An OnlyFans agency must verify every creator's identity and age (18+) against a government document, screen for sanctions/AML, keep §2257-style records of who was verified and when, capture documented consent, and protect personal data — all before any content goes live. The safest rule is simple: verify first, post second.
Here is the compliance checklist, in plain English, and what each item protects you from.
What compliance does an OnlyFans agency need?
- Age verification (18+). Confirm age against a government ID for every creator, every time — no exceptions.
- Identity verification. A liveness check that the person matches the document, so you know the ID is really theirs.
- AML / sanctions screening. Check the creator is not on a sanctions or politically-exposed-person list before paying them.
- Record-keeping (§2257-style). Keep a durable record of the document, the match, and the date — retrievable on request.
- Documented consent. Capture that the creator agreed to the terms, with a timestamp.
- Data protection. Store identity documents securely and limit who can see them (GDPR and similar laws apply).
What is §2257 record-keeping?
It is the US requirement to keep records proving performers in adult content are of age, tied to a verified identity document. Even outside the US, keeping the same kind of record — document, match, date, retrievable — is the defensible standard. The key is that it is durable and produceable, not a screenshot someone might lose.
Age & identity: the non-negotiable step
Every serious problem an agency can have starts with an unverified person. Verifying age and identity against a government document, with a liveness match, at onboarding — before any content — removes the single biggest risk. Automate it so it happens the same way for every creator.
Data protection and consent
- Store documents securely and restrict access to who genuinely needs it.
- Capture consent with a timestamp, not a verbal "yeah, fine".
- Have a retention plan — how long you keep records and how they are deleted.
Frequently asked questions
Do OnlyFans agencies have to verify age?
Yes. Confirming every creator is 18+ against a government document, and keeping the record, is a legal and platform requirement — do it before any content goes live.
What is AML screening and do I need it?
AML (anti-money-laundering) screening checks a person against sanctions and PEP lists before money moves. It is good practice for any business paying individuals, including creator agencies.
How should identity documents be stored?
Securely, with access limited to those who need it, and with a retention and deletion plan. Treat them as sensitive personal data under GDPR and similar laws.
What records should an OnlyFans agency keep?
For each creator: the verified ID, proof the person matched it, the verification date, the signed agreement and captured consent — all retrievable on request.
BIGROS runs ID, age and liveness checks plus AML screening at onboarding and keeps the audit trail for you. See how it works.