OSS-RBA for Beginners: A Complete Guide to Risk-Based Business Licensing in Indonesia

If you are planning to invest or set up a business in Indonesia, sooner or later you will run into an acronym that determine almost everything about your market entry timeline: OSS-RBA. For first-time foreign investors, the system can feel like a maze of acronym and strange terminology NIB, KBLI, PB-UMKU, Sertifikat Standar with no clear map of where to start.

This guide breaks OSS-RBA down into plain language: what it is, how the risk-based approach actually works, and the steps a foreign-owned company (PT PMA) needs to take to legally operate in Indonesia.

What Is OSS-RBA?

OSS-RBA stands for Online Single Submission–Risk-Based Approach, Indonesia’s integrated digital platform for business licensing. It is managed by the Ministry of Investment/Investment Coordinating Board (Kementerian Investasi/BKPM) and serves as the single gateway through which every business local or foreign applies for, receives, and reports on its business licenses.

Before OSS-RBA, investors had to visit multiple ministries and local agencies separately to collect the permits needed to legally run a business. The risk-based approach consolidated this into one online system and, more importantly, changed the underlying logic: instead of applying the same licensing burden to every business, the government now calibrates requirements to the actual risk level of the business activity.

The current legal foundation for OSS-RBA is Government Regulation (PP) No. 28 of 2025, which took effect on 5 June 2025 and refined the earlier framework established by PP No. 5 of 2021. If you read older articles or guides referencing PP 5/2021 as the sole legal basis, treat that as outdated  PP 28/2025 is now the operative regulation, and it’s worth confirming with an advisor whether any recent updates affect your specific sector.

The Four Risk Levels, Explained

The core idea behind OSS-RBA is simple: the riskier your business activity, the more licensing steps you need to complete. Every business activity in Indonesia is classified into a risk tier based on its potential impact on health, safety, the environment, and the use of natural resources. These tiers are:

1. Low Risk The lightest tier. Businesses here only need a NIB (Nomor Induk Berusaha), or Business Identification Number, which also functions as company registration proof, import/export identification, and BPJS social security registration. Many consulting, digital, and service-based businesses fall into this category, and approval can be close to instant.

2. Medium-Low Risk Requires the NIB plus a Sertifikat Standar (Standard Certificate) in the form of a self-declaration. No further verification from a technical authority is usually needed before you can start operating, though compliance is still monitored.

3. Medium-High Risk Also requires the NIB plus a Standard Certificate, but this one must be verified by the relevant technical ministry or agency before it becomes valid. This adds a review step and generally extends the timeline.

4. High Risk The most heavily regulated tier. Businesses here need the NIB plus a full license (izin), often supported by additional technical approvals — environmental permits (AMDAL/UKL-UPL), building approvals (PBG), or sector-specific permits depending on the industry. Processing times can run anywhere from roughly 30 to 60 days depending on the complexity of the technical review.

Where your business lands on this scale depends heavily on your KBLI code — Indonesia’s standardized business classification system, similar to NAICS or SIC codes elsewhere. This is why choosing the correct KBLI code during incorporation is one of the most consequential decisions in the entire market-entry process. An incorrect or overly broad KBLI selection is one of the most common reasons foreign investors get stuck mid-process.

How the OSS-RBA Process Works, Step by Step

While the exact requirements vary by sector and risk level, the general pathway looks like this:

1. Register and map your business activity. Before touching the OSS platform, define precisely what your company will do in Indonesia and match it to the correct KBLI code(s). This decision drives every subsequent step.
2. Incorporate your legal entity. For foreign investors, this typically means establishing a PT PMA, which requires Articles of Association and approval from the Ministry of Law.
3. Create an OSS account and apply for your NIB. Access is via the official OSS platform (oss.go.id), using an Indonesian ID number (NIK) for local applicants or a passport number for foreign nationals. The NIB is the foundational identity number every business needs before anything else can happen.
4. Determine your risk classification. Based on your KBLI code(s), the system will indicate which of the four risk tiers applies and what additional documentation is required.
5. Fulfil additional licensing requirements. Depending on your risk tier, this may include a Standard Certificate, technical verification, or a full license with supporting permits.
6. Complete sector-specific approvals (PB-UMKU). Some activities require Business Licensing to Support Business Activities (Perizinan Berusaha Untuk Menunjang Kegiatan Usaha) on top of the NIB — for example, health permits for F&B businesses or specific operational certificates for regulated industries.
7. Maintain ongoing compliance. Once operational, businesses are required to submit periodic investment activity reports (LKPM) to BKPM. Missing these reports is a common — and avoidable — compliance failure among new PT PMAs.

Common Mistakes Foreign Investors Make

• Choosing the wrong KBLI code, either because it doesn’t match actual business activities or because it inadvertently pushes the company into a higher risk tier than necessary.
• Assuming the NIB alone is sufficient for medium or high-risk activities, when a Standard Certificate or full license is actually still required before legal operation can begin.
• Treating OSS-RBA as a one-time task rather than an ongoing compliance obligation that includes periodic LKPM reporting.
• Submitting documents that aren’t properly legalized or translated, which is a frequent bottleneck for foreign shareholders and directors.
• Underestimating timelines for high-risk sectors, particularly those requiring environmental or building-related approvals, which can add weeks or months to a market-entry plan.

Why This Matters Before You Even Land in Indonesia

The most expensive mistakes in Indonesia market entry rarely happen because investors act too cautiously — they happen because decisions about KBLI codes, entity structure, and risk classification get made too early, without full information, and are difficult or costly to unwind later. A thirty-minute conversation before incorporation can save weeks of rework once the OSS application is already submitted.

This is exactly the kind of decision point where remote, advisory-first legal support is most valuable — you don’t need a lawyer in the room in Jakarta to get clarity on your risk tier, your KBLI classification, or your realistic licensing timeline. You need the right questions answered before you commit capital and paperwork to a structure that may not fit.

Planning to enter the Indonesian market and want clarity before you start the OSS-RBA process? Our Indonesia Market-Entry Desk offers remote advisory sessions for foreign investors — covering entity structure, KBLI classification, risk-tier assessment, and realistic licensing timelines — so you can make informed decisions before committing to incorporation. Book an initial consultation by sending us an email to advokat@azralaw.com to get a clear picture of what your specific business activity will require and to get a free quotation for service that you need.

Article Topics: OSS-RBA Indonesia, risk-based business licensing, NIB Indonesia, business license Indonesia, OSS RBA guide for beginners