**For a software or AI company, a Bali PT PMA licensed through OSS-RBA is often the cleanest foreign-owned route available. Digital KBLI codes are frequently 100% foreign-ownership-open, sit outside Bali’s tourism-code bottleneck, and carry the standard IDR 10 billion investment plan. Code selection, not paperwork, decides the outcome.**
That is the short version as of 2026, and the signals pointing into 2027 mostly reinforce it. What follows is an outlook for founders in Sydney, Singapore, San Francisco and Berlin weighing an Indonesian entity — not legal advice, and not a prediction. Rules shift; verify every figure with licensed Indonesian counsel before you wire anything.
Why does OSS-RBA treat digital companies differently in Bali?
Indonesia runs company licensing through OSS-RBA — the Risk-Based Approach on the Online Single Submission platform, overseen by BKPM under the Ministry of Investment. Every entity picks one or more KBLI business-classification codes, and each code carries a risk level: low, medium-low, medium-high or high. The risk level sets how much licensing you face.
Here is the Bali-specific catch that matters for 2026 into 2027. OSS-RBA has been blocking a range of low and medium-low risk KBLI codes for PT PMAs registered at Bali addresses. Small-scale tourism, retail and hospitality applications have stalled at the provincial gate. This is why local practitioners keep repeating that in Bali, code selection is strategy, not clerical work.
Software and AI companies usually sidestep the worst of this for one reason: their core codes tend to be open to 100% foreign ownership under the Positive Investment List, and they are not tied to Bali land, tourism quotas or physical retail footprints. You still confirm the live status of each code before signing a lease — but the digital sector starts from a stronger position.
What KBLI codes should an AI or SaaS founder actually consider?
There is no single “AI company” code. Most founders map their activity across two or three of the following, chosen to match what the company genuinely does.
| KBLI code | Activity | Typical fit |
|---|---|---|
| 62010 | Computer programming activities | Custom software, app and AI model development |
| 58200 | Software publishing | Licensing your own packaged software or SaaS product |
| 63122 | Commercial web portals and digital platforms | Marketplaces, platform businesses, portals |
| 63111 | Data processing and hosting | Data pipelines, hosting, backend infrastructure |
| 62020 | IT and facility management consultancy | Consulting, implementation, managed services |
| 62090 | Other IT and computer service activities | Catch-all for adjacent digital services |
The wrong classification can freeze an application at the Bali OSS stage, which is exactly the decision that sits at the heart of any competent offshore incorporation service — get it wrong and capital is committed against a code that will not clear. Confirm both the foreign-ownership cap and the current Bali status of each code with counsel, because the Positive Investment List and provincial practice both move.
What does the capital math look like in 2026, heading into 2027?
The headline numbers have been stable, and there is no dated 2026 signal suggesting they drop for 2027. A PT PMA — Perseroan Terbatas Penanaman Modal Asing — commits to a minimum investment plan of IDR 10,000,000,000, roughly USD 660,000 to 700,000 depending on the rate. Minimum paid-up capital is generally 25% of that.
| Item | Amount (as of 2026) | Approx USD | Note |
|---|---|---|---|
| Investment plan (minimum) | IDR 10,000,000,000 | ~USD 660k–700k | Commitment on paper |
| Paid-up capital (min 25%) | IDR 2,500,000,000 | ~USD 150k–175k | Must be injected |
| Initial bank deposit | often under USD 100 | — | Administrative only, separate from capital |
According to Emerhub, the IDR 2.5 billion paid-up floor is set by Article 26(10) of BKPM Regulation No. 5 of 2025 — a 2025 instrument that carries straight into 2027 planning. The two numbers do different jobs: the investment plan is a commitment on paper, while the paid-up capital must actually be injected. And per Bali Villa Realty, that small opening deposit is not the capital requirement — do not confuse opening a bank account with meeting the rule.
How do data-localisation and the PDP Law shape a Bali software company?
This is where 2026 signals point most clearly into 2027, and where AI and SaaS founders carry obligations a villa investor never touches.
Indonesia’s Personal Data Protection Law — the PDP Law, fully in force since late 2024 — governs how you collect, process and move personal data, with extraterritorial reach and penalties modelled loosely on GDPR. If your product touches Indonesian users’ data, the law reaches your PT PMA regardless of where your servers sit.
Separately, electronic system operators are expected to register as a PSE (Penyelenggara Sistem Elektronik) with the Ministry of Communication and Digital, and private operators have had more flexibility on data placement than public bodies — but that flexibility is exactly the kind of setting regulators revisit. Treat cross-border data flows, PSE registration and a data-processing record as first-order design questions for 2027, not afterthoughts. Route the specifics to Indonesian data-protection counsel; this area moves fast.
What is the realistic licensing timeline and step order?
Budget six to ten weeks for a straightforward digital PT PMA, assuming clean documents and no code-status surprises.
- Name reservation and deed of establishment (Akta Pendirian) before a public notary in Indonesian, legalized by the Ministry of Law and Human Rights.
- NIB (Nomor Induk Berusaha) issued through OSS-RBA.
- Corporate NPWP from the tax office, plus PKP confirmation for VAT.
- Domicile letter (SKTU) from the local district authority.
- Sectoral operational and commercial licenses via OSS, keyed to your KBLI codes.
- Corporate bank account and capital injection.
Registered-address proof means an office rental agreement, land certificate, or building permit — the IMB, now the PBG. A virtual or coworking address can work for digital businesses, but confirm it satisfies the specific KBLI and district before you rely on it.
Is a KPPA rep office a smarter first move?
Possibly, if 2026 is a market-testing year rather than a revenue year. A KPPA — representative office — may only do market research, liaison and promotion. No commercial transactions, no invoicing, no revenue. In exchange, it does not carry the IDR 10 billion capital plan, which makes it the lawful low-cost way to put someone on the ground.
The honest warning: “soft” commercial activity by a KPPA — signing deals, collecting payment — can create permanent-establishment tax exposure for the foreign parent. If your Bali team will actually close and bill customers, you need the PT PMA, not the rep office.
What tax and reporting reality should AU/SG/US/EU founders plan for?
- Turnover under IDR 4.8 billion a year may qualify for the 0.5% final turnover-tax regime; above that, normal corporate income tax applies.
- The PT PMA needs at least two shareholders (one foreign minimum), one director and one commissioner.
- The director must reside in Indonesia with a KITAS work permit and a personal NPWP, per Indonesia-Investments — which pulls foreign resident directors into personal Indonesian filing.
- Indonesia participates in CRS automatic information exchange with Australia, Singapore, the United States and EU jurisdictions, so treat the structure as fully visible to your home tax authority.
- After Indonesian tax, PT PMA profits can be repatriated to the foreign parent as dividends.
2027 outlook, not prediction
The direction of travel as of 2026: capital thresholds steady under the 2025 BKPM regulation, Bali’s KBLI gate still tighter for tourism than for tech, and data-protection obligations getting heavier, not lighter. None of that is guaranteed. Regulations, ownership caps and provincial practice can all change before you file.
Use this as a map of the terrain, then hand the final decision to licensed Indonesian counsel and a registered tax consultant. For an AI or SaaS founder, the single highest-leverage move is still the least glamorous one: pick the right KBLI code, confirm it clears at a Bali address, and build the capital and data plan around it.