A Sertifikat Standar is the document that turns a business classification into a business you are actually permitted to run. The NIB records which KBLI codes a company is registered against, and for a great many of those codes the registration by itself authorises nothing. The Sertifikat Standar is what brings the code to life, by attesting that the company meets the standard the government has set for that particular activity, and until it exists and holds the right status the code on the NIB is a description rather than a permission.
Since PP 28/2025 replaced the previous licensing regulation in June 2025, and since business classifications were converted to KBLI 2025 in OSS, that distinction has become a live problem for a specific group of companies: those whose activity now sits at medium-high risk, where the certificate is issued unverified and does not authorise trading until a government agency has checked it.
What PP 28/2025 changed
PP 28/2025 was enacted on 5 June 2025 and replaced PP 5/2021 as the regulation governing risk-based business licensing. It brought six further sectors into the regime, including creative economy, geospatial information, cooperatives, investment, electronic systems and transactions, and environment. It also introduced continuous compliance at Pasal 240 and 241, which means the licensing relationship does not end when the NIB is issued and the government expects to supervise the business periodically after that.
The four risk levels kept their familiar shape, and the difference between two of them is where the difficulty sits.
| Risk level | What is issued | What it takes to trade |
|---|---|---|
| Low | NIB only | The NIB issues automatically and is sufficient |
| Medium-low | NIB and Sertifikat Standar | A self-declaration in OSS, with an SPPL or UKL-UPL where the activity requires one |
| Medium-high | NIB and Sertifikat Standar, issued unverified | A government agency must verify by document check, site inspection, or both, and notify OSS before commercial operation may begin |
| High | NIB and a full Izin | The permit itself |
Unverified is not a formality
At medium-high risk, OSS issues the Sertifikat Standar first and marks it belum terverifikasi, not yet verified. The document exists, it carries the company name, it can be downloaded and printed, and it looks like every other certificate in the system. What it does not do is authorise commercial or operational activity, and that authority only arrives once the verifying agency has satisfied itself that the standard has been met and has sent a notification back to OSS, at which point the status changes and the business is licensed.
Verification is carried out by the central government, the provincial or regency government, a KEK administrator or a KPBPB authority, depending on which of them holds the relevant competence for the activity. It can involve a review of documents, an inspection of the premises, or both.
The practical consequence is that a company can be trading for months on a certificate that was never verified, in the belief that possession of the document was the end of the process. Nothing in OSS interrupts this. The status is visible to anyone who looks, and the moment somebody looks is usually an inspection, a licence renewal, or a transaction where the buyer’s advisers read the file.
What has to be in place before verification
Verification tests whether the business meets the standard for its activity, and a good deal of that standard sits in documents that have nothing to do with OSS itself. Before the certificate can be verified, the company needs its basic licensing complete: spatial conformity for the location, environmental approval appropriate to the activity, a building approval, and a certificate of functional eligibility. The SLF is mandatory, not something that can be left until later.
Those last two are the ones that catch accommodation and hospitality businesses in Bali, because PBG and SLF are frequently missing on buildings that were finished and occupied without them. A Sertifikat Standar that depends on an SLF cannot be verified while the SLF does not exist, and obtaining one for a building already standing is a different exercise from obtaining one for a building being designed.
What the verification asks for
A Sertifikat Standar certifies that a business meets the standard written for its activity, and those standards are built around facilities, infrastructure, equipment and people rather than paperwork alone. What follows is the general shape of what a verification draws on. It is not an exhaustive list, and the sector group at the end is where two companies with near-identical premises can find themselves facing quite different requirements.
Corporate and identity
- NIB, carrying the classification the certificate is sought against
- Deed of establishment and the most recent amendment, with the Ministry of Law approval from AHU-Online
- Identity of the directors or their authorised representative, drawn from the population administration system
- Company tax registration
- Evidence of paid-up capital, where the standard for that classification sets one
Location and building
- Spatial conformity for the location
- Evidence of rights over the land and the building, whether a certificate or a registered lease
- Building approval
- Certificate of functional eligibility, which is mandatory
- Floor plans and technical drawings of the premises
Environment
- The environmental approval appropriate to the scale of the activity, being an SPPL, a UKL-UPL or an AMDAL
Facilities, equipment and safety
- The facilities, infrastructure and equipment the standard specifies for that activity
- Fire prevention and protection provisions, extinguishers, evacuation routes and exit signage
- First aid provision and an emergency response arrangement
- Records of periodic inspection of the safety equipment
The safety items in that group are required of every business, whatever its classification. The facilities and equipment alongside them are the ones that change according to the standard written for the particular activity.
People and operations
- Organisational structure and workforce data
- Competence certification for the roles the standard requires it for
- Operating procedures, or the management system the standard describes
- A signed statement of compliance with the standard
Sector certification
- Whatever the standard written for that particular classification requires, which is the group that varies most and the one most often underestimated
Two examples show how much that last group carries. A restaurant sits under closer supervision because the activity touches public health directly, so the standard reaches into food safety, hygiene and the facilities themselves, and the operator is expected to hold a hygiene and sanitation certificate issued by the local health authority. Accommodation is examined against environmental health quality standards and carries a health suitability certificate of its own, alongside tourism business registration and the fire protection arrangements that come with putting guests in a building overnight. A company that assembled only its corporate documents would not complete either verification.
Why this arrived now
The second half of the story is the classification change. When an activity is converted from KBLI 2020 to KBLI 2025, it can land at a different risk level than the one it previously carried. Where it moves from medium-low to medium-high, a self-declaration the company made itself becomes a verification a government agency has to perform, documents that were never previously requested become mandatory, and in some cases what was a Sertifikat Standar becomes a full permit.
This is the same reclassification we wrote about when 68111 became six codes. The consequence there was that a successor code might carry a different risk level, and this is what that difference means once it reaches the licensing system.
There is a related trap worth naming, because it is common and it is not a technicality. Short-term rental to tourists is accommodation, and it belongs in the 55 series of classifications rather than under real estate at 68111. A property company renting nightly on a real estate classification is operating outside the activity its licence describes, whatever the state of its Sertifikat Standar.
How long it takes
PP 28/2025 puts time limits on the government rather than only on the business. Examination runs to up to 50 working days, with the actual period depending on which technical assessments the activity requires. Where a submission falls short it comes back for correction before the verification can complete, which is the most common reason one takes longer than the company expected.
The capital can sit inside the standard itself
The standard that a Sertifikat Standar attests to is set per classification in the sectoral rules, and for some classifications that standard carries a minimum capital of its own. Where it does, the figure is above IDR 10 billion, about USD 565,000, rather than the general minimum paid-up capital of IDR 2.5 billion, about USD 141,000, that applies to a PT PMA. It is a condition of the certificate rather than a separate matter of company law, so the classification a company registers under determines its risk level, its documents, and in some cases its capital as well.
Most companies are not affected by this. The ones that are tend to discover it during a licensing review rather than at the point they chose the classification, which is the wrong end of the process to find out, and it is a short conversation to have before the structure is set.
What to check
Open your Sertifikat Standar in OSS and read its status rather than its existence. If it says belum terverifikasi, establish which agency holds the competence for your activity and what their standard requires, and treat that as the outstanding item it is. Check which KBLI 2025 code your activity converted to and what risk level came with it, since a company that was correctly self-declared under the old classification may be sitting at medium-high under the new one. Then look at whether the basic licensing behind the certificate is genuinely complete, in particular the building approval and the certificate of functional eligibility, because a verification cannot succeed while those are missing. If your classification is one that carries a capital condition in its standard, that belongs on the same list.
Correct at the date of publication. Currency conversions are approximate, at August 2026 rates. Risk levels, documents and standards are classification-specific and should be checked against your own KBLI in OSS. See also what KBLI 2025 changed, or know more about licensing.