The Government of Indonesia previously established a risk-based licensing framework through Government Regulation No. 5 of 2021 on the Implementation of Risk-Based Business Licensing, along with its amendments (collectively referred to as “GR 5/2021”). This regulation served as the main legal foundation for determining risk levels and business scales, as well as establishing basic licensing requirements, supervision mechanisms, and evaluation procedures applicable on a national scale.
In order to further promote ease of doing business, the government has replaced GR 5/2021 with Government Regulation No. 28 of 2025 (“GR 28/2025”), which came into force on 5 June 2025. GR 28/2025 maintains the principle of risk-based business licensing, aiming to simplify the establishment and operational processes of businesses to become more efficient and adaptive.
With the enactment of GR 28/2025, GR 5/2021 was officially revoked and declared no longer in force. However, several provisions concerning basic requirements, General Business Licensing (“PB”), and Business Licensing to Support Business Activities (“PB UMKU”) shall remain applicable to the extent they do not contradict the new provisions under GR 28/2025.
In line with the implementation of GR 28/2025, the Indonesian Government is also required to update the Online Single Submission (“OSS”) system and the Indonesia National Single Window (“SINSW”) system. This adjustment is necessary to ensure alignment between the electronic licensing service system and the legal framework set forth in GR 28/2025. Furthermore, the government has committed to finalize and issue all relevant implementing regulations no later than 5 October 2025.
Overall, GR 28/2025 constitutes a comprehensive reform of the risk-based business licensing system in Indonesia. This regulation consists of 550 articles divided into 14 chapters, governing key aspects of business licensing implementation, including risk assessment, business scale, supervision procedures, and the imposition of sanctions.
Considering the extensive scope of this regulation, this edition of SWILU will focus its discussion on the following key topics:
- Updates on Risk-Based Business Licensing provisions;
- Norms, Standards, Procedures, and Criteria (“NSPK”) in licensing implementation;
- Expansion of functions and services within the OSS subsystems; and
- Provisions on administrative sanctions.
Updates on Risk-Based Business Licensing Provisions
While maintaining the fundamental principles of risk-based business licensing as stipulated under GR 5/2021, GR 28/2025 expands the scope of sectors required to adopt the risk-based approach. Previously, GR 5/2021 covered 16 sectors; under GR 28/2025, this number has increased to 22 sectors. The six additional sectors include:
- Legal Metrology;
- Creative Economy;
- Geospatial Information;
- Cooperatives;
- Investment; and
- Electronic Systems and Transaction Operations.
Furthermore, GR 28/2025 provides a more detailed and systematic formulation of business activity stages that business actors must comply with. There are two main stages:
- Starting a Business, which consists of:
- Sub-stage of fulfilling business legality, covering initial actions to obtain legal recognition or business status;
- Sub-stage of fulfilling basic requirements, including conformity of spatial utilization (“KKPR”) and environmental approval for business activities not required to have an Environmental Impact Analysis (“AMDAL”) or Environmental Management and Monitoring Efforts (“UKL-UPL”); and
- Obtaining or applying for business licenses in accordance with the respective business activities.
- Operating a Business, which consists of:
- Sub-stage of preparation, including land acquisition, procurement of equipment and/or supporting facilities, and recruitment of human resources; and
- Sub-stage of operational and/or commercial activities, covering production, logistics and distribution, as well as the marketing of goods and/or services.
Norms, Standards, Procedures, and Criteria (“NSPK”)
In principle, the formulation and stipulation of NSPK remains entirely under the authority of the central government. NSPK serves as a single reference that must be uniformly applied by both central and regional governments in implementing risk-based business licensing.
Under the new legal framework set out in GR 28/2025, it is expressly stipulated that regional heads are prohibited from introducing provisions that expand or add to the regulations beyond what has been established in GR 28/2025. Accordingly, any implementing regulations issued by regional governments must fully refer to the NSPK determined by the central government, without additional interpretations or provisions that may create discrepancies at the regional level.
Expansion of Functions and Services within OSS Subsystems
As part of its major updates, GR 28/2025 expands the various service subsystems provided through the OSS system, compared to the previous framework under GR 5/2021. GR 28/2025 retains the previously existing subsystems, such as the Information Service Subsystem, Business Licensing Subsystem, and Supervision Subsystem. Nevertheless, to further strengthen the effectiveness of risk-based business licensing, GR 28/2025 introduces three new subsystems: Basic Requirements Subsystem, Investment Facilities Subsystem, and Partnership Subsystem.
The Basic Requirements Subsystem, for example, is accessible through an official access right and provides information regarding the KKPR, environmental approvals, and building approvals and certificates of proper function.
Furthermore, the Investment Facilities Subsystem is introduced to support various fiscal policies and incentives granted to investors. Through this subsystem, business actors can apply for at least eight new types of services, including applications for import duty exemptions on machinery, goods, and materials used for industrial development or expansion, applications for corporate income tax reductions, and applications for gross income deductions related to internship, training, and/or educational activities.
Additionally, GR 28/2025 introduces the Partnership Subsystem, which serves as a platform for access right holders to facilitate, monitor, and evaluate business partnerships. This subsystem covers partnerships required under investment regulations, other mandatory partnerships under prevailing laws and regulations, as well as voluntary partnerships initiated by business actors.
Administrative Sanctions
GR 28/2025 introduces new provisions on administrative sanctions, which explicitly apply to business actors violating basic requirements, Business Licensing, or PB UMKU. Previously, administrative sanctions were only regulated at the subsectoral level, such as in the fisheries, horticulture, and electricity sectors.
Administrative sanctions under GR 28/2025 must be imposed in stages, based on the level of compliance identified during supervisory activities. Types of sanctions include warnings, temporary suspension of business activities, administrative fines, coercive measures (police force), revocation of licenses (including licenses, certifications, or approvals), and revocation of basic requirements, PB, and PB UMKU.
The imposition of sanctions must be carried out by authorized officials, such as ministers, heads of agencies, governors, regents/mayors, or heads of Special Economic Zones (SEZ), and must be processed through the OSS system.
For legal assistance from SW Counselors at Law, please contact:
T. (+6221) 2222-0200
T. (+6221) 2222-0200
