Activate Company Compliance in Indonesia: Set Up Records, Access and Filing Responsibilities

Build a company-held record and responsibility register

Start with an index that the company can retrieve independently of the person who arranged registration. For an Indonesian limited liability company, Perseroan Terbatas (PT), this normally means collecting the establishment deed and later amendments, legal-entity approval and relevant notifications, the current shareholder and management details, tax registration, and the Online Single Submission (OSS) business profile. Keep the Business Identification Number (NIB) beside the permissions and conditions for each activity and location.

The underlying identity file should agree with the company registration framework in Indonesia : incorporation records, tax registration and business licensing serve different functions. Record discrepancies rather than silently choosing whichever name, address or director appears on the newest screenshot. An unresolved identity mismatch belongs to a named correction task.

Give each record a custodian, effective date, source, storage location and superseded-version link. Store editable ledgers separately from signed or issued outputs. Restrict access to passports, ownership evidence and payroll, while ensuring an authorised replacement can recover them. A document held only in a former adviser’s inbox is not a dependable company record.

Tax retention also needs a deliberate arrangement. Article 28(11) of the General Tax Provisions law requires underlying books, records and documents, including electronic processing outputs, to be retained for ten years in Indonesia. For a corporate taxpayer, the provision specifies its domicile. Arrange compliant local retention and retrievable backups; overseas group storage alone should not be treated as resolving that requirement.

Use the following control register as an internal management tool. It is a practical design, not a prescribed government form. Complete every cell with a person or evidence reference; a department name by itself leaves substitution and approval unclear.

Test authorised access without sharing personal credentials

Test what each user can actually do for the company, not merely whether a password opens a portal. Company control means the business can appoint, limit, replace and supervise its authorised users. It does not mean the business should collect an employee’s personal tax password or signing passphrase.

Coretax: separate preparation from signature

The Directorate General of Taxes (DGT) uses individual access and impersonation for corporate tax administration. Its corporate PIC and access guide explains the person in charge (PIC), individual login and delegated roles. Confirm who is recorded as PIC and whether that person can select the correct corporate Taxpayer Identification Number (NPWP). An adviser’s ability to prepare work does not establish the company’s own continuity arrangements.

DGT’s current grant and revoke role instructions , checked on October 27, 2026, distinguish a drafter who prepares documents from a signer who signs them. In impersonation mode, the PIC uses Profil Saya and Wakil/Kuasa Saya to assign or revoke the relevant role. The guidance says an already logged-in delegate should log out and back in after a role assignment. Record the actual document permissions granted, rather than a general note saying “tax access supplied.”

Run a controlled test with the intended user: select the correct company, view the relevant period and confirm the required preparation or signing permission. Check that the intended signer has the necessary authorisation or digital-signing arrangement for the task. Stop before any live declaration or submission unless the underlying filing has been approved. Keep a dated test record without passwords, one-time codes or passphrases.

OSS and specialist portals: use their own access route

OSS publishes a separate Non-UMK access registration guide . Use the route appropriate to the business and inspect its actual company profile and project records. A Coretax role does not confer OSS authority. Likewise, confirm separately how a notary, authorised corporate representative or other permitted filer handles work with the Directorate General of General Legal Administration (AHU); do not request another professional’s personal credentials.

For every portal, record the recognised representative, permitted actions, recovery contact, mandate evidence and escalation route. Keep company recovery channels under company administration wherever the platform permits. Where a system requires an individual’s verified contact details, document the lawful replacement process instead of substituting a generic mailbox against system rules. Tested authority is the useful deliverable; a list of usernames is only an inventory.

Select filing workstreams from the company’s actual position

Build the filing calendar from a documented applicability review. Record “applies,” “does not currently apply,” or “unresolved,” with the reason, supporting record, reviewer and next review trigger. A blank calendar cannot distinguish an exemption from an omission. Nor should a generic provider package decide the company’s legal obligations.

• Tax: confirm taxpayer status, accounting year, transactions, payroll and any VAT registration. Assign corporate annual income-tax reporting, together with the periodic withholding, VAT or other workstreams that actually apply. Identify who supplies source data before the preparer’s cut-off.
• Corporate governance and AHU records: allocate annual governance preparation, resolutions and changes to company particulars. Identify the appropriate authorised filing route, and retain evidence of the resulting update separately from the underlying decision.
• Beneficial ownership: include the company’s reporting and maintenance obligations. Reconcile the disclosed natural persons against the ownership and control evidence, rather than simply copying the shareholder list.
• Investment and operating permissions: assess Investment Activity Report (LKPM) obligations, licence conditions and project-specific reporting using the company’s status, activities and locations. Record the relevant period and recipient for each applicable task.
• Employment and specialist activity: assess employment, social-security, immigration, environmental and sector reporting when the company’s people or operations trigger those regimes. Assign a competent owner for each applicable stream.

The annual corporate income-tax return normally falls due within four months after the tax year ends under Article 3(3) of the tax law ; this is not automatically the same calendar date for every company. Put the company’s actual year-end and applicable due date into its calendar. Distinguish statutory deadlines from earlier internal dates for data delivery, review and signing.

AHU’s beneficial-owner reporting circular states that corporations must submit beneficial-owner information and maintain updates. Treat the initial report and later maintenance as separate assigned tasks. A change in the control chain should trigger a review even when the company’s direct shareholder remains unchanged.

For an existing foreign investment company (PT PMA), ownership, activity and reporting consistency checks help establish whether the operating facts still match the record. Resolve a substantive mismatch before turning it into a recurring filing assumption. The calendar should reproduce a reviewed obligation, not perpetuate an untested premise.

Run each filing through an evidence close

Make each obligation traceable from its input to its final evidence. The company’s preparer, reviewer and signer may be different people, and the person who uploads a file may not be the person responsible for its figures. Give one internal owner responsibility for moving the task through those handoffs.

1. Open a task for the correct company, obligation, activity or project, and reporting period. Link the applicable rule or confirmed requirement and record the due date.
2. Collect the source records and reconcile them to the filing fields. Identify missing items, prior-period corrections and assumptions before drafting.
3. Record the reviewer’s decision and the exact version approved for signature. Route unresolved legal, tax or licensing questions to the person qualified to resolve them.
4. Use the authorised submitter and retain the submission outcome. If payment is required, connect its evidence to the correct obligation and period.
5. Check the accepted or reported state required by that workflow, download the available evidence and log any follow-up. Close the internal task only when its evidence requirements are met.

DGT’s corporate annual-return instructions illustrate why this distinction matters. They start with financial statements and other supporting documents, then individual login and corporate impersonation. A return paid through a billing code can remain in a waiting-for-payment state until settlement changes it to reported. A saved draft is not evidence that a filing has been reported. Inspect the final status and retain the available acknowledgement as well as the submitted version.

Set up a close folder for each period containing the approved input reconciliation, filed output, approval record, receipt or status evidence, relevant payment proof and correction correspondence. Use a stable evidence reference in the control register. A screenshot should identify the company, period, status and capture date; crop or redact unrelated personal data before circulating it.

Also define what happens when a task cannot close. The owner records the blocker, next action, responsible person and next review date. A technical error should produce a support trail and retry plan. A disagreement over figures should return to the reviewer. Neither belongs in a “complete” column simply because the service provider has invoiced for the work.

Keep compliance controls working when people or facts change

Compliance activation needs a maintenance rule. Review access when a staff member leaves, an adviser’s engagement ends, a signer changes or the company appoints a new responsible person. Review applicability when the company hires, starts a new activity, changes a location, enters a new kind of transaction or receives a relevant regulatory notice. These are recommended management controls; the legal filing triggered by a particular event still needs its own assessment.

For a provider change, arrange a supervised transfer: obtain the company’s current records and prior submissions, identify open tasks, appoint the incoming authorised users, test access, and then remove obsolete permissions through the proper system process. Obtain confirmation that the replacement can retrieve the evidence. Keep legitimate prior approvals and historical filing records intact.

Where one employee performs several roles, have a director or another designated reviewer inspect the reconciliation and final evidence where feasible. Record that compensating review. Small teams can keep a clear audit trail without pretending they have separate departments. Outsourced preparation should still have a named internal data owner and approval contact.

Use a short recurring exception review rather than asking only whether everything was filed. Examine overdue data, untested replacement access, rejected submissions, missing receipts and unresolved applicability decisions. One accountable internal owner should know which unresolved item could affect the next deadline or the company’s permission to operate. Give that owner authority to obtain records and escalate decisions.

If the former administrator cannot be reached, first preserve the evidence already held, identify the official account-recovery or representative-change route and document authority to use it. Keep the filing team informed of the approaching obligation. Avoid creating a second record or replacing identities merely to bypass a blocked login; the underlying company and its history must remain traceable.

Approve compliance activation only when ownership is demonstrable

Approve the internal setup when a replacement authorised person can retrieve the current record set, the named users can perform their assigned portal tasks, and each applicable obligation has an owner, approval route, due date and evidence requirement. Where a first filing is not yet due, a documented access and input-readiness test can support setup completion; the later filing remains open until its actual evidence exists.

Prioritise any missing authority or uncertain obligation that could affect the nearest deadline. Escalate inconsistent corporate facts, doubtful signing authority and unexplained filing status before relying on them. This is the company’s operating control decision. Each government registration, permission and filing retains its own completion standard.