Until recently, most Indonesian companies faced prosecution only when a specific sectoral law allowed it. However, once Law No. 1 of 2023 took effect on 2 January 2026 that changed. Corporate criminal liability in Indonesia has since become part of the general criminal law.
Three laws took effect together:
- Law No. 1 of 2023 on the Criminal Code (KUHP) replaced the colonial-era code.
- Law No. 20 of 2025 on the Criminal Procedure Code (KUHAP) rebuilt criminal procedure.
- Law No. 1 of 2026 on Sentencing Adjustment (Penyesuaian Pidana) then aligned the two and tightened several corporate rules.
The KUHP now provides the general framework for corporate criminal liability in Indonesia, rather than leaving liability solely to separate rules for individual business sectors. A company can be held liable for any offence in the KUHP unless the law provides otherwise, while relevant sectoral criminal laws continue to operate alongside it. Exposure is not limited to directors and officers: it can also extend to anyone who gives orders, controls the company, or is its beneficial owner.
From a foreign investor’s perspective, three things change.
- First, a parent company and its regional executives can now fall within the reach of Indonesian criminal law.
- Second, every share acquisition or merger carries the target’s criminal history.
- Third, a compliance programme is more than just words on a page. It is evidence.
This article explains what the change means for a company in practice. It covers when a company is liable, who else can be exposed, the penalties and successor liability. It also explains the new statutory routes to resolve a criminal case, including deferred prosecution agreements. The article closes with practical steps and answers to common questions.
Key Takeaways on Corporate Criminal Liability in Indonesia
- Since 2 January 2026, any offence in the new Criminal Code can be attributed to a company unless the law says otherwise.
- A company is liable if the offence falls within its business, benefits it unlawfully, reflects its policy, or happens because it failed to prevent it or allowed it.
- Directors, controllers, order givers and beneficial owners can be prosecuted alongside the company, even without a formal position.
- Corporate fines reach Rp50 billion, and judges can impose up to 10% of the prior year’s annual profit where that is not enough.
- Bankruptcy, a merger, an acquisition, a demerger or dissolution no longer ends the state’s right to prosecute.
- Companies can apply for a deferred prosecution agreement from the investigation stage, subject to conditions and court approval.
- A documented, working compliance programme is now the strongest answer to the “failure to prevent” test.
What Changed for Corporate Criminal Liability in Indonesia on 2 January 2026
The Old Position: a Patchwork of Sectoral Laws
The old Criminal Code dated back to 1915, the Dutch colonial era. It never recognised corporations as subjects of criminal law. This gap meant that a company could only be prosecuted where there was a specific sectoral statute that made corporate liability possible. Corruption, money laundering, environmental and competition laws did provide for corporate liability. However, many other laws did not provide for corporate liability.
For years, Indonesian prosecutors and courts relied on Supreme Court Regulation (PERMA) No. 13 of 2016 on Procedures for Handling Criminal Cases by Corporations. It provided procedural guidance, but it remained a court regulation rather than a law.
The New Position: One General Framework
Today, the KUHP puts corporate criminal liability in Indonesia on a general statutory footing. It states plainly that corporations are subjects of criminal offences (Article 45(1)). The corporate rules sit in three places:
- Articles 45 to 50 set out when a company and its people are liable.
- Article 56 lists the factors a judge must weigh when sentencing a company.
- Articles 118 to 124 set out corporate penalties and measures.
On the procedural side, the KUHAP adds a dedicated chapter on corporations (Chapter XVIII, Articles 326 to 332). The Supreme Court has also issued Circular (SEMA) No. 1 of 2026 to guide judges on applying both codes.
Law 1/2026 completed the picture. It amended parts of the KUHP and adjusted the criminal provisions in laws outside the KUHP so that they fit the new system.
Why Indonesia Made the Change
The KUHP was promulgated on 2 January 2023 with a three-year transition. The KUHAP passed the House of Representatives on 18 November 2025. Both came into force on 2 January 2026, together with Law 1/2026.
The reform also reflects Indonesia’s international commitments. Indonesia ratified the UN Convention against Corruption through Law No. 7 of 2006. It became a full member of the Financial Action Task Force in October 2023, and is working through its OECD accession roadmap. Each of these expects Indonesia to impose effective corporate criminal liability, not only individual liability.
Table 1: Corporate criminal liability in Indonesia, old regime and new regime
| Issue | Before 2 January 2026 | From 2 January 2026 |
|---|---|---|
| Legal basis | Sectoral laws, PERMA 13/2016 | KUHP (Law 1/2023), KUHAP (Law 20/2025), Law 1/2026 |
| Offences a company can commit | Only those a sectoral law specified | Any KUHP offence, unless excluded, plus sectoral offences |
| Who can be held liable | Mainly the company and its management | Company, functional management, order givers, controllers, beneficial owners |
| Maximum corporate fine | Varied by statute | Up to Category VIII (Rp50 billion), plus up to 10% of prior-year profit |
| Effect of merger or restructuring | Unclear | Prosecution does not lapse |
| Resolution routes | Trial | Trial, deferred prosecution agreement, guilty plea |
Does the New Law Apply to Conduct Before 2026?
Generally, no. The law in force at the time of the conduct still governs it. However, Article 3 of the KUHP adds a safeguard. Where the law changes after the offence, the new law applies unless the old law is more favourable to the offender.
In practice, historic conduct remains prosecutable under the sectoral laws that applied when it occurred. Due diligence must therefore examine both legacy exposure under the old regime and prospective exposure under the new framework.
Who and What the New Rules Cover
A Broad Definition of “Corporation”
Article 45(2) defines the scope of corporate criminal liability in Indonesia. It covers limited liability companies (PT), foundations, cooperatives, and state-owned and regionally owned enterprises. It also covers associations, firms, limited partnerships (CV) and other business groupings, whether incorporated or not.
Article 45(2) also defines the scope of corporate criminal liability for foreign investors setting up a PT PMA in Indonesia. Since a PT PMA is a limited liability company (Perseroan Terbatas), PT PMA criminal liability in Indonesia is governed by the same rules as any domestic company.
People Whose Acts Count as the Company’s Acts
The KUHP then identifies whose conduct can become the company’s conduct. There are two groups.
- Inside the structure (Article 46) : An offence by a corporation is one committed by people connected to it in different ways. They can be functional management, ordinary employees and anyone working under “another relationship.” As long as these individuals are operating within the company’s business scope and acting in its interest, whether on their own or alongside others, their criminal acts tie straight back to the business itself.
Note that the phrase “another relationship” covers, for example, agents, distributors, consultants and even customs brokers. These are often the people who create the risk leading to corporate criminal liability in Indonesia.
- Outside the structure (Article 47). An order giver, a controller or a beneficial owner can also be the person whose conduct is attributed to the corporation, even where they hold no formal position inside it. It is not material whether they sit on the board or in management. What matters is whether they are in a position to control the company.
- Shadow control counts: Article 47 reaches people with no board seat who still direct the company. Regional heads, parent company executives and those behind nominee arrangements can all fall within scope.
For more on control and disclosure, see our guides to Beneficial Ownership Rules in Indonesia and Foreign Direct Investment in Indonesia.
When Corporate Criminal Liability in Indonesia Attaches: the Article 48 Test
Articles 46 and 47 identify the people whose conduct may be attributed to a company; Article 48 determines when that conduct becomes the company’s offence. Article 48 sets out five alternative conditions, and satisfying any one of them is sufficient for attribution. It is therefore the core test for corporate criminal liability in Indonesia.
- The offence falls within the company’s business scope, as defined in its articles of association or other applicable rules. For example, a logistics company whose staff falsify customs declarations acts within its business scope.
- The offense creates an illegal gain for the company. The term gain is to be interpreted broadly. It does not include only money but also other advantages, such as processing applications more quickly, winning tenders, or saving money.
- The offense was accepted as company policy (written or verbal, sanctioned by management or even merely tolerated by it and enacted by lower-level employees).
- The company failed to take the steps needed to prevent the offence, reduce its impact and ensure compliance with the law.
- The company allowed the offense to happen. This refers to the company’s “looking the other way” in relation to an offense.
Conditions 4 and 5 are especially important at board level because they test whether compliance measures operated in practice, not merely whether policies existed on paper. Evidence that a company took appropriate steps to prevent an offence, reduce its impact, and ensure compliance can support its response to an allegation under Article 48. A policy on file, without evidence of implementation, offers little protection once prosecutors bring a charge.
Two further rules are relevant. First, Article 36 requires fault: the offence must have been committed intentionally or, where the law permits, negligently. Second, Article 50 allows a company to rely on the same justifications and excuses available to the relevant management for the offence charged, provided they relate to that offence.
Infographic 1: Can the company be charged?
Personal Exposure: Directors and Controllers Under the New KUHP
Liability can Land on the Company, the Individuals, or Both
Article 49 is where corporate criminal liability in Indonesia becomes personal. Once an offence is attributed to a company, liability can be imposed on the company itself. It can also be imposed on functional management, order givers, controllers and beneficial owners. The law allows any combination. As a result, board of directors’ criminal liability in Indonesia now sits alongside the company’s own.
The KUHAP mirrors this. Article 326 uses the term “person responsible for the corporation” (penanggung jawab Korporasi) for these individuals. Article 332 then allows prosecutors to indict the company and those individuals together.
What this Means for Foreign Parent Companies
For foreign company criminal liability in Indonesia, the test is effective control, not job title. A regional vice president who approves a budget in Singapore can be an order giver. Likewise, a parent company that directs a local decision can be a controller. The absence of a board seat in Jakarta is not a defence.
This also links to beneficial ownership disclosure. Presidential Regulation No. 13 of 2018 requires companies to identify their beneficial owners. Non-disclosure will have administrative consequences. Criminal exposure arises separately, where a beneficial owner controls the company under Article 47 of the KUHP.
How it Sits with the Business Judgment Rule
Directors often ask whether the business judgment rule protects them from corporate criminal liability in Indonesia. Article 97(5) of Law No. 40 of 2007 on Limited Liability Companies shields directors from civil claims where they acted in good faith, with due care and without a conflict of interest. However, it is not a criminal defence in itself.
Even so, the same evidence helps in both settings. Board minutes, risk reviews and records of preventive steps support a civil defence. They also answer the Article 48 test.
Table 2: Who can be prosecuted, and on what basis
| Person | Legal Basis | Typical Risk Scenario |
|---|---|---|
| Directors | Articles 46 and 49 KUHP | Approving payments or contracts without adequate controls |
| Commissioners | Article 46, plus oversight duties under Law 40/2007 | Ignoring red flags raised by audit or whistleblowers |
| Employees and agents | Article 46 (employment or other relationship) | Sales staff or distributors paying facilitation fees |
| Order givers | Article 47 | A regional executive instructs the local team |
| Controllers | Article 47 | A parent company directs a local decision |
| Beneficial owners | Article 47; Presidential Regulation 13/2018 | Nominee structures that hide true control |
For related governance risks, see Director Removal in Indonesia, The Governance Illusion and Corporate Fraud in Indonesia.
What Penalties Can a Company Face?
The Main Penalty: Fines
Under the rules on corporate criminal liability in Indonesia, the principal penalty for a company is a fine (Articles 118 and 119). Article 79 sets eight fine categories. Article 121 then fixes the range for corporate fines under Indonesian criminal law.
The minimum corporate fine is Category IV, or Rp200 million, unless another law says otherwise. The maximum depends on the prison term the offence carries for individuals:
- under 7 years: up to Category VI (Rp2 billion)
- 7 to 15 years: up to Category VII (Rp5 billion)
- death, life, or up to 20 years: up to Category VIII (Rp50 billion)
At September 2026 exchange rates, Rp50 billion is roughly USD 2.8 million.
A Higher Ceiling for Large Companies
For large groups, the ceiling is not really Rp50 billion. Law 1/2026 inserted a new Article 121(3). It applies where a company receives a Category VIII fine and the judge finds that fine insufficient. The judge may then set the fine at up to 10% of the company’s annual profit for the previous financial year.
Two points matter here. First, this is a higher ceiling, not an automatic add-on. It replaces the Category VIII maximum, and it applies only if the judge decides to use it. Second, it can change the numbers sharply. For a profitable subsidiary, 10% of annual profit can far exceed Rp50 billion.
Table 3: KUHP fine categories and the corporate range
| Category | Maximum Fine (RP) | Relevance to Corporations |
|---|---|---|
| I | 1,000,000 | |
| II | 10,000,000 | |
| III | 50,000,000 | |
| IV | 200,000,000 | Minimum corporate fine |
| V | 500,000,000 | |
| VI | 2,000,000,000 | Maximum where the offence carries under 7 years |
| VII | 5,000,000,000 | Maximum where the offence carries 7 to 15 years |
| VIII | 50,000,000,000 | Maximum where the offence carries death, life or up to 20 years |
| Higher ceiling | Up to 10% of prior-year annual profit | Discretionary; replaces the Category VIII maximum where that is insufficient (Article 121(3)) |
Source: Articles 79 and 121 KUHP, as amended by Law 1/2026; Ministry of Law fine categories.
Additional Penalties
In practice, the wider criminal sanctions for companies in Indonesia often hurt more than the fine. Article 120(1) lists twelve of them. They range from compensation to victims through to dissolution. Licence revocation, closure and freezing of activities can each last up to two years (Article 120(2)).
Measures (Tindakan)
Article 123 adds three measures. A court can order a takeover of the company, place it under supervision, or place it under guardianship (pengampuan). Each one removes control from management.
Table 4: Additional penalties and measures, and what they mean for the business
| Sanction | KUHP Reference | Practical Effect |
|---|---|---|
| Compensation to victims | Art. 120(1)(a) | Direct cash cost |
| Repairing the consequences of the offence | Art. 120(1)(b) | Remediation spend, for example environmental clean-up |
| Performing neglected obligations | Art. 120(1)(c) | Forced compliance with overdue duties |
| Fulfilling customary law obligations | Art. 120(1)(d) | Obligations to affected communities |
| Funding job training | Art. 120(1)(e) | Cost of workforce programmes |
| Confiscation of goods or profits from the offence | Art. 120(1)(f) | Loss of proceeds |
| Publication of the court decision | Art. 120(1)(g) | Reputational damage |
| Revocation of specific licences (max. 2 years) | Art. 120(1)(h) | Loss of OSS permits; operations stop |
| Permanent ban on specific acts | Art. 120(1)(i) | Exit from a business line |
| Closure of premises or activities (max. 2 years) | Art. 120(1)(j) | Site shutdown |
| Freezing of business activities (max. 2 years) | Art. 120(1)(k) | Revenue interruption |
| Dissolution | Art. 120(1)(l) | End of the legal entity |
| Takeover, supervision, guardianship | Art. 123 (measures) | Loss of management control |
What Happens if the Company does not Pay
Fines must be paid within the period the judgment sets (Article 122). If the company does not pay, prosecutors can seize and auction its assets or income. If that still falls short, the court can freeze some or all of its business. The same seizure power applies to unpaid compensation and remedial penalties (Article 120(3)).
How Judges Set the Sentence
Article 56 lists ten factors a judge must weigh when sentencing a company. Several are within the board’s control. They include the level of harm, the involvement of management, how long and how often the offence occurred, and the company’s track record. Crucially, they also include the company’s cooperation in handling the case.
Successor Liability: Why M&A and Restructuring Now Carry Criminal Risk
What Law 1/2026 Says
Before 2026, many deal teams in Indonesia assumed that restructuring could leave corporate criminal liability behind. That assumption no longer holds. Law 1/2026 amended Article 132(2) of the KUHP. The state’s authority to prosecute a company now survives:
- bankruptcy
- a change of name
- a merger
- a consolidation
- an acquisition
- a demerger (pemisahan)
- dissolution
What This Means for Acquirers
In a share acquisition, the buyer inherits the target’s criminal exposure. After a merger, the surviving entity may face it. Consequently, due diligence on corporate criminal liability in Indonesia is now a core workstream, not a box to tick.
Limitation periods determine how far back due diligence should look. Under Article 136, they range from 3 years for minor offences to 20 years for the most serious. For example, bribery of a public official under Article 605 carries a maximum prison term of five years. The applicable limitation period must therefore be assessed by reference to the relevant category in Article 136.
What This Means for Group Reorganisations and Distressed Deals
The same rule applies inside a group. Moving assets or licences into a new entity will not remove exposure left in the old one. Likewise, buying a distressed company out of PKPU can mean buying its criminal history.
Deal Protections That Now Matter More
Buyers should revisit their standard terms. In our view, five protections now carry more weight:
- specific indemnities for criminal matters, not only general warranty cover
- escrow or holdbacks sized to realistic fine and remediation exposure
- conditions precedent tied to the status of any investigation
- warranties on regulatory investigations and third-party payments
- a post-closing compliance integration plan with firm deadlines
Infographic 2: Criminal-risk checkpoints across the deal lifecycle
Table 5: Criminal-risk due diligence checklist for Indonesian targets
| Area | What to Request or Check |
|---|---|
| Investigations | Any summons, inquiries or proceedings by the Police, Attorney General’s Office, KPK, PPATK, KPPU or sector regulators |
| Government-facing business | Contracts with ministries, SOEs and regional governments; procurement history |
| Third parties | Agents, consultants, distributors, customs brokers; payment terms and due diligence files |
| Licences | OSS licence history, suspensions, revocations |
| Whistleblowing | Reports received, investigations conducted, outcomes |
| Beneficial ownership | Disclosures under Presidential Regulation 13/2018; nominee arrangements |
| Tax | Audits, disputes, criminal tax investigations |
| Environment and safety | Permit breaches, incidents, sanctions |
| Compliance programme | Policies, training records, audit reports, board minutes on compliance |
For deal-specific guidance, see Indonesia M&A in 2026, Distressed M&A in Indonesia and Financial Distress and PKPU in Indonesia.
How Corporate Cases Now Run Under the KUHAP
A Dedicated Procedure for Corporations
The KUHAP gives cases on corporate criminal liability in Indonesia their own chapter (Articles 326 to 332). It covers who answers for the company, how summons and attendance work, and how the company is examined during investigation and at trial. It also allows a joint indictment of the company and its responsible persons (Article 332).
Deferred Prosecution Agreements in Indonesia
The deferred prosecution agreement, or DPA (Perjanjian Penundaan Penuntutan), is the most important new tool for companies facing corporate prosecution in Indonesia. Article 328 governs it.
- Who can use it: A DPA applies only to offences by corporations (Article 328(2)). Its stated aims are legal compliance, recovery of losses and efficiency in criminal justice (Article 328(1)).
- When to apply: A company can apply to the public prosecutor, through its management or its advocate, once investigators name it as a suspect and until the case goes to court (Article 328(3)). It is precisely during the investigation stage that a DPA is likely to offer the greatest value to a company.
- How the prosecutor decides: The prosecutor may accept or reject the application. The decision turns on justice, the victims and the defendant’s compliance (Article 328(4)).
Typical conditions include:
- compensation or restitution to victims
- a compliance programme or anti-corruption governance reforms
- reporting to and cooperating with law enforcement during the deferral period
- other corrective steps the prosecutor considers necessary
- Court control: The prosecutor must send the signed agreement to the court within seven days (Article 328(6)). The court then holds a hearing on whether the DPA is appropriate and valid (Article 328(7)). The judge weighs legal compliance, the proportionality of the sanctions, the impact on victims and the community, and the company’s ability to perform (Article 328(8)).
- Outcome: If the company meets every obligation, the court can end the case without further prosecution (Article 328(13)). If it does not, the prosecutor can resume the prosecution (Article 328(15)).
Guilty Pleas
The KUHAP also introduces guilty pleas (pengakuan bersalah), defined in Article 1 point 16. There is a pre-trial route (Article 78) and there are trial-stage routes (Articles 205 and 234). SEMA 1/2026 guides the courts on each.
The pre-trial route is narrow. It applies to first-time offenders facing up to five years, who must have an advocate. Whether and how it applies to companies is not yet settled. For now, the DPA is the clearer corporate route.
Restorative Justice
Restorative justice under Articles 79 to 82 of the KUHAP is limited to lower-level offences. It excludes corruption and several other serious crimes. Its use for corporate defendants remains untested.
Why Cooperation Now has Value
Put together, the new procedural rules on corporate criminal liability reward early cooperation in good faith. Article 56 counts the cooperation of a legal entity as a factor to determine the extent of a penalty; Article 328(4) makes the company’s compliance a factor in whether the prosecutor accepts the DPA application. Therefore, in corporate compliance under Indonesian criminal law, early investigation, remediation and cooperation are usually most rewarding.
Table 6: Resolving corporate criminal liability in Indonesia, routes compared
| Feature | Trial | Deferred Prosecution Agreement | Guilty Plea |
|---|---|---|---|
| Available to | All defendants | Corporations only | Defendants meeting statutory conditions |
| Legal basis | KUHAP | Article 328 KUHAP | Articles 78, 205, 234 KUHAP; SEMA 1/2026 |
| Who initiates | Prosecutor | Company (as suspect) or its advocate | Defendant, with prosecutor and court |
| When | After transfer to court | Any time before transfer to court, including during investigation | Pre-trial or at trial, depending on route |
| Court role | Full trial | Approval hearing and monitoring | Examines validity of the plea |
| Outcome if successful | Acquittal or conviction | Case ended without further prosecution | Reduced sentence, shorter procedure |
| Key conditions | Proof of guilt | Restitution, compliance reforms, cooperation | Voluntary admission, supporting evidence |
| Conviction recorded | Yes, if found guilty | No, if conditions are met | Yes |
Infographic 3: From investigation to resolution
How the Rules Work in Practice: a Worked Scenario
| Illustrative scenario. The facts are fictional. PT Alpha is a PT PMA manufacturer, wholly owned by a Singapore holding company. Its customs broker pays officials to speed up clearance of imported components. The local sales director knows about the payments. A regional vice president at the parent approved a “logistics facilitation” budget that funds them. PT Alpha has an anti-bribery policy but has never carried out due diligence on the broker. Is it a corporate offence? Yes. The broker acts through “another relationship” in PT Alpha’s interest (Article 46). Does Article 48 attach liability? Yes, on three limbs. The conduct is within the business scope. It brings an unlawful benefit, namely faster clearance. And the company failed to prevent it, because it never checked the broker. Who is exposed? PT Alpha and the sales director (Article 49). The regional vice president is also exposed as an order giver outside the structure (Article 47). What penalties apply? Bribing officials under Article 605 carries up to five years. The corporate fine is therefore capped at Category VI, or Rp2 billion. However, licence revocation or a freeze of activities for up to two years would cost far more. The Anti-Corruption Law, which has its own rules on corporate liability, may also apply. What are the options? Early cooperation and a DPA application. Likely conditions include restitution, broker due diligence and a board-level compliance overhaul. |
The lesson is clear. In most cases of corporate criminal liability in Indonesia, the fine is not the biggest risk. The loss of licences, management control and reputation usually is.
The KUHP Works Alongside Sectoral Criminal Laws
The KUHP lays down the general rules, even for offences defined in other laws. However, there is a plethora of sectoral laws that are still in force. Also, corporate crime enforcement in Indonesia is divided amongst different agencies.
Law No. 1/2026 also amended several of these laws, including the ones that define corporate crimes. It reclassified their fines into the KUHP’s categories, with higher ceilings where the offence produced a financial gain.
Companies therefore need to map corporate criminal liability in Indonesia on two layers. The first is the KUHP. The second is every sectoral regime that touches their business.
Table 7: Main sectoral regimes with corporate criminal exposure
| Area | Law | Main Enforcer |
|---|---|---|
| Corruption | Law 31/1999 as amended by Law 20/2001 | KPK, Attorney General’s Office, Police |
| Money laundering | Law 8/2010 | PPATK (analysis), law enforcement |
| Environment | Law 32/2009 as amended by the Job Creation Law | Ministry of Environment, Police |
| Taxation | Law 6/1983 on General Tax Provisions, as amended | Directorate General of Taxes |
| Personal data | Law 27/2022 | PDP supervisory authority |
| Competition | Law 5/1999 | KPPU, courts |
| Consumer protection | Law 8/1999 | Police, courts |
For sector-specific guidance, see Corporate Fraud in Indonesia, Indonesia’s Personal Data Protection Regulation and Building an Antitrust Compliance Program.
A Corporate Compliance Programme that Answers the Article 48 Test
Article 48 makes “failure to prevent” a basis for liability. A working programme is therefore both a shield and, if things go wrong, evidence in DPA negotiations. In corporate compliance under Indonesian criminal law, prosecutors and judges will look for substance over form. For most companies, a strong programme is the most practical way to manage corporate criminal liability in Indonesia.
The Seven Pillars
- Board ownership: Adopt the programme by board resolution and name an accountable director. Record compliance discussions in board minutes.
- Risk assessment: Carry out an Indonesia-specific risk assessment every year. Cover licensing, procurement, customs, tax and third parties.
- Policies: Clearly define policies and procedures for anti-bribery, gifts and hospitality, conflicts of interest and third-party engagement. These policies should be written in Bahasa Indonesia in addition to English and distributed to all employees.
- Third-party due diligence: Risk-rate agents, consultants, distributors and customs brokers before engagement, and include audit rights in their contracts.
- Training: Deliver role-based training with signed completion certificates. Start with staff who deal with government.
- Speak-up and investigations: Set up a protected channel for staff to speak-up about possible wrongdoing. Develop a written protocol for any investigations, including consideration of whether it is in the organization’s best interest to self-report.
- Monitoring and remediation: Audit regularly, fix what you find and report each remediation step to the boards of commissioners and directors.
Useful Indonesian and international reference points include the KPK’s corruption prevention guidance for business, SNI ISO 37001 on anti-bribery management systems, the OECD Good Practice Guidance on Internal Controls, Ethics and Compliance and UNODC guidance for business.
Infographic 4: Seven pillars of a defensible compliance programme
One Programme, Several Regimes
Many foreign groups already run programmes built for other regimes. These include the US Foreign Corrupt Practices Act and the UK Bribery Act 2010, whose section 7 offence has an “adequate procedures” defence. They also include the UK failure to prevent fraud offence, which has a “reasonable procedures” defence.
These measures can serve as a good starting point for meeting the Article 48 test, as well as the general defence against corporate crimes in Indonesia. However, they will rarely be implemented “out of the box” and will have to go through an Indonesia-specific risk assessment, written policies in the local language and third-party checks.
When Investigators Arrive
A company’s response during the first 48 hours of an investigation can materially affect the outcome. The board should approve the response plan in advance so that the company can act immediately.
| When investigators arrive: Name a response lead and call external counsel immediately.Check the investigators’ authority, documents and the scope of any search.Cooperate and do not obstruct. Never destroy or alter documents.Issue a document hold across the company, including messaging apps.Keep a log of everything taken and everyone interviewed.Brief the board the same day.Assess early whether to seek a DPA, since the window opens once the company is named a suspect. |
Corporate Criminal Liability in Indonesia: What Boards Should do Now
Indonesia’s new framework for corporate criminal liability is now in place, and the first cases will define how it’s enforced. So, what should boards be doing now to start preparing?
- Test your existing compliance program against the five conditions of Article 48, and strengthen it, particularly with regard to third parties and with evidence of effective prevention.
- Update the due diligence process for M&A and restructuring transactions to address successor liability under the new law. Introduce a criminal risk workstream and go back in time as far as the relevant limitation period permits. In addition, review and challenge any indemnities given or received.
- Map out an investigation and response protocol that the company can put into action as soon as an incident occurs. Set up a DPA readiness plan, so it can act at once if it is named as a suspect.
Partner Perspective
What stands out most about this reform is not the existence of corporate criminal liability itself, but how far Indonesia has moved it into the mainstream of everyday corporate risk. Until now, boards could reasonably treat criminal exposure as a sector-specific concern, relevant mainly to anti-corruption, money laundering, environmental and competition compliance. That assumption no longer holds. Under the general KUHP regime, any offence can in principle attach to a company, and the test for attribution deliberately looks past formal titles to actual control and actual prevention.
In practice, I expect two issues to dominate early enforcement and client questions. The first is the “failure to prevent” and “allowed it” limbs of Article 48. These put the burden back on the board to show a working compliance programme, not a policy filed away and forgotten. Clients with mature FCPA or UK Bribery Act programmes often assume those frameworks travel well into Indonesia. They do not, without an Indonesia-specific risk assessment, Bahasa Indonesia documentation, and real third-party diligence on the agents and brokers who actually create risk on the ground. The second is successor liability in M&A. Deal teams have historically treated restructuring, and particularly distressed acquisitions, as a way to leave legacy liabilities behind. Article 132(2), as amended by Law 1/2026, closes that route for criminal exposure. Finally, the deferred prosecution agreement is the single most important practical development for companies that find themselves under investigation. Early, documented cooperation is now explicitly rewarded, both in the DPA decision itself and in sentencing under Article 56. Boards should have an investigation response protocol and a DPA readiness assessment in place before an incident occurs, not after. Waiting until a company is named a suspect to start thinking about these questions will put it at a real disadvantage.
Afriyan Rachmad, Partner
Frequently Asked Questions
1. What is corporate criminal liability in Indonesia under the new Criminal Code?
It is the rule that a company itself can be prosecuted and punished for a crime. Since 2 January 2026, Article 45 of the KUHP treats corporations as subjects of criminal law. An offence by the company’s people, or by those who control it, becomes the company’s offence where one of the Article 48 conditions applies. These include unlawful benefit and failure to prevent.
2. Does corporate criminal liability apply to PT PMA companies and their foreign parent companies?
Yes. Corporate criminal liability in Indonesia applies to every PT PMA, because a PT PMA is a limited liability company under Article 45(2). A foreign parent can also be caught as a controller, order giver or beneficial owner under Article 47, even without a board seat. Enforcement against an offshore entity has practical limits. However, its executives and its Indonesian assets and licences remain exposed.
3. Can directors and board members face personal criminal liability for corporate acts?
Yes. Under Article 49, corporate criminal liability in Indonesia can extend to functional management as well as the company. The KUHAP allows prosecutors to charge directors and the company together (Article 332). Commissioners with oversight roles can also be exposed. The business judgment rule protects directors against civil claims, but it is not a criminal defence in itself.
4. Does resigning as a director end personal exposure?
No. Liability attaches to conduct at the time it happened, not to the position someone holds later. The state can prosecute until the limitation period expires. Under Article 136, that ranges from 3 years to 20 years, depending on the seriousness of the offence. Former directors should keep records of their decisions and the advice they received.
5. What criminal sanctions and fine categories can be imposed on companies in Indonesia?
Corporate fines start at Category IV (Rp200 million) and reach Category VIII (Rp50 billion). Where that is insufficient, Article 121(3) lets the judge raise the ceiling to 10% of the prior year’s annual profit. This is discretionary, not an automatic add-on. Courts can also impose twelve additional penalties, such as licence revocation and dissolution, and three measures, including a takeover of the company.
6. What is a Deferred Prosecution Agreement (DPA) under Law No. 20 of 2025 (KUHAP)?
A DPA is an agreement under Article 328 that suspends prosecution of a company while it meets agreed conditions. Only corporations can use it. The company can apply as a suspect, during the investigation, until the case goes to court. Conditions usually include restitution and compliance reforms. A court must approve the agreement and monitors performance.
7. What happens to corporate criminal exposure during an M&A deal or group restructuring?
It stays, because corporate criminal liability in Indonesia now survives most corporate events. Under Article 132(2), as amended by Law 1/2026, prosecution does not lapse on bankruptcy, a change of name, a merger, a consolidation, an acquisition, a demerger or dissolution. Buyers should therefore run criminal-risk due diligence, negotiate specific indemnities and escrow, and integrate compliance quickly after closing.
8. Will a compliance programme stop a prosecution?
Not automatically. However, it directly answers the “failure to prevent” and “allowed it” conditions in Article 48. It also supports a DPA application and counts in sentencing, where Article 56 lists the company’s track record and cooperation as factors. The programme must work in practice. A policy on file with no evidence behind it carries little weight.
9. Do the new rules apply to conduct before 2026?
Generally, conduct before 2 January 2026 remains subject to the law in force at the time. Under Article 3 of the KUHP, however, a later law applies unless the earlier law is more favourable to the offender. Historic conduct can therefore still be prosecuted under the old sectoral regimes, so due diligence must look back as well as forward.
About Nusantara DFDL Partnership
Nusantara DFDL Partnership (NDP) is an Indonesian law firm and a member of the DFDL network, which operates across Southeast Asia. NDP advises foreign corporations, institutional investors, and Indonesian businesses across a full suite of corporate legal services, including corporate advisory, mergers and acquisitions, foreign direct investment, joint ventures, employment law, real estate, dispute resolution, restructuring, and cross-border transactions. NDP works with clients across sectors including digital infrastructure, financial services, energy, manufacturing, and property.
Disclaimer
This article is for general informational purposes only and does not constitute legal advice. Regulatory requirements in this area are subject to change. Readers should seek legal advice before taking steps to restructure, merge, transfer, dissolve, or otherwise reorganise an Indonesian entity or group.
