As Indonesia’s new criminal codes take effect, local and foreign businesses are in a race to keep pace or pay the price. Bimal Mirwani reports
The start of 2026 marked a turning point for Indonesia. On 2 January, the country promulgated a comprehensive criminal law framework, comprising Law No. 1 of 2023 on the Criminal Code (KUHP), Law No. 20 of 2025 on the Criminal Procedure Code (KUHAP), and Law No. 1 of 2026 on the Harmonisation of Criminal Sanctions.
Although these laws have only been in force for a few months, the message is clear for in-house counsel and business leaders operating in Southeast Asia’s largest economy: Indonesia’s new criminal law architecture is not merely a legislative update, but a systemic transformation that aims to redefine corporate exposure, enforcement dynamics and compliance expectations in the years ahead.
Randi Ikhlas Sardoni, vice president of the Indonesian Corporate Counsel Association (ICCA) in Jakarta, captures the significance of the reforms, saying they signal “a fundamental shift towards a more integrated, modernised and enforcement-oriented legal regime”.
The nitty-gritty
At substance level, the KUHP significantly expands and clarifies the concept of corporate criminal liability. Exposure now extends beyond corporate entities to encompass beneficial owners, directors, commissioners, individuals exercising effective control, and potentially external related parties such as consultants.
Chalid Heyder, office managing partner at Hogan Lovells Dewi Negara Fachri & Partners (Hogan Lovells DNFP) in Jakarta, says corporate liability may arise not only from direct misconduct, but also from “inadequate supervision, weak internal controls, or failures to prevent or respond to wrongdoing”.
The KUHP is reinforced by Law No. 1 of 2026, which addresses previously fragmented and inconsistent regimes by aligning criminal provisions across numerous sectoral laws with the KUHP framework. The law also broadens the reach of enforcement and standardises penalties, promoting greater consistency and fairness.
On the procedural side, the KUHAP establishes a more structured and modern framework governing investigations, evidence and prosecution processes. Key developments include the introduction of mechanisms such as the deferred prosecution agreement (DPA). Greater emphasis is also placed on restorative justice, which is limited to specific offences and requires consent from both the victim and the accused to proceed. The KUHAP also codifies procedural safeguards while enhancing enforcement flexibility.
Down to business
Companies are already reassessing their risk exposure, with many undertaking a thorough review of whether existing procedures require adjustment. “Much like our approach to any significant legislative change, the legal and compliance department assesses the new laws and weighs whether they pose a direct, significant or immediate risk to the business. If so, this might result in an accelerated roadmap of action items,” says Widia Hutagaol, head of legal and compliance at Roche Indonesia in Jakarta.
She and Sardonihave identified several priority areas for businesses, including addressing gaps in operational workflows and internal policies. Sardoni says there is a need for “scenario-based testing and simulation”, with enterprises encouraged to “conduct mock exercises” to “test both procedural readiness and decision-making under pressure”.
He underscores the importance of “cross-functional implementation”, ensuring that legal and compliance teams work closely with human resources, operations and senior management “to ensure that policies are not only adopted but effectively embedded in day-to-day business practices”.
The challenge is even more pronounced for multinational companies. “MNCs often have more mature compliance frameworks, they also face higher scrutiny and a lower appetite for reputational risk,” says Hutagaol.
Sardoni notes that foreign businesses may face a “more complex impact compared to local companies”. Key pressure points include localisation challenges in adapting to the new legal landscape, heightened reputational exposure from regulators, media and stakeholders, increased personal liability risks for foreign directors and non-director executives overseeing Indonesian operations, and the need to appoint in-country compliance personnel while strengthening engagement with local counsel and regulators.
Michel Rako, managing partner at DeHeng ARKO in Jakarta, says foreign businesses may also be hindered by “language barriers, differences in legal culture, and reliance on local partners or management, which can increase vulnerability to compliance gaps”.
Heyder advises that senior management outside Indonesia “may be expected to demonstrate meaningful engagement with compliance, risk mitigation and remediation, rather than relying solely on local management assurances”.
From an enforcement risk perspective, Sardoni stresses the need for a proactive approach, as businesses should expect “greater scrutiny during investigations, clearer protocols around searches, seizures and examinations, and a higher expectation of procedural readiness”.
Heyder says that third-party conduct such as the use of agents, intermediaries, consultants and vendors is also likely to draw increased attention: “Enforcement attention may focus less on ‘who did what’ and more on why the organisation allowed it to happen.”
These developments place greater emphasis on the need for clearly defined decision-making authority, internal investigation and whistleblowing mechanisms, evidence readiness, and preparedness in response to raids, searches, seizures and requests for information.
A key development under the new criminal law framework is the expansion of corporate criminal liability. R Bayu Perdana, a partner at RBP Asia in Jakarta, says that liability now extends to “failures to prevent violations or ensure adequate compliance controls”, meaning “regulatory breaches previously treated as administrative may escalate into criminal exposure”.
This shift is compounded by tougher sanctions. As Rako warns, penalties now extend well beyond fines, as “companies may face severe consequences including revocation of business licences, suspension or closure of operations, asset seizure, and even dissolution”.
While businesses across the spectrum will need to adapt, certain sectors will face heightened scrutiny. Highly regulated industries, particularly natural resources, oil and gas, and businesses involving the use of state funds, are expected to face the greatest exposure.
Rako says that, given Indonesia’s economic reliance on these sectors, companies operating within them face “greater exposure to criminal enforcement, particularly in relation to environmental damage, licensing compliance, and reporting obligations”.
Perdana says the Attorney General’s Office is likely to focus on mining, environmental, and oil and gas companies, particularly in relation to “conduct that materially affects the livelihoods of large segments of the Indonesian population”.
Compliance expectations are being fundamentally reshaped. “Compliance can no longer be treated as a formalistic or documentation-driven exercise,” says Sardoni, but must instead function as “an active second line” of defence.
“Businesses operating in Indonesia must adopt a holistic, proactive and integrated compliance framework,” he adds. In practice, this requires embedding risk-based controls, strengthening internal investigations, and ensuring evidence readiness in an increasingly structured enforcement environment.
Rooting out corruption
A defining feature of Indonesia’s criminal law overhaul is its sharpened focus on corruption, particularly where corporate actors intersect with state authority.
This emphasis reflects both longstanding structural risks and renewed enforcement co-ordination. “Corruption-related conduct and abuse of authority will remain a primary focus, especially where corporate actors are involved either directly or indirectly,” says Rako.
The reforms reinforce a regulatory environment in which businesses are held accountable not only for direct misconduct, but also for their role, whether active or passive, in broader corruption ecosystems. “State-owned enterprises must maintain written codes on business ethics, anti-corruption, and fair competition,” says Tri Junanto Wicaksono, corporate affairs and legal director at PT Amerta Indah Otsuka in Jakarta. “Private companies are expected to adopt similar standards as best practice and for risk mitigation.”
Perdana says that enforcement bodies are expected to be more closely aligned in pursuing corruption-related activity. “The Corruption Eradication Commission (KPK) and the Indonesian National Police’s Corruption Crimes Directorate (Kortas Tipidkor) are expected to take a similar approach, aligning their enforcement priorities with the Attorney General’s Office by maintaining a strong focus on asset recovery,” he says.
This suggests a more co-ordinated enforcement strategy, with disgorgement (court-imposed repayment of ill-gotten gains) emerging as a key objective.
Exposure is particularly acute for businesses operating in sectors with significant state interaction. “Corporate conduct in highly regulated industries – including finance, oil and gas, environmental and mining sectors – along with activities involving significant government interaction … is now most likely to face heightened scrutiny,” says Perdana.
Areas such as licensing, concessions and public procurement, where regulatory discretion and government decision making are pivotal, are especially vulnerable to scrutiny around bribery, abuse of authority and unlawful influence.
The intensified focus on corruption comes reflects the magnitude of the problem. “Indonesia continues to face significant corruption risks, as reflected in its Corruption Perceptions Index ranking of 109 out of 182, well below regional peers such as Vietnam, Malaysia and Timor Leste,” says Perdana. The criminal law reforms can therefore be seen as part of broader efforts to close enforcement gaps and bolster institutional credibility.
For in-house counsel and compliance leaders, the implications are clear: anti-corruption frameworks must be robust, operationally embedded and carefully tailored, as enforcement becomes increasingly co-ordinated, targeted and outcome-driven.
The enforcement challenge
While Indonesia’s new criminal law framework under the KUHP, KUHAP and Law No. 1 of 2026 promises greater accountability, its effectiveness will ultimately hinge on enforcement, and deep challenges remain.
The new mechanisms have been introduced to “provide a pragmatic alternative to protracted legal proceedings”, says Rako, but these procedural innovations also carry inherent risks.
While alternative resolution mechanisms may strengthen compliance and corporate governance frameworks, Rako cautions that “in the absence of adequate safeguards, they may also be susceptible to misuse, including risks of extortion and corruption”.
Questions also remain around the technical implementation, including how restitution and asset recovery are calculated. “[There is a need for] a clear, written mechanism allowing corporations to challenge or verify the government’s calculations to ensure fairness and legal certainty,” says Perdana.
Institutional alignment, along with consistency in enforcement, are also shaping up to be key concerns. “From an enforcement perspective, one of the key challenges will be ensuring consistency and co-ordination among law enforcement agencies, the police, prosecutors, and the judiciary,” says Rako.
He says the transition to a new legal regime is expected to create “variations in interpretation and application, particularly in the early stages,” raising concerns around predictability and even-handed enforcement.
These risks are compounded by capacity constraints. “A key challenge for authorities will be ensuring that enforcement aligns with the intent of the reforms,” says Perdana, which requires “sufficient resources and personnel of proven integrity to avoid a gap between the law on paper and its implementation in practice.” He says authorities will also need the technical expertise to investigate complex corporate activity.
For companies, uncertainty around enforcement is already a growing issue. Perdana says that “compliance is no longer limited to administrative filings, and the blurred boundary between administrative and criminal exposure” complicates risk assessment.
At the same time, he acknowledges that adjustment may take time, particularly for domestic businesses. “Many local companies may lack the internal systems, expertise, or resources needed to adjust quickly,” he says, while confirming that several indicated they need time to “understand how the reforms will be applied in practice”.
It is not just local businesses that find themselves in the crosshairs as foreign businesses potentially face an added layer of complexity. “Foreign companies are often subject to heightened regulatory scrutiny. They may also face greater exposure to enforcement risks due to the complexity of operating across jurisdictions,” says Rako.
The activities of foreign firms, particularly those of a cross-border nature, will also come under increased scrutiny. “Foreign business groups face heightened exposure in the context of cross-border transactions,” says Wicaksono. “Risks associated with mergers, acquisitions and restructurings may persist beyond jurisdictional boundaries, requiring more rigorous due diligence and post-transaction compliance integration.”
Perdana says the primary concern foreign entities may face “relates to the gap between written legal norms and actual enforcement in Indonesia, particularly the consistency, predictability and integrity of implementation”. In this regard, both domestic and international stakeholders are aligned on a common concern. “Clients have highlighted the importance of clarity, consistency and effective implementation,” he says.
Heyder says that clients are also “keen to understand how new tools such as DPAs, plea?type mechanisms and expanded interim measures affecting assets will operate”.
He says the way in which all parties overcome the initial teething troubles will impact the overall success of the legal reform. “Both regulators and businesses are operating within a learning curve. How these challenges are managed in practice will significantly shape the credibility and effectiveness of Indonesia’s new criminal law framework.”
Welcome to the new age
Indonesia is already living in the new era of its criminal law reform. The KUHP, KUHAP and Law No. 1 of 2026 are here to stay, but their ultimate effectiveness rests on how swiftly businesses adapt, whether the reforms succeed in tackling corruption, and how early implementation challenges are addressed.
Both Rako and Heyder say it’s too early to draw firm conclusions on the immediate enforcement priorities. Even so, Rako confirms that “many clients welcome the modernisation of these laws” as they are “seen as a step toward aligning Indonesia’s legal framework with evolving international standards”. Businesses are also moving to align their operations with the new regime, with Heyder fittingly concluding this shift reflects “a broad awareness that criminal law risk is now firmly embedded in everyday business decision?making in Indonesia”.
