Operate.

Companies that are developing or commercializing AI products or services should evaluate several issues, including, but not limited to, treatment of model training data, ownership of inputs and outputs, transparency, human oversight, product testing and liability, regulatory risk analyses, and contractual allocation of responsibility. Consider whether a product may be subject to sector-specific requirements, which may include emerging healthcare, financial services, insurance, or employment law regimes, among others. Customers, investors, and other third parties will increasingly expect AI vendors to maintain thorough frameworks that address cybersecurity, data privacy, incident response, and intellectual property considerations.

Companies that are not themselves AI vendors but that use third-party AI tools or have internally developed AI applications should likewise address how those tools access, process, retain, store, protect, and use company data, including confidential company data, customer information, and employee data. Companies should implement AI governance frameworks, which ordinarily comprise several interrelated policies and procedures, including: acceptable use policies specific to generative AI tools, due diligence reviews of AI vendors, oversight of AI usage, AI use case registries, analyses of contractual and regulatory requirements, as well as risk assessments. Founders should also be aware that AI diligence is becoming increasingly common in financings and customer procurement processes.

To avoid being easy prey for attackers, companies must adopt a cybersecurity risk and governance programs appropriate to their size, industry, and risk profile. This involves prioritizing the following areas.

• Security policies and controls. Companies should implement baseline administrative, technical, and physical safeguards designed to protect systems, networks, and data – as well as documentation of such implemented safeguards. This may include access controls, multifactor authentication, endpoint protection, vendor management procedures, employee training, backup and recovery protocols, and vulnerability management processes.

• Incident response planning. Every company should maintain a written incident response plan that identifies key internal and external stakeholders, escalation procedures, communications protocols, and decision-making authority in the event of a cybersecurity incident. Once in place, those plans should be tested through tabletop exercises to help identify operational gaps before an actual incident occurs. It is also key ahead of an incident to identify (and possibly retain) your preferred external experts, including legal, forensics, communications, and other specialists. Involving legal counsel in the incident response process is also essential to mitigate downstream risks and maintain privilege over sensitive cyber investigations.

• Vendor and supply chain risk. Many cybersecurity incidents originate through third-party vendors, cloud providers, software providers, or other service partners. Companies should conduct diligence on key vendors, review contractual security commitments carefully, and understand where sensitive company or customer data is stored and processed.

• Board and management oversight. As companies scale, boards and management teams are increasingly expected to exercise oversight over cybersecurity risks and preparedness. In some industries, customers, investors, and regulators may expect documented governance processes relating to cybersecurity and operational resilience. Companies preparing for public markets should also be mindful of evolving SEC disclosure requirements and heightened expectations around board oversight, cybersecurity governance, and incident reporting.

• Cyber insurance coverage. Companies should strongly consider obtaining cyber insurance coverage to help mitigate the potentially significant costs associated with cybersecurity incidents, including forensic investigations, business interruption losses, ransomware payments, regulatory inquiries, notification obligations, litigation, and third-party claims. Be aware that insurance is not a “silver bullet” and should not take the place of sound investments in security controls and response measures. Importantly, companies should seek advice before selecting a cyber insurer to avoid limiting their choices for retaining expert legal and technical experts to help them navigate a cyber crisis.

• AI security, governance, and risk management. The proliferation of AI in a company’s business increases its cyber “attack surface” and may expose it to other risks relating to confidentiality, data leakage, intellectual property ownership, among others. Companies should consider implementing internal AI governance and risk management processes addressing acceptable use, employee access, human oversight, vendor diligence, data handling restrictions, model testing and validation, and documentation of AI-related decision making. As regulators continue to introduce evolving AI regulatory frameworks and enforcement priorities, companies should work closely with legal counsel and technical advisors to establish governance structures appropriate to their use of AI technologies.

In the United States, no unified federal standard governs all types of businesses and personal information. Instead, businesses must contend with a wide range of sector-specific federal laws – such as laws governing certain regulated healthcare entities, financial institutions, or federally funded educational institutions, among many others – as well as issue- or data-specific privacy laws, including protections for children, video viewing data, consumer reports, and others. The Federal Trade Commission (“FTC”) also has general authority to police “unfair or deceptive acts or practices,” and has used this authority to enforce a wide range of data-related practices and to introduce specific privacy mandates, such as requiring business to disclose their personal information practices in a privacy policy and, obtaining consumer consent in some instances.

At the state level, lawmaking has progressed rapidly. Comprehensive state consumer privacy laws, such as the California Consumer Privacy Act (“CCPA”), have proliferated in nearly half of U.S. states, requiring businesses to offer consumers robust privacy disclosures and rights to control their personal information. A number of states have enacted narrower privacy laws focused on specific contexts, such as children’s data, biometric data, and health data, which create heightened layers of protection for data and more complex obligations for businesses. Some of these laws have triggered significant litigation, where they provide consumers with a private right of action.

Outside the U.S., businesses may fall within scope of privacy laws in other countries by merely directing business activities to, and collecting data from, residents of those countries. The European Union’s (“EU”) General Data Protection Regulation (“GDPR”) and similar legislation in the United Kingdom, as well as many other countries, extend even broader rights to consumers and require businesses to implement internal compliance processes for managing personal information.

Key Privacy Actions for Founders

Given the rapid proliferation of privacy and data protection laws, emerging businesses need to focus on actionable compliance that can scale with their business and allow them to react to new and changing laws in order to reduce the risks of liability and to be able to demonstrate a defensible privacy program to prospective investors. Here are the key actions for founders to build into their roadmap.

• Privacy Policy. Businesses will need a public-facing disclosure describing how the business collects, uses, shares, and retains personal information. At a minimum, the privacy policy should describe the business’s data collection via its website and for marketing purposes. For consumer-facing businesses, and other businesses that “control” personal information (such as data brokers and data aggregators), the policy will also need to cover the business’s use of data in connection with its services. Specific disclosure requirements – including the rights available to individuals – vary by jurisdiction and business sector.

• Customer Contracts and Data Processing Agreements (DPAs). Businesses that sell to other business customers will need to set out their customer data handling practices within their customer agreements. Customers typically will expect your business to commit to safeguard customer data through appropriate security controls and to restrict uses of customer data outside of the customers’ control. Expect more mature enterprise customers to conduct security assessments; building towards SOC 2 Type II auditing and other industry standards can help reduce friction at procurement.

• Website Tracking Technologies and Targeted Advertising. Online marketing practices, including use of advertising cookies, pixels, and similar tools carry real legal risk. Under the state privacy laws, certain tracking may constitute a "sale" or "sharing" of personal data, triggering opt-out rights. The EU requires affirmative consent for advertising cookies. Plaintiffs have also seized on this issue, making this an active area of litigation. Businesses will need to develop compliance processes, which could include cookie banners and consent management tools to give users choice.

• Sensitive Data. Certain categories of data — including health information, precise geolocation, biometrics, race, sexual orientation, and immigration status — attract heightened legal obligations. Processing sensitive data often requires explicit consent or another narrow legal basis, and is subject to stricter security and retention requirements. The concept of sensitive data can extend to “inferences” about sensitive characteristics, even when the underlying data is not inherently sensitive, so businesses need to carefully analyze what data they collect and share.

• Consumer Rights. Most privacy laws grant individuals rights to access, correct, and delete their personal information within specified timelines. Failure to receive and respond to these requests can lead to complaints to regulators and investigations. A dedicated privacy inbox and a clear internal workflow are essential from the start.

• Vendor Management. A business can be liable for its vendors that accesses personal information on the business’s behalf. To protect personal information through the supply chain, businesses should work with established vendors and/or conduct reasonable privacy and security diligence of any vendors that access personal information. Vendors should also sign data processing agreements to commit to protect personal information to the business’s required standard.

• Other Key Compliance Issues. Businesses should pay special attention to activities that trigger heightened regulation. Key risk areas include:

  • Data brokerage: Companies that are in the business of selling personal information may fall within scope of data broker laws, which may require registration with regulators and heightened processes for managing consumer requests.

  • Data about kids and teens: Businesses that offer services to, or collect data from, kids and teens, may trigger additional requirements, in some instances, parental consent, age verification and age assurance mandates, and safety and content moderation protocols.

  • Cross-border data transfers: Data transfers are under increasing scrutiny as countries around the world consider data sovereignty mandates. EU restrictions are forcing businesses in certain regulated sectors to rethink supply chains that move critical data outside the EU. In the U.S., continuing tensions with China and other “countries of concern” has led to growing regulation of certain data transactions involving such countries.

  • Genetic and biometric data: Businesses that collect genetic or biometric data may become subject to laws imposing heightened consent, data security, and data retention standards.

CAN-SPAM (Emails)

The "Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003" or the "CAN-SPAM Act" is the United States' first federal legislation concerning unsolicited commercial email. The law requires unsolicited commercial email messages to be labeled (though not by a standard method) and to include opt-out instructions, as well as the sender's physical address. It also prohibits the use of deceptive subject lines and false headers in such messages.

Under the law, the Federal Trade Commission (FTC) is authorized (but not required) to establish a "do-not-email" registry. State laws that require labels on unsolicited commercial email or prohibit such messages entirely are pre-empted, although provisions merely addressing falsity and deception remain in place.

The bulk of the requirements of the CAN-SPAM Act apply only to "commercial electronic mail messages," defined as: "emails the primary purpose of which is the commercial advertisement or promotion of a commercial product or service." The legislation does not prohibit the transmission of most types of commercial email. It does, however, establish rules that will apply to entities that send commercial email messages.

Based upon the requirements of the CAN-SPAM Act, we offer the following recommendations to companies that wish to send commercial messages.

1. Do not engage in any fraudulent or deceptive activity when transmitting commercial email

   The CAN-SPAM Act prohibits a variety of fraudulent activity committed in connection with email. For instance, the legislation prohibits the falsification of header information in multiple commercial emails. Likewise, the law also prohibits the use of a protected computer to relay or retransmit multiple commercial emails, with the intent to deceive or mislead recipients, or any Internet access server, as to the origin of such messages. Penalties for violating the law's provisions regarding fraudulent activity are rather severe and can include fines, as well as imprisonment. When contracting with any third parties to send commercial emails on their behalf, companies should ensure that all such third parties are contractually bound to comply with the requirements of the CAN-SPAM Act and all other applicable legislation.

2. Implement a system for opting-out and honor opt-out requests

   The CAN-SPAM Act mandates the inclusion of a clear and conspicuous notice of the recipient's right to "opt-out" from receiving future commercial emails. It also requires the inclusion of a mechanism that may be used or an email address to which a recipient may send a message requesting not to receive any future commercial emails from the sender. Companies that receive opt-out requests must honor such requests and must cease the transmission of commercial emails to individuals who have opted-out within 10 business days of the sender's receipt of the opt-out request.

   Learn more about CAN-SPAM Act compliance: Read the FTC's Compliance Guide for Business

3. Comply with all applicable labeling requirements

   In addition to including language regarding the individual's right to opt-out of future transmissions of commercial emails, the CAN-SPAM Act mandates the inclusion of the following information on all commercial emails:

   • A legitimate return email and physical postal address;

   • A clear and conspicuous notice that the message is an advertisement or solicitation;

   • Clear notice in the subject heading if messages include pornographic or sexual content.

4. Be cautious when compiling mailing lists

   The CAN-SPAM Act also prohibits the harvesting of mail addresses, that is, acquiring email addresses through Internet chat rooms, blogs and other sources without the permission of the website or its members/users. Companies should be cautious about the methods used to collect email addresses. If obtaining email addresses from a list broker, it is very important to seek and obtain adequate warranties and indemnities regarding the data included in the lists from the list broker(s).

Exclusions

The recommendations above are applicable to unsolicited commercial email. They do not apply to any "transactional or relationship message," which is defined under the CAN-SPAM Act as any email message, the primary purpose of which is:

• To facilitate, complete or confirm a commercial transaction that the recipient has previously agreed to enter into with the sender;

• To provide warranty information, product recall information, or safety or security information with respect to a commercial product or service used or purchased by the recipient;

• To provide information with respect to a subscription, membership, account, loan or comparable ongoing commercial relationship involving the ongoing purchase or use of products or services offered by the sender to the recipient;

• To provide information directly related to an employment relationship or related benefit plan in which the recipient is currently involved, participating or enrolled; or

• To deliver goods or services, including product updates or upgrades, that the recipient is entitled to receive under the terms of a transaction that the recipient has previously agreed to enter into with the sender.

You should consult with an attorney if you have additional questions regarding anti-SPAM issues or any of the information contained herein.

TCPA & Mini-TCPA Laws

The Telephone Consumer Protection Act (TCPA) and similar state laws (so-called mini-TCPA laws) generally restrict certain calls and texts messages made to customers and potential customers for informational, marketing/promotional and other purposes without the customer’s prior express consent. These laws also require businesses to implement and maintain certain policies and practices before making certain calls and text messages for marketing purposes, including policies and practices to promptly record and honor do-not-call/do-not-text requests from customers and potential customers. Indeed, the driver for many TCPA/mini-TCPA lawsuits a company’s failure to honor a customer’s or potential do-not-call/do-not-text request. TCPA and mini-TCPA lawsuits are a favorite of the plaintiff’s class action bar because they come with substantial penalties -- $500 to $1500 (and sometimes more) for each violative call or text. To mitigate TCPA and mini-TCPA, we offer the following recommendations to companies that wish to make calls or text messages to customers and potential customers:

1. Obtain Express Written Consent Before You Call or Text

   For calls and texts messages made for certain purposes (e.g., marketing or informational), with certain technology, including artificial intelligence, or to numbers listed on a federal or state do not call list, the TCPA requires “prior express consent” from the customer or potential customer. The customer’s consent to calls or text messages must be clear and unambiguous and, in the case of calls or text for marketing purposes, must be obtained in writing or through the customer’s action in checking a disclosure box or confirming their agreement to a consent disclosure by clicking submission button. TCPA and mini-TCPA consent, particularly for marketing calls or text messages, cannot be secured through a customer’s agreement to consent contained as part of terms of service or a privacy policy. In addition, the TCPA requires specific language in a consent disclosure, including that the customer or potential customer understands and agrees that their consent to not required to purchase goods or services from the business.

2. Honor Opt-Outs Immediately and Maintain an Internal Do-Not-Call List

   Once a customer or potential customer opts out — e.g., by replying “STOP,” making a verbal request, or submitting a written request — you must cease contact immediately. Maintain a robust internal do-not-call list and synchronize it across all platforms, campaign tools, and third-party vendors on a regular basis.

3. Understand What Qualifies as a “Marketing” Call or Text Message

   The TCPA and many mini-TCPA laws require prior express written consent for marketing calls and texts. Marketing is broadly defined as a call or text whose purpose is to encourage the purchase of, rental of, investment in, property goods or services. A call or text that has dual purpose – informational and marketing – is considered a marketing call or text.

4. Understand What Technology is Covered by the TCPA and Mini-TCPA Laws

   In addition to restricting calls and text messages for marketing purposes to numbers listed on a federal or state do not call list without the customer or potential customer’s consent, the TCPA and many mini-TCPA laws also require consent for calls or text messages made with certain technology, including artificial intelligence, artificial voice, prerecorded message, an autodialer, an automatic telephone dialing system, or any other automated system for the selection and dialing of phone numbers.

5. Understand the Policies, Procedures and Training that Must be Implemented before Making Calls or Texts for Marketing Purposes

   The TCPA requires business to implement certain policies, procedures and training before making calls or text messages for marketing purposes. These include policies and training for recording and honor do-not-call/do-not-text requests, for maintaining and following an internal do-not-call list, and for developing and implementing a do not call policy that is available to customers and potential customers upon request.

6. Time-of-Day Restrictions and Calling Hours Apply

   The TCPA and FCC regulations generally restrict telemarketing calls and texts to the hours of 8:00 a.m. to 9:00 p.m. in the customer or potential customer’s local time zone. Violating time-of-day rules is an independent basis for liability and is often cited alongside consent failures in litigation. Automated systems must account for time zone differences when scheduling outbound campaigns.

7. You Are Responsible for Your Vendors’ Conduct

   Outsourcing calls or texts to a vendor does not insulate your business from liability. If a vendor makes non-compliant calls or messages on your behalf, you may be held liable under the TCPA or mini-TCPA laws. All vendor agreements should include TCPA and mini-TCPA compliance representations, indemnification provisions, and audit rights.

8. Document Consent Records, Opt-Outs, and Compliance Policies

   In TCPA and mini-TCPA litigation, the burden generally falls on the business to prove customer or potential customer consent to the challenged calls or texts and compliance with the TCPA or mini-TCPA laws at issue. Maintain records of how and when consent was obtained, including the specific language used, the platform, the timestamp, and the IP address where applicable. Retention of opt-out requests and compliance policies is equally important.

The TCPA and mini-TCPA laws are nuanced and change regularly. You should consult an attorney to evaluate your programs and compliance to mitigate non-compliance risk.

U.S. Sanctions Regimes: Office of Foreign Assets Control (OFAC)

CFIUS, the Outbound Investment Security Program, the DOJ’s Data Security Program, export controls, economic sanctions, import and customs, anti-corruption and other global trade laws and regulations should be carefully considered when setting up and operating your business if you:

• Export, re-export, transfer, or provide access to products, software, technology, or services from the United States to other countries (including making software available for download outside the United States) or to foreign nationals (wherever located)

• Engage in cross-border transactions, investments, joint ventures, or vendor or licensing arrangements involving companies that engage with export-controlled technology, critical infrastructure, or sensitive personal data

• Receive investment from, or transact with, non-U.S. persons (including LPs in funds) that may trigger obligations or mitigation under CFIUS, Outbound Investment Security Program, DOJ’s Data Security Program, and other national security regimes

It is important to understand how global trade laws affect your business from day one. The laws are complex, vigorously enforced, and may result in severe penalties and reputational damage. You should consult with an attorney to best understand these complex issues.

The U.S. Department of the Treasury's OFAC administers economic sanctions regulations, more commonly referred to as the "OFAC regulations" or "OFAC sanctions."

OFAC sanctions prohibit dealings with certain persons and entities (e.g., terrorists, drug traffickers, human rights violators, etc.); certain foreign countries and regions (including Cuba, Iran, North Korea, and the Crimea, Donetsk, and Luhansk regions of Ukraine, with Russia, Belarus, and Venezuela presenting significant risk for sanctions violations); and certain industry sectors or with certain governments or government officials. The Russia and Belarus sanctions regimes have expanded significantly since 2022 and cover a broad range of industries, financial institutions, and individuals.

OFAC sanctions apply to most direct and indirect transactions with these prohibited or restricted persons, entities, and jurisdictions. U.S. companies and persons, regardless of their location, cannot transact business with sanctioned persons, entities and jurisdictions without authorization. To comply with OFAC sanctions, companies should, at a minimum:

• Screen counterparties to any transactions against OFAC's list of "Specially Designated Nationals and "Blocked Persons". Publicly exposed APIs and third-party software products are available to facilitate these types of searches. Search OFAC's sanctions list here.

• Ensure that companies in which they invest are not conducting, and have not conducted, business with OFAC prohibited persons, entities or jurisdictions, unless in compliance with the regulations.

• Conduct diligence to assess compliance risk in dealings with Cuba, Iran, North Korea, Russia, Belarus, Venezuela, the Crimea, Donetsk, and Luhansk regions of Ukraine, and OFAC-sanctioned individuals and entities. Given the significant expansion of Russia and Belarus sanctions since 2022, companies should conduct heightened diligence on any dealings with Russian or Belarusian counterparties or touchpoints.

• Beware of tricky “facilitation” issues or “red flags,” such as providing assistance to non-U.S. persons or entities in trade with a prohibited individual, entity or jurisdiction or counterparties obfuscating their identities or locations.

Learn more about OFAC sanctions: Visit the OFAC website

U.S. Export Controls

U.S. export controls (other than the OFAC sanctions) are administered by the U.S. Department of Commerce's Bureau of Industry and Security (BIS), through the Export Administration Regulations (EAR), and by the Department of State's Directorate of Defense Trade Controls (DDTC), through the International Traffic in Arms Regulations (ITAR).

The EAR regulates the export and re-export of so-called "dual use" items and technology. The ITAR regulates the export and re-export of military items, services and technology. Releases of technology to foreign nationals, wherever located, and the provision of defense services are also subject to these regulatory regimes.

To comply with U.S. export controls, companies should consider carefully whether their products, technologies and services are controlled under the EAR and/or the ITAR, whether future modifications will bring a product within the scope of the EAR and/or ITAR, and whether controlled technology, including proprietary source code or certain genetic elements, may be accessed by foreign nationals.

The Commerce and State Departments also maintain lists of restricted parties to which exports can be prohibited or otherwise restricted. Counterparties can be screened against the full list of restricted parties (including those sanctioned by OFAC) here: Consolidated Screening List.

Export Administration Regulation (EAR): Visit the BIS website

International Traffic in Arms Regulations (ITAR): Visit the DDTC website

Committee on Foreign Investment in the United States (CFIUS)

CFIUS is an interagency committee charged with reviewing foreign investment in the United States for possible national security concerns. Companies (and investors in companies) whose products, technologies, or services are controlled by the ITAR and/or EAR, or that play important roles in protecting the U.S. national security, should be mindful of CFIUS. CFIUS’s jurisdiction was expanded 2018 to capture more types of transactions subject to review, including certain minority investments in U.S. businesses involved in critical technology, critical infrastructure, or sensitive personal data.

CFIUS can investigate any transaction that could result in foreign “control” (defined at low levels), or in access to certain sensitive information, in ways that adversely affect national security. Where deemed necessary, CFIUS may block transactions or require that control, access to information, or other national security concerns be mitigated.

CFIUS has also established a mandatory filing process for certain investments in U.S. businesses dealing in "critical technologies" and meeting other criteria. There is no minimum investment amount that triggers the mandatory filing obligation. Failure to submit a mandatory declaration when required by CFIUS can result in potentially significant penalties — up to the value of the transaction.

Learn more about CFIUS: Visit the Treasury Department's section on CFIUS

Outbound Investment Security Program (OISP)

Administered by the U.S. Department of the Treasury, the OISP prohibits or requires notification for certain U.S. investments in sensitive technology sectors in China, Hong Kong, and Macau. The program focuses on three core technology areas: semiconductors and microelectronics, quantum information technologies, and artificial intelligence. Unlike CFIUS, which reviews inbound investment into the United States, the OISP addresses risks that U.S. capital, expertise, and intangible benefits (such as managerial support or technical knowledge) could enhance the military, intelligence, or surveillance capabilities of strategic competitors. The OISP framework regulates: (1) prohibited transactions involving the most sensitive activities (e.g., advanced chip production or certain AI systems with military applications), and (2) notifiable transactions, where U.S. persons must report investments to the Treasury but are not outright barred.

The program can apply broadly to U.S. persons, including companies, funds, and individuals, covering equity investments, joint ventures, and certain projects that provide covered intangible benefits. For companies and investors, the OISP introduces a compliance layer requiring transaction screening and diligence on target activities. Civil and potential criminal penalties may be imposed for violations of the OISP.

With the passage of the Comprehensive Outbound Investment National Security Act of 2025 (COINS Act), the U.S. government anticipates expanding the OISP to cover transactions in additional countries (Russia, Iran, North Korea, Cuba, and Venezuela) and additional sectors (high-performance computing/supercomputing and hypersonic systems).

Learn more about the OISP: Visit the Treasury Department’s website on the OISP

Data Security Program (DSP)

The DSP is administered by the U.S. Department of Justice and prohibits or restricts certain transactions involving sensitive data with counterparties having a certain nexus to China, Hong Kong, Macau, Russia, Iran, Cuba, North Korea, or Venezuela. The rule targets transactions that could enable foreign adversaries to exploit Americans’ personal data for espionage, surveillance, or coercion purposes. The program defines “bulk U.S. sensitive personal data” and “government-related data” by volume thresholds and sensitivity (e.g., genomic and other ‘omic, health, geolocation, biometric, financial, and certain identifiers) and captures a wide range of data brokerage, vendor, employment, and investment arrangements that could provide foreign access. Some transactions are prohibited outright (e.g., non-passive investments in targets handling genomic data or data brokerage involving covered data), while others are restricted unless the U.S. party implements prescribed security requirements, such as access controls, data localization, and vendor due diligence.

The rule also creates exemptions and safe harbors for passive investments, certain financial services, telecommunications, clinical trials, and activities already authorized under other federal regimes, provided specified conditions are met. For companies, the DSP introduces a compliance framework akin to sanctions/export controls, requiring data mapping, counterparty screening, contractual controls, and technical safeguards to prevent unauthorized foreign access. Violations of the DSP can carry civil and potential criminal penalties.

Learn more about the DSP: Visit the Justice Department’s website on the DSP

Anti-Money Laundering and Terrorist Financing

U.S. criminal laws prohibit all U.S. persons from engaging in money laundering (attempts to transfer funds that are the proceeds of illegal activities and make them appear legitimate) and terrorist financing (providing support and resources to terrorists). Financial institutions are subject to various regulations adopted by the U.S. Treasury Department pursuant to the Bank Secrecy Act (“BSA”), as amended by the USA PATRIOT Act of 2001, but most prescriptive BSA regulations, such as those that require anti-money laundering programs and reporting of suspicious activity to the federal government, do not apply to companies that are not “financial institutions” as defined by the BSA. However, as fintech-bank partnerships are growing, non-financial institutions are increasingly required by contract to adopt anti-money laundering programs and conduct transaction monitoring that align with the financial institution partner’s policies and procedures. The recent blockchain and digital asset innovations also place emphasis on the role non-financial institutions play in ensuring the integrity of the U.S. financial system, causing many to establish and maintain a BSA-compliant compliance program even though it is not a legal requirement. Recent trend sees that anti-money laundering has become a crucial diligence area among investors and buyers.

Anti-Money Laundering Laws

Money laundering generally is defined as a transaction that seeks to conceal or disguise the proceeds of illegal activities so that they appear to have been derived from legitimate sources. Money laundering does not always involve cash transactions and may be conducted through entities that are not financial institutions. Money laundering can occur, for example, when a company operating as a front for a drug cartel purchases goods from a legitimate business (using drug proceeds) and then sells the goods to other legitimate business (thus washing the drug money clean).

Terrorist Financing Laws

Terrorist financing may not involve proceeds of criminal conduct but, instead, an attempt to provide material support or resources to terrorists or terrorist organizations. “Material support or resources” is a broad term that includes, among other things, currency or monetary instruments, expert advice or assistance, communications equipment, facilities, personnel or transportation.

Companies and their employees cannot engage in, or help others engage in, money laundering or terrorist activities, and may not willfully ignore such activities, whether internally, at a counterparty, or at a company in which the company invests. To limit exposure to possible anti-money laundering and terrorist financing issues, companies and their employees should be watchful for possible suspicious activity in connection with transactions and investments. To further evaluate situations in which money laundering or terrorist financing issues may be of concern, companies should:

• Conduct due diligence in connection with transactions and investments, particularly if they involve cash-intensive businesses

• Thoroughly investigate any rumors or bad reputations of the parties involved in a transaction or investment

• Thoroughly assess any and all unexplained payments and cash flows

• Adopt a risk-based compliance program tailored to the company’s profile, and conduct employee training to ensure the foregoing is properly executed.

The Foreign Corrupt Practices Act (FCPA)

The FCPA deals with bribery of government, political party and international organization officials. The FCPA anti-bribery provisions prohibit the payment (or offer, authorization or promise to pay) of "anything of value," whether directly or indirectly, to any foreign government official, foreign political party, official of a foreign political party, or foreign political candidate, in order to get the recipient to act in obtaining, retaining or directing business or securing an improper advantage.

There are certain narrow exceptions to the FCPA. For example, a U.S. person may be able to reimburse a foreign official for reasonable and bona fide expenditures incurred, such as travel or lodging, that are directly related to business promotion or execution of a contract with a foreign government.

Learn more about the FCPA: Visit the Department of Justice's section on FCPA

The FCPA books and records provisions impose recordkeeping and internal controls requirements on companies that are "issuers" of public securities and subject to Securities and Exchange Commission (“SEC”) jurisdiction. These companies must: maintain books, records and accounts that accurately and fairly reflect the company's transactions; and maintain internal controls to assure that the company's management controls the use of business assets.

To address potential FCPA issues, a company should consider adopting an FCPA compliance program tailored to the company's risk profile. Companies should also consider requiring foreign counterparties and agents to make representations regarding FCPA compliance or to adopt FCPA compliance programs.

Coworking & Flexible Workspace

One of the first operational decisions a new company faces is where — and how — to establish a physical presence. For most early-stage startups, this means a coworking membership or a virtual office address long before it means a traditional lease. Understanding the legal and practical differences between these options helps founders avoid unnecessary risk and cost at each stage of growth.

Coworking spaces — offered by providers such as WeWork, Industrious, Regus, and many local operators — remain a common starting point for most seed and early Series A companies. They offer month-to-month flexibility, minimal upfront commitment, and built-in amenities that would be impractical for a small team to replicate independently.

While coworking arrangements are simpler to enter than traditional leases, they carry their own legal and operational risks that founders should understand before signing up.

Membership Agreements vs. Leases

A co-working membership agreement is a services contract, not a traditional commercial lease. This distinction has significant practical implications:

• Fewer tenant protections: Most co-working agreements are drafted heavily in favor of the operator and can be terminated on short notice. Unlike a traditional lease, you generally do not receive the same possessory rights or statutory tenant protections that a tenant would have under a traditional commercial lease. In addition, most operators are unwilling to make significant revisions to their standard forms.

• No SNDA protection: In a traditional lease, tenants may be able to negotiate an SNDA with the building’s lender, which protects the tenant’s right to occupy the space even if the landlord defaults on its mortgage. Coworking members have no equivalent protection.

• Limited recourse: If the co-working operator closes, relocates, or significantly changes the terms of service, your remedies are typically limited to what the membership agreement provides — which is often very little.

• Deposits: Security deposits paid to co-working operators are unsecured claims against the operator. If the operator becomes insolvent, recovery of the deposit may be difficult or impossible.

• Relocation: Note that operators generally have broad rights to relocate you to other space in a building or even into other buildings used by the operator.

What to Review Before Signing

Before entering a co-working membership agreement, companies should review the following:

• Termination provisions: How much notice does the operator need to give to terminate or relocate your membership? What notice do you need to give to exit? Are there penalties for early termination?

• Price escalation: Many agreements allow the operator to increase membership fees on relatively short notice. Understand any caps or limitations on price increases.

• Exclusivity and use restrictions: Some agreements limit what types of activities can be conducted from the space, which can be relevant for companies in regulated industries or those receiving clients on-site.

• Guest and visitor policies: Understand the rules around bringing clients, contractors, or visitors into the space. Some operators restrict access or require advance registration.

• Data and network security: Shared network infrastructure in co-working environments is a meaningful security risk. Companies handling sensitive customer data, health information, or financial data should use a VPN at all times and consider whether a dedicated, private office within the co-working facility is more appropriate than an open floor plan.

• Mail and package handling: Confirm what address you are permitted to use for legal and regulatory filings, and whether the operator handles mail reliably.

Insurance in Co-working Spaces

Standard commercial general liability policies and renter’s policies may not automatically cover co-working arrangements. Companies should confirm with their insurance broker that their coverage extends to co-working locations and that they are not relying solely on the operator’s policy, which is designed to protect the operator, not the members.

When to Move to Traditional Leased Space

Co-working is well-suited for companies in their earliest stages, but it has meaningful limitations as a company scales. Companies typically consider transitioning to a traditional lease when:

• Headcount makes per-desk co-working costs comparable to or greater than a direct lease

• Client-facing operations require a more controlled, professional environment

• Security or confidentiality requirements make shared infrastructure impractical

• Investor or regulatory expectations require a more formal, stable address

• The company wants the ability to customize its space, install specialized equipment, or establish a distinct physical brand presence

When that transition is appropriate, the considerations set out in the traditional lease section below become directly relevant.

Virtual Offices

A virtual office provides a company with a professional business address, mail handling services, and typically access to on-demand meeting room time — without dedicated physical workspace. For fully remote companies, solo founders, or companies operating from home, a virtual office can provide an important layer of operational and legal credibility.

Why a Business Address Matters

Even a company with no physical office needs a registered business address for several practical reasons:

• State and regulatory filings: The company’s registered agent and principal office address must be maintained with the state of incorporation and any states where the company is qualified to do business.

• Banking: Banks generally require a physical business address and may have restrictions on P.O. boxes, mail drops, or certain virtual office addresses.

• Contracts and vendor relationships: Many counterparties expect a non-residential business address.

• Professional credibility: A business address in a recognized commercial district can matter to prospective customers, partners, and employees, particularly in the early stages when the company is building credibility.

• Privacy: Using a home address for business filings and contracts creates a public record of the founder’s residential address, which many founders prefer to avoid.

Common Virtual Office Providers

Virtual office services are offered by many co-working operators (WeWork, Regus, Industrious) as standalone products, as well as by dedicated virtual office providers. Services typically include:

• A street address (not a P.O. box) for use on business filings, correspondence, and marketing materials

• Mail receipt, scanning, and forwarding

• A phone answering service or local phone number, in some cases

• Access to meeting rooms and day offices on an as-needed, hourly basis

Legal and Practical Considerations

Virtual offices are straightforward but a few issues are worth noting:

• Delaware Corporations: While virtual offices offer a cost-effective alternative to traditional office space, businesses must be aware of key legal limitations — particularly in Delaware, where the Secretary of State does not recognize a virtual office as a valid principal place of business. Businesses considering virtual office arrangements should consult with legal counsel to ensure their registered address and principal place of business meet applicable state requirements.

• Registered agent vs. business address: A virtual office address is typically used as the company’s principal place of business address. It is generally separate from the company’s registered agent address, which is used for service of process. Many companies use a professional registered agent service (such as CT Corporation or CSC) for the registered agent function and a virtual office for their general business address.

• State tax nexus: A virtual office address alone may not create tax nexus in every case, but nexus rules vary by state and can depend on economic activity, employees, available workspace, sales volume, and other contacts with the state.

• Mail reliability: The quality of mail handling services varies significantly by provider. Before relying on a virtual office for important legal and regulatory correspondence, test the service and confirm that mail is reliably received and forwarded on a timely basis.

• Meeting room access: If the company plans to meet with clients or investors using the virtual office’s on-demand meeting rooms, confirm availability, booking procedures, and any applicable usage limits or overage charges under the agreement.

Signing a Lease

One of the first things a new company needs is good space. Here are the top considerations you should review before signing a lease:

Is a written lease necessary?

A landlord will or should be very reluctant to allow occupancy of space without a written lease because of the need for assurance that certain essential responsibilities will be fulfilled. The landlord will want to be certain that you carry appropriate insurance; maintain the premises in good condition and comply with laws; and that effective remedies are available if you default.

A written lease also benefits you as the tenant and insures you a stated term of occupancy and identifies the services the landlord will be obligated to provide to you.

Without a lease, terms and conditions, and rights and responsibilities are more likely to be uncertain or unclear, which could easily lead to disputes and liability.

Is a verbal lease agreement binding?

Generally, a verbal lease agreement is considered legal and binding for a term of less than one year. However, it is highly recommended to get a written letter of agreement as this protects both the landlord and the tenant.

Who signs the lease first?

Typically, landlords require that the prospective tenant signs the agreement first.

What is the purpose of a letter of intent?

A letter of intent is a written memo or letter that outlines the basic business terms agreed upon by the landlord and prospective tenant. The letter of intent should expressly state that it is non-binding since it oversimplifies what can typically be fairly complex terms and conditions to be more particularly spelled out in the lease document. The letter of intent is the roadmap for the lease negotiation.

However, the one thing that you may wish to make binding in a letter of intent is that the landlord commits to negotiate exclusively with you for a set period of time.

Are you dealing with the "real" landlord?

Ask who owns the building and get clarification on the authority of the person with whom you are dealing. A landlord sometimes is required to obtain consent from its mortgage lender(s) before entering into a lease. You should ask about any such contingencies and obtain evidence that any needed consent was obtained.

When you have negotiating power or are investing significant money in improvements to the premises, you should require that the landlord obtain an agreement (typically referred to as an SNDA) from its mortgage lender to honor the lease even if the landlord fails to perform its obligations to the lender and the mortgage is foreclosed.

Who will be occupying the premises?

Leases typically allow only the named tenant entity and its employees to use and occupy the premises, so if other entities such as subsidiaries or business partners are to use the space, the lease should reflect this.

Typically a lease will restrict the tenant from assigning the lease or subletting the premises to another party. It is important to negotiate some flexibility in your lease and require that the Landlord agree to act reasonably in considering a request for consent to assign the lease and/or sublease the premises.

What are the premises?

The premises being leased should be accurately described in the lease, including rights to use common areas and building amenity spaces. Be sure to refer to the building address, the floor and relevant suite numbers, and if possible, attach a floor plan showing the leased premises as an exhibit to the lease. If any amenity areas were a driving force in selecting a particular building, make sure the landlord is obligated to maintain them throughout your lease term.

Whenever possible, you should delete any right of the landlord to relocate your leased premises to an alternative location in the building or, at the very least, negotiate reasonable safeguards and parameters. Relocations can be very disruptive to your business.

Is your use of the leased property limited?

Unless limited by an express clause, you may use the leased premises for any lawful purposes. However, a clause stating that the contemplated use of the premises is for a particular narrow use will tie your hands unnecessarily and inappropriately.

If you have special use needs (vivarium, special electrical requirements, supplemental HVAC), the lease must specifically address them. Large gathering spaces in your premises may require a public assembly permit.

Even where permitted under a lease, any intended use must also be permitted by applicable zoning laws. An inability to use the premises for the intended use because of zoning restrictions will not forgive the tenant's obligations under the lease, including the obligation to pay rent.

What privileges and services are you entitled to?

The lease should define your access rights (such as 24 hrs x 7 days), utilities, parking rights and describe any rights to use common areas and/or other amenities, including driveways, parking, shared conference rooms, cafeteria, gym, etc.

Any rights to signage, elevator usage and additional services, such as air conditioning after normal building business hours, and at what cost, need to be well understood.

What happens to the lease if I enter into a business transaction such as a merger or other change in control?

Be careful of provisions that indicate that a direct or indirect transfer of a controlling interest in the tenant constitutes an "assignment" of the Lease. Instead, the lease should contain a safe harbor that provides that transactions made in the ordinary course of business to finance, sell or reorganize your company will not require the prior consent of the Landlord so long as the successor entity does not have a lesser net worth or financial strength. In addition, assignments or subleases to an affiliated entity should not require landlord consent.

Who prepares the premises for occupancy?

Is the space ready for immediate occupancy, or is there a current occupant? Will decommissioning, cosmetic improvements or alterations be required? If you expect the landlord to undertake or be responsible for the fulfillment of any conditions associated with the condition of the premises, then be sure this is stated in the letter of intent and the lease and that your rental obligations and commencement of legal liability for the premises do not occur before the work is done and the premises turned over to you.

Timing is important especially if you are relocating from another leased premises where you may be at risk of being a holdover with a significant penalty rent.

In what condition is the premises to be surrendered?

You should be careful not to assume responsibility for removing alterations that were made to accommodate your occupancy.

If you wish to remove fixtures and equipment that you have added to the building at the expiration of your lease, you should clearly set forth what items you intend to remove, because otherwise the items may become the landlord's property upon lease expiration.