Indonesia’s business licensing system does not classify an entire company with one generic risk label. It assesses the activities the company proposes to carry out, using the relevant KBLI classification, business scale, sector rules and project details. That distinction matters: two companies with similar names can face different licensing paths if their actual activities, facilities, locations or operating models differ.
This guide explains how Indonesia business risk classification works, what information influences the result in the Online Single Submission system, and how foreign investors can prepare a defensible licensing plan before committing to a site, equipment or launch date.
Key Takeaways
- Indonesia classifies the risk of each business activity, generally by reference to a five-digit KBLI activity and the scope defined for that activity.
- The official analysis considers initial risk, including potential harm to health, safety, the environment, and the use or management of resources.
- Low, medium-low, medium-high and high are the four operational tiers used to determine the main business-licensing instrument.
- Business scale can affect the risk analysis and requirements shown for a particular activity.
- The highest relevant risk across the assessed aspects can determine the activity’s overall classification.
- An NIB is important, but it is not universal proof that every activity is ready for commercial operation.
- Location, products, facilities, environmental impacts and sector approvals may create requirements beyond the core risk-based business licence.
- Foreign investors should verify the exact OSS output for the proposed KBLI, scale and project configuration before implementation.
The Short Answer: How Indonesia Determines Business Risk
Indonesia’s risk-based licensing framework starts with the business activity. The government identifies the activity through its KBLI classification, considers the applicable business scale, assesses the hazards and the potential for those hazards to occur, and assigns a risk level. Government Regulation No. 28 of 2025 describes risk as the potential for injury or loss arising from a hazard or from the combination of a hazard’s likelihood and consequence.
The official analysis uses initial risk, meaning the risk inherent in the activity before relying on a company’s proposed controls to assume a lower category. It considers health, safety, environmental, and resource-use or resource-management aspects. Other aspects may be considered where the nature of the activity requires them. The result is mapped to the licensing instrument delivered through the official OSS system.
The practical result is not merely a label. It determines whether the principal business licence is an NIB, an NIB plus a Standard Certificate, or an NIB plus a licence. It can also affect whether a self-declaration is sufficient, whether government verification is needed, and when operational or commercial activity can lawfully begin.
The Building Blocks of Indonesia’s Risk Classification
1. The Actual Business Activity
The first question is what the company will really do. A commercial description such as “technology,” “consulting” or “manufacturing” is usually too broad. Licensing analysis requires a more operational description: what is produced or delivered, for whom, through which channel, at what facility, and with what equipment, inputs or regulated products.
That description is mapped to the applicable KBLI code and scope. BPS defines KBLI as Indonesia’s official classification of economic activities. KBLI 2025 was established through BPS Regulation No. 7 of 2025 and was later amended in a targeted way by BPS Regulation No. 6 of 2026. Businesses should therefore verify both the current code and its official description rather than relying on an older list or a convenient title alone. The OSS KBLI directory shows the activity scope, risk, scale and obligations available in the live system.
2. Business Scale
The risk assessment also considers whether the activity is carried out at micro, small, medium or large scale. This does not mean that every larger business is automatically high risk. It means scale is one input in the framework and may change the risk or licensing treatment for a particular activity. A foreign-owned PT PMA is normally planned within the large-business licensing environment, but the conclusion for any project must be checked against the applicable investment and sector rules.
3. Hazard Across Several Regulatory Dimensions
Government Regulation No. 28 of 2025 identifies four core aspects in the risk analysis: health, safety, environment, and the use or management of resources. Health can include potential effects on consumers, people near the business location and the wider public. Safety concerns may arise from equipment, processes, structures, substances or operating conditions. Environmental effects can involve pollution, waste, emissions or ecosystem impacts. Resource considerations can involve the way a project uses or manages natural or other regulated resources.
These are analytical categories used by the authorities. A company should not assume it can independently rescore a listed activity and obtain a different licence. Its task is to select the correct activity and provide accurate project data so OSS and the competent authority apply the established framework to the right facts.
4. The Potential for the Hazard to Occur
Risk is not based only on the seriousness of a possible consequence. The official method also considers the potential for the hazard to occur. The framework combines the hazard value with the occurrence-potential value through a risk matrix. This helps distinguish an activity involving a limited and unlikely impact from one with a serious or more plausible impact.
5. The Maximum-Risk Principle
The regulation applies a maximum-risk concept across the criteria used in the analysis. In practical terms, a low result for one aspect does not cancel a high result for another. If an activity is low risk from a health perspective but high risk from a safety perspective, the higher material result can determine the overall tier. This is why a company should review the whole operating model instead of focusing on the factor that appears easiest to satisfy.
The Four Operational Risk Tiers and Their Main Licences
The official analysis groups activities into three broad levels, with the medium level divided into medium-low and medium-high for licensing implementation. That produces four operational tiers.
| Risk tier | Main licensing instrument | Core practical distinction |
|---|---|---|
| Low | NIB | The NIB is the principal business licence for the classified activity, subject to applicable standards and other project requirements. |
| Medium-low | NIB and Standard Certificate | The Standard Certificate is issued following the business’s self-declaration to meet and implement the applicable standards. |
| Medium-high | NIB and Standard Certificate | Verification of compliance with the applicable standards is generally central to moving from preparation to operational or commercial readiness, subject to the activity-specific rules. |
| High | NIB and licence | The competent authority grants the licence after applicable activity requirements are fulfilled; additional standards may also apply to certain activities. |
This table explains the core framework, not every approval a project may require. Spatial conformity, environmental approval, building approvals, product registrations, import permissions, sector licences and business licences supporting operational activities may sit alongside the principal instrument. IndoGateway’s overview of Indonesia’s four risk-based licensing levels provides a complementary comparison.
Why the Same Company Can Have More Than One Risk Classification
A company may register several genuine business activities. Each activity can carry its own risk level and licensing output. A PT PMA that combines wholesale distribution, equipment installation, repair services and local manufacturing should not expect one classification to cover the entire model. The manufacturing activity may have a different risk tier and technical standards from the trading or service activity.
This activity-level structure has three practical consequences. First, the company should map every material revenue-generating and operational function to an appropriate KBLI. Second, it should identify the principal activity and supporting activities honestly, without adding speculative codes that the company is not prepared to implement. Third, it should track readiness by activity because one approved activity does not automatically authorize another.
This is also why a single NIB should not be read in isolation. The NIB identifies the business and records its activities, but the operational status of each activity depends on its risk tier and applicable requirements. For a broader explanation, see IndoGateway’s guide to the relationship between NIB, OSS and KBLI in Indonesia.
Project Details That Can Change the Licensing Path
The KBLI code is the starting point, but foreign investors should test the full project configuration before treating the displayed licence as the complete answer. The applicable approvals may depend on the selected activity, project location, risk classification and operating model.
- Scope of work: designing a product, distributing it, installing it and manufacturing it can be separate regulated activities.
- Business scale: the risk and obligations displayed for an activity may differ according to the recognized business scale.
- Foreign ownership: eligibility and ownership conditions may be sector- and activity-specific and should be checked separately from the risk tier.
- Location and land use: zoning, spatial conformity, industrial-estate conditions and site characteristics can affect project feasibility.
- Facility: warehouses, factories, laboratories, kitchens, clinics and offices involve different operational and building considerations.
- Products: food, cosmetics, medical devices, telecommunications equipment and other regulated goods may require market-access approvals beyond the business licence.
- Environmental impact: the nature and scale of the project may determine the relevant environmental document or approval route.
- Import and distribution model: acting as importer, distributor, retailer, marketplace operator or manufacturer can create distinct licensing dependencies.
A robust review therefore connects OSS licensing with corporate purpose, foreign-ownership analysis, site selection, environmental review, product compliance, customs, tax, workforce and construction workstreams. For projects with a physical site, an early review of spatial approval requirements and environmental approval pathways can prevent the licensing plan from drifting away from the actual facility.
A Practical Pre-OSS Classification Process
- Write an activity inventory. Describe every activity in operational language, including what the Indonesian entity will sell, produce, import, install, manage or support.
- Separate current and future activities. Prioritize activities needed for launch and identify expansion options that require later corporate or licensing changes.
- Map activities to current KBLI descriptions. Compare the title, description, inclusions and exclusions. Use the current BPS and OSS materials, including the official conversion information where an older KBLI appears in legacy documents.
- Check entity and ownership compatibility. Confirm that the proposed legal form and ownership structure can undertake each activity. Do not infer foreign-ownership eligibility from the risk tier.
- Test scale and project data. Confirm the scale, location, premises, products, production capacity, equipment and supporting activities that will be entered or linked in OSS.
- Read the activity-specific OSS output. Record the displayed risk tier, principal licence, Standard Certificate or verification status, and any supporting approvals.
- Build a dependency register. Assign responsibility for spatial, environmental, building, product, import, workforce and sector approvals.
- Define the operational gate. Document what must be completed before construction, preparation, trial activity, operational activity and commercial launch.
This sequence is more reliable than forming a company first and trying to reconcile the operating model afterward. IndoGateway’s NIB and OSS business licensing service is designed to connect classification with the wider implementation plan.
Common Classification Mistakes
Choosing a Code Only Because It Looks Low Risk
The selected KBLI should accurately describe the activity. A lower-risk code that does not fit the operating model can create inconsistencies across contracts, invoices, product registrations, imports, the company’s corporate purpose and inspections. Risk is a result of correct classification, not a criterion for choosing an inaccurate code.
Treating the NIB as a Universal Operating Permit
The NIB is foundational, but the activity’s risk tier determines what accompanies it. Medium-high and high-risk activities can involve verification or a government licence before full operational or commercial activity. Supporting approvals can also remain outstanding even where an NIB has been issued.
Ignoring the Difference Between Preparation and Commercial Operation
Some licensing outputs allow limited preparation while standards are being verified. That is not the same as unrestricted commercial operation. Companies should translate each OSS status into an internal go/no-go gate understood by management, project, sales and finance teams.
Using Legacy KBLI Data Without Checking Current Implementation
BPS released KBLI 2025 to update Indonesia’s economic-activity classification, and official conversion tools support the transition. The government has stated that implementation does not by itself require businesses to obtain new licences where there is no substantive activity change. However, a company changing its corporate purposes or actual scope should verify the required adjustment in OSS and AHU rather than assuming an automatic conversion resolves every issue.
Reviewing Licensing Without the Site or Product Workstreams
An activity can have a clear core business licence and still be unable to launch because the premises, environmental route, construction status, regulated products or import model are unresolved. The most useful licensing review is a readiness review, not simply a screenshot of an OSS page.
Questions Management Should Answer Before Filing
- What will the Indonesian entity do on day one, and what will it add later?
- Which activities generate revenue, and which merely support another activity?
- Will the entity manufacture, import, distribute, install, repair or only provide advice?
- What products and customer groups are involved?
- What site and facilities will each activity use?
- Could the activity affect health, safety, the environment or regulated resources?
- Which approvals must be verified before commercial launch?
- Who owns each licensing dependency, and what evidence will prove completion?
These answers give advisers and internal teams enough detail to test the classification against the live system. They also create an audit trail showing why a code and licensing route were selected.
Conclusion
Indonesia determines business risk classification by analyzing the activity, scale, potential hazards and the likelihood of those hazards, then applying the highest relevant risk outcome across the assessed aspects. That classification connects directly to the main licensing instrument: NIB, Standard Certificate or licence.
For foreign businesses, the real task is to ensure the system is evaluating the correct activity and project facts. A strong plan links KBLI selection to ownership, location, products, facilities, imports, environmental requirements and the intended launch sequence. That approach turns risk classification from an administrative label into a practical operating-readiness tool.
Plan Your Indonesia Licensing Route
A risk classification is useful only when it matches the business you intend to operate. IndoGateway can help map your activities, review KBLI options, identify OSS outputs and coordinate the connected entity, site, product and compliance workstreams. Contact IndoGateway to turn your operating model into a structured licensing plan.
Frequently Asked Questions
1. Who decides a business activity’s risk classification in Indonesia?
The risk classification is established through the government framework for each business activity; it is not a label that a company freely chooses. The competent ministries and agencies analyze activities under their sector authority, and the resulting classification and licensing route are implemented through OSS. The company is responsible for supplying accurate information and selecting the KBLI that genuinely matches its operations. If the activity description, scale, site or operating model is entered incorrectly, the displayed result may not represent the real project. A project-specific check against the live OSS output remains essential.
2. Is every activity under one KBLI code assigned the same risk level?
Not necessarily in every practical configuration. The framework is organized around business activities and five-digit KBLI classifications, but the live OSS directory can distinguish scope, sector authority, scale and obligations within an activity. Project facts can also trigger supporting requirements beyond the main licence. Businesses should therefore inspect the precise activity item applicable to their scope and scale rather than reading only the KBLI title. The selected location, products, facilities and operating model should be reviewed separately because those variables may affect approvals even when the headline risk tier appears settled.
3. Does a foreign-owned PT PMA automatically count as high risk?
No. Foreign ownership and business risk classification address different questions. The risk tier concerns the potential hazards and consequences of the business activity, while foreign-ownership eligibility concerns whether and on what terms foreign investment may participate in that activity. A PT PMA may undertake activities across different risk tiers, subject to the applicable ownership, investment, sector and licensing rules. Companies should perform both analyses: first confirm that the ownership structure can lawfully conduct the selected activities, then determine the OSS risk and licensing output for the correct activity, scale and project details.
4. Can a company lower its risk tier by adding safety or environmental controls?
A company should implement appropriate controls, but it should not assume those controls let it unilaterally choose a lower OSS tier. Government Regulation No. 28 of 2025 describes the assessment in terms of initial risk and assigns the official result to the activity through the regulatory framework. Controls, standards and verified compliance remain important for lawful operation, supervision and risk management. If the business model materially differs from the standard activity scope, the right response is to verify the KBLI and project facts with the competent authority or qualified adviser, not to override the classification through an internal risk matrix.
5. What is the difference between medium-low and medium-high risk?
Both tiers generally use an NIB and a Standard Certificate, but the path to operational readiness differs. For medium-low risk, the Standard Certificate is associated with the business’s self-declaration that it will meet and implement the applicable standards. For medium-high risk, verification of standard compliance by the competent government authority is generally a key step before operational or commercial activity, subject to the activity-specific provisions. Businesses should read the exact OSS status and requirements because preparation rights, verification timing and supporting approvals can differ. A certificate’s existence alone should not be treated as proof that every operating condition is complete.
6. Is an NIB enough for a low-risk business to operate?
For an activity classified as low risk, the NIB is the principal risk-based business licence. However, “NIB only” should not be interpreted as “no other compliance applies.” Standards concerning health, safety and the environment can still govern operations, and the project may need spatial, building, product, import, tax, workforce or sector-specific approvals depending on its facts. The safest approach is to distinguish the core business licence from every supporting approval needed for the site, goods and operating model. Management should approve launch only after the complete dependency register has been checked, not solely after the NIB is issued.
7. How should a company check its classification before investing in a site?
Start with a detailed activity description and map it to current KBLI options in the official BPS and OSS resources. Then test the intended scale, ownership structure, products, facility type, production or service process, and exact location. Review the risk tier and licensing output for each material activity, followed by spatial, environmental, construction and sector dependencies. This work should precede a binding lease or major equipment commitment where possible. A site that cannot support the selected activities may create costly changes even when the corporate entity and NIB have already been established.
8. Can Indonesia’s business risk classifications change?
Yes. Licensing rules, activity classifications, sector standards and OSS implementation can change, and a company’s own activities or scale may also evolve. Government Regulation No. 28 of 2025 replaced the earlier Government Regulation No. 5 of 2021 framework, while KBLI 2025 updated the economic-activity classification and received a targeted amendment in 2026. Businesses should use current official sources and review material changes before expanding, relocating or adding activities. They should also monitor the obligations and verification status shown in OSS. A historic licence file is useful evidence, but it is not a substitute for checking current requirements.
