BFIN The Profit Growth Streak Finally Breaks, and the Cyberattack Behind It Still Has No Name

The Profit Growth Streak Finally Breaks, and the Cyberattack Behind It Still Has No Name

Every reporting period since Q1 2021's own pandemic-hit decline - through a corporate-action tender offer, a full board reshuffle, and H1 2023's cyberattack-linked deterioration - has posted year-over-year net income growth, even when that growth was thin (H1 2023 itself still managed +2.3%). 9M 2023 breaks that nine-period streak outright: net income fell 10.2% year-over-year, to Rp1,176,201M from Rp1,309,778M - the first year-over-year profit decline since the pandemic. Cost of Credit, the single number that has told this story all year, climbed further still: 4.5% for the nine months (from 0.8% a year earlier), and 5.4% in Q3 2023 alone - worse than Q2's already-record 4.8%, meaning the deterioration flagged last quarter didn't stop with the quarter containing the disclosed incident.

What's genuinely different this quarter is the shape of the deterioration, not its direction. New bookings, which fell 37.0% quarter-over-quarter in the cyberattack's own quarter, actually grew 4.3% quarter-over-quarter in Q3 (Rp4,155 billion from Q2's Rp3,983 billion) - the booking engine restarted. NPF (gross) ticked up only 7 basis points quarter-over-quarter, to 2.02% from 1.94% - a fraction of Q2's 88-basis-point jump. But Cost of Credit kept climbing anyway, and Motorcycles - the segment flagged in H1 as absorbing the sharpest margin compression - had its worst quarter yet: profit before tax for Q3 2023 alone was roughly Rp11 billion, down from over Rp170 billion in H1's own two quarters combined. Bookings are recovering; credit costs and segment profitability are not, at least not yet.

None of this happens against a silent backdrop. The financial statements' own notes still never name the cyberattack BFI disclosed to OJK and IDX on 21 May 2023 - the same generic, forward-looking cyber-risk language (penetration testing, access-management renewal) appears in this quarter's risk-management note as appeared in Q2's, with no reference to an actual event having occurred. See Beyond the Usual below. The cure rate and second-restructuring share stay undisclosed for a sixth consecutive filing. And debt-to-equity, which climbed for three straight quarters through H1 2023, actually eased this quarter - see Key Financial Metrics below for why that's a genuine de-lever, not a data quirk.

The Prescription

A recovering booking pace and a still-rising Cost of Credit are not the same signal, and BFI's own disclosures don't yet let a reader tell which one is temporary. The company should publish a segment-level Cost of Credit or NPF breakdown - even just Cars/Motorcycles/Others, matching the segment table it already discloses for income and profit - so a reader can see whether Motorcycles' near-zero Q3 profit reflects a genuinely deteriorating book (worth real concern) or a one-quarter write-off timing effect (less so). Right now the only way to infer this is to subtract cumulative figures across quarters, which is exactly the kind of reconstruction a company's own disclosures shouldn't require of a reader.

What the company should stop doing: treating "operational disruption" as a closed chapter rather than an ongoing explanatory gap. The phrase appeared three times in Q2's presentation and reappears in Q3's Key Ratios language ("Higher NPF and CoC a Result of Operational Disruptions") - now describing a second consecutive quarter of Cost of Credit records, months after the disclosed incident itself. Either the cyberattack's operational impact is still working through the book five months later (in which case that's worth explaining explicitly, not gesturing at repeatedly), or the phrase has become a convenient shorthand for a broader credit-quality problem that deserves its own explanation. The missing cure rate (see Update on Loan Restructuring below) would help distinguish between the two, which is why three straight prior posts have already asked for it.

Key Financial Metrics

Nine months ended 30 September 2023 vs. nine months ended 30 September 2022

FX: Rp15,474 = USD 1 (28 September 2023 close, the closest trading day to period-end). Both periods below are converted at this same rate for comparability, following the convention used throughout this backlog - it is not a historical rate for the 2022 column.

Metric	9M 2023 (IDR)	9M 2023 (USD)	9M 2022 (IDR)	YoY
Total Income ("Net Revenue" equivalent)	Rp3,869,000M	~$250.0M	Rp3,199,000M	✅ +20.9%
Profit Before Tax ("Operating Income" equivalent)	Rp1,450,773M	~$93.8M	Rp1,623,916M	⚠️ -10.7%
Net Income	Rp1,176,201M	~$76.0M	Rp1,309,778M	⚠️ -10.2%
Total Cash and Cash Equivalents	Rp2,056,836M	~$132.9M	Rp1,073,255M	✅ +91.6% (vs. FY2022)

Profit before tax remains the closest operating-income equivalent for this lender, as established throughout this backlog. This is the first period since Q1 2021 where both profit before tax and net income actually fell year-over-year rather than merely growing slower than revenue - the pattern flagged since H1 2023 of profit growth lagging Cost of Credit has now crossed into outright decline. Operating activities used just Rp164,721M this year, a fraction of 9M22's Rp2,281,031M outflow, largely because new-booking growth this year (+5.3% YoY) is far more moderate than 9M22's underlying pace, so less cash is needed to fund origination. Total cash rose 91.6% versus FY2022's Rp1,073,255M, though it's worth noting cash actually declined from H1 2023's own Rp2,567,492M - Rp1.1 trillion in bond repayments and dividend/interest outflows during Q3 drew the balance back down.

Basic earnings per share fell to Rp78 for 9M23 from Rp88 a year earlier (-11.4%), on an essentially unchanged weighted-average share count of 15,039,383,620 (no further treasury shares moved this quarter - see Beyond the Usual). Q3 2023 alone contributed roughly Rp22 of that Rp78, in line with H1's own Q2 contribution, but down from Q1's Rp34 - a run rate that's now settled at a materially lower level than the Rp30+ quarterly pace seen through 2022.

Balance sheet metric	30 Sep 2023 (IDR)	30 Sep 2023 (USD)	31 Dec 2022 (IDR)	9M ∆
Total Assets	Rp24,165,826M	~$1,561.7M	Rp21,929,634M	✅ +10.2%
Financing Receivables (gross)	Rp21,443,572M	~$1,385.6M	Rp20,387,689M	✅ +5.2%
Total Liabilities	Rp14,753,585M	~$953.4M	Rp13,173,725M	⚠️ +12.0%
Fund Borrowings (net)	Rp9,005,820M	~$582.0M	Rp10,246,908M	✅ -12.1%
Securities Issued (bonds, net)	Rp4,718,307M	~$304.9M	Rp1,581,490M	⚠️ +198.3%
Total Equity	Rp9,412,241M	~$608.3M	Rp8,755,909M	✅ +7.5%

Debt-to-equity^» eased to 1.46x from H1 2023's 1.7x - reversing the three straight quarterly increases flagged through H1 2023 (1.4x at FY2022 → 1.5x at Q1 → 1.7x at H1 → now 1.46x), even as Total Liabilities kept rising. The reason: bond repayments (Rp655,000M of two maturing series settled in Q3, see Beyond the Usual) and equity growth from retained earnings outpaced new borrowing, so interest-bearing debt (fund borrowings plus securities issued, Rp13,724,127M) grew more slowly than equity this quarter. This figure now matches, almost to the decimal, the company's own OJK-mandated Gearing Ratio of 1.46x (up from FY2022's 1.35x) - as close as this backlog's independently-computed DER has tracked the company's own regulatory disclosure in recent quarters. As in every prior quarter, DER itself is nowhere in the investor presentation's own narrative slides - only in the mandatory compliance-ratio note. The related-party PT United Tractors Tbk facility - flagged since Q1 2020 - kept drawing, its balance rising to Rp418,420M from Rp407,100M at year-end, still against an unchanged Rp1,250,000M limit.

Key Operational Metrics

• New financing originations: Rp14,455 billion for 9M23 (excluding Pinjam Modal channeling, the narrower basis used consistently since FY2022), up 5.3% YoY from 9M22's Rp13,727 billion - a much slower pace than H1 2023's own 20.8% YoY. But the quarterly split tells a better story than the cumulative number: Q3 2023 alone was Rp4,155 billion, up 4.3% quarter-over-quarter from Q2's cyberattack-depressed Rp3,983 billion - the first sequential increase since Q4 2022, ending two straight quarters of decline.
• Managed receivables (including off-balance-sheet joint financing, per the deck): Rp21,917 billion, up 19.3% YoY.
• Non-Performing Financing (NPF) (company's own disclosed figure^», gross basis): 2.02% at 9M23, up just 7bps QoQ from H1's 1.94% and up 93bps YoY from 9M22's 1.09%. The pace of quarter-over-quarter deterioration slowed sharply versus H1's own 89bps QoQ jump - a genuine deceleration, though not yet a reversal. NPF coverage fell further to 2.2x, down from H1's 2.3x and 9M22's 4.2x - also a much smaller quarterly step-down than the prior quarter's collapse from 3.8x to 2.3x.
• Cost of Credit (CoC): 4.5% for 9M23, up from 0.8% a year earlier, and 5.4% for Q3 2023 alone - worse than Q2's already-record 4.8% (see H1's post). The presentation's Key Ratios slide attributes this to the same "operational disruptions" framing used last quarter, now applied to a second consecutive record. This is the one metric that didn't decelerate even as NPF's pace of increase slowed - see The Real Driver above.
• Net Interest Spread: 12.7% for 9M23, down from 13.6% a year earlier; Q3 2023 alone eased further to 12.0% from Q2's 12.7%.
• Cost to Income: 43.0% for 9M23, an improvement from 45.9% a year earlier; Q3 2023 alone (43.3%) improved slightly from Q2's 43.7%.
• Return on average assets (before tax): 8.0% for 9M23, down from 12.4% a year earlier; Q3 alone 6.5%, down from Q2's 6.8%.
• Return on average equity (after tax): 17.1% for 9M23, down from 21.7% a year earlier (the company's own 9M22 comparative figure, distinct from the 21.2% cited for H1 2022 in last quarter's post - both are genuine company-disclosed numbers for different comparative periods, not a contradiction); Q3 alone 14.1%, down from Q2's 14.8%.
• Earnings per share: Rp78 basic for 9M23, down from Rp88 a year earlier (see Key Financial Metrics above).

Every quarterly profitability ratio above still moved the wrong direction versus Q2 - Net Interest Spread, ROAA, and ROAE all compressed further quarter-over-quarter, just by smaller margins than H1's own sequential declines. This is a genuine deceleration in the rate of deterioration, not a reversal of it - the distinction that matters for a reader trying to judge whether the worst has passed.

Update on Loan Restructuring

• Restructured balance: Rp80,598M as of 30 September 2023, roughly 0.4% of total managed receivables - down again from H1 2023's 0.6%, the eighth consecutive quarterly contraction in the pool.
• Absolute size: down 76.1% in nine months, from Rp336,971M at 31 December 2022 to Rp80,598M at 30 September 2023.
• Cure rate and second-restructuring share: still not disclosed, for a sixth consecutive filing. The last disclosed cure rate remains Q1 2022's 80.7%; the last disclosed second-restructuring share remains Q1 2022's 18.0%. See The Prescription above and Beyond the Usual below.
• Rescheduling program remains closed since August 2020 - every account still in restructuring is working through relief already granted in 2020, per the same disclosure that has held throughout this backlog.

Three Segments, and Motorcycles' Quarter Nearly Disappears

The company reports Cars, Motorcycles, and Others on the same nine-month basis as every prior quarter in this backlog.

Cars - still the largest segment: Rp3,135,437M of income (65.8% of total, down slightly from 9M22's 67.8%), up 20.2% YoY - but profit before tax fell 8.7% YoY to Rp1,042,348M from Rp1,141,766M, with margin compressing to 33.2% from 43.8%, and net profit down 8.2% to Rp845,074M. Isolating Q3 alone (9M less H1's own Rp718,878M): roughly Rp323,470M of profit before tax, broadly consistent with H1's per-quarter pace.

Motorcycles - Rp951,138M of income (20.0% of total, down slightly from 20.6%), up 20.2% YoY - but profit before tax fell 41.6% YoY to Rp184,278M from Rp315,735M, margin collapsing to 19.4% from 39.9%, and net profit down 41.3% to Rp149,402M. Isolating Q3 alone: roughly Rp11,278M of profit before tax - down from over Rp170,000M combined across H1's own two quarters, the sharpest single-quarter segment swing this backlog has been able to isolate.

Others (heavy equipment/machinery, property, and sharia financing) - Rp681,116M of income (14.3% of total, up from 11.6%), up 52.2% YoY, with profit before tax up 34.7% YoY to Rp224,147M from Rp166,415M and net profit up 35.4% to Rp181,725M. But margin compressed too this quarter, to 32.9% from 37.2% - the first time in this backlog Others' own margin has moved the wrong direction, even as it remains the only segment growing profit at all.

The pattern flagged in H1 deepened rather than reversed: Cars and Motorcycles both posted profit declines this period despite double-digit revenue growth, and Motorcycles' own quarterly profit is now close to breakeven. Others is still the only segment growing profit, but its margin cracked for the first time too - a signal that whatever is driving the vehicle book's deterioration may be starting to touch the rest of the business, even if only modestly so far.

Beyond the Usual

A second consecutive Cost of Credit record, and the incident cited to explain it still doesn't appear in the numbers' own footnotes

Cost of Credit hit 5.4% in Q3 2023 alone - a second consecutive quarterly record, worse than Q2's already-unprecedented 4.8% - and the investor presentation's Key Ratios slide again attributes it to "operational disruptions," the same phrase used to explain Q2's numbers following BFI's 21 May 2023 cyberattack disclosure to OJK and IDX. This quarter's consolidated financial statements - covering the full nine months, five months past the disclosed incident - still never name the cyberattack anywhere in their notes. The risk-management section's cyber-risk language is unchanged from Q2's filing: generic, forward-looking control description (penetration testing, access-management renewal, standardized network-device management), with no note disclosing that an actual cyberattack occurred, what systems it affected, or what it's estimated to have cost. Two consecutive quarterly filings since the disclosed incident, and a reader relying solely on the filed financial statements still has no way to connect this backlog's worst-ever credit numbers to a named, regulator-disclosed security event.

The cure rate has now been missing for six straight filings

BFI disclosed a restructuring cure rate and second-restructuring share every quarter from the pandemic's start through Q1 2022, then dropped both starting with the H1 2022 filings. This is the sixth consecutive filing - four interim quarters, one annual report, and now this one - without either figure or any stated reason for the omission. The restructured pool has kept shrinking every period since (10.2% of receivables at FY2021, then 6.9%, 4.5%, 2.9%, 1.6%, 1.0%, 0.6%, and now roughly 0.4%), even as this backlog just recorded its first year-over-year profit decline since the pandemic. Whether the shrinking restructured pool reflects genuine cures or aging into the write-offs behind this year's Cost of Credit records remains exactly the question the missing disclosure would answer.

The treasury mandate's fifth straight quarter at zero

The 29 June 2022 EGMS authorized disposing of BFI's entire 1,002,732,000-share treasury stock: 75,000,000 shares for the MESOP^» program (executed 11 October 2022) and 927,732,000 shares for sale to Trinugraha Capital or any other party. That larger tranche shows an unchanged treasury balance across five straight quarter-end filings now - 30 September 2022 through 30 September 2023 all show the identical 927,732,000-share balance, still against the 5 November 2025 transfer deadline disclosed for the first time last quarter. No new information this quarter beyond the balance staying exactly where it was.

Bond financing kept rotating this quarter: a new Shelf Registration Bond Phase III under the same Rp8 trillion program (Rp1.1 trillion, coupons of 6.25%-7.375% across roughly 5-27 month tranches) joined the Phase IV and V bonds already issued in H1, while two older series matured and were repaid in the same quarter - the Shelf IV Phase III (2020) Series B (Rp395,000M, 8 September 2023) and Shelf V Phase II Series B (Rp260,000M, 6 August 2023). Net effect: total bonds outstanding actually fell slightly from H1's peak, to Rp4,718,307M, even with a new tranche added - the debt structure is rotating maturities as much as it's growing.

The off-balance-sheet Bank Jago joint-financing balance - the facility whose ceiling BFI expanded roughly 6.7x in the days after the cyberattack disclosure, flagged last quarter - grew to Rp441,478M from FY2022's Rp102,899M, more than quadrupling as the company actually draws against the enlarged Rp2,000,000M ceiling. This financing sits entirely off BFI's own balance sheet.

Target Valuation Range

Market cap ~Rp17,220,094M (~$1,112.8M) at ~10.29x TTM P/E and ~1.83x P/B - fairly valued, not a bargain. The stock's multiple compression this quarter is the market catching up to genuinely weaker earnings - the first outright profit decline since the pandemic - not a market overreacting to a temporary shock. With Cost of Credit still setting records and the cure rate disclosure now missing for six straight filings, there isn't yet a clean signal that the credit cycle has turned, which keeps this from reading as clearly undervalued either.

Using 15,039,383,620 shares outstanding net of treasury (unchanged again this quarter - see Beyond the Usual above) and the Rp1,145 closing price:

Market cap buildup	9M 2023
Share price (period-end)	Rp1,145
Shares outstanding	15,039,383,620
Market capitalization	Rp17,220,094M (~$1,112.8M)
Book value (total equity)	Rp9,412,241M

Peer-multiple sanity check	H1 2023	9M 2023	Change
P/E (TTM)	~11.78x	~10.29x	down - the first contraction after two straight quarters of expansion
P/B	~2.36x	~1.83x	down

Market cap is down 19.9% from H1 2023's ~Rp21,506,319M. TTM P/E uses TTM net income of Rp1,673,102M (FY2022's Rp1,806,679M plus 9M23's Rp1,176,201M, less 9M22's Rp1,309,778M). TTM net income has now fallen for three consecutive quarters - Rp1,919,519M at Q1, Rp1,826,155M at H1, and now Rp1,673,102M - a genuine multi-quarter earnings decline, not a one-off. Unlike H1, where the stock re-rated up against falling trailing earnings, this quarter the price fell faster than earnings did (market cap -19.9% vs. TTM earnings -8.4% versus H1's trailing figure) - the valuation gap this backlog has flagged since Q1 2023 is closing, even if it hasn't fully closed.

Stock Price: A Steady Slide Through the Quarter With the Worst Credit Numbers Yet

BFI Finance shares closed at Rp1,145 on 29 September 2023, down 19.9% from H1 2023's Rp1,430 - a reversal of the two straight quarter-end gains that had carried the stock to that two-year high. Over the trailing two-year window (October 2021 through September 2023), the stock ranged from Rp975 (November 2021) to Rp1,430 (June 2023's quarter-end high) - a 46.7% peak-to-trough swing, well past the >30-40% threshold applied throughout this backlog. Unlike H1's choppy but ultimately upward path, Q3's move was a steady, near-monthly decline: Rp1,320 in July, Rp1,200 in August, Rp1,145 by quarter-end - three straight down months, coinciding with the same quarter Cost of Credit set its second consecutive record and net income posted its first outright decline since the pandemic.

---