For many foreign investors, the journey into the Indonesian market begins with a burst of optimism and a quick registration on the OSS system. You input your data, receive your NIB (Business Identification Number), and assume you are fully greenlit to open your doors. This “NIB-only” mindset is the most common and dangerous misconception in the current regulatory landscape. While the NIB is indeed your foundational identity, treating it as your only permit is a fast track to administrative sanctions.
In 2026, the reality of the Risk-Based Licensing (OSS-RBA) system under Government Regulation (PP) 28/2025 is that permission to operate is tiered. A simple NIB might suffice for a digital consultant, but it is legally insufficient for a restaurant, a construction firm, or a wellness center. Operating a medium or high-risk business with only a low-risk registration is akin to driving a truck with a motorcycle license—you may get away with it briefly, but the first checkpoint will lead to immediate impoundment.
This guide clarifies the often-confusing architecture of business licenses in the archipelago. We will distinguish between the NIB, the Standard Certificate (Sertifikat Standar), and the full Business License (Izin), helping you identify exactly what your PT PMA needs based on its activities. By understanding this multi-layered framework, you can move beyond “paper compliance” to secure the robust, verifiable approvals required for long-term success in Bali.
Table of Contents
- Licensing Architecture 2026: NIB vs "Other Licenses"
- When NIB is Enough and When You Need More
- Practical Inclusions: How to Obtain Other Licenses
- Sectoral and Special Licenses Beyond OSS
- Real Story: The "Soft Opening" Trap in Uluwatu
- Fees, Timelines, and "Deemed Approval"
- Key Risks and Common Compliance Mistakes
- 2026 "Not Confirmed" Areas to Watch
- FAQ's about Additional Business Permits
Licensing Architecture 2026: NIB vs "Other Licenses"
The regulatory backbone for business licenses in 2026 is defined by the OSS-RBA framework, now governed by the updated Government Regulation (PP) 28/2025. This system moved Indonesia away from a “one-size-fits-all” approach to a risk-based model. Under this architecture, the NIB is the universal starting point—every single business entity, from a solo entrepreneur to a multinational PT PMA, must have one. It serves as your identity, import API, and customs access.
However, the NIB is often just the container, not the content. The actual authority to conduct commercial activities depends on the specific “Risk Level” of your Standard Industrial Classification (KBLI) code. The system classifies activities into four tiers: Low, Medium-Low, Medium-High, and High. While Low risk requires nothing more than an NIB, the other three tiers trigger mandatory requirements for additional business licenses in the form of Standard Certificates or full Permits (Izin).
When NIB is Enough and When You Need More
Determining when you need extra permissions requires a close look at your KBLI.
- NIB Alone Suffices (Low Risk): If you are running a management consultancy, a software development house, or a call center, your activity is typically classified as “Low Risk.” In this scenario, the NIB doubles as your operational license. You can legally invoice clients and run operations immediately upon issuance.
- Standard Certificate Mandatory (Medium Risk): For “Medium-Low” risk (e.g., small workshops, some trading), you need a Self-Declared Standard Certificate. For “Medium-High” risk (e.g., construction, most hospitality), you need a Verified Standard Certificate. Operating without this verification means your business licenses are incomplete, and your operations are technically illegal.
- Full License Required (High Risk): For sectors with significant impact (e.g., heavy manufacturing, medical clinics), an NIB allows only preparation. You cannot generate revenue until a full Business License (Izin) is approved by the relevant ministry.
Practical Inclusions: How to Obtain Other Licenses
Obtaining these additional business licenses is a sequential process within the OSS dashboard.
- Identify Risk: Check the official OSS risk table for your specific KBLI.
- Self-Declaration (Medium-Low): You simply tick a compliance statement in the OSS, confirming you meet safety and environmental standards (SPPL). The system then auto-generates your Standard Certificate.
- Verification Request (Medium-High): You must upload evidence—such as your building approval (PBG) and functionality certificate (SLF). or environmental plan (UKL-UPL). The system routes this to the local technical agency (Dinas). They may conduct a site visit. Only after they click “Verify” in the system does your certificate become valid.
- Full License Application (High): You submit a comprehensive dossier. This often involves presenting your case to regional or central government panels.
Sectoral and Special Licenses Beyond OSS
Even with a “Verified” status in OSS, many industries have a layer of “Sectoral” business licenses that sit on top. These are specific operational permits required by technical ministries.
- Tourism & F&B: A restaurant needs more than just a verified OSS certificate; it may need a Hygiene/Sanitation Certificate (SLHS) and a specific Alcohol License (SKPL) if serving drinks.
- Health & Beauty: A wellness clinic needs specific permits from the Ministry of Health for its medical equipment and staff.
- Construction: Beyond the SBU (Business Entity Certificate), specific projects require checking zoning (KKPR) and obtaining the PBG building permit. These sectoral business licenses often involve separate portals or offline inspections, meaning the OSS is the hub, but not always the only stop.
Real Story: The "Soft Opening" Trap in Uluwatu
Meet Marco, a 34-year-old restaurateur from Italy. In January 2026, Marco leased a stunning cliffside venue in Uluwatu to open “Tramonto,” a high-end Mediterranean gastro-bar. He registered his PT PMA, obtained his NIB, and saw the status “Active.” Assuming he was clear, he launched a “soft opening” to capture the sunset crowd.
Three weeks later, Satpol PP (Public Order Enforcers) arrived. They asked for his Sertifikat Standar Verifikasi for the bar and kitchen. Marco presented his NIB. The officers explained that “Restaurant” is a Medium-High risk activity requiring site verification, not just registration. His NIB allowed him to build the restaurant, not to cook in it. He was forced to close immediately during peak hour, facing a potential seal on his premises.
Desperate to reopen, Marco contacted a trusted tax management company that also handled compliance audits. They rushed to upload his hygiene documents and coordinated with the Badung Tourism Office to expedite the verification visit. It took 14 days of lost revenue to turn his “Unverified” status to “Verified.” “I thought the NIB was the license,” Marco admitted. “In Italy, we have bureaucracy, but here, the computer system is stricter than the people.”
Fees, Timelines, and "Deemed Approval"
The OSS platform itself does not charge for issuing business licenses or Standard Certificates. Costs typically arise from the underlying technical requirements—such as hiring consultants for environmental documents (AMDAL/UKL-UPL) or paying regional levies for building permits (PBG).
Timelines vary by risk. Low-risk NIBs are instant. Medium-High verifications technically have Service Level Agreements (SLAs)—often 5 to 14 working days depending on the sector. Under PP 28/2025, a new “Deemed Approval” (or fictitious positive) mechanism exists: if an agency fails to verify or reject within the SLA, the system is supposed to auto-approve the license. However, in practice, relying on this automation is risky. Proactive follow-up with the local agency is usually necessary to secure the final “Verified” stamp.
Key Risks and Common Compliance Mistakes
The most frequent error foreign investors make is the “NIB is enough” assumption. Operating a Medium-High risk business (like a villa or spa) with only an unverified NIB is legally equivalent to operating without a license. This leaves you vulnerable to administrative sanctions, including temporary suspension of activities or revocation of the NIB entirely.
Another risk is KBLI mismatch. Investors often choose a Low-Risk KBLI (like “Management Consulting”) to get an instant NIB, while actually running a High-Risk activity (like “Construction”). This discrepancy is easily flagged during tax audits or immigration checks. Authorities are increasingly cross-referencing business licenses with actual on-ground activities. If your license says “Office” but your premise is a “Factory,” you face immediate closure risk.
2026 "Not Confirmed" Areas to Watch
While the regulations are clearer, implementation varies. The exact SLA duration for “Deemed Approval” differs across regions and sectors; while the central rule exists, local technical offices in Bali may have different processing speeds due to volume. This timeline is often “Not confirmed” until you submit.
Additionally, the classification of certain “grey area” activities—such as specific types of digital nomad hubs or co-living spaces—can fluctuate between commercial rental (Medium Risk) and hospitality (High Risk). Regional interpretations of these business licenses can vary between Badung and Gianyar regencies. Finally, while sanction types are known, a precise, uniform “fine tariff” for every license violation is not publicly codified, leaving discretion to local enforcers.
FAQ's about Additional Business Permits
-
Is the NIB a valid business license for a Villa?
No. Villa operations are typically Medium-High or High risk. You need the NIB plus a Verified Standard Certificate from the Tourism Office.
-
Can I start operating while waiting for verification?
Legally, no. For Medium-High and High risk, the NIB only allows "pre-operational" activities (construction, hiring). Commercial sales require the final verified license.
-
How do I know my risk level?
You must check the KBLI code in the OSS system. It will automatically display the risk level (Low, Medium-Low, Medium-High, High) and the required business licenses.
-
Does the Standard Certificate expire?
Generally, no, as long as you remain compliant. However, some supporting certificates (like Hygiene/SLHS) may need periodic renewal every few years.
-
Do I need a separate license for alcohol?
Yes. A general restaurant license does not cover alcohol sales. You need a separate SKPL (Surat Keterangan Penjual Langsung) specifically for alcoholic beverages.
-
What is the "Fictitious Positive" approval?
It is a mechanism where, if the government fails to process a license within the mandatory timeframe, the system automatically considers it approved.
