A medium-high-risk business in OSS generally needs more than an NIB and a self-declared Standard Certificate before it can operate commercially. The defining step is verification of the Standard Certificate and the underlying business standards.
The current overarching framework is Government Regulation No. 28 of 2025, which has been in force since 5 June 2025 and replaced Government Regulation No. 5 of 2021.
The current implementing regulation is Minister of Investment and Hilirisasi/BKPM Regulation No. 5 of 2025, which the issuing authority lists as in force and effective from its promulgation on 2 October 2025.
For the broader planning framework, read our Company Setup Guide in Lombok. For help with your project, see our Business Setup services.
Medium-High Risk License OSS: What Does It Require?
For medium-high risk license oss, the core licensing output is NIB plus a Standard Certificate that must reach verified status for the business to rely on it for operational or commercial activity.
Under Article 186, low-risk Business Licensing consists of NIB, medium-low risk consists of NIB and a Standard Certificate without verification, medium-high risk consists of NIB and a Standard Certificate with verification, and high risk consists of NIB and an Izin.
This means that identifying the correct risk classification is not a cosmetic OSS label. It determines what licensing evidence must exist before the activity is treated as operationally ready.
Medium-High Risk Is Different From Medium-Low and High Risk
Medium-high risk sits between two different licensing models.
A medium-low-risk activity uses NIB plus a Standard Certificate without verification. A medium-high-risk activity also uses NIB and a Standard Certificate, but verification is the key additional step. A high-risk activity instead follows the NIB plus Izin pathway.
This distinction matters because owners sometimes see the words “Standard Certificate” in OSS and assume the document has the same legal effect regardless of status. For medium-high risk, the verification status changes what the document can actually support.
Readers dealing specifically with high-risk activities should use Lombok Legal ID’s High Risk OSS Licensing Indonesia guide rather than applying the medium-high-risk Standard Certificate pathway to an activity that requires an Izin.
What OSS Issues Before Verification
For a medium-high-risk activity, Article 189 requires the business actor that has completed the applicable Basic Requirements to apply for NIB and a Standard Certificate as the Business Licensing.
After the required declarations are submitted, Article 189 provides that OSS issues the NIB and a Standard Certificate marked as not yet verified.
That unverified status is the important checkpoint. The business has entered the licensing pathway, but it has not yet reached the same operational position as a business holding the verified certificate.
Preparation Is Allowed
The initial medium-high-risk licensing output can support preparation of the business.
Preparation can include work needed to make the project ready for the later operational stage, subject to the applicable project and sector requirements. Owners should therefore use this period to complete the business standards and evidence required for verification rather than treating the first OSS output as the end of the process.
Where location readiness is still unresolved, Lombok Legal ID’s Spatial Conformity OSS Indonesia guide addresses the separate Basic Requirement question of whether the activity fits the project location.
Commercial Operation Is Not Yet Allowed
This is the compliance line that owners should monitor before opening, producing commercially, serving customers under the regulated activity or otherwise relying on the license as operational.
A screenshot, PDF or OSS dashboard entry showing an unverified Standard Certificate should therefore not be treated as equivalent to the final verified licensing position.
How the Standard Certificate Becomes Verified
Verification begins with fulfilment of the standards attached to the activity.
Under Article 190, a business holding an unverified Standard Certificate must submit fulfilment of the applicable business standards through OSS.
Article 190 further provides that OSS sends notifications concerning fulfilment of the business standards when the unverified Standard Certificate is issued, 30 days after issuance, and/or 60 days before the estimated start of operational or commercial activity.
The evidence and technical checks depend on the business activity and the standards assigned to it. The practical task is therefore to read the requirements for the exact KBLI and project rather than rely on a generic list used by another business.
Submit Fulfilment of Business Standards Through OSS
Start by opening the medium-high-risk activity in OSS and checking which standards, supporting documents and obligations are attached to that activity.
Match each requirement to actual project evidence. If the standard relates to premises, equipment, personnel, technical competency, production process or another sector-specific element, the documents should correspond to the real operating setup.
Do not submit an evidence package designed only to complete the online field. Verification is intended to establish whether the business has fulfilled the standards tied to that activity.
The current OSS portal also maintains a dedicated medium-high- and high-risk Business Licensing application guide, confirming that these higher-risk workflows are handled separately from low- and medium-low-risk applications.
Verified Status Unlocks Operational Legality
Following approval of the verification process, the regulation provides that OSS issues a Standard Certificate marked as verified, which constitutes legality for operational or commercial activity.
That is the status investors and business owners should verify before relying on the medium-high-risk license as commercially operational.
The verification result should also be checked against the same activity, location and project scope being operated. A verified certificate for one activity should not automatically be assumed to cover another KBLI or materially different project.
Medium-High Risk Readiness Checklist
First, confirm the correct KBLI and risk level. Do not start from a licensing template used by another business.
Second, check whether the applicable Basic Requirements have been completed. Spatial, environmental, building or other project requirements may need to be addressed before the Business Licensing process is treated as ready.
Third, confirm what OSS has actually issued. Distinguish the NIB from the Standard Certificate and check whether the certificate is marked as not yet verified or verified.
Fourth, map every standard and obligation attached to the activity. Identify which documents, technical evidence and project conditions still need to be completed.
Fifth, submit fulfilment through OSS and track the verification process. Do not schedule the regulated commercial launch on the assumption that the unverified certificate will automatically have the same legal effect as the verified one.
Sixth, once verification is completed, check the final certificate and activity record. Make sure the verified output corresponds to the correct KBLI, project location and operating scope.
For medium-scale industrial businesses, the supplied Medium Industry License service is a relevant industry-specific next step where the business also needs industrial licensing support.
Common Medium-High Risk Lincense OSS Mistakes
The first mistake is treating NIB issuance as the end of the licensing process.
The second is treating an unverified Standard Certificate as if it authorizes normal operational or commercial activity.
The third is confusing medium-high risk with high risk and looking for an Izin when the activity’s principal pathway is NIB plus a verified Standard Certificate.
The fourth is preparing generic documents without checking the exact standards attached to the activity.
The fifth is ignoring Basic Requirements or project-location issues while focusing only on the Standard Certificate.
The sixth is failing to re-check the final verification status before commercial launch.
Conclusion
The central feature of medium-high-risk licensing in OSS is verification. The activity uses NIB plus a Standard Certificate, but the initial certificate is marked as not yet verified and provides only limited legality for preparation.
Before operational or commercial activity begins, the business should complete the applicable standards through OSS and confirm that the Standard Certificate has reached verified status. That distinction is what separates an OSS file that has started the medium-high-risk licensing process from one that is ready to support the regulated business operation.
Verify the Standard Certificate Before Commercial Operations
If your business in Lombok is classified as medium-high risk, Lombok Legal ID can be consulted to review the activity’s Basic Requirements, OSS status and Standard Certificate verification pathway.
For medium-scale industrial activities, the verified Medium Industry License service can be reviewed as the relevant industry-specific licensing support.
FAQ Medium-High Risk License OSS
What license does a medium-high-risk business need in OSS?
The current framework uses NIB plus a Standard Certificate with verification for medium-high-risk activities.
Can a business operate with an unverified Standard Certificate?
The current implementing regulation states that NIB plus a Standard Certificate marked as not yet verified only provides limited legality for business preparation and cannot be used for operational or commercial activity.
What is the difference between medium-low and medium-high risk?
Both use NIB and a Standard Certificate, but medium-low risk uses the certificate without verification, while medium-high risk requires verification.
Is medium-high risk the same as high risk?
No. Medium-high risk uses NIB plus a verified Standard Certificate. High risk uses NIB plus an Izin under the current general licensing structure.
How does the Standard Certificate become verified?
The business submits fulfilment of the applicable business standards through OSS, after which the competent verification and approval process is completed for the activity.
Should verification be checked before opening the business?
Yes. For a medium-high-risk activity, the verified Standard Certificate is the key status to confirm before relying on the Business Licensing for operational or commercial activity.
References & Sources
- Government Regulation No. 28 of 2025 — Risk-Based Business Licensing — peraturan.bpk.go.id
- Minister of Investment/BKPM Regulation No. 5 of 2025 — Official Legal Record — jdih.bkpm.go.id
- Minister of Investment/BKPM Regulation No. 5 of 2025 — Official Regulation PDF — jdih-storage.bkpm.go.id
- OSS Guide — Medium-High and High-Risk Business Licensing Application — oss.go.id
- OSS Risk-Based Business Licensing Portal — oss.go.id
Recommended Next Articles
- high-risk OSS licensing requirements — lomboklegalid.com
- spatial conformity and Basic Requirements — lomboklegalid.com