Indonesia's OSS Licensing System: How Business Permits Work

What OSS Is and How It Works

OSS (Online Single Submission) is Indonesia's integrated business licensing platform, administered by the Indonesian Investment Coordinating Board (BKPI, formerly BKPM). The system was introduced by Government Regulation No. 24 of 2018 and significantly expanded through the Job Creation Law cluster and implementing regulations issued from 2021 onwards. All business licensing in Indonesia — from initial business registration through to sector-specific operational permits — is processed through the OSS platform at oss.go.id.

The current version, OSS-RBA (Risk-Based Approach), categorizes business activities by risk level rather than applying a uniform licensing requirement to all activities. The risk level assigned to a business activity determines what licenses and certifications are required before operations can commence.

Risk Categories and What They Require

Under OSS-RBA, business activities are classified into four risk categories. Low-risk activities require only a Business Identification Number (NIB) — the 13-digit registration number that simultaneously serves as business registration, customs identification, and standard certificate. No additional pre-operational permit is required, though post-operational compliance obligations may still apply.

Medium-low risk activities require a NIB plus a Standard Certificate (Sertifikat Standar) that is self-declared by the business — meaning the applicant certifies compliance with applicable technical standards without prior government verification. Medium-high risk activities require a Standard Certificate that is verified by the relevant technical ministry or agency before it becomes effective. High-risk activities require a specific license (Izin) issued after assessment by the relevant authority.

Why KBLI Code Selection Is Critical

The KBLI — Indonesian Standard Business Classification code — is the key input that drives OSS-RBA's risk classification output. When a company registers through OSS, it selects one or more KBLI codes representing its business activities. The system then assigns a risk level to each code and determines what licenses are required based on that code. The KBLI code also determines which foreign ownership restrictions apply under the Positive Investment List.

The practical consequence is significant: two companies doing economically similar things may face entirely different licensing requirements depending on which KBLI code they select. A technology company providing enterprise software services, for example, could plausibly select codes in software development, data processing, consulting, or IT infrastructure — each carrying different risk classifications and requirements. Selecting the wrong code either creates unnecessary licensing burden or, more dangerously, results in operating without the correct permits for the actual business activity.

Sector-Specific Licensing Layers

OSS handles the business entity and general operating permit layer. Sector-specific licenses — issued by financial regulators (OJK), health authorities (BPOM, Kemenkes), telecommunications regulators (Kominfo), or other bodies — are separate requirements that layer on top of the OSS framework. OSS has integration links with some sector regulators, but the actual permit from the sector authority must still be obtained and renewed independently.

Foreign-owned companies (PT PMA) with activities in regulated sectors should map both the OSS licensing pathway and the sector regulator pathway before commencing operations. The two systems have different processing timelines, documentation requirements, and renewal cycles.

Common Errors in OSS Filings

Beyond incorrect KBLI selection, the most frequent OSS compliance issues for foreign investors include mismatches between the company's Articles of Association (which define authorized activities) and the KBLI codes registered in OSS, failure to complete post-NIB requirements within required timeframes, and failure to update OSS records when business activities expand or change. An outdated OSS registration is treated as operating outside the permitted scope of activities — which carries legal and tax implications.