Indonesia Introduces New Criminal Code, and Corporations Must Be More Cautious
From Personal Risk to Business Continuity Risk
This shift reflects a change in criminal law policy in response to the realities of the modern economy, where serious offenses are often committed through corporate structures and unlawful benefits remain within the business entity.
After more than a century of reliance on the Old Criminal Code as a colonial legal framework in force since 1918, Indonesia enacted Law No. 1 of 2023 on the Criminal Code (“New Criminal Code”). Since its entry into force in January 2026, corporations are positioned as subjects of criminal law, directly and independently liable and subject to prosecution as defendants, with legal consequences that threaten the corporation’s existence.
This shift reflects a change in criminal law policy in response to the realities of the modern economy, where serious offenses are often committed through corporate structures and unlawful benefits remain within the business entity. By expanding criminal exposure beyond individuals to include significant fines, suspension of business activities, licence revocation, and corporate dissolution, the New Criminal Code directly links criminal liability to business continuity.
Broad Legal Subjects: Piercing the Corporate Veil
The New Criminal Code defines corporations quite broadly, encompassing both legal entities and non-legal entities, so that the form of business organization does not shield a corporation from criminal liability.
Departing from the previous Criminal Code inherited from the Dutch colonial era, the New Criminal Code no longer determines corporate liability exclusively for individuals holding formal positions within the corporate structure. The scope of corporate criminal liability has been expanded to include parties exercising actual control over corporate policies and business activities, thereby expanding liability to parties who control, direct, or allow criminal conduct, including instructing parties and beneficial owners, even if they are outside the formal corporate structure.
Public Prosecutors can prosecute the corporation, its management, instructing parties, or all of them jointly, cumulatively, or alternatively.
Article 48 of the New Criminal Code defines when a criminal act can be attributed to a corporation by assessing the functional link between the corporation’s conduct, business activities, unlawful benefits, and failures in control or prevention.
Governance failures could amount to corporate crimes
Article 48 of the New Criminal Code defines when a criminal act can be attributed to a corporation by assessing the functional link between the corporation’s conduct, business activities, unlawful benefits, and failures in control or prevention.
A criminal act can be attributed to a corporation if any of the following criteria are met:
a. Conducted within the scope of the corporation’s business activities. For example, a pharmaceutical corporation producing and selling medicines without the required permits and using ingredients that do not meet safety or quality standards.
b. Unlawfully benefiting the corporation. This can occur when a corporation prioritizes achieving sales target and cutting corners over upholding ethical values.
c. Accepted or implemented as corporate policy. For instance, a logistics corporation tolerating drivers exceeding statutory driving-hour limits to meet delivery targets.
d. Failure to implement necessary preventive measures, such as a corporation’s failure to question suspicious business practices and unverified executive actions.
e. Allowing the commission of a criminal act. A corporation turning a blind eye to policy violations could ‘allow’ fraudulent activities to continue undetected.
These criteria show that corporate criminal liability under Article 48 does not depend merely on explicit management instructions. In particular, the failure-to-prevent and omission criteria under Article 48 (d) and (e) reflect a shift in criminal risk from intent-based misconduct to governance failure, where liability may arise from managerial negligence, unenforced policies, or ineffective oversight. Compliance, therefore, functions as a substantive determinant of criminal liability, rather than a post-event administrative formality.
Financial and Existential Consequences for Corporations
Where the criteria under Article 48 are met, the New Criminal Code imposes sanctions that directly impact the corporation’s business continuity. The primary sanction is a fine of up to IDR 50 billion.
If the fine is not paid, the state can seize and auction the corporation’s assets or earnings, and where the proceeds are insufficient, the court can impose a substitute sanction in the form of a partial or total suspension of business activities.
In addition, corporations may be subject to supplementary sanctions, including licence revocation, forfeiture of unlawful gains, and corporate dissolution, effectively terminating the corporation’s legal existence and operations.
Implications for Businesses
The New Criminal Code expands criminal liability beyond individuals formally positioned within a corporate structure to also include instructing parties, controlling parties, and beneficial owners. As a result, individuals who previously shielded themselves by remaining outside the formal corporate structure can now be held criminally liable, subject to proof of actual control over the corporation.
- Criminal Exposure to Business Continuity
Criminal exposure is no longer limited to monetary penalties but may directly affect business continuity through suspension of operations, licence revocation, forfeiture of profits, and corporate dissolution. Criminal law, therefore, operates as a direct constraint on corporate strategy and risk-taking.
- Management and Compliance under Scrutiny
Corporations must be able to demonstrate that management has implemented and enforced adequate preventive measures and internal controls. In practice, governance failures, ineffective oversight, or tolerated violations may shift criminal risk from isolated misconduct to systemic corporate liability.
Conclusion
The New Criminal Code shifts the risks of corporate crime from individual misconduct to corporate governance. Under Article 48, failures in prevention, oversight, or control may expose not only individuals but also the corporation itself to criminal liability.
Criminal sanctions can now directly impact business continuity, including substantial fines, suspension of operations, licence revocation, and corporate dissolution. In this context, compliance and internal controls are no longer merely administrative functions but play a key role in safeguarding corporations from legal risks.
Disclaimer – The views expressed in this article are the personal views of the authors and are purely informative in nature.