7 Critical Changes in Risk-Based Licensing in Bali and Lombok: What Foreign Investors Must Master

Why Understanding Risk-Based Licensing in Bali and Lombok Is Crucial for Foreign Investors

Setting up a business in paradise can quickly turn into a bureaucratic nightmare when compliance is overlooked. Many foreign companies entering Bali and Lombok underestimate the complexity of Indonesia’s licensing framework, until costly delays, stalled projects, or revoked permits force them to rethink their strategy. A single missing document or misclassified activity under the OSS system can freeze operations for months, draining both time and capital.

That’s why mastering risk-based licensing in Bali and Lombok has become a critical step for every foreign investor. Since Indonesia’s business environment is increasingly guided by a risk-based approach, understanding how your business is categorized, low, medium, or high risk, determines not only the speed of approval but also the type of permits required to operate legally.

This article unpacks the essentials: what risk-based licensing actually means, how Government Regulation No. 5 of 2021 (GR 5/2021) introduced the framework, and how the updated Government Regulation No. 28 of 2025 (GR 28/2025) reshapes the rules. We’ll explore how risk levels are assigned, how they affect business setup in Bali and Lombok, and the practical steps every foreign company should take to stay compliant. Whether you’re planning a beach resort, wellness retreat, or trading company, understanding these rules is the foundation for doing business right in Indonesia’s most dynamic regions.

Understanding the Core of Risk-Based Licensing in Bali and Lombok

At the heart of Indonesia’s modern investment framework lies the concept of risk-based licensing in Bali and Lombok, a system introduced through Government Regulation No. 5 of 2021 (GR 5/2021). This approach replaces the old, one-size-fits-all licensing model with a structure that classifies business activities based on their potential impact on public safety, environment, and economy. Instead of treating every company the same, it tailors licensing obligations according to the risk level of each business activity.

Under GR 5/2021, all activities are categorized into four levels: low, medium-low, medium-high, and high risk. The classification is determined using the KBLI (Klasifikasi Baku Lapangan Usaha Indonesia), Indonesia’s official business classification code. These codes define what kind of documentation and licenses a company must secure through the OSS (Online Single Submission) system.

• Low-risk businesses only require a Business Identification Number (NIB), which serves as the company’s legal operating ID.
• Medium-risk activities require an NIB plus a Standard Certificate, confirming compliance with specific operational standards.
• High-risk sectors must obtain an NIB and formal Business License, often involving environmental assessments, safety certifications, or sectoral approvals.

For foreign-owned enterprises in Bali and Lombok, these distinctions are particularly significant. Tourism, hospitality, real estate, and marine activities, key sectors in these islands, typically fall under medium-high or high-risk categories. This means investors must navigate not only national compliance but also local zoning and environmental standards.

In short, understanding how your KBLI code aligns with risk classification can make or break your investment timeline. For anyone planning expansion or setup, risk-based licensing in Bali and Lombok is not just an administrative step, it’s the foundation of sustainable and compliant operations.

Key Provisions of GR 5/2021 That Shape Risk-Based Licensing in Bali and Lombok

The introduction of risk-based licensing in Bali and Lombok through Government Regulation No. 5 of 2021 (GR 5/2021) marked a major transformation in Indonesia’s business environment. Prior to this reform, companies faced a complex and fragmented licensing landscape, each sector requiring separate permits from multiple ministries, often leading to overlapping requirements and long approval timelines. GR 5/2021 streamlined this system by integrating all licensing activities under the Online Single Submission (OSS) platform, managed by the Investment Coordinating Board (BKPM).

Under this regulation, every business activity is now assessed based on its risk level, shifting Indonesia from a “licence-before-operation” model to a risk-based compliance approach. This means that not every investor must obtain multiple permits before starting operations; instead, the type and number of licences depend on how risky the activity is deemed to be.

For example, tourism, hospitality, manufacturing, trade, construction, and agriculture sectors heavily represented in Bali and Lombok are now subject to the risk-based licensing system. A foreign-owned resort in Bali or a real estate project in Lombok must identify its specific KBLI (Klasifikasi Baku Lapangan Usaha Indonesia) code and ensure that the registered activity matches the correct risk category. An incorrect KBLI or misunderstanding of the risk classification could lead to licensing delays, OSS rejections, or even compliance sanctions later during audits.

For foreign investors, this framework brings both convenience and responsibility. While the OSS system simplifies submissions, it also requires a precise understanding of the regulatory obligations behind each KBLI. Medium-high and high-risk sectors, common in tourism, accommodation, and marine activities, carry additional requirements such as environmental impact assessments (AMDAL), building and zoning compliance, and sectoral permits from local authorities.

In essence, GR 5/2021 has replaced bureaucratic hurdles with a transparent, structured system, but it demands diligence. For companies setting up in Indonesia’s fast-growing regions, understanding and correctly applying risk-based licensing in Bali and Lombok is the first step to achieving both legal certainty and operational readiness.

GR 28/2025: New Rules for Risk-Based Licensing in Bali and Lombok

In June 2025, Indonesia introduced Government Regulation No. 28 of 2025 (GR 28/2025), which officially replaced GR 5/2021 and modernized the nation’s investment and business licensing framework. This new regulation continues the foundation of risk-based licensing in Bali and Lombok, but with major updates designed to improve clarity, coordination, and efficiency for investors, particularly foreign-owned companies operating in the region.

One of the key shifts under GR 28/2025 is the expansion of sector coverage, increasing from 16 to 22 business sectors, now including more detailed classifications for tourism, creative economy, energy, and logistics. This expansion is significant for areas like Bali and Lombok, where hospitality, eco-tourism, and renewable energy projects are central to economic growth. Businesses that were previously operating under undefined or overlapping KBLI codes now fall under more specific categories, offering greater legal certainty.

The OSS (Online Single Submission) system has also been upgraded from five to eight digital subsystems, improving integration across ministries and local governments. Importantly, GR 28/2025 introduces a “fiktif positif” mechanism a deemed-approval rule that automatically grants certain permits if government agencies fail to respond within a prescribed period. This is a major step toward faster processing times and enhanced investor confidence, especially for compliant foreign companies that meet all documentary requirements on time.

For existing businesses, transitional provisions ensure that licences issued under GR 5/2021 remain valid, unless GR 28/2025 provides a more favourable condition. Companies have a migration period to update their data on the latest OSS platform and align with the new modules.

However, with these benefits come tighter post-licensing supervision and digital compliance audits. The government now uses integrated verification and monitoring tools to ensure businesses maintain conformity with their declared risk level and activity.

For foreign investors and operators, risk-based licensing in Bali and Lombok has become both easier and more demanding: easier in application, but stricter in enforcement. The takeaway is clear, compliance is no longer a one-time obligation, but a continuous process embedded in your business operations.

Applying Risk-Based Licensing in Bali and Lombok: A Step-by-Step Guide for Foreign Companies

Understanding how risk-based licensing in Bali and Lombok operates in practice is essential for foreign investors planning to open or expand their businesses. Under GR 28/2025, the process begins with correctly identifying your KBLI (Indonesian Standard Business Classification) code — the foundation for every license application. Each KBLI corresponds to a specific business activity, such as operating a tourism villa, spa, restaurant, or real estate development project, and determines your company’s risk level.

Once your KBLI is identified, the OSS (Online Single Submission) system will automatically classify your activity as low, medium, or high risk. This classification determines the scope of compliance:

• Low-risk businesses (e.g., small online stores or consulting firms) only require a Business Identification Number (NIB).
• Medium-risk activities (e.g., boutique hotels or wellness centers) need an NIB plus a Standard Certificate, confirming adherence to specific business standards.
• High-risk operations (e.g., beach clubs, real estate developments, or large-scale resorts) must secure an NIB plus formal Business License, along with ongoing supervision and periodic reporting obligations.

For instance, a beach club in Bali would fall under the high-risk category due to its environmental and public safety implications. It would require an NIB, business licence, and environmental permits, while a small e-commerce startup in Lombok would only need an NIB.

What makes risk-based licensing in Bali and Lombok particularly intricate is the influence of regional zoning (RTRW) and tourism spatial classification. Local governments often integrate building and environmental approvals directly into the OSS platform as principal licenses under GR 28/2025.

Common pitfalls include choosing the wrong KBLI, underestimating the risk level, or relying on outdated licensing regulations from pre-2025 frameworks. To avoid these mistakes, foreign companies should work closely with experienced local consultants who understand the intersection between national OSS rules and regional enforcement across Bali and Lombok.

Legal and Compliance Risks of Mismanaging Risk-Based Licensing in Bali and Lombok

Mistakes in risk-based licensing in Bali and Lombok can create severe consequences for foreign-owned companies. Under Government Regulation No. 28 of 2025 (GR 28/2025), Indonesia’s licensing regime has become more transparent, but also significantly stricter. Authorities now conduct post-licensing audits to ensure that each company operates within the declared risk classification and complies with national and regional standards.

When a business fails to comply, the outcomes can be costly. The revocation of a business licence can immediately halt operations, leading to financial losses and contract breaches. A delayed OSS update or incorrect risk classification can also cause months-long project delays or prevent companies from obtaining crucial secondary permits. In some cases, companies have faced temporary shutdowns until they corrected their OSS documentation or underwent compliance inspections.

For foreign investors in Bali and Lombok, these issues are more than administrative headaches, they directly affect critical business functions. An invalid or outdated licence can jeopardize:

• Visa sponsorships, since foreign employees depend on legally recognized entities.
• Land and lease agreements, as landlords often require valid OSS records.
• Banking relationships, with banks obligated to verify the authenticity of a company’s licence before facilitating transactions.
• Financing and project approvals, as investors and lenders rely on clean compliance documentation before disbursing funds.

Risk-based licensing in Bali and Lombok also ties into environmental and community obligations. For example, high-risk projects like beachfront developments or spas must periodically report on environmental compliance; failing to do so can lead to fines or permit suspension.

With GR 28/2025, regulators such as the BKPM (Investment Coordinating Board) and local DPMPTSP offices are empowered to perform data-driven enforcement. This means inconsistencies in your OSS account can automatically trigger red flags for inspection.

Ultimately, foreign companies must view compliance not as a one-time licensing exercise but as a continuous responsibility. Partnering with experts who understand both national OSS protocols and local enforcement practices in Bali and Lombok is now indispensable for ensuring long-term operational stability and investor confidence.

Compliance Checklist for Foreign Companies Navigating Risk-Based Licensing in Bali and Lombok

Foreign investors entering the Indonesian market must approach risk-based licensing in Bali and Lombok with careful preparation and structured documentation. The process under GR 28/2025 may appear digital and simplified, but each step carries compliance obligations that directly affect business legality and continuity. Below is a practical step-by-step checklist to help foreign-owned entities stay compliant from the start:

1. Define Your Business Activity and Choose the Correct KBLI Code
   Begin by clearly identifying your operational activity, whether it’s a resort, café, spa, or consulting firm and match it with the correct KBLI (Indonesian Standard Business Classification). The KBLI code determines your risk level and the exact type of licence you must secure under risk-based licensing in Bali and Lombok.
   
   
2. Assess Risk Level (Low, Medium-Low, Medium-High, or High)
   Each KBLI category carries a risk profile. For example, hospitality or real estate development is typically medium-high to high risk, requiring additional approvals. Understanding this helps forecast compliance costs and inspection frequency.
   
   
3. Register for NIB via OSS (Online Single Submission)
   All companies must first obtain a Nomor Induk Berusaha (NIB). Under risk-based licensing in Bali and Lombok, low-risk activities stop here, while medium or high-risk operations must proceed with further certifications or licenses.
   
   
4. Apply for Standard Certificates or Licenses if Required
   For medium or high-risk businesses, the OSS platform will request technical approvals or standard certificates based on your KBLI. Under GR 28/2025, there are now eight OSS subsystems to verify all sectoral compliance digitally.
   
   
5. Align Local Permits with OSS Data
   Ensure your zoning (RTRW), environmental, and building permits match your OSS classification. Discrepancies between local DPMPTSP records and OSS data are one of the most common causes of compliance flags in risk-based licensing in Bali and Lombok.
   
   
6. Monitor the GR 5 to GR 28 Transition Period
   Businesses established under GR 5/2021 must migrate to the updated OSS framework. Failing to update within the grace period may invalidate your existing NIB or business license.
   
   
7. Maintain Ongoing Compliance and Reporting
   Keep detailed records, submit your LKPM (Investment Realization Reports) quarterly, and monitor post-licensing supervision notices from authorities. This ensures your entity remains valid and avoids audit penalties.

Each of these steps reinforces that risk-based licensing in Bali and Lombok is not a one-time formality, it’s a living compliance framework that requires continuous attention. Companies that integrate these checks into their operations gain faster approvals, better investor credibility, and stronger regulatory standing.

Expert Guidance for Foreign Investors on Risk-Based Licensing in Bali and Lombok

Successfully managing risk-based licensing in Bali and Lombok requires more than just submitting forms through the OSS system, it demands local insight, regulatory foresight, and precise documentation. This is where Synergy Pro becomes an essential partner for foreign investors.

Our team assists with company establishment (both PT and PT PMA), ensuring your business structure aligns with your intended activity and ownership model. We provide tailored KBLI consultation to help you select the correct business classification, preventing common errors that can delay or invalidate licenses. From OSS registration to permit mapping, licensing audits, and regional compliance checks, every process is handled with careful attention to Indonesia’s evolving regulations.

As GR 28/2025 introduces new subsystems, stricter monitoring, and data integration requirements, businesses must adapt swiftly to remain compliant. Our experts keep your operations aligned with these updates, ensuring seamless transitions from previous frameworks like GR 5/2021 to the latest risk-based licensing standards.

Partnering early with Synergy Pro means gaining both speed and certainty. We bridge the gap between national and local authorities, helping investors secure permits efficiently and sustain compliance long after setup.

With Synergy Pro by your side, navigating risk-based licensing in Bali and Lombok becomes a structured, transparent, and secure journey, allowing you to focus on what matters most: growing your business in Indonesia’s most promising regions.

Final Thoughts: Making Risk-Based Licensing Work for Your Business in Bali & Lombok

For foreign companies operating in Bali and Lombok, risk-based licensing in Bali and Lombok is far more than a bureaucratic requirement, it’s a core element of strategic compliance and long-term business sustainability. Proper licensing ensures that your business remains legally protected, operationally efficient, and ready for growth under Indonesia’s evolving regulations.

Mistakes in this area, such as incorrect KBLI selection, outdated OSS records, or missed migration deadlines can cost valuable time, money, and even result in operational suspension. That’s why proactive management is essential.

Now is the right moment to act: review your business classification, migrate to the GR 28/2025 framework, and consult trusted local specialists who understand both national and regional compliance dynamics.

For expert support, contact Synergy Pro. Our team helps you stay audit-ready, compliant, and confident as you navigate the complexities of risk-based licensing in Bali and Lombok.