The March 2026 verification push wasn't a one-time event — it was the start of a permanent regime (for the underlying regulatory context, see our explainer on the Bali 2026 compliance cliff and Permenpar 6/2025). Airbnb, Booking.com, and Agoda now tie an operator's ability to keep a listing online to verifiable license status, and that check recurs: at renewal, on a complaint, on a tax-data mismatch, or in the next enforcement sweep. So the goal isn't to "pass once." It's to build a small, repeatable compliance system you can re-run on demand. This checklist treats it exactly that way — fourteen steps, each with a concrete action and an output you can file, so the next verification cycle is a five-minute export instead of a three-week scramble.
A quick reality note before you start: the regulatory ground is moving. KBLI 2025 (BPS Reg 7/2025) renumbered several tourism codes from December 2025 and is still settling into the OSS system, and Bali is nine regencies plus Denpasar, each with its own tax office and procedures. Treat the steps below as a framework to verify against your regency and a qualified advisor — not as legal advice.
1. Audit your current NIB status in OSS
Start at the source of truth. Log in to the OSS system (oss.go.id) and pull your NIB (Nomor Induk Berusaha — the 13-digit business identification number). Confirm it is active, that the entity behind it is the one actually operating the property, and that the registered KBLI and risk-based licenses (Sertifikat Standar / TDUP where applicable) are present and current. Output: a dated PDF export of the NIB and its OSS detail page, stored in your repository (Step 7). This is the first document any platform or inspector asks for.
2. Verify KBLI alignment — and don't rely on 68111
Read the actual KBLI on your NIB, not the marketing word "villa." The hard rule: 68111 (real estate) cannot be used by a PT PMA to justify short-term, nightly rental — under KBLI 2025 it's narrowed to residential development and sale, with long-term rental at 68112. That misuse is one of the most easily identified violations. The accommodation code you should hold is the contested part: the Villa activity is 55193 under the old classification and 55203 under KBLI 2025, and whether a foreign-owned PT PMA can hold it is genuinely disputed (some sources treat it as MSME-reserved). Do not assume — confirm your eligibility and the correct current code against live OSS and counsel. (See our companion piece, the KBLI codes Bali operators get wrong, for the full breakdown.) Output: a one-line note in your repository recording your registered code, its KBLI 2025 successor, and confirmation of eligibility.
3. Confirm KKPR zoning (the Pink Zone question)
A license never overrides location. Verify your property's spatial-planning approval — KKPR (Kesesuaian Kegiatan Pemanfaatan Ruang) — and that the parcel sits in a zone that permits commercial tourism accommodation (commonly the "Pink Zone" / tourism zone on Bali's spatial maps). A hospitality KBLI in a residential or green zone is not operable, regardless of the entity type, and the government uses GPS-based spatial planning to approve or deny. Output: the KKPR document and a screenshot of the zoning map reference for the parcel.
4. Update PBG/SLF building documentation
Two building documents underpin a legal commercial operation: the PBG (Persetujuan Bangunan Gedung — building approval, the successor to the old IMB) for commercial use, and the SLF (Sertifikat Laik Fungsi — certificate of functional suitability/safety). Confirm both exist, match the building's actual use, and are current. A residential PBG on a property run as a commercial villa is a gap an inspector will find. Output: PBG and SLF copies with their issue/expiry dates logged.
5. Register NPWPD for local accommodation tax (PBJT)
The local accommodation tax — historically called PHR (Pajak Hotel dan Restoran), now reorganised as PBJT (Pajak Barang dan Jasa Tertentu) under the 2022 HKPD Law (UU 1/2022) — is 10% on accommodation revenue, collected by the operator and remitted to the regency's Bapenda (local tax agency). To pay it you need an NPWPD (Nomor Pokok Wajib Pajak Daerah — local tax ID). Many villas found operating without one face back-assessment of their entire revenue history, so this is not optional. Register with the Bapenda of your specific regency (Badung, Gianyar, etc. — each administers PBJT separately). Output: NPWPD certificate filed, with the regency and rate noted.
6. Set up a monthly PBJT remittance workflow
Registration is the easy part; the recurring discipline is what survives an audit. Build a simple monthly workflow: tally accommodation revenue, calculate the 10% PBJT, file and remit to Bapenda (typically due by the 15th of the following month), and keep the receipt. Separately, track your national obligations — PPh (income tax on rental) and, if you exceed the IDR 4.8 billion threshold with hotel-like services, PPN (VAT, 11%) via the DGT's Coretax system. Output: a recurring monthly task with a checklist and a folder of filed returns and payment receipts. Treat it like a cron job, not a memory.
7. Build a digital document repository
Centralise everything above into one structured, access-controlled repository (cloud drive or a proper document store). A workable folder structure:
entity/— deed, NIB, OSS exportsproperty/— KKPR, PBG, SLF, land title/leasetax/— NPWPD, monthly PBJT returns, PPh/PPN filingsguests/— APOA receiptsplatform/— OTA verification confirmations
The verification cycle is mostly a retrieval problem — if your documents are scattered across email and WhatsApp, every cycle is a crisis. Output: a single, current, dated repository that any authorised team member can export from in minutes.
8. Set up renewal alerts for expiring documents
Compliance erodes by expiry, not by event. Most operators don't fail because they never had the documents — they fail because the SLF lapsed, the lease renewal slipped, or a license needed re-verification and nobody was watching. Put every document with a date — NIB status checks, PBG/SLF, land title/lease, license renewals, annual tax filings — into a calendar with alerts at 90, 60, and 30 days before expiry, with a named owner for each. Output: a renewals calendar with owners and lead-time alerts.
9. Configure the APOA foreign-guest reporting workflow
This is a separate, immigration obligation that operates independently of your business licenses — and it's heavily enforced. Under the Immigration Law (Law 6/2011, as amended by Law 63/2024, Article 72), accommodation providers — hotels, villas, homestays, guesthouses, with no small-host exemption — must report foreign guests through APOA (Aplikasi Pelaporan/Pengawasan Orang Asing) at the official portal apoa.imigrasi.go.id. The mechanism is report at both check-in and check-out: log in, upload a clear photo/scan of the passport ID page, and retain the generated reporting receipt; at check-out, log the departure. Build this into your check-in SOP so it happens every time, automatically. Non-reporting carries penalties under the Immigration Law (sources cite figures ranging from IDR 25 million / short imprisonment upward — confirm current exposure). Output: an APOA step embedded in the check-in/out runbook, with receipts saved to guests/.
10. Document the audit trail on bookings and payments
An inspector or tax auditor reconstructs your operation from records, so keep them reconstructable. For every booking, you want a linkable chain: reservation (with channel and gross price) → guest record (APOA receipt) → payment received (net of OTA commission) → tax base declared. Keep these in a structured ledger, not just inside the OTA dashboards (which you may lose access to or which may change). Output: a booking ledger that lets you trace any single reservation from inquiry to tax filing.
11. Do a dry run of each platform's license verification
This is where the "verification cycle" literally happens. Each OTA now has a field to enter/upload your license details — most prominently the NIB — into the listing's compliance or "regulatory information" section (Airbnb, Booking.com, and Agoda each have their own dashboard flow). Don't wait for a deadline notice: proactively enter your NIB into each platform now and confirm it is accepted/validated, not just submitted. If a platform rejects or flags it, you've found the problem on your schedule instead of theirs. Output: a dated screenshot of the accepted verification status on each platform, filed in platform/. (Note: there is no operator-facing developer API here — "verification" means the platform's license field validating against your real NIB.)
12. Prepare a Bapenda spot-audit response procedure
Local tax audits on high-end villas are increasing, and they arrive with little notice. Write a short runbook before you need it: who is the point of contact, where the documents live (your repository), which regency's Bapenda has jurisdiction, what the last filed PBJT returns show, and which advisor to call. A spot audit handled with a calm, complete document export is a non-event; the same audit handled by improvising is how a small discrepancy becomes a back-assessment. Output: a one-page audit-response runbook with contacts and document links.
13. Run a quarterly compliance review
Set a recurring quarterly review to re-run the high-value checks: NIB still active, KBLI still correct (especially as KBLI 2025 finishes integrating into OSS), PBG/SLF and lease not approaching expiry, PBJT filings up to date, APOA receipts complete, and platform verifications still green. Compliance built once and never revisited silently rots — the quarterly cadence catches drift while it's cheap to fix. Output: a dated quarterly review checklist with any remediation items and owners.
14. Cross-check OTA-reported revenue against your tax records
This is the step that most directly prevents a painful audit, because it mirrors what the authorities now do automatically. Tax administration increasingly compares gross bookings reported by the OTAs against the revenue base you declared (PBJT to Bapenda, income to DGT/Coretax). A material gap — say, IDR 300M in platform bookings against a far smaller declared base — generates a discrepancy flag and a review. Reconcile this yourself, monthly: pull each platform's gross-earnings report, compare to your declared base, and make sure differences are explainable (legitimately, OTA commission reduces what you receive, but the tax base is generally the accommodation charge, not your net — confirm the correct base with your accountant, since getting this wrong is itself a common, costly error). Output: a monthly reconciliation note showing platform gross vs declared base, with explanations for any variance.
The bigger picture
Every step above is also an argument for reducing single-channel dependence. The same clean compliance base — verified NIB, correct KBLI, current building and tax documents, a real booking ledger — is exactly what lets you operate confidently on your own direct-booking channel, where you keep the OTA commission instead of paying 15%+ on every reservation. Compliance done as a system isn't only defensive; it's the foundation that makes hospitality and villa operators less dependent on the platforms doing the verifying.
The operators who find these cycles stressful are the ones reconstructing everything from scratch each time. The operators who find them trivial built the system once: a repository, a renewals calendar, a monthly tax-and-reconciliation routine, and an APOA habit — the same architecture we engineer through our Bali compliance and operational reporting service. Build it once, and the next verification cycle is an export, not an emergency.
Reviewed by the H-Studio Indonesia editorial team.
Important disclaimer. This article is general, practical guidance for operators — not legal, tax, or immigration advice. Indonesian business classification (KBLI 2025), licensing, immigration reporting (APOA), and local tax (PBJT) rules are changing and were mid-transition at the time of writing; codes, rates, deadlines, procedures, and penalties vary by regency and can change without notice, and some points (notably foreign eligibility for the Villa code) are disputed between sources. Always verify against the live OSS system (oss.go.id), the relevant regency Bapenda, the official APOA portal (apoa.imigrasi.go.id), and a qualified Indonesian lawyer and tax advisor before relying on anything here.
