Fortax Legal Compliance Check

Legal compliance check and risk assessment

Needs Python 3 and internet: runs scripts/fortax.py (the Fortax engine on ai.fortax.in; your file is processed and not stored).

Typical asks: "client referral program me cash reward dena chahta hai, kya dikkat hai", "app me Aadhaar/biometric login lagana hai", "foreign company se investment aa raha hai, kya approvals", "is risk ko rate karo", "risk register me daalo".

This is not legal advice. It tells the CA which laws a plan touches, what each needs, what is still unknown, and how big each risk is. Requirements change often: every threshold, rate, deadline and form is looked up (Rule 5 below), never recalled.

Step 1 — get the plan in specific words

Ask for, if not given:

• What exactly — "email all our users a cashback offer" beats "marketing campaign".
• Who does it — entity type (company, LLP, firm, proprietor), listed or not, sector regulator if any.
• Where — states in India, and any foreign country (customers, servers, investors, vendors).
• What data — personal data involved? children's? financial, health, biometric, Aadhaar?
• Money flow — who pays whom, in what form (cash, wallet, points, crypto, shares), cross-border?
• When — launch date, so deadlines can be set.

Step 2 — map the laws it touches

Go down this list and keep only what applies. For each, say why it applies in one line.

For each area that applies, look up the current requirement:

python3 scripts/fortax.py kb "<specific question, e.g. TDS on referral rewards to individuals>" --topics itr,tds,gst

Quote source and captured. If match is weak or none, write the requirement as "confirm on the Act / notification / regulator's site" and name the law. Never fill the gap from memory as though sourced.

Step 3 — requirements, met or not

One row per concrete requirement, not per law. "Register the internal committee under POSH" not "POSH Act". Status is Met, Not met or Unknown — Unknown is fine and honest; say what would settle it.

Step 4 — rate each risk (severity x likelihood)

Severity — impact if it happens:

Likelihood — probability it happens:

Score = Severity x Likelihood. Work it in the table or a sheet, not in your head.

                    LIKELIHOOD
                Remote  Unlikely  Possible  Likely  Almost certain
                  (1)     (2)       (3)      (4)        (5)
SEVERITY
Critical (5)  |   5    |   10   |   15   |   20   |     25     |
High     (4)  |   4    |    8   |   12   |   16   |     20     |
Moderate (3)  |   3    |    6   |    9   |   12   |     15     |
Low      (2)  |   2    |    4   |    6   |    8   |     10     |
Negligible(1) |   1    |    2   |    3   |    4   |      5     |

What each level means for the client:

• GREEN (1-4) — accept with normal controls, record in the risk register, review quarterly or yearly, no escalation. E.g. a vendor contract with a minor deviation in a non-critical area; a routine NDA with a known counterparty; an administrative filing with a clear owner and date.
• YELLOW (5-9) — mitigate (controls or negotiation), name an owner, review monthly or on a trigger, brief the business owner, define what would raise it. E.g. liability cap below standard but negotiable; a vendor storing personal data abroad without clear safeguards; a pending regulatory change.
• ORANGE (10-15) — brief the promoters/board, written mitigation plan, weekly review, consider an advocate, full risk memo, contingency plan. E.g. uncapped indemnity in a material area; processing that may breach a requirement unless restructured; threatened litigation or a legal notice from a significant party; an IP infringement allegation with some basis; a departmental inquiry or audit.
• RED (16-25) — immediate escalation to promoters/board, engage an advocate now, a small response team with roles, notify insurers if covered, preserve documents (no deletion, see fortax-legal-response for a preservation notice), daily review, board reporting, and any statutory notification (e.g. DPDP breach intimation, CERT-In reporting, stock-exchange disclosure for listed companies). E.g. active litigation with large exposure; a personal data breach; enforcement action; search or summons from a department; a credible infringement claim against a core product.

Use references/risk-assessment-memo.md for the full memo format and the risk register fields.

Step 5 — when it goes to an advocate

Must: any suit or arbitration filed by or against the client; any summons, search, show-cause or inquiry from a regulator, police or agency (ED, SFIO, SEBI, CCI, DPB, consumer commission) — tax notices go to fortax-notice-reply; any possible criminal exposure for the company or its people; anything affecting a listed company's disclosures; matters needing board or shareholder approval where the legal position is contested.

Strongly recommended: unsettled law where the client's position could set precedent; more than one jurisdiction with conflicting rules; exposure above what the client can absorb; specialist areas (competition, FEMA compounding, patents, anti-corruption, US FCPA or UK Bribery Act where there is a nexus); new regulation needing a compliance programme; M&A due diligence and structuring.

Consider: significant contract disputes; employment claims (POSH, wrongful termination, whistleblower); data incidents that may need notification; IP disputes on material products; insurance coverage disputes.

When suggesting one, list what to weigh: subject expertise, the forum and state, industry familiarity, conflict check, fee basis (fixed, hourly, retainer), existing relationships. Do not name a firm.

Output

Compliance check — <initiative> — <client>, <date>

Summary: Proceed / Proceed with conditions / Needs further review
<two lines: why>

Laws and approvals it touches
| Law / regulator | Why it applies | Key requirement | Source (kb URL + captured, or "confirm") |

Requirements
| # | Requirement | Status (Met / Not met / Unknown) | Action needed | Owner | By |

Risks
| # | Risk | Severity (1-5) | Likelihood (1-5) | Score | Level | Mitigation |

Recommended actions
1. <most important>
2. …

Approvals needed
| Approver (board / shareholders / RBI / FDI government-route ministry / sector regulator / lender) | Why | Status |

Needs an advocate
- <only the points from Step 5>

Save next to the plan in the client folder as YYYY-MM-DD_<initiative>_compliance.md. Give the CA the summary and the RED/ORANGE rows in chat.

Rules

1. Indian law first. Foreign regimes only on facts that bring them in, and then say which fact.
2. No figure from memory. Thresholds, penalties, caps, deadlines, fees: fortax.py kb or "confirm" with the law named. Say which year's rule it is.
3. No case law from memory. Research and cite (fortax-deep-research) or leave it out.
4. Unknown is a status. Do not guess a requirement to Met.
5. Nothing is filed or sent. The CA and client apply, file and notify.

Credits: the compliance-check output and approach are adapted from compliance-check, and the severity x likelihood framework, levels, memo, register and escalation lists from legal-risk-assessment, both in anthropics/knowledge-work-plugins, © Anthropic, Apache License 2.0 (LICENSE-THIRD-PARTY-knowledge-work-plugins.txt).

Changes by Fortax: adapted for Indian law and CA practice, merged with legal-risk-assessment (knowledge-work-plugins); added the Indian law map and kb lookups; moved GDPR, CCPA, DPA and data-subject-request material to references/foreign-privacy-and-dpa.md; "outside counsel" became an advocate; connector steps removed.