A marketplace built with AI tools inherits the same obligations as one built by a hundred engineers: in the US, the INFORM Consumers Act requires collecting and verifying bank, ID, tax and contact details for any seller with 200 transactions and $5,000 in a year, and the FTC's first case settled for $2 million; in the EU, DSA Article 30 requires trader identity, payment and registration details before a trader can sell, and 2026 brought fines of €550 million and €200 million for marketplaces that failed to manage illegal and counterfeit goods. The fraud that kills small marketplaces first, ban evasion, account takeover, counterfeits and triangulation, is stopped by the same control the law requires: a verified seller tied to a verified payout. Here is the flow, and the code.

Marketplace verification is the deepidv vertical this guide draws on. Pair it with the vibe coding security checklist for the app itself and with marketplace fraud in 2026 for the enforcement detail. For card and collectibles marketplaces, the TCG marketplace guide applies the same flow to that vertical.

What does the law require of a marketplace?

INFORM Consumers Act (US). A high-volume third-party seller is one with 200 or more transactions and $5,000 or more in gross revenue in a 12-month period. For each, the marketplace must collect and verify bank account, government ID, tax ID and contact information, recertify annually, disclose sellers above $20,000 to consumers, and offer a reporting mechanism. The FTC's first case ended with Temu paying $2 million in September 2025, over a missing telephonic reporting mechanism and missing disclosures in gamified and mobile listings.

DSA Article 30 (EU). Before a trader can sell, the platform must obtain name, address, phone and email, an ID document copy, payment account details, trade register details and a self-certification, make best efforts to verify them, suspend non-compliant traders, and retain the data six months after the relationship ends. The Commission fined AliExpress €550 million on 20 July 2026 and Temu €200 million in May for failing to manage the risk of illegal and counterfeit goods.

What fraud hits a new marketplace first?

Four patterns, all documented in marketplace fraud in 2026:

1. Ban evasion. A removed seller is back the next day with a new email and phone. The control is one-to-many face dedupe at onboarding.
2. Account takeover. A trusted seller account with years of history lists high-value items and disappears. The control is step-up liveness on payout, device and address changes.
3. Counterfeits behind unverified storefronts. The DSA cases in one sentence. The control is verified trader identity and listing screening.
4. Triangulation and return fraud. Disposable identities on both sides. The control is verified identity tied to a verified payout account.

The law and the fraud ask for the same thing. Build it once.

The seller onboarding flow

1. Identity at seller signup: document, liveness, match, with KYB for business sellers.
2. Dedupe against every enrolled and banned seller.
3. Payout account verified as belonging to the identity.
4. Screening for sanctions and PEP at onboarding and on a schedule.
5. Step-up on risk events.
6. Annual recertification, automated, with suspension on non-response (INFORM requires it).
7. Proof per check, for the day a regulator asks.

How do you build it with a vibe-coding tool?

Attach the deepidv MCP server to Cursor or Claude Code (docs):

{
  "mcpServers": {
    "deepidv": {
      "command": "npx",
      "args": ["-y", "@deepidv/mcp-server"]
    }
  }
}

Prompt: "Using the deepidv MCP server, create a workflow named 'seller-onboarding' with ID_VERIFICATION, FACE_LIVENESS, ANTI_CHEAT and PEP_SANCTIONS. Add a server function that creates a verification session for a seller when they first attempt to list, redirects them to session_url, and stores verified status on the session.status.verified webhook. Block listing and payouts for unverified sellers. Add a scheduled job that creates a bank statement request for sellers whose payout account changed."

The generated code should look like this on the server (sessions, SDK):

import { DeepIDV } from "@deepidv/server";
const client = new DeepIDV({ apiKey: process.env.DEEPIDV_API_KEY! });

export async function verifySeller(seller: {
  id: string; firstName: string; lastName: string; email: string; phone: string;
}) {
  const s = await client.sessions.create({
    firstName: seller.firstName,
    lastName: seller.lastName,
    email: seller.email,
    phone: seller.phone,
    externalId: seller.id,
    workflowId: process.env.DEEPIDV_SELLER_WORKFLOW!,
    redirectUrl: "https://yourmarketplace.com/seller/verified",
  });
  return s.sessionUrl;
}

Webhook handler: on session.status.verified, set seller.verified_at; on session.status.rejected or session.status.failed, keep the seller blocked and open a review (webhooks). Dedupe runs inside the workflow as ANTI_CHEAT; a DUPLICATE verdict against a banned face stops the enrollment (reference).

Step-up: when a verified seller changes payout details, create a new session with a workflow of FACE_LIVENESS only and hold the change until it passes. Payout account checks use the bank statement request tool exposed through the MCP server and the financial endpoints.

Test with the sandbox: GET /v1/sessions/test_verified, test_rejected, test_pending and test_voided return canned states (sandbox).

What about the buyers, and the listings?

Buyers get a light check: phone trust at signup (POST /v1/screening/phone-trust) and full identity only when they cross a value threshold or open a dispute. Listings get screened by category: for cards and collectibles, deepidv's TCG Authenticity Verification reads the listing photos for counterfeit signals, and the seven TCG marketplace scams show what it is screening for; for other goods, the seller's verified status and history carry the weight.

What does it cost?

At the public list prices at the time of writing: identity with liveness $0.50, biometric dedupe 1:N $0.30, PEP and sanctions $0.40, KYB $0.70, phone verification $0.15. A seller is verified once; a repeat check on a returning verified person is $0.05. On a marketplace taking 10 percent of a $50 order, the onboarding cost of a seller is recovered on their first sale. Marketplaces are a listed use case for the deepidv Startup Program.

Frequently asked questions

Does the INFORM Consumers Act apply to a new marketplace?

Yes, from the moment any seller reaches 200 transactions and $5,000 in revenue in a year. The thresholds apply to sellers, not to the marketplace's size.

What is DSA Article 30?

The EU rule requiring online platforms to collect and verify trader identity, contact, payment and registration details before a trader can sell, and to suspend traders who do not comply.

How do I stop banned sellers from coming back?

One-to-many face matching at onboarding. Email and phone bans are free to evade; a face is not.

Can I build the seller verification flow with Lovable or Cursor?

The integration, yes. The verification runs on deepidv's engine through a hosted session and a webhook; with the MCP server attached, your assistant creates the workflow and the session code from a prompt.

What is the difference between verifying a seller and a buyer?

Sellers get full identity, dedupe and payout verification because they are the regulated party and the fraud vector. Buyers get a light check unless they cross a value or dispute threshold.

How do I prove compliance to the FTC or the Commission?

Keep a tamper-evident record per check. deepidv seals every verification as a proof at proof.deepidv.com, with no personal data on chain.