Business Licenses in Indonesia: Find the Approval Needed for Your Actual Activity

Frame the first business event before looking for a licence

Choose an actual event, such as manufacturing a product at a named site, importing a shipment, opening a retail outlet or performing a service for a customer. Identify the company that will do it, the customer, goods or service, equipment, site, scale, expected date and whether a third party performs any part. A company can need different decisions for different activities or locations; a broad description such as ‘commerce’ does not establish the applicable permit.

Write down the boundary of the activity. An overseas supplier may make a product while an Indonesian company imports, stores, markets and resells it. Each fact matters because the Indonesian company’s own permissions may be different from the supplier’s. A lease, a corporate deed or a supplier’s certificate does not automatically establish permission for every activity in the chain.

The decision record should name the person who owns the description and the source of each fact. If sales says the company only distributes but operations plans repackaging, resolve that discrepancy before classification. Do not choose a KBLI simply because it offers the shortest application or looks familiar from another company’s NIB.

Map the actual work to current KBLI descriptions

Use the OSS KBLI directory and compare the descriptions and scope with the real work. Record why each candidate code fits, whether any part is excluded, the site and the person who approved the selection. More than one code may be appropriate where the company genuinely performs multiple distinct activities, but adding a code does not by itself grant permission to start every project.

Check the version of the classification. The OSS conversion guide explains that a previous code can remain, change, split, merge or be reorganized under KBLI 2025. A conversion table is a starting point; read the current scope before submitting. If the intended activity is unclear or a regulated product is involved, seek classification guidance from the relevant authority and keep the answer with the file.

Compare the classification with the company’s constitutional purpose, ownership and sector rules. For a foreign-investment company, assess whether foreign ownership and any investment conditions match the specific activity. The wider Indonesia company registration process includes this corporate setup review; licensing is a separate activity-level assessment.

Read the risk level and the actual output

Government Regulation 28 of 2025 governs risk-based business licensing. Its framework uses an NIB for low risk, an NIB and standard certificate for medium risk, and an NIB and licence for high risk. The official OSS system distinguishes four levels: low, medium-low, medium-high and high. The live result and the relevant sector rules should be reviewed for the chosen business activity and project.

For medium-low risk, the applicable standard certificate can be issued based on a self-declaration, with continuing obligations to meet the standard. For medium-high risk, the regulation distinguishes a certificate that has not been verified, which supports preparation, from a verified certificate used with the NIB for operational or commercial activities. High-risk activities require the applicable licence and may also have supporting or technical requirements. These are framework descriptions; read the actual output, conditions and any transition rules for the project.

Record the issue date, activity and site, risk, output name, verification status, authority, outstanding conditions and next action. If the output is not yet effective for the planned commercial event, do not equate a receipt or pending submission with a completed approval. Ask the competent authority which preparatory acts are allowed while the application remains open.

Check site, product and supporting permissions

A business licensing result may sit alongside basic requirements concerning spatial use, environmental management or building and occupancy, depending on the activity and site. Product registrations, import rules, professional credentials, safety approvals and sector-specific permissions may also apply. Determine the requirements from the actual activity and responsible agencies rather than copying a generic list into every project.

The OSS PB UMKU directory lists supporting business-activity permissions and related classifications. Its presence shows that supporting permissions can exist; it does not prove that a specific listed permission applies to every business. Read the individual requirement, project facts, competent authority and status. Some requirements may be handled through another system or authority.

A hypothetical example: a company plans to sell a finished product through an office and to store stock at another site. List selling, import where applicable, storage and any product-specific activities separately; then identify the actual operator and location for each. Whether a specific permit is required depends on the goods, business model and current rules. Do not assume that the office’s NIB automatically authorizes storage at a different location.

Diagnose missing, pending or mismatched coverage

If the NIB lists an activity but its site is wrong, compare the approved project data and ask whether a change or new filing is needed. If the document is correct but the standard certificate is pending verification, identify the outstanding evidence and the authority. If the work is absent from the stated KBLI scope, reassess the activity before changing records. A different root cause calls for a different remedy.

Preserve the current official output, application history, correspondence and dates before making changes. Identify the affected customers, contracts, sites and first activity. Where the company has already begun a potentially unlicensed operation, seek prompt Indonesian legal advice on containment, disclosure and remediation. A later amendment does not automatically validate an earlier activity.

The guide to updating KBLI and OSS licences covers the update process. For this decision, the key is to distinguish a classification problem, missing condition, pending verification and a site or product approval gap.

A controlled issue log should include the original code and document status, the first date of the affected activity, the facts suggesting a mismatch and the person with authority to make changes. Preserve invoices and supporting records without altering historical dates. Ask the adviser which activities should be paused and which customers or authorities may need to be informed. Track the proposed remedy separately from the authority’s final decision. Do not present an internal correction plan as evidence that a permit has already been issued or that a previous period has been regularized.

Authorize the specific activity only when evidence matches

Create one release row for each first business event: the legal operator, actual work, site, KBLI, risk, business-licensing output, verification status, supporting approvals, conditions, evidence link and responsible decision maker. A director or authorized project owner can then see which items are complete, which need authority clarification and which prevent the planned launch.

If the entity, activity, location and every applicable condition match the intended operation, retain the official outputs and document the internal approval. If a material item is missing or uncertain, set an owner and next review date rather than treating the whole company as approved. Revisit the row when the product, process, premises, ownership facts or regulation changes. The register is an editorial planning tool, not an official permit or a guarantee of approval.