Scope and purpose

Principal statutes and regulatory bodies

Choosing a legal form

• Private limited company (most common for seeking outside investment;
• Sole proprietorship or partnership (used for early-stage operations or very small teams);
• Branch or liaison office of a foreign entity (subject to additional regulatory requirements).

Registration and initial administrative steps

1. Reserve a company name and prepare constitutional documents for filing with the RJSC (articles of association and memorandum, where applicable).
2. Complete company incorporation with the RJSC and obtain the certificate of incorporation.
3. Obtain a trade licence or municipal permit from the relevant local authority where a physical office is maintained.
4. Register for tax: apply for a Tax Identification Number (TIN) and, where applicable, VAT registration through the NBR and local tax offices.
5. Open corporate bank accounts after completing the bank’s due diligence and KYC procedures.
6. Put in place basic internal policies (employment/contracts, confidentiality, IP assignment) and, where appropriate, data-protection and information-security policies.

Tax registration and ongoing tax compliance

• Income recognition and expense deductibility for the business model;
• VAT registration thresholds and invoicing requirements if supplies of goods or services are VATable;
• Withholding obligations on payments to employees and service providers; and
• Transfer pricing documentation where cross-border transactions with related parties occur.

Intellectual property: securing and preserving rights

• Copyright in software code, databases, documentation and original content;
• Trade marks identifying brand names, logos and slogans;
• Patentable inventions (where a technical invention meets legal patentability criteria); and
• Design rights relating to product appearance.

Employment and contractor arrangements

• Drafting employment agreements that reflect salary, benefits, leave, confidentiality, post-termination restrictions and statutory obligations;
• Classifying workers consistently with labour and tax laws to avoid misclassification risk;
• Ensuring statutory social security, provident fund or other contributions are addressed where applicable;
• Preparing policies on workplace safety, anti-harassment, and leave entitlements.

Data protection and cybersecurity

• Mapping data flows and maintaining inventories of personal data processed;
• Implementing technical and organisational measures proportionate to the risks (access controls, encryption, backups, incident response plans);
• Drafting privacy notices for end users and data-processing clauses with vendors; and
• Preparing an incident response plan and assessing breach-notification obligations to customers or authorities.

Fundraising, securities and corporate governance

• Choice of share class, shareholder rights and protective provisions;
• Shareholders’ agreements covering transfer restrictions, drag-along/tag-along rights, anti-dilution and governance;
• Compliance with securities law if a public offering or an offer to the public is contemplated; and
• Board composition, minutes and statutory filings after funding rounds.

Commercial contracts and procurement

• Limitation of liability clauses calibrated to risk and market norms;
• Warranties and disclaimers appropriate for the product or service;
• Service-level agreements (SLAs) for cloud services, hosting and uptime guarantees;
• Indemnities covering third-party claims, IP infringement and data breaches; and
• Termination provisions to permit orderly wind-down or disengagement.

Common compliance pitfalls

• Failing to document IP ownership and relying on informal understandings with co-founders or contractors;
• Neglecting basic bookkeeping and tax filings, which creates future compliance costs and potential penalties;
• Misclassifying workers as independent contractors where labour law would consider them employees;
• Using third-party code without checking open-source licence compatibility; and
• Underestimating data-protection and cybersecurity requirements for customer data.

2026 update

• Policy initiatives aimed at supporting entrepreneurship, which may include sector-specific incentives or programmes announced by government agencies; such programmes often have eligibility requirements and time limits and should be confirmed with the issuing authority.
• Continued attention to data-protection, digital-security and cyber-resilience measures. Startups that process sensitive data should track relevant regulatory guidance and sectoral rules.
• Ongoing reform of intellectual property administration and practice in the region; IP owners should monitor filing requirements and international filing options for cross-border protection.

Procedural checklist for founders

1. Decide business form and complete incorporation filings with the RJSC.
2. Open a corporate bank account and secure appropriate KYC documents.
3. Apply for TIN and VAT registration as required with the NBR (https://nbr.gov.bd).
4. Put in writing co-founder roles, equity allocations, vesting schedules and dispute-resolution mechanisms.
5. Obtain written IP assignment from founders, employees and contractors covering inventions, code and brand material.
6. Implement basic accounting and payroll systems to meet tax and reporting obligations.
7. Draft core commercial agreements (customer terms, supplier terms, NDAs) and ensure data-processing clauses where personal data is involved.
8. Assess insurance needs (professional indemnity, cyber insurance, directors’ and officers’ cover) and obtain quotations as appropriate.

When to obtain legal or tax advice

• Before finalising founder equity split and vesting arrangements;
• When preparing investor term-sheets or negotiating share-sale/preference terms;
• Prior to engaging cross-border service providers or transferring personal data across borders;
• When a product involves regulated activities (payments, health, telecoms, education); and
• Where the business contemplates public offerings or complex securities structures.

Practical examples of documentation

• Articles of association and statutory registers;
• Shareholders’ agreements and subscription agreements;
• Employment contracts and contractor engagement letters with clear IP assignment clauses;
• Non-disclosure agreements (NDAs) for sensitive disclosures;
• Standard customer terms and conditions and privacy notices; and
• Data-processing agreements with cloud providers and third-party processors.

Sectoral considerations and licences

• Payments, remittance and fintech activities (licences and central-bank oversight may apply);
• Telecommunications and broadcasting (licensing and spectrum-related authorisations may be required);
• Health-tech handling protected health information (additional privacy and professional-regulation obligations may apply); and
• Educational technology integrated with formal institutions (accreditation or education-sector regulation may be relevant).

Cross-border operations

• Foreign exchange and inward-investment approvals that may apply to capital inflows;
• Withholding tax and double-taxation issues on cross-border payments;
• Local presence requirements and the legal treatment of remote employees or contractors; and
• IP protection strategy in target jurisdictions (national registrations, the Madrid system for trade marks, or the PCT for patents where relevant).

Disputes and enforcement considerations

• Including dispute-resolution clauses that specify governing law, jurisdiction or arbitration procedures;
• Keeping contemporaneous records of decisions, board minutes and material agreements; and
• Considering alternative dispute resolution (ADR) where commercial relationships benefit from confidentiality and speed.

Resources and official contacts

How TRW Law Firm can assist (practice links)

Five practical FAQs

Next steps and recommended priorities for founders

Conclusion