What is Indonesia's Risk-Based Licensing (RBA) system?
The Risk-Based Approach fundamentally restructures Indonesia's business licensing paradigm by categorizing business activities according to their potential risks to public health, safety, environment, and natural resource utilization. This system operates through the OSS-RBA platform, which serves as the single digital gateway for all business licensing requirements.
Government Regulation No. 28/2025, effective from June 5, 2025, strengthens and refines the legal framework established by GR 5/2021. The updated regulation expands sectoral coverage from 16 to 23 business sectors, increases business activity classifications from 1,348 to 1,417 KBLI entries, and introduces enhanced system integration features including principal licensing, investment facilities, and partnership obligations.
The RBA system operates under structured implementation phases: starting a business and operating a business. Each phase involves distinct activities subject to licensing requirements tailored to the business's risk profile. Unlike the previous sector-based approach that required multiple permits from various agencies, the RBA system consolidates requirements based on assessed risk levels, significantly reducing administrative burden.
Key regulatory foundations include integration with spatial planning databases, environmental approval systems, and building permit processes. The system also incorporates Service Level Agreements (SLAs) with binding processing times and automatic approval mechanisms when deadlines are not met by the newly introduced fictitious positive principle.
Why the RBA System matters for businesses?
The RBA system delivers substantial operational advantages that directly impact business competitiveness and market entry strategies.
- Through the integrated OSS platform, businesses can obtain their Business Identification Number (NIB) and required permits through a single submission process, reducing licensing timeframes from months to weeks or even hours for low-risk activities.
- Transparency and predictability represent core benefits of the RBA framework. The system provides clear standards, procedures, and criteria (NSPK) that eliminate regulatory ambiguity. Businesses can accurately assess required permits, associated costs, and processing timelines before initiating operations. This predictability proves particularly valuable for foreign investors conducting due diligence and investment planning
- Cost reduction occurs through multiple channels: elimination of multiple agency fees, reduced professional service costs, and decreased operational delays. The system's risk-based differentiation ensures that low-risk businesses face minimal regulatory burden while high-risk activities receive appropriate oversight. Small and medium enterprises particularly benefit from simplified requirements that previously created disproportionate compliance costs.
- Investment climate improvements manifest through enhanced regulatory coherence and reduced bureaucratic overlap. The automatic approval mechanisms and strict SLA enforcement prevent regulatory delays that previously deterred investment. Foreign investors report increased confidence in Indonesia's regulatory environment due to the system's transparency and efficiency.
Business License Classification in the RBA's framework
Indonesia's RBA system categorizes business activities into four distinct risk levels, each with specific licensing requirements designed to match regulatory oversight with actual business risks.
Indonesia's Risk-Based Business Licensing Classification system
|
Risk level |
Licensing requirements |
Typical sectors/examples |
Key characteristics |
|
Low-Risk |
|
|
|
|
Medium-Low Risk |
|
|
|
|
Medium-High Risk |
|
|
|
|
High-Risk |
|
|
|
Step-by-Step: How to apply for Business Licenses via OSS RBA
The OSS-RBA application process follows a systematic seven-stage approach designed to guide businesses through licensing requirements efficiently.
Stage 1: Registration and NIB acquisition
Begin by accessing the OSS platform at oss.go.id and creating an account using either your Indonesian ID number (NIK) or passport number for foreign nationals. Submit your company's Articles of Association, Ministry of Law approval, and investment plan details to obtain your NIB.
The NIB serves as your business's foundational identity and unlocks access to additional licensing requirements based on your declared business activities. Foreign investors must ensure their company registration documents are properly legalized and translated before submission.
Stage 2: Business activity risk classification
Determine your business activities using the appropriate KBLI (Indonesian Standard Industrial Classification) codes. The system automatically assigns risk classifications based on your selected activities, determining which additional permits are required.
Review the detailed requirements for your specific risk category and prepare the necessary documentation accordingly. The platform provides guidance on applicable standards and compliance obligations for each classification level.
Stage 3: Supporting document submission
Upload the required supporting documents based on your risk classification. Low-risk businesses typically need only basic company information, while higher-risk activities require technical specifications, environmental assessments, and safety certifications.
Ensure all documents meet specified formats and requirements to avoid processing delays. The system provides document checklists and validation tools to assist with proper submission.
Stage 4: Verification and assessment
The OSS system processes your application according to established SLAs. Low-risk applications receive immediate approval, while higher-risk submissions undergo technical review by relevant authorities.
Track your application status through the OSS dashboard and respond promptly to any additional information requests. The system provides real-time updates on processing progress and estimated completion times.
Stage 5: License issuance
Upon successful verification, the system issues your business licenses electronically. Download and retain digital copies of all permits for your records and operational compliance.
Verify that all issued licenses accurately reflect your business activities and authorized locations before commencing operations.
Stage 6: Post-licensing obligations
Comply with ongoing obligations, including LKPM (Investment Activity Report) submissions. Small businesses must report semi-annually, while medium and large enterprises submit quarterly reports through the OSS system.
Maintain compliance with all license conditions and promptly report any changes to business activities that may affect your risk classification.
Transitional rules and special cases
Grandfathering provisions under Article 549 of GR 28/2025 ensure that licenses issued under the previous GR 5/2021 framework remain valid unless the new provisions provide more favorable terms for license holders. Businesses may voluntarily seek reissuance under GR 28/2025 if it provides compliance or operational advantages.
- System migration requirements mandate that businesses with existing OSS accounts manually update their data by October 5, 2025, when the updated OSS system launches. This process may require re-uploading licenses, adjusting business classifications, and completing new profile fields introduced under the updated regulation.
- Access Rights updates become necessary for businesses operating under older licensing frameworks. Companies must review their current permits against new classifications and update their OSS profiles to maintain compliance with current requirements.
- Risk reclassification procedures apply when businesses modify their activities or expand into new sectors. The system automatically reassesses risk levels based on updated business activity declarations, potentially requiring additional permits or allowing for simplified requirements.
Common challenges and compliance risks
- Misclassification of risk levels represents the most frequent compliance error, often resulting from inadequate understanding of KBLI codes or underestimating business activity impacts. Incorrect classifications can lead to operating with insufficient permits, exposing businesses to regulatory penalties and operational disruptions.
- Incomplete supporting documentation frequently delays approval processes and may result in application rejections. Businesses must ensure all technical requirements, environmental assessments, and safety certifications meet specified standards before submission.
- Sector-specific license requirements continue to apply alongside OSS-RBA permits for certain industries. Mining, energy, and financial services sectors maintain additional regulatory requirements that complement rather than replace the RBA framework.
- Non-compliance penalties escalate based on violation severity: minor violations result in warnings, moderate violations trigger operational restrictions, and major violations can lead to license revocation and fines reaching IDR 4 billion for sectoral violations. Foreign operators face additional immigration consequences, including deportation and re-entry bans.
FAQs on Indonesia's RBA Licensing System
What is the difference between NIB and business license?
The NIB serves as a foundational business identity that automatically provides several traditional licenses including Company Registration Certificate (TDP), Import Identification Number (API), and Customs Access. Business licenses are additional sector-specific permits required based on risk classification and business activities. Low-risk businesses operate solely with NIB, while higher-risk activities require NIB plus additional business licenses.
Do small businesses still need permits?
Small businesses require permits based on their risk classification rather than size. Micro businesses with capital under IDR 1 billion are exempt from LKPM reporting but still need appropriate licenses for their business activities. The RBA system ensures small businesses face proportionate regulatory requirements matching their actual risk levels.
How long does OSS approval take?
Processing times vary by risk classification: low-risk applications receive immediate approval, medium-risk applications typically process within 7-14 days, and high-risk applications may require 30-60 days depending on technical review complexity. The system's SLA mechanisms ensure predictable timeframes and automatic approval when deadlines are exceeded.
What happens if my business changes activities?
Business activity changes trigger automatic risk reassessment through the OSS system. Before updating their business license, Companies must make an adjustment on their companies' Article of Association regarding the purpose and objectives in relation to their new KBLI. Subsequently, Companies may update their business activity declarations, potentially requiring additional permits for higher-risk activities or enabling simplified requirements for lower-risk operations. The system provides guidance on new requirements and transition procedures for modified business activities.
Are foreign companies treated differently under RBA?
Foreign companies face the same risk-based classifications as domestic businesses but encounter additional requirements including minimum investment thresholds, foreign ownership restrictions, and enhanced documentation standards. PT PMA companies must demonstrate compliance with investment commitments and may face stricter verification processes regardless of their underlying business risk classification.
The RBA system represents Indonesia's commitment to creating a more efficient, transparent, and business-friendly regulatory environment while maintaining appropriate oversight for activities that pose genuine risks to public welfare. Success in navigating this system requires understanding both the technical requirements and strategic implications of risk-based classifications for long-term business sustainability and growth in Indonesia's dynamic market environment.
