Loading Zantara...
Zantara AI
AI Business Advisor
Topics
Zantara AI
AI Business Advisor
Bali Zero handles visas, company setup, tax and property compliance in Indonesia. Ask us directly on WhatsApp.
Chat with Bali Zero on WhatsAppIn 2025, Indonesia did not issue one regulation that affects foreign investment. It issued three. Each addresses a different dimension of the same system, and together they form a regulatory framework that no foreign investor in Bali can afford to misunderstand.
KBLI 2025 (BPS Regulation 7/2025) reclassifies every business activity in Indonesia. It determines what your company is officially recognized as doing. PP 28/2025 (Government Regulation on Risk-Based Business Licensing) assigns risk tiers to those activities, determining what permits you need and how long they take to obtain. BKPM Regulation 5/2025 defines the capital structure for foreign-owned companies, determining how much money you must commit and how you report your investment.
These three regulations are not independent. They are sequential dependencies. Your KBLI code determines your risk tier under PP 28. Your risk tier determines your licensing pathway. Your licensing pathway, combined with your KBLI codes, determines your capital commitment under BKPM 5. Change one variable — reclassify one activity code — and the entire downstream chain shifts.
This convergence creates both risk and opportunity. The risk is obvious: companies that migrate KBLI codes without understanding the PP 28 and BKPM 5 implications may find themselves in a licensing category they did not anticipate, with capital requirements they did not budget for. The opportunity is subtler but equally real: companies that understand all three regulations can structure their PT PMA to optimize across classification, risk, and capital simultaneously.
This article maps how these three regulations interact, what they mean for specific sectors popular with foreign investors in Bali, and why the correct response right now is strategic patience rather than reactive compliance.
KBLI 2025 is not a simple renumbering exercise. It is a structural realignment of Indonesia's entire business classification system to match ISIC Revision 5, the latest United Nations International Standard Industrial Classification. This alignment introduces changes that go far beyond swapping old codes for new ones.
One-to-many mappings. A single KBLI 2020 code may now correspond to multiple KBLI 2025 codes. The previous "catch-all" codes that let companies bundle diverse activities under one classification have been split into more specific categories. If your PT PMA relied on a broad code to cover several related activities, you may now need multiple codes — each with its own risk assessment and capital allocation.
Many-to-one consolidations. In some sectors, multiple KBLI 2020 codes have been merged into a single KBLI 2025 code. This simplifies compliance for companies that previously held redundant codes, but it requires verifying that the consolidated code still covers all your actual activities.
The digital economy split. KBLI 2025 separates traditional telecommunications (now under Category J — Information and Communication) from financial technology (now under Category K — Financial and Insurance Activities). Fintech companies that were previously classified alongside IT services now sit in the financial services category, inheriting different regulatory oversight, different risk tiers, and different foreign ownership limits. This is not a cosmetic change. It fundamentally alters the compliance landscape for any Bali-based business operating at the intersection of technology and finance.
New codes with no history. KBLI 2025 introduces entirely new classifications — codes that did not exist in KBLI 2020 and therefore have no established risk assessment, no processing timeline, and no licensing precedent. These "BPS Only" codes exist in the statistical classification but await formal integration into the PP 28 risk framework. Companies whose activities match these new codes face a regulatory gap that requires careful navigation.
BPS Regulation 7/2025 established a June 2026 transition window that has now closed. After this date, KBLI 2020 codes become "ghost codes" — technically present in your NIB (Nomor Induk Berusaha) but unrecognized by the updated OSS system. Ghost codes cannot be used for new license applications, permit renewals, or NIB amendments. Your company continues to exist, but its ability to transact with the regulatory system is effectively frozen until migration is completed.
The practical implication is that migration is not optional, but neither does it reward unsupported haste. Verify the live OSS workflow before changing KBLI data. Rushing through partial mappings creates its own risks, particularly if intermediate codes or temporary mappings do not accurately reflect your business activities.
If KBLI 2025 defines what your business is, PP 28/2025 defines what your business must do to operate legally. It is the regulation that transforms a classification code into a licensing requirement.
PP 28/2025 assigns every KBLI code to one of four risk levels, each with a distinct licensing pathway:
| Risk Level | Indonesian Term | Requirement | Processing |
|---|---|---|---|
| Low | Rendah | NIB only | Automatic |
| Medium-Low | Menengah Rendah | NIB + Sertifikat Standar (self-declared) | 1-7 days |
| Medium-High | Menengah Tinggi | NIB + Sertifikat Standar (verified) | 7-14 days |
| High | Tinggi | NIB + Izin (full license) | 14-29 days |
Low risk activities require only a NIB — your basic business identification number. No additional permits, no inspections, no waiting periods. You register, you receive your NIB, you operate.
Medium-Low risk requires a Sertifikat Standar based on self-declaration. You certify that your business meets the applicable standards, and the system accepts your declaration without verification. This is a trust-based mechanism.
Medium-High risk requires the same Sertifikat Standar, but with third-party verification. An inspector or certified auditor must confirm that your business actually meets the declared standards before the certificate is issued.
High risk requires a full Izin — a formal license issued after comprehensive review, which may include site inspections, document verification, technical assessments, and inter-agency consultation. This is the most demanding and time-consuming pathway.
PP 28/2025 includes a provision that is both powerful and widely misunderstood: Fiktif Positif (deemed approval). If the licensing authority fails to process your application within the prescribed timeline, your application is automatically deemed approved. A Medium-High risk application not processed within 14 days? Approved. A High risk application sitting untouched for 30 days? Approved.
In theory, this mechanism prevents bureaucratic bottlenecks from indefinitely delaying business operations. In practice, it requires meticulous documentation. You must prove that your application was complete, properly submitted, and that the timeline expired without action. Incomplete applications or those requiring clarification restart the clock. Fiktif Positif is a safety net, not a shortcut.
When a KBLI code is remapped from 2020 to 2025, its risk level may change. A previously Low risk activity might become Medium-High. A Medium-High activity might drop to Low. These shifts are not academic — they directly change your compliance obligations.
If your existing PT PMA holds a code that was Low risk under KBLI 2020 but is now Medium-High under KBLI 2025, migration is not just a code swap. It triggers a re-assessment. You may need to obtain Standard Certificates that were never previously required, undergo verifications that were never previously conducted, and demonstrate compliance with standards that were never previously applied to your business.
This is why understanding PP 28/2025 before migrating your KBLI codes is essential. The migration itself is mechanical — old code maps to new code. The licensing implications are not.
BKPM Regulation 5/2025 restructures the financial requirements for PT PMA companies in a way that is frequently misunderstood — often to the detriment of investors who plan their capital based on outdated or incorrect information.
Paid-up capital: IDR 2.5 billion (approximately USD 155,000). This is the minimum amount that must be actually deposited in the company's bank account. It is real money, not a projection or a promise.
Total investment plan: IDR 10 billion per KBLI code (approximately USD 620,000). This is the total projected investment over the life of the investment plan, including paid-up capital, loan capital, equipment, office space, and operational costs. It is a plan, not an immediate cash requirement.
The distinction is critical. Under the previous framework, the IDR 10 billion figure was often presented as an upfront capital requirement, deterring smaller investors. BKPM 5/2025 clarifies that IDR 2.5 billion is the actual cash minimum, while the IDR 10 billion is a structured investment projection that unfolds over time.
The IDR 10 billion investment plan applies per KBLI code. A PT PMA with three KBLI codes must demonstrate a total investment plan of IDR 30 billion across all three activities. This does not mean IDR 30 billion in cash — it means your investment plan must show how capital will be deployed across all registered business activities over the investment period.
This per-code structure creates a strategic consideration: every KBLI code you add to your PT PMA increases your total investment commitment. Companies that accumulated codes under KBLI 2020 as a "just in case" strategy now face a tangible cost for each code they carry. Migration to KBLI 2025 is an opportunity to audit and rationalize your code portfolio.
BKPM 5/2025 maintains the LKPM (Laporan Kegiatan Penanaman Modal) reporting requirement. PT PMA companies must submit quarterly investment activity reports detailing capital deployment, employment, production, and export activities. Non-compliance with LKPM reporting can result in sanctions including license suspension.
The LKPM is not a formality. BKPM actively monitors compliance, and the data feeds into investment policy decisions. Companies that treat LKPM as a checkbox exercise risk audit findings that complicate future license amendments or expansions.
Retail is where the regulatory convergence hits hardest for Bali's foreign investor community. The combination of KBLI reclassification, risk reassignment, and capital structuring creates a complex landscape that varies dramatically by retail format.
Alcohol retail under KBLI 47221 carries a Tinggi (High Risk) classification — the most demanding tier. Operators need a full SIUP-MB (Surat Izin Usaha Perdagangan Minuman Beralkohol), which requires demonstrating compliance with location restrictions, storage standards, and distribution chain documentation. In Bali, where alcohol retail is central to the tourism economy, this code intersects with local regulations on alcohol sales proximity to schools and religious sites.
The distinction between "large format" and "small format" retail hinges on 400 square meters of sales floor area. Above 400 sqm, retail is generally open to 100% PMA ownership. Below 400 sqm, the activity is classified as small-scale retail and falls under SME protection provisions that restrict or prohibit foreign ownership.
For Bali's boutique retail scene — fashion stores, surf shops, artisan goods — this threshold is the regulatory boundary. A 350 sqm boutique in Seminyak is structured differently from a 450 sqm retail space in the same street. The 100 sqm difference changes the ownership model entirely.
KBLI 2025 distinguishes between e-commerce merchants (sellers using existing platforms like Tokopedia or Shopee) and e-commerce platform operators (companies building and running the marketplace infrastructure). Platform operators may qualify for 100% PMA and fall under IT/digital codes with their own risk profiles. Merchants follow the retail classification of whatever they sell, subject to the same format and scale restrictions that apply to physical retail.
Foreign construction companies in Bali must hold an SBUJK (Sertifikat Badan Usaha Jasa Konstruksi) — a construction business entity certificate that is separate from and additional to the NIB and KBLI-based licensing. KBLI 2025 reclassifies several construction subcategories, and each reclassified code requires SBUJK revalidation.
The villa construction boom in Bali makes this particularly relevant. Companies building villas for foreign buyers need construction codes that match their actual activities — general construction, specialty trades, project management — and each code carries its own SBUJK grade, risk tier, and capital requirement.
Bali's manufacturing sector — wood carving, stone carving, jewelry — intersects with both KBLI reclassification and international compliance requirements.
Wood and wood products manufacturing requires SVLK (Sistem Verifikasi Legalitas Kayu) certification — Indonesia's timber legality verification system. SVLK compliance is mandatory for any business processing or exporting wood products, and it operates independently of the KBLI/PP 28 framework. A furniture manufacturer needs both the correct KBLI code with its associated risk-tier licensing and SVLK certification.
Jewelry manufacturing under KBLI 2025 is classified separately from jewelry retail. Manufacturing codes carry different risk assessments than retail codes, and the capital investment structure differs accordingly. A Bali-based silver jewelry workshop that both manufactures and sells directly to consumers needs codes for both activities — each with its own compliance pathway.
Foreign-owned educational institutions in Bali face a structural choice that predates KBLI 2025 but is complicated by it: operate as a Yayasan (non-profit foundation) or as a PT PMA (foreign investment company).
Yayasan structures are traditionally used for schools, training centers, and educational non-profits. They have different governance requirements, tax treatment, and regulatory oversight than PT PMAs. However, a Yayasan cannot distribute profits to founders, which makes it unsuitable for commercially-oriented education businesses.
PT PMA structures allow profit distribution but subject the educational activity to KBLI classification, PP 28 risk assessment, and BKPM 5 capital requirements. A PT PMA operating a language school needs the correct education KBLI code, the associated risk-tier permits, and the capital investment plan — obligations that a Yayasan avoids.
KBLI 2025 reclassifies several education subcategories, and the risk tiers for educational activities vary significantly. A coding bootcamp, a yoga teacher training program, and a formal international school each fall under different codes with different compliance requirements.
A Bali beach club is not one business. It is four or more businesses operating under one roof: food service, beverage service (including alcohol), entertainment/events, and potentially accommodation or retail. Under KBLI 2025, each activity requires its own code, and each code carries its own risk tier.
A typical beach club might need: 56101 (restaurant, Medium-Low risk), 56301 (bar/nightclub, Medium-High risk), 47221 (alcohol retail, High risk), and 93292 (entertainment venue, varies). The highest-risk code in your portfolio defines your ceiling compliance burden, and each code adds to your total investment plan under BKPM 5/2025.
Spa and wellness businesses in Bali face a specific tax exposure that intersects with the KBLI convergence: PBJT (Pajak Barang dan Jasa Tertentu), the specific goods and services tax applied to entertainment and wellness services. PBJT rates for spa services range from 40% to 75% depending on the local government regulation — rates that can fundamentally alter business viability if not anticipated during planning.
The KBLI code you select for a spa or wellness business determines which PBJT category applies. Misclassification does not just create a licensing problem — it creates a tax problem that compounds with every transaction.
Given the convergence of three major regulations, live OSS workflow uncertainty, and the complexity of cross-regulation interactions, the correct strategic response for foreign investors is not to rush. It is to verify methodically.
Map your current state. Document every KBLI 2020 code your PT PMA currently holds. For each code, identify the KBLI 2025 equivalent (or equivalents, in one-to-many scenarios). Determine the PP 28/2025 risk tier for each new code. Calculate the BKPM 5/2025 capital implications of your new code portfolio.
Identify gaps. Are there activities your business performs that are not covered by your current codes? Are there codes you hold but do not actually use? Migration is an opportunity to align your classification with your actual operations — not just to swap old numbers for new ones.
Assess risk tier changes. If any of your codes moved to a higher risk tier, identify the new licensing requirements. Determine what documentation, certifications, or verifications you will need. Keep these materials assembled before the next filing, amendment, or audit creates time pressure.
Monitor OSS updates. The system will be updated to support KBLI 2025 codes before the June deadline. When the update goes live, verify that the code mappings, risk tiers, and licensing pathways match your audit findings. Discrepancies between published regulations and system implementation are not uncommon.
Do not register with "closest match" codes. This is the single most dangerous mistake in the migration process. If your exact KBLI 2025 code is not yet available in OSS, registering under a similar-but-different code creates a permanent compliance problem. The wrong code means the wrong risk tier, the wrong permits, the wrong capital structure, and potentially the wrong foreign ownership limits. It is far better to wait for the correct code than to register under an incorrect one.
Validate with legal counsel. Before submitting any migration, have your KBLI code selection, risk tier assessment, and capital plan reviewed by qualified Indonesian legal counsel. The interaction between three regulations creates edge cases that automated systems and general guidance cannot anticipate.
With your audit complete, your documentation assembled, and the OSS system updated, execute the migration. Submit complete applications with all required supporting documents. Monitor processing timelines. Invoke Fiktif Positif only if necessary and with proper documentation.
The companies that will navigate this convergence most successfully are not the ones that move fastest. They are the ones that move most accurately.
Planning a PT PMA in Bali or migrating existing KBLI codes? Bali Zero provides end-to-end regulatory advisory covering KBLI 2025 classification, PP 28/2025 risk assessment, and BKPM 5/2025 capital structuring. We audit your current compliance position and build a migration strategy that optimizes across all three regulations. Contact us for post-window KBLI guidance.