Purpose
Produce a structured first-pass regulatory risk scan of a proposed market initiative or partnership — flagging where licensing, tax, zoning, data, labor, and consumer-protection exposures likely sit — so a market manager can triage issues, brief stakeholders, and escalate the right items to legal instead of either ignoring risk or blocking everything for review.
When to Use
Invoke this skill when the user asks to:
- Assess the compliance risk of entering a new market or geography
- Evaluate a partnership, vendor, or reseller deal before signing
- Scan a new product, pricing model, or operational change for regulatory exposure
- Prepare a risk summary before escalating something to legal or a compliance team
- Compare regulatory exposure across multiple candidate markets or launch options
- Sanity-check whether an initiative can proceed as-is or needs review first
Inputs Required
Before starting, collect:
- Initiative description: 3–5 sentences on what is being launched, changed, or entered — the product, deal, or operational move
- Jurisdictions: The specific cities, states, provinces, or countries involved (or "TBD" if not yet chosen)
- Business model mechanics: How money moves — who pays whom, whether the operator takes a cut, holds funds, or facilitates transactions
- Parties involved: Whether workers, drivers, hosts, sellers, or partners are employees, contractors, or third parties
- Data handled: What personal or sensitive data is collected, stored, or shared (payment, health, location, biometric, minors)
- Physical footprint: Whether the initiative involves physical locations, property use, or on-site operations
- Risk posture: Whether the user wants a conservative flag-everything scan or a materiality-filtered "what actually matters" view
If jurisdictions are "TBD," produce a jurisdiction-agnostic scan flagging categories that are typically regulated and noting which flags become sharper once geography is fixed.
Instructions
Step 1: Classify the Initiative
Before scanning, categorize the initiative to calibrate the scan:
- Type: Market entry / partnership / new product or feature / pricing or payment change / operational shift
- Regulatory surface area: Does it touch money movement, physical space, personal data, worker classification, or a licensed activity? Note each surface it touches — these are the categories to scan hardest.
- Novelty: Is this a well-trodden model (standard marketplace listing) or a novel structure (new payment flow, new asset class, new worker relationship)? Novel structures carry higher unknown-risk and warrant more conservative flagging.
State the classification in 2–3 sentences before the scan.
Step 2: Scan Across Six Regulatory Risk Categories
For each category, assess whether the initiative triggers it, assign a severity, and state the specific concern. Do not flag categories that genuinely don't apply — say "No material exposure identified" and give one line of reasoning.
Category 1 — Licensing & Permits Whether the activity requires a license, registration, or permit to operate legally.
- Common triggers: money transmission/holding funds, financial services, alcohol/food/cannabis, transportation, real estate brokerage, healthcare, professional services
- Flag if the operator facilitates transactions in a way that resembles a regulated intermediary (money transmitter, broker, marketplace facilitator)
- Note whether licensing is per-jurisdiction (stacks by state/city) vs. federal/national
Category 2 — Tax & Fee Obligations Whether the initiative creates tax collection, remittance, or reporting duties.
- Common triggers: marketplace facilitator sales-tax collection, nexus creation in new jurisdictions, VAT/GST, occupancy/lodging taxes, 1099-K reporting thresholds, withholding on payouts
- Flag if the operator processes payments — marketplace facilitator laws often shift collection duty onto the platform
- Note whether entering the jurisdiction creates economic nexus for the operator itself
Category 3 — Zoning & Land-Use Whether physical operations conflict with local land-use rules.
- Common triggers: short-term rentals, home-based businesses, dark stores/ghost kitchens, warehousing, on-street activity, signage
- Flag if the initiative uses residential property for commercial activity, or commercial property for a use it isn't zoned for
- Note that zoning is hyper-local — often city or even district level
Category 4 — Data & Privacy Whether data handling triggers privacy or security obligations.
- Common triggers: GDPR (EU), CCPA/CPRA (California), state privacy laws, HIPAA (health), COPPA (minors), biometric laws (e.g., BIPA), cross-border data transfer
- Flag by data sensitivity: payment, location, health, biometric, and children's data each raise the tier
- Note consent, deletion, and breach-notification duties triggered by the data collected
Category 5 — Labor & Worker Classification Whether the relationship with workers or partners creates employment obligations.
- Common triggers: gig/contractor models, ABC-test states, joint-employer risk, minimum wage/overtime, benefits mandates, misclassification exposure
- Flag if workers are treated as contractors but the model exerts employee-like control
- Note that classification tests vary sharply by jurisdiction and are actively litigated
Category 6 — Consumer Protection & Marketing Whether the offer or communications risk unfair/deceptive-practices exposure.
- Common triggers: auto-renewal/subscription laws, pricing transparency, drip pricing/junk fees, refund and cancellation rules, advertising claims, dark-pattern regulations
- Flag if the model uses auto-renewal, mandatory fees disclosed late, or claims requiring substantiation
- Note fee-transparency and cancellation rules that increasingly carry statutory penalties
Step 3: Assign Severity and Build the Flag Table
For every flagged issue, assign:
- Severity: Critical (likely illegal or blocking as structured) / High (material exposure, needs legal review before launch) / Medium (manageable with a known fix or filing) / Low (monitor, low likelihood or low penalty)
- Likelihood: How probable the exposure applies given the facts provided
- Trigger condition: The specific fact that would confirm or resolve the flag
- Recommended action: The concrete next step — file X, obtain Y license, escalate to legal, add disclosure, restructure the flow
Step 4: Produce the Escalation Summary
Close with a decision-oriented summary:
- Go / Conditional Go / Hold: A single posture recommendation with one-line rationale
- Must-resolve-before-launch list: The Critical and High flags only
- Legal-review packet: The 3–5 specific questions to send to counsel, phrased as questions, not vague topics
- Open information gaps: What facts, if provided, would sharpen or clear the biggest flags
Output Format
- Structure: Classification → six-category scan → severity flag table → escalation summary
- Length: 800–1,200 words
- Format: Prose for classification and summary; a table for the flag register (Category | Issue | Severity | Likelihood | Trigger | Recommended Action)
- Sections: Initiative Classification → Category Scan (all 6, in order) → Flag Register (table) → Escalation Summary
- Tone: Compliance analyst — precise, plainly worded, flags risk without alarmism, distinguishes "confirmed concern" from "worth checking"
Quality Checklist
Before delivering output, verify:
- [ ] All six categories are addressed — including a stated "no material exposure" with reasoning where a category doesn't apply
- [ ] Every flag has a severity, a likelihood, a trigger condition, and a recommended action — none left blank
- [ ] Severity ratings are justified by the specific facts provided, not assigned generically
- [ ] The escalation summary gives one clear posture (Go / Conditional Go / Hold), not a hedge
- [ ] The legal-review packet is phrased as specific answerable questions, not broad topics
- [ ] Jurisdiction-specific flags note that local law controls where geography is fixed or TBD
Notes
- This is a triage scan, not legal advice — always frame flags as items for review, and state that final determinations require qualified counsel in the relevant jurisdiction
- Marketplace facilitator laws (tax) and worker-classification tests (labor) are the two categories that most often surprise operators — scan them hardest when payments or workers are involved
- When jurisdictions are undecided, the highest-value output is often a comparison: which candidate market carries the lightest regulatory load for this specific model
- Novelty is a risk multiplier — if the model doesn't fit an existing regulatory box, flag it High even when no single category screams, because ambiguity itself is exposure
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills