Business License in Indonesia: NIB, OSS and Risk-Based Permits for PT PMA

Business License in Indonesia: NIB, OSS and Risk-Based Permits for PT PMA

A business licence in Indonesia is not one universal document. A PT PMA normally begins with a Business Identification Number, or NIB, generated through the Online Single Submission system. Whether the company may actually start a particular activity then depends on the five-digit KBLI classification, its risk level, the status of any Standard Certificate or licence, the fulfilment of basic requirements, and sector-specific approvals.

For a low-risk activity, the NIB may be sufficient as the risk-based business licence. For medium-low risk, the company generally needs the NIB and a Standard Certificate based on its commitment. Medium-high risk requires the Standard Certificate to be verified before the regulated activity is carried out. High-risk activity requires an NIB and a licence, with additional standards and approvals depending on the sector.

The practical rule is simple: receiving an NIB does not necessarily mean that every KBLI shown in the OSS profile is operational. Before signing customers, importing products, opening regulated premises, manufacturing, constructing or providing a licensed service, confirm the status of each activity separately.

Answer first: A PT PMA is ready to operate only when its legal entity, NIB, KBLI selection, risk-based licence status, basic requirements and sector approvals match the activities it will actually perform. Treat the NIB as the starting identity and licensing gateway—not automatic clearance for every operation.

The current legal framework changed in 2025

Government Regulation No. 28 of 2025 on Risk-Based Business Licensing took effect on 5 June 2025 and expressly revoked Government Regulation No. 5 of 2021. It covers basic requirements, risk-based business licensing, licences supporting business activities, OSS procedures, supervision, evaluation, sanctions and the resolution of licensing obstacles.

The operational procedures were further updated by Ministry of Investment and Downstream Industry/BKPM Regulation No. 5 of 2025, effective 2 October 2025. That regulation governs risk-based licensing and investment facilities through OSS and replaced several BKPM regulations issued in 2021. A current 2026 licence review should therefore not stop at articles, checklists or screenshots built around the former 2021 framework.

PP 28/2025 preserved the risk-based logic but refined process, service standards and the quality of licensing administration. The applicable output is still determined at activity level. A company with several KBLIs may have one low-risk activity, another requiring a verified Standard Certificate, and a third requiring a sector licence. The safest audit is conducted KBLI by KBLI and location by location.

What are NIB, Standard Certificate, licence and PB UMKU?

Instrument	Function	What to verify
NIB	The company’s business identity in OSS and the core entry point to risk-based licensing.	Company, address, responsible person, shareholders, investment and KBLI data are accurate and synchronised.
Standard Certificate	Evidence of compliance with business standards for medium-risk activities; its effectiveness can depend on the relevant risk tier and verification.	Whether it is self-declared or verified, which commitments apply, and whether OSS shows an effective status.
Licence	Approval required for high-risk activity before the regulated business operation may begin.	Technical prerequisites, verification, issuing authority, validity, location and operating conditions.
PB UMKU	A licence supporting a business activity at a particular operational or commercial stage.	Product, distribution, professional, facility or other supporting approvals required beyond the core business licence.
Basic requirements	Underlying approvals connected to space, environment and buildings, as applicable.	Location suitability, environmental obligations, building approval and function certification before relying on a premises.

 

These instruments do not always appear in a neat sequence. OSS can issue or display commitments while an external ministry, regional authority or technical system completes verification. Some supporting approvals sit outside the main OSS screen. The company should maintain a licence matrix showing the instrument, authority, status, conditions, evidence, expiry or monitoring date, and the business activity it supports.

Indonesia’s four risk levels

Risk level	Core licensing output	Operational implication
Low	NIB	The NIB generally functions as the risk-based licence for that low-risk activity, subject to continuing compliance and any separate product or supporting approval.
Medium-low	NIB + Standard Certificate	The certificate is generally based on the business’s statement of compliance. The company must still satisfy the standards it declared.
Medium-high	NIB + verified Standard Certificate	The regulated activity should not commence until the certificate has been verified and the applicable conditions are fulfilled.
High	NIB + licence	The company needs the licence before conducting the high-risk operation; technical, environmental, facility or sector approvals may be prerequisites.

Risk level is not chosen by the founder. OSS derives it from the KBLI, business scale, activity parameters and the regulatory data mapped to that activity. A familiar word such as “consulting,” “trading,” “technology” or “manufacturing” is too broad to predict the result. The contracting model and operational facts matter.

How to obtain a business licence for a PT PMA

1. Define the activity before selecting the KBLI

Describe what the Indonesian company will do, who pays it, what it delivers, whether it imports or manufactures, whether it stores or distributes products, whether it operates a digital platform, and where each activity occurs. Separate principal activity, supporting activity and future expansion. The description should be specific enough to compare with KBLI definitions and the licences attached to them.

Do not copy a competitor’s KBLI. Two businesses with similar websites may have different legal functions. A marketplace differs from a seller; a distributor differs from an agent; a software publisher differs from an implementation consultant; a restaurant differs from a food manufacturer. The wrong code can produce the wrong risk level, foreign-ownership analysis, investment plan and licence set.

2. Confirm foreign ownership and PT PMA eligibility

A code that appears in OSS is not automatically open to the proposed foreign shareholding. Review the investment-business-field rules, the scale reserved for cooperatives or micro and small enterprises, partnership requirements and sector-specific ownership conditions. Where full foreign ownership is permitted, the PT PMA can generally use foreign shareholders; restricted activities need a lawful structure rather than a nominee arrangement.

This ownership analysis should happen before the deed is signed because the KBLI, stated objects, shareholder structure and investment profile need to form a coherent record. If you are planning market entry, MLS’s PT PMA and Investor KITAS service can coordinate the corporate, licensing and immigration workstreams before inconsistent filings require amendments.

3. Establish the legal entity and align the source data

The PT PMA must be established through a notarial deed and receive approval as a legal entity through AHU. Its tax identity, address, management, shareholders and beneficial-owner information should be checked before OSS registration. System integration does not remove the company’s responsibility to correct inconsistent names, passport data, addresses, capital or corporate roles.

For a foreign corporate shareholder, prepare evidence of legal existence, constitutional documents, authorisation and signatory documents, with apostille or legalisation and sworn translation where applicable. Banks and authorities may also require the ultimate ownership chain and the natural persons who exercise ownership or control.

4. Complete OSS business and investment data

The OSS filing connects the legal entity to its activities and projects. Enter each relevant KBLI, project location, business scale, land or premises data, planned investment, workforce plan and responsible person accurately. For a PT PMA, the investment and capital figures should be reconciled with the deed, bank evidence, accounting records and later LKPM reporting.

Adding many speculative KBLIs is not harmless. Each code can create an investment expectation, licensing obligation, reporting scope or location consequence. Select codes needed for the actual business plan and use a documented expansion process when the company later adds activities.

5. Obtain the NIB and inspect every activity status

After valid data is submitted, OSS generates the NIB and the risk-based outputs associated with the activities. Downloading the NIB is not the end of the review. Open each project and KBLI entry, identify the risk level, record the additional instrument, check whether a certificate or licence is effective, and note every commitment or pending verification.

A client, bank or counterparty may ask only for the NIB because it is the most visible identifier. That commercial request does not override the underlying regulatory conditions. The internal go-live decision should be based on the complete licence file, not the existence of one PDF.

6. Fulfil standards, verification and technical conditions

For medium-risk activity, read the applicable standards and prepare evidence that the company meets them. Medium-low self-declaration is not permission to ignore the declared obligations. Medium-high verification can require a review of premises, technical personnel, equipment, operating procedures or other evidence. High-risk licensing may require these elements before the licence becomes effective.

The exact requirements depend on the sector and can involve ministries, regional authorities or professional bodies. Build time for clarification and correction. An estimate provided before the KBLI, location and technical requirements are confirmed is only a planning estimate, not an approval promise.

7. Complete sector licences and PB UMKU

Core risk-based licensing does not replace all sector and product regulation. Food, cosmetics, medical devices, pharmaceuticals, construction, transport, financial services, telecommunications, mining, tourism, education, professional services, importation and other regulated activities can require additional approvals. Product registration, certification, distribution rights, technical qualifications or facility approvals may be needed before sales begin.

PB UMKU should be mapped to the company’s operating sequence. Ask what approval is required to import, produce, store, distribute, advertise, sell or provide the service—not merely what document is needed to register the entity. This prevents the common situation in which the company exists and has an NIB but cannot lawfully execute its revenue model.

8. Verify operational readiness and retain evidence

Before launch, compare the deed, AHU profile, NPWP, NIB, OSS project data, licences, premises, contracts, invoices, website descriptions, staffing and bank records. The same company should not describe itself differently across those records. Maintain a dated licence matrix and the technical evidence supporting every commitment.

Licensing is not a one-time incorporation file. Changes to address, shareholders, directors, capital, KBLI, project location, products or facilities can trigger updates or new approvals. Ongoing obligations may include LKPM investment reporting, tax and employment compliance, licence supervision, annual corporate approvals and beneficial-owner updates.

Business-licence document checklist

• Business-model description covering products, services, contracting flow, customers and operating locations.

• Proposed KBLI list with a written reason for each code and the revenue stream it supports.

• Foreign-ownership review for every material activity and relevant sector.

• Notarial deed, AHU approval, NPWP and current corporate data.

• Shareholder, director, commissioner, responsible-person and beneficial-owner information.

• Project location, premises evidence and confirmation that the address is suitable for the activity.

• Paid-up capital evidence, planned investment values and workforce plan.

• NIB and an activity-by-activity OSS status review.

• Standard Certificates, licences, verification results and proof of compliance with declared standards.

• Basic requirements relating to spatial use, environment and buildings where applicable.

• Sector permits, product registrations, professional qualifications and PB UMKU.

• Licence matrix showing authority, status, conditions, renewal or monitoring date and document owner.

Common mistakes that delay or invalidate operational readiness

Assuming the NIB is the final licence

The NIB may be sufficient for a low-risk activity, but other activities need a Standard Certificate, verification or licence. Product and sector approvals can apply even where the core risk level is low. Review each KBLI rather than describing the entire company as “already licensed.”

Using the wrong or overly broad KBLI

A convenient code can become expensive when a bank, customer or regulator compares it with the contracts and actual operation. Correcting the mismatch may require an amendment to the company’s objects, AHU filing, OSS update and new licence process.

Operating while verification is pending

A certificate shown in OSS may still have commitments or verification requirements. For medium-high and high-risk activity, confirm effectiveness before launch. Separate preparation activities from the regulated commercial operation and obtain specific advice if the boundary is unclear.

Treating old guidance as current law

Many high-ranking pages still cite PP 5/2021, refer to temporary and permanent business licences, or use pre-2025 procedures. PP 28/2025 revoked PP 5/2021 on 5 June 2025, and BKPM Regulation 5/2025 replaced several 2021 implementing regulations from 2 October 2025.

Ignoring the premises and operating substance

A virtual office can be appropriate for some activities but not for every regulated or location-dependent business. Manufacturing, hospitality, storage, construction and other facility-based operations require a premises and technical plan that supports the licence. Check zoning, environmental and building requirements before committing to the address.

Letting the licence file diverge from corporate and financial records

Changes to shareholders, management, capital, address or activities should be reflected consistently across the deed, AHU, tax system, OSS, bank KYC, beneficial-owner filing and accounting. Inconsistent records create delays during licences, immigration, banking, due diligence and regulatory supervision.

How long does business licensing take in Indonesia?

There is no reliable universal timeline. When the company data is clean and the activity is low risk, the NIB stage can be completed relatively quickly. A medium-high or high-risk activity can take longer because premises, technical personnel, equipment, environmental requirements, external verification, sector approvals or product registration must be ready.

The useful planning question is not “How many days for a business licence?” but “Which approval controls the date on which this activity may lawfully go live?” Build the project schedule around that critical licence, then work backwards to the deed, premises, technical evidence, staffing, imports and commercial launch. Avoid providers who promise approval without first reviewing the KBLI and sector.

What does a business licence cost?

There is no single government fee for an Indonesian business licence. Costs depend on the entity, activity, issuing authority, location, technical verification, sector charges, product registrations, environmental or building work and professional support. The NIB itself should not be confused with the full cost of becoming operational.

Separate at least four budgets: corporate establishment and notarial work; capital and planned investment; government or sector charges; and professional or technical implementation costs. A low quote that covers only the deed and NIB can be misleading if the revenue-producing activity requires a verified certificate, sector licence or product approval.

Business licensing and Investor KITAS are separate

Company licensing does not automatically grant a foreign shareholder or director the right to stay in Indonesia or perform every type of work. Investor immigration status, including the E28A pathway, has separate rules on sponsorship, shareholding, corporate position, permitted activities and supporting documents. A PT PMA can have a valid NIB while an individual’s proposed activity still needs immigration or manpower analysis.

Coordinate the filings because the deed, shareholding, management role, OSS data and immigration evidence should tell the same story. MLS provides integrated PT PMA and Investor KITAS assistance for foreign founders who need the corporate vehicle, licences and residence strategy planned as one project while keeping the legal tests distinct.

Frequently asked questions

Can a foreigner obtain a business licence in Indonesia?

Yes, normally through an eligible Indonesian legal vehicle such as a PT PMA. The proposed activities must be open to the foreign ownership structure, and the company must fulfil the risk-based and sector licensing requirements attached to its KBLI codes.

Is an NIB enough to start operating?

It can be enough for the relevant low-risk activity, but not universally. Medium-risk and high-risk activities require additional instruments, and separate sector or product approvals may apply. Inspect the status of each activity in OSS before launch.

Does every PT PMA need the same licences?

No. The required set depends on the activities, risk levels, scale, locations, premises, products and sector rules. Two PT PMAs with similar names or customers can require different licences because their contracting and operational roles differ.

Can one PT PMA have several KBLI codes?

Yes, provided the codes reflect genuine activities and are compatible with the company’s corporate objects, foreign-ownership position, investment plan and licences. Each additional code can create its own regulatory and reporting consequences.

Can the company operate while a Standard Certificate is being verified?

Do not assume so. For a medium-high risk activity, verification is central to the certificate’s effectiveness. The permitted preparatory steps and the point at which regulated operations begin are fact-specific and should be confirmed before commercial activity starts.

Does the NIB expire?

The NIB is generally the company’s continuing business identity, but its data must remain accurate and the company must comply with conditions attached to its activities. Other licences, certifications and supporting approvals can have validity periods, renewal duties or continuing supervision.

Can a company change or add its KBLI later?

Yes, but the change can require a corporate resolution and notarial amendment, AHU update, revised investment data, OSS changes and new licences. Review foreign ownership, capital, premises and sector rules before adding the activity.

Is business licensing completed automatically after incorporation?

No. AHU approval establishes the legal entity. OSS registration, NIB issuance and completion of risk-based and sector approvals are separate steps. The company may legally exist before every planned activity is operationally licensed.

Plan the licence before the launch date

A sound PT PMA project begins with the revenue model and works backwards from the approval needed to operate. Define the activity, select the correct KBLI, confirm foreign ownership, map the risk level and sector rules, prepare the premises and technical evidence, then align the deed, AHU, tax, OSS, bank and immigration records.

Master Legal Solution can review the KBLI and licence pathway, establish the PT PMA, coordinate notarial and AHU work, complete OSS filings and plan Investor KITAS documentation. Early licence mapping is usually faster and less expensive than amending a company that was incorporated with the wrong activity, address or operating assumptions.

Authoritative sources checked on 24 September 2026

• Government Regulation No. 28 of 2025 on Risk-Based Business Licensing

• Ministry of Investment and Downstream Industry/BKPM Regulation No. 5 of 2025

• Official Online Single Submission portal

• Law No. 25 of 2007 on Investment, as amended

• Law No. 40 of 2007 on Limited Liability Companies

• Presidential Regulation No. 10 of 2021 on Investment Business Fields

• Presidential Regulation No. 49 of 2021 amending the Investment Business Fields regulation

Editorial note: This article provides general legal information, not a definitive licensing opinion. The required approvals and operational date depend on the actual activity, KBLI, scale, location, parties, premises and documents. Government systems and sector requirements should be checked again at the time of filing.