Startup Legal Checklist: 25 Steps From Formation to Funding

A startup legal checklist is the ordered list of filings, documents, and agreements a US company needs to form correctly, protect its ownership and intellectual property, hire legally, and pass investor due diligence. Founders don’t need all 25 items on day one. They need the right items in the right order, because certain mistakes get more expensive every month they go unfixed: a missed 83(b) election, an unsigned IP assignment, or a cap table that contradicts the board minutes.

This guide sorts every task by stage and attaches the deadline or dollar figure that applies, so it works as both a set of legal steps to start a startup and a reference for the startup legal requirements that show up later, when a term sheet arrives. Federal changes through September 2026 are included, among them the permanent end of beneficial ownership reporting for US companies and the 2025 expansion of the Qualified Small Business Stock (QSBS) tax exclusion.

What Belongs on a Startup Legal Checklist?

A complete startup legal documents checklist covers 25 tasks across six stages, beginning with entity formation and ending with recurring state filings. The stages overlap in practice. A two-founder software company that pays a freelance designer in week three is already in Stage 3 before finishing Stage 2, so treat the order as a priority ranking, not a strict sequence.

Stage	Checklist items	Deadline to watch
1. Formation	Entity choice, certificate of incorporation and registered agent, bylaws and board resolutions, EIN and bank account, state registration	Register in your operating state before doing business there
2. Founder equity	Stock purchase agreements with vesting, 83(b) election, founder IP assignment, founder agreement, cap table	83(b): 30 days after the stock is issued
3. First hires	Worker classification, offer letters and invention assignments, equity plan and 409A valuation, non-compete alternatives	409A valuation before the first option grant
4. Launch	Trademark, terms of service and privacy policy, industry licenses, customer and vendor contracts, insurance	Privacy policy before collecting user data
5. Fundraising	Funding instrument, securities exemption and Form D, data room	Form D: 15 days after the first sale
6. Ongoing	Delaware franchise tax and annual report, BOI reporting status, annual legal audit	Delaware corporations: March 1 every year

Stages 1 and 2 carry the highest stakes. Most of the problems investors uncover during due diligence trace back to the first 30 days of a company’s life, and fixing those problems after a term sheet arrives costs far more in legal fees than doing the work at formation.

Stage 1: Formation Day

Choose a Delaware C Corporation or an LLC

Founders who plan to raise venture capital or grant stock options should form a Delaware C corporation, while consulting firms, agencies, and bootstrapped companies that distribute profits often fit a limited liability company (LLC) with pass-through taxation. Sole proprietorships and general partnerships skip formation paperwork entirely, but they also skip the liability shield, so most founders outgrow them within the first few transactions. Venture funds prefer Delaware for its predictable corporate law, its Court of Chancery, and the National Venture Capital Association (NVCA) model forms built around it.

An LLC carries trade-offs: its units don’t qualify for the QSBS exclusion, employee equity requires profits interests or phantom equity instead of stock options, and its foundational document is an operating agreement rather than bylaws. For stock acquired after July 4, 2025, the One Big Beautiful Bill Act raised the QSBS exclusion cap to the greater of $15 million or 10 times basis and lifted the gross-asset limit to $75 million. It also replaced the five-year cliff with a tiered schedule: a 50% exclusion after three years, 75% after four, and 100% after five.

File the Certificate of Incorporation and Appoint a Registered Agent

A Delaware corporation legally exists once the Delaware Division of Corporations accepts its certificate of incorporation. The certificate names the company, sets the number of authorized shares, and lists a registered agent with a physical Delaware address to accept lawsuits and state notices.

Share count matters more than most founders expect. Startups commonly authorize 10,000,000 shares with a par value of $0.00001, which keeps the founders’ purchase price at pennies. That same share count can produce an alarming annual tax notice once Stage 6’s franchise tax bill arrives, but the fix is straightforward and covered in that section.

Adopt Bylaws and Initial Board Resolutions

Bylaws and initial board resolutions turn a registered company into a functioning corporation with officers, directors, and authority to issue stock. The incorporator signs a document appointing the first board. That board then adopts the bylaws, elects officers such as a chief executive officer (CEO) and a secretary, authorizes founder stock issuances, and approves opening a bank account.

Skipping this step creates problems during due diligence. Stock issued without a board resolution is technically unauthorized, and repairing it later requires ratification votes and sometimes a filing under Section 204 of the Delaware General Corporation Law (DGCL).

Get an EIN and Open a Business Bank Account

Every startup needs an Employer Identification Number (EIN) from the Internal Revenue Service (IRS) before opening a bank account, running payroll, or filing taxes. The EIN application is free on the IRS website, and domestic applicants receive the number immediately after completing the online form.

Keep company money separate from personal money from the first deposit. Paying rent from the company account or buying equipment on a founder’s personal card blurs that line, and courts cite commingled funds as a reason to pierce the corporate veil and hold founders personally liable.

Register in the State Where You Operate

A Delaware corporation must register as a foreign corporation in every state where it has employees, an office, or regular business operations. Two founders working from Austin, for example, register the company with the Texas Secretary of State.

California is the costliest example. A Delaware corporation doing business in California pays the California minimum franchise tax of $800 per year on top of its Delaware obligations. Operating without registering exposes the company to penalties and can block it from filing a lawsuit in that state’s courts until it registers.

Stage 2: Founder Equity and Ownership

Sign Founder Stock Purchase Agreements With Vesting

Each founder should buy shares under a written stock purchase agreement that includes a vesting schedule. The market standard is four years of vesting with a one-year cliff: 25% of the shares vest on the first anniversary, and the rest vest monthly over the next 36 months.

Vesting protects the founders who stay. Consider two founders, each holding 4,000,000 shares. One leaves after eight months, so the company repurchases all 4,000,000 of that founder’s shares at the original price instead of watching 50% of the company walk out the door. Investors ask about founder vesting in nearly every seed round, so putting vesting in place at formation avoids a renegotiation later.

File the 83(b) Election Within 30 Days

Founders who receive stock subject to vesting must file an 83(b) election with the IRS within 30 calendar days of the stock grant, and the IRS grants no extensions. The election tells the IRS to tax the stock at its value on the grant date, which is usually close to zero, rather than taxing each installment as it vests.

The dollar difference is large. A founder buying 4,000,000 shares at $0.0001 per share pays $400, and filing the 83(b) election fixes the taxable value at that $400. Without the election, the founder owes ordinary income tax on the value of each monthly tranche as it vests, even after a priced round has pushed the shares to $1 each. Founders can file with IRS Form 15620 or a signed written statement, preferably by certified mail with a return receipt, and should keep a stamped copy with the company records.

Assign All Founder IP to the Company

Every founder must sign an agreement transferring all company-related intellectual property (IP) to the corporation, including work created before incorporation. Code, designs, domain names, trade secrets, and prototypes, for example, all belong to the individual who created them until a signed assignment transfers them.

Missing assignments rank among the most serious findings in investor due diligence. A former co-founder who wrote the first version of the product and never signed an assignment still owns that code, and buying it back after the company has value gives that person enormous leverage in the negotiation. Most founder stock purchase agreements include a technology assignment clause, so read the agreement to confirm the clause covers pre-formation work.

Put Founder Roles and Decision Rules in Writing

A written founder agreement defines each founder’s title, responsibilities, time commitment, and the process for resolving deadlocks. Handshake deals fail when two founders remember the same conversation differently.

Cover four decisions at minimum: who can sign contracts above a set dollar threshold, such as $10,000; which actions require a unanimous vote; how disputes get resolved; and what happens to equity, board seats, and voting rights when a founder leaves. Answering those questions takes one afternoon during formation. Answering them during a falling-out can end the company.

Start a Clean Cap Table

A capitalization table (cap table) records every share, option, warrant, SAFE, and convertible note the company has issued, and each line must match a signed document and a board approval. A spreadsheet works at formation. Many startups move to cap table software once they grant their first options.

Mismatches between the cap table and the corporate records are one of the most common problems uncovered in seed-stage due diligence. A typical example: an advisor was promised 0.5% in a Slack message, but no grant document or board resolution exists. Resolve every informal promise by documenting it or formally declining it before approaching investors.

Stage 3: First Hires and Contractors

Classify Every Worker Correctly

Workers who follow company-set schedules and perform core business functions are usually employees, not independent contractors, and misclassification triggers back taxes, back wages, and penalties. California applies the strict ABC test from Assembly Bill 5 (AB5), which presumes employee status unless the company proves all three parts of the test, including that the work falls outside the usual course of its business.

Pay classification is the other trap. The federal Fair Labor Standards Act (FLSA) exempts salaried professionals from overtime only when they earn at least $684 per week ($35,568 per year) and meet the job-duties test, and states such as California and New York set higher salary thresholds. Founders can be held personally liable for unpaid wages in some states, even after the company shuts down.

Use Offer Letters and Invention Assignment Agreements

Every employee and contractor should sign a written offer letter or services agreement plus a Proprietary Information and Invention Assignment Agreement (PIIA) before starting work. The offer letter states salary, title, at-will status, and any equity grant. Most states, Florida included, presume employment is at-will unless a contract says otherwise, but the offer letter should still say so directly rather than relying on the default. The PIIA transfers work-related inventions to the company and imposes confidentiality obligations, and many companies pair it with a standalone non-disclosure agreement (NDA) for anyone who sees sensitive material before an offer is even signed.

Contractors need assignment language even more than employees do. Under US copyright law, a freelancer who writes code owns that code unless a written agreement assigns it, because most software doesn’t fall within the narrow “work made for hire” categories that apply to contractors.

Once headcount passes a handful of people, add an employee handbook covering anti-harassment policy, paid time off, and the other baseline HR policies that most states expect a company to have in writing.

Adopt an Equity Incentive Plan and Get a 409A Valuation

Startups must adopt a board- and stockholder-approved equity incentive plan and obtain an independent 409A valuation before granting stock options. The plan reserves a pool of shares, typically 10% to 20% of the company, and sets the terms for options, restricted stock, and, less commonly, stock appreciation rights (SARs). Stockholders must approve the plan within 12 months of board adoption for options to qualify as incentive stock options (ISOs).

The 409A valuation sets the fair market value of common stock, which becomes the minimum exercise price for options. Options priced below that value violate Section 409A of the Internal Revenue Code and expose employees to immediate taxation plus a 20% additional federal tax. An independent appraisal stays valid for 12 months unless a material event, such as a new funding round, happens first.

Replace Non-Competes With Enforceable Protections

Non-compete agreements are unenforceable for most employees in California, Minnesota, North Dakota, and Oklahoma, so startups should rely on confidentiality, non-solicitation, and invention assignment clauses instead. The proposed nationwide federal ban never took effect. On September 5, 2025, the Federal Trade Commission (FTC) voted 3-1 to dismiss its appeals in Ryan, LLC v. FTC and Properties of the Villages v. FTC, and the Non-Compete Rule was removed from the Code of Federal Regulations on February 12, 2026.

The FTC is still watching. In April 2026, the FTC ordered Rollins, Inc. to stop enforcing non-compete agreements against more than 18,000 employees nationwide. States haven’t backed off either: Colorado and Washington have both passed income-based restrictions on non-competes. A narrow non-solicitation clause covering customers and employees for 12 months protects the same business interests with far less legal risk.

Stage 4: Product Launch and First Customers

Clear and Register Your Trademark

Founders should run a trademark clearance search before spending money on a brand, then file a federal application with the United States Patent and Trademark Office (USPTO). A company that registers a domain name doesn’t own the matching trademark, and launching under a name another business already registered invites a cease-and-desist letter and a forced rebrand.

An intent-to-use application reserves the name before launch. The company files under Section 1(b) of the Lanham Act, and priority dates to the filing day once the mark is in use and registered. The USPTO base application fee is $350 per class of goods or services. Claim matching social media handles the same week.

Not everything worth protecting belongs in a trademark application. A pricing algorithm, a customer list, or a manufacturing process is usually better protected as a trade secret, kept confidential through NDAs and access controls rather than disclosed in a public filing.

Publish Terms of Service and a Privacy Policy

Any startup that collects personal data from users needs a privacy policy that matches its actual data practices, and any startup with a product or website needs terms of service. Terms of service set liability limits, acceptable use, payment terms, and a dispute resolution process, which often means binding arbitration.

The privacy rules keep multiplying. Twenty US states have comprehensive consumer privacy laws in effect as of 2026, up from one state (California) in 2018, and Rhode Island’s applicability threshold sits at 35,000 consumers, the lowest of any state. A startup with users in the European Union also needs to address the General Data Protection Regulation (GDPR), which applies based on where the users are located rather than where the company is incorporated. Copying a competitor’s policy creates legal exposure, because a policy that misstates actual data practices becomes the basis for deceptive-practices claims under Section 5 of the FTC Act. Products aimed at children under 13 must meet the Children’s Online Privacy Protection Act (COPPA) as well.

Confirm Industry Licenses and Regulations

Startups in regulated industries must obtain federal or state licenses before serving customers, and operating without them can shut the business down. Regulatory compliance requirements vary widely by industry: examples include money transmitter licenses for payments companies, Health Insurance Portability and Accountability Act (HIPAA) compliance for companies handling patient health data, and state lending licenses for fintech lenders.

AI startups face a moving target. Colorado’s original AI Act was set to take effect June 30, 2026, but a federal magistrate stayed its enforcement in April 2026 and the legislature replaced it with a narrower law on a later timeline, a reminder to check current status before assuming any state AI law applies as written.

Local requirements apply to nearly every company. City and county business licenses, sales tax permits, and home-occupation permits for founders working from home each carry their own filing fees and renewal dates, so add every renewal date to the compliance calendar at the moment the license arrives.

Put Customer and Vendor Contracts in Writing

Every paying customer, key vendor, and strategic partner relationship should run on a signed written contract. Early-stage companies benefit from a standard master services agreement (MSA) or order form they reuse across deals, instead of drafting from scratch each time. Software companies typically negotiate a service level agreement (SLA) alongside the MSA, spelling out uptime commitments and support response times, and many vendor relationships start with a mutual NDA before either side shares anything sensitive.

Large customers will send their own paper. Negotiate three clauses first: the limitation of liability (often capped at 12 months of fees paid), indemnification obligations, and termination rights. Flag any clause giving the customer rights on a change of control, because an acquirer will review those clauses closely during an exit.

Buy the Right Business Insurance

Most startups need general liability insurance at launch, workers’ compensation once they hire employees, and directors and officers (D&O) coverage before adding outside board members. Workers’ compensation is mandatory in nearly every state once a company has employees, and Texas is the notable exception.

Technology companies add errors and omissions (E&O) insurance and cyber liability insurance. Enterprise customers frequently require proof of coverage before signing, and a typical procurement checklist asks for $1 million to $2 million per claim of E&O coverage, so check the requirement early in the sales process.

Stage 5: Raising Capital

Pick a Funding Instrument

Pre-seed and seed startups typically raise money through a Simple Agreement for Future Equity (SAFE), a convertible note, or a priced equity round. Each instrument handles valuation and dilution differently:

• SAFE: Y Combinator introduced the SAFE in 2013. The investor’s cash converts into shares at the next priced round, usually subject to a valuation cap, and no interest accrues and no maturity date applies.
• Convertible note: A convertible note is debt that carries an interest rate, often 4% to 8%, and a maturity date, then converts into equity at the next priced round.
• KISS (Keep It Simple Security): 500 Startups’ version of a convertible instrument, built along similar lines to the SAFE, though most founders now default to the SAFE simply because it is the more widely recognized document among investors.
• Priced round: A priced round sells preferred stock at a set valuation using documents such as the NVCA model forms, and it costs more in legal fees than a SAFE.

Stack SAFEs carefully. Five post-money SAFEs at different caps can dilute the founders more than expected, so model the combined conversion before signing the second one.

Use a Securities Exemption and File Form D

Every sale of startup equity, including a SAFE, is a securities offering that must be registered with the Securities and Exchange Commission (SEC) or fit an exemption. Most startups use Regulation D before raising capital from outside investors:

• Rule 506(b): A 506(b) offering allows unlimited accredited investors and up to 35 non-accredited but financially sophisticated investors, and it bans general solicitation. Including any non-accredited investor generally triggers a requirement to give them a private placement memorandum (PPM), a disclosure document far more detailed than a standard term sheet.
• Rule 506(c): A 506(c) offering permits public advertising, but every investor must be accredited and the company must take reasonable steps to verify that status.

The company files Form D with the SEC within 15 calendar days of the first sale, plus state notice filings where investors live. An individual counts as accredited with income above $200,000 ($300,000 jointly with a spouse) in each of the past two years, or a net worth above $1 million excluding a primary residence. A founder who announces an open round on LinkedIn while relying on 506(b) has made a general solicitation and lost the exemption for that raise.

Build a Due Diligence Data Room

A due diligence data room is an organized online folder holding every document an investor will request. Include the certificate of incorporation, bylaws, board and stockholder consents, the cap table, stock purchase agreements, 83(b) filings, PIIAs, the equity plan and grants, 409A reports, material contracts, and any prior SAFEs or notes.

Prior raises get special attention. Friends-and-family money raised without an exemption or proper disclosure can give those investors rescission rights, meaning a right to demand their money back, so disclose the history to counsel before the next round begins.

Stage 6: Ongoing Compliance

Pay the Delaware Franchise Tax and File the Annual Report

Delaware corporations must file an annual report and pay the franchise tax by March 1 every year. The minimum franchise tax is $175 plus a $50 annual report fee, for a minimum total of $225 per year, and late filers owe a $200 penalty plus 1.5% interest on the amount due.

Delaware’s first invoice often shocks founders. The state bills by default under the Authorized Shares Method, which charges $250 plus $85 for each additional 10,000 shares above 10,000, so a company with 10,000,000 authorized shares receives a bill of about $85,165. Refiling under the Assumed Par Value Capital Method, which has a minimum tax of $400, usually drops the bill to a few hundred dollars for an early-stage startup with modest assets.

Confirm Your Beneficial Ownership Reporting Status

Confirm where the company was formed, because companies formed in the United States no longer file beneficial ownership information (BOI) reports under the Corporate Transparency Act (CTA). The Financial Crimes Enforcement Network (FinCEN) issued a final rule on August 11, 2026 that permanently removes the BOI reporting requirement for US companies and US persons, and the rule took effect on publication in the Federal Register on August 14, 2026.

A narrow exception remains. Foreign entities that qualify as reporting companies must still report beneficial ownership information for foreign individuals. A startup incorporated in the Cayman Islands and registered to do business in California, for example, still files.

Run an Annual Legal Audit

An annual legal audit checks that the cap table, contracts, policies, and state filings still match how the company operates. Schedule the audit for the same month each year, such as January, before the March 1 Delaware deadline.

Use a fixed list: confirm good standing in every registered state, reconcile the cap table against board consents, refresh the 409A valuation, update the privacy policy for new data uses, renew licenses and insurance, and collect missing PIIAs from anyone who joined during the year. A 50-person company that runs this audit every year typically moves through due diligence in weeks instead of months.

Which Checklist Items Can Founders Handle Without a Lawyer?

Founders can safely handle the EIN application, bank account setup, domain and social handle registration, business license renewals, and the Delaware annual report without a lawyer. Each task follows a published government form or a simple online process with clear instructions.

Other items carry permanent consequences when done wrong. Entity choice, founder stock purchase agreements, the equity incentive plan, any fundraising documents, and securities filings belong with a startup attorney, because errors in those documents surface during due diligence and cost 5 to 10 times more to repair than to draft correctly. So when a founder asks “do I need a startup lawyer,” the honest answer is: not for the whole checklist, just for the items above. Many startup firms offer flat-fee formation packages that cover Stages 1 and 2 together.

Conclusion

Founders who complete Stages 1 and 2 of this startup legal checklist within the first month avoid the most expensive startup legal problems. Those two stages cover the entity, the founder shares, the IP assignments, and the cap table, and they account for most of the defects investors find in seed-stage due diligence.

The later stages arrive on their own timelines. Hiring triggers Stage 3, launch triggers Stage 4, and a term sheet triggers Stage 5, so add each stage’s deadlines to the compliance calendar when that event happens. Keep this startup compliance checklist next to the calendar, and count the 83(b) deadline from the date printed on the stock purchase agreement, not the date the shares arrive in the cap table software.

Frequently Asked Questions