Max: Indonesia's criminal law trilogy came into force on 2 January 2026, and the market has not caught up with what that means operationally.
Anita: When executives say they've absorbed the headline and moved on, what specifically are they missing?
Max: The structural shift. Indonesia's previous criminal code operated on the doctrine that a corporation cannot commit a criminal offence. That doctrine is gone. Corporate criminal liability is now codified as a general principle in Book One of the Criminal Code, applicable across all offences — not only those under specific sectoral legislation.
Anita: So this isn't a targeted anti-corruption measure or a financial crime overlay — it covers the whole waterfront.
Max: Correct. And the enforcement timeline is compressed in a way most management teams haven't internalised. Fines must be paid within one month after judgment becomes final and binding. If a corporation fails to pay, the public prosecutor may seize and auction the corporation's assets to satisfy the fine.
Anita: Is there evidence that prosecutors are actually using these tools, or is this still largely theoretical?
Max: It is not theoretical. On 4 May 2026, the Serang District Court approved Indonesia's first deferred prosecution agreement under the new criminal procedure code — Court Decision Number 1 slash Pen.Pid-PPP slash 2026 slash PN Srg — involving PT Crown Steel in a hazardous and toxic waste management case. That is an environmental enforcement action, not a financial crime case. The practical message is that supply-chain and environmental failures are squarely in scope, and prosecutors moved within months of enactment.
Anita: That's a meaningful signal about prosecutorial intent. What does a deferred prosecution agreement actually require of a company?
Max: The conditions include providing compensation or restitution to victims, implementing compliance programs, and cooperating with and reporting to the prosecutor over a deferral period. If all obligations are fulfilled, the corporation may be exempted from further prosecution. If not, the prosecutor may resume. Compliance documentation is no longer a governance formality — it is the primary commercial asset in any enforcement engagement.
Anita: For companies with Indonesian subsidiaries or M&A exposure in the market, where does the liability boundary sit? Who inside the organisation is actually at risk?
Max: Wider than most assume. A criminal offence committed in the course of a corporation's business may be treated as a corporate criminal offence where it is committed by individuals acting for or on behalf of the corporation — whether under an employment relationship or otherwise — or by controllers, order-givers, or beneficial owners, even if they fall outside the formal organisational structure. Inadequate supervision and weak internal controls are themselves the liability pathway, not just direct misconduct.
Anita: And for private equity or anyone doing M&A into Indonesia — does transaction close clean up historical exposure?
Max: It does not. The new criminal procedure code and the Harmonisation Act recognise successor liability explicitly. Corporate actions — mergers, consolidations, demergers, dissolutions — do not in and of themselves extinguish criminal liability. A portfolio company carrying unresolved environmental, labour, or vendor compliance failures now carries criminal exposure that transfers with the deal.
Anita: That changes the diligence calculus materially. You're not just mapping financial and contractual risk — you're mapping prosecutorial exposure.
Max: Exactly. And the same compressed urgency applies to the trade compliance signals running in parallel. Australian agricultural exporters face a hard stop on 17 October 2026, when halal certification becomes mandatory for all imported food and beverage products entering Indonesia. Certification pipelines are capacity-constrained as that deadline approaches, and the process requires physical audit visits by Indonesian halal auditors with travel and accommodation costs borne by the exporter.
Anita: And there's a separate EU dimension compressing at the same time?
Max: Two EU pressures converging. First, the European Commission has confirmed no further postponement of the EUDR application date — large and medium-sized companies must comply from 30 December 2026. Indonesia sits in the standard-risk tier, so full due diligence obligations apply to Indonesian-origin product with no simplified pathway. Second, Indonesia's EU General Scheme of Preferences benefits expire on 31 December 2026. If IEU-CEPA ratification slips — in the Indonesian parliament or in the European Parliament — exporters face a gap between GSP expiry and CEPA entry into force that raises effective tariff costs on existing flows.
Anita: So the second half of 2026 DPR legislative calendar becomes the binding constraint to watch.
Max: It is. And in Australia, two regulated sectors crossed their own thresholds this week. Tranche 2 businesses — real estate agents, lawyers, accountants, virtual asset service providers — had until 29 July 2026 to notify AUSTRAC of their AML and CTF compliance officer. AML and CTF programs must be operational from 1 July. Enrolment alone is not the finish line; it triggers obligations. Failing to enrol while providing services is a criminal offence.
Anita: The compliance officer appointment being a bottleneck — that's not a paperwork problem, that's a liability problem if the role is nominally filled.
Max: Precisely. A nominal appointment with no real authority creates its own enforcement risk. The same logic applies to Australia's first statutory AASB S2 climate reporting cycle, where Group 1 lodgements are already live and director liability is active from year one. False or misleading climate statements can result in fines of up to fifteen million dollars or ten percent of annual turnover, whichever is greater. The question for every board before the FY2026 report is lodged: can you defend the assurance trail on Scope 1 and 2 numbers to the same standard you would defend a financial statement figure?
Anita: That's the right framing. Across all three segments this week, the common thread seems to be that the enforcement environment is already operational — it's not a future state.
Max: That is the PSP Position. The common failure mode across all three segments this week is treating enforcement as a future state. Indonesia's criminal law trilogy — the KUHP, the KUHAP, and the Harmonisation Act — came into force on 2 January 2026, and the Serang District Court's approval of the first DPA on 4 May confirms that prosecutors are using the new tools now, not building toward them. The doctrine that a corporation cannot be a criminal subject is gone; what replaced it puts the quality of a company's compliance program at the centre of prosecutorial discretion and DPA eligibility. That means compliance documentation is no longer a governance formality — it is the primary commercial asset in any enforcement engagement. For local operators, the immediate task is to appoint a named compliance officer with documented authority and run a gap analysis on vendor and distribution contracts, because poorly allocated supervisory responsibility is the fact pattern that puts functional managers in the dock alongside the entity. For multinationals, the subsidiary must be treated as a criminal-procedure entity, with board-level oversight of its governance documented as if it will be produced in a Jakarta court. For private equity, criminal liability does not clean up at transaction close; the diligence work and responsible-actor exposure mapping belong in the pre-acquisition phase and the first 100 days, and DPA risk needs to be priced into exit valuations. PSP SignalDesk, together with Rifdaan Novarazka and Prabowo, will host a special half-day workshop on criminal code liability mapping — the working session where responsible-actor and successor-liability exposure gets mapped to real entities and management chains. It is built around the deal structuring and regulatory navigation agenda of the 8 July Cross-Border M&A forum. Special invitations are coming soon; watch for them.