# Pre-Launch Regulatory Compliance Checklist — RateRight
**Date:** 2026-02-26 | **Author:** Harper (Finance/Legal)
**Purpose:** Comprehensive pre-launch compliance checklist for a national contractor marketplace. Zero gaps tolerated.
**Scope:** All federal, state, and industry-specific obligations for a platform operating in all Australian states/territories.

---

## STATUS SUMMARY

| Category | Items | ✅ Clear | ⚠️ Action Needed | ❌ Blocker |
|----------|-------|---------|------------------|-----------|
| Company Registration | 4 | 4 | 0 | 0 |
| Labour/Employment Law | 5 | 4 | 1 | 0 |
| Consumer Protection | 5 | 2 | 3 | 0 |
| Privacy & Data | 4 | 2 | 2 | 0 |
| Electronic Communications | 3 | 1 | 2 | 0 |
| Payment Processing | 4 | 1 | 2 | 1 |
| Insurance | 3 | 1 | 0 | 2 |
| Industry-Specific | 3 | 2 | 1 | 0 |
| **TOTAL** | **31** | **17** | **11** | **3** |

**3 blockers. 11 actions needed. 17 clear.**

---

## 1. COMPANY REGISTRATION & STRUCTURE

| # | Requirement | Status | Evidence | Action |
|---|------------|--------|----------|--------|
| 1.1 | **ABN registration** | ✅ Clear | ABN 62 841 523 907 | None |
| 1.2 | **Company registration (ASIC)** | ✅ Clear | RateRight Pty Ltd | None |
| 1.3 | **GST registration** | ✅ Not required | Turnover <$75K. Not required until ~128 hires/month. | Monitor — auto-triggers at $75K/yr |
| 1.4 | **Business name registration** | ✅ Clear | Trading as "RateRight" under company name | None |

---

## 2. LABOUR & EMPLOYMENT LAW

This is the highest-risk category. The critical question: **Is RateRight a "labour hire provider"?**

| # | Requirement | Status | Analysis | Action |
|---|------------|--------|----------|--------|
| 2.1 | **Labour hire licensing — NSW** | ✅ Clear | NSW does not require labour hire licences. No state scheme exists. | None |
| 2.2 | **Labour hire licensing — QLD, VIC, SA, ACT** | ⚠️ Needs legal confirmation | These states require licences for labour hire providers. RateRight does NOT employ, pay, or supply workers — it connects contractors with independent workers. The platform model is closer to Seek/Indeed (job board) than to a labour hire firm. **However**, the QLD definition is broad: "supplies workers to perform work in a host's business." If a regulator interprets "matching + facilitating payment" as "supplying", RateRight could be caught. **My assessment: LOW risk but not zero.** Yakka Labour (direct competitor) appears to operate without a labour hire licence using a similar marketplace model. | **Recommend:** Get a 30-minute legal opinion ($200-400) confirming RateRight's marketplace model is exempt from labour hire licensing in QLD, VIC, SA, ACT. This is cheap insurance against a $500K penalty (QLD max fine for using an unlicensed provider). Do this before any contractor in those states posts a job. |
| 2.3 | **Fair Work — Sham contracting** | ✅ Clear | Construction tradies with ABNs are independent contractors, not employees. Sham contracting applies when employers disguise employment as contracting. RateRight doesn't employ anyone — it's a marketplace. Workers set their own rates, choose their own jobs, use their own tools. LOW risk. See `memory/2026-02-24.md` for full Closing Loopholes assessment. | None |
| 2.4 | **Fair Work — Independent contractor protections** | ✅ Clear | Closing Loopholes Act 2024 strengthened protections for independent contractors. RateRight benefits — our model aligns with genuine contracting (workers choose jobs, set rates, no exclusivity). The new "right to disconnect" doesn't apply (no employment relationship). | None |
| 2.5 | **Workplace health & safety** | ✅ Clear | RateRight is NOT a PCBU (Person Conducting a Business or Undertaking) for work performed on construction sites. The hiring contractor is the PCBU. RateRight has no WHS duties for on-site work. However, RateRight should include a ToS clause making this explicit. | Ensure ToS includes WHS disclaimer — workers and contractors acknowledge RateRight is not responsible for on-site safety. |

---

## 3. CONSUMER PROTECTION (Australian Consumer Law)

| # | Requirement | Status | Analysis | Action |
|---|------------|--------|----------|--------|
| 3.1 | **Terms of Service** | ⚠️ Draft complete, needs review | ToS drafted by Harper. Covers: service description, payment terms, dispute resolution, limitation of liability. **Needs review for unfair contract terms (UCT) compliance.** Since Nov 2023, UCT provisions apply to standard-form contracts with small businesses. Penalty: up to $50M per contravention. | Review ToS against UCT checklist. Key risk areas: unilateral termination clauses, unilateral price change clauses, limitation of liability that's too broad. Consider professional legal review before launch ($500-1,000). |
| 3.2 | **Consumer guarantees** | ⚠️ Needs attention | ACL consumer guarantees apply to services. RateRight provides a matching service for $50. The guarantee of "due care and skill" applies — we must make reasonable efforts to match contractors with suitable workers. If the matching algorithm consistently provides poor matches, this could be challenged. | Include in ToS: RateRight guarantees due care in matching but does not guarantee worker quality, availability, or work outcomes. Document matching methodology for compliance evidence. |
| 3.3 | **Refund policy** | ⚠️ NOT DONE — action needed | ACL requires "major failure" refunds. A matching service that returns zero matches could be a "major failure" (service not fit for purpose). RateRight needs a clear, fair refund policy that's ACL-compliant. | **Draft refund policy this week.** Must cover: (1) zero matches = full refund, (2) worker no-show on first shift = full refund (first-hire guarantee), (3) process for dispute resolution. Publish on website before launch. |
| 3.4 | **Pricing transparency** | ✅ Clear | $50 flat fee is clear, simple, displayed upfront. No hidden fees. No subscription traps. Model pricing is a compliance asset — ACCC is specifically targeting subscription traps and hidden fees in 2025-26 priorities. | None |
| 3.5 | **Misleading conduct** | ✅ Clear (with caveats) | Marketing must not overstate match quality or guarantee outcomes. Susan's marketing materials reviewed — "we match you directly" is accurate. **Risk area:** Claiming "keep 100% of your rate" could be misleading if workers don't understand that contractors set the rate, not the platform. | Ensure all marketing clarifies: "Contractors and workers agree on rates directly. RateRight does not set or influence pay rates." |

---

## 4. PRIVACY & DATA PROTECTION

| # | Requirement | Status | Analysis | Action |
|---|------------|--------|----------|--------|
| 4.1 | **Privacy Act 1988 — APP entity** | ⚠️ Likely applies | The Privacy Act applies to organisations with >$3M annual turnover OR that trade in personal information. RateRight is below $3M but **may be caught** because it collects and shares personal information (worker profiles with contractors) as a core business function. The OAIC has flagged that "trading in personal information" includes sharing for commercial purposes. **Conservative position: assume the Privacy Act applies.** | Treat RateRight as an APP entity. Comply with all 13 Australian Privacy Principles (APPs). This is conservative but safe. |
| 4.2 | **Privacy Policy** | ✅ Draft complete | Privacy policy drafted, covering: collection, use, disclosure, storage, access, correction, complaints. | Publish on website. Review annually (next: Feb 2027). |
| 4.3 | **Data breach notification** | ⚠️ Needs process | Notifiable Data Breaches (NDB) scheme requires notification to OAIC and affected individuals within 30 days of an "eligible data breach" (likely to result in serious harm). RateRight holds: names, phone numbers, email, trade certifications, location, payment info. A breach of this data could cause serious harm. | **Define data breach response plan.** Who is notified (Michael), what's the assessment process, how to notify OAIC (oaic.gov.au/privacy/notifiable-data-breaches), template notification letter. Sentinel should have infrastructure controls. |
| 4.4 | **Cross-border data transfer** | ✅ Clear (likely) | If all data is stored on Australian servers (Fly.io Sydney region) and processed by US-based AI (Anthropic), APP 8 requires reasonable steps to ensure overseas recipients comply with APPs. Anthropic's data processing is covered by their ToS. Stripe data goes to US but Stripe has compliant data handling. | Confirm Fly.io primary region is Sydney. Document overseas data processors (Anthropic, Stripe, Twilio) and their privacy compliance. |

---

## 5. ELECTRONIC COMMUNICATIONS (Spam Act / Telecomms)

| # | Requirement | Status | Analysis | Action |
|---|------------|--------|----------|--------|
| 5.1 | **Spam Act 2003 — SMS marketing** | ⚠️ Compliance needed | Susan's outreach plan includes SMS campaigns to contractors. Under the Spam Act: (1) Must have consent (opt-in) OR an existing business relationship, (2) Must include sender identification, (3) Must include unsubscribe/opt-out facility. Cold SMS to contractors from Apollo leads is technically **unsolicited commercial electronic messages** = potentially illegal spam. | **Critical:** Susan's SMS outreach must either (a) use phone calls instead of SMS for cold outreach (phone calls are exempt from Spam Act), or (b) obtain consent first via another channel. The safer path: cold CALL first, get verbal consent, then SMS. All SMS must include opt-out. |
| 5.2 | **ACMA SMS Sender ID Register** | ⚠️ Needs checking | Since 15 Dec 2025, a mandatory SMS Sender ID Register exists. Businesses sending SMS must register their sender ID to prevent scam impersonation. RateRight may need to register if sending branded SMS (e.g., "RateRight" as sender). | Check if Twilio handles Sender ID registration automatically or if RateRight needs to register separately with ACMA. |
| 5.3 | **Do Not Call Register** | ✅ Clear (with compliance) | Phone calls to business numbers are generally exempt from the DNCR if calling for business purposes. Susan's contractor outreach (calling construction businesses about a B2B service) is likely exempt. However, best practice: check numbers against DNCR before calling. | Susan should scrub numbers against DNCR before calling. Twilio may offer DNCR checking integration. |

---

## 6. PAYMENT PROCESSING

| # | Requirement | Status | Analysis | Action |
|---|------------|--------|----------|--------|
| 6.1 | **Stripe compliance** | ✅ Clear | Stripe handles PCI-DSS compliance, payment security, and regulatory requirements for payment processing. RateRight doesn't store card numbers directly. | None |
| 6.2 | **Tax invoices / receipts** | ⚠️ Needs verification | When a contractor pays $50, they must receive a receipt/tax invoice. Since RateRight is NOT GST-registered, the receipt must NOT include GST. It should include: business name, ABN, date, description, amount, "No GST" notation. **Stripe auto-receipts may not include ABN or correct AU formatting.** | **Verify Stripe receipt content.** Confirm ABN appears, "No GST" is stated, business name is correct. If Stripe receipts are inadequate, configure custom receipts or send manual invoices. |
| 6.3 | **Stripe → bank payout** | ❌ BLOCKER — not tested | No test payment has been run. If the first real $50 payment fails to reach the bank account, it's a trust-destroying event at the worst possible moment. | **Run a $1 test charge through Stripe BEFORE launch.** Verify funds appear in AirWallex. This is a 5-minute task. |
| 6.4 | **Refund processing** | ⚠️ Needs setup | No refund process defined. Stripe supports refunds but they need to be triggered. Who triggers them? What's the approval process? What's the timeline? | Define refund workflow: contractor requests → Michael reviews → approval within 48 hours → Stripe processes → confirmation email. Link to refund policy (Section 3.3). |

---

## 7. INSURANCE

| # | Requirement | Status | Analysis | Action |
|---|------------|--------|----------|--------|
| 7.1 | **Professional Indemnity (PI)** | ❌ BLOCKER — not obtained | PI insurance covers claims arising from professional advice or services. A contractor could claim RateRight's matching algorithm recommended an unsuitable worker, causing loss. Without PI, a single claim could be company-ending. **Estimated cost: $800-1,500/year.** | **Michael: Get BizCover quote THIS WEEK.** 10 minutes online. Do NOT launch without PI. |
| 7.2 | **Public Liability (PL)** | ❌ BLOCKER — not obtained | PL covers third-party injury/property damage claims. While on-site injuries fall on the PCBU (contractor), a claim could allege RateRight's platform contributed to an unsafe match (e.g., unqualified worker). **Estimated cost: $400-800/year combined with PI.** | Bundle with PI quote from BizCover. |
| 7.3 | **Workers Compensation** | ✅ Not required | RateRight has no employees. Workers on the platform are engaged directly by contractors (who must have their own workers comp). | None — monitor if RateRight hires employees in future. |

---

## 8. INDUSTRY-SPECIFIC

| # | Requirement | Status | Analysis | Action |
|---|------------|--------|----------|--------|
| 8.1 | **White Card requirement** | ✅ Clear (platform enforces) | All construction workers need a General Construction Induction Card (White Card) under WHS regs. RateRight should verify/require White Card during signup. Workers without one cannot legally work on construction sites. | Confirm signup flow requires White Card number or photo. If not implemented, flag to Builder as pre-launch requirement. |
| 8.2 | **Construction industry-specific regs** | ✅ Clear | No specific licensing needed to operate a construction job board/marketplace. Construction-specific regulations (SafeWork NSW, etc.) apply to on-site work, not to the matching platform. | None |
| 8.3 | **National labour hire licensing scheme** | ⚠️ Monitor | Federal government has committed to a national labour hire licensing scheme. Currently in consultation phase. If enacted, could require RateRight to obtain a licence even as a marketplace (depending on definitions). **Timeline: unlikely before late 2026 at earliest.** | Monitor Treasury announcements. If national scheme is announced, immediately assess whether marketplace model is caught. Flag to Michael if definitions are broad. |

---

## 9. PRIORITY ACTION LIST

### ❌ BLOCKERS (Must Fix Before Launch)

| # | Action | Owner | Time Required | Cost | Risk if Skipped |
|---|--------|-------|--------------|------|----------------|
| **B1** | Get PI + PL insurance | Michael | 15-30 min (BizCover online) | $1,000-2,000/yr | Company-ending claim |
| **B2** | Test Stripe payout | Michael/Builder | 5 min | $1 (test charge) | First payment fails, contractor trust destroyed |
| **B3** | Define & publish refund policy | Harper draft → Michael approve | 1 hour | $0 | ACL non-compliance + first complaint has no resolution path |

### ⚠️ HIGH PRIORITY (Should Fix Before Launch)

| # | Action | Owner | Time Required | Cost |
|---|--------|-------|--------------|------|
| **H1** | Review ToS for unfair contract terms | Harper (or lawyer) | 2-4 hours (Harper) or $500-1,000 (lawyer) | $0-$1,000 |
| **H2** | Verify Stripe receipts include ABN + "No GST" | Michael/Builder | 15 min | $0 |
| **H3** | Confirm SMS outreach is Spam Act compliant | Susan/Harper | 30 min | $0 |
| **H4** | Define data breach response plan | Harper + Sentinel | 1 hour | $0 |
| **H5** | Check ACMA SMS Sender ID Register requirements | Susan/Sentinel | 30 min | $0 |

### ⚠️ MEDIUM PRIORITY (Fix Within Month 1)

| # | Action | Owner | Time Required | Cost |
|---|--------|-------|--------------|------|
| **M1** | Get legal opinion on labour hire licensing (QLD/VIC/SA/ACT) | Michael (engage lawyer) | 30-min consult | $200-400 |
| **M2** | Document overseas data processors for APP 8 compliance | Harper/Sentinel | 1 hour | $0 |
| **M3** | Define refund processing workflow in Stripe | Michael/Builder | 30 min | $0 |
| **M4** | Consumer guarantee compliance statement in ToS | Harper | 1 hour | $0 |

### LOW PRIORITY (Monitor)

| # | Item | Review Date |
|---|------|------------|
| L1 | National labour hire licensing scheme progress | Monthly |
| L2 | ACCC digital platform enforcement priorities | Quarterly |
| L3 | GST registration threshold monitoring | When revenue > $50K/yr |
| L4 | Privacy Act reform (expanded scope proposals) | Quarterly |

---

## 10. COMPLIANCE COST SUMMARY

| Item | One-Off Cost | Annual Cost |
|------|-------------|-------------|
| PI + PL Insurance | $0 (included in annual) | $1,000-$2,000 |
| Legal opinion (labour hire licensing) | $200-$400 | $0 |
| ToS legal review (optional but recommended) | $500-$1,000 | $0 |
| ACMA Sender ID registration | TBD (may be $0) | TBD |
| **TOTAL** | **$700-$1,400** | **$1,000-$2,000** |

**Total compliance cost: $1,700-$3,400 in Year 1.** This is ~2 months of current burn rate. Cheap insurance against fines that start at $50K (Spam Act) and go up to $50M (UCT) or $500K (unlicensed labour hire in QLD).

---

## EXECUTIVE SUMMARY

**RateRight's compliance position is GOOD but not CLEAN.** 17 of 31 items are clear. 3 are blockers that must be fixed before launch. The marketplace model provides natural insulation from many construction industry regulations, but there are specific gaps:

1. **Insurance (PI + PL) is the #1 blocker.** One claim without cover = game over. 15 minutes on BizCover.
2. **Stripe payout is untested.** 5-minute fix. No excuse for not doing this.
3. **Refund policy doesn't exist.** ACL requires fair dealing. First unhappy contractor has no recourse.
4. **Labour hire licensing in QLD/VIC/SA/ACT is an open question.** Low risk but high consequence. A 30-minute legal consult ($200-400) closes it.
5. **SMS outreach must comply with Spam Act.** Cold SMS without consent = illegal. Switch to phone-first.

**Fix the 3 blockers. Do the 5 high-priority items. The rest can wait until Month 1.**

---

*"Compliance isn't expensive. Non-compliance is."*