**As of 2026, medium-high risk KBLI codes are becoming the pragmatic route for foreign-owned Bali companies heading into 2027 — because the OSS-RBA platform has been quietly blocking low and medium-low risk codes at many Bali addresses. Medium-high codes demand a government-verified standard certificate: heavier paperwork, but a cleaner path to lawful foreign operations.**
This is an outlook, not a prediction. Indonesia’s Positive Investment List, the risk tiers under the OSS-RBA single-submission system, and how BKPM enforces them at the district level all move faster than any published guide. Treat everything below as dated 2026 signal-reading — a way to structure early — and confirm live code eligibility with licensed Indonesian counsel before you commit capital.
What does “medium-high risk KBLI” actually mean?
Every Indonesian company picks one or more KBLI codes — the five-digit business-classification numbers that tell the government what you do. Under Indonesia’s risk-based approach, each code carries a risk level, and that level decides how much paperwork stands between you and a legal operating permit.
There are four tiers. The higher the assessed risk, the more the state wants to verify before you trade.
| Risk tier | What OSS issues | Who verifies it | Typical burden |
|---|---|---|---|
| Low (Rendah) | NIB only | No one — the NIB is the legality | Minimal |
| Medium-low (Menengah Rendah) | NIB + standard certificate | Self-declared by the company | Light |
| Medium-high (Menengah Tinggi) | NIB + standard certificate | Government-verified before it is valid | Moderate |
| High (Tinggi) | NIB + full licence (Izin) | Ministry/agency approval, often with environmental review | Heavy |
The distinction that matters for foreigners sits between medium-low and medium-high. A medium-low certificate is a promise you make about yourself. A medium-high certificate is a promise the relevant ministry checks and stamps. That verification step is exactly why medium-high is turning into a safer harbour for PT PMAs.
Why are medium-high codes becoming the pragmatic path for 2027?
Here is the 2026 signal that reframes everything. Through 2026, OSS-RBA has been rejecting or freezing low and medium-low risk KBLI selections for PT PMAs registered at Bali addresses — sometimes even codes that read as low-risk on paper. Foreign founders who assumed a quick, light-touch registration have watched their NIB stall for reasons the platform never fully explains.
Read forward and the direction is uncomfortable but usable. When the light tiers get squeezed, the codes that keep clearing are the ones that force you to prove substance — verified certificates, real premises, a documented operating plan. Medium-high codes do exactly that. The extra scrutiny that once looked like a burden now functions as evidence that your PT PMA is a genuine operating company, not a shell.
That reframes sequencing, too. The order in which you file your Bali business license application now depends on your risk tier — not just how fast you can push paperwork — because a medium-high code cannot go live until its standard certificate has been verified by the responsible authority. Founders who map the tier first, then file, avoid the dead-end of a frozen NIB.
Which medium-high risk codes still allow foreign ownership?
Two separate gates decide whether a foreigner can own a business under a given code. The risk tier decides your paperwork. The Positive Investment List decides your maximum foreign-ownership percentage. A code can be 100% open to foreigners and still sit in the medium-high tier — the two are unrelated.
Below are representative sectors where foreign-owned Bali operators commonly land in the medium-high band as of 2026. Do not treat these as guaranteed 2027 eligibility — verify each code live in OSS with counsel, because classifications and ownership caps are revised without much notice.
| Sector (representative) | Why it often sits medium-high | Foreign-ownership note |
|---|---|---|
| Construction & building works | Safety and technical verification required | Frequently open, often with local partnering conditions |
| Real estate owned or leased | Land-rights and PBG (formerly IMB) documentation | Open via PT PMA; the lawful route to hold HGB/Hak Pakai |
| Consultancy & professional services | Competence certification checked by ministry | Commonly 100% foreign |
| Event, MICE & specialised organising | Public-safety and venue verification | Often open, capacity-dependent |
The honest caveat: a code that clears in Jakarta may still stall at a Bali address, because the address-level blocking pattern of 2026 is geographic, not just sectoral.
What is the documentation burden per risk tier?
The step-up from medium-low to medium-high is not one extra form. It is a change in who signs off.
- Low: NIB, and you operate. Increasingly hard for PT PMAs at Bali addresses.
- Medium-low: NIB plus a self-declared standard certificate you commit to honour.
- Medium-high: NIB, a standard certificate, and a verification file — proof of premises, technical competence, and compliance the ministry reviews before your certificate is valid.
- High: all of the above plus a full licence and, frequently, an environmental approval (UKL-UPL or AMDAL).
None of this removes the underlying PT PMA thresholds. As of 2026, the vehicle still carries an IDR 10 billion investment plan (roughly USD 660,000–700,000 depending on FX) and a minimum paid-up capital of IDR 2.5 billion — the 25% floor that Emerhub attributes to Article 26(10) of BKPM Regulation No. 5 of 2025. Your KBLI tier changes the licensing path, not the capital commitment.
How can founders pre-emptively structure before enforcement tightens?
If the 2026 signals hold, the founders who win in 2027 are the ones who front-load the substance regulators are starting to demand.
- Pick the code before the company. Reverse-engineer your structure from the KBLI you need, not the other way around.
- Test the address early. Because blocking is geographic, pressure-test your intended Bali registered address against your target codes before signing a long lease.
- Consider a KPPA first. A representative office does market research, liaison and promotion only — no invoicing, no revenue — and skips the IDR 10 billion requirement, making it the lawful low-cost way to test the market. Note that “soft” commercial activity by a KPPA can create permanent-establishment tax exposure for the foreign parent.
- Budget for verification, not just filing. Assume premises proof, an office rental agreement, and PBG documentation will be checked.
- Never paper over it with nominees. Nominee shareholder or director arrangements to dodge a restricted code are risky and effectively unenforceable — the honest position, and the one most likely to unravel under exactly the scrutiny that is tightening.
What could still shift the picture in 2027?
Plenty. The Positive Investment List can be amended by presidential regulation. BKPM can reclassify codes between tiers. The Ministry of Law and Human Rights and the Directorate General of Taxes can adjust adjacent requirements. And the Bali address-blocking behaviour could be formalised into published policy — or quietly relaxed. Any of these would move the lines drawn above. That is precisely why this is framed as outlook: dated signals from 2026, read forward, not a forecast anyone should bank on.
The honest bottom line
Medium-high risk KBLI codes are trending from “extra hassle” to “the credible foreign-ownership path” for Bali PT PMAs, because the system is rewarding demonstrable substance and squeezing the light-touch routes. Structure early, verify each code live, and keep the capital and tax realities in view — including the 0.5% final turnover-tax regime available under IDR 4.8 billion in annual revenue, and Indonesia’s participation in CRS information exchange with Australia, Singapore, the US and the EU. This is information, not legal or tax advice. Before you file anything, route your specific case to licensed Indonesian counsel and a registered tax consultant. Figures are as of 2026 and subject to change.