Business Compliance Checklist (post-EIN launch)

Version 2026.05.22. You have the EIN. This is the launch-readiness checklist a regulatory/business attorney would walk you through. Tick each before you start taking real money. Not legal advice — have Maryland-licensed counsel confirm.

1. Entity & registration

• <input type="checkbox" checked disabled>EIN obtained (IRS)
• <input type="checkbox" disabled>Entity formed (LLC or C-corp) and in good standing with the Maryland SDAT
• <input type="checkbox" disabled>Registered agent on file in Maryland
• <input type="checkbox" disabled>Operating agreement / bylaws executed
• <input type="checkbox" disabled>Beneficial Ownership Information (BOI) report filed with FinCEN (Corporate Transparency Act) if required
• <input type="checkbox" disabled>Business bank account opened under the EIN (separate from personal)
• <input type="checkbox" disabled>Maryland business license / trader's license if the county requires one for the activity

2. Tax

• <input type="checkbox" disabled>Maryland sales-and-use tax license (register with the Comptroller) before collecting tax
• <input type="checkbox" disabled>Economic-nexus monitoring set up for other states (TaxJar/Avalara config slot is live in admin Settings)
• <input type="checkbox" disabled>Resale / exemption certificate handling process for tax-exempt institutional buyers
• <input type="checkbox" disabled>Quarterly estimated tax + annual filing calendar set
• <input type="checkbox" disabled>Sales-tax remittance schedule per state where nexus exists

3. Payments

• <input type="checkbox" disabled>Merchant account underwriting with a trusted payment processor — 2–4 weeks
• <input type="checkbox" disabled>ACH/wire bank transfer setup (primary methods); Net-30 terms for verified institutional accounts
• <input type="checkbox" disabled>PCI-DSS SAQ-A self-assessment (you never touch card data; processor is PCI-DSS)
• <input type="checkbox" disabled>AML/KYC policy adopted and the compliance officer named

4. Product & labeling

• <input type="checkbox" disabled>Labeling spec reviewed and signed by regulatory counsel
• <input type="checkbox" disabled>Every SKU's RUO posture confirmed; no human-use or structure/function claims anywhere
• <input type="checkbox" disabled>COA on file for every shippable lot (Storage SOP)
• <input type="checkbox" disabled>Quality/recall SOP adopted; mock recall scheduled
• <input type="checkbox" disabled>Supplier qualification + supply agreement with the US fulfillment/manufacturing partner
• <input type="checkbox" disabled>Export posture confirmed (Export Compliance Policy); OFAC/BIS screening for wholesale

5. Insurance

• <input type="checkbox" disabled>General liability
• <input type="checkbox" disabled>Product liability (critical for any physical product, even RUO)
• <input type="checkbox" disabled>Cyber / data-breach liability
• <input type="checkbox" disabled>Directors & officers if you take outside investment

6. Site & data

• <input type="checkbox" checked disabled>Terms of Service, EULA, Terms of Sale, Privacy, Data Use, Cookie, Global Compliance, Acceptable Use, DMCA, Shipping, Refund, Accessibility, Export — all published in /legal/
• <input type="checkbox" checked disabled>Triple attestation at checkout, audit log, robots/noindex on PII pages, first-party-only cookies
• <input type="checkbox" disabled>DSAR (data subject access request) inbox monitored: [email protected]
• <input type="checkbox" disabled>DMCA agent registered with the US Copyright Office (optional but strengthens safe harbor)
• <input type="checkbox" disabled>Email auth (SPF/DKIM/DMARC) live per the internal DNS runbook

7. Domain & infrastructure

• <input type="checkbox" checked disabled>Domain owned (Namecheap)
• <input type="checkbox" disabled>DNS A/ALIAS records pointed at GitHub Pages + www CNAME (see the internal DNS runbook)
• <input type="checkbox" disabled>GitHub Pages custom domain set to xfactorpeptidelab.com + Enforce HTTPS
• <input type="checkbox" disabled>CNAME file in repo (committed)
• <input type="checkbox" disabled>Registrar lock + DNSSEC + 2FA on the Namecheap account

8. Operations

• <input type="checkbox" disabled>Fulfillment partner contract + cold-chain handling agreement
• <input type="checkbox" disabled>Freezer temperature logging in place (Storage SOP)
• <input type="checkbox" disabled>Return/RMA workflow staffed (admin Returns tab + /returns.html)
• <input type="checkbox" disabled>Support SLA (one business day) staffed
• <input type="checkbox" disabled>Backup/export of admin data scheduled weekly

9. Records retention

• <input type="checkbox" disabled>7-year retention for orders, attestations, COAs, audit log, complaints, recalls, tax filings
• <input type="checkbox" disabled>Off-site backup of the admin data export

10. Before first real order

• <input type="checkbox" disabled>Rotate the admin temp password
• <input type="checkbox" disabled>Wire Supabase (real DB + auth) so state is server-side, not localStorage
• <input type="checkbox" disabled>Wire the processor and run one live test transaction + one test refund
• <input type="checkbox" disabled>Wire the ESP and send one test order-confirmation email
• <input type="checkbox" disabled>Wire Shippo/EasyPost and buy one test label
• <input type="checkbox" disabled>Clear all demo data (admin Settings → Clear Demo Data)
• <input type="checkbox" disabled>Final legal review of the whole /legal/ pack by Maryland-licensed counsel

Contacts

[email protected] · [email protected]