A Standard Certificate in Indonesia’s Online Single Submission (OSS) system is a core business-licensing document for activities classified as medium risk. However, the practical effect of the certificate depends on whether the activity is medium-low risk or medium-high risk and, for medium-high risk activities, whether the certificate has been verified. For foreign companies, that distinction determines whether a project can move beyond preparation into operational or commercial activity.
This guide explains who generally needs a Standard Certificate, when it becomes usable, how it connects to the Business Identification Number (NIB), and what management should verify before treating an OSS output as evidence of operating readiness.
Key Takeaways
- A Standard Certificate is generally part of the risk-based business licensing package for medium-risk business activities in Indonesia.
- Medium-low risk activities generally receive an NIB and a Standard Certificate after the business makes the required self-declaration in OSS.
- For medium-high risk activities, a Standard Certificate marked as not yet verified provides only limited legality for preparation; it cannot be used for operational or commercial activity.
- The applicable route is determined at the activity and project level, including the selected KBLI classification, business scale, location, products, facility, sector and operating model.
- A certificate should be read together with its attachment, status, requirements, obligations and any supporting approvals shown in OSS.
What Is a Standard Certificate in OSS Indonesia?
A Standard Certificate, or Sertifikat Standar, is a risk-based business licensing instrument used for activities that OSS classifies as medium risk. Under the current framework, the main licensing output for a medium-risk activity is the NIB together with a Standard Certificate. The certificate records the business activity and connects it to the standards, evidence, authorities and obligations applicable to that activity.
The official OSS portal explains that risk-based licensing groups activities into four risk levels. These levels determine the licensing instruments and obligations generated by the system. The relevant classification is therefore not chosen as a matter of preference. It follows the official risk mapping for the activity, scale and other project data entered into OSS.
Government Regulation No. 28 of 2025 distinguishes low, medium-low, medium-high and high-risk activities. Its official risk-analysis appendix states that medium-risk activities use an NIB and Standard Certificate, while high-risk activities generally use an NIB and a licence, with a Standard Certificate potentially added for specified activities. This is why investors should not assume that every KBLI code produces the same licensing route.
Who Needs a Standard Certificate?
A company generally needs a Standard Certificate when at least one of its registered business activities is classified as medium-low or medium-high risk in the OSS risk-based licensing framework. The requirement attaches to the activity and project data, not simply to the fact that the company is foreign-owned or has obtained an NIB.
For a PT PMA or another foreign-investment structure, the review normally starts with the intended commercial activities. Each activity should be mapped to the appropriate KBLI code and checked in OSS for scope, business scale, risk level and licensing requirements. Companies can use IndoGateway’s overview of KBLI business classification in Indonesia to understand why accurate activity mapping matters before the OSS filing begins.
A Standard Certificate may be relevant to one activity but not another within the same company. A business with several KBLI activities may therefore see different OSS outputs for different projects or locations. One activity may be low risk and rely primarily on the NIB; another may be medium risk and generate a Standard Certificate; a high-risk activity may require a formal licence. Management should review every activity separately rather than relying on the most convenient output in the account.
Factors that can change the licensing route
- The precise KBLI code, title and scope of the proposed activity.
- The scale or classification of the business recorded in OSS.
- The physical project location and its land-use or spatial-planning position.
- The products, production process, facility, equipment and environmental profile.
- Foreign-ownership eligibility and any sector-specific restrictions.
- Whether the company is preparing a new project, changing an existing activity or updating a legacy OSS record.
- Supporting approvals, PB-UMKU or sectoral requirements that sit alongside the main business licence.
Medium-Low and Medium-High Risk: The Critical Difference
The phrase “Standard Certificate” can conceal an important operational distinction. The current framework treats medium-low and medium-high activities differently, particularly at the point when the business wants to begin operations or commercial activity.
| Risk level | Main OSS licensing output | Practical effect | Management check |
|---|---|---|---|
| Medium-low | NIB and Standard Certificate following the required self-declaration | The package generally functions as the business legality for preparation, operational and/or commercial activity, subject to continuing compliance with the applicable standards and other required approvals. | Confirm that the selected activity and project data are correct and that all standards and continuing obligations can be met. |
| Medium-high, not yet verified | NIB and Standard Certificate marked as not yet verified | Limited legality for preparation only; it cannot be used for operational or commercial activity. | Identify the evidence, reviewing authority, fees if applicable, and verification actions required before the planned operating date. |
| Medium-high, verified | NIB and Standard Certificate with verified status | The verified certificate supports the licensed activity, subject to its scope, attachment, conditions, ongoing obligations and other required approvals. | Confirm that the certificate covers the correct KBLI, activity scope and location and that no separate approval remains outstanding. |
The most consequential error is treating an unverified medium-high Standard Certificate as a complete operating licence. Minister of Investment and Downstream Industry/Head of BKPM Regulation No. 5 of 2025 expressly describes the legality of that document as limited to preparation and says it cannot be used for operational or commercial activity. Its official formats also distinguish between certificates marked not yet verified and those marked verified.
The same regulation includes an automatic-verification mechanism in specified circumstances under the broader regulatory framework. A company should rely on the actual status and evidence shown for its own OSS activity, rather than assuming that the mechanism applies to every sector or filing.
When Does a Company Obtain the Certificate?
The Standard Certificate is generated through the OSS licensing process after the company has entered and confirmed the relevant business and project information and addressed the prerequisites presented by the system. The workflow is data-dependent, but a practical sequence usually includes the following stages.
- Define the real activity. Document what the company will sell, manufacture, operate or deliver, to whom, at which site and through which commercial model.
- Select and validate the KBLI. Match the operating activity to the official classification and confirm that the code’s scope fits the intended revenue-generating activity.
- Check investment eligibility. Review foreign-ownership rules, sector requirements and the corporate purpose before adding the activity to a PT PMA.
- Enter business and project data in OSS. Record the activity, location, scale, investment and other project information accurately.
- Address basic requirements. OSS may connect the application with spatial, environmental, building or other project prerequisites depending on the facts.
- Make the required declarations. For medium-risk activities, the business completes the declarations presented by OSS concerning compliance with the applicable standards.
- Review the certificate status. Determine whether the Standard Certificate is effective for the intended stage or remains not yet verified.
- Complete verification or supporting approvals. Submit the evidence and obtain any verification, PB-UMKU or sector approvals needed before operations.
IndoGateway’s NIB and OSS business licensing service covers the coordination needed to align activity classification, company data, OSS submissions and operating requirements. That alignment is especially important when the project has multiple locations or combines trading, services, manufacturing and regulated products.
What the Certificate Attachment Tells You
The front page of a Standard Certificate is not the whole licensing record. The official formats in Regulation No. 5 of 2025 include an attachment that can identify the KBLI code and title, activity scope, requirements or obligations, evidence of fulfilment, supervising authority and validity information. The regulation states that the attachment is an integral part of the certificate.
This makes the attachment an operational document, not an administrative afterthought. Legal, operations, finance and project teams should convert its requirements into named workstreams with owners and due dates. A certificate may be correctly issued while a related condition, product approval, facility requirement or recurring obligation still needs attention.
Review these fields before relying on the document
- Company name, NIB and the relevant project or business location.
- KBLI code, KBLI title and the stated scope of the licensed activity.
- Whether the certificate is marked verified, not yet verified or otherwise qualified.
- Requirements and obligations listed for the activity.
- Evidence recorded as fulfilled and any evidence still outstanding.
- The ministry, institution, regional authority or other body responsible for supervision.
- Any validity period, change record or activity-specific note.
Does a Standard Certificate Mean the Business Is Ready to Operate?
Not automatically. For a medium-low activity, the NIB and Standard Certificate generally provide the business legality described in the risk-based framework, but the company still has to comply with the declared standards and any connected approvals. For a medium-high activity, a certificate marked not yet verified is limited to preparation and is not authority to conduct operational or commercial activity.
Operational readiness is broader than possession of a PDF. It may depend on the correct entity and shareholder structure, an accurate KBLI, foreign-investment eligibility, a suitable site, environmental and building requirements, product permissions, import arrangements, labour and immigration compliance, tax registrations, sector approvals and PB-UMKU. The applicable combination depends on the project.
For an overview of how these outputs connect, see IndoGateway’s OSS RBA guide for Indonesia and its explanation of Indonesia’s four risk-based licensing levels.
Common Standard Certificate Mistakes
Using a broad KBLI because it appears easier
The classification should reflect the actual revenue-generating activity. A superficially convenient code can produce the wrong risk mapping, omit a required permission or conflict with corporate documents and contracts.
Ignoring the certificate status
For medium-high risk activities, the words indicating whether the certificate is verified matter. A not-yet-verified certificate should be treated as a preparation-stage document until the applicable standards have been fulfilled and the status required for operations has been obtained.
Reading only the first page
The attachment contains the activity-level requirements and obligations. Filing the front page without operationalizing the attachment can leave the company unaware of evidence, supervision or ongoing compliance duties.
Assuming the NIB resolves every licence
The NIB is a core business identifier and part of the licensing package, but it is not universal proof that every registered activity can operate. The correct conclusion comes from the complete activity record, including the Standard Certificate or licence status and any supporting approvals.
Leaving verification until launch
For a medium-high project, verification evidence should be planned while the facility, systems, staffing and vendor arrangements are being developed. Discovering the requirements immediately before a commercial launch can disrupt contracts and internal schedules.
A Practical Readiness Checklist
- Confirm that the KBLI accurately covers the intended commercial activity.
- Verify that the company’s corporate purpose and foreign-investment eligibility align with that activity.
- Check the OSS risk level for the specific activity, scale and project circumstances.
- Review the NIB, Standard Certificate and every certificate attachment together.
- Confirm the certificate’s verification status before fixing an operational launch date.
- Map each listed standard and obligation to documentary evidence and an internal owner.
- Identify supporting approvals involving the site, environment, building, product, import, workforce or sector.
- Reconcile OSS information with corporate, tax, employment, property and commercial records.
- Keep evidence organized for supervision, changes and future licence amendments.
- Obtain specialist verification when the activity scope or operating-readiness conclusion remains uncertain.
Frequently Asked Questions
1. Is a Standard Certificate the same as an NIB?
No. The NIB is the business identification number generated through OSS, while a Standard Certificate is an additional risk-based licensing instrument for a medium-risk activity. A medium-risk business activity generally uses the NIB and Standard Certificate together as its main licensing package. The precise effect depends on the risk tier and certificate status. Management should therefore review the complete OSS activity record, its attachments and any supporting approvals rather than treating the NIB alone as proof that every activity, location or project is operationally ready.
2. Do all foreign-owned companies need a Standard Certificate?
No. The requirement does not arise merely because a company has foreign shareholders. It generally arises when a registered activity is classified as medium-low or medium-high risk under the OSS framework. A foreign-owned company may have low-risk, medium-risk and high-risk activities within the same entity, each producing a different licensing route. The company should validate each KBLI activity, its scale, location and project data, while separately checking foreign-ownership eligibility, the corporate purpose, site requirements and any sector-specific conditions before implementation.
3. Can a company operate with an unverified Standard Certificate?
For a medium-high risk activity, a Standard Certificate marked as not yet verified cannot be used to conduct operational or commercial activity. The current implementing regulation describes it as limited legality for preparation while the business fulfils the applicable standards and submits evidence through OSS. The company should identify the reviewing authority, required documents, facility or process evidence, and any fees or supporting approvals. Only the actual status and conditions shown for the specific OSS activity should guide the launch decision.
4. How is a medium-low Standard Certificate different?
For a medium-low risk activity, the Standard Certificate is generally issued after the business makes the required self-declaration in OSS that it will fulfil and implement the applicable business standards. Together with the NIB, it generally provides the legality described by the framework for preparation, operational and/or commercial activity. That does not remove the standards themselves. The company remains responsible for compliance and may be supervised, while separate site, product, environmental, sectoral or supporting approvals may still apply to the project.
5. How long does Standard Certificate verification take?
There is no responsible universal answer for every Standard Certificate. The route can depend on the KBLI activity, competent authority, evidence required, sector system integration, payment requirements, facility readiness, project location and whether the submission needs correction. Although regulations may specify procedural periods for particular actions, a project schedule should be built from the exact OSS requirements and authority workflow applicable to the activity. Companies should avoid committing to a commercial start date until the responsible team has confirmed the certificate status and outstanding dependencies.
6. Can one company have more than one Standard Certificate?
Yes, a company can have multiple registered activities or projects that generate activity-specific licensing records. The relevant certificate is tied to the KBLI activity, scope and project data shown in its attachment. This means a verified certificate for one activity or location should not be assumed to authorize another activity or site. Businesses with several revenue lines should maintain a licence matrix that links each KBLI and location to its NIB record, Standard Certificate or licence, supporting approvals, responsible authority, status and ongoing obligations.
7. What should a foreign investor check before applying?
The investor should first define the real business model and map each activity to the correct KBLI. It should then verify foreign-ownership eligibility, the corporate purpose, planned locations, project scale, products, facilities, import model and workforce needs. Those decisions can influence both the OSS risk-based output and connected approvals. Preparing this analysis before entering data reduces the risk of an internally inconsistent filing. Requirements should be verified against current official rules for the specific activity, structure, product, location and project circumstances.
8. What happens if the business activity changes after issuance?
The company should assess whether the change affects its corporate purpose, KBLI classification, OSS business data, risk level, project location, investment information, certificate scope or supporting approvals. A minor operational adjustment and a new revenue-generating activity are not necessarily treated the same way. Management should not simply continue using the old certificate if its scope no longer matches the business. The appropriate amendments depend on the change and should be completed before the expanded or modified activity begins operating where required.
Conclusion
A Standard Certificate in OSS Indonesia is required for medium-risk activities, but its practical value depends on the risk tier, project facts and status printed in the licensing record. Medium-low and verified medium-high certificates should not be confused with an unverified medium-high certificate, which is limited to preparation. The safest approach is to align the KBLI, corporate documents, ownership position, project data, certificate attachment and supporting approvals before treating a project as ready to operate.
Regulatory note: Indonesian investment, licensing, tax, immigration, product, environmental and operating requirements may change and may depend on the business activity, ownership structure, location, products and project circumstances. This article provides general information and is not project-specific legal, tax or regulatory advice. Applicable requirements should be verified before implementation.
Plan Your OSS Licensing Route with IndoGateway
If your project needs a clear route from KBLI selection and NIB issuance to Standard Certificate verification and operational readiness, contact IndoGateway. Our team can help coordinate the corporate, OSS, site and supporting-approval workstreams around your intended Indonesian operations.
