Expanding a technology company into Southeast Asia’s largest digital economy is a high-stakes move. While the potential for growth in Indonesia is immense, the regulatory landscape for foreign investment remains complex and often opaque. Many global tech firms struggle with shifting capital requirements and vague licensing categories, fearing that a misstep could lead to operational freezes or costly restructuring down the line.
The uncertainty is compounded by the rapid evolution of digital laws. In 2026, the enforcement of risk-based licensing under the new BKPM Regulation 5/2025 has tightened the scrutiny on foreign-owned entities. Simply registering a company is no longer enough; you must now align your IT Business model with specific KBLI codes and meet strict investment realization targets to avoid sanctions.
Navigating this new terrain requires a precise roadmap. Whether you are launching a SaaS platform from Silicon Valley or opening a development hub in Bali, understanding the correct entry vehicle is non-negotiable. This guide provides a clear, step-by-step pathway for establishing your PT PMA, securing the necessary digital licenses through the OSS system, and ensuring your foreign talent is legally compliant from day one.
Table of Contents
- Market & Regulatory Context: The Positive Investment List
- Entry Vehicles: PT PMA vs. Representative Office
- Step-by-Step Setup: KBLI and Capital Rules
- Licensing: OSS RBA and Digital Permits
- Real Story: The "Nominee" Nightmare in Pererenan
- Immigration Strategy for Foreign Tech Talent
- Post-Licensing: LKPM and BKPM Compliance
- 2026 "Not Confirmed" Regulations to Watch
- FAQ's about Tech Company Establishment
Market & Regulatory Context: The Positive Investment List
The cornerstone of the modern investment climate in Indonesia is the “Positive Investment List,” introduced by Presidential Regulation 10/2021. This landmark policy shifted the nation away from a restrictive “Negative List,” opening the doors for 100% foreign ownership in most digital sectors. For an IT Business, this means that activities like internet services, software development, and digital platforms are now largely unrestricted, provided you meet specific BKPM capital thresholds.
However, openness does not mean a lack of regulation. BKPM Regulation 5/2025, effective from late 2025, has refined the risk-based licensing framework. This regulation explicitly categorizes the digital economy as a “priority sector,” offering potential fiscal incentives but also demanding higher compliance standards. Foreign investors in 2026 must now navigate a system that prioritizes realized investment over mere administrative registration, meaning your commitment to the market in Indonesia must be financial, not just aspirational.
Entry Vehicles: PT PMA vs. Representative Office
Choosing the right legal structure is the first critical decision. For most tech companies aiming to generate revenue in Indonesia, the PT PMA (Perseroan Terbatas Penanaman Modal Asing) is the standard vehicle. This structure allows foreign entities to own shares directly and conduct full commercial activities, including billing clients and entering into local contracts in Bali or Jakarta. It is the only path for companies intending to sell software, subscriptions, or consulting services.
Alternatively, a Representative Office (KPPA) may suit firms that only need a non-commercial presence. A KPPA is useful for market research, liaison work, or supervising local partners in Bali, but it is strictly prohibited from generating revenue. If your goal involves sales or invoicing, a KPPA is a dead end. Misusing a KPPA for commercial activities is a common compliance trap that can lead to severe sanctions from the BKPM, including immediate revocation of your license.
Step-by-Step Setup: KBLI and Capital Rules
Setting up a PT PMA begins with selecting the correct KBLI (Standard Industrial Classification) codes. In the IT sector, these 5-digit codes define your business activities—whether you are in software publishing (e.g., KBLI 62015), data processing, or IT consultancy. Each code carries specific risk levels and foreign ownership rules. Choosing the wrong KBLI can block your ability to obtain necessary licenses later or force a costly amendment of your Articles of Association.
Once the KBLI is selected, you must address the capital requirements. Under BKPM rules, a foreign-owned IT Business must have a minimum paid-up capital of IDR 10 billion (excluding land and buildings) per business activity. The 2025 regulation introduced a 12-month capital lock-up period for declared amounts to prevent “capital flight” and ensure genuine investment in Indonesia. This financial commitment is verified during the OSS registration process and is a hard barrier to entry for undercapitalized startups.
Licensing: OSS RBA and Digital Permits
The operational heart of your setup is the Online Single Submission (OSS) Risk-Based Approach (RBA) system. After incorporation, you register your PT PMA on oss.go.id to obtain your NIB (Business Identification Number). The OSS system automatically assigns a risk level—Low, Medium, or High—to your specific KBLI. Most standard software development and IT consultancy activities fall into the Low or Medium-Low risk categories, allowing for instant issuance of the NIB and Standard Certificate upon self-declaration.
However, certain high-stakes activities like Internet Service Providers (ISP), data centers, and fintech platforms are classified as High Risk by the BKPM. These require additional verification and sectoral licenses from the Ministry of Communication and Informatics (Kominfo). For example, operating a cloud infrastructure service involves strict data localization and cybersecurity compliance that goes beyond the basic OSS registration. Failing to secure these specific digital permits can result in your platform being blocked by internet filters in Indonesia.
Real Story: The "Nominee" Nightmare in Pererenan
Meet David, a 38-year-old software architect from Vancouver, Canada. In August 2025, David relocated his boutique dev shop to a sleek villa in Pererenan, Bali. He wanted to capitalize on the lower operating costs while serving his North American clients. To bypass the IDR 10 billion capital requirement for a PT PMA mandated by the BKPM, he followed a “friend’s” advice and used a local nominee arrangement, where an Indonesian citizen held the shares on paper while David ran the IT Business.
The setup seemed perfect until a dispute arose with the nominee over “management fees.” The nominee, technically the legal owner under laws in Indonesia, froze the company bank accounts and locked David out of the office. Simultaneously, the tax office flagged the company for failing to report the substantial foreign income David was generating. The heavy monsoon rain drumming on his roof matched his mood as he realized he had no legal standing to reclaim his own assets.
Panic-stricken, David contacted a trusted tax management company to intervene. The legal team had to negotiate a costly buyout to regain control and immediately began the process of dissolving the nominee structure to establish a legitimate PT PMA via the OSS. “I thought I was saving $20,000,” David reflects. “In the end, it cost me double that and months of sleepless nights. There is no shortcut to legality in Bali.”
Immigration Strategy for Foreign Tech Talent
Bringing foreign talent into your entity in Indonesia requires a synchronized immigration strategy. A PT PMA can sponsor work permits (KITAS) for foreign experts, provided the roles are specialized—such as CTOs, senior software architects, or product managers. This process begins with obtaining an approved RPTKA (Foreign Worker Utilization Plan) from the Ministry of Manpower, followed by the payment of the DKPTKA levy (USD 1,200 per year per worker).
For remote staff or digital nomads who are not employed by the entity in Indonesia but live in Bali, the “Remote Worker” visa or Second Home visa might be more appropriate. However, if they are working for your local IT Business, they must have formal work KITAS. Using a business visa or tourist visa for active employment is illegal and puts both the individual and the company at risk of heavy fines and blacklisting by immigration authorities in Bali.
Post-Licensing: LKPM and BKPM Compliance
The most overlooked aspect of running a foreign company is the ongoing reporting obligation. Every PT PMA must submit an Investment Activity Report (LKPM) via the OSS system. For companies in the construction or operational phase, this report is typically due quarterly. It details your realized investment, labor absorption, and project progress to the BKPM.
Failure to submit the LKPM is the most common trigger for administrative sanctions in 2026. The OSS system will flag non-compliant companies, leading to warning letters and potentially the revocation of your NIB. Additionally, BKPM Regulation 5/2025 has strengthened the monitoring of capital realization. If your reported investment does not match your initial declaration within the stipulated timeline, you may face an audit that could freeze your business operations until the discrepancy is resolved.
2026 "Not Confirmed" Regulations to Watch
While the Positive Investment List provides a solid framework, several areas of digital regulation remain fluid in Indonesia. The specific tax treatment for cross-border remote teams working for an entity in Bali is still evolving, with potential Permanent Establishment (PE) risks that are “Not confirmed” in unified tax law. Similarly, the exact implementation of data localization rules for specific new AI and machine learning sectors is subject to upcoming ministerial decrees.
Another area of uncertainty is the precise capital interpretation for specific sub-sectors of the digital economy. While the IDR 10 billion minimum is standard BKPM policy, some regional offices in Bali may apply different thresholds for creative economy projects. It is crucial to verify these details with a consultant at the time of your OSS application, rather than relying on static online guides that may be outdated.
FAQ's about Tech Company Establishment
-
Can a foreign IT company own 100% of a PT PMA in Indonesia?
Yes. Most IT sectors, including software development and internet services, are open to 100% foreign ownership under the 2026 Positive Investment List.
-
What is the minimum capital requirement for an IT Business?
The minimum paid-up capital is generally IDR 10 billion (approx. USD 650,000) per KBLI business activity classification.
-
Do I need a specific license to operate a SaaS platform?
Generally, a SaaS platform falls under "Software Publishing" or "Data Processing" KBLI codes, which are low to medium-risk in the OSS system.
-
Can I use a virtual office for my IT company in Bali?
Yes, provided the virtual office is located in a commercial zone and is allowed by the specific district regulations where you register.
-
How long does it take to set up a PT PMA in 2026?
The incorporation and OSS registration typically take 1-2 weeks, but opening a bank account and securing specific work permits can extend the timeline to 4-6 weeks.
-
Is it mandatory to hire local staff in Indonesia?
While there is no strict quota, the BKPM expects knowledge transfer. For every foreign expert, you are generally expected to employ and train an Indonesian counterpart.
