Online Business Compliance Checklist Philippines 2026

What Compliance Requirements Should a Philippine Online Business Know?

A Philippine online business must know five sets of requirements: entity registration with the DTI or the SEC; a local government business permit; BIR registration, store-name declaration and invoicing; the Internet Transactions Act duties on disclosure, internal redress and liability; and the Data Privacy Act. There is no longer a BIR annual registration fee, and the DTI e-commerce Trustmark is voluntary rather than a licence to trade. The point most sellers miss is that the Internet Transactions Act’s eighteen-month transitory period has already run out, so Republic Act No. 11967 now applies in full.

Each of those five is unpacked below, with the agency, the trigger and the first concrete action for each. For the wider regulatory map, use the Business Compliance Philippines hub.

Key Takeaways

The eighteen-month transitory period that RA 11967, Section 32, gave online businesses to come into compliance has expired. The Act was approved on 5 December 2023 and took effect fifteen days after publication, so the grace period closed in 2025.
The ₱500 BIR annual registration fee was removed when Section 34 of RA 11976 rewrote NIRC Section 236(B). Anyone still quoting it is working from pre-2024 material.
BIR RMC No. 91-2024 requires online sellers to declare the store names used on every page, account, website or platform, and to post the Certificate of Registration or its QR code.
Since RMC No. 38-2026 (29 April 2026), a BIR Registration Seal Badge can be posted instead of exposing the full COR page. The badge itself is issued free of charge, but a taxpayer who has to post proof of registration and secures the badge through the registration-update route pays a ₱30.00 loose documentary stamp tax.
Marketplace withholding under RR 16-2023 is 1% on one-half of gross remittances, and does not bite until remittances to the seller pass ₱500,000.
NPC registration is threshold-based, not universal: 250 or more employees, sensitive personal information of 1,000 or more individuals, or risky processing (NPC Circular 2022-04, Section 5).
RA 11967 obligations follow the role you play. An e-retailer selling from its own site, an online merchant on a marketplace, and the marketplace itself have different duty sets.
Selling through a Facebook page or Instagram account is online commerce. The channel changes nothing about registration, invoicing or disclosure.

Jump to a Section

Obligations at a glance · Governing law · The transitory period has ended · Requirements element by element · Who is liable when a sale goes wrong · Exceptions and boundaries · Scenarios · Documentation · Step-by-step procedure · Consequences · Common mistakes · Sequenced registration checklist · FAQs · Official sources

Compliance Obligations at a Glance

Obligation	Agency	Who it applies to	When	Where
Business name registration	DTI	Sole proprietors trading under any name other than their own true name	Before using the name commercially	bnrs.dti.gov.ph
Incorporation or partnership registration	SEC	Corporations, one person corporations and partnerships	Corporate existence begins on issuance of the certificate (RA 11232, Sec. 18)	sec.gov.ph
Mayor’s or business permit	City or municipal LGU	Every business with a place of business, including home-based operations	Before operating; renewed annually	Business Permits and Licensing Office
BIR registration and store-name declaration	BIR	Every person doing business, including online sellers	On registration; store names declared per RMC 91-2024	ORUS or the Revenue District Office
Posting the COR, QR code or Registration Seal Badge	BIR	Online sellers, service providers, content creators and influencers	Continuing, while trading online	Own website and each platform seller profile
1% withholding on remittances	BIR	E-marketplace operators and digital financial services providers, as withholding agents	Once remittances to a seller exceed ₱500,000 (RR 16-2023)	Withheld at source; seller claims the credit
Data processing system registration and DPO	NPC	Controllers and processors meeting NPC Circular 2022-04, Sec. 5 criteria	When a threshold is met	register.privacy.gov.ph
Seller disclosures, invoices and redress	DTI E-Commerce Bureau	Online merchants, e-retailers and e-marketplaces	Continuing (RA 11967, Secs. 21 and 23)	On the storefront itself
E-Commerce Philippine Trustmark	DTI	Voluntary for any online business	Any time; valid one year	trustmark.dti.gov.ph

Governing Law and Authorities

Five instruments do most of the work. Republic Act No. 11967, the Internet Transactions Act of 2023, applies to business-to-business and business-to-consumer internet transactions within the DTI mandate (Sec. 3), defines e-marketplace, e-retailer, online merchant and digital platform (Sec. 4), and reaches foreign sellers who avail of the Philippine market to the extent of establishing minimum contacts here (Sec. 5). It created the E-Commerce Bureau (Sec. 7) and directed an online business database (Sec. 10).

RA 11232, the Revised Corporation Code, governs SEC registration; Section 18 fixes the moment a corporation acquires juridical personality, and Section 10 recognises the one person corporation. The National Internal Revenue Code, as amended by RA 11976 (approved 5 January 2024), governs BIR registration and invoicing. RA 10173, the Data Privacy Act, and NPC Circular 2022-04 govern personal data. Consumer law and DTI issuances govern product claims, pricing and remedies.

The Internet Transactions Act Transitory Period Has Ended

Section 32 of RA 11967 reads: “A transitory period of eighteen (18) months from the effectivity of this Act shall be provided to all affected online merchants, e-retailers, e-marketplaces, and digital platforms to comply with the requirements of the law.” That sentence is the source of a widespread belief among Philippine online sellers that the Act is still bedding in. It is not.

The arithmetic is simple. The Act was approved on 5 December 2023, and Section 38 provides that it takes effect fifteen days after publication is completed in the Official Gazette or a newspaper of general circulation. Effectivity therefore fell in December 2023 or, at the latest, very early in 2024. Eighteen months counted from that point expired in 2025. By October 2026 there is no transitory period left to rely on, and the DTI E-Commerce Bureau lists implementing rules for the Act dated 24 May 2024 among its policy issuances.

What that changes in practice:

The disclosure duties in Section 23 are enforceable now, not aspirational. A storefront with no registered business name, address or complaint route is in breach today.
Administrative fines under Section 29 are live. The tiers are set out in the Consequences section below, and they escalate on repeat offences.
Being new is not a defence. The transitory period ran from the Act’s effectivity, not from the date a particular business started trading, so a shop opened in 2026 gets no grace period of its own.

Verification limit: the exact date on which publication of RA 11967 was completed could not be confirmed from a government source on this review, because the Official Gazette page for the Act returned an error. The conclusion above does not depend on the precise day: any effectivity date in December 2023 or early 2024 puts the end of the eighteen months in 2025.

Requirements Element by Element

Entity registration: DTI or SEC, not both

A sole proprietor registers a business name with the DTI. A corporation, one person corporation or partnership registers with the SEC and acquires juridical personality only on issuance of the certificate of incorporation (RA 11232, Sec. 18). The two paths are alternatives, not stages. If you are unsure which applies, our comparison of DTI business name registration versus SEC registration sets out the practical differences.

Register the names you actually trade under. A corporation whose SEC name is one thing and whose Shopee shop, TikTok Shop account and Instagram handle are three other things has a naming problem that will surface at BIR registration and at platform verification.

Local government permit

A business permit from the city or municipality where the business is located is a separate step from national registration, and it is renewed annually. Operating from home does not remove it. Requirements, assessment method and fees are set locally, so confirm them with the Business Permits and Licensing Office rather than relying on a figure quoted online.

BIR registration, store names and the seal badge

BIR registration is the step online sellers most often defer. RMC No. 91-2024 (14 August 2024) requires taxpayers to register with the BIR all business or trade names as registered with the SEC or DTI, and to declare the store names used in every online page, account, website or e-commerce platform. It also requires online sellers to post an electronic copy of the Certificate of Registration on their website or platform profile, or, where the COR carries a QR code generated through ORUS or the Philippine Business Hub, that QR code instead.

RMC No. 38-2026, issued 29 April 2026, added a better option. The BIR Registration Seal Badge is issued free of charge through ORUS, carries a verification QR code, and can be posted on an About or Compliance page, a platform seller profile, or an app settings page without publishing the full COR. The circular states that taxpayers are not required to replace an existing COR or eCOR that lacks a QR code, although they are encouraged to update it. Our guide to BIR registration for online sellers works through the mechanics.

Invoicing and marketplace withholding

RA 11967, Section 23, requires online merchants and e-retailers to issue invoices or receipts, indicate pricing, ensure goods match their descriptions, supply accessories and manuals, and publicly display the corporate name, physical address and contact details. Separately, RR 16-2023 (21 December 2023) makes e-marketplace operators and digital financial services providers withhold 1% on one-half of gross remittances to sellers. It does not apply where annual total gross remittances to the seller for the past taxable year did not exceed ₱500,000, or where cumulative gross remittances in the current taxable year have not yet exceeded ₱500,000.

Disclosures under the Internet Transactions Act

Section 21 puts duties on e-marketplaces: obtain merchant identification, geographic address and contact details, keep merchant lists updated, protect consumer data, block regulated goods sold without permits, and provide a redress mechanism. Section 23 puts the storefront duties on the seller. The practical test is whether a buyer can identify who they are dealing with, and how to complain, before paying. See our breakdown of online seller disclosure requirements and the wider Internet Transactions Act guide.

Data privacy

If you collect names, addresses, phone numbers, emails, IDs or payment details, the Data Privacy Act applies from the first record. Registration with the NPC is narrower. Under Section 5 of NPC Circular 2022-04, a data processing system must be registered where the entity employs 250 or more persons, processes sensitive personal information of 1,000 or more individuals, or carries out processing likely to pose a risk to the rights and freedoms of data subjects. Systems involving automated decision-making or profiling must be registered in all instances. Registration is filed through the designated Data Protection Officer. The data privacy compliance checklist covers the operational side.

Consumer remedies

A blanket “No Return, No Exchange” rule cannot remove statutory remedies for defective goods or goods that do not conform to what was promised. A defensible policy separates discretionary change-of-mind returns from legally protected remedies. Our guide to e-commerce returns, refunds and consumer rights explains where the line sits.

Who Is Liable When an Online Sale Goes Wrong

This is the part of the Internet Transactions Act that online sellers most often get backwards. Many assume that because a sale happened on a marketplace, the marketplace carries the problem. RA 11967 allocates liability the other way round, and the seller sits at the front of it.

Section 25 makes the e-retailer or online merchant primarily liable for indemnifying the online consumer. The marketplace or digital platform is only subsidiarily liable, and only where one of the circumstances in Section 26 is present, or solidarily liable in the narrower case set out in Section 27. Before any of that, Section 24 requires the aggrieved party to use the platform’s internal redress mechanism first.

Who bears it	Legal basis	When it applies
The seller, primarily	RA 11967, Sec. 25	Always. The e-retailer or online merchant is primarily liable for indemnifying the online consumer.
The marketplace, subsidiarily	RA 11967, Sec. 26	Only on a listed trigger: failure of ordinary diligence under Secs. 21 and 22, failure to act after notice on infringing or takedown-ordered listings, or failure to give the contact details of a merchant with no Philippine legal presence.
The marketplace, solidarily	RA 11967, Sec. 27	Where the platform fails, after notice, to act expeditiously to remove prohibited, injurious, unsafe or dangerous goods or services.
The consumer, first step	RA 11967, Sec. 24	The buyer must use the platform’s internal redress mechanism. A complaint left unresolved for seven calendar days after filing is treated as exhausted.

Two practical consequences follow. First, a seller cannot treat a marketplace dispute queue as the end of its exposure: Section 25 liability is the seller’s own. Second, the seven-calendar-day rule in Section 24 is a clock that runs against the business. If a complaint sits unanswered for a week, the buyer is free to escalate, and the DTI E-Commerce Bureau is the forum that receives it.

Section 26 does give a marketplace a good-faith defence where it relied on merchant documents and made reasonable effort to verify them, which is precisely why platforms demand registration papers before listing. A seller with incomplete DTI, SEC or BIR documents should expect to be delisted rather than defended.

First action: answer every complaint inside seven days, in writing, through the platform’s own mechanism, and keep the dated record. That single habit protects the business under Section 24 and gives it something to show if the complaint is escalated.

Exceptions and Boundaries

Several widely repeated obligations are narrower than they sound.

There is no BIR annual registration fee. Section 34 of RA 11976 rewrote NIRC Section 236(B), which now speaks only of registering each tax type, filing returns and updating registration. The ₱500 figure survives in older checklists and in some accountants’ templates.
The Trustmark is voluntary. As of 6 September 2026 the DTI states that application is voluntary and encouraged rather than required, with the voluntary phase running to 31 December 2026. Fees are ₱130 for micro, ₱630 for small and ₱1,130 for medium enterprises, and the mark is valid one year, with renewal filed between three months and thirty days before expiry (trustmark.dti.gov.ph/faqs, checked 6 September 2026). See our Trustmark guide.
NPC registration is not universal. Falling below all of the Section 5 thresholds means no registration duty, but every other Data Privacy Act obligation still applies.
RR 16-2023 withholding is a marketplace duty, not a seller duty. The marketplace or payment provider withholds; the seller claims the credit. A seller below the ₱500,000 thresholds is not exempt from income tax, only from having tax withheld at source.
RA 11967 is bounded by the DTI mandate. Section 3 limits it to internet transactions within that mandate, so financial products, health products and other sectorally regulated goods carry additional regulators.
Foreign sellers are not outside the law. Section 5 applies Philippine law to a person who avails of the Philippine market to the extent of establishing minimum contacts here.

Four Hypothetical Scenarios

The following are illustrative hypotheticals, not decided cases.

Hypothetical 1: the Facebook-only seller

A sole proprietor sells skincare through a Facebook page and a Shopee shop under two different names, and has never registered anything. She needs a DTI business name, an LGU permit and BIR registration, and under RMC 91-2024 must declare both store names so they appear against her registration. Her belief that a Facebook page is “not a real store” has no basis in RA 11967 or the NIRC.

Hypothetical 2: the ₱480,000 marketplace seller

A registered seller receives ₱480,000 in marketplace remittances this year and received ₱410,000 last year. Under RR 16-2023 the operator should not yet be withholding, because neither the prior-year nor the cumulative current-year threshold has been passed. He still files and pays income tax and business tax; the absence of withholding is not an exemption.

Hypothetical 3: the 40-employee SaaS company

A corporation with 40 staff runs a subscription platform and profiles users to price plans automatically. It is below the 250-employee threshold, but because the system involves automated decision-making or profiling, NPC Circular 2022-04 requires registration in all instances. It also needs a DPO to file that registration.

Hypothetical 4: the anonymous dropshipper

A store lists only an Instagram handle and a mobile number, with no business name, address or complaint route. That fails the Section 23 disclosure duties squarely, and the marketplace hosting it has its own Section 21 exposure for not holding verified merchant identification.

Documentation and Records

Keep, in one place and backed up: DTI or SEC certificates; the LGU permit and its renewals; the BIR Certificate of Registration and the ORUS seal badge; the list of declared store names and where each is posted; issued invoices and receipts; marketplace remittance and withholding statements including BIR Form 2307 certificates; product listings and material advertisements as published; complaint, refund and replacement records; dated versions of the privacy notice; the DPO designation; vendor and data-sharing agreements; and security incident records.

Versioning matters more than volume. If a dispute turns on what a buyer was shown on a given date, an undated policy file proves very little.

Step-by-Step Procedure

Decide the structure. Sole proprietorship goes to the DTI; corporation, one person corporation or partnership goes to the SEC.
Register the name. Sole proprietors file at bnrs.dti.gov.ph; confirm the scope and current fee on the portal at the time of filing.
Secure barangay clearance and the Mayor’s or business permit from the LGU of your place of business.
Register with the BIR through ORUS or your Revenue District Office, and register each applicable tax type.
Declare every online store name, page and account against your registration, as RMC 91-2024 requires.
Generate the Registration Seal Badge in ORUS and post it on your website and on each platform seller profile.
Set up invoicing so every transaction produces a compliant invoice or receipt.
Publish the Section 23 disclosures: registered name, address, contact details, price, product characteristics, payment methods, delivery terms, returns and warranty terms, and the complaint route.
Publish a privacy notice that matches what the site actually collects, and appoint a DPO if you process personal data at scale.
Check the NPC Circular 2022-04 Section 5 thresholds and register at register.privacy.gov.ph if any is met.
Optionally apply for the E-Commerce Philippine Trustmark, which asks for a described internal redress mechanism.
Diarise annual LGU renewal, Trustmark renewal, and a quarterly review of store names, prices and policy text.

Consequences and Realistic Outcomes

Section 29 of RA 11967 does not set one flat range. It sets different administrative fines for different violations, and each one escalates on repeat offences. The table below gives the three tiers that bear on an ordinary online business.

Violation	First offence	Second offence	Third and later
Deceptive, unfair or unconscionable online sales act or practice (Sec. 29(b)), on top of RA 7394 penalties	₱20,000 to ₱100,000	₱100,000 to ₱500,000	₱500,000 to ₱1,000,000
Willful or unreasonable refusal to comply with a takedown order (Sec. 29(c))	₱20,000 to ₱100,000	₱100,000 to ₱500,000	Up to ₱1,000,000
Breach of the marketplace and seller disclosure duties in Secs. 21, 22(b) to (d) and 23(a), (f) or (i) (Sec. 29(e))	₱5,000 to ₱10,000	₱10,000 to ₱50,000	₱50,000 to ₱100,000

Two further points sit outside the table. Section 29(d) penalises breaches of the consumer-obligation provisions by reference to the value of the goods or services, and caps that fine at ₱20,000. A takedown may also be imposed in addition to a fine, under the DTI’s authority to issue takedown orders in Section 15, and Section 16 separately allows blacklisting of an online business. Section 29 requires the DTI Secretary to adjust the fine amounts every five years, so confirm the current figures before relying on them.

The realistic first outcome for a small seller is not a maximum fine: it is a compliance directive, a platform delisting, or a takedown request routed through the marketplace.

On the tax side, failure to register or to issue invoices exposes the business to surcharges, interest and compromise penalties under the NIRC. Under the Data Privacy Act, the NPC can issue compliance and cease-and-desist orders, and specified acts carry criminal penalties. Consumer complaints most often resolve at DTI mediation rather than in court.

The pattern worth planning for is cumulative rather than catastrophic. Unregistered store names, missing invoices and an unposted seal badge tend to be discovered together, usually when a platform runs a verification sweep or a customer complains to the DTI.

Common Mistakes

Budgeting for a ₱500 BIR annual registration fee that RA 11976 removed.
Registering the entity but never declaring the store names used on each platform.
Publishing the full COR page online when the free ORUS seal badge exists.
Treating the Trustmark as a licence to operate rather than a voluntary mark.
Assuming NPC registration is required of every business, or that no registration means no privacy obligations.
Reading the ₱500,000 withholding threshold as an income tax exemption.
Copying a privacy notice that does not describe the site’s actual data flows.
Relying on a blanket “No Return, No Exchange” rule.
Listing only a social handle and a mobile number as seller contact details.
Letting the LGU permit lapse because national registrations are current.

Tool: Sequenced Registration Checklist

Work down the list. Do not start a row until the row above is complete, because each step usually needs the previous certificate as an attachment.

Order	Step	Output you must file away	Renewal
1	Choose structure and reserve the name	Name reservation or confirmation	Not applicable
2	DTI business name or SEC registration	BN certificate, or certificate of incorporation and articles	DTI BN periodically; SEC annual reports
3	Barangay clearance	Clearance	Annual
4	Mayor’s or business permit	Permit and official receipt	Annual
5	BIR registration and tax types	Certificate of Registration	Update on any change
6	Declare online store names	Updated registration reflecting store names	On every new channel
7	Generate and post the Registration Seal Badge	Badge image plus a list of posting locations	Re-post on new platforms
8	Invoicing set up and tested	Sample compliant invoice	Continuing
9	Publish Section 23 disclosures	Dated screenshot of the storefront	Review quarterly
10	Privacy notice and DPO	Dated notice and DPO designation	Review annually
11	NPC registration if a threshold is met	Registration confirmation	Per NPC rules
12	Trustmark, if wanted	Trustmark certificate	Annual, filed 3 months to 30 days before expiry

FAQs

What compliance requirements should a Philippine online business know?

Five sets: entity registration with the DTI for a sole proprietorship or the SEC for a corporation, one person corporation or partnership; a barangay clearance and a Mayor’s or business permit from the LGU where you operate; BIR registration, declaration of every online store name under RMC 91-2024, and compliant invoicing; the Internet Transactions Act duties on price and seller disclosure, internal redress and primary liability under Sections 23 to 25 of RA 11967; and the Data Privacy Act from the first customer record, with NPC registration only if a Circular 2022-04 threshold is met. The ITA’s eighteen-month transitory period has expired, so all of the RA 11967 duties are enforceable now.

Has the Internet Transactions Act transitory period ended?

Yes. Section 32 of RA 11967 gave affected online merchants, e-retailers, e-marketplaces and digital platforms eighteen months from the Act’s effectivity to comply. The Act was approved on 5 December 2023 and took effect fifteen days after publication was completed, so the eighteen months ran out in 2025. A business that opened later does not get a fresh grace period, because the clock ran from the Act’s effectivity rather than from each business’s start date.

If a customer complains on a marketplace, is the marketplace liable instead of me?

No. Section 25 of RA 11967 makes the e-retailer or online merchant primarily liable for indemnifying the online consumer. The marketplace is subsidiarily liable only where a Section 26 trigger is present, and solidarily liable only in the narrower Section 27 case of failing to remove prohibited, injurious, unsafe or dangerous goods after notice. Section 24 also requires the buyer to use the platform’s internal redress mechanism first, and treats a complaint as exhausted if it is unresolved seven calendar days after filing.

Is there still a ₱500 BIR annual registration fee?

No. Section 34 of RA 11976 rewrote NIRC Section 236(B) and the annual registration fee no longer appears in it. Checklists that still list it predate January 2024.

Do I have to post my BIR Certificate of Registration on my website?

RMC 91-2024 requires online sellers to post an electronic copy of the COR or, where available, its ORUS or Philippine Business Hub QR code. Since RMC 38-2026 you may instead post the BIR Registration Seal Badge, which avoids publishing the full COR page. The badge is issued free of charge, though securing it through the registration-update route carries a ₱30.00 loose documentary stamp tax.

Is the E-Commerce Philippine Trustmark mandatory?

No. As of 6 September 2026 the DTI describes application as voluntary and encouraged, with the voluntary phase running to 31 December 2026. Confirm the current position on trustmark.dti.gov.ph before relying on it.

Does my small online shop need to register with the NPC?

Only if it meets a Section 5 threshold in NPC Circular 2022-04: 250 or more employees, sensitive personal information of 1,000 or more individuals, risky processing, or any automated decision-making or profiling. The Data Privacy Act still applies below those thresholds.

Do I need both DTI and SEC registration?

Normally no. Sole proprietors register a business name with the DTI; corporations, one person corporations and partnerships register with the SEC under RA 11232.

Does RA 11967 apply to a foreign seller shipping into the Philippines?

Section 5 applies Philippine law to a person engaging in e-commerce who avails of the Philippine market to the extent of establishing minimum contacts here.

Official Sources

Checks Made on 15 October 2026

Every load-bearing citation on this page was read against a government or primary source on the date below. Two claims were corrected as a result, and two could not be confirmed. The table records all four.

What was checked	Source read	Result
RA 11967 Secs. 3, 5, 21, 23 and 29	Enrolled copy, Senate of the Philippines; Supreme Court E-Library	Confirmed. The section numbers used on this page match the enacted Act.
RA 11967 Sec. 29 fine tiers	Enrolled Senate copy	Confirmed for paragraphs (b) and (e). The page no longer states a single headline range.
RA 11967 Sec. 32 transitory period	Enrolled Senate copy	Confirmed: eighteen months from the effectivity of the Act.
RA 11967 Secs. 24 to 27 liability chain	Supreme Court E-Library copy	Confirmed, including the seven-calendar-day rule in Sec. 24.
RA 11976 amendment to NIRC Sec. 236	Senate copy of RA 11976	Corrected. The amending provision is Section 34, not Section 35. The amended Sec. 236(B) carries no annual registration fee.
RA 11232 Secs. 10 and 18	Senate copy of RA 11232	Confirmed.
BIR RMC No. 38-2026	BIR copy of the circular	Corrected. The Seal Badge is issued free of charge, but the registration-update route to obtain it carries a ₱30.00 loose documentary stamp tax.
NPC Circular 2022-04, Sec. 5 thresholds	Verified on the 14 October 2026 review of the Cybercode data privacy compliance checklist; not re-fetched on this review	Unchanged.
Implementing rules of RA 11967	DTI E-Commerce Bureau policy issuances page	Listed with the date 24 May 2024. A machine-readable government copy of the signed text could not be retrieved on this review.
Exact effectivity date of RA 11967	Official Gazette page for the Act	Not confirmed. The page returned an error, so this guide reasons from the approval date and Sec. 38 instead.

Figures that could not be traced to a source retrieved on this review are not stated on this page as current.

Sources rechecked as of: October 15, 2026

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.