Foreigners Buying Property in Bali (2026): The Digital Due-Diligence Checklist Serious Investors Actually Run

A serious foreign buyer evaluating a $1.2M USD Bali villa-rental project in 2026 runs roughly the same due-diligence playbook as a private-equity associate evaluating a small operating business. The artefacts are different — land certificates instead of share registers, KBLI codes instead of NAICS — but the structural test is identical: does the operator have the legal, regulatory, and operational maturity to hold up under scrutiny, and does the revenue story match the verifiable data?

The deals that go bad almost always do so for reasons that were visible pre-offer. A zoning class that doesn't permit the stated commercial use. An NIB that exists but isn't verified. A revenue claim that's 40% higher than what the OTA listing actually shows. A PT PMA structure that the buyer's lawyer flags two weeks after the deposit cleared. These are not subtle red flags — they are findable in a focused 8–15 hour due-diligence pass before any money changes hands.

This article is the actual checklist serious buyers run in 2026, structured into the eight verification gates that consistently separate good deals from the ones that look good. It complements the operator-side article on what real-estate sites should surface — same problems, from the buyer's seat.

Key takeaways

01 · What changed in 2025–2026 — why the old due-diligence checklists are now incomplete

The standard "Bali property due diligence" checklist circulating in foreign-buyer communities pre-2025 covered legal structure (PT PMA vs Hak Pakai vs leasehold), basic zoning, and yield projections. It worked because enforcement of the deeper compliance layer was loose. Three events in 2025–2026 changed that:

The Bingin Beach demolitions (July 2025). Governor Koster's 500-officer operation against 48 unlicensed clifftop structures broadcast a clear signal: physical demolition of non-compliant structures is on the menu, and it can happen fast. Buyers now have to verify not just the seller's documents but the zoning of the actual plot. A property with valid-looking paperwork sitting in a Green Zone is a write-off risk that didn't exist with the same magnitude two years earlier.

Permenpar No. 6/2025 enforcement (March 2026). The OSS-RBA framework formally activated, tying short-term-rental operation to verified-license status. A buyer purchasing a villa positioned for Airbnb-style income now has to verify that the underlying KBLI code permits that use (55193 yes, 68111 no), that the NIB is verified (not just issued), and that the PBG/SLF declares the building's function as tourism accommodation rather than residential. See Bali's 2026 Compliance Cliff for the full regulatory landscape.

Bali Regional Regulation No. 4/2026. Explicit prohibition on nominee land structures — the informal workaround that enabled foreign "ownership" for two decades via a friendly Indonesian citizen. Buyers who assumed they could "find a way" now need to verify the actual legal structure of any deal that involves Indonesian-citizen-named land titles. The risk that the nominee structure unwinds against the foreign buyer is non-trivial in 2026.

OTA verification cycles (active since March 2026). Airbnb, Booking.com, Agoda, Expedia, VRBO now run periodic license-verification cycles against the Ministry of Tourism database. A property whose NIB is "pending" or whose KBLI is mis-aligned faces silent delisting on the next verification pass — losing the primary booking channel without warning. Revenue projections that assume continued OTA presence need to verify that the operator can sustain OTA-listable status under the new framework.

The cumulative effect: a 2026 due-diligence pass needs to verify three additional things the 2023 checklists did not: zoning under current Bali Provincial regulations, NIB verification status (not existence), and OTA delisting risk.

02 · Gate 1 — legal structure (Hak Pakai, leasehold, PT PMA freehold)

Indonesian law prohibits foreign individuals from holding freehold (Hak Milik) title directly. The three legal structures available to foreign buyers in 2026 each have different implications:

Hak Pakai (Right to Use). Limited to 30 years initial term, with renewals possible. Held in the foreign buyer's name. Lower transaction cost, simpler structure, but legally weaker than freehold equivalents. Best fit for owner-occupied residential use; less optimal for income-generating commercial use.

Leasehold (Hak Sewa). Long-term lease (commonly 25–30 years with 25–30 year extension option). Held in the foreign buyer's name. Common for income-generating villas, especially when the underlying land is owned by a local family with whom a long-term relationship is established. Critical due-diligence check: remaining lease term, renewal mechanism specificity, sub-lease rights, transfer rights on sale.

PT PMA freehold. Foreign-investment company (Perseroan Terbatas Penanaman Modal Asing) holds the land freehold. Minimum paid-up capital IDR 2.5 billion (~$155k USD). The buyer's "ownership" is via shareholding in the PT PMA. Strongest structure for income-generating commercial use; necessary for operating a tourism accommodation business under KBLI 55193. Higher setup and maintenance cost (NPWP, annual audits, BPJS compliance).

Nominee structures. Foreign buyer "owns" via an Indonesian citizen acting as legal title-holder. Explicitly prohibited under Bali Regional Regulation No. 4/2026. Any deal proposing this structure in 2026 is a hard pass. Sellers who present nominee structures as "the standard way" are either mis-informed or deliberately exposing the buyer to known legal risk.

Verification artefacts the buyer should receive:

• Land certificate (sertifikat) — the actual document, not a photo or summary
• For leasehold: the executed lease agreement with all amendments
• For PT PMA: company deed, shareholder structure, paid-up capital evidence, NIB, NPWP, latest audited financials
• Lawyer's title-clear opinion from a Bali-based notaris (PPAT) who is independent of the seller

03 · Gate 2 — compliance state under Permenpar 6/2025

Even with a clean legal structure, the use case the buyer intends needs to be legal under the 2026 framework. The compliance gate is where most older Bali deals fail when re-evaluated.

Zoning (KKPR / GISTARU). Verify the plot sits in a zone that permits the intended use. Pink Zone (tourism) is required for KBLI 55193 villa-as-rental operation. Yellow Zone (residential) does not permit commercial tourism use, regardless of what neighbours are doing. Green Zone (protected, conservation, coastal) prohibits construction entirely. Roughly 80% of villas in Canggu are estimated to sit in Yellow Zone — many being marketed as rental-investment properties anyway. The GISTARU mapping tool publishes zoning publicly; verify before offer.

KBLI alignment. The business activity code on the operator's NIB must match the intended use. 55193 (Villa) permits the short-term-rental use case. 55130 (Pondok Wisata) is limited to Indonesian-citizen operators, max 5 rooms, lower compliance burden. 55110 (Hotel) covers larger formal operations. 68111 (Real Estate) does not permit tourism accommodation — using it to operate an Airbnb is grounds for delisting and fine.

PBG / SLF status. PBG (Persetujuan Bangunan Gedung — building approval) must declare the building's function. A residential PBG does not authorise commercial tourism use. SLF (Sertifikat Laik Fungsi — certificate of proper function) certifies the building actually meets that declared function, issued after physical inspection. Both should be current.

NIB verification. Not just "the NIB exists" — the NIB must be in verified status under the OSS system, not "issued" or "pending." Verification ties the NIB to the prior gates clearing (legal entity, KBLI, KKPR, PBG/SLF). A "pending" NIB is not operational and does not appear on OTA verification cycles.

PHR registration. NPWPD (Nomor Pokok Wajib Pajak Daerah — Regional Taxpayer ID) registered with the local Bapenda. PHR (10% of gross accommodation revenue) is the operator's obligation to collect and remit monthly. A property whose operator is not PHR-registered is either operating illegally or has under-reported revenue history — both are due-diligence flags.

These are all publicly verifiable. The buyer's local lawyer can pull most in 1–2 days. The willingness of the operator to surface these documents quickly is itself a strong signal of operational maturity.

04 · Gate 3 — revenue verification (the triangulation method)

Operator-supplied revenue numbers are not data — they are claims. The buyer's job is to triangulate.

Source 1 — operator's claimed numbers. ADR (average daily rate), occupancy, monthly gross revenue across the trailing 12–24 months. Should arrive in a structured format: month, gross revenue, number of bookings, ADR, occupancy %, channel mix. Vague aggregates ("we average 75% occupancy") are insufficient; insist on month-by-month detail.

Source 2 — public OTA listing data. The property's Airbnb / Booking.com / Agoda listings are public. Calendar gaps indicate booked dates. Review count and dates indicate booking volume floor. Pricing across the calendar (peak / shoulder / low season) indicates realised ADR. Third-party tools (AirDNA, Mashvisor, similar) provide modelled estimates of revenue based on this public data; for established listings the model is usually within ±15% of actual.

Source 3 — realistic seasonal modelling. Independent model using comparable property data: similar location, similar bedroom count, similar amenities, realistic peak/shoulder/low occupancy by season, realistic ADR by season. The model should produce a range; the operator's claimed numbers should fall within that range.

When the three sources align, the revenue story is credible. When they don't, the divergence pattern reveals the issue:

• Operator's numbers > public OTA data + model: revenue likely inflated, possibly by including private bookings that can't be verified.
• Operator's numbers > public OTA data, but match model: possibly real, with strong direct-channel mix. Verify direct-booking infrastructure exists (Gate 4).
• Public OTA data > operator's numbers: possibly under-reported for tax reasons, which is a red flag for the buyer (inherits the tax exposure).
• All three roughly equal: credible. Proceed to operational checks.

Additional verifications:

• Bank statements for the past 12 months showing booking payouts (operator may redact non-relevant transactions but should be willing to share)
• PHR payment receipts (proves PHR was actually paid on the claimed revenue)
• OTA payout statements (Airbnb, Booking.com Hotelier portal) showing the operator-side fee structure and net payouts

05 · Gate 4 — operational and digital infrastructure check

A property generating IDR 2B annual revenue on top of a WhatsApp-and-spreadsheet operation is buying the next operator a 30–40% margin loss the moment the relationship transfers. Operational maturity is structural, not optional.

PMS in use. Cloudbeds, Guesty, Lodgify, Hostaway, Smoobu, or equivalent — the operator should be able to name it, show a dashboard, and demonstrate that the reservation calendar lives there. "We track in Excel" is a near-term cost the buyer inherits.

Channel manager. If the property lists on multiple OTAs, a channel manager (SiteMinder, Cloudbeds CM, RateGain, native PMS CM) propagates inventory and prevents double-bookings. "We update each OTA manually" means inventory desync events are a weekly fire — and they will happen on the new buyer's watch.

Payment infrastructure. Midtrans or Xendit for IDR rails (BCA, Mandiri, BNI, BRI virtual accounts, GoPay, OVO). Stripe for international cards. The presence of these signals direct-booking capability; their absence means revenue depends on OTA payment processing with no fallback.

CRM and guest data. A property with a CRM (HubSpot, Pipedrive, or PMS-native) owns its guest relationships. A property without one re-acquires every guest from scratch. Repeat-guest revenue is the single most valuable booking segment; verify it exists in the historical data.

Direct-booking site on operator's domain. If the property has its own website with real booking functionality (not "Contact Us" forms), it has direct-channel capability — strongly de-risks the OTA delisting scenario. See Direct Booking Engine Architecture for the engineering view of what "real booking" actually means.

Foreign-guest reporting workflow. Every foreign guest must be reported to local Polsek within 24 hours of check-in (immigration law). A property that does this manually (passport photos via WhatsApp, paper forms) is a compliance risk that scales linearly with guest volume. A property that does it through structured workflow (passport capture at booking, auto-generated reporting documents) is operationally mature.

Reporting and analytics. Monthly P&L, occupancy reports, channel-mix analysis, repeat-guest tracking. If the operator can produce these on request, the business is being run; if not, the buyer is acquiring an operational rebuild. The structured way to expose these reports to a serious buyer post-offer — gated, audit-trailed, version-controlled — is the Investor Portals service pattern, which is increasingly what mature Bali developers run for their LP / co-investor base.

06 · Gate 5 — independent financial modelling

Seller projections are sales documents. The buyer's job is to model independently using 2026 fee economics and the cancellation differential most projections quietly omit.

Realistic occupancy by season. Bali 2026 peak season occupancy for a well-positioned property: 78–88%. Shoulder season: 55–70%. Low season: 38–55%. Annual blended: 60–70%. Sellers quoting 85%+ blended occupancy are projecting aspirationally; model on 60–70%.

Realistic ADR by season. Pull from the property's own historical data + comparable-property data. Apply 5–10% downward adjustment from claimed numbers as a safety margin for the buyer.

Channel cost structure. Apply the 2026 OTA fee profile (Airbnb host-only 15.5%, Booking.com 15–18% with Genius/Preferred uplift, Agoda 17–25%). Add the cancellation differential — realised revenue is approximately 78% of gross calendar value on OTA bookings, 89% on direct. See Direct Booking vs Airbnb (2026) for the full math.

Operating cost stack. Realistic 2026 Bali operating-cost ranges:

• Property management fee: 18–25% of gross revenue
• Staff (housekeeping, gardener, maintenance, security): IDR 4–8M/month per villa
• Utilities (electricity, water, internet): IDR 2.5–4M/month at full occupancy
• Maintenance reserve: 8–12% of gross revenue
• Marketing + paid acquisition: 3–8% of gross revenue
• Compliance overhead (PHR filings, NIB renewals, foreign-guest reporting infrastructure): IDR 2–5M/month per property

Tax stack. PHR 10% of gross + PPN 12% if operator crosses IDR 4.8B annual turnover + PPh on operator income. Combined effective tax load can exceed 30% of gross revenue. Confirm whether the buyer will be the operating PT PMA (full tax exposure) or whether operations are leased out (different tax structure).

Net to owner. After all of the above, a well-operated single villa generating IDR 2B gross typically delivers IDR 600–900M net to owner annually. Sellers projecting IDR 1.2B+ net on the same gross are not modelling honestly.

Sensitivity testing. Model −20% occupancy, −15% ADR, and the combination. If net-to-owner goes negative in any reasonable downside scenario, the deal price needs reconsideration.

07 · Red flags vs green flags — consolidated

Across due-diligence engagements in 2024–2026, the same patterns predict deal quality. None is conclusive alone; clusters of three or more should be treated as serious warning signals.

Red flags (each one earns a verification escalation; three or more is a pass)

• Operator can't produce the NIB document on request (or produces an unverified-status NIB).
• Property is in Yellow Zone but marketed as commercial tourism rental.
• KBLI on the NIB is 68111 (Real Estate) for a property positioned as villa rental.
• Revenue claims exceed AirDNA/Mashvisor model by more than 25%.
• No PMS in use; reservations live in WhatsApp + Excel.
• No PHR registration with the local Bapenda.
• Operator proposes a nominee structure for foreign-buyer access.
• Photographs on the website show finishes that don't match the actual property.
• Multiple online review sites show pattern of "cancelled at last minute" or "double-booked" complaints.
• Bank-statement payout volume doesn't support claimed revenue.
• Seller pressures fast close ("another buyer is interested") within 5 business days of first contact.
• Title document has unresolved liens, prior disputes, or boundary discrepancies.

Green flags (each one adds confidence; clusters of three or more usually indicate a credible deal)

• Operator surfaces NIB / KKPR / PBG / SLF / PHR documents within 48 hours of request, with verification references.
• Property is in confirmed Pink Zone (tourism) with KBLI 55193 alignment.
• Revenue claims align with AirDNA model within ±15%.
• Active PMS (Cloudbeds / Guesty / Lodgify) with dashboard demonstration on request.
• Channel manager in use; inventory desync events documented as rare.
• Direct-booking site on operator's domain with real booking functionality.
• Foreign-guest reporting workflow is structured (passport captured at booking).
• Monthly P&L and channel-mix reports produced on request.
• Bank statements + PHR payment receipts + OTA payout statements all align with claimed numbers.
• PT PMA has clean audit history (3+ years of audited financials).
• Operator's lawyer is independent of seller (separate firm, separate engagement).
• Seller offers structured 30–60 day due-diligence window without pressure tactics.

The pattern where the most green flags cluster — a single brand-and-data spine across development, sales, and rental operations — is the one we document in Vertically Integrated Developers in Bali: Investland and the Multi-Brand Infrastructure Pattern. When a buyer encounters that level of operational integration on the sell-side, the rest of the due-diligence pass usually moves faster.

08 · Notes from the field

H-Studio Indonesia performs digital due-diligence audits for foreign buyers evaluating Bali income-generating real estate: compliance state verification (NIB / KKPR / PBG / SLF / PHR), revenue triangulation against OTA public data + AirDNA modelling, operational infrastructure assessment (PMS / channel manager / CRM / direct-booking maturity), and independent financial modelling under 2026 fee + cancellation economics.

This is an engineering audit, not legal advice. Legal due diligence (title verification, lease enforceability, PT PMA structure review) is the scope of a licensed Bali notaris (PPAT) and lawyer — we coordinate with the buyer's lawyer rather than replacing them. The combined audit typically runs 2–3 weeks at 8–15 hours of senior engineering time, before any offer is made.

If you are evaluating a Bali property in the $500k–$5M USD band and want a structured pre-offer audit, the conversation starts with a System Mapping ($750–1.5k, 1 week). Written audit report. Risk-classified findings. Clear go/no-go recommendation. Coordinated with your lawyer.

For the operator-side view of what professional Bali real-estate sites should surface — the structural information a serious buyer expects to see — see Why Most Bali Real Estate Websites Fail to Convert Foreign Buyers.

For the full 2026 regulatory framework the due-diligence checks reference — Permenpar 6/2025, zoning enforcement, OTA verification cycles — see Bali's 2026 Compliance Cliff.

For the revenue economics underlying the financial modelling in Gate 5, see Direct Booking vs Airbnb in Bali (2026).

For real-estate-agency platform work more broadly, see Real Estate & Property Agencies.