Counsel BR deliverable: written legal opinion (LGPD + ROSCA classification + credit data)

[alrimarleskovar]

Problem

MAINNET_READINESS.md §6.1 marks "legal counsel review (US + BR jurisdictions)" as 🔵⛔ planned for Q3 2026. But there's no tracked issue for the actual deliverable — a written legal opinion letter from BR counsel addressing the three load-bearing legal questions.

What this blocks

Mainnet GA in BR. Without a written counsel opinion, we cannot confidently launch real-USDC pools to retail Brazilian users.

Proposed solution

Engage BR counsel (suggested firms: Mattos Filho, Pinheiro Neto, BMA — top-tier Solana/Web3 experience desirable) to deliver a written opinion covering:

1. ROSCA classification under BCB — is the RoundFi pool structure regulated as a consortium / cooperative / something else? Banco Central licensing requirements?
2. Behavioral attestations as "credit data" under LGPD — does on-chain attestation creation trigger LGPD data-controller obligations on RoundFi? Subject-rights flow (access, deletion)?
3. B2B oracle subscription as "credit data sharing" — Phase 3 B2B oracle returns score to neobanks. Does this trigger Bacen Resolution 4658 / Resolução BCB 405/2024 / LGPD restrictions?

Plus US counsel (parallel) on:

• CFTC/FinCEN status of behavioral-score data
• State-level money-transmission considerations for the protocol fee flow

Acceptance criteria

• BR counsel engagement letter signed
• Written opinion received (≥ 10 pages, addressing the 3 questions above)
• US counsel parallel opinion received
• Opinions stored in docs/legal/ (private — not in repo)
• Public-facing summary of legal posture added to docs/legal-overview.md
• MAINNET_READINESS.md §6.1 moved from 🔵⛔ to ✅

Estimated scope

Off-protocol — legal work, not code. 4-8 weeks of counsel engagement.

References

• MAINNET_READINESS.md §6.1
• Phase 3 B2B oracle plan: docs/pt/plano-b2b.pdf