Overview
On 5 June 2025, Indonesia issued Government Regulation (GR) No. 28/2025 on Risk-Based Business Licensing, revoking and replacing GR 5/2021. This regulation represents a new Indonesia’s business licensing framework and is intended to create a system that is more adaptive, transparent, integrated, and accountable.
GR 28/2025 addresses three major challenges:
Ensuring licensing certainty by setting Service Level Agreements (SLAs) for Basic Requirements, Business Licensing (PB), and Supporting Business Licensing (PB-UMKU), including clear timelines for corrections;
Simplifying processes; and
Restructuring regulations with more systematic arrangements and improved annexes.
Key GR 28/2025 Updates for Businesses
Sector Coverage and Updated Risk Classification
GR 28/2025 expands the scope of the risk-based licensing system to 22 business sectors. While the qualitative risk classifications—Low, Medium-Low, Medium-High, and High—remain unchanged, the regulation updates the risk analysis methodology and expands the coverage of regulated business activities.
Notably, the total number of KBLI entries has increased from 1,348 to 1,417, indicating that previously unregulated or unclear business activities have now been formally classified and integrated into the OSS framework. Although the number of activities classified as Medium-High or High risk appears to have decreased, the overall regulatory coverage has become more comprehensive.
GR 28/2025 also introduces substantial institutional, procedural, and substantive reforms within the OSS system. The regulation consists of 552 articles across 14 chapters, providing more detailed rules on licensing and post-licensing supervision compared to its predecessor.
Clearer Stages of Business Activity
GR 28/2025 introduces clearer distinctions between the commencement, preparation, and operational stages of a business lifecycle and specifies which approvals are required at each stage. This approach provides greater regulatory certainty, supports better business planning, and reduces compliance risks.
To conduct business activities in Indonesia, companies must first fulfill all Basic Requirements, obtain the relevant Business License (PB), and—where applicable—secure Supporting Business Licenses (PB-UMKU). All licensing processes are conducted electronically through the OSS system, which is integrated with relevant ministries and government agencies.
Enhancement to the Online Single Submission (OSS) System
Additional OSS subsystems are now in place to support the online management of key basic requirements, including spatial planning approvals, environmental approvals, investment incentives (such as import duty exemptions and tax reductions), and partnership obligations.
This enhanced integration provides a clearer, more streamlined, and more transparent pathway for businesses to fulfill their core licensing and compliance obligations.
Sanctions
GR 28/2025 centralizes administrative sanctions for licensing violations across all sectors. Unlike GR 5/2021, which regulated sanctions separately by sector, the new regulation adopts a unified approach.
While the concept of staged administrative sanctions remains, GR 28/2025 expands and clarifies the types of violations subject to sanctions. This centralized framework is intended to simplify enforcement and help businesses better understand regulatory consequences.
Changes to the Annexes
GR 28/2025 introduces substantial revisions to Annexes I to IV, significantly improving clarity and usability.
Attachment I of GR 28/2025 combines the requirements for both PB and PB UMKU licences into a single table, making it easier to understand and identify the necessary licences for specific business activities.
Annex II provides detailed requirements for obtaining PB-UMKU,
Annex III outlines the risk analysis methodology,
Annex IV sets general guidelines for business activity standards and product/service standards, which are further regulated through sector-specific ministerial or agency regulations.
Compliance Implications under Risk-Based GR 28/ 2025
GR 28/2025 has been fully integrated into the Online Single Submission (OSS) system since October 2025, and multiple implementing regulations issued by relevant ministries and government agencies have been amended to align with this framework. As a result, businesses are required to reassess their licensing structures and ensure compliance with the updated risk-based GR 28/ 2025.
Under GR 28/2025, the risk classification of business activities, including cosmetics-related activities such as manufacturing and wholesale trading is determined based on the annexes of GR 28/2025. For example; KBLI 46443 (Wholesale Trading of Cosmetics) is classified as Medium-High Risk.
While GR 28/2025 establishes the risk level and licensing structure, the detailed technical requirements are governed by sector-specific implementing regulations. In the health and cosmetics sectors, these requirements are further regulated through Ministry of Health Regulation No. 11 of 2025 and BPOM Regulation No. 27 of 2025.
In practice, Business Licensing (PB) requirements for cosmetics-related activities are regulated under MoH Regulation No. 11 of 2025, while Supporting Business Licensing (PB-UMKU) requirements are stipulated under BPOM Regulation No. 27 of 2025. Together, these regulations operationalise the risk-based framework set out in GR 28/2025 and provide clarity on licensing obligations, documentation, timelines, and post-licensing compliance.
For more information or assistance, please feel free to contact us at customer@reach24h.com.
