Reading the threat, I notice than one important point is missed: the requirement to validate the customer country with two different methods and also save guard this evidence for a period of 10 YEARS...