Current as at 9 November 2026.
A company that registers a business activity through Indonesia’s Online Single Submission (OSS) system receives a Nomor Induk Berusaha (NIB, Business Identification Number). For an activity rated medium-low or medium-high risk, OSS also issues a Sertifikat Standar (Standard Certificate), which records the company’s own statement that it will meet the business standard for that activity. Meeting the standard often requires certificates and reports from bodies outside OSS, in activities as varied as restaurants, villas, spas, fitness centres, property management, software development and construction. These obligations apply to a domestic limited liability company (Perseroan Terbatas, PT) and to a foreign-owned company (Perseroan Terbatas Penanaman Modal Asing, PT PMA) alike, and OSS lists some further obligations for a PT PMA alone.1
Unmet standard certificate obligations are a recurring finding in the Business Health Checks we perform for our clients. In each case, the company had declared the standards in OSS when it obtained the licence and had not met them by the time of our review. The missing items in recent Business Health Checks included a hygiene and sanitation certificate for food service, a tourism business standard certificate, a construction business entity certificate, reporting to the Indonesian Book Information System and product certification against a national standard.7 Some of these companies were trading while OSS still showed their certificate as unverified, a status that permits preparation only.2
What do the NIB and the standard certificate authorise?
Government Regulation Number 28 of 2025 (PP 28/2025) rates every activity in the Klasifikasi Baku Lapangan Usaha Indonesia (KBLI, Indonesian Standard Industrial Classification) as low, medium-low, medium-high or high risk. For each tier it sets the form of the licence and the point at which the company may operate.1
| Risk tier | Licence | How the standard certificate issues | When the company may operate and sell |
|---|---|---|---|
| Low | NIB | No standard certificate | On issue of the NIB (Article 130) |
| Medium-low | NIB and standard certificate | A statement by the company in OSS that it will meet the business standard, with no prior verification (Article 131(2)) | On issue; the standard must be met while the company operates and is examined at supervision (Article 131(4) to (6)) |
| Medium-high | NIB and standard certificate | A statement in OSS, then verification by the competent ministry or regional office (Article 132(2) to (4)) | Only once the certificate is verified; before that, preparation only (Article 132(5) and (6)) |
| High | NIB and Izin (permit) | No standard certificate; a permit issued after the authority verifies the permit requirements, including an environmental impact assessment where one is required (Articles 133 and 227) | Only once the permit is issued; before that, preparation only (Article 133(3) and (4)) |
The tier of a KBLI code can change with the scope and scale of the business. In OSS, the same code can show a different risk tier and a different list of obligations for each business scale from micro to large, and for some activities the building area also affects the tier. Computer programming, for example, is rated medium-low risk for a small business and medium-high risk for a large one.14 Minister of Investment and Downstream Industry Regulation Number 5 of 2025 (Permen Investasi 5/2025) classes every PT PMA as a large business. A domestic company’s scale follows its business capital, excluding land and buildings, or its annual sales (Articles 25 and 26).2
Why is the standard certificate in OSS only the first step?
Permen Investasi 5/2025 states that an unverified medium-high certificate gives limited legality for preparation and cannot be used for operational or commercial activity.2 A company that takes bookings, serves customers, issues invoices or sells products on an unverified medium-high certificate is outside its licence.
Where the verifying authority gives OSS no notification within the verification period, Article 225 of PP 28/2025 has OSS record the certificate as verified, and the company may print it.1 In our team’s reading, the company must still perform the standards after a deemed verification, because Article 222(4) requires it and supervision examines the standard itself. The sector certificates remain outstanding until their issuing bodies grant them.
High-risk activities follow the same pattern. Where the authority gives OSS no notification of its verification, Article 230 has OSS issue the permit. Where a high-risk activity must meet a business or product standard, Article 231 requires the company to apply for a Perizinan Berusaha untuk Menunjang Kegiatan Usaha (PB UMKU, supporting business licence). A distribution permit for a processed food product is one such licence.1
What does each KBLI code require beyond the certificate?
Each ministry sets the standards for its sector, and OSS lists the obligations for each code and business scale. The examples come from the sectors our clients operate in and use the obligations OSS lists for a large business under KBLI 2025, the scale of every PT PMA. A domestic company should check the tier and obligations for its own scale.14
| Sector | Example activity (KBLI 2025) | Risk tier in OSS for a large business | Obligations beyond the OSS certificate |
|---|---|---|---|
| Food and beverage | Restaurant (56101) | Medium-high | A tourism business standard certificate from a Lembaga Sertifikasi Produk (LSPr, product certification body), a Sertifikat Laik Higiene Sanitasi (SLHS, hygiene and sanitation certificate) from the regency or city government, with renewal applied for no later than three months before expiry, and an approved Rencana Penggunaan Tenaga Kerja Asing (RPTKA, expatriate utilisation plan) where foreign workers are employed34 |
| Food and beverage production | Coffee processing (10761) | High | A permit (Izin), documented good manufacturing procedures for packaging, labelling, storage and staff hygiene, industry data submitted every six months, and a distribution permit for each processed food product |
| Hospitality and accommodation | Villa (55203) | No large-business scale listed; medium-low for micro, small and medium businesses; closed to new PT PMA applications in Bali | A Sertifikat Laik Sehat (SLS, health worthiness certificate) and a self-assessment of readiness to apply the villa standard |
| Real estate and property | Residential property management for a fee (68292) | Medium-high | Written agreements with each client, the licence number displayed at the premises and in all advertising, payment through the national payment system, and activity reports to the Minister of Trade |
| Real estate and property | Real estate agency (68210) | Medium-high | Certified staff: every property broker an Indonesian citizen with a level 6 work competency certificate, at least one property brokerage manager with a level 7 certificate, and a level 7 property manager or property investment consultant where those services are offered; written client agreements, the licence number displayed in all advertising, and activity reports to the Minister of Trade10 |
| Health and wellness | Day spa (96230) | No large-business scale listed; medium-high for micro, small and medium businesses | A tourism business standard certificate from an LSPr and an SLS |
| Health and wellness | Medical spa (96230, medical spa scope) | High (OSS lists the large-business scale only) | A permit (Izin) in place of a standard certificate, a tourism business standard certificate from an LSPr and an SLS |
| Health and wellness | Traditional health services (86992) | Medium-high | Registration of each traditional health practitioner, service reports, and herbal products that have a distribution permit |
| Sport and fitness | Fitness centre (93116) | Medium-low; closed to new PT PMA applications in Bali | An SLS, a self-assessment of readiness to apply the fitness centre standard and, for a PT PMA only, a tourism business standard certificate from an LSPr |
| Tourism and travel | Travel agency (79121) | Medium-high | A tourism business standard certificate from an LSPr |
| Retail and trade | Clothing retail (47711) | Low; closed to new PT PMA applications in Bali | No standard certificate, and activity reports to the Minister of Trade |
| Technology and digital | Computer programming (62199) | Medium-high | Industry data submitted every six months, documented data and electronic system security procedures, and competence training certificates for the staff who provide the service |
| Manufacturing | Garment manufacturing (14111) | Medium-high | An ISO 9001 quality management certificate, periodic calibration or independent laboratory testing records, documented safety and evacuation procedures, and industry data submitted every six months |
| Construction and building | Residential building construction (41011) | Medium-high | A valid Sertifikat Badan Usaha (SBU, construction business entity certificate), entered in OSS before verification, and an annual business activity report5 |
| Products under a mandatory Standar Nasional Indonesia (SNI, Indonesian National Standard) | Any code that makes or imports a covered product | Set by the code | A product certificate from an accredited product certification body (LSPro) before the product is sold8 |
| Every sector, except micro businesses | Every business activity and location | Every tier | A Laporan Kegiatan Penanaman Modal (LKPM, Investment Activity Report), quarterly for a medium or large business and six-monthly for a small business2 |
Most of these obligations follow the code and the business scale, for domestic and foreign-owned companies alike. OSS lists the restaurant’s tourism business standard certificate from small scale upward, for example. OSS can also list an obligation for a PT PMA alone. For a fitness centre, a PT PMA needs a tourism business standard certificate from an LSPr at every scale, and OSS lists no such certificate for a domestic company.14
Every code in this table rated low or medium-low is closed to new PT PMA applications at a Bali address. A PT PMA licensed on one of those codes before the closure keeps it and must still meet its standard. Some obligations attach to people. A real estate agency cannot obtain a verified certificate until a certified level 6 broker and a certified level 7 manager are on its staff, and each certified person may be registered with one agency only. The manager roles may be filled by a foreign national with the identity documents the immigration rules require.10 Where a verification relies on a sector certificate, that certificate has to be in place first. A construction company without an SBU, for example, cannot obtain a verified certificate.5
Which companies can register a code?
A domestic company can register any code open to domestic investment. A PT PMA can register a code only where the Positive Investment List opens it to foreign investment, under Presidential Regulation Number 10 of 2021 as amended by Presidential Regulation Number 49 of 2021.6 The minimum investment for a PT PMA is above IDR 10,000,000,000 (ten billion Indonesian Rupiah), excluding land and buildings, for each five-digit KBLI code at each project location, and Article 26 of Permen Investasi 5/2025 sets different rules for some activities, such as wholesale trade, food and beverage services, construction and property.2
What happens when an obligation is left unperformed?
Article 355 of PP 28/2025 allows sanctions from a warning through to suspension of business activity and revocation of the business licence, applied according to the level of compliance found at supervision.1 OSS also revokes an unverified certificate in the situations set out in Articles 192 to 199 of Permen Investasi 5/2025, including a rejected submission, and sector regulations add their own sanctions.23
What does this mean for a PT PMA in Bali?
Since the third week of May 2026, OSS has refused every new PT PMA application at a Bali address for an activity rated low or medium-low risk. The Governor of Bali requested the restriction by letter of 28 January 2026 and named 18 KBLI codes when announcing it in July 2026. ANTARA reported that the closure covers every code rated low or medium-low, and our testing in OSS confirms it.111213 An existing PT PMA keeps its licence on a closed code and must still meet the standard. It cannot add a closed code to its NIB or obtain one for a new business location. After a licence on a closed code is revoked, the company cannot apply for that code again at a Bali address. Where conversion to KBLI 2025 moved a closed code to medium-high risk, the medium-high rules apply, including verification and the sector certificates for that tier. Domestic companies in Bali are licensed under the general tiers above.
How does TraceWorthy find and close the gaps?
We offer this work as two services, the Business Health Check and the Standard Certificate Obligation Register.
The Business Health Check
A Business Health Check reviews a company across each area of compliance relevant to its business. With the company’s authority, our team reviews its records in each government portal that applies to it, such as OSS, the national and regional tax systems, the BPJS social security systems, the manpower reporting system and the expatriate employment system, together with its corporate documents and accounting records. For licensing, we read every KBLI code registered in OSS against PP 28/2025 and the sector regulation that sets its standard. We record the risk tier and scope of each code, the status of each certificate, any verification deemed under Article 225, and each code converted to KBLI 2025 under Statistics Indonesia Regulation Number 7 of 2025.9 The company receives a report of each finding and the order in which to remediate it.
The Standard Certificate Obligation Register
The Standard Certificate Obligation Register lists each obligation attached to each of the company’s KBLI codes, the body responsible for issuing or receiving it, the date by which it must be met and the person in the company responsible for it. Where the register shows an open obligation, we remediate it with the company. Our work includes the following:
- preparing the fulfilment submissions in OSS and responding to each correction request within its period;
- facilitating each application to the issuing body named in the sector regulation, such as the regency or city government for an SLHS or an LSPr for a tourism business standard certificate;
- setting out the steps to regularise the licence where a company is already operating on an unverified certificate;
- assembling the evidence for each declared standard before supervision, and scheduling each renewal and report so that the obligations remain met.
Our team includes qualified and experienced lawyers, accountants, tax specialists, compliance experts and immigration specialists, alongside the community, business and people development skills and qualifications that Tracy Wilkinson brings herself. To have every obligation attached to your company’s KBLI codes identified, and any gap remediated, book a Business Health Check or ask our team to build your company’s Standard Certificate Obligation Register.
This article is general information and is current as at 9 November 2026. Sector standards are set by each ministry and change by regulation, and the obligations of any company depend on its own KBLI codes, risk tier, licensing dates and business location. It is no substitute for advice on a company’s own position, and it creates no advisory relationship.
Frequently asked questions
PP 28/2025 applies to every company licensed through OSS. A domestic PT and a PT PMA with the same code and business scale generally have the same obligations, and OSS lists some obligations for a PT PMA alone, such as the tourism business standard certificate for a fitness centre. Every PT PMA is a large business, so its obligations are those OSS lists for that scale. The Bali closure of low and medium-low codes applies to new PT PMA applications.
A low-risk activity is licensed by the NIB alone and has no standard certificate (Article 130 of PP 28/2025). Other obligations can still apply. OSS lists activity reports to the Minister of Trade for clothing retail, for example, and every business except a micro business submits the LKPM for each activity and location.
For a medium-high risk activity, an unverified certificate permits preparation only, such as acquiring land, construction, buying equipment and recruiting staff. Taking bookings, serving customers, issuing invoices or selling products before verification is outside the licence, and PP 28/2025 allows sanctions up to revocation of the business licence.
A high-risk activity needs the NIB and a permit (Izin), and no standard certificate (Articles 133 and 218 of PP 28/2025). Where the activity must also meet a business or product standard, the company applies for a supporting business licence (PB UMKU) under Article 231.
OSS has applied KBLI 2025 since 15 June 2026, and a converted code can show a different risk tier and different obligations from the code it replaced. Where a code moved to medium-high risk, the company needs a verified certificate and the sector certificates for that tier. Our team confirms each converted code and its certificate in OSS during a Business Health Check.
Since the third week of May 2026, OSS has refused new PT PMA applications at a Bali address for every low and medium-low risk code. An existing PT PMA keeps a code licensed before the closure and must still meet its standard. It cannot add a closed code to its NIB or obtain one for a new business location. Domestic companies in Bali are outside the closure.
A company can start in OSS by listing each registered KBLI code and its business scale, checking whether each certificate shows as verified, opening the obligations OSS lists for that tier, and comparing them with the certificates and reports it has. A Business Health Check performs that review in full, with the sector regulation for each code, and the Standard Certificate Obligation Register records the result.
The Business Health Check covers the company across each relevant area of compliance and each government portal it uses, and reports each finding with the order in which to remediate it. The Standard Certificate Obligation Register lists every obligation attached to the company’s KBLI codes, with the issuing body and deadline for each one, and the person in the company responsible for it. We use the register to remediate each open obligation and to schedule each renewal and report.
Legal References
1. Government Regulation Number 28 of 2025 on the Implementation of Risk-Based Business Licensing (Peraturan Pemerintah Nomor 28 Tahun 2025 tentang Penyelenggaraan Perizinan Berusaha Berbasis Risiko), in force 5 June 2025. Articles 1(26), 11(5), 130 to 133, 222, 225, 227 to 231 and 355.
2. Minister of Investment and Downstream Industry/Head of BKPM Regulation Number 5 of 2025 on Guidelines and Procedures for Risk-Based Business Licensing and Investment Facilities through OSS (Peraturan Menteri Investasi dan Hilirisasi/Kepala Badan Koordinasi Penanaman Modal Nomor 5 Tahun 2025). Articles 25, 26, 189 to 199, 285 and 286. All periods in Hari are working days under PP 28/2025 Article 1(26).
3. Minister of Tourism Regulation Number 6 of 2025 on Business Activity Standards, Supervision Procedures and Administrative Sanctions in Risk-Based Business Licensing in the Tourism Sector (Peraturan Menteri Pariwisata Nomor 6 Tahun 2025), enacted and in force 10 October 2025. Articles 1(17), 5, 12 and 16, and Lampiran I.
4. Minister of Health Regulation Number 11 of 2025 on Business Activity Standards and Product or Service Standards in Risk-Based Business Licensing in the Health Subsector (Peraturan Menteri Kesehatan Nomor 11 Tahun 2025), enacted 3 October 2025. Articles 4, 39 and 40, and the Lampiran standards for the SLHS and the SLS.
5. Minister of Public Works Regulation Number 6 of 2025 on Business Activity Standards and Product or Service Standards, Supervision and Sanctions in Risk-Based Business Licensing in the Public Works Sector (Peraturan Menteri Pekerjaan Umum Nomor 6 Tahun 2025), enacted 22 December 2025, promulgated and in force 30 December 2025, State Gazette 2025 Number 1142. Articles 20, 21, 24 and 25, and the Lampiran I provisions on verification.
6. Presidential Regulation Number 10 of 2021 on Investment Business Fields, as amended by Presidential Regulation Number 49 of 2021 (Peraturan Presiden Nomor 10 Tahun 2021 tentang Bidang Usaha Penanaman Modal), the Positive Investment List.
7. Minister of Education, Culture, Research and Technology Regulation Number 16 of 2023 on Norms, Standards, Procedures and Criteria for Business Licensing in Book Publishing (Peraturan Menteri Pendidikan, Kebudayaan, Riset, dan Teknologi Nomor 16 Tahun 2023), copy of the ministry’s legal database text hosted by the Indonesian Publishers Association. Lampiran II and III.
8. Law Number 20 of 2014 on Standardisation and Conformity Assessment (Undang-Undang Nomor 20 Tahun 2014 tentang Standardisasi dan Penilaian Kesesuaian).
9. Statistics Indonesia Regulation Number 7 of 2025 on the Indonesian Standard Industrial Classification (Peraturan Badan Pusat Statistik Nomor 7 Tahun 2025), text as reproduced by DDTC.
10. Minister of Trade Regulation Number 33 of 2025 on Business Activity Standards and Product or Service Standards in Risk-Based Business Licensing in the Trade and Legal Metrology Sectors (Peraturan Menteri Perdagangan Nomor 33 Tahun 2025), enacted 3 October 2025, in force 5 October 2025. Lampiran, standard for property brokerage services (Jasa Perantaraan Perdagangan Properti).
Research and Data Sources
11. Kompas, Bali closes 18 business fields to new foreign investment licences, 23 July 2026.
12. ANTARA Bali, 18 business fields closed to foreign investment in Bali, 23 July 2026. The report states that the closure covers KBLI codes in the low and medium-low risk categories from the third week of May 2026.
13. Governor of Bali, letter B.27.000/642/PM/DPMPTSP to the Minister of Investment and Downstream Industry, 28 January 2026, on the public record.
14. OSS, KBLI 2025 business licensing data for KBLI 10761, 14111, 41011, 47711, 55203, 56101, 62199, 68210, 68292, 79121, 86992, 93116 and 96230, risk tiers and obligations by business scale, viewed 9 and 10 November 2026.
Glossary
| Indonesian term | Abbreviation | English meaning |
|---|---|---|
| Nomor Induk Berusaha | NIB | Business Identification Number issued through OSS |
| Sertifikat Standar | None | Standard Certificate; self-declared at medium-low risk; unverified, then verified, at medium-high risk |
| Perseroan Terbatas | PT | Limited liability company |
| Perseroan Terbatas Penanaman Modal Asing | PT PMA | Foreign-owned limited liability company |
| Klasifikasi Baku Lapangan Usaha Indonesia | KBLI | Indonesian Standard Industrial Classification |
| Izin | None | Permit issued after the authority’s assessment, for a high risk activity |
| Lembaga Sertifikasi Produk | LSPr; LSPro in the industry and trade sectors | Product certification body |
| Sertifikat Laik Higiene Sanitasi | SLHS | Hygiene and sanitation certificate for food businesses |
| Sertifikat Laik Sehat | SLS | Health worthiness certificate for accommodation and similar premises |
| Sertifikat Badan Usaha | SBU | Construction business entity certificate |
| Standar Nasional Indonesia | SNI | Indonesian National Standard |
| Laporan Kegiatan Penanaman Modal | LKPM | Investment Activity Report submitted through OSS |
| Rencana Penggunaan Tenaga Kerja Asing | RPTKA | Expatriate utilisation plan |
| Daya paksa polisional | None | Administrative coercive measures that an authority may apply to enforce compliance |
| Hari | None | Day; a working day under PP 28/2025 Article 1(26) |