Risk-Based Business Licensing in Indonesia: Use Activity Risk to Identify the Required Documents

Start with an activity and project record

Risk-based licensing classifies the actual activity, not the corporate name or the nationality of its founders. Identify what the business produces or performs, its scale, location and the scope selected in OSS. Keep the resulting project record so the licensing team can reproduce the assessment.

The governing framework is Government Regulation 28/2025 , supported by Investment Regulation 5/2025 . An old checklist based only on PP 5/2021 should not be treated as the current filing instruction. Existing or transitional project data may need a different route from a new application.

Use the current KBLI description and applicable scope, including inclusions and exclusions. OSS’s KBLI 2025 transition information is relevant when mapping an earlier classification to the present system. Preserve the classification version with the project so the same code number is not mistaken for an unchanged business description.

The legal entity should already be identified consistently. The company registration process in Indonesia establishes the corporate file used in the application; it does not determine the risk output for every project. A company with several activities needs a separate assessment of each relevant activity and location.

Translate activity risk into the main licensing documents

For the ordinary risk-based route, the principal document pattern is shown below. The distinctions follow the licensing framework and the issuance and fulfilment provisions of Investment Regulation 5/2025. Read the actual output and conditions, since a sector or special project can require further documents.

A document’s existence and its usable status are separate checks.

A self-declaration is an undertaking by the business, not a statement that the company may ignore the standard until an inspection. Medium-high verification requires evidence through the relevant fulfilment process. A high-risk output marked as not meeting requirements must be read according to its limited legal effect, rather than simply counted as a licence in the handover.

Do not infer foreign-ownership eligibility from a low risk level. Investment access and operational risk are separate assessments. Similarly, a foreign-investment company is not automatically high risk solely because its shareholders are foreign; the activity facts and governing classification determine the licensing result.

The PT PMA risk-tier operating checks connect those document patterns to project readiness. Keep the main licensing output together with the underlying project details rather than presenting a cropped NIB as proof for an activity whose requirements remain pending.

Add the basic and supporting permissions the project needs

The principal risk-tier output is only one layer of the licensing file. Identify spatial, environmental and building-related basic requirements applicable to the project. A lease, postal address or landlord’s consent should not be substituted for an approval that the activity actually requires.

Then examine supporting business licences and permissions, known as PB UMKU. The official PB UMKU directory organises these by sector and activity. A product, facility, service or professional function can require supporting evidence beyond the main business licence. Use the relevant entry rather than assuming all permissions appear on the first NIB download.

Make a document list by function. Corporate identity records establish the applicant; location documents support the place; technical and personnel records support standards; product or supporting permits cover the additional regulated function. Identify the issuer and completion condition of each document. This avoids sending a large unrelated bundle while omitting one decisive certificate.

Separate a permit held by the company from one held by a supplier, landlord or subcontractor. Where the operating model lawfully depends on another party’s authorisation, record that party’s role and the relevant contract. Do not relabel the counterparty’s permission as a company-owned approval.

A manufacturing facility, a professional service and a distribution business can have very different supporting requirements even if all have NIBs. Select the documents from the actual activity and conditions; avoid a universal company-registration checklist that treats every sector as the same filing.

Build a document, status and action register

Use one row per activity-specific requirement. Record the document name, issuing or verifying authority, relevant project, current status, remaining action and evidence location. The register is an editorial management tool, not a new government application. Its purpose is to connect what has been issued with what the company may do next.

• For an issued document, retain the complete file and any annex, not only the first page or a download button screenshot.
• For an unverified certificate, record the standard being demonstrated, required evidence and the responsible reviewer.
• For a returned submission, retain the actual request and identify the factual or document correction needed.
• For a supporting permission, record its holder and the product, site or service scope it covers.
• For a conditional or expiring output, record the condition, review date and the operation that depends on it.

The register should explain the next action , not merely display a green status.

Read an error or request in context before resubmitting. Check whether the mismatch begins in corporate source data, the selected activity, project information or a technical attachment. Correct the authoritative record first when necessary. Uploading a new explanation without fixing the inconsistent source may reproduce the rejection elsewhere.

The OSS medium-high and high-risk submission guidance identifies the relevant application workstream. Follow the guide and current project-specific instructions rather than inventing a portal sequence from an older screenshot. Menu labels and transitional routes can change without changing the need to establish the activity and its permission status.

Plan the schedule from outstanding evidence. Identify work that can proceed during lawful preparation and the activity that must wait for verification or an effective licence. A provider’s estimated filing date is not an appropriate substitute for the actual permission needed for opening, production or delivery.

Verify the first commercial activity against the complete file

Test the file against a concrete event: opening the premises, manufacturing a product, providing the regulated service or dispatching the first shipment. Ask which activity is being undertaken, where, by whom and under which effective permission. Review the associated basic and supporting requirements at the same time.

Archive the evidence used for the launch decision with a retrieval date and project identifier. A screenshot should show the relevant activity and status, while the complete official file supplies its conditions. This makes it possible to explain a later change without relying on a cropped image that cannot be connected to the project.

For a medium-high activity, a certificate still marked unverified is a clear reason to review the remaining fulfilment work before authorising commercial activity. For high risk, check the actual licence wording and status. Do not convert permission to undertake preparation into a broad right to operate because equipment is already installed or a customer deadline is approaching.

If the first transaction is outside the reviewed scope, change the transaction or complete the necessary review before proceeding. A new location, product process or additional service can alter the requirement set. The operational team should notify the licensing owner before those facts change.

Keep a dated acceptance note from the responsible company officer listing the relevant outputs and open conditions. If the evidence does not establish readiness, name the remaining action and keep the affected operation on hold. The note supports internal control; it does not replace the decision of the competent authority.

Authorise the activity that is supported, not every activity the company might perform.

Use the risk result to close the actual permission gap

Begin with correct activity and project facts, translate the risk tier into the main document pattern, and add the basic and supporting permissions needed for the actual business. Then verify status and scope before using the output to justify operations.

The immediate task is to prepare the document/status/action register for the intended first commercial event. Escalate where a certificate remains unverified, a licence carries unmet conditions or a supporting permission belongs to the wrong party. Resolve the specific gap rather than collecting additional documents unrelated to it.