When is the annual tax return (SPT Tahunan) due in Indonesia?

Under UU KUP, no later than three months after the end of the tax year for individuals and four months for companies. For a calendar tax year that is 31 March and 30 April. For tax year 2025 the DJP waived late penalties for a month after the deadline; that policy does not automatically carry over to later years.

BPA1 is the new name in Coretax for the annual Article 21 withholding slip for private-sector employees, replacing form 1721-A1. For civil servants, 1721-A2 became BPA2.

What should we ask an employee client for?

At minimum the BPA1 or BPA2 slip, whether their NIK has been matched and their Coretax account is active, assets and debts at 31 December, changes in dependants, and any other withholding slips if they had a second source of income.

Is it safe to receive ID cards and tax cards over WhatsApp?

Clients will keep sending them that way, so what matters is what happens next: move them to the client folder, delete them from staff phones, never forward them to other chats, and use a firm number rather than a personal one.

How can clients send documents without creating an account?

Through a portal or upload link per client, or a mail-in address per client. Both put files straight into the right client folder instead of being forwarded out of a staff inbox or chat.

How to Collect Documents from Clients in Tax Season

Tax season and hundreds of WhatsApp chats

Every February to April the same pattern plays out in tax consultancies and audit firms. A client sends a photo of a withholding slip over WhatsApp at eleven at night. Financial statements arrive by email as "final_revisi3.xlsx". Bank statements go to the personal number of someone who is on leave next week.

The cause is rarely lazy clients. It is that clients have no clear list and no single place to send things. This guide gives you a document list per client type, a naming scheme, a routine for requesting and chasing, and basic security habits for tax documents.

The deadlines to plan around

Under Article 3(3) of the General Tax Provisions Law (UU KUP), an individual's annual income tax return (SPT Tahunan) is due no later than three months after the end of the tax year, and a company's no later than four months. Where the tax year is the calendar year, that means 31 March for individuals and 30 April for companies.

2026 was unusual. Returns for tax year 2025 were the first filed through Coretax, the tax office's new system, and the Directorate General of Taxes (DJP) waived late-filing penalties: for individuals until 30 April 2026 (KEP-55/PJ/2026), and for companies for one month after the normal deadline (KEP-71/PJ/2026). That relief applied to tax year 2025 only. Do not assume it will be repeated; plan from the normal deadlines.

Some Coretax changes affect what you ask clients for, according to the DJP:

Employees now use a single individual income tax return form, replacing forms 1770 S and 1770 SS.
Withholding slip 1721-A1 for private-sector employees is now called BPA1, and 1721-A2 for civil servants is now BPA2.
Since 1 July 2024 the national ID number (NIK) has served as a resident individual's tax number (NPWP) (PMK 136/2023). An NIK that has not been matched will hold up filing.
Clients need to activate their Coretax account and create an authorisation code to sign the return.

Put these on the list you send clients, rather than raising them a week before the deadline.

Documents to request, by client type

These lists are a starting point, not an official DJP list. Adjust them per client and check them against the DJP's filing guides for each type of taxpayer.

Employees with one employer

BPA1 (private sector) or BPA2 (civil service) withholding slip from the employer
Whether the NIK has been matched, and the state of the Coretax account
Family card, if dependants have changed
Assets at 31 December: savings, deposits, vehicles, property, investments
Debts at 31 December: mortgage, vehicle loan, credit cards
Receipts for zakat or other obligatory religious donations, if the client wants to claim them
Any other withholding slips, if there is a second source of income

Self-employed individuals and sole traders

Everything relevant from the employee list
Bookkeeping, or a record of monthly turnover
Withholding slips from the parties who paid the client
A full year of business bank statements
Proof of tax payments made during the year
A list of assets used in the business

Companies, and audit clients

For an audit firm this list usually overlaps with the PBC (prepared by client) list. Merge the two so the client does not get two requests for the same document.

Annual financial statements, and the auditor's report if audited
Trial balance and general ledger
Bank statements for every company account
Withholding slips received from others, and a summary of slips issued
Input and output VAT invoices, for VAT-registered businesses
A year of monthly returns (SPT Masa) with payment receipts
Fixed asset and depreciation schedule
The latest amended deed, if directors or shareholders changed
Documents for related-party transactions, if any

File naming and folder structure

Pick one scheme and use it for every client. Which scheme matters less than everyone on the team using the same one.

A folder structure per tax year:

TP2026 / PT Maju Jaya / 01 Identity and accounts
TP2026 / PT Maju Jaya / 02 Income and withholding slips
TP2026 / PT Maju Jaya / 03 Assets and debts
TP2026 / PT Maju Jaya / 04 Financial statements
TP2026 / PT Maju Jaya / 05 Draft return
TP2026 / PT Maju Jaya / 06 Filing receipt

A file-name pattern: tax year, client, document type, detail, date received. For example "TP2026_MajuJaya_BankStatement_BCA-Dec_2027-02-15.pdf".

Rules that make it stick:

Write dates year-month-day so they sort correctly.
Never use "final" or "revised". Use the date.
One document, one file. Twelve photos of a bank statement become one PDF.
Rename files when they arrive, not when someone needs them.
Move wrong or duplicate files to an "Unused" subfolder rather than quietly deleting them.

A routine for requesting and chasing

Work backwards from the deadline. For an individual client due on 31 March:

Early January. Send each client their document list with one link or address to send to. One message with the whole list, not a trickle.
Late January. Check who has not yet received their BPA1 from their employer, and whose NIK has not been matched.
Mid-February. First reminder. Name each missing document rather than asking for "the remaining documents".
Early March. Second reminder, by phone for clients still missing a lot. Set an internal cut-off, say 10 March.
After the cut-off. Send the draft return for approval, noting which documents it relies on.

For companies, move everything about a month later.

A reminder that works names the person, the missing documents, the deadline and the one place to send them:

Pak Hendra, for your 2026 return we are still waiting for two documents: your BCA statements for October to December and the withholding slip from PT Sinar. Please send them through the same link by Monday 8 March. Thank you.

Log every reminder in one place, such as a status column on your client list. When a client says nobody reminded them, you have the answer.

Security basics: NIK and NPWP are not for forwarding

Tax documents are full of personal data. Article 4 of the Personal Data Protection Law (UU PDP) classes personal financial data as specific personal data, the category where a leak does more harm. Simple habits that reduce the risk:

Do not forward photos of ID cards, tax cards or family cards from chat to chat, internal groups included. Store them once in the client's folder and point to it.
Delete client files from staff phones once they are in the firm's folder.
Do not take client documents on a member of staff's personal WhatsApp number. Use a firm number or address.
Limit each client folder to the team handling that client.
If you use AI to summarise documents, make sure identity numbers are not sent with them, or are masked first.
When someone leaves, remove their access that day, including from client WhatsApp groups.

One place to send, for every client

The most effective fix is giving each client one place to send things. Two forms work well together:

A portal or upload link per client. The client opens the link and uploads, and cannot see anyone else's files. No account needed.
A mail-in address per client. The client forwards emails with attachments to that address and the attachments land in the right folder. Good for clients who live in email, and for the office scanner.

Clients will still use WhatsApp, and that is fine. What you can control is where the files end up.

In folders.id

Client portals that receive or exchange files: clients upload without an account, behind a password and an expiry date, and see only what they are allowed to.
A mail-in address per folder, with an allowed-senders list and a daily limit.
WhatsApp files from a registered client number go straight to that client's folder. One number routes to one folder, and the WhatsApp channel has to be set up first.
A delivery log showing which files arrived and which were refused, so "I sent it, where is it?" can be answered from the screen.
Every file is scanned for malware, and scanned documents can be read with Indonesian OCR.
NIK and NPWP are masked before an AI reads the document.

You still send the reminders yourself. folders.id makes sure the replies land in the right folder.

Start with one habit: one place to send, for every client. The rest gets much easier after that.