ChecklistGeographic Expansion

Building a regulatory register before entering a new country

A regulatory register lists every licence, registration and obligation that applies to your entry into one country, with the legal source, the trigger, the lead time, the adviser who owns it and the evidence that it is done. Build it before any commercial commitment, because its lead times decide when you can actually sign, hire and host. This page gives the triggers to screen, the fields to use and the upkeep routine.

Reviewed 10 October 2026 7 min read

On this page

Why the register comes before the first contract
Trigger categories to screen in every target country
The fields every register entry needs
Which adviser answers which entry
Scoping triggers from your product, data flows and sales model
Keeping the register current once you have launched
Register items teams most often skip
Questions and answers
Sources

Why the register comes before the first contract

Most entry plans fail on sequence rather than on any single rule. A customer contract promises a go-live date that a licence application cannot meet; an offer letter is issued by an entity that does not exist yet; data moves before anyone has checked where it may go. A register prevents this by making every obligation visible, with its lead time, before anyone commits to dates.

ColdAI completes the regulatory map before commercial commitments are made, and each entry carries a source and an owner¹. The method below works whether or not you engage anyone: it is a disciplined way to ask the right questions of your own counsel and advisers.

Trigger categories to screen in every target country

Work through each category for the specific country. A trigger that does not apply should still be recorded as screened, with the reason, so nobody re-opens it later.

0 of 9 checked

Regulated activityDoes anything you do, such as payments, lending, custody, advice, insurance, healthcare or telecoms, need a licence or registration in this country?
Personal dataWhich data-protection law applies, does it restrict transfers abroad, and do you need to register or appoint a local representative?
Data localisation and sector hosting rulesDo customers' regulators require in-country hosting, approved cloud providers or notification of outsourcing?
EmploymentEmployer registration, mandatory contract terms, work permits for anyone relocating, and whether an employer of record is permitted for the roles planned.
Corporate presenceWhether you need a local entity or branch to contract, invoice, bid for public tenders or hold the licences above.
Tax registrationCorporate tax, indirect tax on digital services and withholding on cross-border payments, including whether sales from abroad already trigger registration.
Product certification and standardsHardware approvals, accessibility, language or labelling requirements, and any sector certification a buyer will ask for.
Export controls and sanctionsWhether your technology, customers or end uses fall under controls in your home country or the target, including AI hardware and encryption.
Consumer and contract lawMandatory terms, cooling-off rights, language of contract and governing-law limits for the customers you will serve.

The fields every register entry needs

Obligation: What must be done or held, written as an action: obtain, register, notify, appoint, file.
Legal source: The law, regulation, notice or guidance that creates the obligation, with the provision where known and a link to the official text.
Trigger: The fact about your business that makes it apply, such as serving local consumers, holding customer funds or employing someone locally.
Lead time: How long the adviser expects it to take, including regulator review, with the assumptions behind the estimate.
Owner: The named adviser who answers for the entry, and the internal person who chases it.
Status and evidence: Not started, in progress, done or not applicable, with the document that proves it: certificate, filing receipt, adviser memo.

Hypothetical example

One register row for a hypothetical analytics platform

For example, a software company entering a new market with an analytics product that processes customer employees' personal data might record: obligation, register as a data controller with the national data-protection authority; legal source, the national data-protection law and its implementing regulation; trigger, processing personal data of residents as controller for support and billing data; lead time, to be confirmed by local counsel; owner, local data-protection counsel, chased by the privacy lead; status, in progress, evidence pending.

The row is deliberately plain. Its value is that the trigger is stated, so if the product changes and stops processing that data, anyone can see whether the obligation still applies.

Which adviser answers which entry

If
The entry concerns a licence, registration or regulator approval.
Then
Assign it to local regulatory counsel and ask for the application steps, lead time and conditions.
Licensing is regulated legal advice and lead times come from experience with the regulator.
If
The entry concerns tax registration, permanent establishment or transfer pricing.
Then
Assign it to a local tax adviser, coordinated with your home tax adviser.
Both countries' rules and any treaty between them affect the answer.
If
The entry concerns employment, work permits or an employer-of-record arrangement.
Then
Assign it to local employment counsel, or to the EOR provider for its own staff.
Mandatory terms and permit routes vary by country and role.
If
The entry concerns hosting, data flows or product changes.
Then
Assign the legal question to data-protection counsel and the design question to your engineering lead.
Counsel says what is required; only engineers can say whether the product can meet it and by when.
If
The entry concerns incorporation, registered office or company secretarial filings.
Then
Assign it to a corporate service provider under counsel's instructions.
These are procedural filings that follow the structure decision.

Scoping triggers from your product, data flows and sales model

Generic country checklists miss things because they start from the country. Start instead from three descriptions of your own business: what the product does, step by step, including any handling of money or regulated advice; a data-flow map showing what personal data is collected, where it is stored and processed and who can reach it; and the sales model, including whether you sell to consumers, businesses or the public sector, directly or through partners.

Give these to each adviser with your trigger categories. Many entries depend on details that only you know, such as whether funds pass through your accounts or a partner's, or whether support staff abroad can view production data.

Keeping the register current once you have launched

0 of 6 checked

Name an owner for the register in the country teamUsually the country lead or the compliance lead, written into the handover pack.
Add renewal and reporting dates as their own entriesLicence renewals, annual returns and periodic regulatory reports recur and are easy to miss.
Re-screen triggers whenever the product or sales model changesA new payment feature or a move into consumer sales can create entries that did not exist at launch.
Record regulatory changes with their effective datesLink the new text and note which entries it affects.
Review the whole register on a fixed cycleAgree the cadence with counsel; regulated businesses usually review more often.
Keep evidence where an auditor or regulator can follow itOne folder per entry, linked from the register.

Register items teams most often skip

Indirect tax on digital sales from abroad

Early signalSales start before any local entity exists and nobody has asked about registration.

MitigationScreen tax triggers for cross-border sales at the start, not when the entity is formed.

Support access counted as a data transfer

Early signalData is hosted locally but the global support team can still open production records.

MitigationRecord access paths in the data-flow map and give counsel the access design.

Licences the customer needs from you

Early signalProcurement asks for a certificate or registration you have not heard of.

MitigationAsk early prospects for their supplier requirements and add them as entries.

Obligations owned by nobody after launch

Early signalThe programme team disbands and renewal dates sit in an old spreadsheet.

MitigationTransfer ownership formally at handover with a dated review schedule.

Questions and answers

What should we do if a register entry has a lead time longer than our planned launch?

Move the launch, change the scope, or find a lawful interim route, in that order of preference. For example, a limited first phase might serve only customers that do not trigger the licence, or the activity might be run through a licensed partner while your own application proceeds. Never sign customer dates that assume an approval you do not hold.

How detailed should the legal source column be?

Detailed enough that someone new can find the text and check whether it has changed: the instrument's official name, the provision where the adviser has identified it, and a link to the official publication. Avoid citing summaries or blog posts as the source of an obligation; they are useful for orientation but go out of date without notice.

Is a regulatory register the same as a compliance monitoring programme?

No. A register is built per country for an entry decision and then maintained for that operation. Portfolio-wide monitoring of regulatory and geopolitical change across many countries is a broader capability; ColdAI covers it under geopolitics. The register is one of the inputs such monitoring keeps up to date.

Who should hold the register during the entry programme?

One person on the programme team, not each adviser. Advisers contribute entries and evidence, but someone must see all entries together to spot conflicts, such as a hosting choice that complicates a licence or an employment route that depends on an entity not yet formed. After launch, ownership passes to the country lead.

Sources

Geographic Expansion: the expansion sequence and regulatory register deliverable — ColdAI

More in Geographic Expansion

Back to Geographic Expansion

Next step

Want a first-pass register for your target country?

Send a short product description, your data-flow map and how you plan to sell. We will return the trigger screen and the questions to give each local adviser.

Start a regulatory register