Medium-Low-Risk Business Licensing in Indonesia: NIB and Self-Declared Standards

Confirm that the actual project is medium-low risk

Start from a precise activity description: what the business supplies, how it supplies it, where the work takes place and the operational scale or other parameters requested by OSS. Select the applicable KBLI description in the current system, including its exclusions. An attractive code name is insufficient if it describes a different service or production activity.

A PT PMA and a domestically owned PT should both follow the risk outcome applicable to their activity, but ownership eligibility and investment requirements are separate questions. A lower licensing risk does not establish foreign-investment eligibility. Confirm the ownership route before relying on a medium-low-risk filing as the answer to every setup question.

For a new entity, settle the underlying company formation in Indonesia particulars before creating a project from inconsistent shareholder, address or management data. For an existing company, compare the current legal record with the information imported or maintained in OSS. Identify any amendment needed rather than creating a second identity to work around a mismatch.

Keep the project’s risk result and selected activity description with the file. If an adviser’s proposal calls the activity medium-low risk but OSS shows a different result, resolve the difference using the actual project parameters and governing sector provisions. Do not change the commercial description simply to obtain fewer requirements.

Separate certificate issuance from fulfillment of the standard

Article 131 of Government Regulation 28 of 2025 identifies the two licensing outputs for medium-low-risk activities: the Business Identification Number, or NIB, and the Standard Certificate, or Sertifikat Standar. The certificate uses the business’s declaration of commitment to fulfill the applicable operating standards. The same article requires fulfillment when the activity is conducted and provides for examination during supervision.

That structure differs from medium-high risk, where verification of the relevant standards is central to the permission for commercial operations. Do not label a medium-low-risk certificate “unverified” merely because it did not pass the medium-high-risk verification process. Conversely, do not treat an unverified medium-high-risk certificate as though it were the self-declared certificate for a different category.

Read the actual standard before an authorized person makes the declaration. Identify any requirements concerning facilities, equipment, competence, procedures or service delivery that apply to the selected activity. These are not universal requirements for every business; take them from the governing sector standard and project conditions. A provider should be able to show which standard the declaration addresses.

The operating obligation survives the issuance event. Keep two separate milestones in the company’s records: certificate obtained, and standards demonstrably fulfilled for the work being performed. This distinction explains why the company needs both a licensing file and an operational evidence file.

Complete the declaration and its related requirements

Article 221 sets out the medium-low-risk issuance route, including the undertaking to comply with business standards through OSS. It distinguishes activities requiring the UKL-UPL environmental form from those using SPPL in that route, and recognizes supporting business approvals, or PB UMKU, where the activity or product/service standard requires them. Self-declaration is therefore not a general exemption from environmental or supporting approvals.

1. Confirm the company account and authorized filer, and reconcile the company data used for the application.
2. Check the selected KBLI, project address and requested operational information against the actual business.
3. Read the applicable commitments and complete the correct environmental information or forms for the project.
4. Have the authorized company representative approve the declarations before submission.
5. Download the NIB and relevant Standard Certificate, then list any additional approvals or conditions that remain outstanding.

Follow the current interface and project requirements rather than assuming an old tutorial covers every field. The local investment authority’s updated OSS guidance links separate manuals by risk category. A manual intended for a micro or small enterprise must not be used to bypass the company-size and investment data required for another applicant.

Review the issued documents for the correct entity, activity and location. Record their identifiers, issue dates and any obligations displayed with the project. If a certificate is missing, determine whether the declaration is incomplete, a prerequisite remains open or the activity follows another route. Downloading the NIB alone does not settle that question.

Build the evidence file behind each declared standard

Turn the applicable standard into a working evidence register. The example below supplies the review method; the company must replace each category with the exact requirement for its own activity. This is a management tool, not a government form or a universal inspection checklist.

For each row, write what evidence would establish fulfillment and who checks that it remains current. Do not collect certificates unrelated to the standard merely to create a thick file. Where the requirement is not yet fulfilled, record the affected operating step and the remediation needed before that step can proceed.

Use the distinction between risk categories and their required licensing documents to prevent the evidence register from drifting into the wrong regime. A request for proof under a sector standard should not be answered with an unrelated incorporation document, and a genuine NIB cannot prove the competence of an individual professional.

When the company discovers that a declaration was based on an inaccurate activity or project description, preserve the original submission and seek the correct change or correction route. Assess the effect on the affected operation. Do not simply alter an internal checklist while leaving an inconsistent OSS record and unsupported declaration in place.

Decide whether the declared activity is ready to start

Proceed with the particular medium-low-risk activity when the classification is supported, the NIB and Standard Certificate match the project, the applicable standards are fulfilled for operations, and any additional requirements affecting that work are addressed. Test readiness at the activity and site level rather than declaring the entire company ready because one certificate exists.

Hold the affected operation if the selected code is uncertain, a necessary standard cannot be substantiated or a separate project approval remains unresolved. The next useful action is to close that specific gap with the person responsible for the requirement. Waiting for a medium-high-risk verification stage that does not apply is equally unhelpful: follow the correct regime and retain the evidence it actually requires.