# COMPLIANCE-TODO — get professional review before going live

This platform touches regulated agricultural marketing, tax documents, and payments.
None of the below is legal advice; every item needs a lawyer/CA sign-off.

## APMC / state marketing law
- [ ] Operating an e-auction inside a regulated mandi generally requires authorisation under the
      state APMC Act (Tamil Nadu: TN Agricultural Produce Marketing (Regulation) Act) or the state's
      e-trading rules. Confirm licence class for the *platform*, per mandi.
- [ ] Trader licence validation is modelled (unified/state or per-mandi) but licence *numbers are not
      verified against any registry* — integrate with the state DB or make admins verify manually.
- [ ] Market fee & cess rates are seeded as placeholders (1.00% / 0.50%). Use the actual notified
      rates per commodity per mandi; some commodities are exempt.
- [ ] Commission agent fee caps vary by state and commodity; 2% seed value is an invented default.

## Documents generated by print.php
- [ ] **E-agreement**: format, mandatory clauses, and whether e-sign (Aadhaar eSign / DSC) or stamp
      duty applies in your state — the current SHA-256 hash + verify URL is an integrity aid, not a
      legally recognised signature.
- [ ] **Tax invoice**: GST fields are minimal (HSN, GSTIN when present). A CA must confirm invoice
      series, place-of-supply, RCM applicability for agri produce (many items are GST-exempt but the
      *platform fee* is taxable — currently modelled at 18% on platform fee only), and e-invoicing
      thresholds.
- [ ] Gate pass formats are often prescribed by the market committee — match the official layout.

## Payments & money handling
- [ ] The included gateway is a MOCK. Real collection needs a PA/PG-licensed provider; **holding
      buyer money and paying farmers out later is escrow-like and may require a nodal/escrow account
      structure** under RBI PA/PG guidelines — do not route funds through your own current account.
- [ ] Settlement timing promises (T0/T1/T2) must match what the payout rails actually deliver.
- [ ] Refund flows on disputes: RBI timelines apply.

## Data protection (DPDP Act 2023)
- [ ] Consent notices for farmers/traders (Tamil + English), purpose limitation, retention policy.
- [ ] KYC documents (when you build upload) are sensitive — encrypt at rest, restrict access, log access.
- [ ] Photos may embed GPS EXIF; stripping requires GD (see README gap #6).
- [ ] OTP/SMS provider DPAs; audit_log contains IPs — include in privacy notice.

## Platform conduct
- [ ] Shill-bidding controls here are heuristics (same-farmer/agent hard block, same-IP soft flag) —
      the market committee may prescribe specific surveillance/reporting duties.
- [ ] Retraction and auction-cancellation rules should mirror the mandi's bylaws; both are
      configurable but defaults are invented.
- [ ] Grievance officer + escalation timelines if operating at scale (Consumer Protection
      (E-Commerce) Rules may or may not apply to B2B mandi trades — get an opinion).

## Accessibility & language
- [ ] Tamil translations were machine-assisted — have a native speaker review every farmer-facing string.
- [ ] Statutory documents may be required bilingually.