Business Risk Classification Scope in Indonesia: What Does It Cover?

Business risk classification scope in Indonesia refers to the boundaries of the business activity and project being assessed under the country’s risk-based licensing system. It is not simply a permanent risk label attached to a company regardless of what that company does.

For business owners and investors, the practical task is to determine which activity is being conducted, how it is classified, where it takes place, and what licensing information applies to that particular operation. A company conducting several activities should not assume that one classification automatically covers every service, location, or operating arrangement.

What Does Business Risk Classification Cover?

A useful assessment begins by distinguishing three related concepts: the business itself, the classification describing its economic activity, and the licensing requirements associated with that activity.

A company may be incorporated to conduct certain business activities, but its registration as a legal entity does not independently establish that every planned commercial operation is covered by the same licensing output.

For example, an investor may establish a company for hospitality-related activities, but directly operating accommodation, providing management services to other operators, and offering separate guest services are not necessarily identical economic activities.

The purpose of a scope review is to establish what is actually included in the licensing analysis, not merely whether the company has an active registration number.

Understanding the Current Indonesian Licensing Framework

The official record for Government Regulation Number 28 of 2025 establishes the framework for risk-based business licensing, including basic requirements, business licensing, supporting business licensing, OSS services, and supervision.

The official regulatory summary describes risk-based licensing as an approach based on analysis of the risks associated with business activities.

The regulatory status record confirms that Government Regulation Number 28 of 2025 replaced Government Regulation Number 5 of 2021, so the former regulation must not be relied upon as current legal authority.

The official record for Minister of Investment and Downstreaming/BKPM Regulation Number 5 of 2025 identifies the procedural framework for risk-based business licensing and investment facilities through the Online Single Submission system.

The official ministerial regulation summary includes OSS administration, business licensing, supporting licensing, supervision, and other procedural matters within its regulatory scope.

These sources establish the general licensing structure. They do not mean that every industry, project scale, or operating location receives an identical risk classification or set of licensing documents.

Business Risk Classification Scope: What Owners Must Identify

Before examining the licensing output, define the business activity and the circumstances in which it will operate.

The central questions are what the business actually does, who conducts the activity, where it occurs, and which approvals or compliance requirements may relate to it.

Identify the Actual Business Activity

Start with the product or service that the business will provide to its customers.

For a consulting company, distinguish between business advisory services and other professional or operational services that may have different classifications. For a hospitality company, distinguish accommodation operation from management, marketing, catering, or other separate services when those are genuinely performed as distinct activities.

Avoid selecting a business classification solely because its title sounds commercially attractive or because another company with a similar brand uses that category.

The activity description should be compared with the relevant current classification reference and the actual operating model.

Because the risk-based licensing framework evaluates business activities, owners should assess the proposed activity and relevant project information rather than assign a risk level from an unrelated industry example.

This means that a business owner should not conclude that an operation is low-risk, medium-risk, or high-risk merely from a general internet summary of the sector.

Distinguish Separate Activities and Locations

A business may operate one service at a single location or multiple services across different premises.

A proposed expansion should be assessed against the current records rather than assuming that an earlier registration covers the entire expanded operation.

For example, a company may start with one location and later add another facility, a different service, or an independent business line. Each change presents a scope question: Is it the same registered activity, a separate economic activity, a new project location, or a combination of these?

The practical review should document the proposed activity, the operator, the location, and the existing licensing information before determining what needs updating.

Separate Business Licensing from Supporting Sector Requirements

The scope of Government Regulation Number 28 of 2025 expressly includes Perizinan Berusaha and Perizinan Berusaha untuk Menunjang Kegiatan Usaha, establishing that core business licensing and supporting business licensing are distinct regulatory subjects.

For planning purposes, distinguish the authorization for the principal business activity from any supporting permissions or other requirements relevant to the project.

A business may need to consider matters involving premises, spatial compatibility, building use, environmental conditions, or sector-specific operations. The actual requirements depend on the relevant activity and project rather than being universally identical.

The presence of one licensing document should not automatically be treated as proof that every separate project requirement has been fulfilled.

A Practical Risk Classification Scope Matrix

The following matrix helps business owners prepare the information needed to assess the scope of their activities and identify matters requiring additional verification.

Scope element	What to document	Main verification question
Principal activity	Actual product or service and revenue model	Does the selected classification describe what the business does?
Additional activities	Other distinct goods or services supplied	Do separate activities require independent classification review?
Business operator	Legal entity or person conducting each activity	Does the licensing record identify the appropriate operator?
Operating location	Premises and location information	Does the existing registration correspond to the intended project location?
Activity or project scale	Relevant operating information	Does the applicable assessment depend on project details that need confirmation?
OSS licensing output	Current documents and displayed classification	What risk category and licensing pathway are actually recorded?
Supporting permissions	Sector or project-related documents	Are additional requirements indicated for the proposed operation?
Planned expansion	New services, facilities, or operational changes	Does the change require another scope or licensing review?

The matrix is a planning instrument rather than an official government application form. Its purpose is to make the relevant business facts visible before an owner relies on a particular risk designation or licensing document.

How Business Risk Classification Affects Licensing Documents

Indonesia’s risk-based approach differentiates licensing pathways according to the applicable assessment. General explanatory materials commonly discuss low, medium-low, medium-high, and high-risk activities.

However, a business should not treat a generic description of these categories as a substitute for the licensing requirements applicable to its precise project.

For an actual licensing assessment, review the current OSS information and identify the recorded activity, risk classification, available licensing documents, and any conditions or further verification shown for the relevant project.

A useful review distinguishes between documents that have been issued, statements or certificates requiring additional confirmation, and matters that remain incomplete or unresolved.

The official output should also be examined in the context of the business’s actual operations. A technically existing registration may not answer whether a newly introduced service or additional location falls within the same recorded scope.

When the displayed classification or required documents are unclear, retain the uncertainty as an open issue rather than replacing it with an assumption copied from another business.

Bali Hospitality Example: One Business, Different Activities

Consider a hypothetical foreign investor planning a hospitality project in Bali.

The initial business plan is to operate accommodation for paying guests. Later, the investor proposes providing property management to other owners, arranging additional guest services, and opening another operating location.

These changes create several distinct questions. Which entity is providing each service? Which activities generate revenue? Are the services part of the original operating model or genuinely separate business activities? Does another project location need to be assessed?

The published Villa Business License Bali guide provides more detailed context for accommodation licensing, property-use considerations, and the relationship between business classification and a villa operation.

The relevant lesson is broader than the hospitality sector. An investor should examine the actual scope of each business activity before assuming that one classification or registration covers the complete commercial project.

Neither the use of the same company name nor the similarity of services automatically establishes that their licensing requirements are identical.

How to Review Scope Before Changing an OSS Registration

A structured review is useful when a company adds activities, changes its business model, expands locations, or discovers that its licensing records no longer clearly describe its operations.

Start by preparing a record of the current business and the proposed change. Identify the existing activity description, actual operations, current classification reference, affected location, and available OSS licensing output.

Next, compare the proposed change against the registered information. Determine whether the company is changing the nature of an activity, introducing a separate activity, adding a location, or modifying another relevant project detail.

Then identify the evidence needed to resolve any discrepancy. This may include corporate documents, activity descriptions, project information, premises documents, and the current OSS records. The precise official submission requirements should be confirmed against the applicable procedure, rather than treating this internal review list as a mandatory government checklist.

Finally, verify the resulting records after any required updates. A useful completion file should show what was changed, which activities and locations were reviewed, what licensing output was obtained, and what outstanding requirements remain.

This creates a documented basis for future expansion decisions rather than relying on a one-time registration assumption.

Conclusion

Business risk classification scope is best understood through the actual activities and projects being assessed, not as a single permanent label for an entire company.

Before establishing, expanding, or changing business operations, identify the real activity, confirm the appropriate classification, examine the applicable OSS output, and distinguish core business licensing from supporting requirements.

A clear scope record allows business owners and investors to identify unresolved compliance questions and make better-informed decisions before committing to new commercial activities.

Need to Review Your OSS Business Classification?

If you are planning a new business, adding activities, or reviewing an existing OSS registration in Bali, contact Bali Legal ID to discuss the scope of your business activities and the available company registration or licensing support.

A consultation can help identify which activity descriptions, existing records, and project-specific licensing questions should be reviewed before proceeding.

For help scoping the documents and next steps for your business or transaction, contact Bali Legal ID about our business setup services in Bali.

Read More: Business Setup Bali for PT PMA, PT PMDN & OSS RBA Registration

FAQ business risk classification scope

Is a company’s business risk classification the same for every activity?

Not necessarily. Risk-based licensing is associated with business activities and their applicable assessments. Companies operating multiple activities should review each relevant activity and its actual project details rather than assume that one risk category applies universally.

Does selecting a KBLI automatically establish the correct risk classification?

Selecting a business classification is an important step, but owners should also examine the relevant current OSS information and any applicable project-specific requirements. A code that does not match the real activity can undermine the scope assessment.

Can the same company have several business activities with different licensing needs?

Yes, different activities can raise different licensing questions. The relevant requirements should be established from the applicable current regulatory framework and OSS records rather than inferred solely from the company’s legal identity.

Is an NIB enough to operate every business activity?

No universal conclusion should be drawn from possession of an NIB alone. The required business licensing and any supporting permissions depend on the applicable activity and project. Review the actual licensing output and unresolved requirements before beginning operations.

When should an existing business reassess its risk classification scope?

A review is useful when the company introduces a new service, changes its operating model, expands to another location, modifies relevant project details, or discovers that its current licensing records may not accurately describe the business.

References & Sources

Government Regulation Number 28 of 2025 on Risk-Based Business Licensing — peraturan.bpk.go.id
Minister of Investment and Downstreaming/BKPM Regulation Number 5 of 2025 on OSS Licensing Procedures — peraturan.bpk.go.id