Compliance check

Compliance Check — Bangladesh Regulatory Landscape

Config gate: regulatory footprint in plugin config. Read references/statute-index.md, references/regulators.md, references/currency-watch.md — this plugin sits on the most volatile law in the marketplace; every check starts by noting the currency-watch verification date and recommending /bd-law-watch:update-check if > 30 days old.

The sweep (apply each domain; mark N/A with a reason, never silently skip)

1. Cyber — Cyber Security Ordinance 2025 (Ord. 25 of 2025). History matters: it replaced the CSA 2023, which replaced the DSA 2018, which repealed ICT Act s.57. (There is no "s.66A" in Bangladesh law — that's India's IT Act.) Check: CII designation exposure, incident-response duties to the National Cyber Security Agency, content-liability posture for platforms (speech offences narrowed and bailable under the 2025 Ordinance), digital forensics/preservation duties. Ordinance-era flag: Art. 93 ratification status [verify].
2. Data — Personal Data Protection Act 2026 (successor to PDP Ordinance 2025 as amended). Role (fiduciary/processor), lawful basis & consent architecture, data classification (public/internal/confidential/restricted), localisation for restricted data & CII-linked data (synchronized in-country copy), cross-border transfer conditions, children's data prohibitions, breach duties, NDMA registration/CDO — noting deferred-commencement sections [verify commencement notifications]. Fines up to 5% of turnover make this board-level.
3. AML/CFT — MLPA 2012 + AT Act 2009 + BFIU circulars. Reporting-entity status; if yes: KYC/CDD program, STR/CTR mechanics, sanctions screening; if no: counterparty AML exposure and bank-onboarding friction.
4. FX — FERA 1947 + GFET. Inbound investment reporting, outbound payment permission classes, offshore accounts (Offshore Banking Act 2024 where relevant), profit/dividend repatriation mechanics.
5. Environment — ECA 1995 + ECR 2023. ECC category (Green/Yellow/Orange/Red), EIA/IEE requirement, renewal cadence, DoE inspection exposure. (The old 1997 Rules are gone — cite ECR 2023.)
6. Anti-corruption — PCA 1947, Penal Code ss.161–165A, ACC Act 2004. Government touchpoints, agent/intermediary risk, gifts-and-hospitality posture, procurement overlay (PPA 2006/PPR 2008) where bidding.
7. Labour-safety (if operational footprint): DIFE licensing, safety committees, building/fire certification — route detail to bd-employment-legal.
8. Sector licences: BTRC (telecom/ISP), BB (fintech/PSP — Payment Systems regulations), BSEC (capital markets), DGDA (pharma), BERC (energy), Directorate of consumer/DNCRP for B2C. Name the licence, the regulator, the renewal rhythm.

Output

Attorney-review draft: applicability matrix (domain → applies? → key duties → status → gap → owner → deadline), red-flag list ranked by penalty exposure, remediation roadmap, sources table with bdlaws links, ordinance-era caveats block, escalations (any criminal- exposure domain: AML, corruption, cyber offences → named senior counsel immediately).