Indonesia’s New Criminal Code: What Companies Need to Know

30 Mar 2026

Regulation

Indonesia has completed one of its most significant legal reforms in decades with the full entry into force of the new Criminal Code (Kitab Undang-Undang Hukum Pidana = KUHP) and Criminal Procedure Code (Kitab Undang-Undang Hukum Acara Pidana = KUHAP) on 2 January 2026. Together, these laws introduce a more coherent and integrated framework for criminal liability and enforcement, reshaping both the scope of corporate responsibility and the approach to investigations and resolutions.

For companies operating in Indonesia, understanding these changes is no longer optional. Corporate criminal liability is now codified comprehensively within Indonesia’s general criminal law, consolidating principles that were previously scattered across sector-specific regulations such as anti-corruption and environmental statutes.

Recognition of Corporate Criminal Liability

For the first time, it is explicit that corporations themselves are recognized as subjects of criminal law. This applies broadly to limited liability companies (PTs), state-owned enterprises, foundations, cooperatives, partnerships and other business associations. Importantly, corporate liability is no longer confined to specific sectoral offenses but may arise under the general provisions of the Criminal Code.

Liability may arise not only from acts committed by directors or officers, but also by employees, agents, or other individuals acting within the scope of the company’s activities or for its benefit. The framework also captures individuals exercising effective control, including beneficial owners or de facto decision-makers, even if they do not formally hold management position.

Scope of Corporate Liability

Corporate liability may be triggered where:

the offense occurs in the course of business activities,

the company derives unlawful benefit,

misconduct is tolerated as corporate policy, or

violations result from inadequate supervision, internal controls, or compliance systems

In practice, this means that deficiencies in governance, monitoring, or risk management may themselves expose the company to criminal liability.

Individual Accountability Alongside Corporate Liability

Alongside corporate liability, the new framework clarifies the personal exposure of individuals involved in decision- making or oversight. Authorities may pursue both the company and responsible individuals in parallel. Liability is not confined to formal office holders; it extends to anyone:

exercising decision-making authority,

facilitating wrongdoing,

benefiting from criminal conduct, or

failing to act on known risks

For multinational companies, this is particularly relevant in complex, matrixed structures where responsibilities are shared, decisions are escalated informally, or oversight relies heavily on local management. Enforcement increasingly focuses on whether senior management actively engages with compliance and risk management, rather than merely approving policies at high level.

The sanctions regime has also been strengthened significantly:

Corporate fines may range from IDR 200 million up to IDR 50 billion (approximately USD 12,000 to USD 3 million), and in certain cases may be increased to up to 10% of the company’s annual profit in the preceding financial year.

In addition to monetary penalties, courts may impose a wide range of supplementary sanctions, including:

confiscation of assets,

restitution,

publication of judgments,

suspension or revocation of business licenses,

partial or full closure of operations, and ultimately dissolution of the company

The measures significantly increase regulatory and reputational risk, particularly for regulated industries.

Procedural Reforms and Flexible Resolution Mechanisms

Procedural reforms complement these substantive changes, equipping investigators and prosecutors with clearer tools for:

evidence gathering,

digital and financial investigations,

asset freezing, and

judicial oversight

At the same time, the system introduces greater flexibility in resolving cases, particularly corporate matters. Resolution mechanisms now emphasize remediation, accountability, and restoration alongside traditional sanctions.

Notably, the new Criminal Procedure Code introduces a court-approved Deferred Prosecution Agreement (DPA) regime specifically for corporate offenses. This allows companies, under certain conditions, to negotiate a structured resolution with prosecutors, typically involving payments, compliance enhancements, cooperation obligations, and remediation, in exchange for suspension of prosecution. Successful compliance with the agreed terms may result in discontinuation of proceedings.

Mergers, Acquisitions, and Corporate Criminal Exposure

The law also clarifies that mergers, consolidations, spin-offs, or liquidations do not automatically extinguish criminal liability. Corporate criminal exposure may transfer to successor entities. As a result, criminal risk assessment becomes an essential component of M&A due diligence and transaction structuring.

Practical Implications for Companies

In practice, the reforms represent an evolution rather than a complete departure from past practice. Companies are now evaluated not only on the conduct itself but also on how effectively they manage risk and respond to incidents. Clear codification reduces uncertainty but leaves little room to rely on regulatory ambiguity.

Compliance frameworks must be operational and supported by training, internal controls, reporting mechanisms, and documented oversight. Engagement from senior management and boards is increasingly critical, and early internal response to potential issues can be as significant as the underlying conduct itself.

Outlook

Looking ahead, enforcement practices will continue to develop as authorities, courts, and companies adapt to the new standards. Implementing regulations will further clarify procedural and substantive requirements, but one thing is already certain: Companies that prepare effectively – by strengthening governance, operationalizing compliance, and demonstrating proactive risk management – will be far better positioned to navigate Indonesia’s evolving criminal enforcement landscape, safeguarding both legal and reputational standing.