Closed beta — compliance sign-off checklist

Status (2026-05-19): PARKED — re-enters at Phase C. v2.1 closed beta is newsletter-grade: no client money, no portfolio replication, no MiFID-II suitability. Use PRD-stratify-v2.md §6 as the v2.1 Done criteria. This checklist re-activates when the FMA license lands.

Complete before inviting external pilot capital or partner production paths.

Product / ops

• [ ] One pilot live in sandbox DB with verified approvals trail
• [ ] Ten B2C test users seeded or onboarded with KYC + suitability passed
• [ ] One propagated trade < 60s wall clock (script: pnpm demo:closed-beta-trade)
• [ ] Stripe Connect test payout executed (pnpm demo:closed-beta-payout) or --dry-run + ops-approved live test recording
• [ ] Partner completed docs/closed-beta/partner-runbook.md without assistance

Compliance / legal

• [ ] Suitability engine version frozen + changelog entry
• [ ] docs/compliance/suitability-responsibility-matrix.md acknowledged by partner compliance
• [ ] docs/compliance/audit-trail-export-format.md acknowledged by partner compliance
• [ ] DSGVO processing agreement status documented (docs/compliance/dsgvo-data-flow.md)

Security

• [ ] API keys only in vault; manifest path tmp/ gitignored
• [ ] Webhook HMAC verification tested on partner side

Sign-off block