New UK scam ad requirements: developing a proactive approach

At a glance

• The UK Online Safety Act introduces mandatory duties for some of the largest online services to prevent, minimise and act swiftly against paid-for fraudulent advertising.
• Over the summer, Ofcom consulted on its proposed framework for compliance, calling on platforms to “tackle [the] scourge of scam adverts”. This would ultimately require a proactive, service-wide response spanning governance, preventive controls, monitoring, external reports and transparency.
• The proposals are detailed and the consultation documents run to many hundreds of pages. In this article, we outline our view on six areas that in-scope platforms should consider to prepare effectively.
• While individual measures may change following consultation, the central direction is unlikely to shift substantially. Implementation could require significant changes to technology, processes and arrangements with third parties.
• With Ofcom’s final Statement expected by mid-2027 and only limited implementation time likely to follow, in-scope platforms should establish accountability, assess readiness and develop an implementation plan now.

Introduction

The UK Online Safety Act (OSA) includes mandatory duties relating to fraudulent advertising, which will ultimately apply to some of the largest online services (so-called Category 1 and Category 2A services)¹ on which UK users can encounter online paid-for adverts. The duties form part of a wider regulatory drive to combat online fraud, reflected in initiatives spanning online safety, payments and wider fraud-prevention policy.

Over the summer, Ofcom consulted on draft Codes of Practice setting out recommended measures for in-scope platforms to take to comply with these duties. Whilst platforms may choose to pursue alternative measures, they would need to demonstrate that those measures satisfy the statutory duties. In practice, the Codes will act as the primary regulatory benchmark for assessing compliance.

Following the consultation, Ofcom expects to publish its final Statement by mid-2027. Once the Codes complete the subsequent Parliamentary process, potentially later in 2027, the duties will take effect 21 days later, with no formal implementation period. Ofcom has indicated that its enforcement approach will recognise the lead times required for individual measures, but platforms will nevertheless be expected to begin acting towards compliance immediately.²

Given this, platforms should use the period before the final Statement to establish accountability, assess readiness and develop an implementation plan that is ready to mobilise once the Codes are finalised.

Based on Ofcom’s proposals, we identify ‘no-regret’ actions across six priority areas that in-scope platforms can take to ensure readiness, set out in Figure 1. First, this involves understanding current advertising arrangements and assessing fraud risk to establish the evidence base. This evidence should then inform governance, preventive controls, monitoring and response, and the use of external intelligence and transparency.

Figure 1: Operationalising the OSA’s fraudulent advertising duties³

1. Understanding advertising arrangements and dependencies

Platforms’ ability to implement the proposed measures will depend partly on how advertising is placed and managed on their services. Some operate largely closed advertising ecosystems, while others rely on advertising intermediaries for activities such as advertiser onboarding, purchasing advertising inventory and placing or delivering adverts.

An early priority for in-scope platforms should therefore be to establish where control over relevant advertising processes sits. This involves assessing the proposed measures against existing arrangements to determine which can be implemented directly, where current controls can be adapted and where delivery depends on third parties. Given the breadth of the proposals, this assessment will require input from teams with relevant knowledge of advertising operations, fraud controls, technology and intermediary arrangements.

Of course, reliance on intermediaries does not remove the obligation to act. Where a platform lacks sufficient control to implement a proposed measure directly, Ofcom has indicated that it expects platforms to use “all reasonable endeavours” to implement a version that is as similar as possible.

Given the judgement involved, platforms relying on alternative measures should retain clear evidence of the options considered and decisions taken, allowing them to explain their approach in the event of regulatory scrutiny. Alternative measures should also be kept under review, recognising that an approach considered sufficient today may need to evolve as intermediary capabilities and technical solutions develop.

Whilst platforms may not need to fully develop alternative measures before the Codes are finalised, identifying intermediary dependencies now should be a priority, particularly where compliance may necessitate opening up an early dialogue with intermediaries, as well as potential new technical capabilities or contractual changes.

2. Assessing fraud risk

Fraudulent advertising controls will need to be developed with service-specific risks in mind. The proposed fraud indicator assessment requires in-scope platforms to identify the service-specific characteristics that indicate a material risk of fraudulent advertising. Its findings should inform the wider framework, including account checks, training and the prioritisation of potentially fraudulent advertisements for review.

A key implementation challenge will be ensuring that the assessment is supported by sufficiently robust evidence. Relevant information may be spread across moderation decisions, complaints and reports, audit findings and intelligence held by different teams or external experts. Platforms should identify evidence gaps early and determine whether existing data and reporting arrangements provide a sufficiently robust basis for assessing risk.

Existing OSA risk assessment methodologies, evidence sources and governance processes may provide a useful starting point. However, the fraud indicator assessment is a distinct exercise and will need to reflect how paid-for advertising operates on each service. The assessment should also be treated as a living evidence base, updated as new information emerges and the service changes, with those developments used to refine both the assessment and associated controls.⁴

3. Establishing governance and accountability

The breadth of the proposed framework means that compliance is unlikely to sit within a single team. For in-scope platforms, delivery will require coordinated input across advertising, fraud, trust and safety, moderation, product, legal, risk and compliance functions. Where implementation depends on advertising intermediaries, procurement or supplier-management teams may also need to be involved.

Clear ownership and senior management oversight will therefore be essential. Ofcom makes clear that a single individual should be accountable to the platform’s most senior governance body for compliance, while that body would be expected to review the platform’s approach annually. This highlights that fraudulent advertising is an issue requiring active engagement from senior leadership. The focus on ownership is also reflected in proposals for senior managers’ responsibilities to be captured in written statements.

Effective oversight will ultimately depend on senior leaders receiving timely information on implementation, emerging risks and the effectiveness of relevant controls. Platforms will need to establish clear reporting arrangements and ensure that responsibilities are updated as personnel, processes and advertising arrangements evolve. Existing OSA governance, assurance and training arrangements may provide a useful foundation. However, further work is likely to be needed to meet the specific requirements of the new fraudulent advertising framework.

4. Prioritising prevention

The proposals place significant emphasis on preventing fraudulent advertising before it reaches users, with a particular focus on strengthening advertising account integrity and testing AI advertisement generation tools for vulnerabilities. Overall, platforms are expected to design fraud prevention into advertising systems, rather than relying primarily on moderation after publication.

For in-scope platforms, this approach has parallels with financial crime frameworks, where identity and due-diligence checks are used to disrupt fraud and other criminal activity. While the proposed measures do not replicate these formal ‘know your customer’ requirements, they similarly emphasise establishing identity, applying proportionate checks and responding when risks change. As in financial crime frameworks, account integrity should extend beyond onboarding and operate as an ongoing control.

The fraud indicator assessment should help platforms calibrate these controls. Risk indicators defined too broadly could expose legitimate advertisers to unnecessary checks or restrictions, increasing operational costs, appeals and friction. Too narrow an approach could leave material risks unaddressed. Platforms will therefore need evidence-based thresholds that balance fraud prevention with the experience of legitimate advertisers, supported by effective appeals and regular review as fraud patterns and evidence evolve.

5. Strengthening monitoring and response

Despite the focus on prevention, these controls will not identify every suspicious account or prevent the publication of all fraudulent adverts. In-scope platforms will also need effective processes to detect, investigate and act on adverts that may be fraudulent.

Potential concerns may arise through channels including user reports, trusted flaggers and automated technologies. The challenge will be turning these different signals into a coordinated response, ensuring they reach the appropriate teams, are prioritised according to risk and lead to prompt investigation and action. Platforms should also plan for greater expectations around the role of technology. Ofcom intends to consult separately on the use of proactive technology to detect fraudulent advertisements, meaning the final framework is not yet complete.

In advance of the Codes being finalised, platforms should assess whether their existing data, technology and moderation capabilities can meet the proposed moderation expectations, support greater proactive detection, and identify where investment may be required.

6. Preparing for greater external scrutiny and transparency

The proposals expand the role of external experts in identifying potentially fraudulent adverts. In-scope platforms will need dedicated reporting channels for trusted flaggers such as the Advertising Standards Authority and Financial Conduct Authority, allowing reports to be prioritised appropriately. Platforms may be able to build on processes established under the OSA Illegal Content Codes, but these would need to be adapted for paid-for advertising.

Advertising libraries are another important part of the proposed framework, enabling experts and researchers to identify and report potentially fraudulent adverts. Platforms already operating advertising repositories under the Digital Services Act (DSA) may be able to reuse elements of their existing infrastructure, data models and governance, with the added benefit of helping ensure consistency across the two jurisdictions. However, they should not assume that existing repositories will satisfy UK requirements without modification, given differences in the information and functionality required.⁵

This greater role for external experts in platform oversight reflects a broader regulatory trend, the implications of which we set out in our previous blog, Responding to external scrutiny from civil society in the age of AI. Platforms should approach this engagement as an opportunity to strengthen their wider framework, including by using external intelligence to inform the fraud indicator assessment and improve controls and outcomes.

Conclusion

The new regime represents a significant increase in expectations for in-scope platforms carrying paid-for adverts. This article has set out our view on the actions that in-scope platforms can already take to ensure readiness. For completeness, an overview of all the proposed fraudulent advertising measures is set out in Figure 2.

Many platforms will already have relevant capabilities to build on, including advertising and fraud controls, OSA governance and risk-management arrangements, moderation processes and DSA advertising repositories. However, platforms will likely need to modify these existing arrangements to satisfy the specific requirements of the new fraudulent advertising regime.

Platforms should now focus on establishing senior accountability, assessing their existing arrangements and developing an implementation plan that distinguishes between capabilities that can be reused, those requiring modification and new controls that need to be developed. Given the breadth of the proposals and the limited formal implementation period, preparation in advance of the final Codes will be important to support compliance within Ofcom's expected timeframe.

Footnotes:

1. A list of designated services is available here. Category 1 includes services with >34m monthly active UK users which use a content recommender system, or services with >7m users which use a content recommender system and provide functionality for users to forward/share user-generated content on the service with other users of that service. Category 2A includes search engines (not including ‘vertical’ search engines) with >7m monthly active UK users.

2. Ofcom has indicated that it will take a “reasonable and proportionate approach to enforcement”, having regard to the lead times required to implement particular measures. However, once the duties take effect, it expects platforms to begin taking action towards compliance immediately and the majority of measures to be implemented shortly afterwards.

3. Figure 1 simplifies the precise wording of the legal duties, which differ between Category 1 and Category 2A services.

4. Ofcom proposes that the fraud indicator assessment should be documented, shared with the service’s most senior governance body and reviewed at least annually. It should also be updated following significant changes to the service’s design or functionality relating to paid-for advertising, with new potential indicators tracked between formal assessments.

5. Many proposed features align with advertising repositories required under the DSA, including searchable records and information on advertisements, advertisers, targeting and reach. However, the UK proposals include additional information, such as content keywords used to target users making searches, previous account holder names and advertisement status (e.g. whether the advert is active).

6. Descriptions are simplified and paraphrased for illustrative purposes. Please refer to Ofcom’s draft Codes for Category 1 and Category 2A services for the full proposals and requirements.