Fraud is now the most commonly experienced crime in the UK, and paid-for adverts on social media and search are the second most common way fraudsters reach people online — scam ads alone are reckoned to cost the UK around £200 million a year. In response, Ofcom has drawn up a draft Fraudulent Advertising Code of Practice under the Online Safety Act 2023, setting out what the UK’s largest platforms must do to stop scam ads getting through in the first place. The consultation closed on 2 October 2026, and while the final rules won’t land until mid-2027 at the earliest, the direction is already clear enough that the social media agencies, media agencies and video production companies that make up the UK’s media industry should be paying attention now.
What the draft code actually covers
The rules apply only to services Ofcom has designated Category 1 or Category 2A — in practice, the handful of platforms big enough to carry serious advertising volume. They cover paid-for advertising content specifically; ordinary organic posts and non-sponsored search results sit outside the scope entirely. Within that, Ofcom has proposed nearly 40 practical measures grouped under five headings: governance, fraud assessment, account integrity, moderation and complaints.
The account integrity measures are the ones most likely to be felt day-to-day. Platforms would have to verify that an advertiser genuinely represents the business it claims to be, and separately confirm that any advertiser offering financial services is properly authorised to do so. Platforms would also need to run a formal “fraud indicator assessment” — working out how scam ads typically show up on their own service, and what patterns in an account or advert should trigger a closer look — and stress-test their own ad-review and AI tools so fraudsters can’t simply find the gaps. None of this is optional box-ticking either: Ofcom wants each platform’s senior leadership held accountable for getting it right, not just a compliance team buried several layers down.
Why this matters to agencies, not just platforms
The legal duty in the draft code sits with the platform, not with the agency booking the campaign. But in practice, it’s agencies — not the platforms’ own compliance teams — who set up and manage most UK ad accounts on a client’s behalf, which means agencies will be the ones fielding the extra verification requests when a platform tightens its onboarding. Expect more documentation asked for earlier: company registration details, a VAT number, and for any client in financial services, proof that they’re actually authorised to advertise what they’re advertising. Whether an agency is based in Royston, Boston or Everton, the obligation falls on the platform rather than the postcode — but the paperwork trail starts with whoever manages the account, and that’s usually the agency.
There’s a practical upside to getting ahead of it. Agencies that already treat business verification as a standard part of client onboarding — registration documents, VAT details and authorisation paperwork collected and filed before the first campaign brief, not chased up afterwards — are the ones least likely to see a new client’s launch date slip when a platform’s account checks tighten. The alternative is scrambling for paperwork the week a client wants to go live, which is a worse conversation to have than a five-minute ask during onboarding.
What to do now
- Build proof-of-business documents (company registration, VAT number) into new client onboarding as standard, not something requested only if a platform flags the account.
- For any client offering financial products or services, keep their regulatory authorisation details on file and ready to supply.
- Keep an eye on individual platforms’ own ad-account policies over the coming months — they’re likely to start tightening verification ahead of Ofcom’s final statement, not after it.
None of this changes what makes a good ad campaign. It does mean the agencies that treat verification as routine admin, rather than an afterthought, will be the ones clients can rely on to actually get a campaign live on time.
Read Ofcom’s own consultation document at ofcom.org.uk.
