The permits your KBLI actually requires. Handled through OSS.
NIB, Sertifikat Standar, PBG, SLF, sector permits. Set up cleanly, renewed on time, ready for the audit that comes.
Two layers, both mandatory.
Registering a company only gets you the identity number. Being allowed to operate is a separate question, and since PP 28/2025 the Sertifikat Standar is where it is answered. Everything else on this page hangs off which one your KBLI requires, and whether it self-declares or has to be verified on site.
Base license
NIB (Nomor Induk Berusaha) issued through the OSS system once the company exists
Sertifikat Standar self-declared for medium-low risk KBLIs
Sertifikat Standar verified by the responsible agency for medium-high and high-risk activities under PP 28/2025
KBLI mapping and risk classification driving what you actually need
Operational permits
PBG (Persetujuan Bangunan Gedung), the construction approval secured before building work starts. It replaced the IMB and applies to buildings generally, not only commercial ones
SLF (Sertifikat Laik Fungsi), issued after construction to certify that what was built matches what was approved and is fit to be used
Sector-specific permits: BPOM, IUJK, PSE, API-U/API-P depending on activity
KKPR (Kesesuaian Kegiatan Pemanfaatan Ruang), spatial zoning conformity where required
From KBLI to renewal, in eight moves.
01 KBLI selection and strategy
Every activity you plan needs a five-digit KBLI code, and each code sets the foreign ownership cap, the risk level, the licensing path, and the investment commitment. The choice with the most downstream consequences and the one most often revisited later at a cost.
02 NIB (Nomor Induk Berusaha)
The business identification number issued through the OSS system once the company exists. Doubles as your company registration certificate, base business licence for low-risk KBLIs, import registration, and BPJS enrolment.
03 Sertifikat Standar (self-declared)
For medium-low risk activities, you self-declare that the business will meet the applicable standards. Issued automatically through OSS. Simple, but only for the KBLIs that qualify.
04 Sertifikat Standar (verified)
For medium-high and high-risk activities under PP 28/2025, the certificate is only valid once the responsible agency has verified compliance on site. Not automatic. Takes 6 to 8 weeks typically, and this is the one most operators skip and then find out they had to have.
05 PBG (building approval)
Persetujuan Bangunan Gedung, the modern building permit that replaced IMB. Required for any commercial premises before you occupy them, whether new construction or converting existing space to commercial use.
06 SLF (safety certificate)
SLF certifies that a finished building matches the PBG it was approved against and is fit to be used. It is the follow-up to PBG, not a commercial-premises formality, and it applies to buildings generally.
The practical issue we see most often is an older building that holds only an IMB and no SLF. In that situation the SLF usually has to be obtained before a Sertifikat Standar will activate against the address, which puts it on the critical path for the whole licensing chain.
07 Sector-specific licenses
BPOM for food and cosmetics, IUJK for construction services, PSE for digital platforms and content services, API-U or API-P for import. Different agencies, different timelines, different documentation.
Tourism is the common misunderstanding here. TDUP stopped being a licensing document when OSS moved to the risk-based system, so tourism operators work from the NIB and a Sertifikat Standar matched to their risk level rather than a separate tourism registration.
08 OSS updates and renewals
When your capital changes, activities change, address changes, or shareholding shifts, OSS records need updating in sequence, and licences that expire need re-issuing before they lapse. This is where most compliance debt accumulates quietly.
The Bali-specific rules.
Bali applies a provincial layer on top of the national framework, and it moves faster than the national framework does. These four points decide whether a licensing path completes or stalls. The same provincial restrictions shape which KBLI codes a new PMA can activate, which is covered on the company setup page.
The Governor of Bali directive
Provincial directive B.27.000/642/PM/DPMPTSP restricts PMAs from registering KBLI 68111, 70209, and 79121 in Bali. Companies that intended to hold property, act as management consultancies, or run tour packages under those codes now need alternative structures.
Sertifikat Standar is the gate
For medium-high and high risk activities the Sertifikat Standar is not self-declared. The responsible agency verifies the premises before it activates, and in Bali that verification is where most timelines are actually lost. A building carrying only an old IMB will usually need its SLF in hand before the certificate will activate against that address.
OTA listing verification
Since 31 March 2026, short-term rental properties listed on Airbnb, Booking.com and Expedia must hold a verified NIB with a matching KBLI. Listings without it are delisted. Enforcement is active, not pending, and it sits alongside a wider push across the Bali tourism sector.
KKPR before anything else
Kesesuaian Kegiatan Pemanfaatan Ruang, spatial zoning conformity, has to be secured before PBG can be issued. Every tourism, F&B, or wellness project sits behind this gate, and the RDTR zoning map is the map that decides.
Three common situations.
Full licensing package
From KBLI decision through NIB, Sertifikat Standar (self-declared or verified), sector permits, and PBG/SLF on the premises you plan to occupy. All coordinated so the sequence works.
Adding a licence
A new sector permit for an activity you are expanding into (BPOM for a new product line, PSE for a new digital offering, IUJK for construction work), or a verified Sertifikat Standar upgrade from what was originally self-declared.
Fixing what is broken
OTA delist warning, SP2DK letter about licence mismatch, missing PBG or SLF, verified Sertifikat Standar never obtained. We audit the position, sequence the fixes, and get you back to compliant status.
Four steps, in the right order.
Map the licensing path
KBLI risk level, sector permits, Bali-specific requirements, sequence dependencies. Everything mapped before we file anything so no filing gets rejected for missing a prerequisite.
Register the base
NIB through OSS, then Sertifikat Standar either self-declared or verified depending on the risk level. If the certificate needs agency verification, we coordinate the site visit and follow through to issuance.
Secure operational permits
PBG before construction, SLF once the building is finished and conforms, then sector-specific permits (BPOM, IUJK, PSE, API) in the correct sequence. Some of these depend on each other and getting the order wrong resets the clock.
Maintain and renew
Track expiries, manage OSS updates when capital or activities change, coordinate re-verifications where the underlying certificate depends on ongoing conditions.
KBLI-first, Bali-informed, verification-ready.
KBLI-first thinking
We start with the code, not the company name. The right KBLI decides the risk level, the licences, the ownership rules, and what you can actually sell. Getting this right upfront saves rebuilding it later.
Bali specifics baked in
The Governor directive on restricted KBLIs, the villa licensing route via 55193 and the Pink-tourism zoning requirement, the OTA verification deadline, RDTR and KKPR. We know these because we work here.
Verified Sertifikat Standar routinely
PP 28/2025 verified certificates take six to eight weeks and need a site visit. Most agencies avoid this work or subcontract it. We handle it directly and coordinate the site verification with the responsible agency.
In-house team
No outsourced runners, no white-labelling. Everything runs through one team you know, under one roof in Bali, accountable end to end.
What clients ask before they file.
What is the difference between NIB and Sertifikat Standar?
NIB (Nomor Induk Berusaha) is the base identifier issued through OSS once the company is registered. It doubles as a company registration certificate and, for low-risk KBLIs, also as the base business licence. Sertifikat Standar is the second document that says the company meets the standards for its risk level. For medium-low risk activities it is self-declared and issued automatically; for medium-high and high risk it needs the responsible agency to verify compliance before it is valid.
My PMA is registered. Why do I still need PBG and SLF?
Company registration and building permissions are two separate systems, and holding one says nothing about the other.
PBG (Persetujuan Bangunan Gedung) replaced the IMB as the construction approval. It is secured before building work begins and it applies to buildings generally, not only to commercial premises. SLF (Sertifikat Laik Fungsi) comes afterwards and certifies that what was built matches what was approved and is fit to be used.
If you are taking on an existing building that holds only an old IMB, the SLF is usually the blocker: it needs to be in hand before a Sertifikat Standar will activate against that address.
When does a Sertifikat Standar need agency verification?
Under PP 28/2025, medium-high and high-risk KBLIs need the responsible agency to verify compliance on site before the certificate becomes valid. Medium-low risk activities can self-declare. Which category you fall into is set by the KBLI itself, not by anything the company gets to choose.
My KBLI is affected by the Bali provincial restrictions. What now?
Companies already holding an affected code and meeting their ongoing compliance obligations are not being asked to restructure. The restriction applies to new activations.
For a new setup the practical answer is not to pursue a route that will not complete. We map an alternative KBLI that covers the actual commercial activity and remains available to a PMA in Bali, and we do that before incorporation rather than discovering it afterwards.
What happens if I operate without the right sector licence?
Enforcement is real. OSS auditors and sector agencies cross-check activity against registered licences. Consequences range from an SP2DK letter (asking you to explain the discrepancy), to fines, to suspension of the NIB, which pauses your ability to operate. For tourism accommodation specifically, listings can be removed from OTAs like Airbnb and Booking.com.
Can you take over post-incorporation licensing from another agent?
Yes. This is one of the most common ways clients come to us. We audit the current position, identify what is missing or wrong, and sequence the fixes. If licences were issued in the wrong name (agent-held rather than in the company’s own name), we correct that too as part of the handover.
The conversation happens in the language you think in.
Talk to us before you commit.
A first conversation costs nothing and usually saves more than it costs. Tell us what you are planning; we will tell you straight what it takes.