In 2026 the cost of unverified sellers on a marketplace stopped being a fraud-loss line and became a regulatory one. The European Commission fined AliExpress €550 million in July and Temu €200 million in May under the Digital Services Act, and opened proceedings against Shein. In the US, the FTC's first INFORM Consumers Act case cost Temu $2 million, with penalties now up to $53,088 per violation. All three enforcement tracks come back to the same requirement: know who is selling on your platform, verify it, and be able to prove you did.

This article explains the four fraud patterns that drive enforcement, what each law actually requires, and what a seller verification program that satisfies both looks like in practice. It is written for marketplace founders, trust and safety leads and compliance teams at platforms of any size.

What happened to marketplace regulation in 2026?

Three enforcement actions in twelve months set the tone.

AliExpress, €550 million, 20 July 2026. The European Commission found that AliExpress had not properly assessed or mitigated the risk of illegal and unsafe products reaching EU consumers, and that its earlier voluntary commitments lacked specific, measurable targets and external verification mechanisms. A remedial action plan is due by 20 October 2026. TechPolicy.Press reads the decision as a signal to every very large marketplace that listing removal is not risk mitigation; systems that catch recurring risk at scale are.

Temu, €200 million, May 2026. The Commission's Temu decision came first, on the same grounds, with an action plan due 28 August 2026.

Shein, formal proceedings, February 2026. The Commission opened DSA proceedings against Shein over illegal products, addictive design and recommender transparency.

Temu, $2 million, FTC, September 2025. The FTC's first INFORM Consumers Act case alleged Temu failed to collect and verify information from high-volume sellers and failed to provide a working mechanism for consumers to report suspicious activity.

Regulators in both jurisdictions are converging on the same idea: the marketplace is responsible for knowing who its sellers are.

What are the four marketplace fraud patterns behind the enforcement?

Pattern 1: ban evasion

A seller is removed for counterfeits, non-delivery or abuse and returns under a new account within hours. Email, phone and device bans do not hold because all three are cheap. What stops it: biometric one-to-many deduplication at onboarding. A face enrolled once cannot enroll again, whatever the email says.

Pattern 2: account takeover

Established seller accounts are the most valuable thing on a marketplace, and they are being stolen. A trusted account with years of history lists high-value inventory, collects payment and disappears. What stops it: step-up liveness on risk triggers. New payout account, new device, new shipping origin, or a listing pattern that breaks from history means the account holder confirms their face against the one on file before the change goes live.

Pattern 3: counterfeits behind unverified storefronts

This is the DSA case in one sentence. Illegal and unsafe products enter the market through sellers whose identity was never confirmed. When the product is caught, the storefront is gone and a new one has already opened. What stops it: DSA Article 30 compliance done properly, meaning a verified legal identity, a verified payment account and a verified trade register entry for every trader, with the platform making a real effort to assess the reliability of what it collected.

Pattern 4: triangulation and return fraud

A fraudster lists an item they do not own, takes the buyer's payment, orders the same item from a legitimate seller with a stolen card, and has it shipped to the buyer. Both depend on the fraudster's identity being disposable. What stops it: verified identity tied to verified payout, plus transaction monitoring that notices when a seller's purchases and sales line up too neatly.

What does the INFORM Consumers Act actually require?

The INFORM Consumers Act, 15 U.S.C. Section 45f, took effect on 27 June 2023. In short:

• Who is covered: any online marketplace with third-party sellers, and any high-volume third-party seller with 200 or more discrete transactions and $5,000 or more in gross revenue in any continuous 12-month period during the previous 24 months.
• What to collect: bank account number, government-issued ID for individuals or a government record for businesses, tax ID, and working contact information.
• When: within 10 days of the seller crossing the threshold.
• Verify it: the marketplace must verify the information, and re-verify within 10 days of any change.
• Annually: sellers must certify each year that their information is current, and the marketplace must suspend those who do not.
• Disclose: sellers with $20,000 or more in annual revenue must have their contact details shown to consumers.
• Report: a clear, conspicuous way for consumers to report suspicious marketplace activity.

The FTC enforces it with civil penalties currently up to $53,088 per violation, and state attorneys general can bring their own actions. McDermott's analysis of the Temu settlement is the best short read on where marketplaces fall short: collecting without verifying, and treating the reporting mechanism as a form nobody reads.

What does DSA Article 30 require of EU marketplaces?

Article 30 of the Digital Services Act, traceability of traders, applies to any online platform that lets consumers conclude contracts with traders. Before a trader can sell, the platform must obtain name, address, telephone and email; a copy of an identification document; payment account details; a trade register number where applicable; and a self-certification of legal compliance. The platform must then make best efforts to assess whether the information is reliable and complete, and suspend traders who do not comply. The AliExpress and Temu decisions show what best efforts does not mean: a form field and a checkbox.

What does a seller verification program that satisfies both look like?

The same program satisfies INFORM, Article 30 and the fraud problem, because they are asking for the same thing.

1. Identity at onboarding. Government ID capture with authenticity checks, a liveness check, and a biometric match. For business sellers, KYB: registry lookup, ownership, and identity verification of the controlling person.
2. One-to-many dedupe. Every new seller's face compared against every banned seller.
3. Payout account verification. The account receiving money belongs to the verified identity.
4. Sanctions and PEP screening. Required for payment flows in most jurisdictions.
5. Step-up on risk. Liveness re-check on new device, new payout, new address or listing anomalies.
6. Annual recertification. Automated, with suspension on non-response, as INFORM requires.
7. Proof. A tamper-evident record of what was checked, when, and with what result, for every seller.

How does deepidv fit?

deepidv runs all seven steps behind one API. Identity, liveness, biometric dedupe, KYB, sanctions and PEP, step-up and monitoring are modules that a marketplace turns on individually, and Arbiter, the compliance module, tracks the INFORM and DSA obligations and keeps the recertification calendar. Every check is sealed as a proof at proof.deepidv.com with no personal data on chain. The marketplace overview is at deepidv.com/marketplaces, and for collectibles platforms the companion guide is TCG marketplace fraud in 2026.

Suggested read: Vibe-coded marketplace: seller verification that holds up

Frequently asked questions

Does the INFORM Consumers Act apply to small marketplaces?

Yes. The thresholds apply to sellers, not to the marketplace. Any online marketplace with a high-volume third-party seller (200 transactions and $5,000 in a year) has obligations for that seller.

What is the penalty for violating the INFORM Consumers Act?

Civil penalties under the FTC Act, currently up to $53,088 per violation, plus state attorney general actions. The first FTC case, against Temu in September 2025, settled for $2 million.

What is DSA Article 30?

The Digital Services Act's know your business customer rule. Online platforms that let consumers buy from traders must collect identity, contact, payment and registration information from each trader, make best efforts to verify it, and suspend traders who do not comply.

Can a marketplace outsource seller verification?

Yes, and most do. The obligation to verify stays with the marketplace, but the verification itself is normally run by a verification provider through an API.

How long does seller verification take?

A full identity check with liveness takes most sellers under a minute. Business verification depends on registry availability and usually completes within the same session or within a day.

What is the difference between KYC and KYB for marketplaces?

KYC verifies an individual seller. KYB verifies a business seller: that it exists, who owns and controls it, and that the person operating the account is one of them.