Your company develops core banking systems, credit scoring platforms, data processing solutions, or other IT-based services for banks and financial institutions in Indonesia. But is your current business classification sufficient to operate and serve your clients?
This is a question increasingly faced by foreign technology companies entering the Indonesian market.
Many foreign companies establish an Indonesian entity, obtain a Business Identification Number (Nomor Induk Berusaha or NIB), and select business classifications (KBLI) that appear to match their technology services. However, when they start approaching banks, multifinance companies, fintech businesses, or other financial institutions, another challenge emerges.
Their prospective clients request more than just an NIB. They want to ensure that the vendor’s registered business activities, licensing status, and regulatory compliance are consistent with the services being offered.
This is where the gap often begins.
- An NIB Does Not Automatically Mean Full Business Compliance
An NIB is an important business identification and licensing document. However, having an NIB does not necessarily mean that a company has obtained all the permits or fulfilled every regulatory requirement applicable to its business activities.
Under Indonesia’s Risk-Based Business Licensing framework (Perizinan Berusaha Berbasis Risiko), the licensing requirements depend on the nature and risk level of the registered business activities.
Depending on the applicable KBLI, a business may require:
- An NIB as its business identification and licensing document.
- A Standard Certificate (Sertifikat Standar), which may require further verification or approval.
- A Business License or other sector-specific approvals, where applicable.
- Additional business supporting licenses or regulatory registrations.
Therefore, companies should not assume that registering a particular KBLI and obtaining an NIB is sufficient to commence all activities.
- The Challenge: One IT Business May Involve Several Different KBLI Classifications
One of the most common misunderstandings is treating all technology-related services as a single business activity.
In practice, different IT business models may fall under different classifications, even when they are offered by the same company.
For example:
- Core Banking System: Software development, licensing, implementation, customization, or maintenance of banking systems.
- Credit Scoring Solutions: Development and provision of credit assessment algorithms, scoring platforms, or analytical tools.
- Data Processing Services: Processing, analyzing, managing, or providing data-related services for clients.
- Cloud and Data Infrastructure: Hosting, cloud infrastructure, and related IT infrastructure services.
- IT Consulting: Technology advisory, system integration, implementation, and IT management consulting.
- Software as a Service (SaaS): Providing software applications through subscription-based or cloud-based arrangements.
Although these services may be categorized broadly as IT solutions, their underlying business activities are not necessarily the same.
A company developing software and licensing it to a bank may have different licensing considerations from a company operating a data processing platform or providing outsourced IT infrastructure.
The key is to identify what the company actually does, not merely what its product is called.
- KBLI 2025: A New Classification Framework That Businesses Should Understand
Indonesia has introduced the latest Indonesian Standard Industrial Classification (Klasifikasi Baku Lapangan Usaha Indonesia or KBLI) 2025 through BPS Regulation No. 7 of 2025.
This update reflects the development of economic activities, including digital transformation and new technology-driven business models.
KBLI 2025 is structured with reference to the International Standard Industrial Classification of All Economic Activities (ISIC) Revision 5.
For foreign companies operating in Indonesia, this development is important because business classification is not merely an administrative matter. It is also a reference for business licensing through the Online Single Submission (OSS) system.
However, businesses should understand that the transition to KBLI 2025 does not automatically invalidate previously issued business licenses.
The government has also clarified that existing licenses remain valid, while adjustments may be required where there are substantive changes to the company’s business purposes or activities.
Accordingly, companies should review their existing KBLI, understand the applicable conversion, and identify whether any changes to their actual business activities require further corporate or licensing adjustments.
- Being an IT Vendor to a Bank Does Not Automatically Mean Being a Financial Institution
Another important issue is the distinction between providing technology services to financial institutions and directly conducting regulated financial activities.
For example:
- Developing a core banking system does not automatically make the developer a bank.
- Providing a credit scoring application does not automatically make the provider a credit information institution.
- Processing data for a financial institution does not automatically make the service provider a financial services company.
- Providing technology infrastructure to a payment service provider does not automatically mean the vendor is conducting payment services.
However, the actual business model must be carefully examined.
If the company independently operates a platform, provides financial intermediation, conducts payment activities, or offers services that fall within a regulated financial activity, additional regulatory requirements may apply.
This distinction is particularly important for foreign technology companies because the regulatory treatment may differ depending on whether they act as a technology vendor, an outsourced service provider, a platform operator, or a regulated financial service provider.
- Why Banks and Financial Institutions Are Becoming More Concerned
Banks and financial institutions have their own governance, risk management, compliance, and vendor management obligations.
Consequently, they need to ensure that third-party vendors are legally established and authorized to provide the relevant services.
During vendor onboarding and due diligence, they may examine:
- Whether the vendor’s registered KBLI matches the actual services being provided.
- Whether the NIB and relevant business licenses are valid and appropriate.
- Whether the required Standard Certificate has been verified, where applicable.
- Whether the vendor has fulfilled relevant IT, data protection, and information security requirements.
- Whether the vendor’s business activities are consistent with its corporate documents and contractual scope.
This means that an incorrect or incomplete KBLI selection may become a commercial obstacle, even when the company has already developed a sophisticated product and secured potential customers.
- What Should Foreign IT Companies Do?
Before entering into commercial arrangements with Indonesian banks or financial institutions, foreign technology companies should consider conducting a comprehensive business activity and licensing assessment.
We recommend the following steps:
- Map the Actual Business Model
Identify every service, product, and operational activity that the Indonesian entity will undertake. Distinguish between software development, licensing, implementation, consulting, data processing, hosting, and platform operation.
- Conduct a KBLI Assessment
Identify the appropriate KBLI under the applicable classification framework, including the KBLI 2025 transition and relevant conversion requirements.
- Review Risk-Based Licensing Requirements
Determine the licensing obligations associated with each selected KBLI, including whether a Standard Certificate or further verification is required.
- Check Sector-Specific Regulatory Requirements
Assess whether the services trigger additional requirements relating to electronic system operation, personal data protection, information security, outsourcing, or financial sector regulations.
- Align Corporate Documents, NIB, and Actual Operations
Ensure that the company’s Articles of Association, registered business activities, NIB, licensing documents, and commercial agreements reflect a consistent and legally appropriate business model.
Conclusion: The Right KBLI Is Part of Your Market Entry Strategy
For foreign technology companies entering Indonesia, selecting the right KBLI should not be treated as a simple administrative exercise.
It is part of a broader market entry and regulatory compliance strategy.
The objective is not simply to obtain an NIB, but to ensure that the Indonesian entity is legally structured, appropriately licensed, and capable of providing its services to banks and financial institutions without unnecessary regulatory or commercial obstacles.
A good technology solution deserves a business structure that is equally ready for regulatory scrutiny.
At EasyHelps, we assist foreign investors and technology companies in assessing their business activities, selecting appropriate KBLI classifications, reviewing NIB and business licensing requirements, and aligning their corporate structure with Indonesia’s regulatory framework.
Because in Indonesia, getting your business classification right from the beginning can make a significant difference to your business continuity and growth.
EasyHelps – Your Corporate Legal & Regulatory Compliance Partner in Indonesia.
#EasyHelps #KBLI2025 #BusinessLicensing #ForeignInvestment #IndonesiaInvestment #ITCompanies #Fintech #BankingTechnology #RegulatoryCompliance #CorporateLegal