Indonesia does not apply the same licensing pathway to every business. Under the country’s risk-based approach, the licensing instrument attached to an activity depends on the activity’s assessed risk level. That distinction affects whether an NIB is sufficient, whether a Standard Certificate is involved, whether government verification is required, and whether a separate licence must be issued before the relevant activity can operate.
For foreign investors, the practical challenge is that risk is assessed at activity and project level, not simply by company name or legal form. A PT PMA may carry several KBLI activities, operate in more than one location, and encounter different licensing requirements across the same corporate group. The reliable starting point is therefore a precise activity map, followed by validation in the current Online Single Submission (OSS) system.
Key Takeaways
- Indonesia uses four risk levels: low, medium-low, medium-high, and high. The two medium tiers follow different licensing mechanics.
- Low-risk activities generally use an NIB, while medium-risk activities involve a Standard Certificate and high-risk activities involve an NIB plus a licence.
- A risk level applies to a particular business activity and project configuration. It is not a single permanent label for the entire company.
- KBLI selection, business scale, location, products, facilities, and operating model can affect the actual OSS pathway and related approvals.
- An issued document should be checked for its status, scope, conditions, and dependencies before commercial operations begin.
What Is Indonesia Risk-Based Licensing?
Indonesia risk-based licensing, known in Indonesian as Perizinan Berusaha Berbasis Risiko, matches the form of business licensing to the risk attached to a business activity. The current overarching framework is Government Regulation No. 28 of 2025. It replaced Government Regulation No. 5 of 2021 and covers business licensing, supporting business licences, basic requirements, OSS services, supervision, and related procedures.
The core idea is proportionality. Activities assessed as lower risk generally face a lighter licensing instrument, while activities with greater potential consequences require stronger evidence, verification, or approval. The official framework evaluates risk by considering hazard and the potential for the hazard to occur. The maximum risk identified across the relevant aspects drives the activity’s overall risk level.
This is important because “risk” in this setting is a regulatory classification, not an informal judgment about whether a business plan is commercially safe. A profitable software project may be low risk for one activity, while a production, health, transport, energy, or other regulated activity may sit in a different tier. The applicable result must be checked against the current rules and the data entered for the project.
The Four Risk Levels at a Glance
The requested title groups the framework into low, medium, and high risk, but the medium category is formally divided into medium-low and medium-high. That split matters because a self-declared Standard Certificate is not equivalent to a Standard Certificate that requires verification.
| Risk level | Core licensing instrument | Operational point to check |
|---|---|---|
| Low | NIB | Confirm the registered activity and project data are accurate and identify any separate supporting approvals. |
| Medium-low | NIB and Standard Certificate based on a statement of compliance | Understand the standards declared and maintain evidence that the operation actually meets them. |
| Medium-high | NIB and a verified Standard Certificate | Do not confuse submission or an unverified status with completed verification and operating readiness. |
| High | NIB and licence | Confirm that the competent authority has issued the required licence and that all stated conditions are satisfied. |
This table describes the core structure stated in the regulation. It should not be read as a complete project checklist. Basic requirements, sector standards, product approvals, environmental obligations, construction and building approvals, and business licences supporting business activities (PB-UMKU) may also apply.
Low-Risk Business Activities
For a low-risk activity, the NIB is the core business licensing instrument. The NIB also functions as the business actor’s official registration identity in the OSS framework. This can make the low-risk route look simple, but careful setup still matters. An NIB generated from an inaccurate KBLI, incomplete activity description, or unsuitable project location does not correct the underlying mismatch.
Before relying on a low-risk result, a company should verify that the selected KBLI accurately reflects how revenue is earned, which products or services are delivered, where the activity occurs, and whether the activity belongs to the company’s approved corporate purposes. Foreign-owned companies should separately check whether the chosen activity is open to their ownership profile and whether sector rules impose additional conditions.
A low-risk designation also does not automatically resolve every connected workstream. Land use, environmental management, building use, imports, employment, immigration, product registration, and tax administration may create distinct obligations. The better interpretation is that the core business licensing instrument is lighter, not that the project is exempt from every other rule.
Medium-Low-Risk Business Activities
Medium-low-risk activities generally require an NIB and a Standard Certificate based on the business actor’s statement that it will comply with the applicable standards. The declaration is consequential. It should be supported by an internal compliance file showing what standard applies, which team owns each requirement, and how the business will demonstrate continuing conformity.
Companies sometimes treat an automatically generated document as the end of the process. That is a weak control. The business remains responsible for the accuracy of its OSS data and for meeting the standards it has declared. Supervision can occur after issuance, and inconsistencies may create amendment, remediation, or enforcement exposure.
For a foreign investor, the practical response is to translate the applicable standard into an operating checklist. Assign owners for facilities, equipment, technical personnel, safety, records, reporting, and any sector-specific conditions. The licensing file should connect what was declared in OSS with what teams implement on the ground.
Medium-High-Risk Business Activities
Medium-high-risk activities generally require an NIB and a Standard Certificate that is subject to verification. This is the most common point of confusion in risk-based licensing. Registration, submission, and issuance of an intermediate document do not necessarily mean the activity has reached the status required for operation.
The verification route may involve a competent ministry, agency, regional authority, special economic zone administrator, or other authorised institution, depending on the activity and project. The reviewer may assess documents, technical conditions, facilities, personnel, or other evidence specified by the applicable sector standard. The actual sequence and evidence set are activity-dependent.
Project planning should therefore include a verification workstream, not merely an OSS filing task. Before committing to a launch date, identify the responsible authority, required evidence, facility dependencies, and the status that must appear in OSS. Avoid presenting a universal processing time to management because timing can depend on the completeness of evidence, authority workflow, project readiness, and the need for correction.
High-Risk Business Activities
High-risk activities generally require an NIB and a licence. The NIB identifies the business and its registered activity, while the licence represents the higher level of government approval attached to that activity. A company should not interpret possession of an NIB as a substitute for the required licence.
High-risk projects frequently expose dependencies that sit outside the final licensing click. A facility may need location compatibility, environmental approval, technical design acceptance, construction-related documentation, inspection readiness, qualified personnel, or product-specific approvals. Which of these apply depends on the KBLI, sector, location, facility, product, process, and scale.
For capital-intensive projects, licensing should be integrated with site selection and investment approval gates. Signing a long lease, importing machinery, hiring a full operating team, or announcing a commercial opening before validating the regulatory path can create avoidable cost. IndoGateway’s sector licensing support is designed to help companies map those dependencies before they become critical-path surprises.
How Indonesia Determines the Risk Level
The official methodology links the level of risk to hazard and the potential for that hazard to occur. The assessment considers relevant risk aspects and uses the highest identified level among them to determine the activity’s overall classification. The detailed methodology appears in the appendices to Government Regulation No. 28 of 2025.
Businesses do not normally create their own risk score and then choose a preferred tier. The practical task is to select the correct KBLI and enter complete project data so the OSS pathway reflects the activity being undertaken. The current OSS KBLI directory is an essential validation tool because it connects activity descriptions with licensing information.
The following variables should be checked before treating an OSS outcome as final:
- the exact activity description and boundaries of the selected KBLI;
- the scale and investment profile entered for the project;
- the project location, land status, and spatial-use position;
- the production process, equipment, materials, and facility type;
- the product or service being placed on the market;
- the foreign ownership and legal-entity structure;
- environmental, building, safety, workforce, and sector-specific factors; and
- whether supporting PB-UMKU or non-OSS approvals are triggered.
A Practical Licensing Workflow for Foreign Companies
- Define the operating model. Describe what the Indonesian entity will sell, manufacture, import, distribute, manage, or deliver. Separate principal activities from support functions.
- Map each activity to KBLI. Compare the title and full activity description, not just a keyword match. Check that the corporate deed and foreign ownership route are aligned.
- Model each project and location. The same company can have multiple projects. Record the location, facility, investment, products, capacity, and business scale accurately.
- Validate the OSS risk result. Identify whether each activity is low, medium-low, medium-high, or high risk and record the resulting instrument.
- Map dependencies. Review basic requirements, sector standards, PB-UMKU, product approvals, imports, workforce, environmental matters, and building or site requirements.
- Prepare evidence before filing. Build the compliance file, assign owners, and confirm that statements made in OSS can be supported.
- Check issued status and scope. Verify the document number, activity, location, conditions, verification status, and authorised operating scope.
- Maintain post-licensing compliance. Track changes to activity, location, capacity, facilities, management data, and reporting obligations.
Companies that want an initial gap assessment can use IndoGateway’s Indonesia licence checker and review the NIB and OSS business licensing service. These tools support planning, but project-specific conclusions should still be verified against current official requirements.
Common Risk-Based Licensing Mistakes
Treating the Company as Having One Risk Level
A company can conduct several activities, and each activity may have its own licensing route. A single PT PMA can therefore hold a low-risk activity alongside another activity requiring verification or a licence. Maintain an activity-by-activity register rather than one company-level label.
Assuming the NIB Is Always the Final Approval
The NIB is sufficient as the core instrument for low-risk activities, but it does not replace a verified Standard Certificate or licence where one is required. It also does not remove separate product, location, environmental, building, import, workforce, or technical obligations.
Choosing KBLI From the Title Alone
Similar KBLI titles can cover materially different activities. Review the full description, inclusions, exclusions, commercial model, and actual flow of goods or services. A convenient code that does not reflect reality can lead to an unreliable risk and licensing result.
Confusing Submission With Effectiveness
For medium-high and high-risk activities, track the authority’s verification or approval outcome. Internal launch controls should reference the required final status, not merely a screenshot showing that an application exists.
Updating Operations Without Updating Licensing
A new product line, site, production process, activity, warehouse, or capacity may change the company’s licensing position. Include OSS and licensing review in change-management procedures rather than waiting for an inspection or transaction due diligence.
Questions to Resolve Before Relying on an OSS Result
- Does every selected KBLI match an activity the company will actually perform and invoice?
- Is the activity compatible with the company’s foreign ownership and corporate purposes?
- Are all project locations, facility details, investment values, and scale data accurate?
- What specific status must be achieved before the activity can operate?
- Which authority verifies the Standard Certificate or issues the licence?
- Which basic requirements and PB-UMKU items sit on the critical path?
- Are product, import, environmental, building, workforce, and technical approvals addressed?
- Who owns ongoing compliance, OSS amendments, renewals where applicable, and reporting?
Conclusion
Indonesia risk-based licensing is easier to manage when the business stops thinking in terms of “getting an OSS licence” and starts managing a portfolio of activities and projects. Low risk generally points to an NIB, medium-low to an NIB and self-declared Standard Certificate, medium-high to an NIB and verified Standard Certificate, and high risk to an NIB and licence. The decisive details, however, sit in the selected KBLI, project data, standards, location, ownership, and connected approvals.
The operational objective is not simply to generate documents. It is to establish that each planned activity has the correct status, evidence, and supporting approvals before launch, then keep that position aligned as the business changes.
Plan Your Indonesia Licensing Route with IndoGateway
IndoGateway helps foreign businesses connect entity setup, KBLI selection, OSS registration, risk-tier requirements, sector approvals, and operating-readiness workstreams. For a project-specific licensing map and implementation plan, contact IndoGateway.
Frequently Asked Questions
1. What are the risk levels in Indonesia’s business licensing system?
Indonesia uses four regulatory risk levels: low, medium-low, medium-high, and high. The distinction determines the core business licensing instrument for the activity. Low risk generally uses an NIB; medium-low uses an NIB and a Standard Certificate based on a compliance statement; medium-high uses an NIB and a Standard Certificate subject to verification; and high risk uses an NIB and a licence. The result applies to a particular activity and project, so one company may have several activities with different risk levels and approval pathways.
2. Is an NIB enough for a business to operate in Indonesia?
An NIB is generally the core business licensing instrument for a low-risk activity, but it is not universally enough for every company or project. Medium-high activities may require a verified Standard Certificate, while high-risk activities require a licence. Separate basic requirements, PB-UMKU, product registrations, import permissions, environmental documents, building approvals, workforce requirements, or sector-specific obligations may also apply. A company should check the NIB’s listed activities and locations, the OSS status of each activity, and all connected approvals before concluding that operations may begin.
3. What is the difference between medium-low and medium-high risk?
The central difference is the treatment of the Standard Certificate. For a medium-low-risk activity, the Standard Certificate is generally linked to the business actor’s statement that it will comply with the relevant standard. For medium-high risk, the Standard Certificate is subject to verification by the competent authority. This means a medium-high filing may require additional evidence and an official verification outcome before the activity reaches the required operating status. The applicable standard, reviewer, documents, and practical sequence depend on the activity, project, sector, and current OSS requirements.
4. How does OSS determine whether an activity is low or high risk?
The regulatory framework determines risk through an analysis of hazard and the potential for that hazard to occur, considering the relevant risk aspects. The maximum identified risk can determine the activity’s overall level. In practice, the business selects the appropriate KBLI and enters project information in OSS, and the system applies the current regulatory mapping. Companies should not choose a tier based on preference. They should ensure the KBLI, scale, location, facility, products, process, and other project data accurately describe the planned operation so the resulting pathway is reliable.
5. Can one PT PMA have activities with different risk levels?
Yes. A PT PMA may conduct more than one business activity when its corporate documents, foreign ownership position, investment plan, and sector rules support those activities. Each KBLI activity and project can have its own risk classification and licensing instrument. The company may therefore hold an NIB for a low-risk activity while separately completing verification or obtaining a licence for another activity. Management should maintain a licensing matrix by KBLI, project, location, instrument, status, responsible authority, and compliance owner rather than treating the company as having one overall risk label.
6. Does a high-risk classification mean foreign investment is prohibited?
No. A high-risk classification describes the business licensing pathway and does not, by itself, mean that foreign investment is prohibited. Foreign ownership is a separate analysis that depends on the business field, KBLI, sector legislation, reserved or conditional activities, and the investor’s proposed structure. A high-risk activity may be open to foreign investment but require an NIB, a licence, and additional technical or project approvals. Conversely, an activity’s lower risk level does not prove that it is open to a particular foreign ownership structure. Both questions require separate validation.
7. What should a company do if its OSS risk level seems wrong?
First, recheck the selected KBLI and all project data, including the activity description, scale, location, investment, facility, products, and operating model. Compare the result with the current OSS KBLI information and the applicable regulation or sector standard. Do not solve the problem by selecting a convenient but inaccurate KBLI. If the data are correct but the result still appears inconsistent, document the issue and seek clarification through the appropriate OSS or competent-authority channel. Material changes should be made through the proper amendment process with supporting corporate and project records.
8. How often should a business review its Indonesia licences?
A business should review its licensing position whenever the operation changes and as part of a scheduled compliance cycle. Triggers include adding an activity, launching a new product, moving or adding a site, changing production capacity or process, importing different goods, modifying facilities, changing ownership, or entering a new regulated channel. Regulatory updates to OSS, KBLI, sector standards, or supporting approvals can also create a need for review. The company should assign clear ownership for monitoring changes, maintaining evidence, updating OSS data, and confirming that each activity retains the status required for operation.
