Docs/Reference/Country gaps — what RideKit is missing, market by market

Country gaps — what RideKit is missing, market by market

Question this answers: across the 37 preset markets in backend/src/markets/country-presets.ts, what do riders, drivers and regulators expect that RideKit does not yet do — and what should be built next?

Date: 2026-09-05 Companion document: docs/polish-audit.md — how the product feels, screen by screen.

Read this first: research coverage is uneven, and I am not going to hide it

The session's web-search budget (200 searches) was exhausted partway through this work. Coverage is therefore:

Region	Web research	Status
India	Complete	MVAG 2025 read in full from the official MoRTH PDF; DPDP Rules 2025; GST position
MENA (AE SA OM QA KW EG MA TN)	Complete	Regulator sources for each market
Brazil	Partial	Federal law + São Paulo municipal regime verified; LGPD/Pix/labour law not reached
Mexico, Colombia, Chile, Peru, Argentina, Ecuador	None	Budget exhausted before any search
SEA + AU/NZ (ID PH MY TH VN AU NZ)	None	Budget exhausted before any search
Africa (KE NG ZA GH UG TZ)	Partial	Kenya, Nigeria, South Africa and Ghana researched; Uganda and Tanzania not researched at all
Europe + US/CA (US CA GB DE FR ES IT NL)	Complete, from primary statute	Researched by fetching EUR-Lex, gov.uk, BOE, ARPE, ILT, CPUC, TLC and ADA.gov directly. Italy could not be verified (the Italian legal databases blocked automated access)

Every claim below is labelled:

VERIFIED — confirmed on the web this session, with the URL.
CODE-VERIFIED — confirmed by reading this repository. These are facts about our product and are as reliable as the source.
UNVERIFIED / NOT RESEARCHED — say so and stop. Nothing here is filled in from memory.

The single most useful consequence of the budget running out is that it forced the analysis to start from the code, and the largest findings turned out to be code-verifiable and universal — they need no research at all.

The one-minute version

Three findings dominate everything else, and none of them is market-specific:

Neither app can be published on either app store today. There is no in-app account deletion anywhere in the product (zero hits across backend/src and mobile/), and "By continuing you agree to our Terms & Privacy Policy" on the welcome screen is plain text with no link — no Terms URL, no Privacy Policy URL, anywhere in either app. Apple has required in-app account deletion since June 2022; Google Play requires it plus a web deletion URL. This gates all 37 markets. (CODE-VERIFIED; store rules VERIFIED.)
30 of the 37 markets have no local payment rail — only Stripe plus cash. Just 7 markets ship a genuinely local electronic rail: India (UPI/Razorpay), Brazil (Pix), Saudi (Moyasar), Nigeria (Paystack/Flutterwave), Kenya (M-Pesa), Philippines (GCash), and Mexico (OXXO, and only for wallet top-up). Everywhere else the preset resolves to ['stripe', 'cash']. In Kuwait, Oman, Qatar, Egypt, Morocco and Tunisia the buyer cannot open a Stripe merchant account at all, so those six presets ship as cash-only. (CODE-VERIFIED; Stripe's GCC/Egypt/Maghreb unavailability VERIFIED.)
No market has a verified working e-invoicing path. 33 of 37 presets are tax: { engine: 'none' } — VAT is charged and displayed but never filed. And all four markets that do have an engine have a problem: India's rate is set to 18% when the correct ECO passenger-transport rate is 5% (a live overcharge on every ride); Saudi's ZATCA provider produces only a Phase-1 QR, not the signed XML Phase 2 requires; Mexico's CFDI provider has no receptor block at all (no name, no postal code, no régimen fiscal), so it cannot be stamped; Brazil's NFS-e provider posts JSON to a REST endpoint while real municipal services are signed SOAP/XML. (All CODE-VERIFIED; the India rate and ZATCA Phase 2 requirements VERIFIED.)

Beyond those, the highest-value researched findings are:

India's MVAG 2025 makes today's commission ceiling illegal — it requires the driver keep ≥80% of the fare, and the preset permits 40% — and the fare shape is wrong (base must cover the first 3 km).
Kenya makes data-protection registration a precondition of the operator licence, so a Kenyan buyer cannot get licensed on this codebase at all. Its 18% commission cap is suspended for 12 months, not gone; RideKit defaults Kenya to 50%.
South Africa now attaches a R100,000 fine or 2 years' imprisonment to dispatching a driver without an operating licence — and there is no operating-licence document type and no dispatch gate on document validity.
Saudi requires WASL telemetry before a vehicle can legally operate, and the shipped ZATCA provider produces a Phase-1 QR while advertising engine: 'zatca'.
Lagos charges a flat ₦20 on every trip, and the product has no concept of a per-trip statutory levy — the same missing primitive as Australia's state levies.
Brazil's regulation is municipal, which the schema cannot express: markets has a unique index on country_code, one row per country.
In the EU, from 2 December 2026, a human must make every driver deactivation, with written reasons and a two-week review SLA — and biometric identity checks on drivers are outright banned, which inverts the identity-verification recommendation for Europe.
In the UK, VAT is due on the full fare, not the commission — settled by HM Treasury in Nov 2025. A principal-vs-agent switch does not exist, and getting it wrong is a 20%-of-revenue error.
The same missing primitive appears in three continents: a per-trip statutory levy. Lagos's flat ₦20, California's $0.10 and Australia's state point-to-point levies are one build.

Two things worth knowing that are not gaps: neither the DSA nor the P2B Regulation applies to a RideKit deployment (it is a transport service under Elite Taxi, not an information society service — a genuine de-scoping win), and France's ban on showing available cars before booking is already satisfied, though only by accident.

And one genuinely free win: the Flutterwave provider already declares Ghana and Uganda mobile money and already handles GHS and UGX — the GH and UG presets simply never list it. Two markets go from cash-only to mobile money on a one-line preset edit.

If you build five things: legal links + account deletion · the consent/DSAR/retention core · real payment rails (starting with the free Ghana/Uganda edit) · the per-market commission and tax values that are wrong today · sub-national market configuration.

Part 1 — Universal findings (all 37 markets, no research required)

These are the highest-confidence items in the document and, by markets-unlocked-per-day-of-work, the best value in it.

U1. No in-app account deletion — the apps cannot be published

Markets: all 37
Expected: Apple Guideline 5.1.1(v) — any app supporting account creation must offer in-app account deletion; enforced since 30 June 2022, and deactivate-only fails review. Google Play requires an in-app path plus a web URL for deletion requests, declared in the Data safety form; non-compliant submissions are rejected.
Today: zero deletion endpoints in backend/src, zero deletion UI in either app. The rider's entire Settings screen is language and appearance — nothing else (mobile/rider/app/(app)/settings.tsx).
Gap: in-app deletion in both apps, a backend soft-delete/anonymise that respects what the double-entry ledger and tax invoices must legally retain, and a public deletion page on the marketing site.
BLOCKER-TO-SELL — a buyer literally cannot ship. Size: M (the endpoint is S; ledger-safe anonymisation is the real work.)
CODE-VERIFIED. Store rules VERIFIED: Apple · Google Play

U2. Terms and Privacy Policy are unlinked text

Markets: all 37
Expected: a reachable privacy policy is an app-store requirement and the precondition for claiming informed consent under every privacy regime below.
Today: welcomeLegal: 'By continuing you agree to our Terms & Privacy Policy.' is a locale string rendered as static grey text — no URL, no tappable link, in either app (visible at the foot of e2e/r01-launch.png). Grep finds no policy URL anywhere in mobile/.
Gap: two configurable URLs and two tappable links. The marketing site already has a privacy page.
BLOCKER-TO-SELL. Size: S — likely the cheapest item in this document.
CODE-VERIFIED

Markets: all 37. Verified legal requirement in: India (DPDP Rules 2025), UAE, Saudi, Morocco, Tunisia, Egypt, Brazil; near-certainly the EU 8, and every African and SEA market — see per-region notes.
Expected (India, as the fully-researched example): DPDP Rules notified 14 Nov 2025 — itemised consent notice (purpose, categories, retention, withdrawal), data-principal rights to access/correct/erase, 48 hours' notice before erasure, breach report to the Board within 72 hours, verifiable parental consent, and a Consent Manager interoperability path. Data-fiduciary obligations bite at 18 months (13 May 2027).
Expected (Morocco/Tunisia): a prior declaration to the regulator before processing begins (CNDP in Morocco, INPDP in Tunisia) — you cannot legally start without one, and you cannot file one without a documented processing inventory.
Today: grep across the whole repo returns zero hits for gdpr, dpdp, lgpd, consent framework, erasure, data export, DSAR or retention enforcement. dataResidency.retentionMonths exists in the market config type and nothing acts on it.
Gap: versioned consent capture + a consent ledger; a data-subject-request flow in both apps and the admin; export; a retention engine that honours the config field already present; a breach-notification workflow; and a shippable processing-inventory document for the declaration regimes.
BLOCKER-TO-SELL. Size: L — but one build satisfies four-plus legal regimes at once.
CODE-VERIFIED (absence). India: VERIFIED PIB, DPDP Rules PDF. Morocco/Tunisia/UAE/Saudi: VERIFIED DLA Piper UAE, Morgan Lewis on Saudi PDPL, Morocco 09-08, Tunisia 2004-63

U4. 30 of 37 markets have no local payment rail

Markets: everything except IN, BR, MX, SA, NG, KE, PH.
Today (extracted from country-presets.ts):

Market	Gateways in the preset
IN	`upi, razorpay, stripe, manual`
BR	`pix, stripe, manual`
SA	`moyasar, stripe, cash`
NG	`paystack, flutterwave, stripe, cash`
KE	`mpesa, flutterwave, stripe, cash`
PH	`gcash, stripe, cash`
MX	`stripe, oxxo, cash` — but the code's own header notes OXXO is top-up-only and confirms in days, so a Mexican rider pays by card or cash
AE ZA ID MY TH VN OM QA KW EG MA TN CO CL PE AR EC GH UG TZ US CA GB AU NZ DE FR ES IT NL	`stripe` + `cash`/`manual` only

Of those 30, Stripe operates in the 11 Western markets plus the UAE. In Kuwait, Oman, Qatar, Egypt, Morocco and Tunisia the buyer cannot open a Stripe account, so the preset silently degrades to cash-only. Kuwait's local debit cards are all KNET-branded (~80% of online transactions); Oman's OmanNet is ~95% of cards; every Moroccan card transaction routes through CMI.

Gap: a genuine local rail per market. The architecture is ready for it — TopUpRailResolver has a most-local-first priority order and the header comments show real care about not defaulting a rider into a foreign rail. There is simply nothing local to prefer.
Two of these are nearly free: the shipped Flutterwave provider already declares mobilemoneyghana and mobilemoneyuganda and already handles GHS and UGX correctly — the GH and UG presets just never list it. See AF-1.
BLOCKER-TO-SELL for KW, OM, MA, TN, EG (VERIFIED) and GH, UG, TZ; STRONG-EXPECTATION elsewhere. Size: M per rail — but S for Ghana and Uganda.
CODE-VERIFIED. Stripe coverage VERIFIED: supported countries · KNET · OmanNet · CMI

U5. No cash-collection loop — in cash-majority markets this is the whole revenue mechanism

Markets: most acutely EG, MA, TN, and (unresearched but near-certain) the African and South Asian markets. Careem put card payment at only 20–25% of Egyptian trips.
Today: cash rides settle correctly in the ledger — the debit goes to a CASH_CLEARING system account instead of the rider's wallet, and the driver's wallet is credited their net (wallet.service.ts:556-564). But getOrCreateSystemAccount(AccountOwnerType.CASH_CLEARING, ...) takes no owner id, so cash clearing is a single global account: there is no per-driver figure for how much cash a driver is holding on the operator's behalf. Grep finds zero hits for cashCollect, cash_due, cashInHand, driverDeposit or negativeBalance.
Consequence: a driver who takes a cash fare holds the gross and has their wallet credited the net, and can withdraw it. Nothing accrues the commission owed, nothing collects it, and nothing takes a driver offline when they owe too much.
Gap: per-driver cash-owed accrual, a deposit/settlement workflow, and an auto-offline threshold.
BLOCKER-TO-SELL in cash-majority markets. Size: M.
CODE-VERIFIED. Egypt cash share VERIFIED: Daily News Egypt

U6. One market row per country — sub-national rules cannot be expressed

Markets: BR (municipal), MX (state), US (state/city), CA (province), AU (state levies), IN (state fares, state languages, state bike-taxi bans).
Today: market.entity.ts:180 — @Index(['countryCode'], { unique: true }). Every configuration section (tax, KYC, gateways, pricing, safety, languages) hangs off that single row. The NFS-e provider takes a single cityCode from provider config — one Brazilian município per deployment, nationwide.
Gap: a sub-national layer with a resolution order (city → state → country), plus admin UI wherever config is read.
BLOCKER-TO-SELL for Brazil specifically; a growing constraint elsewhere. Size: L.
CODE-VERIFIED. Brazil's municipal competence VERIFIED: Lei 13.640/2018

U7. 17 of 37 markets ship English-only apps

Today: both apps ship 14 locales (ar bn en es gu hi id kn mr pt ta te th vi) — all of them used by some market, and es/pt are complete (635 keys each, matching en). But the presets wire only English into: ZA NG KE GH UG TZ PH MY US CA GB AU NZ DE FR IT NL.
Gap: no fr (blocks Morocco, Tunisia, France, and francophone Africa — the admin has fr, the apps do not, which is backwards), no de, it, nl, ms, tl, sw. India separately misses Malayalam, Punjabi, Odia, Assamese and Urdu, which MVAG cl. 14.3 makes a legal requirement in the states where those are official.
STRONG-EXPECTATION generally; BLOCKER for Kerala/Punjab under Indian law. Size: S per language — the i18n scaffolding is clean and parity-tested.
CODE-VERIFIED. India language mandate VERIFIED (MVAG 2025 cl. 14.3).

U8. 21 of 37 markets get a two-document KYC set

Today: kycFor() (country-presets.ts:812-822) gives India its 6-point set and the 10 Western markets id_proof + license + insurance + vehicle_registration; the 5 GCC markets get id_proof + license + vehicle_registration. Everything else — BR MX ZA NG KE ID PH MY TH VN EG CO CL PE AR EC MA TN GH UG TZ — gets KYC_LIGHT = ['id_proof', 'license']. No insurance, no vehicle registration, no criminal-record check.
Gap: Brazil's federal law requires seguro APP insurance and a certidão negativa de antecedentes criminais (VERIFIED). DriverDocType is a fixed enum, so adding a doc type is a migration rather than configuration.
Credit where due: document expiry tracking already exists (expiresAt, expiring-soon computation, daily sweep) — the renewal-cadence half is solved.
BLOCKER-TO-SELL for Brazil; STRONG-EXPECTATION elsewhere. Size: S for per-country lists, M if doc types become configurable.
CODE-VERIFIED. Brazil requirement VERIFIED: Lei 12.587/2012 art. 11-A

U9. No identity verification anywhere — KYC is upload-and-eyeball

Markets: all 37.
Today: no liveness, no selfie match, no face comparison, no third-party IDV provider, no national-ID validation of any kind (no CPF/RFC/CURP/RUT checksum, no Aadhaar/DigiLocker, no NIN, no Nafath/UAE PASS/Absher hook). backgroundCheckRequired: true is a boolean flag with nothing behind it.
Why it matters beyond onboarding: India's MVAG cl. 15.4 requires a mechanism in the app to verify the driver undertaking a journey is the one police-verified — i.e. Uber's Real-Time ID Check. That is an in-trip requirement, not an onboarding one.
Gap: a pluggable IDV provider interface (the payment/tax modules already demonstrate the pattern), plus structured compliance fields with dates and expiries.
Build it gated, not global. The EU Platform Work Directive Art 7(1)(f) prohibits processing a platform worker's biometric data to establish identity by comparison against a stored database — so the selfie re-verification India mandates would be unlawful for drivers in the EU (see EU-10). India also requires any liveness step to ship with an accessible alternative (Pragya Prasun). This must be a per-market flag from day one; retrofitting a gate onto a global feature is the expensive path.
BLOCKER-TO-SELL for India; STRONG-EXPECTATION elsewhere; PROHIBITED for drivers in the EU. Size: M with a vendor.
CODE-VERIFIED. India requirement VERIFIED (MVAG 2025 cl. 15.4); EU prohibition VERIFIED (Directive 2024/2831 Art 7).

U10. Assets you already have that this document should not double-count

Worth stating plainly, because several of the compliance findings below are cheaper than they look:

Surge and commission caps are already per-market configuration. marketConfigFor() gives every one of the 37 markets surgeFloorBps, surgeCeilingBps, commissionMaxBps and driverEarningsMinBps, and dispatch.service.ts:489 enforces the commission clamp with a log line. The gap is that the defaults are generic — commissionMaxBps: p.code === 'IN' ? 4000 : 5000, so every market except India permits a 50% take rate, against India's real 20% floor-price rule and Kenya's 18% statutory cap. Filling in each market's real legal cap is S, not L. The one genuinely missing primitive is an effective-date window on a cap, which Kenya needs because its 18% cap is currently suspended for 12 months (KE-2).
M-Pesa Paybill vs Till already works — MPESA_TRANSACTION_TYPE switches CustomerPayBillOnline ↔ CustomerBuyGoodsOnline (mpesa-payment.provider.ts:281-285). The real M-Pesa gap is narrower: no C2B confirmation callbacks (KE-4).
The ledger already supports driver debt — allowNegative/allowDebt in wallet.service.ts, used by the cancellation flow. The cash-collection gate in U5 is a rule on top of an existing primitive, not new plumbing.
All 37 markets are seeded, not just the original five — migration 1700000047000-CountryPresetPack.ts inserts every preset with full config, idempotently. (The comments in that file and in country-presets.ts:93 both say "47 countries"; the array actually holds 37. Stale comment, worth fixing.)
Per-country emergency numbers and safety check-in defaults ship for every market.
Trip-share links already self-destruct 15 minutes after the ride reaches a terminal state, with a separate hard expiresAt and a rider-controlled revokedAt (trip-share.service.ts:110, 256-271). India's MVAG cl. 14.7 requirement is effectively met.
The tax module is honest about non-compliance. Where credentials are absent it marks documents local_only and refuses to call them issued. The product does not claim compliance it lacks — which makes the India rate error and the engine: 'zatca' label the two things most worth correcting, since they are the only places the product overstates itself.

U11. The driver has almost no safety surface

Markets: all 37, most acutely wherever driver safety is the acute risk.
Today: the rider has a full safety centre (rider/app/(app)/safety.tsx) — trusted contacts, emergency numbers, ride check-in, share trip. The driver app has no safety screen at all. Its entire safetyApi is one method, sos, called from the trip and parcel screens. The backend's trusted-contacts controller is behind a plain JwtAuthGuard, so a driver could call it — there is simply no UI.
Gap: a driver safety centre. Because the backend already supports it, this is mostly client work. India's MVAG cl. 11.3(v) separately requires two emergency contacts recorded per driver at onboarding.
STRONG-EXPECTATION. Size: S–M.
CODE-VERIFIED. India requirement VERIFIED (MVAG 2025 cl. 11.3(v)).

Part 2 — India (researched in full)

India is the flagship market and has the most specific, most binding rule set. The governing document is the Motor Vehicles Aggregator Guidelines 2025 (issued 1 July 2025 under s.93 of the MV Act 1988) — a central template that each State adopts and may add to. Official PDF

Correction to circulating summaries: several secondary sources report a 30-hour training requirement and a 12-hour/day working cap. The official text says 40 hours (cl. 10.1) and contains no working-hour cap at all. Do not put the 12-hour figure in a compliance claim — its origin is UNVERIFIED.

Money bugs (fix first — these are wrong today, not merely missing)

IN-1 · GST is set to 18%; the correct rate is 5%. country-presets.ts:115 sets rateBps: 1800, and india-gst.provider.ts:41-56 applies it verbatim. Passenger transport through an e-commerce operator is a Section 9(5) deemed supply taxed at 5% with restricted ITC; the platform is deemed supplier and TCS under s.52 does not apply. Every India install out of the box overcharges 13 points and files wrong. There is also only one rate per market, so cab 5% / rent-a-cab 18% / exempt-offline cannot be expressed. BLOCKER. Size: S for the rate, M for per-category rates. VERIFIED: taxaj, ClearTax

IN-2 · The commission ceiling permits an illegal take rate. MVAG cl. 17.4 requires the driver receive ≥80% of the fare for a driver-owned vehicle (≥60% if aggregator-owned). The preset sets India to commissionMaxBps: 4000 / driverEarningsMinBps: 6000 — the fleet-owned number applied to the overwhelmingly common driver-owned case. Should be 2000/8000 with an ownership flag. BLOCKER. Size: S for the defaults, M for the ownership split. VERIFIED (MVAG cl. 17.4–17.5). (Surge is already correct: MVAG allows 0.5×–2.0× and India's preset is exactly 5000/20000 bps.)

IN-3 · Fare shape is wrong. cl. 17.1 requires the base fare be the State-notified fare; cl. 17.2 requires it cover a minimum of 3 km to compensate dead mileage. India's preset is ₹40 base + ₹13/km from km 0 (fare-presets.ts:306), with no "included km" on VehicleType (that field exists only for rentals) and no way to hold three different notified base fares for a buyer operating in three states. BLOCKER. Size: M. VERIFIED (MVAG cl. 17.1/17.2/17.8)

IN-4 · Cancellation fee has a floor where the law puts a cap. cl. 18 sets the fee at 10% of fare capped at ₹100, applied to both parties, only where the reason is off a published valid-reason list, with the passenger-paid fee split 80/20 to the driver. cancellation.service.ts:253-255 computes pctFee and then takes pctFee > floor ? pctFee : floor — a floor, never a cap. No driver-side penalty, no reason taxonomy, no split. BLOCKER. Size: S–M. VERIFIED (MVAG cl. 18–19)

Missing compliance machinery

#	Requirement	Today	Verdict · Size
IN-5	Grievance officer — name, email, phone published in-app and on the website; online reporting to the Competent Authority (cl. 9.10)	Zero occurrences of "grievance" anywhere in the repo	BLOCKER · S–M
IN-6	40-hour induction training before onboarding, annual refresher, and quarterly retraining for drivers below the 5th rating percentile or removal from the platform (cl. 10.1, 11.2)	Nothing — KYC is upload + admin review	BLOCKER · M
IN-7	Route-deviation detection signalling the control room, which connects driver and passenger (cl. 15.2)	Only `rerouteThresholdPct` in `fare-integrity-config.ts` — that is billing re-quote logic, not a safety alert	BLOCKER · M
IN-8	AIS-140 VLTD + panic button connected to the control room, feed available at the State ICCC (cl. 13.1(xi), 15.1)	App GPS only; no telemetry ingest, no hardware panic channel, no ICCC forwarder	BLOCKER · L
IN-9	VAHAN/SARATHI real-time authentication, 8-year vehicle age cap, e-challan clearance before onboarding (cl. 11.3, 13.2, 13.3)	`Vehicle` has a nullable `year` and nothing else — no registration date, fitness, PUC or challan fields, no age gate, no API client	BLOCKER · M (fields) / L (with APIs)
IN-10	Insurance: ≥₹5 lakh passenger cover; per driver, ≥₹5 lakh health and ≥₹10 lakh term (cl. 9.5, 11.2)	Only an `insurance` document type for vehicle third-party. No policy entity, no coverage amounts, no rider-facing disclosure	BLOCKER · S–M
IN-11	Complaint SLA — inquiry within 3 days, outcome told to the passenger; immediate off-boarding on a drug/alcohol complaint (cl. 11.2(vi), 14.10)	Incidents/SOS console exists; no complaint case model, no clock, no auto-suspension	STRONG · M
IN-12	Accessibility — MVAG cl. 14.8 plus RPwD Act s.46 binding IS 17802 on private establishments. The CCPD has already issued directions to Ola Cabs, MakeMyTrip and Paytm, and fined 96 establishments ₹50,000 each in 2025. Rajive Raturi (SC, Nov 2024) made standards mandatory; Pragya Prasun (Apr 2025) held inaccessible liveness-based KYC an Art. 21 violation	No conformance work or audit. Note the compounding risk with IN-13: any liveness step must ship with an accessible alternative	BLOCKER · L
IN-13	In-trip driver identity check (cl. 15.4) — see U9	Absent	BLOCKER · M
IN-14	EV attribute — Delhi's Aggregator Scheme 2023 mandates a 100% EV fleet by 2030; MVAG cl. 20/22 lets states set annual EV percentages aggregators "shall mandatorily adhere to"	`Vehicle` has make/model/colour/year — no fuel type, no EV flag, no fleet-mix report	STRONG · S–M
IN-15	Per-state service kill switch for bike taxis — Karnataka HC allowed bike taxis in Jan 2026 after a ban from Jun 2025; Maharashtra revoked Ola/Uber/Rapido bike-taxi licences in Mar 2026	`bike` exists as a fare archetype; vehicle types can only be disabled globally, and there is no EV-only constraint on a category. Warning worth documenting: RideKit ships parcel, and Indian platforms used "passenger as parcel" during the Karnataka ban — lawyers called that a contempt risk	STRONG · M

Sources: AuthBridge on MVAG 2025 · AZB on IS 17802 / CCPD · MediaNama, Karnataka HC · MediaNama, Maharashtra · nasscom on the Delhi scheme

Commercial, not regulatory

IN-16 · No driver-subscription / zero-commission model — this is the Indian business model now. Namma Yatri launched flat-fee zero-commission (₹25/day autos) in Nov 2022; within two years every major platform followed. Rapido charges ₹9–29/day for autos and ₹500/month for cabs above ₹10,000 monthly earnings; Uber India moved auto drivers to ₹20–40/day fees in Feb 2025. RideKit is commission-only — zero hits for subscription, plan, daily fee or login fee. To an Indian buyer this reads as a 2021-era product. Arguably a blocker in India. Size: M. VERIFIED: TechCrunch, Inc42

IN-17 · No UPI AutoPay / e-mandate — so you cannot collect IN-16. UPI AutoPay is the standard recurring rail; under RBI's e-mandate framework debits up to ₹15,000 run without OTP after one AFA-authenticated mandate, with a mandatory pre-debit notification 24h before each debit. Zero hits for autopay or e-mandate; wallet top-up is one-shot. Needed for driver subscriptions and rider wallet auto-topup. STRONG. Size: M. VERIFIED: BHIM UPI AutoPay

IN-18 · The subscription model creates a GST question you must document. If a buyer adopts zero-commission, whether s.9(5) still applies is genuinely unsettled: the Karnataka AAR ruled for Juspay and against Uber and Rapido on near-identical facts, keying on how embedded the app is in the ride. Ship a documented tax-treatment switch (deemed-supplier vs facilitator) and a plain warning — not silence. Size: S (docs + config). VERIFIED: Lakshmikumaran & Sridharan

IN-19 · e-invoicing is built for the wrong half. GST e-invoicing (IRN/QR) applies at AATO > ₹5 crore and only to B2B/export/SEZ supplies — B2C is outside the mandate entirely, and ride-hailing is overwhelmingly B2C. The built IRN path is near-irrelevant for core rides (and issuing IRNs for B2C rides is wrong), while what is actually needed — a B2C tax invoice as deemed supplier, and reporting 9(5) supplies in GSTR-3B table 3.1.1(i) — is absent. Keep the IRN path for corporate rides, which genuinely are B2B. Size: M. VERIFIED: xflowpay

IN-20 · ONDC is real but not a buyer expectation for ride-hailing. ONDC has passed 450M+ cumulative transactions, but mobility volume is dominated by metro and bus ticketing (>300,000/day), not cab dispatch; ride-hailing on the network is essentially Namma Yatri / Yatri Sathi. Integration means a Beckn/ONDC TRV BPP adapter with registry signing keys. Worth doing only for buyers chasing govt-adjacent positioning. NICE-TO-HAVE · L–XL. Transaction figures VERIFIED (Elite Wealth); 2026 BPP certification requirements UNVERIFIED — ondc.org would not fetch.

IN-21 · Data localisation is a documentation gap, not a code gap. The licence application (MVAG Form I, item 10) requires "details of location of servers where data is proposed to be stored", and cl. 14.4 requires the app's cyber-safety be certified by a CERT-In empanelled firm. RideKit is self-hosted so localisation is achievable — but nothing tells the buyer it is a licence condition. An India deployment/compliance doc is S effort with high sales value.

Already fine in India, do not rebuild

Multi-stop (up to 3 stops, priced on full routed distance) · surge floor/ceiling already exactly match MVAG's 0.5×–2.0× · two-way ratings (cl. 9.7) · driver photo (cl. 14.9) · trip-share expiry (cl. 14.7 — see U10) · per-ride commission disclosed to the driver · wheelchair/female_driver service attributes. The platform-issues-the-invoice architecture is correct for s.9(5) — only the rate is wrong.

Part 3 — MENA (researched in full)

Framing correction: WASL is Saudi, not Dubai — it is the national land-transport monitoring platform operated by Elm for the Transport General Authority. Dubai's nearest analogue is SecurePath/SIRA, which targets rental and commercial fleets rather than e-hailing apps. The WASL gap is a Saudi gap, and it is larger than a telematics feed.

Saudi Arabia — the most regulated market in the set

SA-1 · WASL integration is absent, and without it vehicles cannot legally operate. Fleets must stream live location, speed, driving status, trajectory and driver identity to WASL by API, and WASL linkage is a precondition for issuing or renewing the vehicle operating card and the facility transport licence. Zero hits for wasl; driver location exists in driver_profile.last_location and goes nowhere external. BLOCKER · L. VERIFIED: NextBillion, TachyonHub

SA-2 · ZATCA Phase 2 is claimed but not implemented — and this is the one item with legal exposure for you, not the buyer. Phase 2 requires CSR → compliance CSID → production CSID onboarding via Fatoora, signed UBL 2.1 XML, an ECDSA cryptographic stamp, invoice-hash chaining, and the Phase-2 QR (tags 6–9); B2C invoices are reported within 24h, standard invoices cleared before issue. zatca-tax.provider.ts builds a correct Phase-1 TLV QR (tags 1–5) only, and posts { invoiceHash: externalId, uuid: rideId, invoice: qrPayload } where qrPayload is that Base64 TLV QR, not signed XML. The code's own comment calls it a "signed-XML placeholder". No CSR/CSID, no XML, no stamp, no hash chain; void() is a no-op. ZATCA will reject it — yet country-presets.ts:191 advertises engine: 'zatca'. Either finish Phase 2 or relabel it Phase-1-QR-only. BLOCKER · L. VERIFIED: ZATCA technical guideline

SA-3 · TGA operating card and vehicle eligibility not modelled. The vehicle needs a TGA operating card tied to car and owner — without it the account does not go live — and per-city accepted model-year lists move forward every January. STRONG · M. Operating card VERIFIED: TGA. A Saudi-nationals-only driver rule appears in commercial blogs but I could only confirm a primary-source nationality ban for delivery self-employment — treat the ride-hailing version as UNVERIFIED and do not build a hard gate on it.

SA-4 · Data residency. PDPL plus the transport rules push data in-Kingdom; SDAIA has published no adequacy list, so transfers need SCCs plus (since Feb 2025) a documented risk assessment, and for WASL-regulated transport "the servers and databases supporting the service must also be hosted inside Saudi Arabia". RideKit is a single Docker Compose deployment with no residency guidance. Mostly documentation and config — but it must exist to answer a buyer's first compliance question. STRONG · S–M. VERIFIED: Tahawul

SA-5 · Market signal for sales collateral: TGA reports 38.3m app trips in Q2 2026, +20% YoY, with Riyadh at 43.8%. VERIFIED: SPA

UAE

AE-1 · The buyer must be an RTA-licensed limousine company — and there is no fleet model. Ride-hail cars are limousine-class under an RTA commercial limousine licence; an app operator contracts with licensed limousine/taxi franchise companies that supply drivers and vehicles, and drivers need an RTA Professional/Limousine Driver Permit. Abu Dhabi's ITC separately licenses "booking and dispatching service providers". In RideKit, drivers are individuals on driver_profile, and organizations is a corporate customer entity (billing/settlement), not a vehicle-owning fleet. There is no professional/limousine permit doc type, no operating card, no permit number or expiry on the vehicle. This is as much a sales-positioning finding as a build one: your UAE buyer is a limousine company. STRONG (borderline blocker) · M. VERIFIED: RTA permit guide, Abu Dhabi ITC

AE-2 · No regulated-fare mode or surge ceiling tuned to Dubai. RTA sets the app-booked taxi minimum fare (AED 13 since Nov 2025) and caps the peak surcharge at a fixed AED 7.50; Hala — an RTA–Careem joint venture, so the regulator is itself a market participant — runs meter rates with no surge at all. RideKit's surge model is a multiplier with a generic 250% ceiling; a fixed-surcharge model and a "regulated meter" fare mode do not exist. STRONG · S–M. VERIFIED: Hala

AE-3 · Salik/Darb tolls are not modelled per trip. Careem and Uber add the toll automatically and itemise it on the receipt. RideKit has only a flat per-vehicle-type default_toll_minor, and fare-presets.ts:337 explicitly says "No default toll is assumed anywhere — tolls are route-specific." No toll-gate geofences, no route-crossing detection, no per-gate receipt line. STRONG · M. VERIFIED: TollGuru UAE

AE-4 · No Makani number support. Makani is Dubai Municipality's 10-digit entrance-level geo-address, accepted by Amazon.ae, Noon, Talabat and Deliveroo; Dubai riders type the code rather than describing a building. There is no Makani field or lookup — and no address-input plugin slot that could host one (the same slot would serve other national addressing schemes). This is the thing a Dubai buyer notices in the first demo. STRONG · S. VERIFIED: NextBillion

AE-5 · e-invoicing arrives 2026–27. The UAE is adopting a 5-corner Peppol DCTCE model with PINT AE XML through an Accredited Service Provider: pilot 1 Jul 2026, businesses ≥AED 50m must appoint an ASP by 30 Oct 2026 and go live 1 Jan 2027, SMEs Jul 2027. Announced scope is B2B and B2G — B2C ride receipts are probably outside the first waves, but RideKit ships corporate accounts, and those invoices are B2B and squarely in scope. AE is currently engine: 'none'. STRONG, becoming a blocker above AED 50m · M–L (realistically an ASP hand-off plus PINT AE export, not a full network node). VERIFIED: Avalara

AE-6 · Possible live money bug — VAT on passenger transport. The AE preset charges 5% (rateBps: 500); UAE VAT law is understood to treat local passenger transport as exempt. If so, every UAE ride overcharges. UNVERIFIED — the search budget ran out before the FTA position could be confirmed. Do not act on this without checking the FTA public clarification. If it holds, the fix is S (config plus a per-service-class exemption flag).

Egypt

EG-1 · Law 87/2018 imposes 180-day retention and security-agency access. Operating without a cabinet permit is banned; the licence is 5-year renewable at EGP 30m (~$1.7m); companies must supply national security agencies with customer data and store user data for 180 days. RideKit has no retention engine, no lawful-disclosure export and no data-residency configuration. (The data-localisation/server-in-Egypt provision was reportedly softened in the final text — treat localisation as UNVERIFIED; retention and disclosure are verified.) This is also a sales-qualification finding: the EGP 30m licence means your Egyptian buyer is a large incumbent, not a startup. BLOCKER · M. VERIFIED: Library of Congress, IAPP

EG-2 · ETA e-invoicing covers services, and the B2C e-receipt mandate expanded from January 2025 — requiring POS/ERP integration with the ETA platform and real-time reporting. EG ships engine: 'none' with 14% VAT shown but never filed. BLOCKER · L. VERIFIED: Flick Network

Kuwait, Qatar, Oman

KW-1 · Resolution 893/2026 requires in-car cameras with ≥120-day retention and trip records on demand. MoI's resolution regulating app-based passenger transport requires an MoCI licence plus prior General Traffic Department approval and a physical office; all vehicles must carry cameras with recordings kept at least 120 days; and companies must keep digital records of all rides and hand data to authorities on request. RideKit has no media pipeline, no regulator-facing trip-record export and no retention policy engine. The camera half is hardware the buyer sources, but the platform must ingest and index it. BLOCKER · L (M if scoped to trip-record retention and export only). VERIFIED: Arab Times

QA-1 · Qatar is a closed market. Careem exited entirely in Feb 2023; Karwa/Mowasalat holds the exclusive taxi licence; the Ministry of Transport lists exactly seven authorised apps and warns of legal action against unlicensed operators. A Qatari buyer must be one of the licensed few — a sales-qualification finding rather than a build. Local acquiring specifics (NAPS) are UNVERIFIED. VERIFIED: Al Jazeera, The Peninsula

OM-1 · Oman ordered all street taxis onto licensed apps by 1 April 2025 — i.e. metered-taxi parity, which argues for the regulated-fare mode in AE-2. The market is consolidating fast (Yango acquired OTaxi in Apr 2025). Thawani is the CBO-licensed gateway and OmanNet is ~95% of cards; RideKit has neither. VERIFIED: Gulf News, Oman Observer

Morocco and Tunisia

MA-1 · Morocco has no legal basis for ride-hailing at all. In October 2025 the Ministry of Transport formally rejected licensing requests from ride-hailing apps; private drivers offering paid transport have "no legal basis" and face fines or imprisonment; only authorised tourist-transport operators can register vehicles. Apps operate in a grey zone regardless. This is a positioning finding, not a code gap: the viable Moroccan buyer is a licensed tourist-transport operator, and the product feature that actually fits the grey market — driver bidding — already ships. Market MA around the licensed-fleet and bidding angle rather than "launch your Uber". Size: S (docs). VERIFIED: Morocco World News

MA-2 / TN-1 · No French in the apps. MA and TN presets declare languages: ['en','ar'], and neither app ships an fr catalog — while the admin does. A Maghreb buyer gets Arabic/English apps and a French admin, which is exactly backwards. Effectively a blocker for a Maghreb demo. Size: S. CODE-VERIFIED; the necessity of French is a market norm rather than a statute (UNVERIFIED as a legal rule).

Region-wide

MENA-1 · No Apple Pay or Google Pay sheet. Google Pay went nationwide in Saudi on the mada rail in 2025; Apple Pay is widely used across the GCC and skews to higher spend. Cash is down to ~22% of B2C transactions in KSA and ~23% in UAE. Zero hits for applepay or googlepay. Importantly this is not a rail problem — Moyasar and Stripe both support these upstream — it is a missing native payment sheet in the apps. Related and code-verified: the rider's Stripe screen is a WebView loading Stripe.js, and the provider sets automatic_payment_methods: { allow_redirects: 'never' }, which structurally excludes redirect-based methods. STRONG, not a blocker · M. VERIFIED: Arab News

MENA-2 · No national digital identity (Nafath, UAE PASS, Absher). Nafath is Saudi's biometric-backed national SSO used by 500+ entities and mandated by the Digital Government Authority as the standard for online identity verification; UAE PASS is the UAE equivalent (OIDC, Emirates ID + face match) and RTA's own apps integrate it. RideKit has no OIDC identity-provider hook at all. Architecturally cheap to make pluggable now, expensive to retrofit. Whether it is legally mandated for private ride-hailing is UNVERIFIED. STRONG · M.

MENA-3 · No Ramadan or prayer-time awareness. Careem feeds prayer times and iftar timing into its ETA models, pauses delivery for 30 minutes at iftar, ships a Ramadan ride option, and doubles driver tips during Ramadan; demand shifts to ~3pm, then 5–8pm, then a post-Taraweeh peak. Zero hits for prayer, ramadan or hijri. This is a NICE-TO-HAVE that is also the highest-signal "built for our market" demo feature in the entire document, and it is cheap. Size: S–M. VERIFIED: McKinsey/Careem, Khaleej Times

MENA-4 · Arabic numerals are not the gap you would expect. The localisation consensus is that Latin digits are correct for product UI in the Gulf, and that mixing numeral systems in one interface is the classic avoidable mistake. RideKit uses Latin digits throughout — which is the recommended behaviour. Worth documenting as a decision rather than leaving it to look like an oversight. Hijri date display (distinct from numerals) is genuinely absent. NICE-TO-HAVE · S. VERIFIED: helw.net

MENA-5 · Women-only is close to right for Saudi. Uber launched a "Women Drivers" option in Saudi in July 2025 — female riders matched exclusively with female drivers at UberX pricing. RideKit already has driver-side women_riders_only opt-in, branding gating and matching tests. The narrow gap: Careem restricts its female drivers to female riders or families — that third state (a male-accompanied family booking) has no representation, and the feature is a global branding toggle rather than a per-market default. NICE-TO-HAVE · S. VERIFIED: Skift

Part 4 — Latin America (Brazil researched; the other six not researched)

Brazil — verified

BR-1 · São Paulo requires the operator to run an SFTP server and deliver a daily CSV to the city. Under Resolução SMT/CMUV 21/2019 a credentialed operator must stand up SFTP infrastructure the Prefeitura pulls from, aggregated by day, available by 06:00 Brasília time next day, as RFC 4180 CSV in UTF-8. RideKit has nothing — zero hits for SFTP or municipal reporting. No feed means no OTTC credential, which means you cannot legally operate in São Paulo. BLOCKER · M. VERIFIED: Resolução SMT/CMUV 21/2019. The exact field schema lives in Portaria SMT 124/2020 Anexos, which could not be opened — schema UNVERIFIED.

BR-2 · São Paulo charges a per-km "preço público" bought as kilometre credits. Operators buy créditos de quilometragem consumed per km driven (rates seen R$0.10–0.12/km, made progressive by market share). RideKit has no such concept — the ledger is a rider/driver wallet, not an operator→city credit balance. BLOCKER for SP · M. VERIFIED that the regime exists (Decreto 56.981/2016); but two outlets report TJ-SP suspended or cancelled the charge, and the date and current status are UNVERIFIED. Re-check before building. (CNN Brasil)

BR-3 · Municipal geofence odometry. Operators must measure kilometres driven inside vs outside CMUV-defined perimeters and report credits consumed. RideKit has zones and zone pricing, but distance is whole-trip — no perimeter-split odometry. STRONG (blocker in SP) · M. VERIFIED.

BR-4 · Registry IDs are not modelled. The operating company needs an OTTC credential; drivers must be in CONDUAPP and vehicles must hold a CSVAPP, and the OTTC is responsible for maintaining that data. RideKit stores documents but has no external-registry ID field on driver or vehicle, and no "is this driver CONDUAPP-current?" gate in dispatch eligibility. STRONG · S. VERIFIED. (Note: "CADMOB" is the wrong name — the instruments in force are OTTC / CONDUAPP / CSVAPP.)

BR-5 · Federal driver document set — see U8. Where a município regulates, Lei 12.587 arts. 11-A/11-B require ISS collection, seguro APP plus DPVAT, INSS registration as contribuinte individual, a CNH cat. B+ with the EAR annotation, and a certidão negativa de antecedentes criminais. Brazil currently gets KYC_LIGHT — two documents. BLOCKER · S. VERIFIED. (DPVAT was replaced by SPVAT in 2024–25; the current interaction is UNVERIFIED.)

BR-6 · São Paulo is also a competitor, and sets a female-driver km quota. The Prefeitura runs its own no-surge app, mobizapSP; and Decreto 56.981 obliges OTTCs to ensure a portion of monthly km credits is used on rides by female drivers. RideKit ships women-only rides but has no female-driver km-share metric. NICE-TO-HAVE (STRONG if audited) · S. VERIFIED.

BR-7 · NFS-e is a REST shim, not an integration. The provider posts JSON to {municipalityBaseUrl}/nfse with a Bearer token; real municipal NFS-e services are SOAP/XML with digital signing (ABRASF/GINFES). Without credentials it emits a deterministic hash-derived fake código de verificação — correctly marked local_only, so the product does not lie — but a buyer cannot issue a legally valid NFS-e out of the box, and marketing must not claim otherwise. Compounded by U6: a single cityCode per deployment. BLOCKER · L. CODE-VERIFIED.

Mexico — code-verified only

MX-1 · The CFDI provider cannot produce a stampable CFDI 4.0. The only buyer-side datum in the entire tax model is one free-text buyerTaxId varchar(60) (tax-invoice.entity.ts:56). There is no buyer name, no postal code, no régimen fiscal anywhere, and stampPayload() sends only Emisor.Rfc, Receptor.Rfc, ClaveProdServ, ClaveUnidad, SubTotal, Total — usoCFDI is computed into raw and never sent. It also posts JSON to {pacBaseUrl}/stamp with Basic auth, whereas real PACs (Finkok, Facturama, SW) are SOAP/XML with CSD certificate signing. CODE-VERIFIED. My understanding is that CFDI 4.0 requires the receptor's name, postal code and régimen fiscal to match SAT records or timbrado fails — but that requirement is UNVERIFIED because no search was possible. Treat as a strong lead, not a fact. If it holds: BLOCKER · M (plus a rider fiscal profile).

MX-2 · NOT RESEARCHED: the SAT platform ISR/IVA withholding regime and its monthly informative return; CDMX SEMOVI/ERT permits and the Fondo de Taxi aportación; the reported CDMX cashless requirement; SPEI/CoDi/DiMo/Mercado Pago adoption; CURP/RFC validation; C5 panic-button integration.

Colombia, Chile, Peru, Argentina, Ecuador — code-verified only

LATAM-1 · All five ship ['stripe','cash'] with tax.engine: 'none' (VAT shown but never filed: CO 19%, CL 19%, PE 18%, AR 21%, EC 15%). No PSE/Nequi/Daviplata/Bre-B, no Webpay/Khipu, no Yape/Plin, no MODO/Mercado Pago, no Payphone/Deuna. CODE-VERIFIED. Which rails dominate, and whether DIAN/SII/SUNAT/ARCA legally oblige a transport platform to file, are NOT RESEARCHED — and that second question is the highest-value unanswered item in this document, because it decides whether five markets are blocked or fine.

LATAM-2 · Spanish localisation is better than expected — downgrade this concern. One es.ts catalog at 635 keys, identical to en.ts, in competent neutral es-419 ("viaje", "conductor", "Pedir viaje"). pt.ts likewise complete. The only gap is per-variant catalogs — no Argentine vos, no Colombian "carro". Cosmetic. NICE-TO-HAVE · S. CODE-VERIFIED.

LATAM-3 · Emergency numbers are correct; police integration is what is missing. safety/emergency-numbers.ts carries accurate per-country rows (BR 190/192/193, MX 911, CO 123, CL 133/131/132, PE 105/106/116, AR 101/107/911, EC 911) with honest confidence comments. SOS dials and alerts the operator console; there is no feed to a municipal command centre such as Mexico City's C5 or Bogotá's 123. Whether any city mandates it is NOT RESEARCHED. NICE-TO-HAVE · M.

NOT RESEARCHED for these five: legal status of ride-hailing in Colombia; Chile's Ley EAT (registro RAT, professional-licence requirement, and the app's duty to verify — which would gate dispatch); Peru's Ley 31096; Argentine city-level bans and inflation-driven repricing; Ecuador's LOPDP enforcement. (For what it is worth on Argentina: fare tables are admin-editable per market and quotes snapshot the fare at booking, so manual bulk repricing works — there is simply no scheduled or index-linked repricing.)

Part 5 — Southeast Asia and Australia/NZ (code-verified baseline only — no web research was possible)

I will not invent regulatory findings for these seven markets. Indonesian commission caps, Vietnam's 2025 PDP Law, Malaysia's MyInvois phase dates and LTFRB circulars are exactly the fast-moving material where recalled detail is worthless and an invented URL is worse. What follows is the product-side half of each finding, established from source.

Market	Currency	Languages	Gateways	Tax
ID	IDR	en, id	stripe, cash	none / 11%
PH	PHP	en only	gcash, stripe, cash	none / 12%
MY	MYR	en only	stripe, cash	none / 6%
TH	THB	en, th	stripe, cash	none / 7%
VN	VND	en, vi	stripe, cash	none / 10%
AU	AUD	en only	stripe, manual	none / 10%
NZ	NZD	en only	stripe, manual	none / 15%

SEA-1 · No local e-wallet anywhere. The payments module contains exactly 12 providers; GCash is the only SEA-native one. Missing: GoPay, OVO, DANA, ShopeePay, QRIS (Indonesia's universal QR standard), Maya, GrabPay, Touch 'n Go, Boost, DuitNow/FPX, PromptPay, TrueMoney, MoMo, ZaloPay, VNPay, VietQR. In markets where e-wallets are the default payment method this is the same shape of problem as U4. CODE-VERIFIED; the dominance of each rail is UNVERIFIED.

SEA-2 · Philippines and Malaysia ship English-only apps despite both apps carrying 14 locales — the presets simply do not wire a local language in. No ms, no tl. CODE-VERIFIED.

SEA-3 · No two-wheeler trip model. bike exists only as a fare archetype (factor 0.45 in fare-presets.ts) and an icon key. There is no helmet or pillion handling, no per-market legal gating for motorcycle taxis, and — per the India finding IN-15 — no geography-scoped service kill switch, which is exactly what a market with a shifting bike-taxi legal status needs. In a region where the motorcycle taxi is the product, this is structural. CODE-VERIFIED.

SEA-4 · No per-trip government levy concept. The only levy occurrence in the backend is a prose comment in pricing.service.ts:238. This matters for the NSW and Victorian point-to-point transport levies, which an operator must collect per trip and remit. CODE-VERIFIED; the levy amounts and mechanics are NOT RESEARCHED.

SEA-5 · No concession/senior/PWD discount concept. Zero hits. Potentially significant for the Philippines if the statutory 20% discount extends to TNVS — UNVERIFIED.

SEA-6 · Wheelchair accessibility is a vehicle tag only — one of ['wheelchair','baby_seat','pet_friendly','extra_luggage'] service attributes. No WAV trip type, no accessible-booking flow, no subsidy-scheme handling, no fleet quota or reporting. CODE-VERIFIED.

Still open for these seven markets: Indonesian PM 118/2018 and ojek-online status, Kominfo/Komdigi PSE registration, the commission-cap regulation, UU 27/2022 enforcement; Philippine LTFRB TNVS accreditation, the fare matrix and surge cap, the Data Privacy Act's NPC registration and DPO duty, motorcycle-taxi legality; Malaysian APAD Intermediation Business licensing, PSV licences, Puspakom inspection, EVP, the 2025 e-hailing insurance rule, PDPA 2024 amendments; Thailand's 2021 legalising regulation and DLT app certification; Vietnam's Decree 10/2020 vehicle badge, the mandatory per-trip electronic invoice connected to the tax authority, and Decree 13/2023; Australian state accreditation and levies, GST-from-dollar-one for drivers, WAV mandates; NZ Small Passenger Services rules.

Part 6 — Africa (Kenya, Nigeria, South Africa, Ghana researched; Uganda and Tanzania not researched)

The free win — do this one first

AF-1 · Ghana and Uganda mobile money are one preset line away from working. The Flutterwave provider already sends payment_options: 'banktransfer,ussd,mobilemoneyghana,mobilemoneyuganda,card,account' (flutterwave-payment.provider.ts:124) — Ghana and Uganda mobile money are explicitly declared. It also already handles both currencies correctly: UGX is in the zero-decimal set (line 94) and GHS takes the standard exponent-2 path. But only the NG and KE presets list flutterwave; GH and UG ship ['stripe','cash'] and never touch it. Adding flutterwave to those two presets — ahead of stripe, per the resolver's most-local-first ordering — turns on mobile money in two markets using code that already ships. Size: S. CODE-VERIFIED end to end.

Kenya

KE-1 · ODPC data-controller registration is a precondition of the operator licence. The NTSA (Transport Network Companies, Owners, Drivers and Passengers) Regulations 2022 (LN 120/2022, in force Feb 2023) require a TNC, before licensing, to be a registered company, tax compliant, hold a physical Kenyan office, and be registered with the Data Commissioner as a data controller/processor. Annual licence KES 100,000. A Kenyan buyer cannot get licensed on this codebase — see U3. BLOCKER · L (rolls into the U3 build). VERIFIED: Kenya Law LN 120/2022, NTSA PDF

KE-2 · The 18% commission cap is suspended, not gone — and RideKit defaults Kenya to 50%. Reg. 9 capped platform commission at 18% of total trip earnings. On a Bolt petition the High Court blocked enforcement in Sept 2026 for want of a regulatory impact assessment — but suspended the declaration of invalidity for 12 months so the rules can be re-made. Draft amendment regulations plus a minimum-fare framework (KSh400–500 discussed against a ~KSh220 base today) are in public participation. RideKit's clamp machinery is right, but country-presets.ts:833 seeds commissionMaxBps: p.code === 'IN' ? 4000 : 5000 — every non-India market gets a 50% cap. Kenya needs 1800 bps, and the product needs a notion of a cap with an effective-date window. STRONG, becoming a BLOCKER when the re-made regs land · S to seed the values, M to add effective-date windows and an admin "regulatory cap" surface. VERIFIED: Business Daily, Techweez

KE-3 · Retention is now a constitutional question, and RideKit enforces none. The same ruling struck down NTSA's rule forcing platforms to retain detailed passenger/driver data for 3 years and surrender it on demand, calling it unconstitutional continuous surveillance. Meanwhile the ODPC has a draft transport-sector rule pushing mandatory local data storage for ride-hailing platforms (comment window closed 15 May 2026), with fines to KES 5m. RideKit declares retentionMonths on the market entity and dataResidency in CountryCompliance — for India only — and grep finds no purge, anonymise or scrub job. Retention is declarative decoration that nothing acts on. STRONG; BLOCKER if the localisation rule is finalised · M. VERIFIED: Techweez on local storage

KE-4 · M-Pesa: correction to my earlier baseline. Paybill vs Till is already supported — MPESA_TRANSACTION_TYPE switches CustomerPayBillOnline ↔ CustomerBuyGoodsOnline (mpesa-payment.provider.ts:281-285). The real gap is narrower and still real: no C2B registerurl with validation/confirmation callbacks, so a rider who pays the paybill from their own phone menu — the habitual Kenyan fallback when an STK prompt times out — is invisible to the system. Also no Ratiba standing order, no Pochi la Biashara, no USSD path. The provider's own header notes no transaction has ever been driven through the adapter. STRONG · M. CODE-VERIFIED.

KE-5 · NOT RESEARCHED: whether KRA's eTIMS electronic invoicing applies to ride-hailing and to driver earnings. Kenya is tax.engine: 'none' at 16% — VAT shown, never filed. If eTIMS covers ride-hailing this becomes a Kenya blocker on the same footing as the four built engines.

Nigeria

NG-1 · Lagos charges a flat ₦20 levy on every trip, and RideKit has no per-trip levy concept. Under the Guidelines for Online Hailing Business Operation of Taxi in Lagos State 2020, operators pay a flat ₦20 per trip "Road Improvement Fund" (this replaced a proposed 10% service tax), plus a licence of ₦10m (<1,000 drivers) or ₦25m (>1,000) with annual renewals. Enforcement is live — VIS impounded 241 unlicensed vehicles in Sept 2024. RideKit's fare breakdown has base, per-km, per-min, min-fare, commission and tax, but no statutory per-trip fee line and no trips-by-period remittance export, so a Lagos operator hand-reconciles trip counts to pay the state. (This is the same missing primitive as the NSW/Victoria point-to-point levies in SEA-4.) BLOCKER for Lagos · S–M. VERIFIED: Technext, TechCabal

NG-2 · NOT RESEARCHED: NDPA 2023 / NDPC registration thresholds for a "data controller of major importance", DPO duty, annual compliance-audit filing, breach-notice window, fines. Also unconfirmed: whether NIN verification is legally mandated for Lagos e-hailing drivers, and which identity vendors (Smile ID, Youverify, Prembly, Dojah, QoreID) dominate.

South Africa

ZA-1 · Dispatching an unlicensed driver is now a criminal offence — up to R100,000 or 2 years. The National Land Transport Amendment Act 23 of 2023 was gazetted with its e-hailing regulations on 12 September 2025, making e-hailing a recognised public-transport category. Reported requirements: vehicles must display branding, must have panic buttons installed, and operators must secure and verify driver operating licences through the Provincial Regulatory Entity. App developers who permit users to operate without an operating licence face a fine up to R100,000 or up to 2 years' imprisonment. Uber and Bolt filed with the NPTR against a reported 11 March 2026 deadline.

RideKit has document types and expiry tracking, and the panic-button requirement is already met by the existing SOS module. What is missing is precisely what the penalty attaches to: no operating_licence / PrDP document type, and no hard gate that blocks dispatch when it is missing or expired. Also no branding/decal compliance field. BLOCKER · M. VERIFIED: gov.za, SAnews

ZA-2 · NOT RESEARCHED: POPIA Information Officer registration, PAIA manual, prescribed data-subject-request forms, breach-notification timing, s69 direct-marketing opt-in, s72 cross-border transfer. Worth noting for a second pass: RideKit has a promo, referral and notifications stack with no marketing-consent flag — likely an s69 problem, but I will not assert it unverified. Also unverified: whether South African buyers treat third-party armed-response integration (AURA, Namola) as table stakes; RideKit's SOS fans out to trusted contacts by SMS and raises an operator incident, with no emergency-dispatch integration.

Ghana

GH-1 · Ghana legalised commercial motorcycles in December 2025 — a brand-new bike-taxi market RideKit cannot serve. Parliament passed the Road Traffic (Amendment) Bill on 11 Dec 2025, legalising commercial use of motorcycles, tricycles and quadricycles ("okada") subject to strict safety rules including mandatory protective gear, and lowering the commercial-driver age from 25 to 21. Over 1m riders were already operating informally.

In RideKit, bike is a fare archetype and an icon key, nothing more. Grep: helmet = 0 (the only hit is the Express security middleware), pillion = 0, boda = 0, okada = 0, motorcycle = 0. Two-wheeler logic exists only in the parcel vertical. There is no helmet or protective-gear attestation, no single-pillion rule, no bike-specific pricing floor, and — the same gap as India's IN-15 — no geography-scoped switch to turn bike taxis on or off, which is exactly what a region needs where bikes are legal in Kenya, Uganda, Tanzania and now Ghana but banned across most of Lagos. An icon is not a product. STRONG; BLOCKER for any Ugandan or Ghanaian buyer whose core business is bodas · L. VERIFIED: Ghana News Agency, Graphic

GH-2 · Ghana requires a Class C commercial licence and DVLA re-verification of every platform-onboarded driver. Any driver earning income from driving must hold a Class C licence, and when a platform registers a driver or vehicle it must bring the documents to DVLA for verification — DVLA describes this as a standing collaboration with the platforms. RideKit's KYC has a generic license document type with an expiry date but no licence-class attribute (market config sets doc types, not classes) and no external-verification hook, so the DVLA step lives entirely outside the product with no audit trail back to the driver record. STRONG · M. VERIFIED: GhanaWeb / DVLA

GH-3 · Ghana's DPC registration renews every two years and requires a gap-analysis report showing how the controller has complied; non-registration risks penalty units and up to 2 years' imprisonment. Beyond the missing U3 framework, there is no records-of-processing artefact from which such a report could be built. STRONG, rolls into U3 · S if U3 is built. VERIFIED: Ghana DPC

Region-wide

AF-2 · Not one African language ships in the mobile apps. All six presets are seeded languages: ['en'], and neither app carries Swahili, French, Afrikaans, isiZulu, Amharic, Hausa, Yoruba or Igbo. A buyer in Dar es Salaam or Kampala ships an English-only app to a Swahili-speaking driver base — and the driver app is the more acute problem, since driver literacy in English runs well below rider literacy. STRONG for KE/TZ/UG (Swahili) · M per language pair (the catalogs are structurally parallel with a parity test, so the mechanism is cheap; translation quality is the cost). CODE-VERIFIED. Whether any South African official-language provision legally binds a private app is UNVERIFIED and should not be asserted either way.

AF-3 · No offline or low-connectivity behaviour, and a fixed 6-second high-accuracy GPS ping. Grep across both apps for NetInfo, offlineQueue, persistQueue or low_data: zero hits (the offline matches are driver online/offline status strings). driver/src/lib/bg-location.ts:45-47 runs Location.Accuracy.High at timeInterval: 6000 / distanceInterval: 20. So there is no request queue that survives a tunnel or a dead cell, no degraded/low-data mode, no SMS fallback for trip state, no USSD or call-centre booking path — and a prepaid driver on a metered bundle burns data at a fixed cadence with no adaptive backoff. STRONG · M (offline queue + adaptive ping) / L (USSD or SMS booking). CODE-VERIFIED. The market-side evidence — 2G/3G share, data cost as a share of income, Android Go prevalence, whether Uber/Bolt/inDrive ship low-data modes — was lost entirely to the search cap and is the first thing to re-run.

AF-4 · Boda "float" model — the primitive exists, the gate does not. The prepaid driver-credit pattern common to boda operations needs a debt gate. RideKit's ledger does support negative driver balances (allowNegative/allowDebt in wallet.service.ts, used by the cancellation flow), so the primitive is there — but there is no rule that stops a driver accepting rides once they owe the platform. This is the same missing piece as U5. Whether that gate is expected in these markets is UNVERIFIED.

AF-5 · NOT RESEARCHED at all: Uganda and Tanzania. Ugandan ride-hailing and boda licensing, the digital-number-plate/ITMS mandate, DPPA 2019 and NITA-U registration, mobile-money tax. Tanzanian LATRA electronic-hailing regulations, the commission-cap figure and whether Uber's 2022 withdrawal reversed, PDPA 2022 and PDPC registration. Tanzania matters most here — it is the market most likely to have a harder commission cap than Kenya's.

Part 7 — Europe and North America (researched from primary statute; Italy and two sub-questions unresolved)

This region was researched by fetching primary sources directly — EUR-Lex, gesetze-im-internet.de, gov.uk, TfL, ILT, BOE, ARPE, the Conseil constitutionnel, CPUC, NYC TLC, ADA.gov, IRS and OQLF — so the citations below are statute and regulator text rather than commentary.

The headline: none of these eight is a "buy the zip and launch" market

In all eight the practical buyer is an already-licensed PHV, VTC, NCC or taxi operator replacing a dispatch system, never a would-be Uber. The product's job there is to be the dispatch, pricing, payment and — critically — compliance-evidence layer for a licence somebody else already holds. The compliance-evidence half is what RideKit does not have, and it is roughly four features that between them unlock six of the eight markets:

subject-rights machinery (U3),
an algorithmic-decision appeal flow with a human gate,
an auditable booking-receipt and return-to-base log,
a pluggable regulatory-export module.

Realistic: GB, US (outside NYC), CA (outside Quebec), ES, DE, FR. Aspirational: NL until the CDT integration exists; IT until the research is finished.

Cross-cutting EU law

EU-1 · The EU Accessibility Act catches ride-hailing — through the e-commerce limb, not the transport limb. Directive (EU) 2019/882 applies to consumer services provided after 28 June 2025. Road taxi/PHV is not in the transport list (Art 2(2)(c) covers only air, bus, rail and waterborne) — but Art 2(2)(f) covers "e-commerce services", defined in Art 3(30) as services provided at a distance through websites and mobile device-based services, at the individual request of a consumer, with a view to concluding a consumer contract. Booking a ride in an app is exactly that. Annex I §IV(g) additionally singles out the identification, security and payment functions as needing to be perceivable, operable, understandable and robust — and RideKit's payment screen is an HTML page inside a WebView, the least testable surface for precisely that function. BLOCKER for any EU buyer above microenterprise size · L. VERIFIED: Directive 2019/882

EU-2 · The EAA requires a published accessibility statement inside the T&Cs. Art 13: the provider "shall include the information assessing how the service meets the accessibility requirements ... in the general terms and conditions, or equivalent document." RideKit has no accessibility statement and no per-market T&C surface that could carry one. Its absence is the first thing an enforcement authority checks. BLOCKER · S. VERIFIED (same source, Art 13).

EU-3 · The microenterprise exemption is real, narrow, and worth stating in sales material. Art 4(5) exempts microenterprises providing services; Art 3(23) defines that as fewer than 10 staff and turnover or balance sheet ≤€2m. Art 32 also lets service contracts agreed before 28 June 2025 run to 2030. So your smallest EU buyers are lawfully exempt and your mid-size ones are not — a market-config flag and a line in the sales material, not a reason to skip EU-1. NICE-TO-HAVE · S. VERIFIED (Arts 3(23), 4(5), 32).

EU-4 · GDPR is the single biggest EU blocker — see U3. The minimum shippable set: consent capture with withdrawal; an in-app privacy notice (Arts 12–14); working access (15), erasure (17) and portability (20) endpoints; retention schedules with real deletion jobs; records of processing (30); breach notification "not later than 72 hours" (Art 33(1)); DPIA (35); DPO where required (37). BLOCKER · L. VERIFIED: GDPR

EU-5 · ePrivacy consent is separate from GDPR and bites the push token. Art 5(3) makes storing or accessing information in a user's terminal equipment conditional on consent, except where strictly necessary for the service requested. This is device-storage law, so it reaches SDK identifiers in a native app, not just web cookies. RideKit uses expo-notifications in both apps and — genuinely to its credit — ships no analytics SDK at all, so there is currently little to consent for. Transactional ride push is arguably strictly necessary; marketing push is not. STRONG, and a BLOCKER the moment a buyer adds Firebase or Sentry · M. VERIFIED: ePrivacy consolidated

EU-6 · As a source-code vendor you owe nothing legally — which is exactly why this kills sales. The buyer who deploys and operates is the controller; you never touch the data, so you are neither controller nor processor and no DPA with you is needed. GDPR only encourages you: Recital 78 says producers "should be encouraged ... to make sure that controllers and processors are able to fulfil their data protection obligations." RideKit currently ships a product in which the controller cannot fulfil them, because the endpoints do not exist. The honest listing claim would be "GDPR-ready toolkit, buyer is controller" — and you cannot make it today. Commercial BLOCKER; covered by the U3 build. VERIFIED (Recital 78).

EU-7 · From 2 December 2026, a human must make every driver deactivation. Directive (EU) 2024/2831, transposition deadline 2 Dec 2026 (Art 29(1)). Art 10(5): "Any decision to restrict, suspend or terminate the contractual relationship or the account of a person performing platform work ... shall be taken by a human being." Art 11(1) requires a written statement of reasons delivered at the latest on the date it takes effect (including for refusing payment for work done); Art 11(2) gives the driver a right to demand review with a substantive reply within two weeks; Art 11(3) requires rectification within two weeks or compensation; Art 12(5) requires effective reporting channels for violence and harassment.

RideKit has an @Audited interceptor and an audit log — a good foundation — but no driver-facing appeal flow, no statement-of-reasons template, no two-week SLA clock, and no human-actor assertion on suspension paths. BLOCKER from Dec 2026 · M. VERIFIED: Directive 2024/2831

EU-8 · Driver data portability, including ratings and reviews, must be a free in-app tool. Art 9(6) gives drivers portability of data generated through their work "including ratings and reviews", requires the platform to provide tools free of charge, and to transmit directly to a third party on request. RideKit has nothing. BLOCKER from Dec 2026 · M. VERIFIED (Art 9(6)).

EU-9 · An "explain the algorithm" document, on day one and on every change. Art 9(1)–(3) requires written, plain-language disclosure of: that automated monitoring/decision systems are used; the categories of data monitored; the categories of decision taken; the main parameters and their relative importance, including how the driver's own behaviour influences decisions; and specifically the grounds for account restriction, suspension, termination and refusal of payment. Delivered by the first working day, before any change, and on request — and Art 9(5) extends it to candidates before selection begins. RideKit runs dispatch scoring, ratings, incentives, quests, a heatmap and bidding, and documents none of it to the driver. BLOCKER from Dec 2026 · M. VERIFIED (Art 9).

EU-10 · Surprising, and it inverts U9: biometric driver identity checks are BANNED in the EU. Art 7(1)(f) prohibits platforms from processing biometric data of a person performing platform work "to establish that person's identity by comparing that data to stored biometric data in a database." Art 7(2) extends this from the start of recruitment. Also banned: emotional or psychological state (a); private conversations, explicitly including exchanges with other platform workers and their representatives (b); collecting personal data while the person is not offering or performing work (c); and inferring protected characteristics (e).

Two consequences. First, the KYC roadmap needs a market flag — the Onfido/Persona-style selfie re-verification that India mandates (IN-13) would be unlawful for drivers in the EU. Build it pluggable and gated, not global. Second, never run automated moderation or scoring over in-app driver chat in the EU. And a genuine credit: RideKit is already Art 7(1)(c)-clean — bg-location.ts starts tracking on accept and stops on complete/cancel, and home.tsx pings only while online. STRONG — it prevents a costly wrong build · S (a config guard). VERIFIED (Art 7).

EU-11 · Neither the DSA nor the P2B Regulation applies — a real de-scoping win. Both are scoped to information society services (DSA Art 3(g); P2B Art 2(2)(a)). In C-434/15 Elite Taxi (Grand Chamber, 20 Dec 2017) the Court held a smartphone service connecting drivers with passengers is "inherently linked to a transport service" and "must be classified not as an information society service ... but as a service in the field of transport." In C-62/19 Star Taxi App (3 Dec 2020) it held an app is an ISS where the provider "does not forward the bookings ..., does not determine the fare ... or collect it from the passengers ..., and exercises no control over the quality of the vehicles or their drivers."

RideKit dispatches, prices, collects the fare into a ledger wallet, and runs ratings and KYC — the opposite of Star Taxi App on all four counts. So a RideKit deployment sits squarely on the Elite Taxi side and no build is required: DSA ranking transparency and notice-and-action, and P2B's 15-day T&C notice, 30-day termination notice, internal complaint-handling and two-named-mediators obligations, all fall away. The flip side is that every national transport licensing regime applies in full, with no e-Commerce Directive country-of-origin shelter. Worth documenting · S. VERIFIED: C-434/15, C-62/19

United Kingdom

GB-1 · VAT is due on the full fare, not the commission — settled by HM Treasury in November 2025. After Uber London v TfL (2021) and Uber Britannia v Sefton (2023) the PHV operator contracts as principal. HM Treasury's consultation response (last updated 26 Nov 2025) states the government "will not amend VAT legislation to allow PHVOs to act as agents for tax purposes in all cases, nor will it introduce a new margin scheme or reduced rate", and will legislate to exclude PHV and taxi services from the Tour Operators' Margin Scheme — closing the Bolt TOMS route.

RideKit models base, per-km, per-minute, min-fare, waiting and toll, and has no principal-vs-agent switch, no VAT breakdown on the rider receipt, and no reverse charge on driver commission. Getting this wrong is a 20%-of-revenue error. BLOCKER · M. VERIFIED: HM Treasury consultation response

GB-2 · Driver vetting is a recurring, evidenced process, not a one-time upload. DfT statutory standards require an enhanced DBS check with both barred lists, and that all licensed drivers "evidence continuous registration with the DBS update service" so the authority can check "every 6 months" — drivers who do not subscribe must still be checked every 6 months. Operators and vehicle licensees need an annual basic disclosure. TfL adds an English Language Requirement at CEFR B1 plus the SERU assessment. RideKit has manual upload, an expiry sweep cron and a background-check flag. STRONG · M — needs a recurring re-check scheduler with distinct check types, evidence retention and an auto-suspend-pending-review path (which must still be human-confirmed under EU-7 in EU markets). VERIFIED: DfT statutory standards, TfL

Germany

DE-1 · PBefG §49(4) makes an auditable booking-receipt log a statutory feature. Mietwagen "may only execute transport orders that were received at the business premises (Betriebssitz) or at the operator's home", must "return immediately to the Betriebssitz" after each job unless a new order arrived before or during the trip (Rückkehrpflicht), and — decisively for software — the operator "must record the receipt of the transport order ... in books or electronically (including by means of an app-based system) and retain the record for one year." Acceptance, brokerage and advertising must not be confusable with taxi service.

RideKit has no booking-receipt ledger with a defined retention window, no return-to-base state or geofence, and no violation reporting. BLOCKER · M — an immutable order-receipt log (order id, timestamp, receiving premises, driver, vehicle) with 1-year retention and an inspector export, plus a return-to-base trip state with chained-booking exceptions. VERIFIED: PBefG §49

DE-2 · Municipalities can set minimum fares, and pooling carries a measured quota. §51a(1) lets the licensing authority "set tariff-related rules, in particular minimum fares" for Mietwagen in its district; §51a(2) makes them mandatory for pooled on-demand transport, keeping a gap above local public transport fares. §50(3) requires a Bündelungsquote — a pooling ratio "calculated as passenger-kilometres in relation to vehicle-kilometres" — monitored for up to five years, and §50(4) lets the authority impose accessibility, emission and even working-time/pay standards. RideKit has min_fare_minor as a commercial floor but no regulatory floor that promos and surge discounts cannot undercut, and pooled journeys exist with no pax-km/veh-km measurement. STRONG · M. VERIFIED: PBefG §51a, §50

France

FR-1 · Showing available cars on the map before booking is illegal in France — and RideKit is accidentally compliant. Art L.3120-2 III 1° of the code des transports bans operators and their intermediaries from informing a customer, before the booking, "by whatever means, of both the location and the availability" of a vehicle on a public road, unless the operator holds a taxi stationing authorisation. Upheld as constitutional — and the Conseil constitutionnel spelled out what remains lawful: informing the client of only the location or only the availability, and telling them the expected wait time.

RideKit is compliant today by accident: the rider app's only markers are pickup, stops, drop-off and the live driver marker after booking, and there is no nearby-drivers endpoint anywhere. The gap is the absence of a guard — nothing stops a buyer adding the industry-standard "cars near you" layer and being fined, and the ETA-only alternative is not documented as the France-legal pattern. (Note the direct tension with the docs/polish-audit.md recommendation to add nearby-driver markers to the rider's home map: that change must be market-gated.) STRONG · S. VERIFIED: Conseil constitutionnel 2015-468/469/472 QPC

FR-2 · France has its own return-to-base rule. Art L.3122-9: as soon as the pre-booked service is completed the VTC driver "is required to return to the operator's place of establishment, or to a place off the carriageway where parking is authorised, unless he can justify a prior booking or a contract with the end client." Declared constitutional. (Separately, L.3122-2, which restricted VTC pricing methods, was struck down — so time-and-distance pricing is fine.) BLOCKER · shared with DE-1 — one feature covers both markets. VERIFIED (same source).

FR-3 · France front-ran the Platform Work Directive by three years, with binding collective agreements. ARPE publishes VTC sector agreements homologated by ministerial decision, i.e. binding: a minimum income per ride (accord of 18 Jan 2023, homologated 17 Mar 2023, amended twice and re-homologated in Mar and Jun 2024); transparency of booking-centre operation and the conditions for suspension and termination (19 Sep 2023, homologated 13 Nov 2023); driver-revenue improvement (19 Dec 2023); and strengthening drivers' freedom to choose their rides (19 Dec 2023).

RideKit has no per-ride driver earnings floor — its fare floor is a rider-side minimum, not an earnings guarantee — and no suspension-transparency flow. Positively, the offer sheet already shows the drop-off address before accept, which supports the last agreement. The EU-7 suspension flow must land in France now, not in Dec 2026. BLOCKER · M. VERIFIED: ARPE VTC agreements

Spain

ES-1 · Every VTC trip must be contracted before it starts, with the evidence carried in the vehicle. Under the ROTT, VTC vehicles carrying non-company persons "may only circulate if it is justified that they are providing a previously contracted service"; the contract "must have been completed before the contracted service begins", and "the documentation evidencing that contracting must be carried on board the vehicle." VTC vehicles "may in no case circulate on public roads in search of customers". Prices are not administratively tariffed, but the operator must publish them.

RideKit has no per-trip electronic contract artefact, no offline on-board display for roadside inspection, and no published-tariff surface. BLOCKER · M. VERIFIED: ROTT consolidated

Related and VERIFIED: in C-50/21 Prestige and Limousine (8 Jun 2023) the Court held Art 49 TFEU does not preclude requiring a second, metropolitan VTC licence on top of the national one, but does preclude capping VTC licences at one thirtieth of taxi licences absent proof of coherence and necessity. The 1:30 ratio is wounded; the dual-licence scarcity is not. C-50/21

UNVERIFIED and material: whether each individual service must be pre-declared to a government registry before pickup (the comunicación previa under later Órdenes FOM), and the current status of Barcelona/Catalonia's 15-minute pre-contracting rule. The registry question would materially change the build.

Italy — the market that could not be verified, which is itself the finding

IT-1 · Legge 21/1992 is understood to govern NCC with a foglio di servizio, a duty to return to the rimessa between services, and the garage in the licensing municipality; recent instruments reportedly make the foglio di servizio electronic and add a national register (RENT). All of this is UNVERIFIED — normattiva.it renders via JavaScript, and gazzettaufficiale.it and camera.it both blocked automated access. Structurally it is the same feature family as DE-1 and ES-1, so it is probably cheap once those exist — but a mandatory electronic-register transmission would be a separate integration. Do not quote an Italian buyer until this is settled. Size if the register is real: M–L.

Netherlands — the blocker is being dismantled right now

NL-1 · The BCT hardware requirement ends, and the migration window opened on 1 July 2025. Dutch taxi drivers must register working and rest times with a prescribed means — historically the BoordComputer Taxi, "a certified device installed by an approved installation station", paired with a personal chauffeurskaart, retained 2 years and readable by the ILT. But per the ILT: "From 1 January 2028 the BCT will be replaced by a means that delivers to the Central Taxi Transport Database (CDT)", and "on 1 July 2025 a transition period began ... alongside the BCT, drivers may also use a means that delivers data to the CDT", running until 1 Jan 2028. For the CDT, operators "can use various means, including a device or smartphone apps from connected ICT service providers", and "the ILT also has direct access to this data."

This flips the answer to "does the on-board computer kill an app-only product?" It no longer does — provided you build CDT delivery and become an accredited ICT service provider. RideKit has no working/rest-time registration at all. BLOCKER today; a differentiator once built, because incumbents are locked to certified hardware. Size: L. VERIFIED: ILT working and rest times

United States

US-1 · New York City requires every licensed base to file trip records to a government spec. "Effective February 28, 2021, all TLC-licensed bases must submit trip records using the CSV format", and must "identify the driver and the vehicle that serviced each trip by including the driver and vehicle TLC license numbers" — bases are "no longer allowed to include the base's internal IDs." Submission is by SFTP or the TLC Upload Portal with a signed affirmation. The HVFHS licence (above 10,000 FHV trips per day citywide under one brand) adds a ten-file feed including driver payments and breadcrumbs (GPS traces).

RideKit has no regulator-export subsystem and no external regulator licence-number field on driver or vehicle. BLOCKER in NYC · M for base trip records, L for HVFHS. (NYC is effectively a separate product.) VERIFIED: TLC trip record submission, HVFHS

US-2 · California charges a statutory levy on every trip, and the fare engine has nowhere to put it. Under SB 1376, "beginning on July 1, 2019, transportation network companies are required to collect a ten cent ($0.10) fee on each TNC trip in California", funding on-demand WAV service; AB 1532, signed 1 October 2025, extends the programme to 1 January 2032. CPUC also requires TNC licensing, quarterly Access-for-All fee statements, quarterly and annual PUCTRA fees, a zero-tolerance policy, an accessibility plan, a driver training programme and DMV records checks.

RideKit's pricing has base, per-km, per-minute, min-fare, waiting and toll — no regulatory-levy line item, no jurisdiction-scoped surcharge, and no remittance ledger separate from commission. This is the same missing primitive as Lagos's ₦20 (NG-1) and Australia's state levies (SEA-4) — one build covers all three, plus Chicago, Seattle, Nevada and BC. BLOCKER in CA · M. VERIFIED: CPUC Access for All

US-3 · Wheelchair-accessible vehicles: the backend exists, the product does not. wheelchair is a real service attribute on vehicle-type.entity.ts, seeded in the CountryCompliance migration alongside baby_seat, pet_friendly and extra_luggage, and editable in the admin pricing page. But grep across mobile/ returns zero hits for wheelchair — there is no rider-facing way to request one, and no service-attribute surface in the rider app at all. The groundwork is done; the product is missing. STRONG, BLOCKER where a WAV mandate applies · S–M — a rider request surface, WAV-aware matching with a looser dispatch radius, WAV trip flagging for US-1/US-2 reporting, and a service-animal policy surface. CODE-VERIFIED.

US-4 · The US accessibility rule that actually reaches you is the one for city contractors. DOJ's Title II rule sets WCAG 2.1 Level AA for state and local government web content and mobile apps, and its private-sector reach is explicit: "If a city lets people pay for public parking using a mobile app, that mobile app must meet WCAG 2.1, Level AA even if the app is run by a private company." An Interim Final Rule published 20 April 2026 extended compliance to 26 April 2027 (populations ≥50,000) and 26 April 2028 (smaller entities). Private TNCs sit under Title III, which has no promulgated standard — only litigation risk. The moment a buyer runs municipal microtransit or paratransit under contract, WCAG 2.1 AA becomes contractual. STRONG · shared with EU-1 — one accessibility programme covers EU and US-municipal. VERIFIED: ADA.gov web rule

US-5 · 1099-K: the burden is smaller than most 2024-era guidance says. IRS guidance (reviewed 28 Jun 2026): TPSOs report on Form 1099-K when payments "exceed $20,000 in more than 200 transactions." RideKit generates no driver tax forms. The high threshold means most part-time drivers on a small fleet fall below it, making this a year-end reporting feature rather than a launch blocker. NICE-TO-HAVE · M. VERIFIED: IRS. UNVERIFIED: the 1099-NEC/MISC threshold for incentives and referrals, reportedly changed by the 2025 reconciliation act. Also UNVERIFIED: insurance period 1/2/3 limits and whether statute requires retaining an app-on / matched / passenger-aboard audit log.

Canada

CA-1 · Quebec: the contract must be handed over in French first, and RideKit has no French at all. Under the Charter of the French Language as amended by Bill 96, "since 1 June 2023, every new contract of adhesion must first be provided in French to the adhering party. After the French version is provided, the parties may choose to conclude the contract in another language if that is their express will." Bilingual delivery is acceptable, but "French must appear at least as prominently as any other language", by the same medium. A ride-hailing app's rider and driver terms are textbook contracts of adhesion. Businesses employing 25+ people in Quebec must also register with the OQLF for francisation (the 25–49 band from 1 June 2025).

The mobile apps ship 14 locales and none of them is French — the admin has fr.json, the apps do not. BLOCKER in Quebec · M (a French locale for both apps plus a French-first contract-presentation flow at signup). VERIFIED: OQLF contracts of adhesion

UNVERIFIED: Quebec Law 25 specifics (consent, portability in force Sept 2024, de-indexing, mandatory PIA, penalties) — legisquebec.gouv.qc.ca returned 502 and CanLII blocked access. It maps structurally onto EU-4, so the GDPR build largely covers it, but confirm the PIA and de-indexing obligations separately. Also unverified: Toronto PTC, BC Passenger Transportation Board and Quebec Loi 17 licensing specifics.

CA-2 · Canada's single tax rate is wrong. The preset carries one 13% rate (Ontario HST) although provincial rates run 5%–15%. A consequence of U6.

Payments — three code-verified defects in the Stripe path

PAY-1 · allow_redirects: 'never' structurally excludes everything Northern Europe uses. stripe-payment.provider.ts createIntent() sets automatic_payment_methods: { enabled: true, allow_redirects: 'never' }. The in-code comment is candid about the intent — a wallet top-up should complete in the sheet, not bounce the rider to a bank page — but the effect is to filter out every redirect-based method: iDEAL, Bancontact, Klarna, P24, SEPA direct debit. charge() separately hardcodes payment_method_types: ['card']. BLOCKER in NL, strong expectation in DE/FR · M. CODE-VERIFIED.

PAY-2 · The Apple Pay / Google Pay comment in the code is not true as written. Stripe.js renders Apple Pay only over a secure origin with a verified Apple Pay domain. pay-stripe.tsx renders the Payment Element inside a WebView fed by source={{ html }} — an origin-less document, so there is no domain to register and the wallet buttons will not appear. The code nonetheless comments that "Stripe.js handles cards + local wallets (Apple/Google Pay where available)". There is no @stripe/stripe-react-native dependency in either app. STRONG (wallet share is very high in the US and UK) · M — a native PaymentSheet integration, or serve the checkout page from an HTTPS origin you control. Correct the comment either way. CODE-VERIFIED.

PAY-3 · SCA/3DS works on top-up but silently stalls on server-initiated charges — this is a bug, not a gap. The top-up path is genuinely well built: confirmPayment({ elements, redirect: 'if_required' }) lets Stripe.js run the 3DS challenge in place, and the server re-verifies with verifyIntent() rather than trusting the client. But charge() creates a PaymentIntent with confirm: true and no return_url, no off_session, no setup_future_usage — and mapStatus() has no case for requires_action, so it falls through default: to 'pending'. Any server-initiated card charge that triggers 3DS becomes a permanently stuck "pending" with no path to completion. charge() also defaults the payment method to the literal Stripe test token 'pm_card_visa' when the caller supplies none, so a misconfigured production call charges a test card instead of failing loudly. BLOCKER the moment a buyer wants charge-at-drop-off rather than a pre-paid wallet · S–M. CODE-VERIFIED (stripe-payment.provider.ts:102, 111, 169-181).

PAY-4 · Four of the eight markets have no UI language — no de, fr, it, nl. Beyond translation, this needs register decisions (German Sie) and the French-first contract flow of CA-1. BLOCKER in DE, FR, IT, NL · M. CODE-VERIFIED.

Summary table — ranked by markets unlocked per unit of work

Ordered by value density, not by size. "Markets" counts preset markets where the item is a blocker or a strong expectation.

Rank	Build	Markets	Size	Why it ranks here
1	Terms + Privacy Policy links (U2)	37	S	Hours of work; currently gates every app-store submission and every consent claim
2	Add `flutterwave` to the GH and UG presets (AF-1)	2	S	The provider already declares `mobilemoneyghana` / `mobilemoneyuganda` and already handles GHS and UGX. Two markets go from cash-only to mobile money on a preset edit
3	In-app account deletion + web deletion URL (U1)	37	M	Nothing ships without it, on either store
4	India GST rate 18% → 5% (IN-1)	1	S	A one-line config fix that stops overcharging tax on every Indian ride
5	Per-market commission, surge and fare caps (U10, IN-2, KE-2)	37	S	The clamp machinery ships and is enforced at dispatch; only the values are generic. Today India permits an illegal 40% and Kenya a 50% take rate against an 18% statutory cap
6	French, Swahili, and the other missing app languages (U7, AF-2)	20+	S–M each	Unblocks the Maghreb, East Africa, and Western Europe demos; scaffolding is clean and parity-tested. The driver app matters more than the rider app here
7	Consent / DSAR / erasure / export / retention core (U3)	37	L	One build satisfies DPDP, GDPR, LGPD, PDPL ×2, Kenya's DPA (a licensing precondition), Ghana's DPC, Egypt's 180-day duty and the Maghreb declaration regimes
8	Local payment rails for the remaining cash-only markets (U4)	~20	M each	KNET, Thawani/OmanNet, CMI, Konnect, Paymob/Fawry, plus TZ mobile money
9	Per-trip statutory levy as a fare component + remittance report (NG-1, US-2, SEA-4)	8+	M	Lagos's flat ₦20, California's $0.10, and the NSW/Victoria point-to-point levies are one missing primitive on three continents. Also covers Chicago, Seattle, Nevada, BC
10	Fix the Stripe 3DS stall and the test-token fallback (PAY-3)	8+	S–M	`mapStatus()` has no `requires_action` case, so any 3DS-challenged server charge sticks at "pending" forever; and `charge()` silently falls back to the test token `pm_card_visa`. This is a bug, not a gap
11	A dispatch eligibility gate on document validity (ZA-1, GB-2)	8+	M	South Africa attaches a R100,000 fine or 2 years' imprisonment to dispatching an unlicensed driver; the UK needs 6-monthly DBS re-checks. The expiry engine already exists — it needs an `operating_licence` doc type and a hard block
12	Driver deactivation appeal flow with a human gate (EU-7, FR-3)	5, France now	M	From 2 Dec 2026 a human must make every restriction/suspension/termination, with written reasons and a 14-day review SLA. France's ARPE agreements already bind this today. The `@Audited` interceptor is a good foundation
13	Per-driver cash reconciliation loop (U5, AF-4)	~15 cash-heavy	M	The revenue mechanism in every cash-majority market; the ledger already supports driver debt, so this is a rule on an existing primitive
14	Accessibility conformance programme + statement (EU-1, EU-2, US-4, IN-12)	14+	L	One programme covers the EU Accessibility Act (live since Jun 2025), DOJ Title II for municipal contracts, and India's IS 17802 — where the CCPD has already acted against Ola Cabs
15	Driver safety centre (U11)	37	S–M	Backend already supports it — mostly client work
16	Rider-facing WAV request + accessible-vehicle matching (US-3)	14+	S–M	`wheelchair` is modelled in the backend and editable in the admin, but has zero hits in `mobile/` — no rider can request one. The groundwork is done
17	Per-market KYC document sets + licence class (U8, GH-2)	21	S	Brazil's insurance and criminal-record requirement is a verified blocker; Ghana needs a Class C attribute
18	Offline queue + adaptive location cadence (AF-3)	~20	M	No connectivity handling exists anywhere, and the driver app pings high-accuracy GPS every 6s on a prepaid bundle
19	Booking-receipt log + return-to-base state (DE-1, FR-2, ES-1, IT-1)	4	M	One feature family satisfies Germany's §49(4) one-year order log, France's L.3122-9 return duty, and Spain's on-board pre-contract evidence
20	Regulatory-export module (US-1, BR-1)	3+	M	NYC's mandatory TLC CSV filing and São Paulo's daily SFTP feed are the same pluggable subsystem — external licence-number fields, a scheduled exporter, submission tracking
21	Algorithm-disclosure + driver data portability (EU-9, EU-8)	5	M	Both bite from Dec 2026; the disclosure is largely a writing exercise over systems that already exist
22	UK principal-vs-agent VAT switch (GB-1)	1	M	Settled by HM Treasury Nov 2025: VAT on the full fare. Getting it wrong is a 20%-of-revenue error
23	Sub-national market configuration (U6)	6 regions	L	Hard blocker for Brazil; unlocks state-level India, US, CA, AU, MX — and fixes Canada's single-province tax rate
24	Pluggable identity verification — gated per market (U9, EU-10)	37	M	India mandates in-trip identity checks; Ghana requires DVLA re-verification; the EU prohibits biometric driver identity checks outright. Build the gate with the feature, never after
25	A real two-wheeler product + geography-scoped service switch (GH-1, IN-15, SEA-3)	12+	L	Bikes are the dominant mode across East/West Africa and SEA, Ghana legalised okada in Dec 2025, and India's bike-taxi legality flips state by state. Today `bike` is an icon
26	India MVAG compliance pack (IN-5 … IN-11)	1	L total	Grievance officer, training records, route deviation, VAHAN/SARATHI, insurance, complaint SLA — India is unsellable without most of it
27	EU payment methods — lift `allow_redirects: 'never'` (PAY-1)	5	M	iDEAL is close to mandatory in the Netherlands, and the current setting filters it out along with Bancontact, Klarna, P24 and SEPA debit
28	Driver subscription / zero-commission + UPI AutoPay (IN-16, IN-17)	1	M	Not regulatory, but it is the Indian business model; a commission-only product reads as obsolete there
29	Saudi WASL + real ZATCA Phase 2 (SA-1, SA-2)	1	L each	Vehicles cannot legally operate without WASL; and the `engine: 'zatca'` label is the one place the product overstates itself
30	Regulated-fare / minimum-fare / fixed-surcharge modes (AE-2, OM-1, DE-2, FR-3)	6+	M	Dubai caps the peak surcharge at a fixed AED 7.50, Hala runs no surge at all, German municipalities set statutory minimum fares, and France mandates a per-ride driver earnings floor. A multiplier-only model expresses none of them
31	Ramadan / prayer-time awareness (MENA-3)	8	S–M	Nice-to-have that is also the highest-signal "built for our market" demo feature in the document
32	Toll modelling + Makani-style address plugin (AE-3, AE-4)	1–3	M / S	Both are things a Dubai buyer notices in the first demo
33	São Paulo regulatory feed + km credits (BR-1, BR-2)	1 city	M each	Required to hold an OTTC credential — but re-check BR-2's suspension status first
34	Native Apple Pay / Google Pay sheet (MENA-1, PAY-2)	20+	M	The rails support it; the WebView has no secure origin, so the wallet buttons cannot render. Needs the native Stripe SDK, or a checkout page served from your own HTTPS origin
35	Netherlands CDT delivery + ICT-provider accreditation (NL-1)	1	L	Unsellable until built — and a durable differentiator once built, because incumbents are locked to certified BCT hardware
36	ONDC BPP adapter (IN-20)	1, niche	L–XL	Deliberately last: ONDC's mobility volume is metro/bus ticketing, not cab dispatch

Two items that are pure documentation, and worth writing this week

A market flag and a written rationale for France's pre-booking display ban (FR-1). RideKit complies today by accident; nothing stops a buyer adding a "cars near you" layer and being fined.
A note that the DSA and P2B Regulation do not apply (EU-11). It de-scopes a large amount of imagined work, and it is the kind of thing a buyer's counsel will ask about in the first call.

Questions worth answering before you build anything

Each of these decides whether an item above is a build or a footnote, and none needs more than an hour with a working search budget.

Do Colombia, Chile, Peru, Argentina and Ecuador legally require a transport platform to file electronic invoices? Five markets hang on it and it was never researched.
Is UAE local passenger transport VAT-exempt? If it is, the AE preset is overcharging 5% on every ride today — a live money bug, not a feature gap.
Is São Paulo's per-km charge still suspended by TJ-SP? Determines whether BR-2 is a build or a footnote.
Does KRA's eTIMS apply to ride-hailing in Kenya? If yes, Kenya joins India, Saudi, Mexico and Brazil as a market needing a real e-invoicing engine.
Does Stripe actually onboard merchants in Ghana, Uganda and Tanzania? If not, those three presets currently offer local buyers nothing but cash, which upgrades U4 from serious to critical for them.
What is Tanzania's LATRA commission cap? It is the market most likely to have a harder cap than Kenya's 18%, and it was never researched.
Does CFDI 4.0 require the receptor's name, postal code and régimen fiscal to match SAT records? If yes, MX-1 is a blocker; the code half is already verified.
Is Italy's electronic foglio di servizio and the RENT national register real and mandatory? If the register requires transmission, Italy becomes an integration rather than a variant of the German build.
Does Spain require each individual VTC service to be pre-declared to a government registry before pickup? This would materially change the ES-1 build.

What would make this document complete

A second pass with a raised CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION, covering, in priority order:

Mexico — the largest fully-unresearched market, and one where a code-verified blocker (MX-1) is already sitting there waiting for confirmation.
Indonesia, Philippines, Vietnam — three large two-wheeler-and-e-wallet markets with zero coverage. Vietnam's mandatory per-trip electronic invoice connected to the tax authority is the specific thing to check first.
Italy, which is the only European market left unresolved, plus the two open European sub-questions above (Spain's registry, Quebec's Law 25).
Uganda and Tanzania, then Colombia, Chile, Peru, Argentina, Ecuador.
Australia and New Zealand — the levy mechanics, GST-from-dollar-one for drivers, and WAV mandates.
Low-connectivity market evidence for Africa and South Asia — 2G/3G share, data cost as a share of driver income, Android Go prevalence, and whether the incumbents ship low-data modes. This determines how hard to push AF-3.

A practical note for whoever runs that pass: the Europe agent got further than any other precisely because it stopped using WebSearch and fetched primary sources directly with curl — EUR-Lex, gesetze-im-internet.de, gov.uk, BOE, ARPE, CPUC and ADA.gov all serve clean HTML. Statute text is also better evidence than commentary. That is the method to repeat.

source: docs/country-gaps.md (ships identically in the product zip)

Country gaps — what RideKit is missing, market by market

Read this first: research coverage is uneven, and I am not going to hide it

The one-minute version

Part 1 — Universal findings (all 37 markets, no research required)

U1. No in-app account deletion — the apps cannot be published

U2. Terms and Privacy Policy are unlinked text

U3. No consent, DSAR, erasure, export or retention machinery

U4. 30 of 37 markets have no local payment rail

U5. No cash-collection loop — in cash-majority markets this is the whole revenue mechanism

U6. One market row per country — sub-national rules cannot be expressed

U7. 17 of 37 markets ship English-only apps

U8. 21 of 37 markets get a two-document KYC set

U9. No identity verification anywhere — KYC is upload-and-eyeball

U10. Assets you already have that this document should not double-count

U11. The driver has almost no safety surface

Part 2 — India (researched in full)

Money bugs (fix first — these are wrong today, not merely missing)

Missing compliance machinery

Commercial, not regulatory

Already fine in India, do not rebuild

Part 3 — MENA (researched in full)

Saudi Arabia — the most regulated market in the set

UAE

Egypt

Kuwait, Qatar, Oman

Morocco and Tunisia

Region-wide

Part 4 — Latin America (Brazil researched; the other six not researched)

Brazil — verified

Mexico — code-verified only

Colombia, Chile, Peru, Argentina, Ecuador — code-verified only

Part 5 — Southeast Asia and Australia/NZ (code-verified baseline only — no web research was possible)

Part 6 — Africa (Kenya, Nigeria, South Africa, Ghana researched; Uganda and Tanzania not researched)

The free win — do this one first

Kenya

Nigeria

South Africa

Ghana

Region-wide

Part 7 — Europe and North America (researched from primary statute; Italy and two sub-questions unresolved)

The headline: none of these eight is a "buy the zip and launch" market

Cross-cutting EU law

United Kingdom

Germany

France

Spain

Italy — the market that could not be verified, which is itself the finding

Netherlands — the blocker is being dismantled right now

United States

Canada

Payments — three code-verified defects in the Stripe path

Summary table — ranked by markets unlocked per unit of work

Two items that are pure documentation, and worth writing this week

Questions worth answering before you build anything

What would make this document complete