AliExpress €550M, Temu €200M and a $2M FTC case in one year. What the INFORM Act and DSA now require of marketplaces, and how seller verification meets it.
In 2026 the cost of unverified sellers on a marketplace stopped being a fraud-loss line and became a regulatory one. The European Commission fined AliExpress €550 million in July and Temu €200 million in May under the Digital Services Act, and opened proceedings against Shein. In the US, the FTC's first INFORM Consumers Act case cost Temu $2 million, with penalties now up to $53,088 per violation. All three enforcement tracks come back to the same requirement: know who is selling on your platform, verify it, and be able to prove you did.
This article explains the four fraud patterns that drive enforcement, what each law actually requires, and what a seller verification program that satisfies both looks like in practice. It is written for marketplace founders, trust and safety leads and compliance teams at platforms of any size.
Three enforcement actions in twelve months set the tone.
AliExpress, €550 million, 20 July 2026. The European Commission found that AliExpress had not properly assessed or mitigated the risk of illegal and unsafe products reaching EU consumers, and that its earlier voluntary commitments lacked specific, measurable targets and external verification mechanisms. A remedial action plan is due by 20 October 2026. TechPolicy.Press reads the decision as a signal to every very large marketplace that listing removal is not risk mitigation; systems that catch recurring risk at scale are.
Temu, €200 million, May 2026. The Commission's Temu decision came first, on the same grounds, with an action plan due 28 August 2026.
Shein, formal proceedings, February 2026. The Commission opened DSA proceedings against Shein over illegal products, addictive design and recommender transparency.
Temu, $2 million, FTC, September 2025. The FTC's first INFORM Consumers Act case alleged Temu failed to collect and verify information from high-volume sellers and failed to provide a working mechanism for consumers to report suspicious activity.
Regulators in both jurisdictions are converging on the same idea: the marketplace is responsible for knowing who its sellers are.
A seller is removed for counterfeits, non-delivery or abuse and returns under a new account within hours. Email, phone and device bans do not hold because all three are cheap. What stops it: biometric one-to-many deduplication at onboarding. A face enrolled once cannot enroll again, whatever the email says.
Established seller accounts are the most valuable thing on a marketplace, and they are being stolen. A trusted account with years of history lists high-value inventory, collects payment and disappears. What stops it: step-up liveness on risk triggers. New payout account, new device, new shipping origin, or a listing pattern that breaks from history means the account holder confirms their face against the one on file before the change goes live.
This is the DSA case in one sentence. Illegal and unsafe products enter the market through sellers whose identity was never confirmed. When the product is caught, the storefront is gone and a new one has already opened. What stops it: DSA Article 30 compliance done properly, meaning a verified legal identity, a verified payment account and a verified trade register entry for every trader, with the platform making a real effort to assess the reliability of what it collected.
A fraudster lists an item they do not own, takes the buyer's payment, orders the same item from a legitimate seller with a stolen card, and has it shipped to the buyer. Both depend on the fraudster's identity being disposable. What stops it: verified identity tied to verified payout, plus transaction monitoring that notices when a seller's purchases and sales line up too neatly.
The INFORM Consumers Act, 15 U.S.C. Section 45f, took effect on 27 June 2023. In short:
The FTC enforces it with civil penalties currently up to $53,088 per violation, and state attorneys general can bring their own actions. McDermott's analysis of the Temu settlement is the best short read on where marketplaces fall short: collecting without verifying, and treating the reporting mechanism as a form nobody reads.
Article 30 of the Digital Services Act, traceability of traders, applies to any online platform that lets consumers conclude contracts with traders. Before a trader can sell, the platform must obtain name, address, telephone and email; a copy of an identification document; payment account details; a trade register number where applicable; and a self-certification of legal compliance. The platform must then make best efforts to assess whether the information is reliable and complete, and suspend traders who do not comply. The AliExpress and Temu decisions show what best efforts does not mean: a form field and a checkbox.
The same program satisfies INFORM, Article 30 and the fraud problem, because they are asking for the same thing.
deepidv runs all seven steps behind one API. Identity, liveness, biometric dedupe, KYB, sanctions and PEP, step-up and monitoring are modules that a marketplace turns on individually, and Arbiter, the compliance module, tracks the INFORM and DSA obligations and keeps the recertification calendar. Every check is sealed as a proof at proof.deepidv.com with no personal data on chain. The marketplace overview is at deepidv.com/marketplaces, and for collectibles platforms the companion guide is TCG marketplace fraud in 2026.
Suggested read: Vibe-coded marketplace: seller verification that holds up
Yes. The thresholds apply to sellers, not to the marketplace. Any online marketplace with a high-volume third-party seller (200 transactions and $5,000 in a year) has obligations for that seller.
Civil penalties under the FTC Act, currently up to $53,088 per violation, plus state attorney general actions. The first FTC case, against Temu in September 2025, settled for $2 million.
The Digital Services Act's know your business customer rule. Online platforms that let consumers buy from traders must collect identity, contact, payment and registration information from each trader, make best efforts to verify it, and suspend traders who do not comply.
Yes, and most do. The obligation to verify stays with the marketplace, but the verification itself is normally run by a verification provider through an API.
A full identity check with liveness takes most sellers under a minute. Business verification depends on registry availability and usually completes within the same session or within a day.
KYC verifies an individual seller. KYB verifies a business seller: that it exists, who owns and controls it, and that the person operating the account is one of them.
Go live in minutes. No sandbox required, no hidden fees.
The 2026 guide to identity verification in Canada: FINTRAC's five methods, PCMLTFA rules, bilingual onboarding, and how Verifast, Trulioo, and deepidv compare.
From AMLD6 to state-level FinTech regulations, the compliance landscape for identity verification is shifting rapidly. Here is what your compliance team needs to know.
Generative AI has broken the assumptions underlying most identity frameworks. Regulators are responding with new rules, and the industry must adapt. Here is the current state of AI identity regulation worldwide.
