In January 2026, the board of a Malaysian-owned plantation subsidiary in South Sumatra was stunned when local prosecutors initiated a criminal inquiry into the company for “environmental negligence.” For the first time, the investigation did not target just the local manager; it specifically summoned the Malaysian resident director under the provisions of the newly active New Penal Code. The charge was based on a “failure to supervise,” a concept that has transformed from a corporate governance lapse into a potential criminal offense. In 2026, “I was at the head office in KL” is no longer a valid legal shield for directors of Indonesian PT PMA entities.
The Paradigm Shift: Articles 45–50 of the New Penal Code
The legal landscape has been fundamentally recalibrated by Law Number 1 of 2023 concerning the Criminal Code (hereinafter referred to as the New Penal Code), which officially entered into force on January 2, 2026. This legislation consolidates corporate criminal liability, moving it from fragmented sectoral laws into the heart of Indonesia’s general criminal law.
Under Article 45 of the New Penal Code, corporations are now primary subjects of criminal law. Crucially, Article 46 and Article 47 clarify that liability is not limited to the company itself but extends to the “Functional Management” including directors, commissioners, and even “shadow directors” who exercise effective control from abroad. For Malaysian investors, this means the corporate veil can be pierced whenever a crime is committed within the scope of the business, for the benefit of the company, or due to a lack of preventive measures.
Risk Analysis: The “Supervisory Failure” Trap
One of the most dangerous innovations in the 2026 framework is the codification of “Supervisory Failure” as a basis for liability. Under Article 48 of the New Penal Code, a corporation and its directors can be held liable if they “allow” a crime to happen or fail to take “necessary preventive measures.”
For Malaysian MNEs, this creates a high-risk scenario for directors who hold formal titles in Indonesia but remain physically based in Malaysia. In the eyes of Indonesian prosecutors, a director who signs off on budgets but fails to audit local permitting processes or environmental compliance is “allowing” risks to materialize. Under the new Law Number 20 of 2025 concerning the Criminal Procedure Code (hereinafter referred to as the New KUHAP), authorities can now pursue a “dual-track” prosecution, charging both the corporation and the individual directors as co-defendants.
Strategic Expert Opinion: The Legalinfo Perspective
For Malaysian directors, compliance is no longer a checkbox; it is a personal liberty insurance policy.
According to Gunawan Sembiring, S.H., Managing Partner Legalinfo Lawyers, many Malaysian directors mistakenly rely on the “Business Judgment Rule” from company law to protect them from criminal charges. He notes that in 2026, the New Penal Code has effectively lowered the bar for “criminal negligence” in corporate settings. He emphasizes that Legalinfo Lawyers focuses on building a “Documentary Shield” through the implementation of Supreme Court Regulation Number 13 of 2016 (hereinafter referred to as PERMA 13/2016). According to Gunawan, if a director can present documented evidence of periodic compliance audits, specific anti-bribery training, and a functional whistleblowing system, they can invoke the “Adequate Procedures” defense to seek a dismissal of personal charges.
Defensive Protocol for Malaysian Directors in 2026
To mitigate personal exposure under the New Penal Code, Legalinfo Lawyers recommends the following institutional protocol:
Formalize Supervisory Roles: Clearly define the supervisory duties of Malaysian resident and non-resident directors in the company’s internal “Work Plan.” Do not leave “oversight” as a vague concept.
Implementation of PERMA 13/2016: Ensure your Indonesian subsidiary has a written “Compliance Manual” that specifically addresses high-risk areas like land acquisition, government procurement, and environmental permits.
The “Active Dissent” Record: If a board decision carries a legal risk, ensure your dissent or request for a legal audit is recorded in the formal Minutes of Meeting. Under the New Penal Code, silence is often interpreted as “allowing” the act.
Bilingual Compliance Audits: Conduct bi-annual legal audits by a Jakarta-based firm. These audit reports serve as critical evidence of “good faith” and “preventive measures” if a criminal investigation is launched.
Deferred Prosecution Agreement (DPA) Readiness: Under the New KUHAP, corporations can now enter a DPA to avoid trial. Malaysian directors should ensure their company is “DPA-ready” by maintaining high standards of cooperation and remediation capability.
Conclusion
The 2026 New Penal Code represents the most significant threat to Malaysian corporate directors in Indonesia’s history. The shift from “individual intent” to “organizational failure” means that Malaysian executives can no longer manage Indonesian risks from a distance. However, the same law provides a path for protection: those who can prove they built a culture of compliance through PERMA 13/2016 will be shielded. In the Indonesia of 2026, the best defense is not a good argument in court it is a robust compliance system built before the police arrive.
