High-risk OSS licensing requires more than obtaining an NIB. Under Indonesia’s current risk-based framework, the NIB can support the preparation stage of a high-risk activity, but the required Permit must be fulfilled before the activity moves into the operational or commercial stage.
The current framework is Government Regulation No. 28 of 2025, which took effect on 5 June 2025 and revoked Government Regulation No. 5 of 2021.
For the broader planning framework, read our Company Setup Guide in Lombok. For help with your project, see our Business Setup services.
High Risk OSS Licensing Indonesia: What Is Required?
For a high-risk activity, Article 133 of PP 28/2025 provides that principal Business Licensing consists of an NIB and a Permit.
That distinction should shape the entire readiness review. A high-risk project can have an NIB and still not have reached the stage required for commercial operation.
The current OSS portal maintains a dedicated application guide for medium-high and high-risk business licensing.
NIB Does Not Equal Commercial Readiness
An NIB is important, but for a high-risk activity it should not be treated as evidence that every licensing requirement has already been completed.
At the implementation stage, Article 227 requires a business actor to have an NIB issued through OSS before carrying out a high-risk business activity.
After the NIB is obtained, Article 227 requires the applicable Permit requirements to be fulfilled before operational or commercial activities are carried out.
For investors and project owners, the practical question is therefore not simply whether an NIB exists. The relevant question is whether the activity’s Permit requirements have been verified and whether the Permit required for operational or commercial activity has actually been issued.
How the High-Risk Permit Process Works
PP 28/2025 gives the high-risk Permit a verification-based path through OSS.
Step 1 — Obtain the NIB
The NIB comes first. It establishes the business actor in OSS and allows the high-risk project to move through its preparation stage while the separate Permit requirements are addressed.
For due diligence, record the exact business activity, KBLI, activity scope and location attached to the NIB rather than reviewing the NIB only at company level. A company can conduct multiple activities, and the high-risk Permit question belongs to the relevant activity.
Step 2 — Fulfill Permit Requirements
After obtaining the NIB, the business must meet the Permit requirements specified for the high-risk activity before beginning operational or commercial activities.
The business submits the Permit requirements through OSS, which forwards them to the competent ministry, agency, DPMPTSP or special-area authority for verification.
The exact technical requirements are activity-specific. They should therefore be read from the current OSS scope and the norms, standards, procedures and criteria governing the relevant sector rather than copied from another high-risk project.
Step 3 — Authority Verification
The competent authority reviews whether the submitted requirements have been fulfilled. Article 227 provides for verification according to the authority of the relevant ministry, agency, provincial or regency/city apparatus, KEK administrator or KPBPB authority where applicable.
This verification stage is a key readiness checkpoint. A submitted application is not the same thing as an issued Permit.
Step 4 — Permit Issuance
If verification determines that the requirements have been fulfilled, Article 228 provides that OSS issues the Permit to the business actor.
If the verification result finds the requirements incomplete, Article 229 requires OSS to notify the business actor to complete the outstanding Permit requirements.
For an acquisition or project launch, distinguish at least three statuses: the NIB has been issued, Permit requirements have been submitted, and the Permit itself has been issued. Only reviewing the first two can produce a false impression of commercial readiness.
When Amdal Becomes Part of the Permit File
Environmental requirements should be checked against the actual activity rather than assumed from the word “high risk.”
Where the high-risk activity is subject to Amdal, Article 227 expressly includes Amdal within the Permit requirements.
The rule is conditional: it does not mean every high-risk project automatically requires Amdal. It means that where the activity is legally required to have Amdal, fulfillment of that requirement forms part of the high-risk Permit process.
A project-readiness review should therefore check the environmental path together with the Permit rather than treating environmental approval and OSS licensing as unrelated files.
Check PB UMKU Separately
Even an issued principal Permit may not be the last licensing item relevant to the project.
A Permit may also not be the final item in the file because Article 231 requires a PB UMKU application where the high-risk activity requires fulfillment of business-activity standards and/or product or service standards.
PB UMKU should therefore be reviewed separately from the NIB and principal Permit. A project may have its main high-risk Permit while still needing supporting legalities connected to particular products, facilities, standards or commercial functions.
The detailed OSS procedure is governed by Minister of Investment and Hilirisasi/BKPM Regulation No. 5 of 2025, which is currently in force and implements the PP 28/2025 framework through the OSS system.
High-Risk Permit Readiness Checks for Investors
A useful review begins with the activity, not the company name.
First, confirm the current KBLI and scope in OSS and verify that the project being reviewed is actually classified as high risk. Second, confirm that the NIB covers the correct activity and location. Third, identify every Permit requirement shown for that scope and determine whether each requirement has been submitted and verified.
Next, check whether the Permit itself has been issued. Do not rely only on a screenshot showing an application number or an NIB. If Amdal applies to the activity, reconcile its status with the Permit file. Then review the PB UMKU section to identify any supporting licenses or standards that remain relevant to operations.
For an existing project, compare the OSS documents with what the business actually does on site. Expansion, changes in production, additional services or a new location can make old licensing records an incomplete picture of the current operation.
For an acquisition, preserve current OSS evidence showing the activity, risk level, NIB, Permit status and relevant supporting legalities. This makes it easier to distinguish a project that is fully ready for commercial operation from one that is still completing its licensing path.
Common Readiness Mistakes
The first mistake is treating the NIB as the final high-risk operating license. Under PP 28/2025, the high-risk principal licensing package is NIB plus Permit.
The second is treating an application as an issued Permit. The Article 227 process contains a substantive verification stage before the normal issuance path in Article 228.
The third is assuming every high-risk project needs the same requirements. Permit requirements depend on the activity and applicable sector rules.
The fourth is overlooking environmental or supporting approvals. Amdal enters the Permit requirements where legally required, while PB UMKU can apply where business-activity or product/service standards require supporting licensing.
The fifth is reviewing licensing only at company level. A company can have several activities, and the readiness of one activity does not automatically establish the readiness of another.
Businesses that need implementation support after identifying the applicable high-risk route can use the verified NIB OSS RBA Registration service for the practical OSS filing process.
Conclusion
High-risk OSS licensing in Indonesia is a readiness sequence, not simply an NIB registration exercise. The NIB supports the high-risk activity’s preparation stage, while Permit requirements must be fulfilled and the Permit issued before the project relies on the principal licensing basis for operational or commercial activity.
Before launch, investment or acquisition, review the exact high-risk activity, NIB, Permit requirements, verification result, issued Permit, Amdal where applicable and any relevant PB UMKU. That activity-level review is more reliable than assuming that the existence of an OSS account or NIB proves the project is commercially ready.
Check Permit Readiness Before a High-Risk Project Operates
If you are setting up, acquiring or expanding a high-risk business activity in Lombok, Lombok Legal ID can be consulted to review how the activity fits into the current OSS licensing framework.
For practical registration and filing support, the verified NIB OSS RBA Registration service can assist with the OSS process after the relevant activity and licensing route have been identified.
FAQ – High Risk OSS Licensing Indonesia
What does a high-risk business require under PP 28/2025?
The principal Business Licensing structure for a high-risk activity consists of an NIB and a Permit.
Can a high-risk business operate with only an NIB?
The NIB can support preparation, but the applicable Permit requirements must be fulfilled and the Permit obtained for the principal licensing basis required for operational or commercial activity.
Does receiving an NIB mean the high-risk Permit has been approved?
No. The NIB and Permit are separate elements of the high-risk licensing structure, and the Permit follows its own requirements and verification process.
Does every high-risk project need Amdal?
No. PP 28/2025 states that Permit requirements include Amdal for activities that are legally required to have Amdal. The environmental requirement must therefore be checked against the specific activity.
What happens if the Permit requirements are incomplete?
Article 229 provides that OSS notifies the business actor to complete the outstanding Permit requirements when verification finds that they have not been fulfilled.
Can PB UMKU still apply after a high-risk Permit?
Yes. Article 231 requires a PB UMKU application where the high-risk activity requires fulfillment of applicable business-activity standards or product/service standards.
References & Sources
- Government Regulation No. 28 of 2025 — Risk-Based Business Licensing — peraturan.bpk.go.id
- Government Regulation No. 28 of 2025 — BKPM-Hosted Unofficial English Translation — jdih-storage.bkpm.go.id
- OSS Guide — Medium-High and High-Risk Business Licensing — oss.go.id
- Minister of Investment/BKPM Regulation No. 5 of 2025 — OSS Risk-Based Licensing Procedures — peraturan.bpk.go.id