Inside PP 28/2025: Faster, Clearer Timelines for Foreign Investors Under Indonesia’s Risk-based Licensing

Approval timelines change most through two connected ideas: defined Service Level Agreement (SLA) time frames and “deemed approval” (fiktif positif). Commentary on GR 28/2025 describes a shift from manual bureaucracy toward digital automation, with the OSS system applying fixed SLAs for each license type and sending tiered warning notifications to verification officers. If the relevant authority does not act within the SLA period, OSS can automatically deem the application approved and issue the license without manual intervention, using official electronic signatures. This is positioned as a direct answer to long-standing “pending licenses,” where applications previously stalled without clear timelines because verification remained manual inside technical ministries and regional governments.

What Deemed Approval Means for Foreign Investor Timelines

GR 28/2025 frames deemed approval as a way to keep projects moving when fundamental requirements (persyaratan dasar) are not processed on time. In practice, this can allow businesses to proceed to the next step as though the necessary approval has been granted, even though authorities still retain the ability to verify what was issued and evaluate or revoke a license when discrepancies are found. After the regulation was enacted, BKPM announced via OSS on 24 June 2025 a list of 258 KBLI codes to which deemed approval applies, spanning industries primarily related to manufacturing, tourism, and agriculture. At the same time, observers note that GR 28/2025 does not set out detailed technical procedures for how deemed approval will be implemented for these KBLI-based licenses, with further clarity expected through future sector-specific implementing regulations.

Beyond timelines, the regulation also affects how foreign investors scope compliance items that can drive critical-path scheduling. GR 28/2025 updates the comprehensive list of business sectors by KBLI, including the corresponding risk level (low, medium-low, medium-high, or high), licensing requirements, obligations, and timing for licence issuance. It also suggests PMA holding companies can be established and used in structuring Indonesian investments as a primary business line under KBLI 64200, where licensing had previously been unclear, while noting such holding companies are treated as foreign investors for FDI purposes. Separately, one academic analysis highlights a minimum FDI requirement stated as Rp10 billion and argues the rule lacks clear criteria for valuation and compliance assessment, which could affect certainty in OSS-based assessment and increase the risk of administrative disputes.

For existing operations and expansions, transition handling can also influence timelines. Guidance on the new rules indicates existing business licences that have not expired generally remain in force, but licence holders are required to register for risk-based licences in OSS for verification. If a licence has expired, a new application must be made under the new regulations. Companies with active OSS access may need to revisit and update information and supporting documents so licences issued prior to GR 28/2025 and BKPM Regulation 5/2025 continue to be valid. Taken together, the main takeaway is process engineering: map each KBLI, confirm the risk level and required approvals, and watch the OSS SLA clock, because the regulation is built to reduce open-ended waits.