Agency Operations

Creator Onboarding: KYC & Payment-Setup Checklist

Onboarding is the least glamorous part of running a fans agency and the part that quietly determines whether everything else works. A creator brought on cleanly — verified everywhere, payout details correct, split configured and tested — pays out smoothly for years. A creator onboarded sloppily becomes the reason a payout bounces or an account freezes six months later, usually at the worst possible moment.

What most checklists miss is that a creator is verified by three separate parties, not one. The platform verifies them before they can publish. The payment provider verifies them before money can move. And the agency needs its own file — contract, split agreement, identity records — because when a provider or tax authority asks a question, "the platform checked" is not an answer.

This guide covers all three layers, the order to run them in, and the failure points that actually freeze payouts in 2026.

Why Onboarding Is a Compliance Event

Three developments have turned creator onboarding from admin into compliance:

• AMLA, the EU's new anti-money-laundering authority, has been operational in Frankfurt since July 2025 and took over the EBA's AML mandates in January 2026. The AMLR — a single rulebook applying directly in all 27 member states from 10 July 2027 — makes enhanced due diligence mandatory for high-risk sectors, which includes adult content. See AMLA 2025.
• DAC7 reporting has been running since 2024. Platforms report creator earnings to EU tax authorities annually, and those authorities now hold two-plus years of creator income data they actively cross-check. A creator whose tax details are missing or wrong is a reporting problem the platform solves by freezing payouts.
• Verification of Payee has been mandatory since 9 October 2025: every SEPA transfer is name-checked against the destination IBAN before it leaves. Sloppy payout details that used to slide through now generate warnings — or blocked transfers.

The most common trigger for a frozen account remains the same as ever: a provider deciding it doesn't understand a relationship it should have understood from day one. Why fans agencies get accounts frozen covers the mechanics; onboarding is where you prevent it.

Layer 1 — Platform-Side Verification

Every serious platform now runs full identity verification before a creator can earn. The standard set:

• Government photo ID — passport, national ID, or driving licence, current and unexpired.
• A live selfie matched against the ID — no filters, no old photos. Poorly lit or cropped submissions are the main reason verification drags from 48 hours into weeks.
• Legal name, address, date of birth.
• Banking and tax details for payouts.

Two items deserve agency attention because they fail silently.

Tax forms. US persons file a W-9; most others a W-8 equivalent. EU-resident creators also supply DAC7 data — legal name, address, tax identification number, IBAN — which the platform reports to tax authorities annually once earnings pass €2,000 or 30 transactions a year. A missing or inconsistent form doesn't generate a polite reminder; it freezes payouts, and for US-connected creators can trigger 24% backup withholding. Confirm the tax section is complete before the first payout cycle, not after. DAC7 explained covers the reporting side.

Co-performer releases. Any person appearing in content — a partner, a guest, another creator — must be verified by the platform and covered by a signed release confirming identity, age, and consent. Posting collaboration content before the co-performer completes verification is one of the most common compliance strikes on major platforms. Collect release forms during onboarding, not when the first collab is already filmed.

Expect re-verification too: platforms increasingly re-check identity periodically rather than once. The regulatory direction is one-way — under the UK Online Safety Act, age assurance has been enforceable for adult platforms since July 2025, and Ofcom had opened investigations into more than 90 services and issued multiple fines by early 2026. Platforms answer that pressure by tightening verification for everyone, everywhere.

Layer 2 — Payment-Side KYC

The payment provider — for most European agencies, an EU-licensed EMI — runs its own KYC before a creator wallet or sub-account opens. The standard request:

• Government ID plus a liveness check — a short video or guided selfie proving a real, present person.
• Proof of address — utility bill, bank statement, or lease, usually dated within the last three months.
• Expected activity — monthly volumes, where money comes from, where it goes.
• Source-of-funds evidence at higher volumes — platform earning statements are usually the cleanest answer for creators.

Two practical notes. Proof of address trips up more creators than ID does — a phone bill in a parent's name or a statement older than three months means a rejected application and a restart, so tell creators exactly what qualifies before they submit. And on expected activity, understate nothing: a creator declared at €2,000 a month who receives €20,000 triggers exactly the review the declaration was meant to avoid.

The agency entity goes through the heavier version: incorporation documents, ownership structure, and ID for every beneficial owner above 25%. Answer the questions straight and completely. Under the incoming AMLR framework, enhanced due diligence for this sector is mandatory, so a provider asking detailed questions is doing its job — a provider asking none is the red flag. How to choose a payment provider covers what else to look for.

Layer 3 — The Agency File

The layer agencies actually control, and the one most neglect. For every creator, before money moves:

• A signed management contract with the commission terms in writing.
• A split agreement that states the exact percentage and — critically — the base it applies to (gross platform payout vs net of fees). Disputes almost always trace back to an ambiguous base. See commission split structures.
• A copy of the verified ID and the verification date.
• Signed releases for any co-performers.

Because you're storing ID documents, GDPR applies. Be able to name your lawful basis — legal obligation for records kept to meet AML and tax duties, contract performance for the rest. Set retention limits: AML-related records are typically kept five years after the relationship ends, not indefinitely. Restrict access to the few people who need it, store copies encrypted, and delete what the retention schedule says to delete. An ID archive kept "just in case", forever, in a shared drive is itself a compliance failure.

The Right Sequence

Order matters more than most agencies realise:

1. Contract first. Terms in writing before any account exists. It also fixes the legal name and the split you'll configure later.
2. Platform verification. The longest, least predictable step — start it early. Include tax forms and any co-performer releases.
3. Payment account. Open the creator's wallet or sub-account, complete the provider's KYC, and capture payout details in the creator's legal name — ideally an EU IBAN for SEPA payouts.
4. Split configuration. Configure the contracted percentage against the contracted base so payouts divide automatically (see how automated split payments work, and model the economics with the split calculator).
5. First payout test. Run one real cycle at low stakes, confirm both sides received the right amounts, reconcile against the contract, then scale.

Run the steps out of order and each becomes more expensive: a split configured before the account exists is guesswork, and a first payout without a test run turns configuration errors into money already sent to the wrong place.

Budget one to two weeks end to end. Platform verification takes 24–72 hours when submissions are clean and weeks when they aren't; EMI KYC typically clears in a few days; the payout test depends on the platform's payout cycle. Starting the platform step on day one, in parallel with the paperwork, is the single biggest schedule saver.

The Onboarding Checklist

Copy this into your operations doc and run it per creator.

Contract

• Management contract signed by both parties
• Commission % and base (gross vs net) stated explicitly
• Creator's legal name recorded exactly as on ID

Platform

• Identity verification completed (ID + live selfie)
• Tax form completed (W-9 / W-8 / DAC7 data incl. TIN)
• Payout details entered in the legal name
• Co-performer release forms signed and stored (if applicable)

Payment account

• Creator wallet / sub-account opened
• KYC passed: ID, liveness, proof of address
• Source-of-funds evidence filed (higher volumes)
• IBAN verified against a bank statement, not a chat message

Split

• Split % configured to match the contract
• Base confirmed against the contract
• Configuration reviewed by a second person

Go-live

• First payout cycle run and reconciled to the cent
• Both sides confirm receipt
• Records archived: contract, ID, verification dates, first reconciliation
• Retention schedule entry created (GDPR)

Where Onboarding Actually Fails

Stage name vs legal name. The classic. A creator known by a stage name supplies payout details that don't match her legal identity. Since Verification of Payee went live in October 2025, every SEPA transfer is checked name-against-IBAN before execution — a mismatch generates a warning or a block. Everything financial runs on the legal name; the stage name exists only in marketing.

Wrong IBAN. VoP catches many errors, but the fix belongs upstream: verify the IBAN against a bank statement or a screenshot from the banking app, never against a number typed into a chat.

Missing tax form. The platform doesn't chase — it freezes. If a creator's payouts stop unexpectedly, the tax section is the first place to look.

Split configured against the wrong base. A 50% split of gross and a 50% split of net-of-platform-fees differ by the platform's 20% cut. Configure the wrong one and the error compounds every cycle until someone reconciles — which is why the checklist puts a second pair of eyes on the configuration and a to-the-cent reconciliation on the first payout.

Missing co-performer release. Collab content published before the co-performer is verified means strikes or content removal — revenue disruption that traces directly back to a form nobody collected.

No paper trail. When a provider or authority asks a question and there's nothing to show, a routine query becomes a frozen account while the file is rebuilt from scratch.

What Changes Next

Two dates worth planning around:

10 July 2027 — AMLR. The single EU rulebook harmonises customer due diligence across all 27 member states and makes enhanced due diligence mandatory for high-risk sectors. Expect providers to standardise on the stricter end: more source-of-funds questions, more periodic reviews. Agencies with clean files will barely notice.

End of 2026 — eIDAS 2 wallets. Every member state must offer citizens an EU Digital Identity Wallet by the end of 2026, and regulated businesses must start accepting wallet-based identification from 2027. Over time, creator KYC could shift from document uploads and selfie checks to sharing verified credentials from a wallet — faster, and harder to forge. Nothing to rebuild yet; just know the document-upload ritual has an expiry date.

The EU compliance calendar tracks both alongside everything else on the horizon.

Bottom Line

A creator is onboarded three times — by the platform, by the payment provider, and by the agency — and the process only counts when all three files are complete. Run the sequence in order: contract, platform verification, payment account, split configuration, test payout. Keep legal names on everything financial, tax forms complete before the first cycle, releases signed before the first collab, and records within GDPR limits. Onboarding done properly the first time is invisible; done sloppily, it resurfaces as frozen accounts and mispaid splits months later. The agencies that scale cleanly are almost always the ones that onboard cleanly.

Once creators are onboarded, see how operations hold up as you grow in scaling a fans agency.

---

AgencyPayments.eu is an independent informational resource and does not provide legal or compliance advice. KYC and AML obligations vary by jurisdiction; confirm your requirements with a qualified adviser. Current as of July 2026.