Indonesia’s Online Single Submission Risk-Based Approach (OSS RBA) is designed to match the licensing route to the risk profile of each business activity. For foreign companies, however, obtaining a Business Identification Number (NIB) is usually a milestone rather than the end of the process. Operational readiness depends on whether every selected activity has the required effective licence, verified Standard Certificate, basic requirement and supporting approval for the actual project.
This guide explains the OSS RBA licensing process from activity mapping and NIB issuance through site, sector and operational checks. It is intended to help investors build a practical work plan while avoiding the common mistake of assuming that one document authorizes every commercial activity.
Key Takeaways
- OSS RBA assesses licensing at the business-activity level, so one company can have several KBLI activities with different risk classifications and readiness requirements.
- The NIB is the business identity and registration foundation, but it is not universal proof that every activity may operate commercially.
- Low-risk activities generally rely on the NIB, while medium-risk activities involve a Standard Certificate and high-risk activities require an NIB plus a licence.
- For medium-high-risk activities, a Standard Certificate generally needs government verification before the activity is operationally or commercially ready.
- Spatial, environmental, building, product, sector and PB UMKU requirements may sit alongside the main OSS licensing output.
- A reliable go-live decision should be based on an activity-by-activity evidence matrix, not a single green status or downloaded document.
What Is the OSS RBA Licensing Process?
The OSS RBA licensing process is Indonesia’s integrated, risk-based route for issuing business identification and licensing outputs. Under Government Regulation Number 28 of 2025, risk-based business licensing covers basic requirements, principal business licensing, Business Licensing to Support Business Activities (PB UMKU), OSS services, supervision and related implementation matters. The regulation replaced Government Regulation Number 5 of 2021.
The practical idea is straightforward: the regulatory route should reflect the risk of the specific activity rather than apply the same licence to every business. The implementation details are further addressed by Investment Ministry/BKPM Regulation Number 5 of 2025 and the current OSS portal.
This does not mean that risk is assessed once for the company as a whole. The selected KBLI, scope, scale and sector determine the activity-level pathway. A foreign-owned company with consulting, wholesale distribution and software activities may therefore see different OSS outputs and supporting obligations for each line of business.
The Four Risk Levels and Their Main Licensing Outputs
Indonesia’s risk-based model uses four levels. The following table is a planning summary, not an activity-specific determination. The actual result must be checked in the current OSS activity record and applicable sector standards.
| Risk level | Main OSS output | Operational question |
|---|---|---|
| Low | NIB | Are the activity, location, basic requirements and any supporting obligations correctly recorded? |
| Medium-low | NIB and self-declared Standard Certificate | Has the company accepted and implemented the applicable standards, rather than merely downloading the certificate? |
| Medium-high | NIB and government-verified Standard Certificate | Has verification been completed, and is the certificate effective for operational or commercial activity? |
| High | NIB and licence | Has the competent authority issued the required licence, and are all preconditions and supporting approvals effective? |
The distinction between medium-low and medium-high activities is particularly important. A self-declared Standard Certificate and a Standard Certificate that requires authority verification are not interchangeable. A medium-high business should not assume that filing the application or holding an unverified document is equivalent to authorization to operate commercially.
For a deeper explanation of the classification logic, see IndoGateway’s guide to Indonesia’s four risk-based licensing levels.
OSS RBA Licensing Process: Step by Step
1. Define the Actual Business Model
Start with what the Indonesian entity will actually do, earn revenue from and control. Separate manufacturing from trading, owned-inventory retail from marketplace intermediation, consulting from regulated professional practice, and software development from electronic-system or payment functions. This commercial description should be specific enough to test against KBLI scopes and sector rules.
The company should also identify where each activity will occur, whether goods will be imported, whether regulated products are involved, whether a physical facility is required and which entity will contract with customers. These facts can change the licensing workstream even when the proposed brand or business description sounds unchanged.
2. Select and Validate the KBLI Activities
Each proposed activity should be matched to the most defensible current KBLI code and scope. Do not select a code because its short title sounds convenient. Review its detailed description, exclusions, sector association, risk information and any supporting licensing shown in the current OSS directory. IndoGateway’s KBLI classification guide explains why the classification decision affects more than the company profile.
For a foreign-owned company, KBLI validation should be coordinated with foreign-investment eligibility and the entity’s corporate purpose. A code that is technically available in OSS may still require review against investment, sector, professional, product or operating-model restrictions. Corporate documents and OSS data should tell the same story.
3. Confirm Entity and OSS Account Data
Before processing licensing, verify the legal entity data that OSS receives from connected government systems. The company name, deed and approval information, shareholders, management, tax details, address, contact information and authorized user should be accurate. Inconsistent data can cause an application to stall or can produce documents that do not match the intended project.
This stage is also a governance checkpoint. Decide who is authorized to submit declarations, accept standards and maintain credentials. OSS submissions can contain legally and operationally significant statements, so access should not depend on one external email address or an undocumented handover.
4. Enter Activity and Project Data
The applicant then enters the relevant business-activity and project information. Depending on the activity, the requested data may address the location, land area, investment plan, workforce, products, capacity, facility or other project characteristics. These fields should reflect an agreed project basis rather than provisional numbers copied from another application.
Project data can influence the risk and requirement pathway. Changes to the site, capacity, operating model or product range may therefore require a fresh licensing analysis and possibly an OSS amendment. The internal project team should retain the source documents supporting every material entry.
5. Resolve Applicable Basic Requirements
Basic requirements may include spatial-use conformity, environmental approval and building-related compliance, depending on the activity and project. These workstreams are connected to the actual site and facility, not merely the entity. A leased site should be reviewed just as carefully as owned land because the intended use, building status and existing approvals may not cover the proposed operation.
For projects with a material physical footprint, build a site-readiness review before making an irreversible lease, land or construction commitment. Relevant IndoGateway resources include spatial approval support, UKL-UPL and SPPL environmental support, and guidance on PBG and SLF building compliance.
6. Obtain the NIB and Review Every Activity Output
After the required data and declarations are submitted, OSS may issue the NIB and display the licensing route for each recorded activity. The NIB is evidence of business registration and identity, but the company should immediately inspect the activity list rather than stop at the NIB download.
For each KBLI activity, record the risk level, main licence type, status, authority, location and any unresolved requirement. The NIB, OSS and KBLI guide provides additional context on how these elements fit together.
What Happens After the NIB?
Complete the Standard Certificate or Licence Route
A medium-risk activity may require a Standard Certificate, while a high-risk activity requires the relevant licence. The exact evidence, review steps and responsible authority depend on the activity and sector. Treat an application status, a preparation-stage document and an effective operational authorization as different things.
For medium-high risk, the company may be able to conduct preparation while verification is pending, subject to the applicable rules, but it should not equate that stage with permission for operational or commercial activity. The go-live checklist should record the effective status shown in OSS and any authority-issued document.
Identify PB UMKU and Sector Requirements
PB UMKU supports particular business activities and may include standards or product-related permissions that are processed before or after the operational or commercial stage according to the competent ministry or agency’s rules. Examples vary widely across sectors, so the OSS directory for the selected activity should be reviewed rather than relying on a generic list.
Some projects also involve approvals administered through sector-specific processes. Product registration, importer arrangements, electronic-system registration, professional authorization, industrial obligations, food safety, halal, medical-device, construction, transport, energy and other sector matters may be relevant. IndoGateway’s sector-licensing services page shows the breadth of possible workstreams without implying that all apply to every company.
Implement the Standards in Operations
Licensing readiness is not only a document exercise. A self-declared or verified standard may require the business to maintain personnel, facilities, procedures, records, equipment or controls. The operational team should translate each commitment into a named owner, evidence requirement and review date.
This is where legal, compliance, operations, property, product and finance teams need a single control matrix. A document can be valid while the real facility or process still fails to match the conditions declared in the application.
Prepare for Supervision and Ongoing Compliance
Risk-based licensing includes supervision. Businesses should retain submitted data, issued documents, correspondence, verification evidence and proof that applicable standards are being implemented. They should also monitor changes to activities, ownership, site, capacity, products or facilities that could trigger an amendment or new approval.
For foreign-investment companies, ongoing obligations may also include investment activity reporting and other corporate, tax, workforce and sector compliance. The precise calendar should be built from the company’s actual licences and registrations.
How to Test Operational Readiness
A practical readiness review should work from the activity outward. Create one row for every KBLI activity and one column for each dependency. At minimum, test the following:
- Corporate alignment: The entity’s corporate purpose, approved data and OSS activity records are consistent.
- Investment eligibility: Foreign ownership and sector eligibility have been reviewed for the exact activity and investor profile.
- Main OSS output: The NIB, Standard Certificate or licence required for that risk level is issued and effective for the intended stage.
- Basic requirements: Spatial, environmental and building matters applicable to the site and project are complete or at the correct effective stage.
- Supporting permissions: Relevant PB UMKU, product, import, sector, professional and facility approvals have been identified and completed where required.
- Operational evidence: The actual people, premises, equipment, procedures and records meet the standards accepted or verified through licensing.
- Change control: A process exists to assess future changes before the business expands, relocates, adds products or modifies activities.
The outcome should be a documented decision for each activity: ready, ready with controlled conditions, preparation only, or blocked. This is more useful than a general statement that the company “has OSS.”
Common OSS RBA Mistakes
- Treating the NIB as a universal operating licence. Review every activity’s risk route and effective status.
- Choosing KBLI codes from titles alone. The detailed scope and exclusions may not match the revenue model.
- Submitting provisional project data. Site, scale, products and capacity can affect the requirement pathway.
- Ignoring verification status. A medium-high Standard Certificate that still requires verification should not be treated as fully operational.
- Reviewing the entity but not the site. Property, environmental and building dependencies can block practical operation.
- Missing PB UMKU or sector approvals. The main business licence may not cover all supporting functions or regulated products.
- Failing to implement declared standards. Compliance needs operational evidence, not only downloaded files.
- Changing the business without a licensing review. New activities, locations, products or facilities may require amendments.
Questions to Answer Before Filing
- What will the Indonesian entity sell, manufacture, operate or provide?
- Which entity will own inventory, import goods, operate the platform or sign customer contracts?
- Which KBLI scope covers each revenue-generating activity?
- Is each activity open to the proposed foreign-ownership structure?
- What site, facility, product, capacity and workforce will the project use?
- Which basic requirements, PB UMKU and sector approvals appear for each activity?
- What evidence will demonstrate that applicable standards are implemented?
- Who owns submissions, credentials, renewals, reporting and future change control?
Conclusion
The OSS RBA licensing process should be managed as an activity-by-activity path from business-model definition to verified operational readiness. The NIB creates the identification foundation, but the company’s ability to start a specific operation may still depend on an effective Standard Certificate or licence, basic requirements, PB UMKU, sector permissions and evidence that the standards are actually implemented.
Foreign investors can reduce rework by aligning the commercial model, KBLI selection, corporate documents, site and supporting approvals before filing. The strongest go-live decision is supported by a complete evidence matrix for every activity, not by the existence of a single document.
Regulatory note: Indonesian investment, licensing, tax, immigration, product, environmental and operating requirements may change and may depend on the business activity, ownership structure, location, products and project circumstances. This article provides general information and is not project-specific legal, tax or regulatory advice. Applicable requirements should be verified before implementation.
Plan Your OSS RBA Licensing Route
IndoGateway can help foreign companies connect entity data, KBLI selection, OSS outputs, site requirements and sector approvals into one practical readiness plan. Contact IndoGateway to review the dependencies for your proposed activities before committing to a filing or launch date.
Frequently Asked Questions
1. Is an NIB enough to start operating in Indonesia?
An NIB is enough only where the applicable activity-level route and all project dependencies make it sufficient; it is not a universal operating approval. For low-risk activity, the NIB is generally the main business-licensing output, but the company must still confirm the recorded activity, site and any supporting obligations. Medium-risk and high-risk activities involve a Standard Certificate or licence. Basic requirements, PB UMKU, product registration and sector approvals may also affect readiness. Review every KBLI activity in OSS before deciding that commercial operations may begin.
2. What is the difference between medium-low and medium-high risk in OSS?
The central difference is how the Standard Certificate becomes effective for the relevant operating stage. A medium-low-risk route generally uses a business declaration of compliance with the applicable standard, while a medium-high-risk route requires verification by the competent government authority. That distinction affects when the activity may move from preparation into operational or commercial activity. The company should check the certificate’s current status and the applicable sector standard, because filing information or receiving a preliminary document does not by itself prove that verification has been completed.
3. Can one company have different OSS risk levels?
Yes. Risk classification is connected to each business activity and its relevant scope, not simply to the legal entity as a whole. A company with several KBLI activities may therefore have a low-risk output for one activity, a Standard Certificate for another and a licence route for a third. The operational team should maintain a separate readiness record for every activity and location. A consolidated company-level statement can hide unresolved dependencies, especially when one activity involves a regulated product, physical facility, import function or sector-specific authorization.
4. What are basic requirements in the OSS RBA process?
Basic requirements are foundational project approvals addressed within Indonesia’s risk-based licensing framework, including spatial-use, environmental and building-related matters where applicable. The precise route depends on the project, site, facility and impact profile. They should be assessed early because a company can be incorporated and hold an NIB while the intended premises are not yet ready for the proposed use. Before signing a long-term lease, buying land or starting construction, investors should verify the site’s planning position, environmental route and building compliance against the actual operation.
5. What is PB UMKU, and when is it needed?
PB UMKU means Business Licensing to Support Business Activities. It covers supporting permissions, standards or product-related requirements linked to particular operations and sectors. Whether one is required depends on the selected KBLI, product, function and competent authority’s rules; it cannot be determined from the company name alone. The current OSS activity and PB UMKU directories should be reviewed for each project. Some supporting permissions may be processed before or after the operational or commercial stage, so their timing must be mapped to the intended launch sequence.
6. How long does the OSS RBA licensing process take?
There is no reliable universal timeline for the complete OSS RBA process. NIB issuance, authority verification, site approvals, environmental review, building compliance, product registration and sector licensing can have different data needs and review routes. Timing also depends on the accuracy of corporate records, chosen KBLI, project location, risk level, facility readiness and whether the competent authority requests corrections or evidence. Build the schedule by workstream and dependency, using official service information for the specific application rather than a generic promise covering every licence.
7. What should a foreign company prepare before using OSS?
A foreign company should prepare a precise Indonesian business model, validated KBLI activities, an ownership and sector eligibility review, aligned corporate documents, accurate shareholder and management data, project location information, investment and workforce data, and a list of products, facilities and operating functions. It should also identify the authorized OSS user and retain supporting records for material submissions. Preparation is strongest when legal, investment, property, environmental, product, import and operational teams agree on one project basis before data is entered into the system.
8. When should an OSS licence be amended?
An amendment review should occur before a material change is implemented, including adding or changing activities, relocating a project, expanding a facility, changing products or capacity, modifying ownership or corporate data, or altering the operating model. Not every change follows the same procedure, and some may affect corporate documents, investment eligibility, basic requirements, risk outputs or supporting approvals. Compare the proposed future state with the licensed state activity by activity. Where the effect is uncertain, verify the required OSS and authority steps before contracting, construction or commercial launch.
