{"pack_id":"bootminds.legal","pack_name":"Bootminds Legal & Co. Setup Pack","pack_version":"1.0.0","priority":100,"license":"BSL-1.1","registry_version_hash":"69cac88368a9645f5c629806508f3f3ef5d3ccaa460919bccbf197813bde0490","function":"Legal","authored_by":"Bootminds","description":"Discovery + decision scaffolding for legal entity setup, statutory registrations, signatories, banking, and data protection for new GCC / shared services builds. Five workstreams (entity incorporation, registrations & compliance, signatories & authority, banking & treasury, contracts & IP) covering ~20 questions and 8 decisions with a single pack-wide maturity rubric. Excludes compliance-control templates (deferred to Phase 1B alongside PDPL alignment).","required_runtime_capabilities":["multi_step_approval","programme_memory"],"workstream_templates":[{"workstream_template_id":"legal.entity_incorporation","name":"Entity incorporation","description":"Choice of country, entity type, parent ownership, share capital, and director appointments for the GCC vehicle.","priority_tier":"P0","display_order":1,"default_owner_role":"ProgrammeLead"},{"workstream_template_id":"legal.registrations_compliance","name":"Registrations & statutory compliance","description":"Tax/VAT/GST, registrar/MCA-equivalent filings, industry-specific schemes (e.g., STPI/SEZ), and statutory calendar bootstrap.","priority_tier":"P0","display_order":2,"default_owner_role":"Stakeholder","depends_on_workstream_template_ids":["legal.entity_incorporation"]},{"workstream_template_id":"legal.signatories_authority","name":"Signatories & authority","description":"Authorised signatory matrix, board resolutions, powers of attorney, and delegation thresholds.","priority_tier":"P0","display_order":3,"default_owner_role":"ProgrammeLead","depends_on_workstream_template_ids":["legal.entity_incorporation"]},{"workstream_template_id":"legal.banking_treasury","name":"Banking & treasury setup","description":"Corporate bank account opening, signatory mandates, payment-system integrations, and KYC documentation pack.","priority_tier":"P1","display_order":4,"default_owner_role":"Stakeholder","depends_on_workstream_template_ids":["legal.entity_incorporation","legal.signatories_authority"]},{"workstream_template_id":"legal.contracts_ip","name":"Contracts, IP & data protection","description":"DPA scaffolding, employee confidentiality and IP assignment, customer NDAs, and cross-border transfer mechanisms. Excludes PDPL-specific controls (Phase 1B).","priority_tier":"P1","display_order":5,"default_owner_role":"Stakeholder","depends_on_workstream_template_ids":["legal.entity_incorporation"]}],"capability_templates":[],"question_templates":[{"question_template_id":"legal.q.target_country","prompt":"What is the target country of incorporation for the GCC entity, and what is the principal driver of that choice (talent pool, tax incentive, proximity to parent, customer location)?","rationale_skeleton":"Drives tax treatment, statutory obligations, repatriation pathways, and compliance posture. Common candidates for KSA-anchored groups: India (TN/Karnataka with GCC incentives), UAE (Dubai/Sharjah free zones), Singapore (RHQ). The principal driver locks downstream choices on labour law, banking, and DPA scaffolding.","scope":"GCC","category":"Entity choice","subcategory":"Jurisdiction","priority":"P0","artefact_type":"text","workstream_template_id_ref":"legal.entity_incorporation","default_raci_contributors":["ClientAdmin","ClientExecutive"]},{"question_template_id":"legal.q.parent_ownership_pct","prompt":"What percentage of the GCC entity will be held by the parent / group holding company, and are there minority shareholders (local partner, JV, ESOP trust)?","rationale_skeleton":"Ownership pattern determines whether the entity is a wholly-owned subsidiary, JV, or partially-owned vehicle. Has knock-on effects on consolidation, transfer pricing, dividend repatriation, and certain jurisdictional restrictions (e.g., mandatory local shareholding in some MENA jurisdictions).","scope":"GCC","category":"Entity choice","subcategory":"Capitalisation","priority":"P0","artefact_type":"table","workstream_template_id_ref":"legal.entity_incorporation","default_raci_contributors":["ClientAdmin","ClientExecutive"]},{"question_template_id":"legal.q.share_capital","prompt":"What is the proposed authorised and paid-up share capital for the GCC entity at incorporation, and the anticipated capital-injection schedule for years 1-3?","rationale_skeleton":"Drives statutory minimums (jurisdiction-specific), opening bank deposits, and stamp-duty exposure. Some regulators (e.g., MCA in India, DIFC in UAE) tie licence categories to capital thresholds.","scope":"GCC","category":"Capitalisation","priority":"P1","artefact_type":"currency","workstream_template_id_ref":"legal.entity_incorporation","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.proposed_directors","prompt":"Who are the proposed directors (including any independent / local-resident directors required by jurisdiction), and what are their proposed roles (executive vs. non-executive)?","rationale_skeleton":"Most jurisdictions require at least one local-resident director (India: one resident director under Companies Act s.149; UAE mainland: dependent on activity; Singapore: at least one ordinarily resident). Director identity gates incorporation filings and KYC for banking.","scope":"GCC","category":"Governance","subcategory":"Directors","priority":"P0","artefact_type":"entity-row","workstream_template_id_ref":"legal.entity_incorporation","default_raci_contributors":["ClientAdmin","ClientExecutive"]},{"question_template_id":"legal.q.registered_office","prompt":"What is the planned registered office address for the entity, and is it a leased commercial premises, virtual office, or free-zone-provided address?","rationale_skeleton":"Registered office is a statutory requirement; some jurisdictions (e.g., India MCA, KSA MoC) require physical premises with verifiable lease; free zones typically provide a registered address as part of the licence. Choice here interacts with lease registration and occupancy permits.","scope":"GCC","category":"Governance","subcategory":"Registered office","priority":"P1","artefact_type":"text","workstream_template_id_ref":"legal.entity_incorporation","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.tax_registrations","prompt":"Which tax registrations are required at or near incorporation (corporate tax / VAT / GST / withholding / payroll), and what are the trigger thresholds for each?","rationale_skeleton":"Tax-registration omissions are a common cause of post-incorporation penalties. Most jurisdictions require corporate-tax registration concurrent with incorporation; VAT/GST may trigger by turnover threshold or voluntarily for input-credit recovery; payroll tax registration is gated by first hire.","scope":"GCC","category":"Statutory registrations","subcategory":"Tax","priority":"P0","artefact_type":"checklist","workstream_template_id_ref":"legal.registrations_compliance","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.industry_registrations","prompt":"Are any industry-specific registrations required for the GCC's planned activity (e.g., STPI / SEZ for IT services in India, telecoms permits, financial-services licences, healthcare data permits)?","rationale_skeleton":"Industry-specific schemes can unlock tax holidays and duty exemptions (e.g., STPI in India offers customs/GST benefits for IT export units) but bring their own filing cadence. Some require pre-incorporation approval, so timing must be aligned with the entity setup plan.","scope":"GCC","category":"Statutory registrations","subcategory":"Industry-specific","priority":"P1","artefact_type":"checklist","workstream_template_id_ref":"legal.registrations_compliance","default_raci_contributors":["ClientAdmin","BootmindsStaff"]},{"question_template_id":"legal.q.statutory_calendar","prompt":"What is the consolidated statutory filing calendar for the GCC (corporate filings, tax returns, payroll filings, statutory audit), with owner, due date pattern, and consequence-of-late on each item?","rationale_skeleton":"Builds the operational compliance backbone. A missed filing is rarely catastrophic in isolation but compounds into directors-disqualification or name-strike-off exposure over time. The calendar is the single artefact a new legal-ops team needs from day one.","scope":"GCC","category":"Statutory compliance","subcategory":"Filing calendar","priority":"P1","artefact_type":"table","workstream_template_id_ref":"legal.registrations_compliance","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.signatory_matrix","prompt":"Who are the authorised signatories for the GCC entity across the categories of contracts, financial instruments, regulatory filings, and HR? Include monetary thresholds and joint-signature requirements.","rationale_skeleton":"The signatory matrix is the operational expression of board-delegated authority. Without it, even routine vendor contracts stall at signature. Matrices typically distinguish (a) single-signature up to threshold, (b) joint-signature above threshold, (c) board-approval-required above ceiling.","scope":"GCC","category":"Authority","subcategory":"Signatory matrix","priority":"P0","artefact_type":"table","workstream_template_id_ref":"legal.signatories_authority","default_raci_contributors":["ClientAdmin","ClientExecutive"]},{"question_template_id":"legal.q.board_resolutions_inventory","prompt":"What inventory of board / shareholder resolutions is required to operationalise the GCC at launch (account opening, lease execution, statutory filings, PoA grants), and who drafts each?","rationale_skeleton":"Banks and registrars demand specific resolutions in specific formats; missing or mis-worded resolutions are the single biggest cause of bank-account-opening delays. A drafted inventory at incorporation saves weeks downstream.","scope":"GCC","category":"Authority","subcategory":"Board resolutions","priority":"P1","artefact_type":"checklist","workstream_template_id_ref":"legal.signatories_authority","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.poa_grants","prompt":"Are any powers of attorney required (e.g., to local agents for in-country filings, to the global mobility provider for visa filings, to legal counsel for litigation), and what is the scope/duration of each?","rationale_skeleton":"PoAs are convenient but legally significant; jurisdictions vary on whether they must be notarised, apostilled, and consularised. Over-broad PoAs are a control risk; under-scoped ones force re-issuance.","scope":"GCC","category":"Authority","subcategory":"Powers of attorney","priority":"P2","artefact_type":"table","workstream_template_id_ref":"legal.signatories_authority","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.banking_partner_shortlist","prompt":"Which banks are on the shortlist for the GCC's primary operating account, and what are the comparative timelines, fee structures, and digital-banking capabilities (API, payment rails, FX) of each?","rationale_skeleton":"Bank-account-opening is the most schedule-critical legal-ops item: 6-12 weeks is typical in India and KSA, longer for FATCA-flagged ownership structures. Choice of bank also gates payment-system integration (host-to-host, API, SWIFT).","scope":"GCC","category":"Banking","subcategory":"Partner selection","priority":"P0","artefact_type":"table","workstream_template_id_ref":"legal.banking_treasury","default_raci_contributors":["ClientAdmin","BootmindsStaff"]},{"question_template_id":"legal.q.bank_kyc_pack","prompt":"What KYC documents must be assembled for bank-account opening (certified incorporation docs, beneficial-ownership chart, director KYC, source-of-funds), and what is the apostille/legalisation status of each?","rationale_skeleton":"KYC packs are unforgiving: a single un-apostilled document restarts the bank's clock. Beneficial-ownership disclosure under FATCA / CRS adds a layer for any entity with US or multi-jurisdictional ownership.","scope":"GCC","category":"Banking","subcategory":"KYC","priority":"P0","artefact_type":"checklist","workstream_template_id_ref":"legal.banking_treasury","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.dpa_scope_and_role","prompt":"For data flows between the parent / group and the GCC entity, will the GCC be a controller, joint-controller, or processor of personal data, and which DPA template applies?","rationale_skeleton":"Controller-vs-processor designation drives every downstream data-protection obligation: lawful basis, data-subject-rights handling, breach notification, sub-processor approval, audit rights. Getting this wrong means re-papering every customer and vendor contract. Phase 1B will layer PDPL-specific controls on top of this baseline.","scope":"GCC","category":"Data protection","subcategory":"Controller / processor","priority":"P0","artefact_type":"text","workstream_template_id_ref":"legal.contracts_ip","default_raci_contributors":["ClientAdmin","BootmindsStaff"]},{"question_template_id":"legal.q.cross_border_transfer_mechanism","prompt":"What cross-border transfer mechanism will be used for personal data flowing into / out of the GCC's jurisdiction (Standard Contractual Clauses, adequacy, intra-group BCRs, derogations)?","rationale_skeleton":"Cross-border transfer is the choke-point in any multi-jurisdictional GCC. SCCs are the default fallback; intra-group BCRs are heavier upfront but cleaner long-term; adequacy decisions cover only a handful of jurisdictions. Choice locks into vendor contracts and customer DPAs.","scope":"GCC","category":"Data protection","subcategory":"Cross-border transfer","priority":"P1","artefact_type":"text","workstream_template_id_ref":"legal.contracts_ip","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.sub_processor_register","prompt":"What is the initial sub-processor register for the GCC (cloud providers, SaaS vendors, payroll processors, etc.), and what is the customer-notification process for additions?","rationale_skeleton":"Most customer DPAs require advance notice (30-60 days) before adding sub-processors. A maintained register avoids retrofitting and keeps the GCC clean on customer audits.","scope":"GCC","category":"Data protection","subcategory":"Sub-processors","priority":"P2","artefact_type":"table","workstream_template_id_ref":"legal.contracts_ip","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.dpo_appointment","prompt":"Is a Data Protection Officer (DPO) required by law for the GCC, and if so who is the appointee and what is their reporting line?","rationale_skeleton":"DPO appointment is mandatory under several regimes (GDPR Art.37, certain KSA / UAE conditions). The DPO's independence and reporting line matter: a finance-reporting DPO is non-compliant under most regimes.","scope":"GCC","category":"Data protection","subcategory":"DPO","priority":"P2","artefact_type":"text","workstream_template_id_ref":"legal.contracts_ip","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.employee_ip_assignment","prompt":"What is the standard employee IP-assignment and confidentiality clause set for GCC hires, and how does it interact with local labour-law restrictions (e.g., on inventions made off-hours / outside scope)?","rationale_skeleton":"Without robust IP-assignment, code and content generated by GCC employees may not vest in the entity, creating exposure to claims by departing staff. Local labour codes (Indian Copyright Act s.17, UAE Labour Law) impose specific carve-outs.","scope":"GCC","category":"Contracts & IP","subcategory":"Employment IP","priority":"P1","artefact_type":"text","workstream_template_id_ref":"legal.contracts_ip","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.customer_nda_template","prompt":"What is the standard mutual NDA template the GCC will use for inbound and outbound discussions, and what are the carve-outs (term, residual-knowledge, return-or-destroy)?","rationale_skeleton":"A negotiated standard mutual NDA shortens deal cycles; without one, every prospect adds 1-3 weeks of redlining. Key carve-outs typically are around residual-knowledge (worth fighting for) and return-or-destroy on termination (often acceptable to concede).","scope":"GCC","category":"Contracts & IP","subcategory":"NDAs","priority":"P2","artefact_type":"file","workstream_template_id_ref":"legal.contracts_ip","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.lease_registration","prompt":"If the GCC will operate from leased premises, what are the lease registration, stamp-duty, and fitout-permission requirements in the relevant jurisdiction, and what is the planned lease commencement vs. occupancy timeline?","rationale_skeleton":"Lease registration is sometimes a precondition for the registered-office address to be accepted by registrars and banks. Fitout permissions (especially in free zones) can add 4-8 weeks; misalignment between lease commencement and team-onboarding produces rent on unusable space.","scope":"GCC","category":"Real estate","subcategory":"Lease registration","priority":"P2","artefact_type":"text","workstream_template_id_ref":"legal.entity_incorporation","default_raci_contributors":["ClientAdmin"]},{"question_template_id":"legal.q.insurance_inventory","prompt":"Which insurance lines are required or strongly recommended for the GCC at launch (general liability, D&O, professional indemnity, cyber, workers' compensation), and what are the indicative coverage limits?","rationale_skeleton":"D&O is the only line directors will personally care about. Cyber is increasingly demanded by customer contracts, especially for entities processing personal data. Workers' compensation is statutory in most jurisdictions and tied to payroll registration.","scope":"GCC","category":"Insurance","priority":"P3","artefact_type":"checklist","workstream_template_id_ref":"legal.entity_incorporation","default_raci_contributors":["ClientAdmin"]}],"decision_templates":[{"decision_template_id":"legal.d.country_of_incorporation","title":"Select the country of incorporation for the GCC entity","summary":"Choice locks tax regime, labour law, banking timelines, and data-protection baseline. Reversal post-incorporation requires wind-down and re-incorporation - the most expensive reversal in the legal pack.","default_options":[{"option_id":"ind_pvt_ltd_jurisdiction","label":"India (typically Karnataka or Tamil Nadu)","description":"Wholly-owned Indian subsidiary at a state with active GCC incentives. Default choice for engineering / shared-services GCCs above ~50 FTE.","default_pros":["Deep, English-speaking, engineering-skewed talent market","Mature regulatory environment with predictable filings","Potential STPI / SEZ tax benefits for export-oriented activity","Lowest fully-loaded cost per FTE among comparator jurisdictions"],"default_cons":["12-16 week incorporation + bank-account timeline","Statutory compliance burden (ROC filings, GST, TDS) is non-trivial","Withholding tax on dividend repatriation","Local-resident director requirement (Companies Act s.149)"]},{"option_id":"uae_freezone","label":"UAE free zone (DIFC / ADGM / DMCC / DSO)","description":"Free-zone entity, typically chosen for back-office or finance-anchored GCCs serving MENA.","default_pros":["Fast incorporation (4-8 weeks)","0% corporate tax in many zones (DIFC qualifying income, etc.)","Full foreign ownership permitted","Strong banking infrastructure and treasury-friendly tooling"],"default_cons":["Talent pool smaller and more expensive than India","Free-zone activity restrictions can limit mainland engagement","Per-FTE cost is roughly 2-3x the India equivalent for comparable seniority","Substance requirements (ESR) demand real on-the-ground presence"]},{"option_id":"singapore_rhq","label":"Singapore (Pte Ltd, often as RHQ)","description":"Singapore Private Limited, typically as a Regional HQ vehicle when the GCC also performs governance / IP-holding functions.","default_pros":["Highly stable, common-law regulatory environment","Excellent banking and capital-markets access","Tax treaties with most relevant jurisdictions","Strong reputation for IP-holding structures"],"default_cons":["High fully-loaded talent cost","Smaller engineering talent pool than India","Substance / economic-substance scrutiny on RHQ structures","ACRA filings, AGM cadence, statutory audit add ongoing overhead"]},{"option_id":"ksa_mainland","label":"KSA mainland (LLC under MISA licence)","description":"Saudi LLC under a Ministry of Investment foreign-investment licence. Becoming attractive under Vision 2030 RHQ Program incentives.","default_pros":["RHQ Program tax incentives (currently up to 30 years)","Aligns with KSA-domiciled customer/sovereign procurement preferences","Direct local presence reduces cross-border data-transfer load"],"default_cons":["Saudisation (Nitaqat) labour requirements add hiring friction","Banking timelines comparable to or slower than India","Less mature engineering talent pool relative to demand","Requires close coordination with MISA on licence scope"]}],"rationale_prompt_skeleton":"Decision narrative should engage: (a) which jurisdiction was chosen and why the principal driver (talent / tax / proximity / customer) outweighs the others; (b) how the decision interacts with the parent group's existing footprint; (c) which option was the closest runner-up and what would cause us to revisit; (d) the locked downstream decisions this enables (entity type, banking partner shortlist, DPA template).","scope":"GCC","priority":"P0","default_approval_chain_template":["ProgrammeLead","Admin"],"evidence_question_template_ids":["legal.q.target_country","legal.q.parent_ownership_pct"]},{"decision_template_id":"legal.d.entity_type","title":"Select the legal entity type for the GCC","summary":"Choice of legal vehicle conditional on country of incorporation. Determines minimum capital, governance overhead, ownership constraints, and tax incentive eligibility.","default_options":[{"option_id":"subsidiary_pvt_ltd","label":"Wholly-owned Private Limited subsidiary","description":"Standalone private-limited entity in the chosen jurisdiction, 100% owned by parent or group holding.","default_pros":["Clean ownership: simplest consolidation and dividend repatriation","Full operational autonomy","Generally the lowest legal-complexity option"],"default_cons":["Full statutory compliance burden falls on the new entity","Higher minimum capital than some alternatives"]},{"option_id":"freezone_llc","label":"Free-zone LLC (e.g., FZ-LLC, DIFC SPV)","description":"Entity established under the rules of a designated free zone.","default_pros":["Fastest incorporation timelines (commonly 4-8 weeks)","100% foreign ownership permitted by default","Bundled registered office and licensing"],"default_cons":["Activity restrictions: typically cannot trade with mainland customers without an additional permit","Renewal and licence fees can escalate over time","Substance requirements still apply (Economic Substance Regulations)"]},{"option_id":"branch_office","label":"Branch of parent (not separately incorporated)","description":"A branch is an extension of the parent rather than a separate legal entity.","default_pros":["No separate incorporation step; faster to operationalise in some jurisdictions","Single set of consolidated accounts"],"default_cons":["Parent has unlimited liability for branch activity (often the deal-breaker)","Tax treatment is often less favourable than a subsidiary","Not eligible for several incentive schemes (e.g., STPI in India)"]},{"option_id":"llp","label":"Limited Liability Partnership (LLP)","description":"LLP vehicle (common in India / UK).","default_pros":["Lower compliance burden than a private limited company","Pass-through-style taxation in some jurisdictions"],"default_cons":["Not always usable for foreign investment (India FDI rules restrict LLPs in some sectors)","Limited equity-raise pathways: not investable in the traditional sense","Some incentive schemes exclude LLPs"]},{"option_id":"joint_venture","label":"Joint venture with local partner","description":"Shared-equity vehicle with a local partner, typically used where local ownership is required by law or commercially preferable.","default_pros":["Local partner provides regulatory / commercial relationships","Sometimes the only feasible structure in restricted sectors"],"default_cons":["Governance complexity: shareholder agreement is now a critical artefact","Profit/IP-sharing reduces upside","Exit pathways must be designed up front (drag/tag, ROFR, buy-back)"]}],"rationale_prompt_skeleton":"Narrative should explain: (a) why the chosen vehicle is the best match for the activity, ownership, and incentive eligibility profile; (b) which alternatives were rejected and why; (c) any local-counsel advice that shaped the choice; (d) downstream artefacts triggered (incorporation documents, shareholder agreement if JV, licence application if free zone).","scope":"GCC","priority":"P0","default_approval_chain_template":["ProgrammeLead","Admin"],"depends_on_decision_template_ids":["legal.d.country_of_incorporation"],"evidence_question_template_ids":["legal.q.parent_ownership_pct","legal.q.share_capital","legal.q.industry_registrations"]},{"decision_template_id":"legal.d.board_composition","title":"Define the GCC board composition and resident-director plan","summary":"Board composition encodes both jurisdictional compliance (resident director, gender / nationality quotas) and de facto control. Settled at incorporation and revisited annually.","default_options":[{"option_id":"single_resident_plus_group","label":"Minimum compliance: one local-resident director + group nominees","description":"Single locally-resident director (to clear statutory minimum) plus group executives as non-resident directors.","default_pros":["Lowest setup cost and complexity","Tight group control"],"default_cons":["Concentration of risk on the single resident director","No independent challenge on strategy / risk"]},{"option_id":"balanced_board_with_independent","label":"Balanced board with at least one independent director","description":"Local resident + group nominees + at least one independent director.","default_pros":["Stronger governance posture, useful when raising capital or selling to public-sector customers","Brings external perspective into strategic decisions"],"default_cons":["Higher director fees + D&O insurance cost","Slower decision cycles unless terms of reference are tight"]},{"option_id":"fully_local_board","label":"Fully locally-resident board","description":"All directors resident in the jurisdiction; group-level oversight via shareholder reserved matters.","default_pros":["Maximum substance / regulatory comfort","Faster local decision-making"],"default_cons":["Group must rely on shareholder mechanisms (reserved matters, observer seats) rather than board control","Recruitment difficulty: trusted local senior directors are scarce"]}],"rationale_prompt_skeleton":"Narrative should record: (a) the statutory minimum being satisfied; (b) the balance between group control and substance / governance optics; (c) any planned evolution (e.g., add independent director by Year 2); (d) D&O insurance posture aligned to the chosen composition.","scope":"GCC","priority":"P1","default_approval_chain_template":["ProgrammeLead","Admin"],"depends_on_decision_template_ids":["legal.d.entity_type"],"evidence_question_template_ids":["legal.q.proposed_directors","legal.q.insurance_inventory"]},{"decision_template_id":"legal.d.statutory_registrations_set","title":"Lock the statutory registration set at launch","summary":"Decision on which registrations are obtained pre-launch versus deferred to first-trigger. Sequencing has material effect on team-onboarding and first-customer-deal timelines.","default_options":[{"option_id":"full_pack_at_launch","label":"Full pack at launch","description":"Obtain corporate tax + VAT/GST + payroll + any industry-specific registration before first hire.","default_pros":["Zero compliance friction at first hire or first invoice","Simplest mental model for ops team"],"default_cons":["Longest incorporation-to-operational timeline","Some registrations have ongoing-filing obligations from day one even with zero activity"]},{"option_id":"trigger_based","label":"Trigger-based registration","description":"Obtain only the strictly required pre-launch registrations; register others when their activity threshold is crossed (e.g., VAT/GST on first invoice).","default_pros":["Faster to first hire","Avoids no-activity filings for registrations not yet needed"],"default_cons":["Risk of missing a trigger (penalty exposure)","Higher operational discipline required"]},{"option_id":"selective_with_incentives","label":"Selective with incentive registration prioritised","description":"Obtain incentive registrations (STPI, SEZ, RHQ) early to capture tax benefits; defer others to trigger.","default_pros":["Maximises tax benefit capture from day one of operations","Faster than full pack but still secures the high-value items"],"default_cons":["Incentive registrations often involve substantial documentation and review","Requires upfront commitment to specific activity profile"]}],"rationale_prompt_skeleton":"Narrative should explain: (a) which registrations are included in the launch set and which are deferred; (b) the trigger criteria for each deferred item and the owner accountable for monitoring; (c) any incentive registrations and the activity commitments they imply; (d) the statutory calendar that flows from this decision.","scope":"GCC","priority":"P1","default_approval_chain_template":["ProgrammeLead"],"depends_on_decision_template_ids":["legal.d.entity_type"],"evidence_question_template_ids":["legal.q.tax_registrations","legal.q.industry_registrations","legal.q.statutory_calendar"]},{"decision_template_id":"legal.d.authority_delegation_thresholds","title":"Set monetary delegation thresholds and joint-signature rules","summary":"Operationalises board authority. Thresholds calibrate signing speed against control. Revisited annually or on material change to organisational scale.","default_options":[{"option_id":"tight_thresholds","label":"Tight thresholds with frequent joint-signature","description":"Low single-signature limits (e.g., USD 5k) with joint-signature for anything above and board approval for material commitments.","default_pros":["Strong control posture; suits early-stage or high-risk jurisdictions","Reduces fraud / mistake exposure"],"default_cons":["Daily friction on routine spend","Slows vendor onboarding"]},{"option_id":"balanced_thresholds","label":"Balanced thresholds aligned to scale","description":"Single-signature to a mid threshold (e.g., USD 25k), joint above, board for strategic commitments.","default_pros":["Workable day-to-day with reasonable control","Aligns with most banking-mandate templates"],"default_cons":["Requires periodic recalibration as the GCC grows"]},{"option_id":"permissive_with_ex_post_review","label":"Permissive thresholds with strong ex-post review","description":"High single-signature limits relying on monthly / quarterly committee review.","default_pros":["Fastest operational velocity","Suits highly trusted senior leadership"],"default_cons":["Higher residual risk; relies on review discipline","Often unacceptable to lenders / institutional investors"]}],"rationale_prompt_skeleton":"Narrative should record: (a) the chosen threshold ladder and joint-signature triggers; (b) the categories of commitment subject to board approval irrespective of value; (c) the review cadence for the thresholds themselves; (d) how the thresholds align with the banking mandate.","scope":"GCC","priority":"P1","default_approval_chain_template":["ProgrammeLead","Admin"],"depends_on_decision_template_ids":["legal.d.board_composition"],"evidence_question_template_ids":["legal.q.signatory_matrix","legal.q.board_resolutions_inventory","legal.q.poa_grants"]},{"decision_template_id":"legal.d.banking_partner","title":"Select the primary banking partner for the GCC","summary":"Bank-account opening is the single most time-critical legal-ops item. Choice is constrained by bank acceptance of foreign-owned subsidiary structures, FATCA/CRS posture, and integration with payment systems.","default_options":[{"option_id":"global_relationship_bank","label":"Existing group relationship bank","description":"Leverage the parent group's incumbent global bank for the GCC.","default_pros":["Pre-existing relationship typically halves onboarding time","Group-wide visibility and treasury consolidation","Strong cross-border payment rails"],"default_cons":["Local capabilities may lag against domestic banks","Concentration risk if group is dependent on a single banking partner"]},{"option_id":"local_full_service","label":"Local full-service bank","description":"Major domestic bank with full digital banking, payroll integration, and government-payments capability.","default_pros":["Deepest local capabilities (statutory payments, payroll APIs)","Often best digital-banking offering for in-country flows"],"default_cons":["KYC for foreign-owned entities can be slow (12+ weeks not unusual)","Cross-border treasury integration may be weaker"]},{"option_id":"dual_bank_split","label":"Dual-bank: operating + treasury","description":"Local bank for operating account (payroll, statutory payments); group bank for treasury / cross-border.","default_pros":["Best of both: local depth and cross-border efficiency","Resilience: no single point of banking failure"],"default_cons":["Two onboarding cycles to manage in parallel","More complex reconciliation"]}],"rationale_prompt_skeleton":"Narrative should record: (a) the chosen partner(s) and their respective accounts; (b) the indicative onboarding timeline and target operational-readiness date; (c) the digital banking / API stack the GCC will use; (d) the contingency plan if the lead bank's onboarding stalls.","scope":"GCC","priority":"P0","default_approval_chain_template":["ProgrammeLead","Admin"],"depends_on_decision_template_ids":["legal.d.entity_type","legal.d.authority_delegation_thresholds"],"evidence_question_template_ids":["legal.q.banking_partner_shortlist","legal.q.bank_kyc_pack"]},{"decision_template_id":"legal.d.dpa_controller_processor_posture","title":"Set the GCC's controller / processor posture for group personal data","summary":"Designation drives every downstream data-protection obligation. Conservative bet for an internal-shared-services GCC is processor; deviation needs articulated reasoning. Excludes PDPL-specific controls (Phase 1B).","default_options":[{"option_id":"processor_only","label":"Processor for all group personal data","description":"GCC processes personal data exclusively on instruction from group / customer controllers; never determines purposes / means.","default_pros":["Cleanest narrative for customer / group contracts","Lowest direct regulatory exposure","Standard sub-processor mechanics apply"],"default_cons":["Limits GCC autonomy on data-driven product work","Requires tight instruction logs and contract clauses"]},{"option_id":"joint_controller_for_internal_data","label":"Joint controller for internal data; processor for customer data","description":"GCC is a joint controller for group-internal HR / vendor data and a processor for customer data.","default_pros":["Realistic for GCCs that run group HR / IT functions","Permits direct decisions on retention, lawful basis, etc., for internal data"],"default_cons":["Joint-controller arrangements require Article 26-style agreements","Allocation of data-subject-rights responsibilities must be explicit"]},{"option_id":"independent_controller","label":"Independent controller for own purposes","description":"GCC determines purposes / means independently for at least some personal-data flows (e.g., its own employees, its own marketing).","default_pros":["Necessary for direct hiring and own-payroll processing","Accurate reflection of operational reality"],"default_cons":["Adds full DPIA / records-of-processing-activities burden","Demands a dedicated data-protection function inside the GCC"]}],"rationale_prompt_skeleton":"Narrative should distinguish: (a) which data flows fall into which posture (recommend a table in the rationale); (b) where intra-group agreements are needed (Article 26 joint-controller / SCC / BCR); (c) any DPIA triggers that follow from the posture; (d) the deferred Phase 1B PDPL alignment workstream this baseline will feed.","scope":"GCC","priority":"P0","default_approval_chain_template":["ProgrammeLead","Admin"],"evidence_question_template_ids":["legal.q.dpa_scope_and_role","legal.q.cross_border_transfer_mechanism","legal.q.sub_processor_register","legal.q.dpo_appointment"]},{"decision_template_id":"legal.d.employee_ip_assignment_template","title":"Adopt the standard employee IP-assignment and confidentiality template","summary":"Template will be issued to every GCC hire. Material to vesting of code / content / inventions in the GCC entity. Reversal post-issuance requires re-papering staff, which is operationally painful.","default_options":[{"option_id":"broad_assignment_with_local_carveouts","label":"Broad present and future assignment with local-law carve-outs","description":"Default-to-broad pre-assignment of all work product, with carve-outs required by local labour law.","default_pros":["Maximises vesting of IP in the GCC","Industry-standard for technology employers"],"default_cons":["Requires per-jurisdiction legal review","Some jurisdictions void over-broad clauses"]},{"option_id":"scope_limited_assignment","label":"Scope-limited assignment (in-scope work only)","description":"Assignment limited to inventions / works arising in the course of employment within scope.","default_pros":["Friendlier to senior creative hires","Aligns with the narrower end of jurisdictional norms"],"default_cons":["Creates grey zones for hybrid / off-hours work","Disputes more likely on departing engineers"]},{"option_id":"moonlighting_permitted_with_disclosure","label":"Scope-limited plus moonlighting permitted with disclosure","description":"Adds a moonlighting permission to a scope-limited template, with mandatory disclosure for conflict review.","default_pros":["Strong talent-market signal in jurisdictions with active moonlighting debates (e.g., India 2022-)","Compliant with local labour-court direction"],"default_cons":["Disclosure process must be operationalised","Risk of conflicts not disclosed in practice"]}],"rationale_prompt_skeleton":"Narrative should record: (a) the chosen template and the jurisdictional carve-outs reviewed; (b) the IP-assignment treatment of pre-existing work product; (c) the alignment with group-level IP holding strategy; (d) the operational owner accountable for disclosure / conflict reviews if moonlighting is permitted.","scope":"GCC","priority":"P1","default_approval_chain_template":["ProgrammeLead"],"evidence_question_template_ids":["legal.q.employee_ip_assignment"]}],"maturity_rubric":[{"maturity_dimension_template_id":"legal.md.legal_setup_overall","name":"Legal & Co. Setup overall maturity","description":"Pack-wide rubric covering the joint readiness of entity setup, statutory compliance, signatories, banking, and contracts/data-protection for the GCC. Single dimension by design (per Phase 0 Q1 rubric guidance for Legal).","levels":["Ad-hoc","Repeatable","Defined","Managed","Optimised"],"scoring_criteria_per_level":["Entity formed reactively; signatories handled ad-hoc; banking via personal relationships; no statutory calendar; DPA / IP terms negotiated case-by-case; no DPO; lease / insurance gaps unaddressed at launch.","Documented entity setup process; standard signatory list maintained outside the platform; centralised banking ops in place; statutory calendar exists but not integrated with reminders; DPA / NDA templates available but not consistently applied.","Cross-jurisdictional playbooks for incorporation and registrations; statutory calendar actively managed with named owners; DPA templates standardised by counterparty type; sub-processor register maintained; insurance pack reviewed annually.","Legal-ops dashboards covering filings, contract turnaround, and DPA throughput; compliance KPIs tracked; quarterly review cycles with the board; signatory matrix integrated into approval workflows; cross-border transfer mechanisms documented per data flow.","Integrated with HR / Finance / IT for end-to-end automation (filings, approvals, contract lifecycle); proactive horizon scanning on regulatory change; programme memory captures rationale for each material legal decision; predictive risk modelling for filing deadlines and contract exposures."],"target_level":3}],"raci_defaults":{"legal.q.target_country":{"contributor":["Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.q.parent_ownership_pct":{"contributor":["Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.q.share_capital":{"contributor":["Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.q.proposed_directors":{"contributor":["Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.q.registered_office":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.tax_registrations":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.industry_registrations":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.statutory_calendar":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.signatory_matrix":{"contributor":["Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.q.board_resolutions_inventory":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.poa_grants":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.banking_partner_shortlist":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.bank_kyc_pack":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.dpa_scope_and_role":{"contributor":["Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.q.cross_border_transfer_mechanism":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.sub_processor_register":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.dpo_appointment":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.employee_ip_assignment":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.customer_nda_template":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.lease_registration":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.q.insurance_inventory":{"contributor":["Admin"],"reviewer":["ProgrammeLead"]},"legal.d.country_of_incorporation":{"decision_maker":"Admin","approver":["ProgrammeLead","Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.d.entity_type":{"decision_maker":"Admin","approver":["ProgrammeLead","Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.d.board_composition":{"decision_maker":"Admin","approver":["ProgrammeLead","Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.d.statutory_registrations_set":{"decision_maker":"Admin","approver":["ProgrammeLead"],"reviewer":["ProgrammeLead"]},"legal.d.authority_delegation_thresholds":{"decision_maker":"Admin","approver":["ProgrammeLead","Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.d.banking_partner":{"decision_maker":"Admin","approver":["ProgrammeLead","Admin"],"reviewer":["ProgrammeLead"]},"legal.d.dpa_controller_processor_posture":{"decision_maker":"Admin","approver":["ProgrammeLead","Admin"],"reviewer":["ProgrammeLead"],"informed":["ExecutiveViewer"]},"legal.d.employee_ip_assignment_template":{"decision_maker":"Admin","approver":["ProgrammeLead"],"reviewer":["ProgrammeLead"]},"legal.md.legal_setup_overall":{"decision_maker":"ProgrammeLead","reviewer":["Admin"]}},"ai_interpretation_templates":[{"ai_interpretation_template_id":"legal.ai.entity_choice_advisor","name":"Entity-choice comparison memo drafter","target_node_type_ref":"Decision","interpretation_type":"suggested_decision","prompt_template_skeleton":"You are drafting a comparison memo for the GCC entity-type decision. Given the answers to {{evidence_questions}} and any uploaded corporate-law documents retrieved via {{retrieval_strategy}}, produce a structured comparison of the candidate options on (a) statutory minimum capital, (b) governance overhead, (c) incentive eligibility, (d) ownership flexibility, (e) tax repatriation pathway. Cite each fact to a specific retrieved chunk. End with a recommended option and a confidence score [0..1]. Do not invent jurisdictional facts that are not present in the retrieved chunks.","trigger_event_type_ref":"DecisionOpened","retrieval_strategy":"tenant_documents","default_confidence_threshold":0.6,"acceptance_ux_type":"side_panel"},{"ai_interpretation_template_id":"legal.ai.dpa_drafting_assist","name":"DPA / data-protection answer drafter","target_node_type_ref":"Question","interpretation_type":"draft_answer","prompt_template_skeleton":"You are drafting an answer to a data-protection scoping question for the GCC build. Question text: {{prompt}}. Use the tenant's existing DPA / privacy artefacts retrieved via {{retrieval_strategy}} as the primary source; supplement only with widely accepted boilerplate where the retrieved set is silent and clearly flag any boilerplate-only sections. Output: (1) a candidate answer in the artefact_type expected by the question, (2) a short citation table mapping each material claim to a retrieved chunk, (3) flagged open items the human must complete. Never assert a controller / processor designation that is not supported by the retrieved evidence.","trigger_event_type_ref":"QuestionOpened","retrieval_strategy":"tenant_documents_plus_memory","default_confidence_threshold":0.55,"acceptance_ux_type":"side_panel"},{"ai_interpretation_template_id":"legal.ai.statutory_calendar_drafter","name":"Statutory calendar drafter from registrations decision","target_node_type_ref":"Question","interpretation_type":"draft_answer","prompt_template_skeleton":"You are constructing the consolidated statutory-filing calendar for the GCC. Given (a) the locked country of incorporation, (b) the locked entity type, (c) the locked statutory-registrations set, and (d) any uploaded counsel memos retrieved via {{retrieval_strategy}}, produce a table of filings with columns: filing, owner role, due date pattern, consequence of late. Only include filings that follow from the registrations actually adopted. Cite the source for each filing's due-date pattern. Flag any filing where the source is silent on consequence-of-late.","trigger_event_type_ref":"DecisionLocked","retrieval_strategy":"tenant_documents_plus_memory","default_confidence_threshold":0.6,"acceptance_ux_type":"side_panel"}]}