When Can a Company Be Held Criminally Liable for Acts of Its Directors or Employees?
Written by : Setiawan Efendi, S.H.
I. Corporate Criminal Liability under Indonesia’s New Criminal Code
A company does not act on its own. Its decisions, policies, and business activities are carried out through individuals who work for or have certain relationships with the company, including directors, management personnel, managers, employees, and, in certain circumstances, other persons who may effectively direct or control the company.
The issue becomes more complex when a criminal offense occurs in the course of those activities.
If a director, member of management, or employee commits a criminal offense in connection with the company’s activities, does criminal liability rest solely with the individual who committed the act? Or may the company itself also be held criminally liable?
This question has become increasingly relevant following the entry into force of Law Number 1 of 2023 concerning the Criminal Code (the “Criminal Code”), as adjusted by Law Number 1 of 2026 concerning Criminal Law Adjustments, on 2 January 2026.
Corporate criminal liability is not an entirely new concept under Indonesian law. Various sector-specific laws had already recognized corporations as subjects of criminal offenses, while Supreme Court Regulation Number 13 of 2016 concerning Procedures for Handling Criminal Cases Involving Corporations (“Supreme Court Regulation 13/2016”) provided procedural guidance for corporate criminal cases.
The significant development introduced by the new Criminal Code is the systematic recognition of corporate criminal liability as part of Indonesia’s general criminal law framework.
Accordingly, when a criminal offense occurs within a company, the legal analysis should not end with identifying the individual who physically committed the act. A further question must be addressed: was the offense merely an individual misconduct that harmed the company, or is there a sufficient legal basis to attribute the offense to the corporation itself?
In other words, a corporation may occupy two fundamentally different positions: it may be the party harmed by the misconduct of its directors or employees, or it may itself become a subject of criminal liability.
II. Corporations as Subjects of Criminal Offenses
Article 45 paragraph (1) of the Criminal Code expressly recognizes corporations as subjects of criminal offenses.
The term “corporation” is not limited to limited liability companies. Article 45 paragraph (2) covers, among others, limited liability companies, foundations, cooperatives, State-Owned Enterprises (BUMN), Regional-Owned Enterprises (BUMD), other legal entities, incorporated or unincorporated associations, firms, limited partnerships, and other forms recognized under applicable laws and regulations.
Accordingly, the corporate criminal liability framework also applies, in principle, to BUMN and BUMD. State or regional government ownership does not by itself exclude an enterprise from corporate criminal liability.
However, recognizing a corporation as a subject of criminal offenses does not mean that every criminal act committed by someone working within or for a company automatically becomes a criminal offense of the corporation.
The analysis must still consider who committed the act, in what capacity the act was committed, and how the offense relates to the corporation’s activities, interests, and conduct.
III. Whose Conduct May Be Attributed to a Corporation?
Article 46 of the Criminal Code provides that a criminal offense by a corporation may be committed by management personnel holding a functional position within the organizational structure, as well as by persons who, based on an employment or other relationship, act for and on behalf of the corporation or in the corporation’s interest within the scope of its business or activities.
Formal title is therefore not the sole determining factor.
A director or member of management may certainly commit an act that is subsequently attributable to the corporation. The same, however, may apply to managers, employees, or other persons having a relevant relationship with the company where the conditions under Article 46 are satisfied.
Article 47 extends the scope further to persons outside the formal organizational structure who give orders, exercise control, or constitute the corporation’s beneficial owners, provided that they are capable of controlling the corporation.
Corporate criminal law therefore looks beyond the company’s formal organizational chart. It may also consider who, as a matter of fact, is capable of directing, determining, or controlling corporate conduct.
Nevertheless, identifying the individual offender is only the first stage of the analysis. The mere fact that the offender is a director, member of management, or employee does not in itself establish that the individual’s wrongdoing is also the wrongdoing of the corporation.
IV. Is the Corporation the Injured Party or the Offender?
This distinction is central to determining corporate criminal liability.
Not every criminal offense committed by a director, management personnel, or employee constitutes a corporate offense. In one situation, the company may itself be harmed by the individual’s misconduct. In another, the relationship between the offense and the company’s interests or conduct may be sufficiently close for the offense to be attributable to the corporation.
V. Corporations as Injured Parties Due to the Acts of Their Management
Consider, for example, a director who secretly transfers company funds to an account under his control for personal benefit. The act is committed without corporate authorization, contrary to the company’s interests and internal policies, concealed from internal supervision, provides no benefit to the company, and results in the loss of corporate assets.
In such circumstances, the director’s position within the company does not automatically transform the misconduct into a criminal offense of the corporation. Substantively, the company may instead be the party harmed by the director’s abuse of authority.
A similar situation may arise where an employee misuses access or facilities provided by the company to commit an offense for personal gain, while the company receives no benefit, prohibits such conduct, has implemented reasonable supervision, and takes appropriate action once the misconduct is discovered.
This must be distinguished from a situation where, for example, a manager makes an unlawful payment to secure a project for the company. The company subsequently obtains the project and derives an unlawful benefit, while the practice is known, accepted, or at least tolerated by persons with authority within the company.
In the latter situation, the connection between the offense and the corporation becomes significantly stronger. The act can no longer be viewed solely as an individual deviation. It becomes necessary to determine whether the conduct may legally be treated as a criminal offense by the corporation.
This distinction is essential between a criminal offense committed by an individual who has a relationship with the company and a criminal offense that, as a matter of law, may be attributed to the corporation.
Accordingly, the status of an individual as a member of management or an employee should not, by itself, serve as a basis for attributing the individual’s entire wrongdoing to the company.
VI. Corporations as Offenders Benefiting from Criminal Acts
The circumstances are different where the conduct is closely connected to the company’s interests or results in the company obtaining an unlawful benefit.
For example, a manager makes an unlawful payment to a particular party to secure a project for the company. The company subsequently obtains the project and derives a benefit from the conduct, while the practice is known, accepted, or at least tolerated by persons with authority within the company.
In such circumstances, the connection between the criminal offense and the corporation becomes significantly stronger. The conduct can no longer be viewed merely as an individual’s personal misconduct. Further consideration is required as to whether there is a legal basis for treating the conduct as a criminal offense committed by the corporation. At this point, Article 48 of the Indonesian Criminal Code (KUHP) becomes a decisive provision.
VII. Article 48 and the Attribution of Corporate Fault
Article 48 of the Criminal Code provides the central parameters for assessing liability for corporate offenses under Articles 46 and 47.
The relevant considerations include whether the offense falls within the corporation’s business or activities, unlawfully benefits the corporation, is accepted as corporate policy, occurs because the corporation fails to take necessary preventive and compliance measures, and/or occurs because the corporation allows the offense to take place.
Corporate criminal liability is therefore fundamentally an issue of attribution.
The question is not merely who physically committed the offense, but whether there is a sufficient relationship between the individual’s conduct and the corporation’s activities, interests, benefits, policies, omissions, or tolerance for the offense to be attributable to the corporation.
An unlawful benefit obtained by the company is highly relevant, but it should not be treated as the sole indicator.
Even where the corporation does not directly receive a financial benefit, it may still be relevant to examine whether the unlawful conduct was accepted as corporate policy, knowingly tolerated, or occurred because the corporation failed to implement measures reasonably required to prevent criminal conduct and ensure legal compliance.
A similar approach had already been reflected in Article 4 paragraph (2) of Supreme Court Regulation 13/2016. In assessing corporate fault, the court may consider whether the corporation obtained a benefit from the criminal offense or whether the offense was committed in its interest, whether the corporation allowed the offense to occur, and whether it failed to take necessary measures to prevent the offense and ensure compliance with the law.
Accordingly, the distinction between a corporation as an injured party and a corporation as an offender requires an examination of the overall relationship between the individual misconduct and the corporation.
A company whose management has misappropriated its assets occupies a fundamentally different position from a company that benefits from unlawful conduct, incorporates such conduct into its practices, tolerates it, or fails to take reasonable steps to prevent it.
The same principle applies to BUMN and BUMD. Their status as state- or regional-owned enterprises does not automatically determine whether they are the injured party or the offender. Their position must be assessed by reference to the nature of the conduct, the interests served, any benefits obtained, and the corporation’s response to the offense. Where corruption offenses are involved, the specific corporate liability provisions under Indonesia’s anti-corruption legislation must also be taken into account.
VIII. State-Owned Enterprises (SOEs/BUMN) and Regionally Owned Enterprises (ROEs/BUMD) in Corporate Criminal Liability
The same principle applies to State-Owned Enterprises (SOEs) and Regionally Owned Enterprises (ROEs).
As expressly provided under Article 45 paragraph (2) of the Indonesian Criminal Code (KUHP), SOEs and ROEs are included within the definition of a corporation. Accordingly, state or regional ownership does not alter the basic mechanism for assessing corporate criminal liability as provided under Articles 46 to 49 of the KUHP.
An SOE or ROE may be in the position of an injured party as a result of misconduct by its management, for example, where a member of management transfers company assets for personal benefit.
In other circumstances, an SOE or ROE may also be subject to criminal liability where the criminal offense is committed in connection with the corporation’s interests and satisfies the attribution parameters prescribed by the KUHP.
In the context of corruption offenses, such assessment must also take into account the specific provisions concerning corporate criminal liability under the laws and regulations governing the eradication of corruption offenses.
Accordingly, the status of an entity as an SOE or ROE should not, by itself, lead to the assumption that the corporation is either the victim or the offender.
The position of the corporation must still be determined based on the nature of the conduct, the interests served, the benefits obtained, and the corporation’s actions and response to the criminal offense.
IX. Corporate Liability Does Not Necessarily Exclude Individual Liability
The distinction between individual misconduct and corporate fault does not mean that the law must always choose between the individual and the corporation.
Article 49 of the Criminal Code, as adjusted by Law Number 1 of 2026, provides that liability for a criminal offense by a corporation under Article 48 is imposed upon the corporation. Such liability may also be imposed upon management personnel holding functional positions, persons giving orders, controlling persons, and/or beneficial owners of the corporation.
This framework emphasizes the distinction between a criminal offense committed by a corporation and the persons who may ultimately bear criminal responsibility for that offense.
Accordingly, once an offense is attributable to a corporation, criminal liability does not necessarily stop at the corporate entity. Individuals whose roles and culpability justify personal responsibility may also be held liable.
Conversely, the existence of an individually liable offender does not automatically exclude the possibility of corporate criminal liability.
Each must be assessed according to the relevant role, relationship, and basis of fault.
X. Why Corporate Compliance Matters?
The distinction between the corporation as an injured party and as an offender also demonstrates why effective corporate compliance has become increasingly important under the new Criminal Code.
Where a company is confronted with misconduct by a director or employee, an effective system of supervision and prevention may be relevant in demonstrating that the offense constituted individual misconduct rather than conduct accepted, authorized, or tolerated by the corporation.
Conversely, where a company becomes aware of unlawful practices but chooses not to intervene, particularly where it derives a benefit from those practices, the mere existence of standard operating procedures, codes of conduct, anti-bribery policies, or other compliance documents will not automatically shield the corporation from liability.
Both Article 48 of the Criminal Code and Supreme Court Regulation 13/2016 focus on the measures actually taken by the corporation to prevent criminal conduct and ensure legal compliance.
In practice, such measures may include effective approval procedures, segregation of authority, internal audits, supervision of high-risk transactions, whistleblowing mechanisms, proper investigation of reported violations, and corrective measures when indications of criminal conduct are identified.
Corporate compliance should therefore no longer be viewed merely as an administrative or corporate governance requirement. Its effectiveness may become an important factor in determining whether an offense constitutes individual misconduct that harms the corporation or conduct that may legally be attributed to the corporation itself.
XI. Determining the Corporation’s Position
Under the new Criminal Code, identifying the individual who physically committed an offense is only the beginning of the analysis.
It is also necessary to examine whether the conduct occurred within the scope of the corporation’s business or activities, whether it served the corporation’s interests, whether the corporation obtained an unlawful benefit, whether the conduct was accepted as corporate policy, whether adequate preventive and supervisory measures were taken, and whether the corporation allowed the offense to occur.
The answers to those questions will ultimately determine the corporation’s position.
On the one hand, a corporation may be the party harmed by the misconduct of its directors or employees. On the other hand, it may itself become a subject of criminal liability where the relationship between the offense and the corporation’s interests, benefits, policies, failure to prevent, or tolerance of the conduct is sufficiently close for the offense to be attributed to the corporation.
Therefore, when a director, member of management, or employee commits a criminal offense, the legal inquiry should not end with:
“Who committed the offense?”
It must be followed by a further question:
“Was the corporation harmed by the individual’s misconduct, or is there a sufficient legal basis to attribute the offense to the corporation itself?”
It is at this point that the line between individual wrongdoing and corporate criminal liability must ultimately be drawn.
