Indonesia's Online Single Submission system places the Business Identification Number, or NIB, at the centre of business licensing. For due diligence, the NIB is a strong starting point because it helps identify the business actor. It should not be read in isolation. The relevant Indonesian Standard Industrial Classification code, known as KBLI, and the risk level attached to an activity influence what additional licences, standards, or certificates may be required.
Start with the legal entity and NIB
A review should reconcile the NIB with the company's legal name, entity type, tax information, address, management, shareholders, and deed history. The aim is to confirm that the business presented to the client is the same entity shown in official records.
Indonesian company names and addresses can be rendered inconsistently across contracts, invoices, websites, and translated materials. Entity resolution should use identifiers and original-language records wherever possible. Reviewers should also distinguish the main company from branches, projects, brands, or affiliated entities.
Connect KBLI codes to the real activity
KBLI codes describe business activities and are used in the OSS risk-based licensing framework. The classification should make commercial sense when compared with the products, services, facilities, and revenue activity described by the counterparty.
A mismatch can be innocent, such as an outdated or overly broad classification, but it can also signal that the entity is operating outside its stated scope or that the client has been introduced to the wrong group company. Where multiple activities are listed, attention should focus on the activity relevant to the proposed relationship.
Risk level determines the next document
Indonesia's risk-based framework applies different licensing requirements according to the assessed risk of the activity. The practical diligence question is therefore not simply whether the entity has an NIB, but whether it holds the additional licence, standard certificate, or approval required for the particular activity and location.
Document checks should be paired with operating evidence: the site, equipment, workforce, management experience, customers, supply chain, and local reputation. When information is fragmented across systems, a structured request list and local-language follow-up are usually more reliable than assuming that one database contains the complete answer.