Risk Class Is Destiny in Bali Now

For years, the first question a foreigner asked about a business in Indonesia was "is it open to foreign ownership?" In Bali, since 13 May 2026, that is the wrong first question. The question that now decides your fate is colder and less intuitive: what risk class does the OSS system assign your activity?

Risk class used to be a back-office detail — it set how much licensing paperwork you'd face. Now it is the gate. Under the Bali moratorium, risk class decides whether you can register at all.

The four classes, and the line that matters

Every KBLI activity in the OSS system is rated, scale by scale, into one of four risk bands. In rising order they are:

• Rendah — low risk
• Menengah Rendah — medium-low risk
• Menengah Tinggi — medium-high risk
• Tinggi — high risk

The Governor's letter (B.27.000/642/PM/DPMPTSP) draws one line through that ladder: it blocks new PMA registration for everything rated low or medium-low (Rendah and Menengah Rendah), island-wide. Above the line — medium-high and high — survives. Below the line — the supposedly "easy," low-paperwork activities — is shut.

So the intuition inverts. The businesses that used to be easiest to license (low risk, automatic NIB, minimal inspection) are now the ones a foreigner cannot have. The ones with heavier risk profiles are the ones that pass.

Why a PT PMA reads the Besar row

There is a crucial mechanical detail. The OSS system rates each activity separately at each business scale — Mikro, Kecil, Menengah, Besar. A PT PMA is, by law, a large-scale (Besar) enterprise. So the only risk row that matters for a foreigner is the Besar one.

This is why two activities that feel similar can split. Take game/software development (62110): at micro, small, and medium scale it is rated medium-low — but at Besar scale it rises to Menengah Tinggi (medium-high). That escalation at the top scale is exactly what carries it over the moratorium line. A foreigner registers at Besar, reads the medium-high row, and passes.

Same sector, opposite fate

The clearest way to feel the rule is to watch neighbours diverge:

• Bar (56301) is registrable — its risk class survives. Café (56303) is blocked — low-risk, caught by the line. Same street, same drinks license intuition, opposite outcome.
• Private clinic (86105) is registrable — medical activity carries genuine risk weight. Lighter wellness and cosmetic activities next door often fall below the line and are blocked.
• Wholesale jewellery (46494) is blocked precisely because it is low-risk — a clean, simple trading activity with little to inspect, and therefore exactly what the moratorium reserves for local operators.

None of these outcomes follows from the national ownership rule. All of them follow from risk class.

What to do with this

The practical move is to stop thinking in sectors ("hospitality," "retail," "tech") and start thinking in risk classes. When you map your plan:

1. Find the exact 2025 KBLI code for what you actually do.
2. Read its Besar-scale risk class, not the micro one.
3. If it's Rendah or Menengah Rendah, assume it's blocked in Bali and hunt for the higher-risk sibling that does the same job.

That sibling frequently exists — a more substantial, higher-risk version of the activity that the system rates medium-high. Choosing it is not gaming the rule; it is registering as the serious, large-scale operator a PT PMA is supposed to be.

Risk class is now the single most decision-relevant fact about any Bali business code. It is also invisible on the national investment lists the old blogs quote — which is why they keep sending people into walls.

Look up the Besar-scale risk class and the live Bali status of your exact code on the Bali Zero KBLI Navigator at balizero.com — the national status and the Bali risk-class verdict sit side by side, so you can see the line your activity falls on before you commit capital.