On 2 January 2026, Indonesia brought into force Law No. 1 of 2023 on the Criminal Code (Kitab Undang-Undang Hukum Pidana) (New KUHP), Law No. 20 of 2025 on the Criminal Procedure Code (Kitab Undang-Undang Hukum Acara Pidana) (New KUHAP), and Law No. 1 of 2026 on Harmonisation of Criminal Sanction (Penyesuaian Pidana) (Law 1/2026). These statutes materially recalibrate Indonesia’s criminal enforcement landscape as it applies to corporations.

At a substantive level, the New KUHP expressly recognises corporations as subjects of criminal law, moving beyond the previous framework in which corporate criminal liability was addressed primarily through sector-specific legislation. It clarifies whose acts and omissions may be attributed to a corporation and sets out the circumstances in which corporate fault may be established. Law 1/2026 further strengthens the sanctions framework, including, in appropriate cases, by allowing courts to increase fines by reference to a corporation’s annual profit.

From a procedural perspective, the New KUHAP introduces a court-approved Deferred Prosecution Agreement (DPA) as an alternative mechanism for resolving corporate criminal matters. This offers eligible corporations an additional pathway for addressing potential offences, with the possibility of avoiding prosecution, subject to judicial oversight and compliance with specified conditions.

In addition, the New KUHAP and Law 1/2026 recognise successor liability concepts that may have significant implications for group reorganisations and M&A transactions. In this article, we outline the key developments and highlight practical considerations for corporate governance, compliance programmes, investigation readiness, and transaction risk allocation.

Under the previous Criminal Code, corporations were not expressly recognised as subjects of criminal law. Instead, corporate criminal liability was regulated in a fragmented manner across various sector-specific statutes (Sectoral Laws), including:
 

• the Anti Corruption Law; 
• the Anti-Money Laundering Law; and
• the Environmental Law. 

As a result, it was generally understood that corporate criminal liability arose only in respect of offences for which the relevant Sectoral Laws expressly extended liability to corporations.

The New KUHP seeks to address this gap by expressly recognising corporations as subjects of criminal law. This broadens the corporate liability framework, exposing corporations not only to liability for offences specifically designated under Sectoral Laws, but also to liability for general offences under the New KUHP, subject to the applicable elements of liability.

The New KUHP and New KUHAP also adopt a broad definition of “corporation”, which includes:
 

• legal entities such as a limited liability companies, foundations, cooperatives, state-owned enterprises (SOEs) and regional-owned enterprises (ROEs); 
• associations, whether or not they have legal entity status; and 
• partnerships.

The New KUHP clarifies (i) whose conduct may be attributed to a corporation as a “corporate criminal offence”, and (ii) the circumstances in which such an offence may give rise to corporate criminal liability.

The “who” (attribution). A criminal offence committed in the course of a corporation’s business or activities may be treated as a corporate criminal offence where it is committed by:
 

• management with functional authority;
• individuals acting for or on behalf of the corporation, whether under an employment relationship or otherwise; or
• controllers, order-givers (pemberi perintah), or beneficial owners, even if they fall outside the corporation’s formal organisational structure, provided they are able to influence or determine the corporation’s conduct.
   

The “how” (liability triggers). The New KUHP further sets out a list of circumstances in which a corporation may be held criminally liable, namely where: 
 

• the offence falls within the scope of the corporation’s business or activities;
• the offence unlawfully benefits the corporation;
• the offence is accepted, endorsed or treated as corporate policy;
• the offence results from inadequate preventive, supervisory, or compliance measures; and/or
• the offence occurs because the corporation knowingly permits it or fails to prevent it.
   

The inclusion of “and/or” suggests these factors may operate as alternative bases for imposing corporate liability, rather than as strictly cumulative requirements. That said, it remains to be seen how courts will apply these factors in practice, including whether they will be treated as stand-alone thresholds or assessed holistically when determining:

(a) whether an offence is properly attributable to a corporation; and 
(b) whether corporate fault has been established.

Extension of criminal liability to individuals. The New KUHP, as amended by Law 1/2026, also clarifies that  corporate criminal liability may be extended to relevant individuals, including management with functional authority, order-givers (pemberi perintah), controllers, and, where applicable, beneficial owners. 

3.1 Principal sanctions – Fines of up to 10% of a corporation’s annual profit

The New KUHP provides that the principal criminal sanction applicable to a corporation is a criminal fine. In general, fines range from IDR 200 million to IDR 50 billion.  In addition, Law 1/2026 provides that courts may, at their discretion, increase the fine to up to 10% of the corporation’s annual profit for the financial year immediately preceding sentencing.

Under the New KUHP, a criminal fine (pidana denda) must be paid within the period specified in the court judgment and may be paid in instalments if so ordered. The New KUHAP complements this framework by prescribing the enforcement timeline: fines must be paid within one month after the judgment becomes final and binding (berkekuatan hukum tetap), with a possible one-month extension for valid reasons. If a corporation fails to pay within this prescribed timeframe, the public prosecutor (jaksa) may seize and auction the corporation’s assets to satisfy the fine.

3.2 Additional sanctions and measures

Historically, the Supreme Court issued Supreme Court Regulation No. 13 of 2016 on Guidelines for Handling of Corporate Crime (SCR 13/2016). SCR 13/2016 recognises a range of additional criminal sanctions (pidana tambahan) that may be imposed alongside the principal sanction for corporate criminal liability, including confiscation of assets, substitute payments, compensation, restitution, and remediation of damage arising from the criminal act.

The New KUHP, as amended by Law 1/2026, expands the range of additional criminal sanctions that may be imposed on corporations. These include:
 

• compensation;
• remediation of harm;
• fulfilment of neglected obligations;
• customary obligations;
• funding of job‑training programmes;
• confiscation of assets or criminally obtained profits;
• publication of the judgment;
• revocation of certain licences;
• permanent prohibitions on carrying out certain conduct;
• full or partial closure of business premises;
• full or partial suspension of business activities; and
• dissolution of the corporation.

Failure to comply with additional criminal sanctions may result in further seizure and auction of the corporation’s assets.

Additionally, the New KUHP introduces new “measures” (tindakan) applicable to corporations, including government takeover, supervision, and guardianship. Further implementing regulations are expected to clarify how both principal and additional criminal sanctions, as well as these “measures”, will be enforced in practice.

The New KUHAP and Law 1/2026, which amends the New KUHP, recognise the concept of successor liability. In particular, they make clear that corporate actions such as mergers, consolidations, demergers/splits, or dissolutions do not, in and of themselves, extinguish criminal liability.

That said, the New KUHAP mandates further implementing regulations to clarify how liability will be allocated among surviving, successor, or receiving entities. This forthcoming guidance is expected to have material implications for M&A structuring, group reorganisations, and post transaction risk allocation, including the scope of due diligence, the use of deal protections, and integration planning.

The New KUHAP introduces a court-approved Deferred Prosecution Agreement (DPA) as an alternative mechanism for resolving corporate criminal cases. The DPA regime applies exclusively to corporate offences and allows the public prosecutor to suspend prosecution against a corporation, subject to the corporation undertaking specified remediation and compliance commitments.

The process is initiated when a corporation applies for a DPA before the case is transferred to court. If the prosecutor is prepared to proceed on that basis, the proposed DPA is submitted to the court for review.

The court then convenes a hearing to assess whether the agreement is lawful and appropriate, taking into account factors such as the proportionality of the proposed obligations, the interests of victims and the public, and the corporation’s capacity to comply. If approved, prosecution is suspended for the agreed period, during which the corporation must implement the agreed corrective measures.

Typical DPA obligations may include payment of restitution to victims, the implementation or enhancement of compliance and governance frameworks, periodic reporting, cooperation with law enforcement, and other corrective measures. If the corporation fulfils the agreed obligations within the specified timeframe, the matter may be concluded without further prosecution. Conversely, non-compliance will allow the prosecutor to resume prosecution without the need for further court approval.

Overall, the DPA framework signals a policy shift towards incentivising remediation and compliance, rather than relying solely on punitive measures.

A flowchart illustrating the DPA process under the New KUHAP is available in the Appendix.

Taken together, the New KUHP, the New KUHAP, and Law 1/2026 materially recalibrate the corporate criminal enforcement landscape in Indonesia. By expressly recognising corporations as subjects of criminal law, clarifying rules of attribution and corporate “fault”, and significantly expanding the range and practical enforceability of corporate sanctions, including fines that may be uplifted by reference to annual profit, these reforms increase both the breadth of potential exposure and the severity of enforcement outcomes.

The introduction of a court-approved DPA framework, alongside the continued prospect of individual liability for management, controllers, and beneficial owners, further underscores the importance of robust and proactive compliance and remediation strategies.

The recognition of successor liability elevates criminal risk due diligence and deal protections to core considerations in M&A transactions and corporate restructurings. While certain operational aspects will depend on implementing regulations and judicial practice, corporations should treat these reforms as a prompt to reassess governance structures, compliance controls, investigation readiness, and transaction risk allocation in Indonesia.

If you have questions regarding these developments or how they may impact your business⁠⁠, please contact the authors or any member of our dispute resolution team.