Company secretarial compliance is now a digital-control question for boards: how can they retain control of records, signatures and shareholder data as filing moves online? Indonesia's corporate filing machinery now runs almost entirely online: NIBs are issued through OSS, company-law records sit with AHU, and tax reporting flows through Coretax, so the 2026 question is no longer whether to digitise secretarial work but how to do it without losing control.
In this blog, we discuss what secretarial compliance covers in Indonesia, which official systems are already digital in 2026, where the risks sit, and the safeguards — from multi-factor access control to cloud company secretary software — that keep electronic filings defensible.
What Does Company Secretarial Compliance Cover in Indonesia?
It covers the record-keeping and filing duties a board cannot delegate away: constitutional records, registers, meetings, resolutions, and the statutory filings owed to the Ministry of Law, BKPM and the tax office.
Corporate secretarial work is the record-keeping and filing layer of Indonesian company law. Its baseline is Law No. 40 of 2007 on Limited Liability Companies, read together with the Ministry of Law's general legal administration regime, known as AHU. It runs from the deed of establishment through to every later change in directors, shareholders or capital.
The obligations sit on a fixed clock. An annual general meeting must be held within six months of the financial year-end under Article 78 of the Company Law, and it must ratify the annual report and the board of directors' report. The annual corporate income tax return goes to the tax office within four months of year-end. Entities meeting the criteria must also arrange statutory financial auditing and reporting services in Indonesia, which is a separate obligation from filing the tax return.
Foreign-owned companies (PT PMA) add an investment-reporting layer owed to BKPM. Our corporate secretarial services in Indonesia are built around this calendar, mapping every obligation to a named owner and a reminder date. The table below sets out the deadlines a board cannot miss in 2026.
1. Constitutional records and registers
Every company must keep its deed of establishment, articles, shareholder register and share class details current. Changes must be reflected in the company’s registers and, where required, notified to or approved by the Minister through AHU; the legal effect depends on the type of change.
2. Meetings, resolutions and annual reporting
Minutes, notices and ratified annual reports form the evidentiary backbone of compliance. They must be complete, signed and producible on request, not merely drafted and filed away loosely.
3. Investment and licensing filings
PT PMA entities file the quarterly LKPM investment activity report through OSS and keep the NIB current. Sector licences run on their own validity periods and renewal cycles. A chiropractic clinic in Indonesia is one example of a business that must manage operational approvals alongside its corporate records.
2026 Compliance Calendar for an Indonesian Company
| Obligation | 2026 deadline | Authority |
|---|---|---|
| Annual general meeting (AGM) | Within 6 months of financial year-end | Ministry of Law (Company Law, Article 78) |
| Annual financial statements | Within 4 months of financial year-end | Tax Office (DJP) |
| LKPM investment report | Quarterly for medium and large businesses — by 15 April, 15 July, 15 October and 15 January of the following year | Ministry of Investment and Downstream Industry/BKPM via OSS |
| NIB update | As required on the OSS platform | BKPM/BKPMI |
| PPh 25 corporate income tax instalment | 15th of the following month | DJP |
| PPh 21 and PPh 23 withholding | Pay by the 15th, report by the 20th of the following month | DJP |
| VAT periodic return | Last day of the following month (12 percent statutory rate; effective 11 percent for most non-luxury transactions) | DJP |
| Annual corporate income tax return | 30 April of the following year (extension possible) | DJP (22 percent standard rate in 2026) |
Which Official Systems Are Already Digital in 2026?
Most of the core filing burden is already online: OSS-RBA issues the NIB and licences, AHU carries company-law filings, and Coretax plus e-Faktur handle tax administration.
Indonesia's filing infrastructure went digital before most boards noticed. Three systems now carry the bulk of the work: OSS for licensing, AHU for company law, and the Directorate General of Taxes (DJP) for tax administration.
The Online Single Submission (OSS) platform applies a risk-based approach. It issues the business identification number (NIB), licences and registration certificates against the company's KBLI business classifications. NIB issuance itself carries no core platform charge, though certain sector or local permits levy separate fees. New investors can follow the full sequence in our step-by-step guide to company registration in Indonesia.
Company-law filings run through the AHU portal operated by the Ministry of Law's Directorate General of General Legal Administration. Its PNBP (non-tax state revenue) tariffs were revised by Government Regulation No. 30 of 2026, effective 1 August 2026, and now scale with authorised capital, as the table below shows.
The outcome is predictable for a PT PMA. BKPM Regulation No. 5 of 2025 cut the minimum paid-up capital for foreign-owned companies from IDR 10 billion to IDR 2.5 billion, a 75 percent reduction, deposited after the corporate bank account opens and retained for twelve months. Authorised capital typically sits at or above that threshold, so most foreign investors land in the top two tariff bands. Our guide to the minimum capital of a PT PMA in Indonesia explains the mechanics.
Tax completes the picture. DJP's Coretax system now carries corporate registrations and returns, with e-Faktur generating electronic invoices for monthly VAT reporting, while the company must record at least one responsible related person using the applicable NIK, tax identification numbers (NPWP) or TIN. Indonesia's digital tax collection also shows how digital technology companies are brought into the tax system.
1. OSS-RBA: NIB and risk-based licensing
The platform grades each business line by risk and issues the matching licence or certificate. Investment plans are typically sized above IDR 10 billion per KBLI line, excluding land and buildings in most cases.
2. AHU: company law moves online
Establishment, amendments and changes to officers or shareholding are filed through AHU-backed services. Fees were revised in August 2026: authorised-capital bands apply to registration of a company’s establishment, while amendments and data-change notifications carry separate tariffs.
3. Coretax and e-Faktur: tax filings go end-to-end digital
Monthly instalments, withholding reports and VAT returns now flow through DJP's digital systems. PPh monthly returns are generally due by the 20th and VAT returns at month-end; VAT is charged at a statutory rate of 12 percent, with an effective 11 percent burden for most non-luxury supplies.
AHU Establishment Tariffs Under PP No. 30 of 2026
| Authorised capital band | PNBP tariff (IDR) |
|---|---|
| Up to IDR 25 million | 300,000 |
| Above IDR 25 million to IDR 1 billion | 600,000 |
| Above IDR 1 billion to IDR 5 billion | 1,500,000 |
| Above IDR 5 billion | 5,000,000 |
Where Do the Security Risks Sit Once You Go Digital?
The dangers are mundane, not exotic: stolen credentials, fake portals imitating official systems, exposed personal data, and audit trails that cannot prove what was filed and when.
Digital filing does not change the law; it changes where failure happens. In our experience, incidents cluster in three places: access credentials, personal data, and the integrity of the filing record itself.
Credentials are the master key. An OSS or Coretax account held in a director's name can amend officers, licences and returns, so a stolen password is a governance breach, not just an IT problem. Phishing pages that imitate official portals remain the usual entry route.
Personal data is the second exposure. Indonesia's Personal Data Protection Law (Law No. 27 of 2022, the PDP Law) requires companies to secure, minimise and account for the personal data they hold. Shareholder registers are full of it: identity numbers, passport details, residential addresses and signatures.
The third risk is evidentiary. If a filing is later disputed, the company must show what was filed, by whom and when. Scattered email threads and personal folders rarely survive that test.
1. Account takeover and impersonation
Multi-factor authentication, password managers and a rule against clicking emailed links to official portals blunt most credential attacks. Director-level accounts deserve the strictest settings.
2. Personal data in shareholder records
Registers and minutes sit squarely within the PDP Law. Apply least-privilege access, encryption and logging, with a written retention schedule for identity documents.
3. Version confusion and lost evidence
When drafts live in several places, boards lose track of the executed version. Centralised, version-controlled storage with an immutable log prevents that drift.
How Should You Evaluate Cloud Company Secretary Software?
Judge any platform on four tests: security posture, record integrity, integration with Indonesia's official systems, and access control.
Software does not remove duties; it removes friction. Cloud company secretary software earns its keep in four areas — secure record-keeping, automated deadlines, licensed electronic signatures and filing evidence — provided the platform passes the four tests set out below.
In client migrations, we see the same evaluation gaps. Teams fixate on features and forget hosting, or choose a tool that cannot export filing receipts or fit the OSS-AHU-Coretax workflow. The tests below are the ones that matter, and the table contrasts the two working styles.
1. Security and hosting
Look for encryption in transit and at rest, enforced multi-factor authentication, and an independent security certification. Ask where data is hosted and how the vendor copes with an outage.
2. Records and audit trail
The system should keep complete version history for every document and log every action. Regulators and notaries ask for the executed version, not the latest draft.
3. Integration with official platforms
A good tool slots into the OSS-AHU-Coretax sequence rather than competing with it. NIB records, filing receipts and resolution packs should export cleanly on demand.
4. Access control and user management
Insist on role-based permissions and least-privilege defaults. The quietest risk is a former employee or adviser who can still file on the company's behalf.
Manual Filing vs Cloud Company Secretary Software
| Compliance task | Manual approach | Cloud-based approach |
|---|---|---|
| Statutory registers | Binders and spreadsheets updated by hand | Version-controlled registers with full history |
| Deadline tracking | Calendar reminders and memory | Automated alerts tied to each obligation and owner |
| Resolutions and signatures | Printed drafts circulated for wet-ink signing | Licensed e-signatures with tamper-evident logs |
| Filing evidence | Email confirmations saved in folders | Receipts and timestamps stored in one audit trail |
| Access control | Whoever holds the physical file | Role-based permissions with offboarding |
What Safeguards Keep Digital Secretarial Work Defensible?
A defensible digital workflow rests on five controls: obligation mapping, consolidated records, tight access management, licensed e-signatures, and retained filing evidence.
Digitising safely is a sequence, not a switch. The five controls below turn a paper routine into a digital one a board can defend before a regulator, a notary or a court.
We help clients run this migration end to end, from obligation mapping to vendor reviews, and you can contact us for a readiness check on your current stack.
Step 1: Map every obligation and owner
Start from the 2026 calendar above and assign each filing a named owner and a reminder date. Unassigned obligations are the ones that slip.
Step 2: Consolidate records into one secure system
Move deeds, registers, resolutions and filing receipts into a single version-controlled repository. Encrypt it, back it up and retire the scattered folders.
Step 3: Enforce MFA and least-privilege access
Require multi-factor authentication on every OSS, AHU and Coretax account, and grant each user the narrowest role that allows the work. Revoke access the day it stops being needed.
Step 4: Sign with licensed e-signatures and verify every portal
Indonesia's ITE Law recognises electronic signatures for most commercial documents, though deeds of establishment still run through a notary. Type official URLs directly rather than clicking emailed links.
Step 5: Retain filing evidence and test recovery
Keep every NIB, licence and filing confirmation with its timestamp, and test backups before they are needed. Evidence is what converts a filed document into a defensible one.
Conclusion
Indonesia has already made digital the default. OSS issues the NIB, AHU keeps the company-law record, Coretax and e-Faktur carry tax reporting, and PNBP tariffs now follow authorised capital under PP No. 30 of 2026. What a board still controls is how safely it makes the switch.
Safety does not come from buying a tool. It comes from mapped obligations, consolidated records, multi-factor access control, licensed e-signatures and retained filing evidence — the five controls this article walked through, and the same checks we apply when migrating clients from paper to cloud.
As a Corporate Services Provider spanning company incorporation, corporate secretarial, accounting, tax and business advisory, 3E Accounting Indonesia helps boards digitise their compliance processes without losing control of the record. Reach out for a phased migration plan for your entity.
Digitise Your Compliance With Confidence
3E Accounting Indonesia helps Indonesian boards move company records, filings and signatures online without losing control of the evidence trail.
Frequently Asked Questions
For most core filings, yes. The NIB and business licences are issued through OSS, company-law filings run through AHU, and tax returns go through DJP's Coretax and e-Faktur systems. Paper survives only at the edges, such as notarised deeds.
Yes, for most commercial documents. The ITE Law recognises electronic signatures and electronic records. Incorporation deeds and certain corporate changes still require a notary in wet-ink form.
Under PP No. 30 of 2026, effective 1 August 2026, PNBP tariffs range from IDR 300,000 to IDR 5 million depending on authorised capital. Most PT PMAs pay IDR 1.5 million or IDR 5 million because their authorised capital sits above IDR 1 billion.
No. It automates records, reminders, signatures and evidence, but statutory accountability stays with the directors. Professional support keeps filings correct and current as the rules change.
Quarterly. Reports go to BKPM/BKPMI through OSS in January, April, July and October, covering investment realisation and progress under the company's approved plan.
Abigail Yu
Director
Abigail Yu oversees executive leadership at 3E Accounting Group, leading operations, IT solutions, public relations, and digital marketing to drive business success. She holds an honors degree in Communication and New Media from the National University of Singapore and is highly skilled in crisis management, financial communication, and corporate communications.
