A commercial decision executed through law — entity, privacy, sector regulation, tax and contracts sequenced into one structure that holds.
The entity decides the tax position. The tax position shapes the intercompany flow. The data footprint decides the privacy and HIPAA build. The sector decides the FDA, DEA and DSCSA path. The contracts are what US counterparts and regulators actually read. We do not parcel these into silos. We write them as one document set.
Delaware C-Corp · LLC · EIN · Registered Agent · Qualification
Selection and formation of the right vehicle, Delaware or home-state incorporation, certificate of incorporation and bylaws or LLC operating agreement, EIN, registered agent, foreign qualification in every operating state, and a clean founder and investor cap table.
Request this workstreamCCPA · CPRA · VCDPA · CPA · State Privacy Laws
Data-flow mapping, applicability analysis across California, Virginia, Colorado, Connecticut, Utah, Texas and beyond, privacy policies, consumer-rights and opt-out mechanics, Data Processing Addenda, and cross-border transfer architecture from an Indian or global parent.
Request this workstreamCovered Entity · Business Associate · BAA · Security Rule
Covered Entity and Business Associate analysis, Business Associate Agreements, Privacy Rule, Security Rule risk analysis and safeguards, Breach Notification Rule readiness, and the governance a digital-health or health-data business needs before it touches protected health information.
Request this workstreamFDA · DEA · DSCSA · State Boards of Pharmacy
FDA establishment registration, listing and the correct premarket pathway under the Federal Food, Drug, and Cosmetic Act, DEA registration under the Controlled Substances Act, DSCSA package-level track-and-trace, state Board of Pharmacy licensing and Ryan Haight Act online-dispensing counsel.
Request this workstreamMSA · SaaS · DPA · Employment · IP Assignment · NDA
The Day-1 contract stack written to US law: Master Services Agreements and Terms of Service, SaaS and licensing agreements, Data Processing Addenda, at-will employment offer letters with proper classification and I-9, independent contractor and IP assignment terms, and NDAs.
Request this workstreamFederal & State Tax · Wayfair Nexus · DTAA · CFIUS
Federal and state corporate tax position, sales-tax nexus mapping after Wayfair, treaty and withholding planning under the India-US DTAA, transfer pricing under Section 482, and CFIUS national-security screening for sensitive acquisitions and investments.
Request this workstreamSix stages. Each hands clean inputs to the next. Activity mapping decides the entity. The entity shapes tax and nexus. The data footprint shapes privacy and HIPAA. The sector shapes FDA, DEA and DSCSA. Everything lands in the contract stack. Nothing is retrofitted.
Identify the precise activities the US business will perform, map them to the relevant federal and state regulators, and read each activity through the TCL Framework so entity, privacy, sector and tax decisions are made together, not in silos.
Choose between a Delaware C-Corporation, a home-state corporation and an LLC based on the investor base, revenue model, owner tax residency and repatriation plan, and select the state of formation and the states requiring qualification.
Incorporate, adopt bylaws or an operating agreement, appoint a registered agent, obtain the EIN from the IRS, complete foreign qualification in each operating state, and open the US bank account through to first capital infusion.
Stand up the sector obligations: HIPAA for health data, FDA, DEA and DSCSA for drugs, devices and controlled substances, and CCPA, CPRA and state privacy-law compliance mapped to the data footprint.
Set the federal and state corporate tax position, map sales-tax nexus after Wayfair, build treaty and withholding planning under the India-US DTAA, document transfer pricing under Section 482, and screen for CFIUS where applicable.
Put the contract stack in place: MSA and Terms of Service, SaaS and DPA, at-will employment and contractor agreements, IP assignment, the published privacy policy, and the governing-law and dispute-resolution architecture.
A tax position that is not technically defensible is theatre. A privacy build that is not engineered into the product cannot survive a state Attorney General. A HIPAA posture that lives in a policy document and not in the system is not a posture. Our framework reads every US entry decision under all three lenses, simultaneously.
Short, direct, on the record.
It depends on the investor profile, the tax residency of the owners, the repatriation plan and the states of operation. A Delaware C-Corporation is the default for venture-backed and most foreign-owned operating businesses: investors and acquirers understand it, it cleanly separates ownership from operations, and it contains US tax at the entity level so a foreign parent is not exposed to flow-through US tax. A Limited Liability Company suits closely held or single-owner operations and offers pass-through taxation, but foreign owners cannot elect S-Corporation status. We do not start with the form. We start with the activity, the revenue model, the investor base, the data footprint and the tax position, and the form is the output.
There is no single federal omnibus privacy statute in the United States, so privacy compliance is a state-by-state analysis. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to a for-profit business that does business in California and meets at least one threshold: more than USD 26.625 million in annual gross revenue (an inflation-adjusted figure, originally USD 25 million), buying selling or sharing the personal information of 100,000 or more California consumers or households, or deriving 50 percent or more of annual revenue from selling or sharing personal information. Comparable comprehensive laws are now in force in Virginia, Colorado, Connecticut, Utah, Texas and a growing list of other states, each with its own thresholds, consumer rights and opt-out mechanics. We map your data flows once and build to the strictest applicable standard so you are not re-papering privacy state by state.
The Health Insurance Portability and Accountability Act applies if you are a Covered Entity (a health plan, a healthcare clearinghouse, or a healthcare provider that transmits health information electronically) or a Business Associate that creates, receives, maintains or transmits protected health information on behalf of a Covered Entity. Since the HITECH Act, Business Associates carry direct liability and must sign a Business Associate Agreement. Compliance means the Privacy Rule (permitted uses and disclosures of protected health information), the Security Rule (administrative, physical and technical safeguards for electronic protected health information, documented through a risk analysis), and the Breach Notification Rule, under which breaches must be notified without unreasonable delay and no later than 60 days. Enforcement sits with the HHS Office for Civil Rights.
Drug, biologic and medical-device businesses are regulated by the US Food and Drug Administration under the Federal Food, Drug, and Cosmetic Act, including establishment registration and product listing, the correct premarket pathway (a New Drug Application, an Abbreviated New Drug Application, a Biologics License Application, or device clearance or approval), and current Good Manufacturing Practice. Any business handling controlled substances must register with the Drug Enforcement Administration under the Controlled Substances Act. The Drug Supply Chain Security Act requires interoperable, package-level electronic track-and-trace across the pharmaceutical distribution chain; the one-year stabilization period ended on 27 November 2024, with a limited small-dispenser exemption running to November 2026. Pharmacies are additionally licensed by each state Board of Pharmacy, and online dispensing engages the Ryan Haight Act.
The federal corporate income tax rate is a flat 21 percent since the 2017 reform, layered with state corporate income or franchise taxes that vary by state. Cross-border payments to the foreign parent (dividends, interest, royalties, fees) attract US withholding tax, reduced where a treaty applies; the India-United States Double Taxation Avoidance Agreement is the relevant instrument for Indian parents. Intra-group pricing must satisfy the arms-length standard under Section 482 of the Internal Revenue Code. The most common and most expensive surprise is sales-tax nexus: after South Dakota v. Wayfair (2018), a business can trigger a sales-tax collection obligation in a state through economic activity alone, with no physical presence, once it crosses the revenue or transaction threshold of that state. The architecture has to be decided before the first invoice, not after the first assessment.
A formation service files incorporation paperwork. An accountant handles bookkeeping and tax computation. AMLEGALS engineers the legal architecture those filings and computations sit on, read through the TCL Framework™: the Technical seam (data residency, HIPAA and privacy-by-design, IP ownership, systems), the Commercial seam (revenue model, intercompany pricing, repatriation, exit mechanics) and the Legal seam (entity law, CCPA/CPRA and state privacy, FDA/DEA/DSCSA, tax and CFIUS, contracts). We write a single structure that holds under a regulator reading, a diligence team reading and a future acquirer reading, all at once.
Teams arrive expecting one statute to comply with. There is none at the federal level. There is a fast-growing patchwork of state laws, each with its own thresholds and rights. Build to the strictest once, or re-paper privacy forever.
HIPAA liability reaches the technology company that merely processes protected health information for a Covered Entity. The Business Associate Agreement is not paperwork. It is the instrument that defines your direct exposure.
Economic nexus turned every state line into a potential tax obligation. A SaaS or e-commerce business can cross a dozen thresholds in its first year without a single US employee. The map has to be drawn before the first invoice.
The earliest mandate is the most valuable mandate. Entity, state, tax posture and data architecture are decided long before incorporation.
AMLEGALS
Most foreign-owned operating or venture-backed businesses incorporate as a Delaware C-Corporation, which investors and acquirers understand and which contains US tax at the entity level. A Limited Liability Company (LLC) suits closely held or single-owner operations and offers pass-through taxation, though foreign owners cannot elect S-Corporation status. The choice turns on the investor profile, the tax residency of the owners, the repatriation plan and the states of operation. Every US entity needs a registered agent in its state of formation, an Employer Identification Number (EIN) from the IRS, and foreign qualification in each additional state where it does business.
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), applies to a for-profit business that does business in California and meets at least one threshold: more than USD 26.625 million in annual gross revenue (an inflation-adjusted figure, originally USD 25 million), buying selling or sharing the personal information of 100,000 or more California consumers or households, or deriving 50 percent or more of annual revenue from selling or sharing personal information. There is no single federal privacy statute, so coverage is a state-by-state analysis across California, Virginia, Colorado, Connecticut, Utah, Texas and a growing list of other states.
The Health Insurance Portability and Accountability Act (HIPAA) applies if you are a Covered Entity (a health plan, a healthcare clearinghouse, or a healthcare provider that transmits health information electronically) or a Business Associate that creates, receives, maintains or transmits protected health information on behalf of a Covered Entity. Business Associates carry direct liability under the HITECH Act and must sign a Business Associate Agreement. The Privacy Rule, the Security Rule and the Breach Notification Rule all apply, and breaches must be notified without unreasonable delay and no later than 60 days.
Drug and medical-device businesses are regulated by the US Food and Drug Administration (FDA) under the Federal Food, Drug, and Cosmetic Act, covering establishment registration, product listing, premarket approval or clearance, and current Good Manufacturing Practice. Businesses handling controlled substances must register with the Drug Enforcement Administration (DEA) under the Controlled Substances Act. The Drug Supply Chain Security Act (DSCSA) requires interoperable, package-level electronic track-and-trace across the distribution chain, with the one-year stabilization period having ended on 27 November 2024. Pharmacies are separately licensed by each state Board of Pharmacy.
A defensible US launch stands on a compact set of agreements written to US law: a Master Services Agreement or Terms of Service, a SaaS or software licence agreement, a Data Processing Addendum mapped to the CCPA, CPRA and other state laws, employment offer letters reflecting at-will employment with proper worker classification and I-9 verification, independent contractor agreements, IP assignment and work-made-for-hire terms, mutual and one-way NDAs, and a commercial lease where there is a physical footprint. Each is governed by a chosen US state law with a matching dispute-resolution clause.