust would be key to customer and partner adoption of the new Bank BRI products and services, the bank decided to pursue ISO 27001 certification in 2018, becoming the first bank in ASEAN (the Association of Southeast Asian Nations) to become certified as information security compliant. Now the international community of partners and customers who use the bank’s APIs have yet another reason to place their trust Bank BRI.

“Apigee has become the central nervous system for all communications between the digital core banking, the microservices, the frontend, and the apps. Apigee has become our sun. Everything rotates around Apigee.”—Kaspar Situmorang, Executive Vice President, Bank Rakyat Indonesia

Kaspar Situmorang, Executive Vice President of Bank BRI, had the original vision for how the bank could transform itself into a fintech with digital technology and APIs. His team got started by implementing a web-native frontend over a new technology stack with Apigee as a second layer. This was a big change from the legacy technologies that existed when Situmorang joined the bank in 2017. Previously all of the bank’s products had their own public APIs, which were very difficult to manage, secure, and monetize.

Since deploying Apigee, it’s become much easier to manage the entire API lifecycle. Situmorang’s digital bank team of 15 uses the Apigee monetization and developer portal features while managing and securing APIs and conducting big data integrations. Apigee has become Bank BRI’s center of communications, handling all transactions between the bank and third parties.

Whereas previously it could take up to six months to onboard a new partner using host-to-host and VPN technology, now it takes less than an hour for partners to self-onboard using the Bank BRI Apigee developer portal. On the portal, partners can register, browse APIs, test in the sandbox, and go into production — all in less than an hour.

“Apigee has become the central nervous system for all communications between the digital core banking, the microservices, the frontend, and the apps. Apigee has become our sun. Everything rotates around Apigee,” says Situmorang.

Increasing financial inclusions

With more than 10,000 offices across Indonesia, Bank BRI has the largest network of any bank in ASEAN. The bank is also the biggest microfinance lender in the region. Though already present in even the most far-flung corners of Indonesia, Bank BRI is still working on increasing financial inclusion among un-banked Indonesians. With 56 million people that haven’t accessed banking services, Indonesia is in the bottom four countries for financial literacy in the world, along with Bangladesh, India, and China. It’s estimated that there is up to $8.3 billion in currency being held outside the banking system.

In order to reach this mostly rural, subset of the population, the bank launched Agent BRILink, a nationwide network of branchless agents. These agents can open new accounts, take deposits, pay out withdrawals, and process and disburse loans in under two minutes with the Pinang microfinance mobile app. To date, over 30,000 customers have received loans through Pinang. Handling its own risk-scoring and automatic payroll deductions for payments has translated into less risky and more profitable loans for Bank BRI.

“Customers download the app and scan their ID, capturing their credit score in just a few seconds. The digital offer letter says how much they’re approved for. They can then accept it, go to the approval screen, and do facial recognition. The money is disbursed immediately. GCP has transformed us into a fintech.”—Kaspar Situmorang, Executive Vice President, Bank Rakyat Indonesia

BRILink agents are bank customers who have been scored highly for reliability by the bank’s big data analyses and who maintain a minimum balance of around $800. Combining this data with the Google Maps API, Bank BRI is able to score all 75.5 million of its customers and identify which of them should be recruited as agents for underbanked areas. Since 2018, the bank has been able to appoint more than 200,000 branchless agents using the Agent BRILink app, eliminating the need for logistically challenging face-to-face meetings. This has resulted in an increase in loan volume from branchless business from $15 billion in 2017 to $26 billion in 2018.

To enable branchless agents to sign up new customers and provide banking services, all they need is a mobile phone and internet service. With many parts of rural Indonesia not covered by commercial 3G, Bank BRI has overcome this hurdle by operating its own satellite. With the connectivity the satellite guarantees, branchless agents can help customers obtain microfinancing and open new shops and businesses in all parts of the country. The satellite also provides internet service across the APAC region wherever the bank operates, from Sri Lanka to New Zealand. While it might seem unusual for a bank to operate a satellite, it’s reflective of Bank BRI’s commitment to reaching its financial inclusion targets and meeting its customers wherever they are.

“Pinang was created to win against fintechs trying to compete against us on speed, cost, and security,” says Situmorang. “The truth is that Indonesian regulators closed about 650 fintechs, mainly in the peer-to-peer lending space, because they were unsafe, too expensive, and very slow.”

Using APIs to create and monetize new products

Another way that Bank BRI is leveraging Google Cloud Platform solutions is through an innovative use of the Cloud Vision API, which enables the bank to integrate with the Indonesian government ID database. Identities of new customers — whether they’re coming in via a branch, a BRI Link Agent, or a mobile app — are automatically verified in seconds through facial recognition. With instant credit scoring and identity fraud concerns essentially eliminated, the bank can make more confident lending decisions.

“Monetization is very important to us. It enables us to define our pricing based on API calls and bill automatically based on usage. We’ve already recognized $50 million through the Apigee monetization feature.”—Kaspar Situmorang, Executive Vice President, Bank Rakyat Indonesia

“Customers download the app and scan their ID, capturing their credit score in just a few seconds,” explains Situmorang “The digital offer letter says how much they’re approved for. They can then accept it, go to the approval screen, and do facial recognition. The money is disbursed immediately. GCP has transformed us into a fintech.”

Bank BRI sees a bright digital future, in part thanks to the API product marketplace it’s creating to serve fintechs. With its digital technologies and massive customer base, the bank is sitting on a treasure trove of big data. Bank BRI already packages this data through more than 50 monetized open APIs for more than 70 ecosystem partners wanting to do credit scoring, business assessments, and risk management. Fintechs, insurance companies, and financial institutions don’t have the talent or the financial resources to do quality credit scoring and fraud detection on their own, so they are turning to Bank BRI.

“Monetization is very important to us. It enables us to define our pricing based on API calls and bill automatically based on usage. We’ve already recognized $50 million through the Apigee monetization feature,” says Situmorang.

Bank BRI is meeting and surpassing the goals it has set for itself for digitalization, increasing financial inclusion, and creating new revenue streams with APIs.

Whether they were ready for it or not, the COVID-19 pandemic transformed many retailers into digital businesses. Retailers made huge investments into commerce technologies, customer experience tools, sales and fulfillment technology, and improving digital experiences to continue providing their goods and services to their customers. Now, more than a year into the COVID-19 pandemic, digital retail is the new normal. In fact, many retailers are planning on expanding their digital investments. However, as their digital footprint expands, so do their threats and security concerns. 

As a digital-focused retailer, your website is the most visible part of your attack surface. Your website is where your customers search for goods or services, make payments, or learn more about your brand. However, your website does not operate in isolation. There is an underlying infrastructure as well as the services that run on top of it that need protection from a wide array of attacks that may seek to compromise your data, internal employees, business, and customers. During this week’s Google Cloud Retail Summit, we’ve shared why Google Cloud is built to be the most trusted cloud for retailers. From providing you with control over your data as you move from your own data centers to the public cloud to giving you built-in technology to protect your applications all the way to your end users, Google Cloud helps you safely migrate to and operate in our Trusted Cloud.

Trusted Cloud Gives You Control, Transparency, and Sovereignty

• Access Transparency: We offer the ability to monitor and approve access to your data or configurations by Google Cloud support and engineering based on specific justifications and context, so you have visibility and control over insider access. 
• Certificate Authority Service (CAS): CAS is a highly scalable and available service that simplifies and automates the management and deployment of private CAs while meeting the needs of modern developers and applications. With CAS, you can offload to the cloud time-consuming tasks associated with operating a private CA, like hardware provisioning, infrastructure security, software deployment, high-availability configuration, disaster recovery, backups, and more, allowing you to stand up a private CA in minutes, rather than the months it might normally take to deploy.

• Confidential Computing: We already encrypt data at-rest and in-transit, but customer data needs to be decrypted for processing. Confidential Computing is a breakthrough technology which encrypts data in-use—while it’s being processed. Confidential VMs take this technology to the next level by offering memory encryption so that you can further isolate your workloads in the cloud. With the beta launch of Confidential VMs, we’re the first major cloud provider to offer this level of security and isolation while giving you a simple, easy-to-use option for your newly built and “lift and shift” applications.

• Cloud Key Management: We allow you to configure the locations where your data is stored, where your encryption keys are stored, and where your data can be accessed from. We give you the ability to manage your own encryption keys, even storing them outside Google’s infrastructure. Using our External Key Management service, you have the ability to deny any request by Google to access encryption keys necessary to decrypt customer data at rest for any reason.

Trusted cloud Helps You Prevent, Detect, and Respond to Threats

• BeyondCorp Enterprise is Google’s comprehensive zero trust product offering. Google has over a decade of experience managing and securing cloud applications at a global scale, and this offering was developed based on learnings from our experience managing our own enterprise, feedback from customers and partners, as well as informed by leading engineering and security research. We understand that most customers host resources across different cloud providers. With this in mind, BeyondCorp Enterprise was purpose-built as a multicloud solution, enabling customers to securely access resources hosted not only on Google Cloud or on-premises, but also across other clouds such as Azure and Amazon Web Services (AWS).

• Cloud Armor: We’re simplifying how you can use Cloud Armor to help protect your websites and applications from exploit attempts, as well as Distributed Denial of Service (DDoS) attacks. With Cloud Armor Managed Protection Plus, you will get access to DDoS and WAF services, curated rule sets, and other services for a predictable monthly price.

• Chronicle: Chronicle is a threat detection solution that identifies threats, including ransomware, at unparalleled speed and scale. Google Cloud Threat Intelligence for Chronicle surfaces highly actionable threats based on Google’s collective insight and research into Internet-based threats. Threat Intel for Chronicle allows you to focus on real threats in the environment and accelerate your response time.
• Google Workspace Security: Used by more than five million organizations worldwide, from large banks and retailers with hundreds of thousands of people to fast-growing startups, Google Workspace and Google Workspace for Education include the collaboration and productivity tools found here. Google Workspace and Google Workspace for Education are designed to help teams work together securely in new, more efficient ways, no matter where members are located or what device they use. For instance, Gmail scans over 300 billion attachments for malware every week and prevents more than 99.9% of spam, phishing, and malware from reaching users. We’re committed to protecting against security 1 threats of all kinds, innovating new security tools for users and admins, and providing our customers with a secure cloud service.
• Identity & Access Management IAM: Identity and Access Management (IAM) lets administrators authorize who can take action on specific resources, giving you full control and visibility to manage Google Cloud resources centrally. For enterprises with complex organizational structures, hundreds of workgroups, and many projects, IAM provides a unified view into security policy across your entire organization, with built-in auditing to ease compliance processes.
• reCAPTCHA Enterprise: reCAPTCHA has over a decade of experience defending the internet and data for its network of more than 5 million sites. reCAPTCHA Enterprise builds on this technology with capabilities, such as two-factor authentication and mobile application support, designed specifically for enterprise security concerns. With reCAPTCHA Enterprise, you can defend your website against common web-based attacks like credential stuffing, account takeovers, and scraping and help prevent costly exploits from malicious human and automated actors. And, just like reCAPTCHA v3, reCAPTCHA Enterprise will never interrupt your users with a challenge, so you can run it on all webpages where your customers interact with your services.

• Security Command Center: With Security Command Center (SCC), our native posture management platform, you can prevent and detect abuse of your cloud resources, centralize security findings from Google Cloud services and partner products, and detect common misconfigurations, all in one easy-to-use platform. We have Premium tier for Security Command Center to provide even more tools to protect your cloud resources. It adds new capabilities that let you spot threats using Google intelligence for events in Google Cloud Platform (GCP) logs and containers, surface large sets of misconfigurations, perform automated compliance scanning and reporting. These features help you understand your risks on Google Cloud, verify that you’ve configured your resources properly and safely, and document it for anyone who asks.

• VirusTotal: VirusTotal inspects items with over 70 antivirus scanners and URL/domain blocklisting services, in addition to a myriad of tools to extract signals from the studied content. Any user can select a file from their computer using their browser and send it to VirusTotal.
• Web Risk API: With Web Risk, you can quickly identify known bad sites, warn users before they click infected links, and prevent users from posting links to known infected pages from your site. Web Risk includes data on more than a million unsafe URLs and stays up to date by examining billions of URLs each day.

Trusted cloud Plays an Active Role in Our Shared Fate 

Our trusted cloud provides a shared-fate model for risk management. We stand with retailers from day one, helping them implement best practices for safely migrating to and operating in our trusted cloud.

We hope you enjoy the sessions we’ve created for you with Google Cloud Retail Summit and that they help you understand the ways our trusted cloud can help secure retailers all over the world.