How should licences and regulatory requirements be assessed before building a platform?
Freeze the business facts of the first release before assessing licences. Record the operator, users and regions, who charges whom, whether transactions are intermediated, what users may publish, which data is processed, and whether content is recommended or generated. Then have the authority or qualified counsel map each function to a licence, filing, continuing control, or non-applicability. Exclude unresolved high-risk functions from development instead of building a full platform and seeking permission later.
“Software platform” is not a regulatory category. An internal project tool, a public information app, a merchant marketplace, online healthcare, and recruitment can share a technical stack while carrying different duties. ICP, public-security, app, sector, or local filings depend on the service, deployment, commercial nature, and authority position; an article cannot decide them for a particular operator.
When translating compliance duties into evidence and controls, also compare What compliance support can a software development provider deliver?; the linked guidance adds context that should be considered in the same decision.
| Fact to lock | Architectural or operational consequence | Evidence |
|---|---|---|
| Operator and region | Domestic filing, cross-border, local entity, tax | Entity documents, market and deployment list |
| Service and money flow | Telecom, platform, payment, sector entry | User journey, contract, funds-flow diagram |
| Content and interaction | Governance, specialist licence, algorithm, labels | Content, publication, and distribution map |
| Goods or services | Merchant credentials, restrictions, consumer duties | Catalogue and admission policy |
| Data and users | Sensitive data, minors, transfer, audit | Field inventory, flow, retention |
| Third parties | Authorization, sharing, and incident allocation | SDK/API register and data terms |
Create a decision card for each function: plain business description, jurisdiction, regulatory issue, authoritative source, owner, deadline, technical dependency, and fallback. A job board accepting employer posts differs from a directory linking to government notices. A platform taking commission differs from displaying a supplier phone number. Trigger the analysis by what the product does, not an industry keyword.
Use official application guidance and retain written or otherwise reproducible advice. China's MIIT has established mobile-app filing; its official explanation describes app sponsors, network access, and distribution participants. App filing is not a licence for news, healthcare, finance, or another regulated service. A sector licence likewise does not replace privacy, advertising, consumer, and security duties.
The pre-development package should include first-release and excluded functions, entity and money flow, licence and filing matrix, content and merchant rules, data inventory and flow, suppliers, user rights, incident response, store requirements, and signed residual risk. Mark each item confirmed, awaiting professional confirmation, or launch-blocking, with source and review date. A consultation draft signals possible change but is not current law.
Product design then implements the confirmed requirement. Merchant verification needs credential fields, expiry, and recheck. User deletion must reach databases, files, and suppliers. UGC needs reporting, action, appeal, and evidence. Algorithms or generated content may require notice, filing, assessment, or labels. Policy text and actual SDK behavior must agree.
Before launch, walk one real journey from advertisement through registration, publication or purchase, payment, support access, refund, and deletion. Confirm the same legal entity across licence, domain, package, store account, payment merchant, and policy. Inspect production SDK traffic, permissions, logs, and cloud regions; a passing test environment is insufficient.
Wavesteam converts business facts and confirmed requirements into product, engineering, test, and launch controls and prepares technical evidence. The client owns the business model, licensed entity, and truthful filing; authorities, lawyers, and assessors own their professional decisions. Missing prerequisites lead to a reduced release or disabled function, not “launch and see.” The service process shows how prerequisites become project scope.