Cross-Border Expansion Strategy Memorandum

1. Executive Summary

Marea Digital plans to establish wholly-owned local operating subsidiaries — sales, customer success and a country manager, three to eight staff each, a small local office and local-currency invoicing — in Spain, Denmark, Mexico and Brazil. This memorandum compares the four jurisdictions across the dimensions that will drive cost, timing and legal risk, and recommends a sequenced rollout rather than a simultaneous launch.

The four countries fall into two natural pairs. Spain and Denmark are EU/EEA jurisdictions: intra-EEA personal-data flows are unrestricted, foreign ownership of a private limited company is essentially unimpeded for our profile, incorporation is measured in days to a few weeks, and continuing compliance is predictable. Mexico and Brazil are attractive growth markets but carry materially heavier entry friction — mandatory foreign-investment registration (RNIE in Mexico; Banco Central/RDE in Brazil), a strong dependence on notaries and local counsel, tax and payroll systems that require in-country advisers from day one, and, in Brazil in particular, a lengthy multi-registry incorporation.

My central recommendation is to use direct-employment subsidiaries as the target structure everywhere, but to bridge the earliest hires in the slower jurisdictions through an Employer of Record (EOR) where that shortens time-to-revenue without creating permanent-establishment exposure that outweighs the benefit. On sequencing, I recommend the order Spain → Denmark → Mexico → Brazil, for the reasons developed in Part 9. This order front-loads the jurisdictions where we already have operational familiarity (Spain is our HQ) and legal simplicity (Denmark), builds a repeatable playbook on friendly ground, and defers the two registration-heavy Latin American entries — with Brazil, the most complex, last — until that playbook exists.

Every tax and indirect-tax observation below is issue-spotting only and is expressly flagged for confirmation by local tax advisers in each jurisdiction.

2. Assumptions

This analysis rests on the following stated assumptions. If any prove incorrect, the conclusions should be revisited.

1. Wholly-owned subsidiaries. Each local entity will be 100% owned within the Marea Digital group (directly or through the Delaware parent). We are not taking local partners, so joint-venture and minority-shareholder issues are out of scope.
2. Small operating footprint. Each subsidiary will have three to eight employees performing sales and customer success under a local country manager, plus a small leased office. No manufacturing, no regulated financial activity, no local hosting of the core platform.
3. Software/SaaS activity only. The business is B2B cloud project- and workflow-analytics software. It is not in a sector subject to special foreign-investment restrictions (defence, critical infrastructure, media, energy, telecommunications carriers, etc.) in any of the four countries. This assumption is important and is confirmed at the entity-formation stage in each jurisdiction.
4. IP stays at the US parent. Marea Digital, Inc. (Delaware) remains the group IP owner and licenses the platform down to each operating entity under an intercompany licence. The local subsidiaries are licensees and local go-to-market vehicles, not IP owners.
5. Local-currency invoicing. Each subsidiary invoices local customers in local currency (EUR in Spain, DKK in Denmark, MXN in Mexico, BRL in Brazil), which is why a local operating entity and a local bank account are needed rather than cross-border billing from Spain or the US.
6. Data architecture unchanged. The central customer-data platform remains hosted on AWS us-east-1, owned/operated by the US parent, with group data accessible to the US parent for product operations. Employee and customer personal data will flow to the Spanish and US entities and to the US cloud provider. We do not intend to localise data storage per country.
7. English working language of the file. This memo is in English; local filings, deeds and statutory documents will be in the local official language and will require certified translation where the group signs.
8. Reasonable capitalisation available. The group can fund the modest statutory minimum capital and initial operating capital of each entity, and can appoint group personnel as directors/administrators where a local resident representative is not strictly required.

Confidence note: Where I am not certain of a precise statutory citation, I refer to the governing regime and registry generally rather than invent a citation. All figures for minimum capital, thresholds and timelines should be re-confirmed with local counsel as they change.

3. The Threshold Choice — Subsidiary vs. Branch, and Direct Employment vs. EOR

3.1 Subsidiary vs. branch

For all four countries I recommend a subsidiary (a locally incorporated limited-liability company) rather than a branch of the Spanish or US entity. The reasoning is consistent across jurisdictions:

1. Liability containment. A branch is not a separate legal person; the foreign head office is directly liable for the branch's obligations. A subsidiary ring-fences local liability (employment, commercial, tax) within a separate entity.
2. Local-currency invoicing and banking. Our plan requires local-currency billing and a local bank account, which a subsidiary supports cleanly. A branch can do this too, but with more head-office entanglement.
3. Permanent-establishment clarity. A branch is, almost by definition, a permanent establishment of the foreign entity, dragging the head office into local corporate tax on the branch's profits. A properly run subsidiary is taxed as a local resident on its own margin. (Flagged for local tax advisers.)
4. Perception and hiring. Customers and employees in each market generally prefer to contract with, and be employed by, a local company.
5. Registration parity. In Mexico and Brazil, registering a branch of a foreign company is not meaningfully simpler than incorporating a subsidiary and, in Brazil, a branch of a foreign company requires federal executive authorisation, which is slow. The subsidiary route is the standard and faster path.

The trade-off is that a subsidiary carries its own governance and annual-accounts burden (Part 8). For a permanent go-to-market presence generating local revenue, that burden is justified.

3.2 Direct employment vs. Employer of Record (EOR)

Two questions must be separated: which entity ultimately employs the team, and how we bridge the gap before that entity exists and is payroll-ready.

The target state in every country is direct employment by the local subsidiary. That is cleanest for control, IP assignment, confidentiality, and long-term cost. However, an EOR — a third party that legally employs staff on our behalf in-country — is a legitimate bridge where incorporation and payroll registration will take weeks or months and we want the country manager selling sooner. My recommendations:

1. Spain: direct employment from the outset. The subsidiary (in fact the HQ jurisdiction) can be payroll-ready quickly; an EOR adds cost for no timing benefit.
2. Denmark: direct employment from the outset; Danish incorporation and registration are fast enough that an EOR is generally unnecessary.
3. Mexico: consider a short EOR bridge for the first one or two hires while the S. de R.L. de C.V. is incorporated and registered with SAT (RFC) and IMSS, then migrate to direct employment. Note that Mexico's 2021 labour-outsourcing reform sharply restricts subcontracting of core activities; an EOR arrangement must be structured carefully so it is a compliant employment service and not prohibited personnel outsourcing. (Confirm with Mexican labour counsel.)
4. Brazil: the strongest EOR case, because Brazilian incorporation plus CNPJ, municipal/state registrations and payroll onboarding is the slowest of the four. An EOR bridge lets us test the market and place a country manager while the Ltda. is built out. Migrate to direct employment once the entity is fully operational, mindful of Brazil's employee-protective labour regime and the risk that misclassified "PJ" (independent-contractor) relationships are recharacterised as employment.

Permanent-establishment caveat on EOR: an EOR solves employment compliance; it does not by itself prevent the foreign entity from creating a taxable permanent establishment if the EOR-employed country manager habitually concludes or negotiates contracts in the group's name. This must be watched wherever we use an EOR bridge. (Flagged for local tax advisers.)

4. Foreign-Ownership Restrictions and Foreign-Investment Reporting

None of the four countries prohibits 100% foreign ownership of a private limited company for a software/services business of our profile. What differs sharply is the reporting obligation that attaches to the inbound investment.

4.1 Spain

Foreign direct investment into Spain is generally liberalised. For an EU/EEA-controlled investor, the incorporation of a Spanish S.L. and its funding are ordinarily reportable to the investment registry (the D-1A declaration to the Registro de Inversiones of the Ministry) on a largely ex-post, statistical basis, rather than requiring prior authorisation. Because our group parent is US (non-EU), the FDI screening regime under RD 571/2023 (implementing the Law 19/2003 / RDL framework) must be checked: screening bites on specified sensitive sectors and on certain thresholds. A B2B analytics-SaaS sales subsidiary is unlikely to fall in a screened sector, but the analysis must be run before funding, because non-US ultimate control does not exempt a US-parented investment. (Confirm sector and threshold analysis with Spanish counsel.)

4.2 Denmark

Denmark is broadly open to foreign investment. Denmark operates an FDI screening regime (administered in coordination with the Danish Business Authority framework) focused on defence, critical infrastructure, critical technology and similar sensitive areas; an ordinary software-sales ApS is outside its mandatory-notification scope on our assumptions. There is no general foreign-capital registration comparable to Mexico's RNIE or Brazil's RDE. This is one of Denmark's principal advantages.

4.3 Mexico

Under the Ley de Inversión Extranjera, most economic activities — including software and business services — are open to 100% foreign investment. However, a Mexican company with foreign investment must register with the Registro Nacional de Inversiones Extranjeras (RNIE) at the Secretaría de Economía within the statutory window after incorporation, and must file periodic renewals/updates. This is an affirmative, recurring obligation, not a one-off. Restricted and reserved-activity lists exist but do not, on our assumptions, reach B2B SaaS. (Confirm activity classification with Mexican counsel.)

4.4 Brazil

Brazil permits full foreign ownership of a Ltda. for our activity, but imposes the heaviest reporting. Foreign capital entering Brazil must be registered electronically with the Banco Central do Brasil through the foreign-capital / electronic declaratory registration system (the RDE module), and the group must maintain that registration as capital moves. In practice this means the foreign shareholder(s) obtain a Brazilian taxpayer enrolment (CNPJ for the foreign entity, and CPF for individuals) and appoint a resident attorney-in-fact before capital is contributed. This is a gating step, not a formality. (Confirm current RDE procedure with Brazilian counsel.)

5. Incorporation Process, Governance, Local Representation, Banking and Capitalisation

5.1 Spain — Sociedad Limitada (S.L.)

Incorporation is governed by the Ley de Sociedades de Capital (RD Legislativo 1/2010) and completed by public deed before a notary and registration at the Registro Mercantil. Practical steps: obtain the tax identification (NIF) for the foreign shareholder(s), obtain a certificate of company-name availability, open a bank account and deposit the capital (the statutory minimum for an S.L. is low; the "successive formation" / reduced-capital route is also available), grant the incorporation deed before a notary, and register at the Registro Mercantil, followed by tax and social-security registration. Governance can be a sole administrator or a board; there is no requirement for a resident director, though foreign administrators need a NIF. Timeline is typically a couple of weeks once documentation and apostilled powers of attorney are in order. Notary involvement is mandatory; local counsel involvement is advisable but the process is well-trodden and predictable.

5.2 Denmark — Anpartsselskab (ApS)

Incorporation is administered by the Danish Business Authority (Erhvervsstyrelsen) and is largely digital. An ApS requires a modest minimum share capital, and registration produces a CVR number. Denmark is notably notary-light: formation is done through the Business Authority's online system rather than by notarial deed, which is a structural advantage over the civil-law-notary jurisdictions. Governance requires management (a director / management board); there is an EU/EEA residence consideration for management/founders that must be checked, but this is generally satisfiable within our group or via a management appointment. Bank-account opening and Danish AML/KYC onboarding are, in practice, the slowest part of a Danish setup, and should be started early. Overall Denmark is the fastest and lightest of the four to stand up.

5.3 Mexico — S. de R.L. de C.V.

Incorporation is governed by the Ley General de Sociedades Mercantiles (LGSM). The Sociedad de Responsabilidad Limitada de Capital Variable is a common vehicle for foreign-owned operating companies; "de Capital Variable" gives flexibility to increase/decrease capital without amending the base charter. Steps: obtain the company-name authorisation from the Secretaría de Economía; execute the incorporation before a notario público (or corredor público); register at the Registro Público de Comercio; obtain the tax registration (RFC) from SAT; register with the IMSS (social security) and applicable state payroll-tax authorities once there are employees; and file with the RNIE (Part 4.3). At least two partners are traditionally expected for an S. de R.L.; this is easily met with two group entities. A Mexican tax-domicile and, in practice, a local legal representative with an RFC and e-signature (e.firma) are needed for tax dealings. Notary dependence is high; local corporate and tax counsel are effectively required.

5.4 Brazil — Sociedade Limitada (Ltda.)

Incorporation is registered at the state Junta Comercial (commercial registry) and produces a federal taxpayer enrolment, the CNPJ. Before that, each foreign shareholder must be enrolled with Brazilian tax authorities (CNPJ for a foreign entity shareholder, CPF for foreign individuals) and must appoint a resident attorney-in-fact in Brazil with powers to receive service and manage the shareholding. The Ltda. must have at least one administrator resident in Brazil. After Junta Comercial registration come municipal and state registrations, the operating licence (alvará), and enrolment for the relevant taxes; foreign capital is registered with the Banco Central via RDE (Part 4.4). This is the most document-, notary/registry- and counsel-intensive of the four, and the resident-administrator and resident-attorney requirements mean we cannot run it purely with group personnel abroad.

5.5 Banking and capitalisation — common themes

In every jurisdiction, bank-account opening is a critical-path item because of AML/KYC on a foreign-owned entity: the bank will want the incorporation documents, beneficial-ownership evidence up to the Delaware parent, and often certified/apostilled and translated corporate documents. In Spain and Mexico capital is typically evidenced through the bank at incorporation; in Denmark capital is confirmed through the digital process; in Brazil capital contribution interacts with the RDE registration. Practical guidance: start KYC document assembly (apostilles, certified translations, group ownership chart, passports/IDs of signatories) before choosing incorporation dates, as this — not the registry itself — is usually what determines timing.

6. Tax and Indirect Tax — Issue-Spotting Only

The following is issue-spotting for the Board and is expressly flagged for confirmation by local tax advisers in each country. Nothing here is a tax opinion.

6.1 Cross-cutting issues

1. Intercompany IP licence and transfer pricing. Because IP stays with the Delaware parent and is licensed down, each subsidiary will pay licence fees/royalties or an intercompany service charge. Pricing must be at arm's length and documented; withholding tax on royalties, and its interaction with tax treaties, differs by country. This is the single largest recurring tax-structuring item and needs a coordinated transfer-pricing policy, not four separate improvisations.
2. Permanent establishment. As noted, an EOR bridge or a habitually-contracting country manager can create a PE of the Spanish or US entity even before or alongside the subsidiary. Contracts should be concluded by the local subsidiary once it exists.
3. Indirect tax on cross-border SaaS. Digital-services / SaaS supplies attract indirect tax in each market — EU VAT in Spain and Denmark, IVA in Mexico, and a combination of federal/state/municipal taxes in Brazil. Local-currency invoicing by a local entity is partly driven by these indirect-tax mechanics.

6.2 By country

1. Spain: corporate income tax on the subsidiary's profit; VAT (IVA) registration and periodic returns; withholding considerations on outbound royalties to the US parent (treaty-relieved but requires substantiation). EU VAT rules on B2B services generally shift accounting to the customer for cross-border intra-EU supplies, but domestic Spanish sales carry Spanish VAT.
2. Denmark: corporate income tax; Danish VAT (moms) registration and returns; similar EU B2B place-of-supply mechanics. Denmark's tax administration is efficient and digital, which lowers the ongoing compliance burden relative to Mexico and Brazil.
3. Mexico: corporate income tax (ISR); IVA; strict electronic-invoicing (CFDI) rules that a local entity must comply with from day one; payroll taxes and IMSS/INFONAVIT contributions; withholding on cross-border royalty/service payments to the US parent. The CFDI e-invoicing regime is a real operational obligation, not a formality. (Confirm with Mexican tax advisers.)
4. Brazil: the most complex indirect-tax environment — a layered system of federal, state and municipal taxes on services and revenue (and an in-progress consumption-tax reform), plus significant withholding and contribution obligations on remittances abroad. Brazilian tax compliance materially increases the ongoing cost of the entity and cannot be run without a local tax/accounting adviser. (Confirm with Brazilian tax advisers.)

7. Privacy and International Data Transfers

Our data architecture — a central customer-data platform on AWS us-east-1, group data accessible to the US parent, and employee/customer personal data flowing to the Spanish and US entities — is the same for all four subsidiaries and is the compliance thread that ties the whole expansion together.

7.1 EU/EEA (Spain and Denmark)

Spanish and Danish operations are governed by the GDPR (with Spain's LOPDGDD and Denmark's Data Protection Act layering national rules). The core issue is the transfer of personal data from the EEA to the United States (both the US parent's access and the AWS us-east-1 hosting). This requires a lawful transfer mechanism: reliance on the EU–US Data Privacy Framework where the US importer is certified, and/or Standard Contractual Clauses with a transfer impact assessment, plus intra-group data-processing/joint-controller arrangements. We will also need Article 30 records of processing, appropriate privacy notices for employees and customers, and a controller/processor mapping across Spain, Denmark, the US parent and AWS. Because processing is materially the same, we should build one intra-group data-transfer and DPA framework and reuse it, rather than reinventing per country.

7.2 Mexico

Mexico's data-protection law governs the private-sector processing and the international transfer of personal data, requiring appropriate notice (aviso de privacidad) and a transfer basis. Transfers to the US parent and to the US cloud provider must be covered by the privacy notice and by intra-group arrangements. The obligations are real but less prescriptive than GDPR.

7.3 Brazil

Brazil's LGPD is closely modelled on the GDPR, including provisions on international data transfer; the Brazilian authority (ANPD) has been developing the transfer-mechanism framework. Practically, our EEA transfer framework (SCC-equivalent contractual safeguards, transfer records, privacy notices) can be extended to cover the Brazilian entity with local-counsel adjustment. LGPD also expects an appointed person responsible for data processing (encarregado/DPO-equivalent).

Takeaway: the data-transfer work is front-loaded and reusable. Building the GDPR-grade transfer framework for the Spain/Denmark launches produces most of what Mexico and Brazil then need, which is an argument for doing the EU jurisdictions first.

8. Continuing Compliance Burden and Dependence on Notaries / Local Counsel

Entry cost is one-off; the continuing burden is what the Board will feel every year across (eventually) four entities. Ranking from lightest to heaviest ongoing burden on our assumptions:

1. Denmark (lightest): digital-first Business Authority filings, annual report, VAT/moms and payroll returns; low notary dependence; efficient administration.
2. Spain: annual accounts filed at the Registro Mercantil, corporate-tax and VAT returns, social-security filings, RNIE-equivalent D-1A/FDI touchpoints; moderate notary dependence for corporate changes; predictable.
3. Mexico: monthly/periodic SAT filings and CFDI e-invoicing, IMSS/payroll obligations, RNIE renewals, and notary involvement for most corporate changes; standing local corporate and tax counsel effectively required.
4. Brazil (heaviest): multi-layer federal/state/municipal tax compliance, ongoing Banco Central/RDE maintenance, resident administrator and resident attorney-in-fact, heavy accounting/bookkeeping obligations; continuous local counsel and accounting support is non-optional.

Notary/local-counsel dependence tracks the same ranking: Denmark is notary-light and can be substantially self-served with light local support; Spain needs a notary for the deed and key corporate acts but is routine; Mexico and Brazil require deep, ongoing notary/registry and counsel engagement from formation onward. The group should budget for retained local counsel and local accounting in Mexico and Brazil as a fixed cost, not an occasional one.

9. Proposed Rollout Order and Justification

Weighing entry friction, ongoing burden, data-compliance reuse, and our own operational familiarity, I recommend the sequence Spain → Denmark → Mexico → Brazil. The recommendation follows from the assumptions in Part 2; a different weighting of market-revenue urgency could change it, and I flag that below.

9.1 First — Spain

Spain is the natural first entity: it is our HQ jurisdiction, so we have the most operational and language familiarity; the S.L. formation under the LSC is well-understood; there is no resident-director requirement; and, critically, standing up Spain forces us to build the GDPR-grade EU→US data-transfer framework that every later entity reuses. The one item to clear early is the RD 571/2023 FDI screening check given the US ultimate parent, which we should run before funding.

9.2 Second — Denmark

Denmark is the lowest-friction of the remaining three: digital incorporation via Erhvervsstyrelsen (CVR), no separate foreign-capital registration, notary-light, and the lightest ongoing burden. Because Denmark is also EEA, it reuses the Spain data-transfer framework almost wholesale. Doing Denmark second lets us prove the "second-country" playbook — repeating the EU pattern once — before we take on the harder Latin American entries. The main early task is Danish bank-account KYC, which we start in parallel.

9.3 Third — Mexico

Mexico is the first of the two heavier entries. It requires notarial incorporation under the LGSM, SAT/RFC and IMSS registration, RNIE filing, CFDI e-invoicing and standing local counsel — materially more than the EU pair, but less than Brazil. Placing Mexico third means we tackle mandatory foreign-investment registration (RNIE) and a notary-heavy, tax-registration-heavy process once before facing Brazil's even heavier version. We plan a short EOR bridge for the first hire(s) to shorten time-to-revenue while the entity is built, migrating to direct employment and watching the labour-outsourcing and PE constraints.

9.4 Fourth — Brazil

Brazil is deliberately last. It has the most gating requirements (foreign-shareholder CNPJ/CPF enrolment, resident attorney-in-fact, resident administrator, Junta Comercial plus municipal/state registrations, Banco Central/RDE foreign-capital registration), the most complex tax and indirect-tax system, and the heaviest ongoing compliance and counsel dependence. By the time we reach Brazil we will have (a) a mature EU→US and Mexico data-transfer framework extensible to LGPD, (b) experience running a notary/registration-heavy Latin American entry from Mexico, and (c) a tested EOR-bridge-then-migrate pattern, for which Brazil is the strongest candidate. Attempting Brazil first would expose the least-prepared version of the group to the most demanding regime.

9.5 Where this order could change

This sequence optimises for legal simplicity and reusable compliance, front-loading easy wins and deferring risk. If the Board's priority is instead revenue capture in the largest growth market, and if Mexico or Brazil holds a time-sensitive commercial opportunity, an EOR bridge could let the country manager begin selling in that market immediately while the local entity is incorporated later in the legal sequence above. That decouples "start selling" from "finish incorporating" and is the pressure-release valve if the commercial and legal timetables conflict. I would not, however, change the incorporation order: Brazil should remain the last entity we fully stand up regardless.

10. Immediate Next Steps

1. Confirm the Part 2 assumptions with the Board, in particular that no sensitive-sector FDI screening applies (Spain RD 571/2023; Danish screening) and that our activity classification is unrestricted in Mexico (RNIE/Secretaría de Economía) and Brazil.
2. Instruct local corporate counsel in each jurisdiction and retained local tax advisers in Mexico and Brazil; confirm current minimum-capital figures, timelines and resident-representative requirements.
3. Begin the group KYC/apostille/translation pack now (group ownership chart to the Delaware parent, signatory IDs, powers of attorney), as bank onboarding is the true critical path.
4. Commission the intercompany IP-licence and transfer-pricing policy so it is in place before the first subsidiary starts invoicing. (Tax — flagged for advisers.)
5. Build the EU→US data-transfer framework (DPF reliance and/or SCCs + transfer impact assessment, intra-group DPA, records of processing) during the Spain launch, designed for reuse in Denmark, Mexico and Brazil.
6. Prepare a compliant EOR-bridge template for Mexico and Brazil, with the permanent-establishment and labour-classification guardrails identified in Part 3.2.

This memorandum is a strategic overview for internal decision-making. Each jurisdiction's implementation must be confirmed by local corporate counsel, and all tax and indirect-tax points must be confirmed by local tax advisers, before any filing or reliance.