Why Economic Crime Requires an Organisational Perspective

The basis of corporate criminal liability is closely connected to the changing nature of economic crime. The former Criminal Code was built on the classical premise that the offender is a person. That premise became increasingly difficult to maintain as corporations acquired the capacity to mobilise capital, information, and decision-making on a scale that individuals could not. Modern commercial activity is rarely organised in such a simple manner; decisions are distributed through boards, committees, employees, subsidiaries, information systems and external intermediaries. An unlawful outcome may result from a chain of formally separate acts, an unrealistic commercial target, inadequate due diligence, a weak approval process, incentives that reward non-compliance, an ignored audit finding and a management response that permits the benefit to continue, rather than from a single signature or transfer.

Corporate criminal liability therefore addresses the possibility that fault may be organisational as well as individual. It should not, however, be understood as a rule that converts every commercial failure, regulatory breach or employee offence into a crime by the corporation. Attribution still depends on the statutory elements of the underlying offence and the connection between the conduct and the enterprise; the corporation that designed the process, allocated authority, received the unlawful benefit, accepted the practice as policy or failed to respond to repeated warning signs remains the relevant subject of inquiry, not every corporation touched by an employee’s wrongdoing. 

Corporate Crime under the New Criminal Code  

Indonesia enacted a new Criminal Code through Law No. 1 of 2023 on the Criminal Code, which was subsequently amended by Law No. 1 of  2026 on Criminal Penalty Adjustments (“Criminal Code”). The Criminal Code replaced the former Criminal Code, which had long served as the basis of Indonesian criminal law. Among its significant reforms, the Criminal Code establishes a general statutory framework for corporate criminal liability. Articles 45 to 50 of the Criminal Code establish the framework governing corporate criminal liability, including the recognition of corporations as subjects of criminal law, the attribution of criminal conduct to corporations, and the allocation of criminal responsibility between corporations and relevant individuals.

Article 45 of the Criminal Code recognises a corporation as a subject of criminal law and adopts a broad definition. It covers limited liability companies, foundations, cooperatives, state-owned and regionally owned enterprises, incorporated and unincorporated associations, firms, limited partnerships and comparable organised entities recognised by law. A publicly listed company is included because it remains a limited liability company; its public status primarily affects the governance, disclosure and market consequences that may follow from an investigation.

Articles 46 and 47 of the Criminal Code identify the persons through whom a corporate offence may be committed. The framework includes managers who hold functional positions, employees and other persons acting for, on behalf of or in the interests of the corporation within its business activities. It also covers parties, controllers, and beneficial owners who may sit outside the formal organisational structure but can control corporate conduct. The Code gives greater weight to actual function and influence than to title alone. Article 48 supplies the substantive link between the conduct and the corporation; responsibility may arise where the conduct falls within the corporation’s business or activities, unlawfully benefits the corporation, is accepted as corporate policy, is accompanied by a failure to take necessary preventive or mitigating steps, or is simply allowed to occur. These criteria direct attention to the corporation’s systems and response before, during, and after the event.

Article 49 of the Criminal Code clarifies that corporate criminal liability is distinct from, but may coexist with, individual criminal liability. Responsibility under Article 48 of the Criminal Code is imposed on the corporation, while it may also be imposed on functionally responsible managers, instructing parties, controllers and beneficial owners. This avoids the assumption that every director is automatically criminally responsible, without allowing informal control or fragmented decision-making to become a means of avoiding accountability. 

The framework reflects several established approaches to corporate attribution: identification theory, which associates the state of mind of senior decision makers with the corporation; functional perpetration, which asks whether the conduct occurred within the corporate sphere; vicarious liability, which focuses on acts performed by persons working for or representing the corporation, and organisational fault, which examines policies, systems, incentives, supervision and culture. These concepts may overlap in practice. The Code does not, however, make every corporate offence a matter of strict liability; under Article 37 of the Criminal Code, liability without proof of fault applies only where legislation expressly provides for it.

Article 50 of the Criminal Code also confirms that a corporation may rely on a justification or excuse available to the relevant responsible person when the defence is directly connected to the offence charged against the corporation. This provision is important because recognition as a criminal law subject entails not only exposure to prosecution but also access to legally recognised grounds of defence.

Implications for Company and State-Owned Enterprise

For a private limited liability company, the new framework makes the legal quality of delegation, supervision and third-party management more significant. Conduct by sales personnel, procurement teams, consultants, distributors or agents may be examined together with the authority granted to them, the incentives established by management and the corporation’s response to warning signs. Written policies remain relevant, but their practical operation is likely to carry greater evidentiary weight; a policy that is routinely disregarded, unsupported by resources or contradicted by commercial targets may not establish that the corporation took the preventive steps contemplated by Article 48 of the Criminal Code.

For a publicly listed company, the same attribution rules apply, but the surrounding regulatory effects are broader. An investigation may require assessment under capital market disclosure rules, affect dealings with investors and lenders, and test the functioning of the board of commissioners, audit committee, internal audit and risk management structures. The relevant discipline is neither automatic disclosure of every allegation nor silence until a final judgment, but a documented process for assessing materiality, legal privilege, market sensitivity and regulatory obligations.

State-Owned Enterprises are expressly included within Article 45 of the Criminal Code and are therefore subject to the same general criminal law architecture. Their position nevertheless requires attention to the interaction between company law, the state-owned enterprise statutory framework, public assignments, audit and anti-corruption law. A decision may involve both a commercial mandate and a public policy context, and the analysis should distinguish the entity’s corporate interest, the authority supporting any government assignment, the information available to the directors, and any intervention or conflict affecting the independence of the decision. Public ownership does not by itself determine criminal responsibility, just as a financial loss involving a state-owned enterprise does not by itself establish a criminal offence.

The sanctions reinforce the need for entity-specific analysis. Under Articles 118 to 124 of the Criminal Code, a corporation may face a fine as the principal punishment and additional measures such as compensation, remediation, disgorgement, publication of the judgment, licence restrictions, business closure or suspension, and dissolution. Depending on the entity, related consequences may include contractual defaults, restrictions on participation in tenders, disclosure duties, financing implications and reputational effects.

The framework is not, however, only a source of exposure. By replacing fragmented sectoral rules with a common attribution standard in the General Part, the Code gives corporations a single, more predictable set of criteria against which to design and defend their compliance systems. This has been recognized and defined in Article 50 of the Criminal Code that a corporation may rely on the same justifications and excuses available to the responsible individual, giving corporate defence counsel a clearer evidentiary target: a company that can show a genuine, functioning prevention system has a real defence, not merely a mitigating factor. For a private limited liability company and a publicly listed company, this creates an incentive to invest in governance that is otherwise difficult to justify commercially, while for a publicly listed company in particular, disclosure and audit committee scrutiny that already exists under capital market regulation is reinforced rather than duplicated. For a state-owned enterprise, a general criminal law standard that applies uniformly to state and private corporations alike may, over time, reduce the perception that state enterprises are treated as an undifferentiated source of loss whenever a commercial decision fails.

Business Judgment Rule: Its Place in the New Framework

The Criminal Code does not expressly codify the business judgment rule (“BJR”), and BJR should not be described as a new criminal law immunity. For limited liability companies, its principal statutory basis remains Article 97(5) of Law No. 40 of 2007 on Limited Liability Companies. A director may avoid personal responsibility for a corporate loss by proving, among other matters, that the loss was not caused by fault or negligence, that management was performed in good faith and with prudence for the company’s interests and purposes, that no direct or indirect conflict of interest existed, and that reasonable steps were taken to prevent the loss from arising or continuing. Similarly, Law No. 19 of 2003 on State-Owned Enterprises, as most recently amended by Law No. 16 of 2025, provides comparable statutory protection for state-owned enterprises directors. 

BJR and corporate criminal liability address different legal questions. BJR principally allocates personal responsibility for corporate loss and protects the integrity of a lawful business decision-making process, while Articles 45 to 50 of the Criminal Code determine whether an offence can be attributed to the corporation and relevant persons. Nevertheless, the facts that support BJR may also be relevant evidence in a criminal case; proper authority, adequate information, good faith, independence, a rational corporate purpose, legal review and active monitoring may assist in showing that a failed transaction was a genuine commercial decision rather than the implementation or tolerance of unlawful conduct.

The converse is equally important. A board resolution, legal opinion or risk committee paper does not legalise an unlawful objective. BJR has limited relevance where a transaction is affected by fraud, concealed conflicts, fabricated assumptions, private benefit, deliberate non-compliance or the suppression of material information. The Supreme Court’s Decision No. 121 K/Pid.Sus/2020 is frequently cited for distinguishing business loss from criminal conduct where fraud, conflict of interest, unlawfulness and intentional fault were absent. Its practical lesson is not that directors are protected whenever a decision is labelled “business judgment,” but that criminal analysis should examine the decision-making process and the relevant elements of fault rather than reason backwards from the existence of a loss.

From BJR to GCG and Risk Management

The practical value of BJR and Article 48 depends on evidence created when decisions are made and while risks are managed. Good corporate governance (“GCG”) should establish who has authority, how conflicts are identified, what information must be considered and how dissent is recorded. Risk management should then connect those decisions to monitoring, escalation, investigation and remediation. Board and committee papers should state the commercial rationale, legal basis, material assumptions, alternatives, downside scenarios and compliance risks in proportion to the significance of the transaction.

This approach should also extend beyond the boardroom. Procurement, licensing, environmental management, taxation, financing, data processing, sales incentives and the use of intermediaries may each generate different criminal risks. Risk-based due diligence, contractual safeguards, payment controls, audit rights, training, speak-up channels and consistent disciplinary measures help demonstrate how the corporation seeks to prevent misconduct in practice. After approval, designated risk owners should monitor whether assumptions remain valid and whether controls are operating as intended, and an incident response process should address document preservation, independent investigation, escalation, disclosure and remediation. Prompt remediation does not automatically remove liability, but continued benefit, retaliation, concealment or reconstructed records may materially affect how corporate tolerance and organisational fault are assessed.

Conclusion

The emergence of corporate criminal liability in the General Part of Indonesia’s Criminal Code is a significant development within the wider debate surrounding the new Code. It reflects the reality that economic crime may be produced through organisational policy, delegated authority, failed controls and tolerated conduct, while preserving the need to establish the elements of the underlying offence and its statutory connection to the corporation. Article 49 of the Criminal Code clarifies that responsibility is first directed to the corporation and may also extend to the persons who functionally directed or controlled the relevant conduct.

For corporations, responsibility depends on whether the conduct occurred within the ordinary business, whether the corporation benefited from it unlawfully, whether it was effectively treated as company policy, and whether preventive steps were genuinely taken rather than merely documented. The task is accordingly to test actual business lines, subsidiaries, decision makers, controllers and high risk intermediaries against those questions, not to accumulate written policies that day-to-day incentives and practice quietly contradict.

For directors, the business judgment rule rewards authority, information, independence and monitoring that are demonstrable and recorded at the time a decision is made, not reconstructed once an investigation has begun. Because the Code allows a corporation to rely on the same defences available to the individual found responsible, and because the courts distinguish an ordinary business loss from criminal conduct, decisions that are lawfully authorised and free of fraud, concealment or private benefit remain protected. BJR, good corporate governance and risk management remain distinct legal and managerial tools, but they converge on a single practical requirement, that a corporation and its directors be able to show, with evidence created at the time, that a course of conduct was the product of an informed, independent and monitored process rather than the organisational tolerance or failure that corporate criminal liability is designed to address.

For legal consultants, this regulatory shift requires a more proactive approach to corporate criminal risk. Legal consultants should not be engaged only after an alleged offence has occurred, but should assist corporations in identifying criminal exposure across their business activities, translating statutory attribution standards into effective governance and compliance mechanisms, and ensuring that significant corporate decisions are supported by proper authority, legal analysis, risk assessment and contemporaneous documentation. Legal consultants also have an important role in structuring escalation procedures, internal investigations, evidence preservation and remediation where potential misconduct is identified. In this respect, legal consultants play a critical role in helping corporations navigate the evolving corporate criminal liability framework, not only by defending corporate conduct after an event, but also by designing, implementing and evidencing decision-making and compliance processes capable of preventing, identifying and responding to criminal risk. 

This article is intended for general informational purposes only and does not constitute legal advice. For legal assistance or inquiries specific to your situation, please contact us at info@adplaws.com.