Indonesia has entered a new phase in its business licensing reform with the issuance of Government Regulation No. 28 of 2025 on the Organization of Risk-Based Business Licensing, commonly referred to as PP 28/2025 or GR 28/2025.
The regulation was enacted and came into force on 5 June 2025, replacing Government Regulation No. 5 of 2021. It refines Indonesia’s risk-based licensing framework by strengthening legal certainty, improving service standards, clarifying OSS procedures, expanding sector coverage, and reinforcing supervision after licenses are issued.
For companies, investors, and business owners operating in Indonesia, PP 28/2025 is not just another regulatory update. It affects how business activities are classified, what licenses are required, how OSS applications are processed, and what compliance obligations must be maintained after the license is obtained.
What Is PP 28/2025?
PP 28/2025 regulates the implementation of Risk-Based Business Licensing, or Perizinan Berusaha Berbasis Risiko, known in Indonesia as PBBR.
Under this framework, business licensing requirements are determined based on the risk level of each business activity. The higher the risk, the more comprehensive the licensing and verification requirements.
The regulation covers several key areas, including basic requirements, Business Licensing, Business Licensing to Support Business Activities or PB UMKU, norms and standards, OSS system services, supervision, policy evaluation, funding, problem resolution, and administrative sanctions.
In practice, this means that businesses must not only obtain the right license, but also ensure that their business activity, KBLI classification, location, standards, environmental obligations, and operational permits are properly aligned in the OSS system.
Why PP 28/2025 Matters for Businesses
PP 28/2025 was introduced to improve the licensing system that had been operating under PP 5/2021. The government recognized the need to provide stronger legal certainty, clearer business processes, and better service quality for business actors.
For foreign investors and Indonesian companies, the regulation matters because OSS licensing is often the foundation for:
- Company establishment and expansion
- NIB issuance
- Business activity registration
- Sectoral licensing
- Import-export readiness
- Location and building compliance
- Environmental approval
- Investment reporting and supervision
- Operational and commercial activities
A licensing mismatch in OSS can lead to delays in business operations, project approvals, banking processes, vendor onboarding, government reporting, or future corporate actions.
Key Changes Under PP 28/2025
1. PP 28/2025 Replaces PP 5/2021
PP 28/2025 officially revokes and replaces PP 5/2021. This means the current legal basis for Indonesia’s risk-based business licensing system is now PP 28/2025.
Businesses that already obtained licenses before PP 28/2025 should not assume that all documents must automatically be reissued. OSS has clarified that business licenses issued before PP 28/2025 and still valid remain legally valid and can continue to be used.
However, companies should still review their OSS data to ensure that their business activities, KBLI, location data, basic requirements, PB UMKU, and operational obligations remain accurate under the updated framework.
2. Broader Sector Coverage
PP 28/2025 expands and clarifies the sectoral scope of risk-based business licensing.
The regulation covers major sectors such as maritime and fisheries, agriculture, forestry, energy and mineral resources, nuclear energy, industry, trade and legal metrology, public works and housing, transportation, health, education, tourism, religion, postal services, telecommunications, broadcasting, defense, and security.
It also adds or separately recognizes additional sectors, including creative economy, geospatial information, employment, cooperatives, investment, electronic systems and transactions, and environmental protection.
This broader coverage is important because more business activities are now clearly mapped into the OSS risk-based licensing framework.
3. Licensing Requirements Are Still Based on Risk Level
PP 28/2025 maintains the core risk-based structure. Business activities are classified into:
| Risk Level | Main Licensing Requirement |
|---|---|
| Low Risk | NIB |
| Medium-Low Risk | NIB + Standard Certificate |
| Medium-High Risk | NIB + verified Standard Certificate |
| High Risk | NIB + Permit |
For low-risk activities, the NIB functions as both the identity of the business actor and the legal basis for conducting business activities. For medium-low risk activities, the Standard Certificate is generally based on a statement of compliance with applicable standards. For medium-high risk activities, a Standard Certificate must be verified before the business can fully conduct operational or commercial activities. For high-risk activities, a Permit is required before operations.
This structure makes it essential for companies to correctly determine their KBLI and risk classification before starting operations or expanding business lines.
4. Basic Requirements Remain Critical
Before or during the licensing process, businesses may need to fulfill basic requirements depending on their activity and location.
PP 28/2025 identifies basic requirements such as:
- KKPR, or spatial suitability approval
- Environmental approval
- Building approval and certificate of worthiness, including PBG and SLF
These basic requirements are processed according to the location of the business activity and may involve the OSS Agency, ministries, regional governments, KEK Administrators, or KPBPB authorities.
For businesses with physical locations, factories, offices, warehouses, industrial facilities, or construction plans, basic requirements should be reviewed early to avoid licensing delays.
5. OSS Becomes More Integrated
PP 28/2025 emphasizes that Risk-Based Business Licensing is implemented electronically through the OSS system.
The OSS system consists of several subsystems, including information services, basic requirements, business licensing, investment facilities, partnerships, and supervision. It must be used by ministries, agencies, provincial governments, regency or city governments, KEK Administrators, KPBPB Concession Boards, and business actors.
This confirms OSS as the central gateway for business licensing in Indonesia. For companies, this also means that data consistency in OSS is increasingly important.
6. Stronger Service-Level Certainty
One of the important improvements under PP 28/2025 is clearer service-level certainty.
The explanation of PP 28/2025 states that the regulation provides clearer timeframes for several Risk-Based Business Licensing processes, especially basic requirements such as KKPR, environmental approvals, PBG, and SLF. It also introduces positive fictitious arrangements in several service-level provisions to avoid uncertainty and potential disadvantage for business actors.
For investors, this is a positive development because licensing timelines are often a key factor in project planning, site selection, and market-entry decisions.
Technical Implementation Through BKPM Regulation No. 5/2025
PP 28/2025 has been followed by Minister of Investment and Downstream Industry / BKPM Regulation No. 5 of 2025, which provides technical guidance for the implementation of risk-based business licensing and investment facilities through OSS.
This regulation came into force on 2 October 2025 and regulates areas such as basic requirements, business licensing, PB UMKU, OSS services, supervision, cancellation and revocation, sanctions, and licensing services in certain conditions. It also revokes several previous BKPM regulations issued under the earlier licensing framework.
For businesses, this means PP 28/2025 should be read together with the latest BKPM technical regulation and sector-specific rules.
What Happens to Existing OSS Licenses?
Existing businesses should pay attention to transition rules.
OSS has provided guidance for business actors with transition project data before the implementation of PP 28 on 5 October 2025, particularly where spatial requirements had already been issued but the business licensing process had not been completed.
In practice, companies should review whether their licensing status falls under:
- Existing valid licenses issued before PP 28/2025
- Transition projects with old OSS data
- New applications under the PP 28/2025 framework
- Amendments due to business expansion, KBLI updates, location changes, or additional PB UMKU requirements
A proper OSS review can help determine whether the company needs a data correction, license adjustment, additional PB UMKU, or no action at all.
Practical Checklist for Companies
Companies operating in Indonesia should review the following items:
1. Check Your NIB and OSS Profile
Ensure that the company name, address, shareholders, directors, KBLI, business scale, project location, and contact information are accurate in OSS.
2. Review KBLI and Risk Classification
Confirm that each KBLI code reflects the actual business activity. A wrong KBLI can lead to incorrect licensing requirements, risk classification, or sectoral obligations.
3. Verify Basic Requirements
Check whether KKPR, environmental approval, PBG, SLF, or other location-based requirements are required and properly reflected in OSS.
4. Review Standard Certificates
For medium-low and medium-high risk activities, verify whether the Standard Certificate is properly issued, self-declared, unverified, or verified.
5. Identify PB UMKU Obligations
Some businesses require PB UMKU before or during operational and commercial activities. These may include sectoral approvals, product-related permits, distribution permits, technical certificates, or operational supporting licenses.
6. Check Compliance and Supervision Risks
Risk-based licensing does not end after NIB issuance. Businesses may still be subject to supervision, reporting obligations, verification, administrative sanctions, or license revocation if they fail to comply with applicable standards.
Common Business Risks Under the New Framework
Companies may face compliance risks if they:
- Operate under an incorrect KBLI
- Start operations before required permits are completed
- Treat an unverified Standard Certificate as fully operational approval
- Ignore PB UMKU obligations
- Fail to update OSS after changes in address, business activity, or company structure
- Do not align OSS data with AHU corporate documents
- Overlook environmental, building, or spatial requirements
- Assume old licenses are invalid without checking transition rules
These risks can delay business operations and create problems during audits, vendor registration, banking review, import-export procedures, or investment reporting.
Why Foreign Investors Should Pay Attention
For foreign investors, PP 28/2025 is especially important because licensing is closely connected to market entry strategy.
Before establishing or expanding a PT PMA in Indonesia, investors should review:
- Whether the business field is open to foreign investment
- The correct KBLI code
- Minimum investment requirements
- Required OSS licenses
- Sector-specific standards
- Location and zoning requirements
- Environmental and building approvals
- PB UMKU obligations
- Operational readiness timeline
A clear licensing roadmap helps investors avoid delays after incorporation and ensures the company can legally conduct its intended business activities.
How Accura Can Help
Navigating Indonesia’s business licensing system requires more than submitting forms through OSS. Companies need to understand how corporate documents, KBLI, OSS licenses, business scale, risk level, sectoral permits, and compliance obligations work together.
Accura can assist businesses with:
- OSS and NIB review
- Business licensing assessment
- KBLI and risk classification review
- PT PMA and local company licensing
- PB UMKU identification and application support
- Basic requirement review
- OSS data correction and amendment
- Corporate document alignment with AHU and OSS
- Ongoing compliance support
Whether you are establishing a new company, expanding your business activities, or reviewing existing OSS licenses, Accura can help ensure your licensing structure is compliant and business-ready.
Conclusion
PP 28/2025 marks an important step in Indonesia’s ongoing effort to improve risk-based business licensing. By replacing PP 5/2021, expanding sector coverage, strengthening OSS integration, clarifying licensing requirements, and improving supervision, the regulation provides a more structured framework for businesses operating in Indonesia.
For companies, the key message is clear: do not treat OSS licensing as a one-time administrative step. Business licenses must be reviewed, maintained, and aligned with actual business operations.
Businesses that prepare early, verify their OSS data, and understand their licensing obligations will be better positioned to operate smoothly and avoid regulatory issues.
Need assistance reviewing your OSS license, NIB, Standard Certificate, or PB UMKU requirements?
Contact Accura today for a free consultation and let our corporate specialist team help you build a compliant and efficient business structure in Indonesia.