Indonesia’s current OSS risk classification determines the form of Business Licensing attached to a business activity. In practical terms, the four levels are low risk, medium-low risk, medium-high risk and high risk, with the licensing output escalating from an NIB to Standard Certificates and, at the high-risk level, a Permit.
The official BKPM legal database lists Government Regulation No. 28 of 2025 as in force from 5 June 2025 and records that it revoked Government Regulation No. 5 of 2021.
OSS Risk Classification PP 28 2025: The Four Levels
The current licensing outputs are easiest to understand side by side. The table below summarizes the four levels before the article explains what each one means in practice.
| Risk level | Core Business Licensing output |
|---|---|
| Low risk | NIB |
| Medium-low risk | NIB + Standard Certificate without verification |
| Medium-high risk | NIB + Standard Certificate with verification |
| High risk | NIB + Permit |
The table is a starting point rather than a complete project checklist. Location requirements, basic requirements, PB UMKU, environmental matters and sector-specific standards may still need separate review depending on the activity.
How PP 28/2025 Fits Into the Current OSS Framework
PP 28/2025 is the current overarching national framework for Risk-Based Business Licensing. The detailed OSS procedure is implemented through the current BKPM regulation.
The current OSS implementing regulation defines Risk-Based Business Licensing as business licensing that applies a risk-based approach derived from analysis of each business activity.
That wording is important for investors. Risk classification should be checked against the actual business activity being licensed rather than treated as a generic label for the company as a whole.
The official BKPM JDIH lists Minister of Investment and Downstream Industry/Head of BKPM Regulation No. 5 of 2025 as in force and records that it revoked BKPM Regulations Nos. 3, 4 and 5 of 2021.
The regulation also states that Business Licensing is processed electronically through the OSS system.
Low Risk: NIB
Under Article 186 of Regulation No. 5 of 2025, low-risk activity uses the NIB as its Business Licensing.
This is the simplest of the four core licensing outputs. It does not mean a business should ignore other project requirements, but the risk-based Business Licensing instrument for the activity is the NIB rather than a Standard Certificate or Permit.
For planning, confirm that the activity entered into OSS actually matches what the business will do. A low-risk result for one activity should not be assumed to cover a materially different activity added later.
Medium-Low Risk: NIB and Standard Certificate Without Verification
The same Article 186 states that medium-low risk requires an NIB and a Standard Certificate without verification.
For medium-low risk specifically, Article 188 provides that a business actor that has fulfilled the applicable basic requirements applies for an NIB and Standard Certificate as its Business Licensing.
The important distinction is that the Standard Certificate in this tier does not use the verification model applied to medium-high risk. Investors should still read the actual OSS output and applicable standards rather than treating the words ‘without verification’ as an exemption from all continuing obligations.
Medium-High Risk: NIB and Verified Standard Certificate
For medium-high risk, Article 186 requires an NIB and a Standard Certificate with verification.
This creates a more significant operational planning point. A company should distinguish between receiving initial OSS documents and completing the verification needed for the applicable Standard Certificate.
If a project depends on opening a facility, signing a major customer contract or starting commercial operations by a fixed date, the verification stage should be included in the licensing plan rather than assuming NIB issuance completes the process.
High Risk: NIB and Permit
For high-risk activity, Article 186 requires an NIB and a Permit.
High-risk planning therefore requires more than checking whether the company has an NIB. The relevant Permit and any prerequisites attached to that business activity need to be mapped before the project is treated as operationally ready.
This can be particularly important for capital-intensive or regulated activities because the licensing sequence can affect site commitments, procurement, construction planning and intended commencement dates.
Why Risk Classification Is an Activity-Level Planning Issue
The most useful way to apply the four-tier framework is activity by activity.
A company may have more than one business activity in its corporate and OSS profile. Those activities should not automatically be assumed to produce identical licensing outputs. Before budgeting for a new project, expansion or additional KBLI, review the risk classification and licensing output attached to that activity.
A practical sequence is:
- define the actual commercial activity
- identify the applicable KBLI used in the current licensing system
- confirm the project location
- review the risk level and resulting Business Licensing in OSS
- identify applicable basic requirements
- check whether sector-specific standards or PB UMKU are also required
- distinguish preparation-stage documents from documents needed before operational or commercial activity
This method helps prevent a common planning error: assuming that because one activity only needed an NIB, every new activity inside the same company will follow the same licensing path.
How Risk Classification Connects to SBU and Sector Licensing
OSS risk classification answers one question: what form of Business Licensing applies to the particular activity? It should not be used to assume that every sector-specific credential disappears into the NIB, Standard Certificate or Permit.
Construction, electrical, mining and industrial businesses can have separate sector-specific licensing or certification requirements. The correct scope should therefore be mapped from the actual activity and current regulatory output rather than from a generic company-setup checklist.
Jakarta Legal ID’s Business Certification SBU service covers construction and electrical business certification, including business-field classification and related certification work.
For readers who need implementation support after identifying the correct licensing path, Jakarta Legal ID lists PT PMA/PMDN setup, SBU certification, mining licences and industrial licences among its current services.
The useful distinction is to treat risk classification as the licensing framework and sector-specific certification or permits as requirements that must be checked for the particular business activity rather than assumed from the risk label alone.
Pre-Launch OSS Risk Review
Use the following matrix before treating an OSS registration as operationally complete. Its purpose is to identify where additional review is needed, not to predict approval.
| Check | Ready when | Review when |
|---|---|---|
| Actual activity | The commercial activity is clearly defined | The company uses a generic or borrowed activity description |
| KBLI | The selected classification matches the real activity | The code was copied from another company or an old project |
| Risk level | Current OSS output has been reviewed | Risk tier is being assumed from memory or an older licence |
| Low risk | NIB output is understood | NIB is being treated as proof that unrelated activities are covered |
| Medium-low | NIB and Standard Certificate requirements are understood | Continuing standards have not been reviewed |
| Medium-high | Verification is included in the project plan | Unverified status is being treated as final operational readiness |
| High risk | Required Permit and prerequisites are mapped | NIB issuance is being treated as the final licence |
| Basic requirements | Location and other applicable basic requirements are checked | Site commitments are being made before dependencies are known |
| Sector requirements | Relevant SBU, industrial, mining or other requirements are mapped | Risk tier is being treated as a substitute for sector review |
If any row remains unresolved, the useful next step is to verify the activity-specific OSS output before fixing the project’s operational date, licensing budget or external commitments.
Conclusion
The OSS risk classification PP 28 2025 is a four-level framework with materially different licensing outputs. Low risk uses an NIB; medium-low uses an NIB plus a Standard Certificate without verification; medium-high uses an NIB plus a verified Standard Certificate; and high risk uses an NIB plus a Permit.
For investors and business owners in Jakarta, the practical task is not merely to know the four labels. Confirm the classification of each real business activity, read the resulting OSS licensing output and then check the applicable basic, sector-specific and supporting requirements before treating the business as ready to operate.
Map the Licensing Path Before You Commit
If you are planning a new company, business expansion, construction activity, industrial operation or regulated project in Jakarta, Jakarta Legal ID provides business setup, SBU certification, mining licence and industrial licence services within its current service scope.
Request a consultation to review the activity, OSS risk level and expected licensing path before major project commitments are finalized.
FAQ – OSS Risk Classification PP 28 2025
What are the four OSS risk classifications under the current framework?
The four levels are low risk, medium-low risk, medium-high risk and high risk. Their core Business Licensing outputs are respectively NIB; NIB plus a Standard Certificate without verification; NIB plus a Standard Certificate with verification; and NIB plus a Permit.
Did PP 28/2025 replace PP 5/2021?
Yes. The official BKPM legal database lists Government Regulation No. 28 of 2025 as in force and records that it revoked Government Regulation No. 5 of 2021.
Does low risk mean the business only needs an NIB for everything?
Low risk means the core Business Licensing instrument for that activity is the NIB. Businesses should still check applicable basic requirements, sector-specific obligations and other requirements generated for the actual activity and project.
What is the difference between medium-low and medium-high risk?
Both use an NIB and Standard Certificate, but medium-low uses a Standard Certificate without verification while medium-high uses a Standard Certificate with verification.
Does an NIB allow a high-risk business to operate immediately?
The high-risk licensing output includes an NIB and a Permit. A business should review the Permit and applicable prerequisites rather than treating NIB issuance alone as completion of the high-risk licensing process.
Is risk classification assigned to the company or to each business activity?
The current implementation regulation defines the risk-based approach by reference to analysis of each business activity. A company with several activities should therefore review the licensing output for each relevant activity rather than assume one risk tier applies universally.
References & Sources
- Government Regulation No. 28 of 2025 on Risk-Based Business Licensing — jdih.bkpm.go.id
- Minister of Investment and Downstream Industry/Head of BKPM Regulation No. 5 of 2025 — Official JDIH Record — jdih.bkpm.go.id
- Minister of Investment and Downstream Industry/Head of BKPM Regulation No. 5 of 2025 — Official Full Text — jdih-storage.bkpm.go.id
- Jakarta Legal ID Business Licensing Services — jakartalegalid.com
- Jakarta Legal ID SBU Certification Service — jakartalegalid.com