Ofcom has published a consultation on its proposals for what categorised services under the Online Safety Act 2023 must do to tackle fraudulent advertising.

After a long delay, Ofcom finally published its register of categorised services, which includes many of the most widely-used online services in the UK. Those services are subject to additional duties under the Online Safety Act, and the nature and scope of those duties will depend upon which category they fall into (Category 1, 2A, or 2B).

Under sections 38 and 39 of the Online Safety Act, both Category 1 and 2A services are subject to additional duties to protect users from fraudulent advertising. Ofcom’s consultation sets out proposals for the nature and scope of such duties.

The consultation is extensive, explaining in detail the scale and impact of fraudulent advertising online before setting out its proposals in what is described as a “layered approach”, comprising measures which (a) stop fraudsters posting fraudulent advertisements in the first place; (b) improve the speed at which fraudulent advertisements are detected; and (c) ensure swift action, once taken, to remove fraudulent advertisements.

Given its scale, we do not cover every proposal in the consultation here. Instead, below are those measures which are likely to be of most practical significance for providers:

• Carry out a ‘fraud indicator assessment’ (to be reviewed and updated at least every 12 months) to identify characteristics that “indicate, either alone or in combination, a material risk of fraudulent advertising”.
• Carry out and record an annual review of the measures it has taken to comply with the fraudulent advertising duties, name an individual accountable for compliance with them, have written statements of responsibilities for senior managers who make decisions relating to compliance with them, and have internal monitoring arrangements to ensure that any measures taken to comply with the duties are effective.
• Ensure that any ‘advertisement generation tool’ (i.e. a generative AI tool used to create ads) used by the provider is tested to identify whether, and if so, how it could be used to create fraudulent advertisements.

• Have an ‘account checks and actions policy’ setting out how they verify that account holders work for the individual or organisation they advertise, how they carry out checks to prevent banned advertising account holders returning, and how they find risky accounts.
• Implement a ‘financial services verification policy’, setting out the types of financial services advertising allowed on the service, and how the provider will find and verify such advertisements.
• Introduce measures to prevent bad actors from gaining access to legitimate advertisers’ existing advertising accounts, including implementing an ‘account security mechanism’ which is easy to find, access, and use.
• Ban advertising account holders that post fraudulent advertisements and take reasonable steps to prevent them from returning to the service.
• Have an appeals system in place to allow advertising account holders easily to challenge decisions by providers and ensure that determinations are reached promptly.

• Have systems and processes in place to review and assess paid-for advertisements and to take down fraudulent advertising.
• Ensure terms of service and publicly available statements include information about any proactive technology used to detect fraudulent advertising.
• Operate systems and processes which “enable prospective advertising complainants to make advertising complaints, in a way which will secure that service providers will take appropriate action in relation to them”.
• Set up and make publicly available an ‘ad library’ to help trusted flaggers and other parties identify and report fraudulent advertisements.

The consultation closes on 2 October 2026, after which Ofcom plans to publish a Statement by mid-2027. The consultation can be read in full here. A summary of Ofcom’s proposals can also be found here.