Indonesia Business Compliance FAQ

Each tax type carries its own filing deadline, typically the 10th or 15th of the following month for payment and the 20th for reporting. Post-2025, all filings transit through the Directorate General of Taxes (DJP) Coretax platform, replacing the legacy e-Filing and e-Billing systems. A PT PMA must also reconcile its withholding obligations against vendor contracts and employee payroll data monthly — not at year-end — because DJP cross-references reported data against third-party submissions in real time. Late filings attract administrative penalties under Article 7 of the General Tax Provisions Law (UU KUP), and persistent non-compliance triggers audit selection under DJP's risk-based profiling system.

Coretax consolidates previously fragmented DJP systems into a single platform. For companies, the key operational changes include: unified login replacing multiple credentials, digital tax invoice (Faktur Pajak) issuance within Coretax rather than the standalone e-Faktur application, integrated withholding tax proof (Bukti Potong) generation, and real-time payment confirmation via the NTPN system. Companies that previously relied on third-party tax software for e-SPT preparation must verify compatibility with Coretax's API specifications. The transition period has created compliance gaps for firms that delayed migration — particularly around NPWP format conversion from 15-digit legacy to 16-digit Coretax format.

The DJP issues an SP2 (Surat Perintah Pemeriksaan) to commence a field audit or desk audit. Once received, the taxpayer has limited time to produce supporting documents. Best practice is to maintain audit-ready workpapers throughout the year. Key audit targets include: discrepancies between PPh 21 reported amounts and actual payroll records, VAT input credits claimed without valid Faktur Pajak, related-party transactions without arm's-length documentation, and expense deductions that fail the Article 6 deductibility test under UU PPh. Companies with a "High" DJP risk profile — common for PT PMAs with cross-border transactions — face higher audit frequency. The audit defense file should include: a tax position paper for each material position, reconciliation schedules (SPT-to-GL, PPh 21-to-payroll, PPN-to-revenue), and pre-drafted responses to standard DJP queries.

The SPT Tahunan PPh Badan requires detailed schedules including: fiscal adjustment computations (positive and negative corrections to commercial profit), depreciation schedules per Article 11 UU PPh, foreign income and tax credit calculations under Article 24, related-party transaction disclosures, and withholding tax credit reconciliation. PT PMAs with foreign shareholders must also consider withholding on dividend distributions (PPh 26 at 20% or treaty rate). Companies claiming tax incentives — such as tax holidays under PP 78/2019 or super-deductions under PP 45/2019 — must file additional compliance reports to maintain incentive eligibility.

Beyond the administrative fine, late filing has compounding consequences. DJP's risk engine flags habitual late filers for prioritized audit selection. If a company fails to file entirely, DJP may issue an ex-officio assessment (SKP) based on its own calculations — typically unfavorable to the taxpayer. For withholding taxes (PPh 21/23/26), late remittance creates personal exposure for directors under Article 32 and Article 35 of UU KUP, as withholding agents bear fiduciary responsibility for collected taxes. For VAT, late-issued Faktur Pajak results in the input credit being denied to the recipient — creating downstream liability for your counterparty and damaging commercial relationships.

The distinction affects capital requirements, permitted business activities (KBLI codes), licensing pathways (OSS-RBA), and ongoing compliance obligations. A PT PMA must file quarterly LKPM investment activity reports to BKPM — a requirement that does not apply to purely domestic PTs. Foreign ownership percentages are governed by the Positive Investment List under PP 10/2021 (as amended), which specifies sectors open to 100% foreign ownership, sectors with caps, and sectors reserved for domestic investors. PT PMAs also face stricter scrutiny on related-party transactions, thin capitalization (PMK-169/2015), and transfer pricing documentation (PMK-22/2020). The choice between PT PMA and alternative structures should be made with full visibility of the 3-year compliance cost, not just incorporation cost.

The timeline breaks down as: Weeks 1–2 for pre-incorporation planning (KBLI code selection, capital structure design including DER implications under PMK-169/2015, shareholder agreement drafting); Weeks 2–3 for deed execution before a licensed Indonesian notary and Ministry of Law and Human Rights (Kemenkumham) approval; Weeks 3–4 for OSS-RBA registration, NIB issuance, and business licensing; Weeks 4–6 for NPWP registration, domicile certificate, corporate bank account opening, and EFIN activation; Weeks 6–8 for BPJS Ketenagakerjaan and Kesehatan registration, initial employee enrollment, and first payroll tax setup. Delays most commonly occur at bank account opening (KYC requirements vary by bank and foreign shareholder jurisdiction) and at BPJS registration.

LKPM is filed through the OSS-RBA system quarterly (Q1 by April 10, Q2 by July 10, Q3 by October 10, Q4 by January 10). The report requires disclosure of: realized investment vs. planned investment (as stated in the original NIB application), number of Indonesian and foreign employees, production output or revenue figures, and export values if applicable. BKPM uses LKPM data to monitor whether the PT PMA is operating in accordance with its stated investment plan. Persistent non-filing or significant deviation between planned and actual investment can result in: warning letters, OSS license suspension, and ultimately revocation of the NIB — which effectively makes the company unable to operate legally.

The capital structure decision has downstream tax consequences that persist for the life of the entity. Thin capitalization rules under PMK-169/2015 cap the deductible interest expense by reference to a 4:1 debt-to-equity ratio — interest on debt exceeding this ratio is non-deductible for CIT purposes. Intercompany loans from parent entities must carry arm's-length interest rates with proper loan agreements, or DJP may recharacterize interest as dividends under Article 18(2) UU PPh, triggering withholding at 20% (or treaty rate) without deductibility. The most common structuring error is under-capitalizing the PT PMA and over-leveraging with shareholder loans — it minimizes incorporation cost but maximizes ongoing tax risk.

The compliance clock starts immediately upon NPWP issuance, not upon commencing revenue-generating operations. Even a pre-revenue PT PMA with zero transactions must file nil monthly tax returns (PPh 21, PPh 25). Failure to file nil returns triggers the same administrative penalties as late substantive returns. If the PT PMA employs foreign workers, RPTKA (manpower plan) and IMTA/notification must be obtained before the foreign employee begins work. BPJS enrollment is mandatory within 30 days of the first employment relationship; delays result in penalties and inability to access BPJS healthcare for employees. PKP registration for VAT purposes is mandatory once revenue crosses the IDR 4.8 billion threshold, or voluntary if the company wishes to claim input VAT credits earlier.

The documentation must be prepared contemporaneously — meaning before the annual tax return filing deadline, not when DJP requests it during an audit. The master file covers the multinational group's global operations, value chain, and intercompany transaction framework. The local file details the Indonesian entity's specific related-party transactions, functional analysis, and benchmarking study with comparable companies. Country-by-Country Reporting (CbCR) under PMK-213/2016 applies when the group's consolidated revenue exceeds EUR 750 million. Even below the mandatory thresholds, DJP retains authority under Article 18(3) UU PPh to challenge any related-party pricing — making voluntary documentation a defensive investment for PT PMAs with material intercompany flows.

The DER calculation uses the average debt and average equity over the fiscal year, based on monthly balances. A common structuring error is establishing a highly leveraged PT PMA with minimal equity and a large shareholder loan — this may satisfy corporate law (minimum IDR 10 billion paid-up capital) but fail the DER test, rendering a significant portion of interest expense non-deductible. For groups planning intercompany financing, the DER analysis must be performed before the loan agreement is executed, not at year-end tax computation. PMK-169/2015 also interacts with transfer pricing requirements: even if the DER test is satisfied, the interest rate must still be arm's-length under Article 18(3) UU PPh.

Indonesia has 70+ DTAs, but notable gaps exist — including Brazil, most African nations, and several Caribbean/offshore jurisdictions. In absent-DTA scenarios, outbound interest payments bear 20% WHT with no relief, making intercompany loan structures from these jurisdictions tax-inefficient. Royalty payments face the same 20% rate. Groups with operations in both treaty and non-treaty jurisdictions sometimes consider intermediate holding structures through treaty-partner countries — but this requires genuine substance and survives scrutiny only if the intermediate entity has real economic activity, given Indonesia's adoption of the Multilateral Instrument (MLI) Principal Purpose Test (PPT). The absence of a DTA also eliminates the mutual agreement procedure for dispute resolution.

DJP scrutinizes management service fees intensively because they represent an easy mechanism for profit shifting. The OECD Transfer Pricing Guidelines (adopted by Indonesia) require that: the service was actually rendered (not merely available), the Indonesian entity received a tangible benefit, the fee reflects arm's-length pricing (benchmarked against comparable uncontrolled transactions), and adequate documentation exists (service agreements, timesheets, deliverable evidence, allocation keys). "Shareholder activities" — services the parent performs for its own benefit as a shareholder — are not chargeable to the subsidiary. DJP commonly challenges management fees where the service agreement is generic, no deliverables are evidenced, or the fee is computed as a percentage of revenue without cost-basis support.

The MLI overlays Indonesia's bilateral tax treaties without requiring individual renegotiation. The key provisions affecting businesses are: the PPT (Article 7 MLI), which allows DJP to deny treaty benefits for arrangements that lack commercial substance beyond tax advantage; the tie-breaker rule for dual-resident entities (Article 4 MLI), which now requires mutual agreement rather than automatic place-of-effective-management determination; and modifications to permanent establishment definitions (Articles 12–15 MLI), which may expand PE exposure for commissionnaire and similar arrangements. For groups using Singapore, Netherlands, or other holding jurisdictions to access Indonesia's treaty network, the MLI-PPT means that the holding company must demonstrate genuine economic substance — not merely legal presence.

ITGCs are the foundational layer of IT controls that support the reliability of automated financial reporting controls. If ITGCs are weak — for example, if system administrators can modify financial data without approval workflows — then no application-level control can be trusted. For Indonesian PT PMAs that are subsidiaries of listed parent companies, ITGC audit results directly feed into the group's SOX 404 or equivalent internal control assessment. Under Indonesia's UU PDP (Personal Data Protection Law), companies processing personal data must implement technical safeguards including access controls, encryption, and breach notification procedures — all of which fall within ITGC scope. For companies regulated by OJK, POJK 38/2016 on IT Risk Management requires documented IT risk assessments and control testing.

UU PDP applies to any entity processing personal data of Indonesian data subjects, regardless of where the entity is incorporated. For PT PMAs, this means employee payroll data, customer records, vendor contact information, and even director KTP data fall within scope. The technical control requirements map directly to ITGC domains: access management, change management, IT operations, and data lifecycle management. Companies that fail to implement adequate safeguards face administrative sanctions including fines up to 2% of annual revenue and potential criminal liability for directors under Article 57–67 UU PDP. The 72-hour breach notification requirement to both the data subject and the supervisory authority makes incident detection controls critical.

For Indonesian manufacturing companies, the highest-risk areas typically include: procurement and vendor management (kickback risk, related-party vendor transactions, single-source dependency), inventory management (physical-to-book reconciliation, shrinkage, obsolescence provisions under PSAK 14), fixed asset lifecycle (acquisition approval, capitalization thresholds, depreciation accuracy per PSAK 16, disposal controls), revenue recognition (cut-off, bill-and-hold, consignment), payroll and BPJS compliance (ghost employees, overtime calculation accuracy, PPh 21 withholding correctness), and treasury/cash management. For PT PMAs reporting to a parent group, the internal audit scope must also cover group-mandated controls — which may include anti-bribery (FCPA/UK Bribery Act), sanctions screening, and ESG reporting controls.

Indonesian companies face a specific threat landscape that generic global frameworks may understate: high prevalence of business email compromise (BEC) targeting finance teams, ransomware attacks on manufacturing OT/IT converged networks, social engineering via WhatsApp, and insider threats amplified by high employee turnover rates. The risk assessment should be conducted at least annually and after significant changes. For companies pursuing ISO 27001 certification (increasingly requested by multinational clients and group auditors), the Statement of Applicability (SoA) must document which of the 93 Annex A controls (ISO 27001:2022) are applicable, implemented, and justified. The intersection with UU PDP creates a dual compliance mandate: ISO 27001 provides the control framework, while UU PDP specifies the legal obligations.

In Indonesia, external audit is performed by a Kantor Akuntan Publik (KAP) registered with OJK and the Ministry of Finance. It is mandatory for companies with assets or annual revenue above IDR 50 billion, publicly listed companies, and companies in regulated sectors. The external auditor provides an opinion on the fair presentation of financial statements — it does not test operational effectiveness of internal controls (except in limited scope for SOX-mandated engagements). Internal audit, by contrast, is management's tool for evaluating control effectiveness, identifying operational risks, and recommending improvements. For PT PMAs that are subsidiaries of listed groups, the parent's Audit Committee typically mandates internal audit coverage over the Indonesian subsidiary — covering areas the external auditor does not: procurement fraud, inventory leakage, payroll ghost employees, IT access violations, and regulatory compliance beyond financial reporting.

For Indonesian manufacturing and distribution companies, inventory often represents 30–60% of current assets — making verification accuracy a material financial reporting issue. PSAK 14 (Inventories) requires inventory to be carried at the lower of cost or net realizable value, which means physical verification includes assessing condition, identifying obsolete or slow-moving items, and validating the NRV write-down provision. The external auditor (KAP) is required to observe the physical count for material inventory balances; if the company cannot demonstrate a reliable count process, the auditor may issue a qualified opinion — which has downstream consequences for banking covenants and investor confidence. For multi-site operations (common in Indonesian manufacturing — Java, Sumatra, Kalimantan), simultaneous counts or statistical sampling approaches must be pre-agreed with the external auditor.

The deliverable set typically includes: a reconciled fixed asset register (FAR) matching GL balances to physically verified items, signed count sheets with verifier identification, photographic evidence for high-value assets, exception reports (assets found but not in FAR, FAR items not physically located), condition grading (serviceable, needs repair, impaired, to be disposed), remaining useful life reassessment recommendations, and revaluation indicators where fair value has materially diverged from carrying value. For Indonesian companies applying PSAK 16 (Fixed Assets), the verification supports: impairment testing under PSAK 48, component depreciation assessment, and revaluation model elections. Insurance adequacy is a critical byproduct — the verification often reveals that insured values have not been updated to reflect acquisitions, disposals, or appreciation, leaving the company underinsured.

Indonesian manufacturing groups commonly operate across multiple islands — Java (primary), Sumatra, Kalimantan, Sulawesi — creating logistical challenges for simultaneous verification. The methodology must address: movement freeze (all inter-site and inbound/outbound transfers halted during count window), cut-off documentation (last GRN, last dispatch note, goods-in-transit identification), team independence (counters should not be warehouse staff who manage the inventory daily), variance thresholds (items exceeding ±1% variance by value require immediate recount), and consignment inventory (goods on client premises or third-party warehouses require separate confirmation procedures). The count methodology must be pre-agreed with the external auditor if the results will be relied upon for the statutory audit opinion.

PSAK 48 requires that at each reporting date, management assess whether any indication of impairment exists. If yes, the recoverable amount (higher of fair value less costs of disposal, and value in use) must be estimated and compared to carrying amount. For Indonesian manufacturing companies, common impairment triggers include: production line obsolescence due to technology upgrade, factory relocation leaving behind non-transferable installations, regulatory changes rendering equipment non-compliant, and sustained underperformance of a cash-generating unit (CGU). The impairment review requires: identification of the CGU to which the asset belongs, projection of future cash flows (supported by approved budgets and reasonable growth assumptions), selection of an appropriate discount rate (WACC adjusted for asset-specific risks), and sensitivity analysis on key assumptions.

Indonesian companies migrating ERP systems (commonly to SAP S/4HANA, Oracle, or local solutions like Accurate/Jurnal) face a data migration risk that is both a financial reporting issue and an operational continuity issue. For inventory: cost layers built over years under FIFO or weighted-average methods may not transfer cleanly, leading to cost-of-goods-sold distortions post-migration. For fixed assets: accumulated depreciation histories may not map to the new system's depreciation engine, especially if the old system used custom or manually overridden rates. The control framework should include: pre-migration physical verification (establishing the "truth" baseline), parallel-run period (both systems running simultaneously for 1–2 months), post-migration reconciliation, and UAT approval by Finance before legacy system decommission.

Beyond Coretax migration, PMK 81/2024 overhauled the VAT and withholding tax technical guidance effective 2025. Transfer pricing rules were updated by PMK 172/2023, tightening contemporaneous documentation requirements and introducing a new CbCR filing portal. BPJS Ketenagakerjaan contribution rates for the JHT (old-age savings) and JKP (employment termination insurance) programmes were recalibrated in 2025, affecting payroll cost models for all employers. Companies should also note that Indonesia signed the OECD BEPS MLI and the modifications to bilateral DTAs are now in effect — directly affecting withholding tax rates under Indonesia's treaty network.

The Coretax Faktur Pajak workflow is fully digital and counterparty-verified: the seller issues the invoice in Coretax, which generates a system-approved serial number (NSFP) automatically — eliminating the old batch NSFP allocation process. The buyer receives notification within Coretax and confirms receipt, which locks the invoice for both parties. Critical compliance risk: companies that issue invoices with VAT collected but fail to upload them into Coretax face double jeopardy — the VAT liability exists but the buyer cannot claim input credit, generating disputes with customers. Retroactive corrections (pembetulan) are possible but procedurally complex. Companies with high invoice volumes should ensure their ERP-to-Coretax API integration is certified and tested before each compliance cycle.

Indonesia's standard CIT rate is 22%, which is above the 15% Pillar Two floor — meaning most Indonesian operations will not directly trigger a Qualified Domestic Minimum Top-Up Tax (QDMTT). However, Indonesian subsidiaries that benefit from significant tax incentives (tax holidays, special economic zone rates, super-deductions) may see their effective tax rate fall below 15% for specific years, creating potential top-up tax exposure in the parent jurisdiction. Companies claiming Indonesia tax holidays under PP 78/2019 or reduced rates in KEK/KPBPB zones should conduct a Pillar Two ETR analysis now. The relevant Indonesian implementing regulation is expected in 2025–2026; groups should engage with their consolidated tax advisors to align the Indonesian analysis with the parent's GloBE Information Return preparation.

Under PMK 172/2023, the Indonesian Local File must now include an expanded functional analysis, detailed comparability analysis with source identification, and a complete arm's-length range using interquartile methodology — consistent with OECD TPG Chapter II updates. The Country-by-Country Report (CbCR) filing portal has been integrated into Coretax for qualifying MNC groups (consolidated revenue above IDR 11 trillion). Penalty exposure for TP non-compliance has increased: DJP can now adjust related-party transactions to the median of the arm's-length range (not just the range boundary) if contemporaneous documentation is absent. Companies with significant intercompany services, royalties, loans, or tangible goods transactions must review their TP policy and documentation annually — not only when a DJP query arrives.

BPJS Ketenagakerjaan covers four programmes: JHT (old-age savings, 5.7% split employer/employee), JKK (work accident, 0.24–1.74% based on risk level), JKM (death benefit, 0.3%), and JKP (employment termination, 0.46%). BPJS Kesehatan contributions are capped at a maximum salary basis. The 2025 changes require employers to reconcile their BPJS payroll reports against the Coretax PPh 21 reports — since DJP's risk profiling system now flags companies where the BPJS contribution base is materially lower than the PPh 21 gross salary base (a common pattern when companies incorrectly exclude allowances from BPJS calculations). Expatriate employees on KITAS are subject to different BPJS Kesehatan obligations depending on their employment contract structure and home country social security totalization agreements with Indonesia.