KYC for US Online Marketplace Sellers: IRS 1099-K and BSA Compliance 2026

US online marketplaces — from e-commerce platforms and gig economy apps to peer-to-peer payment networks — face a layered compliance framework in 2026 that extends well beyond basic account sign-up checks. Platforms that process seller payments must collect and verify seller identity documents to satisfy IRS Form 1099-K reporting obligations under 26 USC §6050W, Bank Secrecy Act (BSA) AML program requirements under 31 USC §5311, and — where applicable — Corporate Transparency Act (CTA) beneficial ownership reporting under 31 USC §5336. Individual sellers must also understand that their marketplace income is reportable to the IRS beginning at $600 in annual gross payments, a threshold that has been in effect since tax year 2023.

This guide explains exactly what documentation US marketplaces must collect from sellers, when BSA obligations are triggered, how state-level marketplace facilitator laws interact with federal requirements, and what the penalties for non-compliance look like in practice.

This article is for informational purposes only and does not constitute legal or tax advice. US tax and financial regulations are evolving. Consult a qualified US tax attorney or compliance professional for advice specific to your situation.

IRS 1099-K: The Core Reporting Requirement for US Marketplaces

US marketplace platforms that process payments are Third Party Settlement Organizations (TPSOs) under 26 USC §6050W and must issue IRS Form 1099-K to any seller who receives $600 or more in aggregate gross payments in a calendar year. This represents a dramatic reduction from the prior threshold of $20,000 and 200 transactions, which applied through tax year 2022.

Form 1099-K reports the gross amount of all reportable payment transactions — it is not a statement of taxable profit, and sellers may deduct legitimate business expenses when preparing their tax returns. The form is filed both with the IRS and provided directly to the seller by January 31 of the following year.

For platforms, the obligation runs in two directions:

1. Data collection: To issue an accurate 1099-K, the platform must collect and verify each seller's legal name, address, and taxpayer identification number (TIN) — either a Social Security Number (SSN), Individual Taxpayer Identification Number (ITIN), or Employer Identification Number (EIN) for businesses. This is collected via IRS Form W-9 for US persons.

2. Backup withholding: If a seller fails to provide a valid TIN, or if the IRS notifies the platform that the TIN is incorrect, the platform must withhold 24% of reportable payments as backup withholding and remit this to the IRS. Backup withholding applies from the first dollar of payments; there is no de minimis exception once the seller's TIN status is flagged.

The IRS Form 1099-K guidance confirms that the $600 threshold applies for tax year 2023 onward. IRS Notice 2023-10 and IRS Notice 2024-85 addressed phase-in considerations for calendar years 2023 and 2024 respectively, but as of the 2025 tax year filed in 2026, the $600 threshold is fully operative with no transitional relief.

The practical implication for platform compliance teams is clear: every seller onboarding flow must collect a W-9 before the platform processes the seller's first payment, because there is no practical way to retroactively impose backup withholding on payments already disbursed.

For a broader framework on documentary compliance obligations that interact with these IRS requirements, see our document compliance guide.

Who Must Report: Thresholds and Definitions

A Third Party Settlement Organization (TPSO) is defined under 26 USC §6050W(b)(3) as any person who has the contractual obligation to make payment to participating payees in settlement of third-party network transactions. If your platform sits between a buyer and a seller and settles the transaction, you are almost certainly a TPSO.

The threshold evolution from 2022 to 2026 is summarized below.

As of tax year 2025 (returns filed in early 2026), there is no transitional threshold: any seller receiving $600 or more in gross reportable payments triggers a 1099-K filing obligation. Platforms that designed their KYC onboarding around the $20,000 historical threshold must update their seller verification workflows immediately.

Entities explicitly excluded from TPSO status include payment card networks (which have separate reporting obligations under 26 USC §6050W(a)) and transactions between entities that are part of the same controlled group. Personal reimbursements — such as splitting a dinner bill — are not reportable transactions; however, platforms bear the burden of distinguishing commercial from personal payments, and IRS guidance has consistently indicated that platforms should not make this determination without adequate seller documentation.

Seller Documentation: What to Collect from US Sellers

Platforms must collect identity and tax documentation from every seller before the first payment is processed — not after a threshold is crossed — because backup withholding obligations and AML program requirements apply from the first dollar of transactions.

The table below sets out the minimum required documentation by seller type.

For business sellers, state registration documents are not optional: a platform that disburses funds to an entity that does not exist in any state registry has failed its Customer Due Diligence (CDD) obligations and may face BSA liability if those funds are connected to financial crime.

CheckFile's document verification platform supports automated validation of US state business registrations, EIN confirmation against IRS records, and government-issued ID authentication across all 50 states — including driver's licenses from all US jurisdictions. The platform verifies 3,200+ document types across 32 jurisdictions, providing coverage for international sellers operating on US platforms.

For the seller KYC workflow in banking and financial services contexts, see our dedicated bank KYC solutions page.

FinCEN and BSA: When Marketplaces Become Money Services Businesses

A marketplace that accepts and transmits funds on behalf of sellers — rather than simply facilitating card payments through a licensed payment processor — may qualify as a Money Services Business (MSB) under FinCEN's regulations at 31 CFR §1010.100(ff), triggering registration, AML program, and SAR filing requirements under the BSA.

The distinction matters because the obligations differ significantly:

• Payment card processor / ISO: Primary BSA obligations rest with the card network and acquiring bank. The marketplace's 1099-K obligations remain, but no FinCEN MSB registration is required solely for facilitating card-based transactions.
• Money transmitter: If the platform holds seller funds in a pooled account, advances payments, issues marketplace-specific wallets or credits, or settles peer-to-peer payments, it may qualify as a money transmitter — one of the six MSB categories defined under 31 CFR §1010.100(ff).

The FinCEN MSB registration portal at fincen.gov/msb-state-selector provides guidance on which activities trigger registration requirements. FinCEN's 2019 guidance on convertible virtual currencies and its 2021 guidance on peer-to-peer payment applications have progressively expanded the scope of MSB treatment to cover fintech-style marketplace payment flows.

An MSB must:

1. Register with FinCEN (Form 107) within 180 days of establishing the business, and re-register every two years.
2. Implement a written AML program covering: internal policies and procedures; designation of a BSA compliance officer; ongoing employee training; and independent testing/audit of the program.
3. File Suspicious Activity Reports (SARs) for transactions of $2,000 or more where suspicious activity is detected — or where structuring to evade reporting thresholds is suspected, with no minimum dollar threshold.
4. Maintain records of transactions of $3,000 or more including customer identification information, under 31 CFR §1022.410.
5. Register with state money transmission regulators in each state where the platform operates — most states require separate money transmission licenses, with applications typically submitted through the Nationwide Multistate Licensing System (NMLS).

Many marketplace platforms avoid direct MSB classification by partnering with a licensed payment processor or bank sponsor that assumes the regulated money transmission function. However, this structure does not eliminate all BSA obligations: the platform still bears 1099-K reporting responsibilities, and regulators have increasingly scrutinized arrangements where the platform retains effective control over funds flows while claiming to have outsourced regulated activities.

For a detailed look at AML red flags that marketplace compliance teams should monitor, see our guide on AML red flags and suspicious activity indicators.

Corporate Transparency Act: Beneficial Ownership Reporting for Marketplace Sellers

The Corporate Transparency Act (CTA), enacted as 31 USC §5336 and part of the Anti-Money Laundering Act of 2020, requires most US companies and foreign companies registered to do business in the US to disclose beneficial ownership information (BOI) to FinCEN's BOI database.

For marketplace platforms, the CTA creates two distinct compliance considerations:

1. The platform itself (if incorporated) must file its own BOI report. Any company that is a reporting company under the CTA must disclose the name, date of birth, address, and unique identifying document number of each individual who owns or controls 25% or more of the company, or who exercises substantial control over it.

2. Business sellers on the platform may be required to have filed BOI reports. While marketplaces are not obligated to verify a seller's CTA compliance status, platforms conducting enhanced due diligence on high-risk business sellers may reasonably request BOI confirmation as part of their AML program — particularly where the seller's beneficial ownership structure is unclear.

Critical 2025-2026 enforcement caveat: CTA enforcement has been subject to significant legal uncertainty. Multiple federal district courts issued injunctions in late 2024 and early 2025 pausing BOI reporting requirements, and the US Treasury announced in early 2025 that it would not enforce BOI filing penalties against domestic reporting companies while litigation was pending. Compliance teams should verify the current enforcement status with qualified legal counsel, as this area is actively evolving.

The FinCEN BOI reference at fincen.gov maintains updated guidance on reporting obligations and enforcement status.

State-Level Marketplace Facilitator Laws

Most US states have enacted marketplace facilitator laws that impose sales tax collection and remittance obligations on platforms — and several states are now extending identity verification requirements to marketplaces as a condition of their seller registration frameworks.

The primary state-level requirements relevant to marketplace KYC in 2026 include:

California: California's AB 1324 (2023) requires online marketplaces to collect and verify the identity of high-volume third-party sellers — defined as those making 200+ discrete sales AND $5,000+ in aggregate sales in a 12-month period. Required information includes legal name, business address, government-issued ID or business registration number, and bank account details. The California Attorney General enforces these requirements, with the FTC's marketplace guidance providing a parallel federal framework for deceptive practices.

New York: New York's marketplace seller disclosure law (General Business Law §396-nnn) similarly requires identity disclosure for high-volume sellers, with verification obligations for platforms.

Illinois: Illinois has implemented marketplace facilitator provisions that require platforms to collect seller information sufficient to support sales tax compliance, with cross-referencing against Illinois Secretary of State business registration records for entity sellers.

All states: Economic nexus rules following the Supreme Court's South Dakota v. Wayfair (2018) decision mean that marketplace facilitators with economic nexus in a state must collect and remit sales tax. Accurate seller identity and business address data — collected through the KYC process — is essential for determining nexus and proper tax treatment.

For marketplace platforms operating nationally, the practical approach is to design a single seller onboarding flow that satisfies the most demanding state requirements (currently California's AB 1324) as a floor, supplemented by state-specific disclosures where required.

Privacy Compliance: CCPA and Seller Data

Seller identity data collected for IRS 1099-K and BSA KYC purposes constitutes "personal information" under the California Consumer Privacy Act (CCPA, Cal. Civ. Code §1798.100 et seq.) and equivalent privacy laws in Virginia, Colorado, Connecticut, Texas, and other states — meaning platforms must maintain a lawful basis for collection, provide privacy notices, and honor deletion and access rights within the limits of their legal retention obligations.

The interaction between privacy rights and regulatory retention obligations creates tension that marketplace compliance programs must manage carefully:

Platforms should implement a tiered data architecture that separates regulatory compliance data (W-9, ID documents, BSA records) from commercial seller data, with different retention schedules and access controls for each tier. This prevents inadvertent use of compliance data for commercial purposes — a practice that regulators and plaintiff's attorneys have both begun scrutinizing under state privacy enforcement frameworks.

The FTC enforces Section 5 of the FTC Act against deceptive data practices, including misrepresentations about how seller data is used. Marketplaces that collect seller SSNs for 1099-K purposes but then use that data for credit profiling without disclosure face both FTC and state Attorney General exposure.

For security practices around seller document handling, see our security overview.

Penalties for Non-Compliance

Penalties for marketplace KYC and reporting failures in the US are substantial, and the IRS and FinCEN have both signaled increased enforcement focus on third-party payment platforms in 2025 and 2026.

IRS 1099-K Penalties

Under 26 USC §6721 and §6722, penalties for information return failures apply per form filed late, incorrectly, or not at all:

For a large marketplace with millions of sellers, even a 1% failure rate on 1099-K filings at the $310 per-form penalty level can generate tens of millions of dollars in IRS penalties in a single tax year. The intentional disregard penalty — applicable when a platform knowingly fails to collect W-9 data — carries no annual cap.

Backup withholding failures compound these penalties: a platform that fails to impose 24% backup withholding on a seller who did not provide a valid TIN becomes personally liable for the tax that should have been withheld, in addition to the information return penalties.

BSA/AML Penalties

For platforms classified as MSBs or otherwise subject to BSA:

• Civil penalties: Up to $25,000 per day for negligent BSA violations; up to $100,000 per day for willful violations (31 USC §5321).
• Willful BSA violations involving large transactions: Up to $1,000,000 per day or the amount of the transaction involved, whichever is greater — the standard applied in major enforcement actions.
• Criminal penalties: Up to 10 years imprisonment and criminal fines for willful BSA violations (31 USC §5322).
• SAR failure: Failing to file a SAR on a $2,000+ suspicious transaction carries penalties of up to $100,000 per violation.

The 2024 TD Bank enforcement action — a $1.8 billion BSA penalty, the largest in US bank history — illustrates the upper range of BSA exposure where systemic AML failures are found. While most marketplace platforms would not face bank-scale penalties, FinCEN has demonstrated willingness to pursue MSB-level BSA enforcement against fintech-style payment platforms.

State Penalties

California's AB 1324 marketplace verification requirements carry civil penalties of up to $1,000 per day for failure to maintain required seller records, plus private right of action for injured consumers. New York's marketplace disclosure law provides for similar civil penalties enforced by the Attorney General.

For a comprehensive view of how compliance failures translate to regulatory penalties across sectors, see our guide on KYC requirements in 2026.

Frequently Asked Questions

Do I need to collect a W-9 from every seller, or only those likely to exceed $600?

You must collect a W-9 (or W-8 series for foreign sellers) from every seller before processing the first payment. The $600 threshold determines when you must file a 1099-K with the IRS and send a copy to the seller — it does not determine when you must collect taxpayer identification information. If you wait until a seller approaches the threshold, you will face a window where payments are being processed without a valid TIN on file, triggering backup withholding obligations that are impossible to apply retroactively to disbursed funds.

Our marketplace uses a third-party payment processor. Are we still responsible for 1099-K?

The TPSO definition under 26 USC §6050W depends on which entity has the contractual obligation to make payment to the seller. If your marketplace agreement commits you to paying sellers, you are the TPSO regardless of which entity actually moves the money. In some structures, the payment processor contractually assumes TPSO status and takes on 1099-K obligations — but this must be explicitly documented in your agreement with the processor. Absent a clear contractual allocation of TPSO responsibility, the IRS will look to the entity that has the direct commercial relationship with the seller.

A seller provided an SSN, but IRS backup withholding notice (CP2100) says the TIN doesn't match. What do we do?

When you receive an IRS CP2100 or CP2100A notice, you must initiate the "B-Notice" procedure. Send the seller a first B-Notice requiring them to provide a corrected TIN within 30 days. If the TIN is still incorrect after two B-Notices, you must implement 24% backup withholding on all subsequent payments until the IRS notifies you that the TIN issue is resolved. Failure to implement backup withholding after receiving a CP2100 notice makes the platform personally liable for the 24% that should have been withheld.

We operate in multiple states. Do we need separate seller KYC for each state?

Not necessarily separate KYC, but you need a single onboarding flow that captures the information required by the most demanding state (typically California under AB 1324 for high-volume sellers). Your privacy notice and data use disclosure must address all states where your sellers are located. For sales tax purposes, you need seller business address information to correctly apply marketplace facilitator rules in each economic nexus state — this is typically captured in the same onboarding process as your KYC and W-9 collection.

Does our marketplace need to verify seller information, or is it enough to collect it?

Both IRS and BSA obligations go beyond collection to verification. For IRS purposes, the TIN validation process (checking the TIN against IRS records via the Taxpayer Identification Number matching program) is a well-established best practice that reduces CP2100 notices and backup withholding liability. For BSA purposes, FinCEN's Customer Due Diligence (CDD) Rule (31 CFR §1010.230) requires covered financial institutions to verify the identity of beneficial owners — collection without verification does not satisfy this standard. Automated document verification tools like CheckFile can verify government-issued IDs, business registration documents, and bank account ownership at scale, providing a defensible audit trail for both IRS and FinCEN compliance purposes.

---

Additional resources

• IRS Form 1099-K guidance — official IRS resource for platforms and sellers
• FinCEN MSB registration and AML guidance — FinCEN portal for MSB registration and BSA compliance resources
• FTC marketplace and consumer protection guidance — FTC guidance on marketplace seller identity disclosure and consumer protection
• EU DAC7 reporting framework — for US platforms with EU-based sellers subject to DAC7 reporting obligations

This article is for informational purposes only and does not constitute legal advice. Consult a qualified US tax attorney or compliance professional for advice specific to your situation.