Closing the Time Manipulation Loophole in Indonesia's OSS-RBA Business Licensing System
Government Regulation (PP) Number 28 of 2025 was officially promulgated on 5 June 2025 as the latest legal basis for the implementation of the risk-based business licensing system through the Online Single Submission Risk-Based Approach (OSS-RBA) platform. This regulation replaces PP Number 5 of 2021, strengthening the position of OSS-RBA as the sole legal gateway for business licensing in Indonesia and integrating all ministry and agency systems nationwide.
One of the key reinforcements in PP 28/2025 is the strict application of Service Level Agreements (SLAs) or service time limits. Each licensing process is given a specific maximum timeframe. For example, in applications for Spatial Use Activity Conformity (KKPR), the Ministry of Agrarian Affairs and Spatial Planning/National Land Agency (ATR/BPN) is given a maximum deadline of 25 working days if documents do not require revision, or 40 working days if there are minor corrections.
In this context, the "deemed approved" mechanism plays an important role: if the authority does not issue a decision within the stipulated timeframe, the OSS-RBA system automatically issues the permit. The objective is straightforward: to ensure legal certainty, accelerate investment realisation, and eliminate unnecessary bureaucratic negotiation space.
However, PP 28/2025 does not explicitly regulate how the system treats administrative interventions that arise before the SLA expires. Consequently, any response or clarification request from a local agency — regardless of whether the grounds are legitimate — can still potentially reset the deemed approved countdown. This loophole is rather vulnerable to misuse.
For instance, consider a hypothetical case in Central Java where an entrepreneur submits a KKPR application for the construction of a shoe factory through OSS-RBA on 1 July 2025. According to the rules, by the 25th working day or 26 July, the permit should be automatically issued if there are no objections. However, suppose that on day 23, the local Spatial Planning Office sends a letter requiring the re-upload of a location map document on grounds of "incompatible format" — even though the file already uses the standard SHP format issued by the official ATR/BPN Ministry system.
The OSS-RBA system treats this letter as a legitimate administrative action, because there exists a loophole allowing permit issuance to be deferred (since it was responded to, even if the content is merely a rejection or objection). This means the SLA is considered "extended" and the countdown resets to zero. In practice, the entrepreneur must wait another 25 working days for a process that should have already been completed. If this strategy is repeated on day 24 of the next cycle, the entire process remains perpetually hostage to bureaucratic grey areas.
The fundamental problem lies in the absence of any distinction between substantive actions and administrative actions of a vague nature. If OSS-RBA records all interactions as "responses" without substantive verification filters, this is essentially no different from the old system — provided there is no independent verification from the central government to determine whether the clarification is relevant or merely bureaucratic manoeuvring. As a result, SLA logic becomes illusory. Business operators have no mechanism to challenge grounds they consider invalid. More problematically still, there are no administrative consequences or penalties for agencies that delay without strong justification.
Yet PP 28/2025 explicitly stipulates that OSS-RBA is the single reference — meaning all licensing requirements and procedures are codified within the system. No additional document requests or local interpretations that contradict central regulations should be permitted. In practice, however, a small loophole such as "a letter before the deadline" allows this principle to be circumvented.
A concrete solution that perhaps needs to be adopted is this: every clarification request that comes in should be temporarily quarantined by the central OSS-RBA system for verification over a maximum of three working days. If it fails substantive verification, the request is deemed invalid and the SLA continues to run.
Additionally, it is important to establish a fast-track appeal module or rapid dispute forum. Business operators must be given the right to challenge clarification requests they consider illegitimate. The central system should be required to issue a decision within a short timeframe (maximum three days), and the result should be final.
Performance evaluation of ministries and agencies should also shift from the quantity of letters or administrative responses towards the quality of decisions. For example, the number of permits issued without revision compared to total applications could serve as a healthier key performance indicator (KPI) that encourages effectiveness.
Improvements to audit trail quality and digital footprints within OSS-RBA also need to be promoted. Every agency action — whether a clarification request, rejection, or issuance — must be recorded with the responsible officer, timestamp, and legal basis, so that every process can be audited in real time.
Closing the time manipulation loophole through "rejection before the SLA expires" is not merely a technical matter. This concerns Indonesia's credibility in creating a healthy, fair, and predictable investment climate. The deemed approved mechanism must become a systemic reality, not merely rhetoric in regulations.
Muhammad Sirod is a functionary of the Indonesian Chamber of Commerce and Industry (Kadin) and Chairman of HIPPI East Jakarta.
One of the key reinforcements in PP 28/2025 is the strict application of Service Level Agreements (SLAs) or service time limits. Each licensing process is given a specific maximum timeframe. For example, in applications for Spatial Use Activity Conformity (KKPR), the Ministry of Agrarian Affairs and Spatial Planning/National Land Agency (ATR/BPN) is given a maximum deadline of 25 working days if documents do not require revision, or 40 working days if there are minor corrections.
In this context, the "deemed approved" mechanism plays an important role: if the authority does not issue a decision within the stipulated timeframe, the OSS-RBA system automatically issues the permit. The objective is straightforward: to ensure legal certainty, accelerate investment realisation, and eliminate unnecessary bureaucratic negotiation space.
However, PP 28/2025 does not explicitly regulate how the system treats administrative interventions that arise before the SLA expires. Consequently, any response or clarification request from a local agency — regardless of whether the grounds are legitimate — can still potentially reset the deemed approved countdown. This loophole is rather vulnerable to misuse.
For instance, consider a hypothetical case in Central Java where an entrepreneur submits a KKPR application for the construction of a shoe factory through OSS-RBA on 1 July 2025. According to the rules, by the 25th working day or 26 July, the permit should be automatically issued if there are no objections. However, suppose that on day 23, the local Spatial Planning Office sends a letter requiring the re-upload of a location map document on grounds of "incompatible format" — even though the file already uses the standard SHP format issued by the official ATR/BPN Ministry system.
The OSS-RBA system treats this letter as a legitimate administrative action, because there exists a loophole allowing permit issuance to be deferred (since it was responded to, even if the content is merely a rejection or objection). This means the SLA is considered "extended" and the countdown resets to zero. In practice, the entrepreneur must wait another 25 working days for a process that should have already been completed. If this strategy is repeated on day 24 of the next cycle, the entire process remains perpetually hostage to bureaucratic grey areas.
The fundamental problem lies in the absence of any distinction between substantive actions and administrative actions of a vague nature. If OSS-RBA records all interactions as "responses" without substantive verification filters, this is essentially no different from the old system — provided there is no independent verification from the central government to determine whether the clarification is relevant or merely bureaucratic manoeuvring. As a result, SLA logic becomes illusory. Business operators have no mechanism to challenge grounds they consider invalid. More problematically still, there are no administrative consequences or penalties for agencies that delay without strong justification.
Yet PP 28/2025 explicitly stipulates that OSS-RBA is the single reference — meaning all licensing requirements and procedures are codified within the system. No additional document requests or local interpretations that contradict central regulations should be permitted. In practice, however, a small loophole such as "a letter before the deadline" allows this principle to be circumvented.
A concrete solution that perhaps needs to be adopted is this: every clarification request that comes in should be temporarily quarantined by the central OSS-RBA system for verification over a maximum of three working days. If it fails substantive verification, the request is deemed invalid and the SLA continues to run.
Additionally, it is important to establish a fast-track appeal module or rapid dispute forum. Business operators must be given the right to challenge clarification requests they consider illegitimate. The central system should be required to issue a decision within a short timeframe (maximum three days), and the result should be final.
Performance evaluation of ministries and agencies should also shift from the quantity of letters or administrative responses towards the quality of decisions. For example, the number of permits issued without revision compared to total applications could serve as a healthier key performance indicator (KPI) that encourages effectiveness.
Improvements to audit trail quality and digital footprints within OSS-RBA also need to be promoted. Every agency action — whether a clarification request, rejection, or issuance — must be recorded with the responsible officer, timestamp, and legal basis, so that every process can be audited in real time.
Closing the time manipulation loophole through "rejection before the SLA expires" is not merely a technical matter. This concerns Indonesia's credibility in creating a healthy, fair, and predictable investment climate. The deemed approved mechanism must become a systemic reality, not merely rhetoric in regulations.
Muhammad Sirod is a functionary of the Indonesian Chamber of Commerce and Industry (Kadin) and Chairman of HIPPI East Jakarta.