KYC for Online Marketplace Sellers: DAC7 and DSA 2026

UK online marketplaces must now collect, verify, and report identity and tax data for sellers who exceed specified transaction or revenue thresholds — under the Platform Information Regulations (SI 2023/1143) effective from 1 January 2024, administered by HMRC. EU platforms face parallel obligations under DAC7 (Directive 2021/514/EU), and both regimes intersect with the EU Digital Services Act (DSA, Regulation 2022/2065), which separately requires marketplaces to verify professional traders before they can list products. Together, these frameworks make seller KYC a legal baseline, not an optional practice.

This article is for informational purposes only and does not constitute legal advice. Regulatory references are accurate as of the publication date. Consult a qualified professional for guidance specific to your situation.

What DAC7 and UK Platform Reporting Rules Require

The UK Platform Information Regulations (SI 2023/1143) require digital platform operators to collect, verify, and annually report seller identity and income data to HMRC, mirroring the EU's DAC7 directive (2021/514/EU) — with the first UK reports covering 2024 calendar-year data due by 31 January 2025. Source: HMRC Platform Operators Reporting Rules.

The UK regime applies to platforms that facilitate the sale of goods, rental of property, provision of personal services, or rental of transport. Covered platforms must carry out due diligence on sellers, capture prescribed data fields, and submit a return to HMRC each January for the preceding calendar year. Where a seller is also reportable to an EU member state, the platform may rely on a single consolidated report exchanged under the OECD Model Rules framework.

The EU's DAC7 directive, transposed by member states by 1 January 2023, operates on the same logic. It extends automatic exchange of information to digital platforms and applies both to EU-based platforms and to non-EU platforms where sellers are EU tax residents. A UK marketplace that hosts EU-resident sellers therefore faces dual obligations: HMRC reporting for UK-resident sellers and DAC7 reporting for EU-resident sellers via the relevant member state.

For a broader overview of KYC documentation obligations, see our document compliance guide.

Who Needs to Report: Thresholds and Definitions

Under both the UK Platform Information Regulations and DAC7, reporting is triggered when a seller either completes 30 or more transactions or earns £1,700 (€2,000) or more in proceeds during a calendar year — below these thresholds, seller data must still be collected and retained but need not be reported. Source: EUR-Lex, DAC7 Directive 2021/514/EU.

The thresholds define when a report must be filed — not when data collection begins. Platforms must collect identity and tax data from all sellers at onboarding, regardless of expected transaction volume. A seller who does not cross either threshold in a given year does not require a report for that year, but their data must be retained for seven years.

Seller Identity Documents: What to Collect

Platforms must collect and verify a defined set of identity and tax documents from sellers before allowing them to trade — the specific requirements differ between individual sellers and business sellers, with HMRC aligning to the OECD's prescribed due diligence fields. Source: HMRC Platform Operators Reporting Rules.

For individual sellers, platforms must collect:

• Government-issued photo identity: passport or driving licence
• Bank account details: account number and sort code (or IBAN for cross-border sellers)
• Proof of address: utility bill, bank statement, or official correspondence dated within three months
• National Insurance number or Unique Taxpayer Reference (UTR), where applicable

For business sellers (sole traders, partnerships, limited companies), the required documents expand:

• Companies House registration number (for UK-registered entities)
• Unique Taxpayer Reference (UTR) issued by HMRC
• VAT registration number (if the business is VAT-registered)
• Business bank account details
• Proof of registered business address

Verification must go beyond document collection. Platforms are expected to confirm that the information provided is plausible, consistent, and not contradicted by other data held. CheckFile's multi-layer analysis — structural, metadata, and cross-document consistency checks — addresses precisely this requirement, supporting verification of 3,200+ document types across 32 jurisdictions.

For a practical walkthrough of KYC document checklists by business type, see our due diligence checklist for businesses.

DSA Article 30: Verifying Professional Traders

Under Article 30 of the EU Digital Services Act (Regulation 2022/2065), online marketplaces must collect, verify, and retain information from professional traders before allowing them to offer goods or services — the verification obligation applies before activation of the seller account, not retrospectively. Source: EUR-Lex, DSA Regulation 2022/2065, Article 30.

The DSA draws a legal distinction between consumer sellers (individuals selling occasionally) and professional traders. A professional trader is any natural or legal person acting in the course of their trade, business, or profession. Where there is ambiguity, marketplaces must make reasonable efforts to assess the seller's status.

For professional traders, Article 30 requires platforms to collect: the seller's name and address; national registration number or equivalent identifier; payment account details; confirmation that the seller is not subject to EU product safety bans; and a self-declaration that the information provided is accurate. Platforms must make best efforts to verify this information using freely available official databases or by requesting documentary evidence.

Very Large Online Platforms (VLOPs) — those with 45 million or more monthly active EU users — face enhanced obligations. They are subject to direct supervision by the European Commission, must conduct annual risk assessments of their seller verification processes, and must publish transparency reports on compliance with Article 30. Designated VLOPs as of 2024 include Amazon Marketplace, eBay, and Zalando.

UK platforms operating outside the EU are not subject to DSA Article 30 directly. However, UK platforms that offer services to EU users, or that operate EU-facing storefronts through subsidiaries, are within scope. The DSA applies based on where users are located, not where the platform is incorporated.

For a connected discussion of financial services marketplace obligations, see our KYC solutions for banking and regulated finance.

HMRC Reporting Timeline and Deadlines

The UK Platform Information Regulations established a recurring annual reporting cycle starting with calendar year 2024 data — platforms that were operational on 1 January 2024 had an obligation to begin collecting seller data from that date, with the first reports due by 31 January 2025.

Platforms that were not operational before 1 January 2024 but launched during 2024 were still required to file a return for that partial year by 31 January 2025, covering any sellers active during the platform's operational period.

The HMRC reporting format follows the XML schema derived from the OECD Model Rules for Reporting by Platform Operators (MRDPO). Submissions must include: platform operator identification details, a list of reportable sellers, the prescribed data fields for each seller, and the gross proceeds per seller per quarter.

Penalties for Non-Compliance

HMRC can impose penalties of up to £300 per seller who is not reported when reporting was required — and where failures are found to be systematic or deliberate, escalating penalties apply under the standard framework for information return failures in the Finance Act 2011. Source: HMRC Platform Operators Reporting Rules.

The penalty structure for UK platform reporting operates as follows:

• Initial failure to file: fixed penalty of up to £300 per unreported seller
• Continued failure after notice: daily penalties accruing until the return is submitted
• Deliberate non-compliance or falsification: penalties aligned with the Finance Act 2011 Schedule 36 framework, which allows HMRC to pursue penalties of up to 100% of the tax that would have been recoverable from the unreported income

Beyond financial penalties, HMRC can compel disclosure through information notices, which require platforms to hand over all seller data held. Refusal to comply with an information notice itself attracts separate penalties.

For EU platforms subject to DAC7, penalties are set at the member-state level. Most EU member states have enacted penalties in the range of €500–€5,000 per reporting failure, with criminal sanctions reserved for deliberate fraud. Germany, France, and the Netherlands have published specific penalty schedules.

The National Crime Agency (NCA) may also become involved where non-compliance is linked to suspected money laundering or tax evasion facilitation, triggering Suspicious Activity Report (SAR) obligations for the platform.

Automating Marketplace Seller KYC

Manual seller verification at scale is operationally untenable: a marketplace onboarding 10,000 new sellers per month faces over 120,000 annual document checks across passports, driving licences, Companies House extracts, UTR letters, and bank statements — automation is the only practical path to sustained compliance.

CheckFile provides automated document verification through a multi-layer analysis pipeline — structural, metadata, and cross-document consistency checks — that handles the full range of seller documents required under SI 2023/1143 and DSA Article 30. The platform supports 3,200+ document types across 32 jurisdictions, enabling verification of both UK-resident and international sellers on a single workflow.

Key automation capabilities relevant to marketplace seller KYC include:

• Identity document verification: passport and driving licence checks against structural templates and security feature databases
• Business registration verification: Companies House number format validation and cross-reference against public registry data
• Bank account detail validation: account number and sort code format checks, with IBAN validation for EU sellers
• Cross-document consistency: automated flagging where the name on a passport does not match the name on a bank statement or registration document
• Audit trail generation: timestamped verification records held for the seven-year retention period required under HMRC rules

Platforms can integrate CheckFile via API to trigger document checks at the point of seller onboarding, with results returned in under 30 seconds for most document types. For high-volume use cases, batch processing allows verification of queued seller documents outside peak traffic windows.

For pricing and volume tiers relevant to marketplace operators, see our pricing page.

Frequently Asked Questions

Do I need to collect ID from all my sellers or just high-volume ones?

You must collect identity documents from all sellers at onboarding — the reporting thresholds (30 transactions or £1,700 in proceeds) determine when you must file a report with HMRC, not when you must collect documents. A seller who makes a single sale still requires identity verification under the due diligence rules. The data simply does not need to be included in your annual return unless that seller crosses the threshold during the calendar year.

What happens if a seller refuses to provide their tax ID?

If a seller refuses to provide their tax identification number (UTR, National Insurance number, or equivalent for non-UK sellers), you must make two additional attempts to obtain the information before the reporting deadline. If the seller still refuses or fails to provide the information, you are required to close or suspend the seller's account. You cannot simply omit a non-cooperative seller from your return — the seller's refusal must itself be documented and, depending on the circumstances, may need to be flagged as a suspicious activity to the NCA.

Is the UK's platform reporting the same as EU DAC7?

The UK's Platform Information Regulations (SI 2023/1143) and EU DAC7 (Directive 2021/514/EU) are substantively equivalent — they share the same thresholds, the same data fields, and the same annual reporting cycle, because both derive from the OECD Model Rules for Reporting by Platform Operators (MRDPO). The key differences are administrative: UK platforms report to HMRC rather than to an EU member state's tax authority, and data exchange runs through OECD multilateral channels rather than the EU's DAC network. A UK platform with EU-resident sellers faces both regimes simultaneously and must file separate reports to HMRC and to the relevant EU authority (or rely on a single competent authority agreement where available).

Does DSA Article 30 apply to UK-based marketplaces?

DSA Article 30 applies based on where the marketplace's users are located, not where the marketplace is incorporated. A UK-based marketplace that allows EU consumers to purchase from EU-resident professional traders is within scope of the DSA for those transactions. The European Commission has primary enforcement authority over VLOPs, while national Digital Services Coordinators in each EU member state handle enforcement for smaller platforms. UK platforms operating in the EU market should take specific legal advice on their DSA exposure, particularly if they fall below the VLOP threshold but still have significant EU user bases.

What is the FCA's role in marketplace seller KYC?

The FCA's role is most directly relevant for financial services marketplaces — platforms that facilitate the sale of financial products, insurance, or credit between buyers and sellers. Under the FCA's Consumer Duty (PS22/9), firms must ensure that customers can access products that meet their needs, which for marketplaces means verifying that sellers are authorised where required and that product information is accurate. The FCA has also issued guidance under its financial crime frameworks that applies to any marketplace with payment processing functions. For marketplaces that are not regulated financial services firms, the FCA's direct remit is limited, but the ICO's data protection requirements apply to all seller data collected and retained under the platform reporting rules.

For a connected discussion of KYC obligations across regulated sectors in 2026, see our KYC 2026 requirements guide.

---

This article is for informational purposes only and does not constitute legal advice.