Introduction

Indonesia's corporate criminal liability regime entered a new phase on 2 January 2026, when Law No. 1 of 2023 on the Criminal Code, as amended by Law No. 1 of 2026 on Criminal Penalty Adjustments (the "New Criminal Code"), and Law No. 20 of 2025 on the Criminal Procedure Code (the "New Criminal Procedure Code") became effective.

The new framework changes the general architecture of corporate criminal liability. The New Criminal Code places corporate criminal liability in the General Part of Indonesia's criminal law, while the New Criminal Procedure Code provides a dedicated chapter on corporate proceedings. The framework therefore addresses both the corporation and individuals who may bear responsibility alongside it.

A central distinction under the new regime is that corporate and individual responsibility are connected but legally distinct. The framework requires separate consideration of the basis for attributing an offence to the corporation and the basis for imposing responsibility on the individuals who manage, instruct, or control it.

Corporate and Management Liability: Previous and New Framework

Before the new Codes took effect, Indonesia had no single general framework for corporate criminal liability under the former Criminal Code and Criminal Procedure Code. Corporate liability was mainly recognised through sector-specific statutes, while procedural gaps were supplemented by instruments such as Supreme Court Regulation No. 13 of 2016 (“PERMA 13/2016”).

As a result, attribution of offences to corporations, management responsibility and procedures for corporate defendants depended substantially on the applicable sectoral legislation. The new Codes bring these matters into the general framework of criminal law and criminal procedure. 

The Starting Point: Corporate and Management as Separate Subjects

Article 45 of the New Criminal Code recognises the corporation as a subject of criminal offences and broadly covers legal entities and certain non-incorporated organisations. Articles 46 and 47 identify persons through whom a corporate offence may be committed, including management holding a functional position, persons acting through employment or other relationships for or in the interests of the corporation, and instructing parties, controllers or beneficial owners capable of controlling it.

Article 48 provides the link between such conduct and corporate responsibility. A corporate offence may be attributed to the corporation where the conduct falls within its business or activities, unlawfully benefits it, is accepted as corporate policy, reflects a failure to take necessary preventive or compliance measures, or is allowed to occur.

Articles 45–48 therefore establish the corporation as a legal subject distinct from the individuals whose conduct may connect the offence to it. They provide the foundation for corporate responsibility, while the next question is whether responsibility also extends to particular individuals.

When Corporate Liability Reaches the Individuals Behind It

Article 49 of the New Criminal Code addresses that second question. Article 49 of the New Criminal Code provides that responsibility for a corporate offence under Article 48 of the New Criminal Code may be imposed on the corporation, management holding a functional position, the instructing party, the controller, and/or the beneficial owner. The official elucidation of Article 49 of the New Criminal Code states that the provision is intended to separate the criminal act from criminal responsibility. 

These categories are not limited to directors or persons appearing on an organisational chart. They also include persons who give instructions, exercise control or hold beneficial ownership, including those whose influence operates outside formal management. In businesses with layered delegation or informal centres of control, actual function may therefore be as relevant as formal title.

The New Criminal Code places the corporation and relevant individuals within the same corporate liability framework while treating them as different subjects of responsibility. The same corporate offence may provide the factual setting for both, but Article 49 distinguishes responsibility imposed on the corporation from responsibility that may also be imposed on specified individuals.

This separation does not mean that corporate and individual responsibility operate independently. The same conduct may be relevant to both, but the legal inquiry remains subject-specific. Conduct attributable to the corporation does not by itself eliminate the need to identify the basis for imposing responsibility on a particular individual.

A New Procedural Framework for Corporate and Management Liability

The New Criminal Procedure Code gives procedural form to this framework. Article 326(1) states that responsibility for a corporate offence is imposed on the corporation and the person responsible for the corporation. Article 326(2) defines that person as management holding a functional position, the instructing party, the controller, or the beneficial owner.

Article 327 regulates corporate representation and examination. A corporation may be represented by a responsible person at the inquiry stage and must be represented during examination at the investigation stage. If it fails to appear or appoint a representative after a valid summons, the investigator may designate a responsible person and order that person to be brought compulsorily. Article 327 also provides corporate-specific restorative justice requirements, including first-time offending, compensation or restitution, and corrective measures.

Article 328 introduces the DPA, which applies only to corporate offences. It is directed toward legal compliance, restoration of loss, and efficiency in criminal justice. An application may be made before the case is transferred to court; the public prosecutor may accept or reject it, and the resulting agreement is subject to judicial review before approval.

Articles 329–332 address prosecution and adjudication. Article 329 requires a corporate indictment to identify the corporation and the responsible person representing it. Article 330 addresses responsibility where a corporation undergoes merger, consolidation, separation, or dissolution, with further procedures to be regulated by Government Regulation. Article 331 permits sanctions and/or measures against the corporation without precluding punishment of other perpetrators proven to have been involved. Article 332 allows the corporation and its responsible person to be brought jointly as defendants.

These provisions are significant because the former Criminal Procedure Code contained no equivalent corporate chapter. Corporate representation, alternative resolution, indictment, restructuring and joint proceedings are now addressed directly in the general law of criminal procedure.

One Corporate Offence, Different Bases of Responsibility

Read together, the two Codes establish corporate and management liability as related but distinct. The New Criminal Code governs attribution of conduct to the corporation and identifies persons who may bear responsibility, while the New Criminal Procedure Code provides the procedures for examining, prosecuting and trying them.

Evidence may overlap between corporate and individual responsibility. Board resolutions, delegation matrices, internal communications, compliance reports and escalation records may demonstrate both corporate decision-making and individual involvement. However, their legal significance depends on the subject examined: Article 48 focuses on corporate benefit, policy, prevention and tolerance, while Articles 49 and 326 address individuals connected to management, instruction, control and beneficial ownership. Article 331(3) also covers other perpetrators proven to be involved.

The framework therefore requires consideration of both organisational conduct and the basis connecting responsibility to each subject.

What the New Framework Means for Corporate Decision-Making

For corporations, the practical consequence is that decision-making should be capable of being reconstructed. Authority matrices, approvals, delegation instruments, internal instructions and escalation records may help determine whether conduct represented an institutional decision, the act of particular individuals, or both. Such records do not determine criminal liability by themselves, but they can make the allocation of authority and control more visible.

Article 48 also makes preventive measures, mitigation of greater impact, and legal compliance relevant to corporate responsibility. The question is therefore not only whether a policy existed on paper, but also who was responsible for implementing it, how risks were escalated and what response followed.

For management, formal title is likewise an incomplete indicator of exposure. A person outside the conventional board structure may still be relevant as an instructing party, controller or beneficial owner. Corporate criminal risk management should therefore trace actual decision-making and control rather than rely solely on the organisational chart.

Conclusion

The New Criminal Code and New Criminal Procedure Code establish a more comprehensive statutory framework for corporate criminal liability in Indonesia. The former recognises the corporation as a criminal-law subject, provides general attribution rules and identifies individuals to whom responsibility may extend, while the latter provides dedicated procedures for bringing those subjects through the criminal process.

Corporate liability and management liability may arise from the same corporate offence, but the new framework places responsibility on legally distinct subjects and identifies different considerations relevant to each. Understanding where institutional conduct ends and individual involvement begins will therefore be increasingly important in navigating criminal exposure under Indonesia's new regime.

This article is intended for general informational purposes only and does not constitute legal advice. For legal assistance or inquiries specific to your situation, please contact us at info@adplaws.com.