BAST (Berita Acara Serah Terima): A 7-Signer Handover Checklist

A BAST (berita acara serah terima) is the handover certificate that buyer and vendor sign to record that delivered work was inspected against the contract and accepted. In English-language contracts it does the job of an acceptance certificate. Indonesian law sets out a handover procedure only for government procurement: Peraturan LKPP 3/2026 uses the phrase "serah terima" 105 times, while the abbreviation "BAST" appears in none of the nine regulations we searched on 8 November 2026, including PADK 1/2026 and POJK 11/POJK.03/2022, the two OJK rules on bank IT. For a bank, insurer, multifinance company or listed issuer taking delivery of a vendor-built website or app, the BAST is a contract document, and each signature on it can trigger a payment milestone, a transfer of risk, the start of the warranty period and the point at which Article 23 withholding tax falls due.

This piece closes our buying series. Terms of reference for a bank website or app fixes what's being bought, tender rules for Indonesian banks, insurers and issuers fixes how the vendor is chosen, and the owner's estimate (HPS) for a website or app fixes the price. UAT and the amortisation of software assets are covered in two articles in this series that aren't published yet.

What BAST stands for, and which rule governs it

BAST stands for berita acara serah terima, literally "minutes of handover". That's a convention, not a legal definition. We searched nine primary texts for the string "BAST": Peraturan LKPP 3/2026, PADK 1/2026, POJK 11/POJK.03/2022, PP 44/2022, PMK 78/2024, UU 10/2020, PMK 141/PMK.03/2015, UU 27/2022 and PP 71/2019. It returned zero in every one. "Serah terima" appears 105 times in LKPP 3/2026 (110 if the joined form "diserahterimakan" is counted) and zero times in the other eight, both OJK bank-IT rules included. Our count allows for the phrase breaking across a line, which a plain search of the PDF text misses three times.

The definition that sits in the legal dictionary of JDIH Kemenkeu, the Ministry of Finance's legal database, is a grant-accounting term. It covers the handover of goods, services or securities from a grant giver to a grant recipient. It first appears in PMK 230/PMK.05/2011 on grant accounting, Article 1 point 25. PMK 271/PMK.05/2014 repeated it in Article 1 point 27 when it revoked 230/2011, and 271/2014 was itself revoked by PMK 201/PMK.05/2021. The dictionary also lists PMK 197/PMK.07/2011 as a source, but that regulation allocates property-tax revenue-sharing funds for the 2012 budget and contains no BAST definition. None of it describes accepting a build from a contractor.

For a website or app build, the closer reference is Chapter VII of Peraturan LKPP 3/2026 (enacted 21 September 2026), which lays out the sequence. The PPK below is the government's commitment-making officer, the official who signs the contract:

1. Before handover, the PPK inspects the work, optionally with a technical team (§7.1.1 b), against "kriteria/spesifikasi yang tercantum dalam Kontrak", the criteria and specifications stated in the contract (§7.1.1 c).
2. If the work doesn't match, the PPK orders the vendor to repair or complete it (§7.1.1 d).
3. The PPK and the vendor sign the berita acara serah terima (§7.1.1 e).
4. Payment is 95% with 5% retained through the maintenance period, or 100% against a 5% maintenance bond (§7.1.1 g).
5. The maintenance period, "apabila diperlukan" (where needed), ends with a final handover (§7.2 h), and the bond is returned within 14 working days after it (§7.2 j).

This binds government agencies, not banks or issuers. The 5% is a public-procurement benchmark, not a software contracting norm. What a private buyer can use is the order of steps: inspect, repair, then sign.

A BAST is not a UAT sign-off, and OJK never names it

For banks, the document OJK requires is the UAT record, not a BAST. PADK 1/2026 (enacted 23 January 2026, in force 1 March 2026) sets two gates in Appendix I, Chapter II.C.2:

UAT oleh pengguna akhir dilakukan setelah pihak pengembang memberikan berita acara atas hasil pengujian SIT.

In English: end-user UAT happens after the developer has issued its record of the SIT results. If the outcome meets "kebutuhan pengguna dan standar pengamanan Bank" (user needs and the bank's security standards), the bank must produce a "berita acara UAT yang disetujui pengguna", a UAT record approved by the users. Internal audit may take part in testing provided it keeps its independence. So a good BAST cites the reference numbers of the SIT record and the UAT record. It doesn't replace them.

A public document shows how this goes wrong. We read, page by page, the BAST for a staff-management application built for a provincial government agency in 2023: a contract of roughly Rp199 million, 60 calendar days. The inspection record, the BAST and the payment record all carry the same date, the last day of the contract. The inspection was "physical" only: "1 Paket, Prestasi 100%, Lengkap" (one package, 100% progress, complete). The inspection record names the application differently from the contract and the BAST, and nobody caught it. Across its four pages there's no test evidence, no source code, no documentation, no warranty period and no defect list.

The checklist, by signer

The templates that rank for this term say "both parties" and stop there. In a bank or listed company, as many as seven functions sign or initial a BAST. We put compliance and security first because they're the two that can halt the signing.

1. Compliance

• Electronic system operator (PSE) registration. A new website or app with a new URL, IP address or data location changes the data registered under Permenkominfo 5/2020 (promulgated 24 November 2020), Article 3(4) letters c, d, g and h. Article 5 requires changes to be reported, and Article 7(1)b sanctions failure to do so. That a launch counts as a "change" is our reading.
• OJK's right of access to the vendor is written into the contract: POJK 11/POJK.03/2022 (promulgated 7 July 2022), Article 30(3) letter i.
• Any subcontractor who worked on the build has the bank's written approval (Article 30(3) letter d).

2. Security (CISO)

• Security controls were tested before implementation (PADK 1/2026, p. 18, letter h), and open findings are listed in the BAST with deadlines.
• Vendor accounts in production are revoked, or their passwords rotated, at handover.
• Copies of personal data in the vendor's test environment are deleted. UU 27/2022 on personal data protection (promulgated 17 October 2022), Article 43(1)a, requires deleting data that is "tidak lagi diperlukan" (no longer needed). Applying that to test copies is our reading.

The CISO's signature doesn't move liability. Article 51(3) of the PDP Law keeps processing by a processor under the controller's responsibility, and Article 37 obliges the controller to supervise it. Impact assessments are covered in our data protection impact assessment guide for Indonesia.

3. IT

• Program integrity from source code to object code, data-migration accuracy, and a parallel run where an old system is replaced (PADK 1/2026, p. 18).
• Custody of the old system's source code and database is settled.
• Every integration point is shown to be live. For CGS International, for example, WEBARQ built connections to banks, CGS-CIMB, KSEI (the central securities depository) and DUKCAPIL (the civil registry). A list like that belongs in the BAST line by line, not as "integrations working".

Once the project closes, PADK requires a post-implementation review comparing planned and actual cost, benefit and schedule. The BAST date is where that clock starts.

4. Business owner

• A user-approved UAT record exists and covers both user needs and security standards.
• The workflows staff will use every day are accepted too. The CMS we built for BCA Group carries a multi-layer approval process across the sites of its insurance, sharia and securities divisions.
• Things deliberately left out are recorded. PFI Mega Life's e-policy system was designed without automatic renewal so that customers stay in control of their policies. A BAST should state exclusions like that as per specification, so nobody later reads them as defects.
• User training is handed over where it's in scope. On the Angkasa Pura Airports project, 16 integrated websites, training airport management staff across locations was listed as part of the work.

5. Legal

• Source-code ownership, or an escrow agreement where the bank doesn't hold the code. PADK treats owning the source code of custom software as a control objective (p. 14) and escrow as a mitigation that "dapat dilakukan", can be done (p. 60). It isn't a requirement.
• Allocation of copyright, patent and trademark risk, and the vendor's duty to hand over technical documents and transfer knowledge (Chapter V B.3.a items 7d, 10 and 13).
• Every scope change approved in writing, with its price. Article 1610 of the Civil Code (KUHPerdata) requires that for building contracts; using it for software is an analogy.
• Electronic signatures meet the six conditions of PP 71/2019 (promulgated 10 October 2019), Article 59(3), including that later changes can be detected (letter c). A signature on behalf of a legal entity is an electronic seal (Article 59(2)). Electronic documents are valid evidence under UU 1/2024, Article 5(1).

The biggest legal consequence sits in the Civil Code, if a software build is read as a contract for work (pemborongan pekerjaan). That's a reading; no text settles it yet. Article 1605 puts the loss of work destroyed before delivery on the contractor, "kecuali apabila pihak yang memborongkan telah lalai untuk menerima pekerjaan tersebut", unless the client has failed to accept it. Refusing to sign without a written defect list can shift that risk to the buyer.

6. Finance

• Paying a milestone is an inspection. Civil Code Article 1608: where work is delivered in parts, inspection is "dianggap terjadi untuk semua bagian yang telah dibayar", deemed to have happened for every part paid, each time the buyer pays in proportion to progress. Pay a milestone before inspecting it and you've accepted that part.
• The invoice due date the BAST triggers, and any retention or maintenance-bond terms.
• The asset recognition date. When website amortisation starts, and over how many years, is the subject of this series' Saturday article, not yet published.

7. Procurement

• Vendor performance and compliance assessment, for which a bank must have a procedure under POJK 11/POJK.03/2022 Article 29(3) letter e.
• Documentation and training were actually received. Where a bank's system development involves procurement, PADK (p. 18) says it should also take into account ("perlu pula diperhatikan") seven factors: spec fit to the bank's needs, impact on existing systems, after-sales technical support, vendor reputation, completeness of documentation, escrow agreement and training. Those are factors to weigh, not obligations, and they're written for commercial banks.
• Service commitments after handover connect to the service contract. The clauses are in our SLA, downtime and cloud credits article.

Table: each signature and what it sets off

The third column is the one no ranking template carries. "Reading" means no regulation text has settled the point.

What a software BAST should list

None of the "IT project" templates on the first page of results has a single one of these fields. A BAST for a website or app should record:

• The source-code repository and the version handed over (tag or commit hash).
• Credentials and administrator accounts transferred, and vendor accounts revoked.
• Environments handed over (production, staging) and who owns the cloud account.
• Third-party licences and components, with expiry dates.
• The reference numbers of the SIT record and the UAT record.
• Open defects, with severity and fix deadline.
• Technical documentation and evidence of training.
• The start date of the warranty or maintenance period, stated explicitly.

Does a BAST need a duty stamp (meterai)?

Stamp duty doesn't decide whether a BAST is valid. Bea meterai is a tax on documents. UU 10/2020 on stamp duty (promulgated 26 October 2020) never mentions BAST. Article 3(2) letter a levies duty on agreements, statements and declarations "atau surat lainnya yang sejenis" (or other documents of that kind), at Rp10,000 (Article 5). Whether a BAST falls in that class is a reading.

The Rp5,000,000 threshold in letter g applies to documents stating that money was received or a debt was settled. It doesn't apply to any BAST worth more than Rp5 million, as several top-ranking Indonesian pages claim. A BAST that only records acceptance of work states no receipt of money. An unstamped document later used as evidence in court must be stamped at that point (Article 3(1)b). PMK 78/2024 (promulgated 18 October 2024), Article 47 and Article 49 letter a, adds a 100% administrative penalty for late payment, and Article 5(6) lets the parties agree who pays.

Tax around the BAST: Article 23 withholding and VAT

Website development is subject to Article 23 income tax withholding (PPh 23) at 2% of the gross amount, excluding VAT. PMK 141/PMK.03/2015 (promulgated 27 July 2015), Article 1(6) letter v, names "Jasa pembuatan dan/atau pengelolaan website" (website development and/or management services), and letter u covers software services. UU 36/2008, Article 23(1), withholds it when income is paid, set aside for payment, "atau telah jatuh tempo pembayarannya" (or has fallen due), and Article 23(1a) raises it by 100% when the vendor has no tax ID (NPWP). So if the contract makes the invoice due on BAST, the withholding is owed then, even if payment comes later. That's our reading of "jatuh tempo"; no text mentions a BAST.

For VAT, the BAST isn't the tax point. PP 44/2022 (promulgated 2 December 2022), Article 23(5), sets the delivery of services at the moment the price is recognised as a receivable or income, or when the tax invoice is issued. Article 23(2)a charges VAT on payment if money arrives first. Its elucidation says delivery happens when the facility "mulai tersedianya fasilitas atau kemudahan untuk dipakai secara nyata", first becomes available for actual use. A BAST can evidence that moment, but it doesn't replace recognition or the invoice.

BAPP versus BAST

BAPP is the common abbreviation for the work inspection (or completion) record: proof that the work was checked. The BAST records that it was handed over and accepted. LKPP 3/2026 runs in the same order: inspection (§7.1.1 b–d) first, the handover signature (§7.1.1 e) after. For software, that inspection is SIT and UAT. An inspection record dated the same day as the BAST, like the provincial example above, deserves a second look: the inspection may never have happened.

When the committee won't sign yet

LKPP 3/2026 has no "berita acara penolakan" (rejection record); the phrase appears zero times. What it provides is the order to repair (§7.1.1 d). For a private buyer the equivalent is a written defect list, mapped to the specification in the contract, with a re-inspection date. That keeps a refusal from reading as a failure to accept under Article 1605.

Our view: don't sign the BAST on the same day as the UAT record. A gap of a few working days gives compliance and the CISO time to read the test evidence, and the different dates are themselves proof that an inspection took place. If you're preparing a website development project for an OJK-supervised institution, put these BAST fields into the TOR at the start, not into the last week of the contract.