Indonesia does not require every business to obtain the same licence. Under OSS RBA, the licensing pathway becomes progressively more demanding as the regulatory risk of the business activity increases.
The current framework is PP No. 28 of 2025, which JDIH BPK lists as in force from 5 June 2025 and as revoking PP No. 5 of 2021.
Business Licensing Risk Levels Indonesia: The Short Answer
For business licensing risk levels Indonesia, the practical OSS structure is:
| Risk level | Core licensing result | Main operational question |
|---|---|---|
| Low | NIB | Is the NIB issued and are other applicable obligations satisfied? |
| Medium-low | NIB + Standard Certificate | Has the required self-declaration and applicable standard been completed? |
| Medium-high | NIB + verified Standard Certificate | Has the Standard Certificate reached the required verified status? |
| High | NIB + Permit | Has the required Permit actually been issued? |
The level is attached to the business activity under the regulatory framework. A company should therefore read the risk level and licensing status generated for its own activity and project rather than copy another company’s NIB or licence package.
How Indonesia Determines a Business Risk Level
Risk level is not simply a judgment that a business sounds dangerous.
The government uses that analysis to determine the type of Business Licensing attached to the activity.
Risk Is Based on Hazard and Probability
The same official method states that risk level is calculated from the hazard value and the potential occurrence of that hazard, with the maximum-risk concept applied across the criteria used in the analysis.
The maximum-risk approach matters because one serious risk aspect cannot simply be averaged away by lower scores in other areas. A business with a significant safety, environmental, health, or resource-management risk can therefore face a more demanding licensing pathway.
Business Scale Can Matter
Annex III also states that the initial risk analysis considers whether the business is micro, small, medium, or large.
That means an owner should be careful with statements such as ‘this KBLI is always medium-low’ unless the current regulatory entry and project facts support that conclusion. Check the actual activity, business scale, location, and current OSS result.
Low Risk: NIB
Low-risk activity has the simplest core licensing pathway.
For low-risk activity, Annex III states that the business registers through OSS to obtain an NIB.
This does not mean a low-risk business can ignore every other legal requirement. The company still needs to comply with requirements that independently apply to the business, its premises, products, employees, tax position, or other regulated activities.
The useful question is narrower: for the core risk-based Business Licensing of this activity, is NIB the required licence output?
Medium-Low Risk: NIB and Standard Certificate
Medium risk adds a Standard Certificate to the NIB.
For medium-risk activity, the same Annex states that the core Business Licensing consists of an NIB and a Standard Certificate.
Within the operational system, medium risk is divided into medium-low and medium-high. For medium-low activity, the Standard Certificate framework is based on the applicable declaration and standards identified through OSS.
The owner should therefore read the conditions and standards connected to the activity instead of treating issuance of a PDF as the end of compliance.
Medium-High Risk: Verified Standard Certificate
Medium-high activity requires more attention to certificate status.
This is why an owner should not stop after seeing the words ‘Standard Certificate’ in the account. Check whether the certificate is still awaiting verification or has reached the status required for the activity.
Lombok Legal ID’s guide to an unverified OSS Standard Certificate addresses that specific problem in more detail.
High Risk: NIB and Permit
High-risk activity moves to an approval-based Permit pathway.
For high-risk activity, Annex III provides for NIB and a Permit and notes that certain high-risk activities may also require a Standard Certificate.
An NIB alone should therefore not be treated as proof that a high-risk activity has completed its Business Licensing.
The relevant Permit status, technical requirements, basic requirements, and sector-specific conditions should be checked before operations begin. Lombok Legal ID’s high-risk OSS licensing guide provides the narrower follow-up checklist for this category.
What to Check in Your Own OSS Account
Before concluding that a business is ready to operate, verify the project rather than only the company name.
Check:
- the current KBLI and activity description
- the project or business location
- the business scale used by the system
- the displayed risk level
- whether the NIB has been issued
- whether a Standard Certificate is required
- whether that Standard Certificate requires verification and whether verification is complete
- whether a Permit is required and has been issued
- whether basic requirements such as spatial, environmental, or building-related requirements remain outstanding where applicable
- whether PB UMKU or sector-specific supporting approvals are required
A useful licensing review therefore asks more than ‘Do we have an NIB?’ It asks whether every licensing component generated for the actual project has reached the status required before operation.
What Happens When the Business Activity Changes?
Changing the company’s activity can change its licensing analysis.
Adding or replacing a KBLI should trigger a fresh check of risk level, business scale, location, standards, Permit requirements, and related obligations rather than assuming the old licensing result carries over automatically.
Lombok Legal ID’s business-activity change checklist covers that amendment process separately.
The same principle applies when a project changes substantially in scale or operating model: verify the current OSS result rather than relying on the licence profile prepared for the earlier version of the business.
Conclusion
Indonesia’s risk-based licensing system is designed so that regulatory control increases with the risk of the business activity.
Low-risk activity generally relies on NIB. Medium-risk activity adds a Standard Certificate, with medium-high activities requiring attention to verification status. High-risk activity requires an NIB and Permit, with additional Standard Certificate requirements possible for particular activities.
The practical compliance question is therefore not simply ‘What risk level is my KBLI?’ It is ‘What risk level and licensing status does OSS show for this actual activity, scale, location, and project—and have all required documents reached the status needed to operate?’
Check the Licensing Status Before Relying on the NIB
If your Lombok business has an unclear risk level, Standard Certificate status, Permit requirement, or OSS licensing result, Lombok Legal ID can assist with a consultation and business licensing review based on the company’s actual activities and project information.
A useful review starts with the current KBLI, location, business scale, risk level, and OSS status so any missing licensing or certification step can be identified before the business relies on incomplete documentation.
For help coordinating the documents and next steps discussed above, review our business setup in Lombok.
Read More: Company Setup Guide in Lombok: Entity Choice, OSS and Launch Planning
FAQ Business Licensing Risk Levels Indonesia
What are the four OSS business licensing risk levels in Indonesia?
The operational OSS framework distinguishes low, medium-low, medium-high, and high-risk business activities.
What licence is required for a low-risk business?
For the core risk-based Business Licensing, low-risk activity uses NIB. Other independent obligations can still apply depending on the business, premises, products, or sector.
What is required for a medium-low-risk business?
The core pathway uses NIB and a Standard Certificate. The business must still satisfy the standards and obligations applicable to its activity.
What is different about medium-high risk?
Medium-high activity also uses NIB and a Standard Certificate, but verification status is material. Current OSS guidance distinguishes medium-high activity by showing a verified Standard Certificate.
Is an unverified Standard Certificate enough to operate?
Do not assume so for a medium-high activity. Check the current OSS status and the verification requirements attached to that business activity before treating the licensing process as complete.
What does a high-risk business need?
The core framework requires NIB and a Permit. Certain high-risk activities can also require a Standard Certificate.
Who decides the risk level of a business?
The risk level is established through the government’s risk-analysis framework for the business activity. Owners should use the current OSS result rather than choosing a risk category themselves.
Can two businesses with similar activities have different licensing results?
Potentially. Risk analysis and licensing can depend on the actual activity, business scale, project details, location, and sector requirements. The live OSS result for the specific project should therefore be checked.
Can changing a KBLI change the risk level?
Yes, changing the business activity can change the licensing pathway. A new or amended activity should be checked again for its current risk level, Standard Certificate, Permit, and related requirements.
References & Sources
- Current Regulation on Risk-Based Business Licensing — peraturan.bpk.go.id
- Official Risk Analysis Method Under PP No. 28 of 2025 — peraturan.bpk.go.id
- Current OSS Risk-Based Business Licensing Portal — oss.go.id
- Current OSS Guidance Showing Medium-Low and Medium-High Licensing Outputs — s3.oss.go.id