Under the current OSS framework, the NIB is the Business Licensing document for a low-risk activity, while other risk tiers add a Standard Certificate or permit as set out in Regulation No. 5 of 2025. That makes the NIB the core PB for a genuinely low-risk activity, but it does not mean every compliance issue disappears once the NIB is issued.
Government Regulation No. 28 of 2025 is the current umbrella regulation for risk-based business licensing, and the BPK legal database records that it revoked Government Regulation No. 5 of 2021. The implementing procedure is now set out in Minister of Investment and Downstreaming/Head of BKPM Regulation No. 5 of 2025, which the ministry’s legal database lists as in force.
Low Risk OSS Indonesia: What NIB Actually Establishes
The core rule is straightforward: Article 186 of the official text of Regulation No. 5 of 2025 states that Business Licensing for a low-risk activity consists of the NIB, while medium-low risk requires an NIB plus an unverified Standard Certificate, medium-high risk requires an NIB plus a verified Standard Certificate, and high risk requires an NIB plus a permit.
Article 187 then provides that, after the applicable basic requirements have been fulfilled, a business operator applies for the NIB as the Business Licensing document for a low-risk activity through OSS under the same regulation. This is why it is accurate to describe the NIB as the core business licence for a genuinely low-risk OSS activity.
The rule goes further than simple registration: once OSS issues the NIB under Article 187, the business operator has legal basis to carry out preparation, operational, and/or commercial activity for that low-risk business activity as stated in the implementing regulation.
Which Obligations Still Apply to a Low-Risk Business?
The most important distinction for owners and investors is between the core risk-based licence and the rest of the project’s compliance stack. A low-risk classification simplifies the PB layer, but the regulation still ties issuance and operation to other requirements.
Basic requirements can still matter
Article 186 provides that Business Licensing is obtained after fulfillment of applicable basic requirements unless the governing framework provides otherwise in Regulation No. 5 of 2025. For a project in Lombok, this is the point at which location, spatial, environmental, building, or other basic-requirement questions should be checked rather than assuming the risk label resolves them automatically.
If the uncertainty is specifically about location or spatial conformity, the separate Lombok Legal ID guide on spatial conformity in OSS Indonesia is a more focused next read.
Low-risk filing still includes declarations and activity obligations
For a low-risk activity, Article 187 requires the operator to complete declarations covering K3L, SPPL, and the obligations applicable to the business activity through OSS before the system issues the low-risk licensing outputs. The same provision says OSS issues the NIB together with the relevant SPPL and declarations after those commitments are completed.
This matters because a low-risk NIB should not be read as permission to ignore the conditions attached to the activity. The official low-risk NIB format states that the NIB applies only to the listed KBLI code, title, scope, and business activity, and that the operator remains required to satisfy the relevant requirements or obligations shown in the regulation’s NIB format.
PB UMKU may still be a separate layer
Article 186 also states that where supporting legality is required at the operational or commercial stage, the business operator must hold the relevant PB UMKU under Regulation No. 5 of 2025. In other words, low risk can mean NIB is the core PB without making the NIB a universal substitute for every sector-specific supporting approval.
That distinction is especially important for investors reviewing a project by document count alone. The correct question is not merely whether an NIB exists, but whether the listed activity is genuinely low risk and whether OSS or the sector rules show any additional supporting legality or obligation.
How to Read a Low-Risk NIB Before Treating the Project as Ready
A useful review starts with the NIB attachment, not just the first page. The official low-risk NIB format lists the KBLI, activity scope, location, risk classification, licensing type, status, and notes for the covered business activity in the regulation’s prescribed NIB format.
For a Lombok project, check these items in sequence:
- Confirm that the KBLI and activity scope describe what the business will actually do.
- Confirm that the activity shown in OSS is classified as low risk rather than medium-low, medium-high, or high risk.
- Check that the NIB attachment shows the intended location and activity details correctly.
- Review the basic requirements and declarations attached to the project.
- Check whether a PB UMKU or other supporting legality is required for the operational or commercial stage.
- Keep the OSS data aligned with the real activity; if the business activity changes, review the separate guide on changing a business activity in OSS Indonesia rather than assuming the existing NIB covers the new scope.
The official OSS portal also maintains a dedicated Business Licensing Application guide for Low and Low Intermediate Risk, which is useful for checking the current system workflow against the regulatory framework.
Low Risk Is Different From Medium-Low Risk
The difference is not semantic. Under Article 186, low risk uses the NIB as the PB, whereas medium-low risk uses the NIB plus a Standard Certificate without verification under the current implementing regulation.
That boundary matters because an investor who sees a Standard Certificate in OSS is no longer looking at the pure low-risk licensing pattern. If OSS instead shows an unverified Standard Certificate in a situation that raises questions about operational readiness, the Lombok Legal ID article on unverified Standard Certificates in OSS addresses that issue directly.
A Practical Decision Test for Owners and Investors
Before treating an NIB as sufficient for a low-risk project, ask four questions.
First, is the exact activity in the NIB attachment classified as low risk? Second, have the applicable basic requirements been completed or otherwise dealt with through the OSS process? Third, do the activity obligations and declarations shown in OSS match how the business will operate? Fourth, does the project need any PB UMKU or other supporting legality at the operational or commercial stage?
If all four checks are answered from the actual OSS record and current sector requirements, the NIB can be understood in its correct role: the core PB for the low-risk activity, not a blanket waiver from all other compliance.
Conclusion
For low risk OSS Indonesia, the NIB is not merely a registration number: the current implementing regulation makes it the Business Licensing document for a low-risk activity and gives the holder legal basis for preparation, operational, and/or commercial activity for the covered low-risk activity.
The practical caution is equally important: the prescribed NIB format limits the document to the listed KBLI, title, scope, and activity, while the same regulation preserves applicable obligations and any required supporting PB UMKU within the OSS licensing framework. Owners and investors should therefore read the NIB together with its activity attachment and the project’s OSS obligations before treating a Lombok business as fully ready to operate.
Check Whether Your Lombok Project Is Truly NIB-Only
If you are planning or reviewing a Lombok project, Lombok Legal ID can help check the KBLI, risk classification, OSS outputs, and supporting requirements before you rely on the NIB as the only core licence.
For business setup and licensing support, request a consultation focused on the actual activity, location, and OSS record.
For help coordinating the documents and next steps discussed above, review our business setup in Lombok.
Read More: Company Setup Guide in Lombok: Entity Choice, OSS and Launch Planning
FAQ Low Risk OSS Indonesia
Is NIB enough for a low-risk business activity in Indonesia?
For a genuinely low-risk activity, NIB is the core Business Licensing document under the current OSS framework. Project readiness still requires checking the applicable basic requirements, activity obligations, and any supporting legality such as PB UMKU.
Does a low-risk business need a Standard Certificate?
The low-risk PB pattern is NIB. A Standard Certificate belongs to the medium-risk licensing structure, so seeing one in the OSS record is a reason to confirm the activity’s actual risk classification and status.
Can a low-risk activity still need PB UMKU?
Yes, where supporting legality is required for the operational or commercial stage. That is why NIB should be read as the core PB for the covered low-risk activity rather than as a universal substitute for every sector-specific approval.
What should an investor check on a low-risk NIB for a Lombok project?
Check the listed KBLI, activity scope, location, risk classification, licensing status, attached obligations, basic requirements, and whether any supporting PB UMKU or other legality appears in the OSS record.
References & Sources
- Government Regulation No. 28 of 2025 on Risk-Based Business Licensing — peraturan.bpk.go.id
- Minister of Investment and Downstreaming/Head of BKPM Regulation No. 5 of 2025 on OSS Risk-Based Licensing Procedures — jdih.bkpm.go.id
- Official Text of Minister of Investment and Downstreaming/Head of BKPM Regulation No. 5 of 2025 — jdih-storage.bkpm.go.id
- Business Licensing Application Guide for Low and Low Intermediate Risk — oss.go.id