EFIN Activation in Indonesia: When Is It Needed and How Does Coretax Differ?

Identify the service before requesting EFIN

EFIN means Electronic Filing Identification Number. The DJP Online registration screen still asks for an NPWP, EFIN and security code. Its instructions direct individual taxpayers to a tax service office (KPP) and corporate taxpayers to their registered KPP to obtain EFIN. This is evidence for that particular registration route, rather than a reason to insert EFIN into every Indonesian tax-account workflow.

Start by writing down the service you need, the taxpayer concerned and the period involved. Check the actual portal before requesting a credential. DGT’s limited-use guidance for DJP Online directs filing and payment for tax years 2024 and earlier to DJP Online, with exceptions. Final income tax on land and buildings uses Coretax even for an earlier transaction, as do payments of tax bills and assessments for earlier years. The year alone therefore cannot determine the route.

If the confirmed service requires legacy registration and the taxpayer has no activated EFIN, use the official EFIN application form and obtain the current applicant and supporting-document requirements from the relevant KPP. For a company, establish who may submit the request on its behalf before sending identity documents. Once EFIN is available, complete registration in DJP Online using the fields shown there. A saved EFIN application alone is not proof that portal registration succeeded.

If EFIN was already issued but cannot be located, first distinguish recovery of an existing identifier from a first activation request. Keep that distinction in the support request, together with the taxpayer’s NPWP and the exact application involved. Do not submit repeated activation requests merely because a Coretax password is missing.

Choose the correct Coretax access route

Choose the route according to the taxpayer’s previous digital access. The official Coretax entry instructions distinguish three starting positions. A company’s NPWP record and an individual’s account history are different facts, so check whose account you are trying to open before selecting a menu.

• Use “Lupa Kata Sandi” (Forgot Password) for a taxpayer already registered with DJP Online. Request the Coretax reset through an accessible registered email address or mobile number, then follow the reset link.
• Select “Aktivasi Akun Wajib Pajak” for an existing NPWP holder who has never used DJP Online. Complete the digital-access request and its identity checks.
• Use “Daftar di Sini” for someone who has no NPWP and needs taxpayer registration. Do not attempt to solve a missing taxpayer registration through EFIN activation.

For the second route, Coretaxpedia’s digital-access procedure instructs the applicant to confirm existing registration, search the NPWP, validate a selfie, enter contact details, accept the declaration and save. Follow the activation link sent by email. Its January 19, 2026 update also allows replacement contact details within this request, with OTP verification of the new email and telephone number.

Use that updated contact procedure for the situation it describes: an existing NPWP holder without DJP Online access. Do not assume it also resolves every password-reset or corporate-authority problem. An inaccessible mailbox can prevent completion even when the tax identifier is correct. Check receipt of the message and successful login before marking access complete.

These routes establish the scope of the comparison: EFIN is an input to the legacy registration screen, while Coretax uses its own access and verification steps. They are not interchangeable codes. If the displayed result conflicts with the taxpayer’s known history, keep the message, attempted route and identifier for DGT support instead of creating a second taxpayer record.

Make the company accessible to the right person

The company needs an appointed person who can enter its Coretax context. DGT’s corporate annual-return instructions start with the responsible person, representative or authorized tax proxy logging in as an individual, then using “impersonate” to select the corporate NPWP from the dropdown. DGT separately explains that corporate access is tied to the appointed individual to prevent shared corporate-password use and make actions traceable. Check the company name and NPWP displayed after the switch.

For a foreign investment company (PT PMA), keep the company record separate from its directors’ or advisers’ personal credentials. The records produced during company formation in Indonesia establish the underlying entity and its governance; a later tax-account access test must still identify the person acting and the company selected. Holding the incorporation file does not demonstrate a working Coretax login.

Ask the company to name the preparer, the person authorized to sign and the officer who approves the finished tax document. These may be different people. Record their intended functions and check that the actual portal access supports each function. Company access and signing authority should be checked as separate items rather than inferred from one successful login.

If the expected company cannot be selected, pause the company task and investigate the individual-to-company relationship and authority record. An EFIN request does not, by itself, establish that relationship. Preserve the current management and appointment evidence for the person resolving the issue; share sensitive identity material only through the channel required for that request.

Separate login credentials from signing credentials

Coretax signing requires a separate check after access works. DGT’s guidance on who holds signing credentials states that corporate accounts are not issued their own authorization code or electronic certificate: an appointed individual signs as representative or proxy using their own credential. The authorization-code procedure explains the request and status checks. The signing passphrase serves a different function from the account login password.

1. Open “Portal Saya” in Coretax and select “Permintaan Kode Otorisasi/Sertifikat Elektronik”.
2. Choose “Kode Otorisasi DJP” as the digital-certificate type, create the passphrase, accept the declaration and save.
3. Check “Portal Saya” > “Profil Saya” > “Nomor Identifikasi Eksternal” > “Digital Certificate” for the ownership status.
4. Follow DGT’s “Periksa Status” and issuance instructions if the credential is shown as Invalid; confirm that it becomes Valid before relying on it for signing.

DGT’s corporate filing procedure separately calls for choosing the signature provider, entering the passphrase and confirming the signature. Match the signing arrangement to the person and company task actually authorized. A preparer who can open a draft has not yet demonstrated that the intended signatory can complete this stage.

Keep the account password, signing passphrase and any retained legacy EFIN distinguishable in the access register, without writing the secret values into that register. Record the custodian and the approved recovery method instead. Where outside support is used, arrange supervised checks so the company can observe the result without distributing a director’s personal credentials across a team. This is an internal control recommendation, not an additional DGT application step.

Record what each successful access test proves

Use a four-test record when a provider, director or finance employee says that “tax access is activated”. The following completion tests translate the official portal functions into a practical handover. They are a suggested company control; they do not replace DGT’s requirements or certify the substance of any tax return.

Give each failed test an owner and a specific correction. A missing activation email goes to the access/contact workstream; a missing company selection goes to the authority workstream; an invalid signing credential goes to the credential workstream. This makes a support request more useful than “EFIN not working” when the actual failure occurs elsewhere.

The final tax service has its own finish line. For example, the official corporate annual-return procedure distinguishes a return that is reported from one waiting for billing-code payment. After access and signing are resolved, retain the evidence needed after annual return submission so a working account is not mistaken for a completed filing. Save the submitted document and the official acknowledgment relevant to that service.

Plan from confirmation of the correct route to a successful access, company-context and signing check. No combined end-to-end processing duration is assumed here: identity verification, delivery of account messages, contact correction and authority issues can each interrupt the sequence. Test before the intended submission date and keep the remaining tax preparation and payment work on a separate timetable.

DGT’s registration service directory lists taxpayer account activation and authorization-code requests separately from changes to taxpayer data and status. That separation matters when the problem is an incorrect master record rather than a forgotten credential. Record the correction actually needed and its official output; an account password change should not be treated as evidence that the company’s tax particulars were corrected.

Close EFIN or Coretax access against the intended tax task

For a legacy DJP Online task, close the access work only after the required registration or recovery route works for the correct taxpayer. For a Coretax task, start with the appropriate password-reset or activation route, then verify the individual’s company context and the intended signing arrangement. Keep the evidence for each completed test with a named company owner.

Stop the affected task when the identity, corporate authority or signing result cannot be confirmed. Resolve that specific gap through DGT’s applicable procedure before submitting a company document. The decision is whether the right person can complete the intended tax action with the correct taxpayer record—not simply whether someone possesses an EFIN.