You've found a contractor in Indonesia. They send you an invoice. You assume it's valid because they're a real person with a real business. Then tax season arrives and your accountant flags it: the NPWP (Nomor Pokok Wajib Pajak, the Indonesian tax ID) is either fake, inactive, or doesn't match the entity on the invoice. By then you've already paid them and withheld tax. The Indonesian tax authority (DJP) doesn't care about your good intentions—you owe penalties, late interest, and a reconciliation audit. NPWP validation is not optional compliance theater. It's a hard gate before payment, and it has to happen before you calculate withholding. Here's exactly what to check, when to check it, and how to stop it from blocking your first contractor payment for 72 hours. What NPWP validation actually means An NPWP is a 15-digit tax identification number issued by the DJP to individuals and entities that earn income in Indonesia. The format looks like this: First 8 digits: unique identifier assigned by DJP Digits 9–12: branch code (typically 0001 for the main office) Digit 13: entity type (1 = individual, 2 = non-individual) Last 2 digits: check digits (Luhn-style validation) Validation is not just checking that the format is correct. You need to verify three things: Format and checksum: 15 digits, valid Luhn check, digit 13 matches the declared entity type Active status: The NPWP is currently registered and has not been suspended or merged Entity match: The NPWP belongs to the person or company issuing the invoice, and the name on file matches the contract The DJP maintains a public database (NPWP verification through e-Faktur and the official portal), but access to full active-status confirmation requires either a letter of appointment from the contractor or real-time lookup through a tax software vendor. If you withhold tax based on an NPWP that turns out to be inactive or belongs to someone else, you are liable for the unpaid withholding. The three validation gates before payment Gate 1: Format validation (same-day) This is instantaneous and automated. The NPWP must be exactly 15 digits, and the last two digits must pass a checksum algorithm. A contractor gives you 15-digit number; your system either flags it as malformed or passes it. This catches typos and obviously fake numbers. Example: An NPWP of 12.345.678.9-1234.5 (formatted with punctuation for readability) should strip to 123456789123445 before validation. If the Luhn check fails, reject it immediately. Gate 2: Entity-type consistency (2–4 hours) The 13th digit encodes whether the NPWP holder is an individual (1) or entity (2). You must verify this matches the contractor's contract type: If the contract says "individual contractor," digit 13 must be 1 If the contract says "PT [company name]," digit 13 must be 2 If there's a mismatch, the contractor either registered the NPWP under the wrong type or is using someone else's number. Either way, do not pay until they clarify with the DJP or you have written confirmation of the correct NPWP. Gate 3: Active-status and name-match verification (1–3 days) This is the step that takes time and is often skipped. You need confirmation that the NPWP is: Currently active (not suspended, merged, or expired) Registered to the exact name and entity on the contract (no nickname variations, no alternate legal names without formal change documentation) In Indonesia, the only way to get definitive proof is: Direct query through tax software: If the contractor uses e-Faktur (Indonesia's real-time invoicing system) or a certified tax software provider, you can cross-reference their NPWP through the vendor's API. This takes 2–8 hours. Contractor-provided proof: Ask the contractor for a printout of their NPWP registration letter (Surat Keterangan Terdaftar, SKT) or an active e-Faktur certificate. These documents are not confidential and contractors expect to provide them. Allow 24–48 hours for the contractor to send this. Third-party verification service: Some accounting firms and fintech platforms in Indonesia offer real-time NPWP verification through the DJP's portal. Expect to pay ₱50–200K (USD 3–12) per lookup and allow 4–24 hours. The fastest route is Gate 1 + Gate 2 (both same-day) followed by a request for the contractor to provide their SKT or current e-Faktur certificate. This takes you to certainty in 24–48 hours instead of 72 hours. Tax withholding: the 3-digit code and remittance timeline Once you've validated the NPWP, you withhold tax from the contractor's invoice. The withholding rate and remittance deadline depend on the type of service: Services (most contractors): 2% withholding (PPh Pasal 23), remit by the 10th of the following month Professional services (consulting, design, copywriting): 3% withholding (PPh Pasal 23), remit by the 10th of the following month Certain technical services (engineering, IT support): 2% withholding (PPh Pasal 23), remit by the 10th of the following month Labor or management fee f