Which KBLI Code Should Your Tech Company Use in Indonesia? A Sector Guide for SaaS, Fintech, and Digital Businesses

A KBLI code is the five-digit business classification that tells Indonesia’s OSS system what your company does, how much of it foreigners can own, and which licenses sit on top of your NIB. For a generic manufacturer or a restaurant, picking the right one is mostly a matter of reading descriptions carefully. For a tech company, it’s harder, because “software” isn’t one activity in Indonesia’s eyes. Programming, IT consulting, cloud hosting, a marketplace, a lending app, and a cybersecurity tool each sit under a different code, and several of those codes changed number entirely under KBLI 2025. This guide breaks down the codes that actually apply to software, SaaS, IT consulting, data processing, digital marketplaces, fintech, AI, cybersecurity, and data center businesses, and flags where a technically correct code still pulls in a second regulator you didn’t plan for.

Why Is KBLI Selection Harder for a Tech Company Than for Most Other Businesses?

Most sectors map to one obvious KBLI code. A furniture manufacturer picks a furniture code. A tech company rarely works that way, because “technology” spans several regulatory categories that don’t share a licensing path. A company writing custom software, a company hosting other people’s data, and a company processing payments all get called “tech” in a pitch deck, but Indonesia’s OSS system treats them as three separate risk profiles with three different sets of rules.

This gets more complicated because Indonesia replaced its entire classification system in December 2025, and by 2026 that change is no longer a future date to plan around, it’s the standard you’re registering under today. InvestinAsia’s general KBLI guide covers the mechanics of that transition in more detail, but the short version matters here: KBLI 2025, issued under BPS Regulation No. 7 of 2025, removed several codes that foreign-owned tech and e-commerce companies used to default to, most notably the old catch-all digital platform code. Ministries were given until June 18, 2026 to fully integrate the new codes into OSS and the Ministry of Law’s AHU system, and that deadline has now passed, so OSS registrations run on KBLI 2025 going forward. If you’re reading a guide, a forum post, or even a legal opinion written before this transition completed, some of the codes in it no longer exist.

Which KBLI Code Covers Software Development, IT Consulting, and SaaS?

Software development, whether you’re building custom applications, mobile apps, or a subscription SaaS product, generally falls under KBLI 62010, Computer Programming. This code is open to 100% foreign ownership and classified as low risk under OSS-RBA, which means a company operating purely under this code only needs an NIB to start work, no Standard Certificate, no sector license.

IT consultancy, systems integration, and computer facilities management sit under KBLI 62020, also 100% open and low risk. Most software companies register both codes together: 62010 as the primary activity for building and licensing software, 62020 as a supporting code for client advisory or implementation work. A SaaS company selling subscription access to a platform you built typically registers primarily under 62010, since the product is the software itself rather than consulting hours.

Where this gets genuinely tricky is a SaaS product that reaches the public. If your software is used by Indonesian consumers or businesses through a website or app, the activity itself is 62010, but you also fall into a separate registration requirement covered further down in this guide. The KBLI code and the electronic-system registration are two different obligations that happen to apply to the same company.

Which KBLI Code Covers Data Processing, Hosting, and Data Centers?

Under KBLI 2020, this activity split across two codes: 63111 for data processing and 63112 for hosting. KBLI 2025 consolidated and re-scoped this into KBLI 63102, Computing Infrastructure Provisioning, Hosting, and Related Activities, which explicitly covers cloud services (IaaS and PaaS), web hosting, and data center colocation. If your company operates a cloud platform, provides managed hosting, or runs physical data center infrastructure, 63102 is the code to check first, and it’s newer than most published guides acknowledge.

This code is open to foreign ownership under the Positive Investment List, and Indonesia’s data center market has become one of the more active entry points for foreign infrastructure investors specifically because of that openness. The complication isn’t ownership, it’s data localization. Government Regulation No. 71 of 2019 requires certain categories of data, particularly public-service and strategic data, to be stored physically within Indonesia. A pure commercial hosting business generally isn’t caught by this, but a company hosting data for government clients or regulated sectors needs to check this before assuming a standard commercial setup covers everything.

What KBLI Code Applies to a Digital Marketplace or E-Commerce Platform?

This is where the KBLI 2025 transition hits hardest, and it’s a live issue in 2026, not a historical footnote. Under KBLI 2020, almost every foreign-owned marketplace, booking platform, or commercial web portal registered under KBLI 63122, a broad code that covered digital platforms regardless of what they actually sold. That code no longer exists in the current OSS system.

KBLI 2025 replaced it with a sector-specific approach. A platform intermediating retail sales now registers under a retail-intermediation code tied to what’s being sold. A booking platform falls under travel or accommodation codes. A digital health platform falls under health-sector classifications. There is no single substitute code, and this is the mistake we still see most often among founders relying on guides, deed templates, or notary advice written before the transition completed: they ask for “the e-commerce code” and get pointed at something that no longer exists in the OSS system.

If your marketplace connects buyers and sellers of physical goods, expect to register under a digital-intermediation code specific to retail trade rather than a generic technology code, even though the company is fundamentally a tech platform. This affects more than the code number. Marketplace operators also sit under Permendag No. 19 of 2026, which took effect in June 2026 and requires the marketplace itself to reject sellers who don’t have a valid NIB, on a grace period of six months for new sellers and eighteen months for sellers already active on the platform. That means a marketplace’s compliance picture involves both its own KBLI code and its sellers’ registration status.

Whatever specific code your marketplace lands on, one requirement applies almost universally: registration as a Penyelenggara Sistem Elektronik (PSE), Indonesia’s electronic-system-operator registration, covered in the next section. This is separate from your KBLI code and easy to miss if you’re focused purely on the OSS classification.

Which KBLI Code Fits a Fintech, Payment, or Lending Business?

Fintech is the clearest example of a KBLI code being necessary but not sufficient. The business activity code determines OSS risk level and, in principle, ownership eligibility, but for most financial-technology products, the KBLI code is secondary to a license from either Bank Indonesia or the Financial Services Authority (OJK), and neither of those bodies treats a clean KBLI registration as proof you can operate.

The split generally works like this: if your product moves money, e-wallets, payment gateways, digital remittance, it falls under Bank Indonesia’s payment-system licensing framework. If your product lends money or facilitates lending between third parties, peer-to-peer lending being the most common model for foreign entrants, OJK is the licensing authority.

Peer-to-peer lending sits under OJK Regulation No. 40 of 2024, which caps direct or indirect foreign ownership at 85% of paid-up capital and sets a minimum paid-up capital requirement of IDR 25 billion, a figure well above the standard PT PMA minimum. Payment-system infrastructure that handles clearing and settlement carries a stricter cap, limited to 20% foreign ownership under the Positive Investment List, while other payment-service categories vary by sub-type and are worth confirming directly with a licensed advisor before you commit to a structure.

The risk here isn’t the KBLI code itself, most fintech-adjacent codes are open to some degree of foreign ownership. The risk is treating NIB issuance as the finish line. A company can complete OSS registration cleanly and still be operating illegally if it hasn’t separately secured its OJK or BI license, since those authorities license the activity, not just the entity.

How Does KBLI 2025 Classify AI and Cybersecurity Activities?

KBLI 2025 introduced dedicated classifications for artificial intelligence development and autonomous systems for the first time, alongside a more defined code for cybersecurity consulting and security operations, separating it from general IT consultancy. This is a genuine improvement for foreign investors who previously had to force AI or security work into an “other IT services” category with no clean fit.

We’re being deliberately cautious about giving you a specific five-digit number for the new AI code here. The classification is confirmed to exist, but the exact digit sequence has been reported inconsistently across secondary sources, and BPS’s own conversion tooling is the only place to confirm it with certainty. Search the OSS RBA portal directly using plain-language terms like “artificial intelligence” or “autonomous systems” during your NIB application, or verify against BPS’s official KBLI 2020-to-2025 conversion table before you instruct a notary. The same caution applies to the specific cybersecurity code some legal-services websites cite; confirm it in OSS rather than copying a number from an article, including this one, without checking.

In practice, most AI-focused software companies without a specialized hardware or autonomous-systems component still register comfortably under the standard 62010 software code, since AI development is fundamentally still computer programming from a classification standpoint. The dedicated AI code becomes more relevant for companies building autonomous systems, robotics, or AI infrastructure as a distinct product line rather than software with AI features.

Which Licenses Do You Need Beyond the NIB?

This is the section that answers the pain point behind most of this article: a KBLI code can be entirely correct and still leave you short of what you need to legally operate. Three regulators sit on top of the standard OSS/NIB process for tech companies, and which one applies depends entirely on what your product does, not on your KBLI code alone.

Kominfo PSE registration. Any electronic system used by the public in Indonesia, meaning any website, app, or API that Indonesian users interact with for transactions, communication, or content, generally requires registration as a Penyelenggara Sistem Elektronik under Government Regulation No. 71 of 2019 and its implementing Kominfo regulations. This applies broadly: SaaS platforms, marketplaces, fintech apps, and cloud services all typically need it if they serve Indonesian users. Kominfo has enforced this actively, including public warnings and blocking actions against major global platforms that hadn’t registered. This requirement is separate from your KBLI code and from your NIB. A company can have a perfect KBLI classification and still be non-compliant because nobody filed the PSE registration.

OJK licensing. Applies to lending, investment, and most non-payment financial-technology activities, as covered above.

Bank Indonesia licensing. Applies to any product that moves money on behalf of users, payment gateways, e-wallets, remittance, and clearing infrastructure.

What Happens If Your KBLI Code Triggers Licensing You Didn’t Expect?

The founders who get stuck aren’t usually the ones who chose a completely wrong KBLI code. They’re the ones who chose a defensible code, got their NIB issued without any red flag, and only discovered the OJK or Kominfo requirement after launching, sometimes because a bank asked about it during a due diligence check, sometimes because Kominfo flagged the service directly.

The practical consequence of skipping PSE registration, for example, is access blocking. Kominfo can restrict or block a service inside Indonesia, and for a foreign company that means losing the market entirely, not just facing a fine. For fintech products operating without the correct OJK or BI license, the consequence is more severe: the activity itself is unlicensed, which exposes the company and, in some structures, individual directors to regulatory action.

Can a Multi-Product Tech Company Use More Than One KBLI Code?

Yes, and most real tech companies need to. A company that builds software, hosts it on its own infrastructure, and sells access through a marketplace-style storefront is touching three different KBLI categories at once. Indonesian PT PMAs commonly register one primary code and several supporting codes, provided the activities are operationally related rather than unrelated business lines bolted together.

The practical constraint is capital, not the number of codes. Each distinct primary business line can trigger its own minimum investment plan commitment of IDR 10 billion, excluding land and buildings, even though the paid-up capital requirement itself dropped to IDR 2.5 billion under BKPM Regulation No. 5 of 2025. A software company adding a genuinely separate marketplace business, rather than treating the marketplace as a supporting feature of the same product, may be looking at a second capital commitment rather than a simple code addition.

This also matters for companies that grow into a new KBLI after incorporation rather than planning for it from day one. Adding a code later means a notarial deed amendment, Kemenkumham approval, and an OSS update, not a quick portal edit. Our guide on amending a PT PMA’s KBLI code walks through that process in detail, including how the amendment interacts with the KBLI 2025 transition if your original code was one of the ones that got renumbered or removed.

The cleanest approach we see work in practice: map your product roadmap before incorporating, not just your current activity. A founder who knows they’ll add payments within 18 months is better off flagging that during initial registration planning, even if the payment KBLI and BI licensing come later, than discovering the capital and licensing implications after the fact.

How Should You Choose the Right KBLI Codes for Your Tech PT PMA?

Start with your actual revenue model, not your industry label. “Fintech” and “SaaS” are marketing categories; the OSS system only understands specific activity descriptions. Write down precisely what generates revenue today and what’s realistically on the roadmap within the next year or two.

Check each candidate code against the Positive Investment List before committing, even for codes that seem obviously open. Most of the codes covered in this guide, software development, IT consulting, hosting, are fully open to foreign ownership, but fintech sub-categories and anything touching payment infrastructure carry real caps that need to be built into your shareholding structure from the start, not adjusted after incorporation.

Confirm your OSS risk level for each code you’re registering, since that determines whether an NIB alone is enough or whether a Standard Certificate and further verification apply. Then, separately from the KBLI process entirely, confirm whether your product needs Kominfo PSE registration, an OJK license, or a Bank Indonesia license based on what it actually does, not what code it’s filed under.

A PT PMA gives you the legal structure to operate, but the KBLI code and the sector license are two separate gates, and both need to be cleared before you’re actually compliant to launch.

References

1. Badan Pusat Statistik. (2025, December 19). BPS Rilis Klasifikasi Baku Lapangan Usaha Indonesia (KBLI) 2025. Retrieved from
https://www.bps.go.id/en/news/2025/12/19/828/bps-rilis-klasifikasi-baku-lapangan-usaha-indonesia–kbli–2025.html

2. Badan Pusat Statistik. (2025). Peraturan BPS No. 7 Tahun 2025 tentang Klasifikasi Baku Lapangan Usaha Indonesia. Retrieved from
https://www.peraturan.go.id/id/peraturan-bps-no-7-tahun-2025

3. Pemerintah Republik Indonesia. (2021). Peraturan Presiden No. 10 Tahun 2021 tentang Bidang Usaha Penanaman Modal. Retrieved from
https://peraturan.bpk.go.id/Details/160222/perpres-no-10-tahun-2021

4. Pemerintah Republik Indonesia. (2019). Peraturan Pemerintah No. 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik. Retrieved from
https://peraturan.go.id/id/pp-no-71-tahun-2019

5. Otoritas Jasa Keuangan. (2024). OJK Regulation Number 40/2024 concerning Peer-to-Peer Lending Services. Retrieved from
https://iru.ojk.go.id/iru/WebSite/ArticleList/View/299_OJK_Regulation_Number_40_2024_concerning_Peer-to-Peer_Lending_Services_