Bali's API Licence Check Shows Where STR Compliance Is Heading

Indonesia’s Ministry of Tourism is building an API based verification system that will let online travel platforms check a host’s licence directly against national records. The target launch is June 2027, and it turns months of pressure on unlicensed Bali villas into an automated mechanism that governments elsewhere are likely to study closely.

Tourism Minister Widiyanti Putri Wardhana announced the plan in late May 2026. Agoda, Booking.com, Airbnb and other platforms will be able to check a host’s business identification number (NIB), industry classification code (KBLI) and business activity number (NKU) against the national Online Single Submission system. Once the system is live, platforms will be barred from marketing listings without a valid licence, licensed accommodation is expected to carry an on platform label, and operators flagged as unlicensed will have two months from official notification to become compliant or face suspension.

Metric	Figure
Target system launch	June 2027
Identifiers checked	NIB, KBLI and NKU
Grace period once flagged	2 months
Villas with valid business ID, growth (Mar 2025 to May 2026)	+76.4%
Short stay accommodation business IDs, same period	+46.5%

The registration figures matter because they arrive before any automated check exists. Villa businesses holding a valid business ID rose 76.4 percent between March 2025 and May 2026, which suggests the enforcement drive pushed by Governor Wayan Koster, who has repeatedly asked platforms to stop marketing unlicensed villas, is already pulling operators into the formal system.

Why this is a different kind of enforcement

Most registration regimes rely on a number printed on a listing. The number proves little, because it only shows that a host typed something into a field. Bali’s model has the platform query the state record itself. The classification code adds a second layer: a licence issued for the wrong business activity can fail a check that a simple “does a licence exist” test would pass.

For operators, the practical shift is from verbal warnings to a concrete timeline and a defined mechanism. Hosts who register now are ahead of the automated checks rather than reacting to them.

Where verification is already in place

Bali is not starting from zero in global terms. Several major markets already tie a registration number to platform duties, although the depth of the check varies.

Market	Mechanism	Status
European Union	Regulation (EU) 2024/1028: registration number shown on every listing, platform validity checks, activity data sent to national single digital entry points, monthly for larger platforms	Applies since 20 May 2026
Spain	Regional tourist registers remain; the state wide register created in 2025 was annulled by the Supreme Court (Judgment 620/2026, 19 May 2026), which also removed the state level duty to refuse unnumbered listings, while data reporting duties stay	In flux
Italy	National identification code (CIN); Airbnb announced it would remove listings without a CIN	In force
Japan	Minpaku notification number shown on each listing; Airbnb shares the number and nightly booking counts with the Japan Tourism Agency daily; 180 day annual cap	In force since June 2018
New York City	Local Law 18 bars platforms from processing transactions for unregistered rentals, using the city’s verification system	Platform enforcement since 5 September 2023
British Columbia	Provincial registry mandatory since 1 May 2025; platforms must check numbers against registry data and share listing data monthly	In force
Indonesia	API link between platforms and the national licensing system	Target June 2027

Spain’s first year of its register shows how powerful the model can be. Registrars rejected 84,250 applications, and those properties had to come off online platforms. The same country now shows its limits.

The outlook for major STR markets

Three trends stand out for the next phase.

First, verification is moving from a printed number to a live query. The EU rules already require platforms to run validity checks, and British Columbia and New York City have platforms check against official registries. Bali goes a step further by linking directly to the business licensing record.

Second, data flows are becoming the engine of enforcement. Japan’s daily reporting, the EU entry points and British Columbia’s monthly feeds give authorities a view of real activity. Combined with automated verification, unlicensed supply becomes harder to hide.

Third, legal architecture will decide the pace. Spain’s ruling shows that a verification system is only as durable as the authority behind its registry. Markets with a single, uncontested register are best placed to adopt API checks. Fragmented systems are likely to move more slowly.

What operators should do now

Action	Why it matters
Confirm the licence matches the actual activity	Classification codes can be checked, not just licence existence
Keep identifiers consistent across every channel	Automated checks compare the same record everywhere
Track renewals and registration deadlines	Lapsed numbers are the first to fail automated validation
Plan for short remediation windows	Two months from notification is the proposed Bali standard

Cover photo: Matthew Stephenson on Unsplash.