Scam posts, fake investment adverts and impersonation accounts are now regulated harms in the UK, and platforms that carry them have legal duties to find, limit and remove them. The Online Safety Act 2023 (OSA) tackles fraud through two separate routes: the illegal content duties that apply to every regulated user-to-user and search service, and an additional fraudulent advertising duty that applies only to the largest "categorised" services. This guide explains who each route catches, what Ofcom expects, where the timeline stood when this page was checked (8 November 2026), and how trust and safety, fraud and security teams can build a defensible compliance programme. It is written for compliance leads, fraud and trust and safety managers, and the security teams who own account integrity. For the Act as a whole, see the UK Online Safety Act.
Key takeaways
- Two duties, two scopes. Fraud offences are priority illegal content for every in-scope service, while the paid-for fraudulent advertising duty in sections 38 and 39 applies only to Category 1 and Category 2A services.
- The offence list is specific. The fraud duties are anchored to named offences: Fraud Act 2006 sections 2, 4, 7 and 9, FSMA 2000 sections 23 to 25 and Financial Services Act 2012 sections 89 and 90, plus proceeds of crime offences as priority illegal content.
- Illegal content duties already bite. Risk assessments were due by 16 March 2025 and Ofcom's illegal harms codes measures applied from 17 March 2025, including a dedicated reporting channel for organisations with fraud expertise.
- Advertising codes are still in draft. Ofcom published its register of categorised services and 34 draft fraudulent advertising measures on 10 July 2026; the consultation closed on 2 October 2026 and the final statement is expected by mid-2027 at the latest.
- Penalties are revenue based. Ofcom can fine up to the greater of £18 million or 10% of qualifying worldwide revenue, so fraud controls now carry board-level regulatory risk, not only reputational risk.
Scope: who and what is covered
The OSA regulates user-to-user services (where users can share content that other users encounter) and search services, including services based outside the UK that have links with the UK. Fraud sits inside the Act in two places, and the first compliance decision is working out which of them applies to you.
Route 1: fraud as priority illegal content
Schedule 7 of the Act lists the priority offences. The fraud and financial services entries are paragraph 32 (Proceeds of Crime Act 2002 sections 327 to 329, money laundering), paragraph 33 (Fraud Act 2006 sections 2, 4, 7 and 9), paragraph 34 (the Scottish offence of articles for use in fraud under section 49(3) of the Criminal Justice and Licensing (Scotland) Act 2010), paragraph 35 (Financial Services and Markets Act 2000 sections 23, 24 and 25) and paragraph 36 (Financial Services Act 2012 sections 89 and 90). Because these are priority offences, every regulated user-to-user and search service must assess and mitigate the risk of this content, regardless of size.
Route 2: the fraudulent advertising duty
Section 38 places a fraudulent advertising duty on Category 1 services and section 39 on Category 2A services. Under section 38(3) an advert is fraudulent if it is a paid-for advertisement, amounts to an offence listed in section 40, and is not regulated user-generated content. The section 40 list mirrors the fraud and financial services priority offences (without the proceeds of crime entries) and adds attempting, conspiring, encouraging, assisting, aiding and abetting.
| Category | Threshold (SI 2025/226) | Fraud duties that apply |
|---|---|---|
| Any regulated user-to-user or search service | No size threshold | Illegal content risk assessment and safety duties covering fraud priority offences |
| Category 1 (user-to-user) | More than 34 million average monthly active UK users with a content recommender system, or more than 7 million with a recommender system and the ability to forward or share user content | Illegal content duties plus section 38 fraudulent advertising duty for paid-for ads that are not regulated user-generated content |
| Category 2A (search) | Search engine with more than 7 million average monthly active UK users that is not a vertical search engine | Illegal content duties plus section 39 fraudulent advertising duty for paid-for ads in or via search results |
| Category 2B (user-to-user) | More than 3 million average monthly active UK users with direct messaging | Illegal content duties and other categorised duties; not the fraudulent advertising duty |
The threshold regulations were made on 26 February 2025 and came into force on 27 February 2025. Ofcom also tracks "emerging Category 1" services that reach 75% of the Category 1 user-number condition and meet a functionality condition; they do not yet carry the additional duties but should expect to.
Key obligations
Illegal content duties applied to fraud
- Risk assessment: assess how fraud and financial services offences could occur on the service, including through features such as anonymous accounts, direct messaging, marketplaces, payments and recommender systems. Ofcom's Register of Risks treats fraud as one of the listed kinds of illegal harm.
- Proportionate safety measures: take steps to prevent users encountering priority illegal content, minimise how long it is present, and remove it swiftly once aware. Ofcom's codes give a "safe harbour": following the recommended measures is treated as compliance, while alternative measures must be justified and recorded.
- Dedicated fraud reporting channel: the illegal harms codes require in-scope providers to set up a reporting channel for organisations with fraud expertise, so that trusted bodies can flag fraudulent activity quickly.
- Complaints and terms of service: users must be able to report suspected illegal content easily, and terms of service must explain how the provider protects users from it.
Fraudulent advertising duty (sections 38 and 39)
- Core duty: operate proportionate systems and processes designed to prevent users encountering fraudulent adverts, minimise how long any fraudulent advert is present, and swiftly take it down when alerted or otherwise aware.
- Transparency: section 38(2) requires terms of service to explain clearly any proactive technology used for this duty, including its kind, when it is used and how it works.
- Proportionality: section 38(5) points to the nature and severity of potential harm from different kinds of fraudulent advert and the degree of control the provider has over placement.
- UK scope: the duty extends only to the design, operation and use of the service in the United Kingdom (section 38(7)).
Ofcom's draft fraudulent advertising codes (July 2026)
Ofcom's consultation proposed separate codes for Category 1 and Category 2A services containing the same 34 measures. Where a provider has limited control over ad placement (for example, ads served through an intermediary), it should use all reasonable endeavours to implement a similar version of most measures.
| Area (measure codes) | What Ofcom proposes | Who typically owns it |
|---|---|---|
| Governance (A1 to A6) | Annual compliance review, a named accountable individual, written responsibilities, internal monitoring and assurance, a code of conduct and compliance training | Legal, compliance, board |
| Fraud indicators (B1) | A fraud indicator assessment that informs detection and review | Fraud and risk analytics |
| Ad moderation (C1 to C7) | Moderation function to review suspected fraudulent ads and take them down swiftly, internal ad policies, performance targets, prioritisation, resourcing and moderator training | Ads integrity, trust and safety |
| Reporting and complaints (D1 to D7) | Easy complaint routes, action on complaints and appeals, an exception for manifestly unfounded complaints and a dedicated trusted flagger channel | Trust and safety operations |
| Advertising libraries (E1) | A searchable library of adverts | Ads product, transparency |
| Testing (F1) | Testing ad generation tools, where the service offers them | AI and ads product, security testing |
| Terms of service (G1, G2) | Clear, accessible terms covering the substance of the protections | Legal, product |
| Account integrity (H1 to H5) | Advertiser account checks, financial services advertiser verification, account security, account takeover handling and reporting, advertiser bans | Identity, security, fraud |
| Account appeals (J1 to J4) | Appeal routes for advertisers whose accounts are actioned, with determination and follow-up | Advertiser support, legal |
These measures are drafts. Treat them as the clearest available signal of Ofcom's expectations, not as final law, and re-check the final statement when it is published.
Timeline and current status
| Date | Event | Status as checked 8 November 2026 |
|---|---|---|
| 26 October 2023 | Online Safety Act 2023 receives Royal Assent | Enacted |
| 10 January 2024 | Sections 38 and 40 commenced (SI 2023/1420) | In force, but the advertising duty only bites on services entered in the register |
| 27 February 2025 | Category threshold regulations (SI 2025/226) in force | In force |
| 16 March 2025 | Deadline for illegal harms risk assessments | Passed: assessments must be kept up to date |
| 17 March 2025 | Illegal harms codes measures apply, including the fraud reporting channel | Enforceable |
| 10 July 2026 | Ofcom publishes the register of categorised services and the fraudulent advertising codes consultation | Register published; check Ofcom's register for named services |
| October and November 2026 | Categorised services provide risk assessment records to Ofcom, then publish summaries (Category 1 in terms of service, Category 2A in a public statement) | In progress |
| 2 October 2026 | Fraudulent advertising consultation closes | Closed |
| By mid-2027 at the latest | Ofcom statement on final fraudulent advertising codes | Expected; codes then go through the parliamentary process |
A categorised service can appeal its categorisation to the Upper Tribunal within one month under section 167, and the additional duties are suspended while the appeal is pending. Under section 96(6) a service can ask to be removed from the register, and Ofcom must remove one that no longer meets the threshold conditions. legislation.gov.uk also shows later amendments to the Act that were not yet applied to the published text, so check the current consolidated version before relying on exact wording.
Enforcement and penalties
- Fines: Schedule 13 paragraph 4(1) sets the maximum penalty at the greater of £18 million or 10% of qualifying worldwide revenue for the most recent complete accounting period. Where group entities are jointly liable, the 10% is calculated on group revenue (paragraph 5(3)).
- Information and record keeping: Ofcom can require records of risk assessments and of the measures adopted. A provider that departs from the codes needs written evidence that its alternative measures are effective.
- Codes as evidence: the codes are the benchmark Ofcom will compare you against. Moderation backlogs, missed takedown targets and an unused trusted flagger channel are the kinds of operational evidence an investigation will look for.
- Interaction with financial regulation: because sections 23 to 25 of FSMA and sections 89 and 90 of the Financial Services Act 2012 are named offences, unauthorised financial promotions are squarely in scope. Verifying financial services advertisers (draft measure H2) is the practical control.
What it means for AI agents and non-human identities
Most fraudulent advertising and scam content at scale is produced and placed by automation: scripted advertiser sign-ups, API-driven campaign creation, compromised advertiser accounts and, increasingly, generative tools that write the copy and images. Several duties land directly on identity and machine access controls.
- Advertiser account checks (H1) and verification (H2): verification has to hold for programmatic sign-ups and agency or reseller accounts, not only for humans clicking through a form. Bind API credentials and ads API tokens to a verified advertiser entity. See the Identity Proofing and KYC Guide.
- Account security and takeover (H3, H4): scammers buy or phish established advertiser accounts because they carry trust and spending history. Strong authentication for advertiser consoles, short-lived API tokens and alerting on new payment methods or sudden campaign changes are the core controls. See the Account Takeover Prevention Guide.
- Testing ad generation tools (F1): if your platform offers AI tools that write ads, test whether they can be prompted to produce impersonation, fake celebrity endorsements or unauthorised investment promotions, and log tool use per advertiser identity. See the Deepfake and AI Impersonation Guide.
- Bots and fake accounts in user content: the illegal content duties cover scam posts and direct messages generated by bot networks. Bot detection and sign-up fraud controls form part of the risk mitigation you can evidence. See the Bot Management Guide and the Fake Account Creation and Sign-up Fraud Guide.
- Agents acting for advertisers: where AI agents create or manage campaigns through APIs, treat each agent as a non-human identity with its own credentials, scoped permissions and audit trail, so that a banned advertiser cannot return through a new agent key.
Compliance steps
- Confirm your category. Check the Ofcom register and your monthly active UK user counts against SI 2025/226. If you are near a threshold, plan as if you will be categorised.
- Refresh the fraud section of the illegal content risk assessment. Map each Schedule 7 fraud and financial services offence to the features that enable it (marketplaces, messaging, groups, payments, ads) and record likelihood, impact and existing controls.
- Stand up or test the fraud reporting channel. Agree intake formats and response targets with trusted flaggers such as banks and fraud bodies, and measure turnaround.
- Gap-assess against the draft advertising measures. For categorised services, score each of the 34 draft measures as met, partly met or not met, name an owner, and pay early attention to governance (A1 to A6), advertiser verification (H1, H2) and the ad library (E1), which take longest to build.
- Harden advertiser identity and access. Enforce phishing-resistant MFA on advertiser and agency accounts, scope and rotate ads API tokens, and link every campaign to a verified legal entity.
- Write proactive technology into the terms of service. Section 38(2) requires a clear explanation of any automated detection used for fraudulent ads.
- Build the evidence pack. Keep takedown times, moderation decisions, appeal outcomes and test results in a form you can give Ofcom on request.
- Track the final codes. Assign someone to re-check the Ofcom statement (expected by mid-2027) and update the gap assessment when it lands.
Mapping to security frameworks
| OSA requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Understand legal duties and categorisation | GV.OC-03 | None specific |
| Accountable individual and written responsibilities (A2, A3) | GV.RR-02 | None specific |
| Fraud risk assessment and fraud indicator assessment (B1) | ID.RA-03 | SI-4 System Monitoring |
| Advertiser checks and verification (H1, H2) | PR.AA-01 | IA-12 Identity Proofing |
| Moderation monitoring and evidence for Ofcom | ID.RA-03 | AU-6 Audit Record Review, Analysis, and Reporting |
| Trusted flagger channel and coordinated response | RS.MA-01 | None specific |
Metrics that show the programme works
- Median time to takedown for confirmed fraudulent adverts and scam posts, from first report or detection.
- Proactive detection rate: share of removed fraudulent ads caught before any user report.
- Trusted flagger turnaround: time to action reports from the dedicated fraud channel.
- Repeat advertiser rate: banned advertisers who return through new accounts or API keys.
- Verified financial services advertisers as a share of all financial services ad spend.
Common failure patterns
- Treating fraud as an ads-only problem: smaller services assume the OSA fraud duties do not apply because they are not categorised, but fraud is priority illegal content for every in-scope service.
- Verifying the first login only: advertiser checks at sign-up are undone when established accounts are taken over and resold, which is why draft measures H3 and H4 exist.
- An unloved trusted flagger inbox: a reporting channel exists but has no service level, owner or feedback loop, so banks stop using it.
- Undocumented alternative measures: providers depart from the codes without recording why their approach is equally effective, losing the safe harbour.
- Ignoring generative ad tools: platforms add AI copy and image tools for advertisers without testing them for impersonation and false endorsements.
Practitioner checklist
- Record your OSA category, the user counts behind it and the date checked.
- Map each Schedule 7 fraud and financial services offence to service features in the risk assessment.
- Run the dedicated fraud reporting channel with a named owner and response targets.
- Gap-assess the 34 draft fraudulent advertising measures if you are Category 1 or 2A.
- Name the individual accountable for fraudulent advertising compliance.
- Enforce phishing-resistant MFA and scoped, rotated API tokens for advertiser accounts.
- Verify financial services advertisers before their ads run.
- Describe proactive detection technology in the terms of service.
- Keep an evidence pack of takedown times, decisions, appeals and tool testing.
- Diary a review when Ofcom publishes the final advertising codes.
Standards and references
- legislation.gov.uk: Online Safety Act 2023, section 38
- legislation.gov.uk: Online Safety Act 2023, section 40
- legislation.gov.uk: Online Safety Act 2023, Schedule 7 priority offences
- legislation.gov.uk: Online Safety Act 2023, Schedule 13 penalties
- legislation.gov.uk: Category 1, Category 2A and Category 2B Threshold Conditions Regulations 2025
- Ofcom: Consultation on Fraudulent Advertising Codes of Practice
- Ofcom: Fraudulent advertising codes, summary of proposals
- Ofcom: Protecting people from illegal harms online, overview
Related NHI Mgmt Group resources: UK Online Safety Act · Digital Services Act Security Obligations Guide · Authorised Push Payment (APP) Fraud Guide · Ad fraud and connected TV ad fraud. This guide summarises the fraud provisions of the UK Online Safety Act 2023 and Ofcom's guidance as checked on 8 November 2026 and is not legal advice.