Indonesia’s OSS system does not give every business the same licensing path. It uses the risk assigned to each business activity to determine whether the company can rely on a Business Identification Number (NIB), must make or obtain a Standard Certificate, or needs a licence before the activity can operate commercially.
For foreign companies, the practical question is therefore not simply, “How do we obtain an NIB?” It is, “Which licensing output applies to each KBLI activity at this location, scale and operating model, and what must be completed before launch?” Answering that question early affects the project plan, site selection, capital deployment, vendor commitments and launch date.
Key Takeaways
- Indonesia’s risk-based licensing framework has four operational tiers: low, medium-low, medium-high and high risk.
- The risk tier is attached to a business activity and its relevant parameters, not simply to the company as a whole.
- Low-risk activities generally use the NIB as the principal business-licensing output, while medium-risk activities add a Standard Certificate and high-risk activities add a licence.
- A medium-low Standard Certificate is based on a business declaration, while a medium-high Standard Certificate requires government verification before operational or commercial activity.
- An NIB does not automatically prove that every activity, site, product or facility is ready to operate.
- Foreign ownership, spatial planning, environmental approval, building readiness and sector-specific supporting licences must be assessed alongside the OSS output.
What OSS Risk Levels Mean in Indonesia
Risk-based business licensing is the method used by Indonesia’s Online Single Submission system to match regulatory controls to the potential risk of an activity. Under Government Regulation No. 28 of 2025, the analysis considers the level of hazard and the likelihood that the hazard will occur. The resulting classification determines the type of Business Licensing required.
The official framework recognizes low, medium-low, medium-high and high risk. This four-level structure is easy to summarize but more demanding to apply. A classification may vary with the specific KBLI activity, business scale and parameters recorded in OSS. A group with several lines of business may therefore have several licensing routes inside one Indonesian entity.
This is why selecting a KBLI code solely because its label appears commercially convenient can create problems. The chosen activity must accurately reflect what the business will do, while the project data must describe where and how it will be carried out. You can review the wider relationship between activity classification, registration and the platform in IndoGateway’s guide to NIB, OSS and KBLI in Indonesia.
The Four OSS Risk Levels and Their Licensing Routes
The table below is a planning overview, not a project-specific determination. The exact output shown in OSS should be verified for the selected activity and project parameters.
| Risk level | Core OSS route | Practical operating point |
|---|---|---|
| Low | NIB | The NIB is generally the principal Business Licensing output for the activity, subject to applicable basic requirements and supporting approvals. |
| Medium-low | NIB plus self-declared Standard Certificate | The business declares that it will meet the applicable business standards and remains responsible for compliance and supervision. |
| Medium-high | NIB plus verified Standard Certificate | The unverified certificate supports preparation; operational or commercial activity waits for verification of standard fulfilment. |
| High | NIB plus licence | The business must obtain the required licence before beginning the operational or commercial activity covered by it. |
The government’s current OSS portal also describes the system as grouping activities into four risk levels that determine the required permissions and obligations. The legal framework is implemented through OSS procedures, including the guidance in Investment Ministry/BKPM Regulation No. 5 of 2025.
How the Route Changes at Each Risk Level
Low risk: the NIB is central, but scope still matters
For a low-risk activity, the NIB generally serves as the Business Licensing output. That makes the route comparatively direct, but it does not turn the NIB into a universal authorization for anything the company may wish to do. The NIB reflects registered activities and project data. It should be checked against the final KBLI scope, legal entity, location and any supporting permissions that apply.
Foreign investors should also separate licensing risk from foreign-investment eligibility. A low-risk label does not by itself establish that a business activity is open to the proposed ownership structure. Ownership rules, sector conditions and corporate eligibility must be reviewed as a connected workstream.
Medium-low risk: the company makes a compliance declaration
A medium-low activity uses an NIB together with a Standard Certificate issued on the basis of the business’s declaration that it will meet the applicable standards. This does not mean the standards are optional or that no inspection can occur. Management should identify the standards behind the declaration, assign an owner, retain supporting records and build compliance into the operating process.
The distinction matters in due diligence. A certificate in the system is not a substitute for checking whether the facility and operations actually conform to the declared requirements. For a fuller explanation, see IndoGateway’s guide to the Standard Certificate in OSS Indonesia.
Medium-high risk: verification becomes a launch dependency
A medium-high activity also uses an NIB and Standard Certificate, but the certificate requires verification by the relevant authority. Before verification, it is limited to preparation for the business activity. The company should not treat an unverified certificate as permission to begin the relevant operational or commercial activity.
This creates a real project-management dependency. Document preparation, facility readiness, technical standards and authority review may need to align before launch. Businesses should identify who verifies the standard, what evidence is expected, which site conditions must exist and whether the verification depends on another approval.
High risk: the licence is a condition for operation
For a high-risk activity, the route uses an NIB and the applicable licence. The NIB establishes the registered business identity, but the licence is needed before the covered operational or commercial activity starts. The precise licence, issuing authority, technical evaluation and supporting documents depend on the activity and sector.
A high-risk route should be managed as a regulatory workstream, not as a final administrative task after the commercial project is already committed. Land, construction, environmental, technical, equipment and workforce decisions may have to support the licence application. IndoGateway’s sector licensing support can help connect OSS outputs with the competent authority’s requirements.
Why a Company Can Have More Than One Licensing Route
Risk is assessed at the activity level. Consider an investor that plans a production facility, wholesale distribution and a related consulting service. Those activities may use different KBLI codes and may not share the same risk tier, licensing output or authority. One activity may be ready under an NIB, while another awaits Standard Certificate verification or an additional licence.
The same logic applies when activities are added later. An existing company’s current permissions should not be assumed to cover a new product line, distribution model, facility or service merely because the entity already holds an NIB. Management should map each revenue-generating and supporting activity to the correct KBLI scope and then review its output in OSS.
A practical activity matrix should record:
- the commercial activity and how it earns revenue;
- the proposed KBLI code and description;
- the legal entity and ownership structure;
- the project location and business scale;
- the OSS risk tier and core licensing output;
- the status of basic requirements and supporting licences;
- the evidence needed for declarations, verification or licence approval; and
- the permitted point for preparation, testing and commercial operations.
Risk Level Is Only One Part of Operating Readiness
The risk tier determines the core Business Licensing route, but it does not answer every regulatory question. A company may also need to satisfy basic requirements concerning spatial use, environmental approval and buildings. Depending on the project, it may need Business Licensing to Support Business Activities (PB UMKU), product approvals, importer arrangements, sector registrations or technical certifications.
The official OSS PB UMKU directory shows the breadth of supporting permissions linked to different sectors and activities. The relevant combination depends on the KBLI, product, facility, location, workforce and operating model. It should not be inferred from the risk label alone.
Five connected checks are especially important for foreign companies:
- Corporate eligibility: confirm that the Indonesian entity and proposed foreign-ownership structure can conduct the selected activity.
- Activity accuracy: ensure that the KBLI description matches the real business model, including production, trade, distribution, digital delivery and support functions.
- Site readiness: check spatial, environmental, building and sector-specific conditions before signing an inflexible property commitment.
- Supporting approvals: identify PB UMKU, product, import, technical and workforce permissions that sit beside the core OSS output.
- Ongoing compliance: assign responsibility for reporting, declarations, certificate conditions, licence conditions and supervision after issuance.
A Practical OSS Risk-Level Planning Process
Step 1: describe the operating model in plain language
Start with what the Indonesian business will actually make, sell, distribute or deliver. Identify customers, channels, facilities, products, imports, employees and supporting functions. This prevents the licensing exercise from beginning with a code chosen without commercial context.
Step 2: map each material activity to KBLI
Match the operating model to the most accurate KBLI codes and confirm the scope of each description. Avoid adding unrelated codes merely to preserve optionality. An unnecessarily broad list can create extra compliance questions, while a narrow or inaccurate list may fail to cover planned revenue.
Step 3: test foreign-investment and sector conditions
Before treating the OSS route as settled, verify whether the proposed shareholders and entity type can perform each activity. Review any sector rules, conditions or additional approvals that affect the business. The appropriate result can depend on the precise activity rather than a broad industry label.
Step 4: enter consistent project data in OSS
The activity, scale, location, investment and facility data should agree with the corporate documents and project plan. Inconsistent inputs can produce rework or make it difficult to understand which conditions apply. Keep a controlled source file for the information entered and the evidence supporting it.
Step 5: read every output and status, not just the NIB
Download and review the NIB, Standard Certificate, licence and any requirement or status displayed for each activity. For medium-high risk, check whether verification is complete. For high risk, confirm whether the applicable licence has been issued. A document name alone should not be treated as proof of commercial readiness.
Step 6: close the non-OSS dependencies
Coordinate land, building, environmental, product, import, sector, employment and immigration workstreams as relevant. Some may run in parallel; others may depend on site or technical readiness. A single integrated tracker is more useful than separate teams assuming another adviser owns the missing approval.
Step 7: establish the operational compliance file
Retain final corporate data, submissions, declarations, certificates, licences, verification evidence and correspondence. Record conditions, reporting duties and responsible owners. The goal is not only issuance, but also a defensible operating position during supervision, expansion, financing, customer review or due diligence.
Common Mistakes That Change or Delay the Licensing Route
- Treating the company as having one risk level. Different activities can follow different routes.
- Using a convenient but inaccurate KBLI code. The code should follow the actual business model, not a desired licensing output.
- Confusing NIB issuance with operating permission. Medium-high and high-risk activities have additional gates.
- Ignoring the status of a Standard Certificate. A medium-high certificate awaiting verification does not support operational or commercial activity.
- Separating licensing from the site. Location, facility and environmental facts may affect requirements and evidence.
- Assuming low risk means open to foreign ownership. Risk classification and investment eligibility are different analyses.
- Overlooking PB UMKU and product approvals. Supporting permissions can remain necessary after the core Business Licensing output appears.
- Failing to revisit licensing after a change. New activities, locations, products or operating models may require amendments or new approvals.
Questions Management Should Answer Before Launch
A disciplined go-live review should answer the following questions for every material activity:
- Does the final KBLI scope match the contracted products and services?
- Is the ownership structure eligible for the activity?
- What risk tier and licensing output does OSS show for the actual project data?
- If a Standard Certificate applies, is it self-declared or subject to verification?
- If verification or a licence is required, has it been completed and issued?
- Are the spatial, environmental and building requirements in place for the site?
- Are all relevant PB UMKU, product, import and technical permissions complete?
- Who owns post-issuance reporting, licence conditions and change management?
If any answer is uncertain, the company should pause the affected activity rather than assume that an entity-level NIB cures an activity-level gap. IndoGateway’s NIB and OSS business licensing service is designed to help investors connect these decisions before implementation.
Frequently Asked Questions
1. What are the four OSS business risk levels in Indonesia?
The four levels are low, medium-low, medium-high and high risk. They are produced through risk analysis for a business activity and determine the principal Business Licensing route. Low-risk activities generally use an NIB; medium-low activities use an NIB and a self-declared Standard Certificate; medium-high activities use an NIB and a Standard Certificate that requires verification; and high-risk activities use an NIB and a licence. The result should be checked for the specific KBLI, scale and project data rather than assumed from an industry label.
2. Does an Indonesian company have one risk level?
No. A company can conduct several registered activities, and each activity may carry a different risk classification and licensing output. A manufacturing line, distribution activity and consulting service held by one entity may therefore follow separate routes. Management should maintain an activity-by-activity matrix showing the KBLI code, location, risk tier, OSS document, verification status and supporting approvals. This approach prevents one completed low-risk activity from creating false confidence that every other activity is also ready for commercial operation. Review each activity independently.
3. Is an NIB enough for a low-risk business?
For the core risk-based Business Licensing route, the NIB is generally the principal output for a low-risk activity. However, “enough” depends on what the company means by fully operational. The business must still confirm that the NIB covers the correct activity and project, that the ownership structure is eligible, and that applicable basic requirements and supporting permissions are satisfied. Product, import, site, building, environmental or sector requirements may exist separately. The NIB should therefore be reviewed as part of an operating-readiness package, not in isolation.
4. What is the difference between medium-low and medium-high risk?
Both tiers involve an NIB and a Standard Certificate, but the compliance gate differs. For medium-low risk, the certificate is issued on the basis of the business’s declaration that it will meet the relevant standards. For medium-high risk, fulfilment of the standards must be verified by the competent authority before the activity can begin operational or commercial operations. While verification is pending, the certificate is limited to preparation. Businesses should confirm the current OSS status and evidence requirements instead of relying only on the certificate’s presence in the account.
5. Can a medium-high-risk business operate while verification is pending?
The medium-high route distinguishes preparation from operational or commercial activity. An unverified Standard Certificate supports preparation for the activity, but it is not the final basis for beginning the covered operational or commercial operations. The boundary should be assessed carefully for the specific project, especially where installation, commissioning, testing, customer deliveries or revenue generation could be interpreted differently. The company should document the planned pre-operation work, confirm the certificate status in OSS and obtain project-specific regulatory advice before crossing into commercial activity.
6. Does a high-risk activity need an NIB and a separate licence?
Yes. Under the risk-based structure, a high-risk activity uses an NIB together with the applicable licence, and the licence is required before the covered operational or commercial activity begins. The exact licence and evidence package depend on the KBLI activity, sector, facility, product, location and other project facts. A company should not assume that obtaining the NIB starts the high-risk operation. It should build authority review, technical documents, site readiness and related approvals into the critical path before committing to a launch date.
7. Can choosing a different KBLI code reduce the risk level?
A business should not select a KBLI code merely to obtain a lighter licensing route. The code must accurately describe the activity the company will perform. Choosing an inaccurate code can create inconsistencies in contracts, invoices, facilities, tax records, import arrangements, applications and supervision. If several codes appear plausible, the correct response is to compare their official scopes against the real operating model and seek specialist verification where necessary. Commercial design can influence which activities the company performs, but the classification should follow reality rather than a preferred risk result.
8. When should an investor verify its OSS risk level?
Verification should begin before incorporation or major project commitments, then be repeated when final activity, location, scale and facility data are available. It should also be revisited before operations start and whenever the company adds a product, activity, location, facility or materially different operating model. The purpose is to catch changes that affect the licensing route before they become launch delays or compliance gaps. Because regulations and OSS implementation can change, businesses should use current official information and retain a dated record of the assumptions reviewed.
Conclusion
OSS risk levels change the licensing route by changing the document and government control needed before an activity can operate. Low risk centers on the NIB, medium risk adds a Standard Certificate with different declaration and verification mechanics, and high risk adds a licence. The most important planning discipline is to apply that framework separately to each real business activity and then connect it with ownership, site, product and sector requirements.
A reliable launch decision is based on the complete activity and approval matrix, not the existence of a single registration document. Build the matrix early, verify the project data, read every OSS status and keep operating conditions under active ownership after issuance.
Plan the Right Licensing Route with IndoGateway
IndoGateway helps foreign companies translate business activities into a practical Indonesia licensing plan, from KBLI and ownership review through OSS outputs, supporting approvals and operational readiness. Contact IndoGateway to review your proposed activities, locations and launch dependencies before implementation.
