eCommerce & Marketplaces Compliance in the United Kingdom

The UK market is open to online retailers and marketplaces without sector licensing. Obligations attach to specific activities instead: running a platform that pays sellers, selling age-restricted goods, hosting user content, processing children's data, and dealing in high-value goods for cash or in art.

The principal authorities are HM Revenue and Customs (platform seller reporting and AML supervision of high value dealers and art market participants), the Competition and Markets Authority (consumer law), Ofcom (online safety) and the Information Commissioner's Office (data protection). Age-of-sale offences for goods are enforced locally by Trading Standards and the police.

The biggest obstacle for a new entrant is that the identity rules are fragmented: seller verification is driven by tax law, buyer verification by product-specific criminal offences and online safety duties, and both must be squared with data minimisation.

1. Who regulates this sector

Local Trading Standards services and the police enforce age-of-sale offences for knives, tobacco and vapes. Rules on bladed articles and tobacco differ between England and Wales, Scotland and Northern Ireland.

2. Licensing and authorisation

There is no general licence for online retail or for operating a marketplace. Authorisation is triggered by particular activities.

Platform operator registration with HMRC

A website or app is a digital platform under the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023 (SI 2023/817) if it connects sellers to customers and the operator holds, can easily calculate or can find out the amount paid to sellers. HMRC's guidance gives a clothes resale app that collects and passes on payments as an example; a listings site where buyers pay sellers directly by bank transfer or cash, and the operator cannot find out the amount, is not a platform. Operators resident, incorporated or managed in the UK must notify HMRC that they are a reporting platform operator (regulation 7) or an excluded platform operator (regulation 8). Sole traders running a platform, and businesses selling only their own goods through their own website, do not register.

AML registration for high-value and art businesses

A high value dealer or art market participant must be on HMRC's register before trading in that capacity (regulation 56 of the Money Laundering Regulations 2017). A marketplace that holds buyers' funds for sellers should also check whether payment services regulation applies to its flow of funds.

Licensing of tobacco retail

The Tobacco and Vapes Act 2026 creates retail licensing schemes for tobacco and related products in England (sections 16 to 18), Wales and Northern Ireland, each starting on a date set by the relevant government [Adopted, commencement date not yet set].

3. AML, KYC and customer due diligence

Online retailers and marketplaces are not, as such, relevant persons under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Two definitions in regulation 14 can bring them into scope:

High value dealer

A firm or sole trader trading in goods (including an auctioneer) that makes or receives cash payments of at least £10,000 in a single transaction or linked transactions. Card and bank payments do not count, so most online sellers are outside this definition.

Art market participant

A firm or sole practitioner that trades in, or acts as an intermediary in the sale or purchase of, works of art where the transaction or linked transactions amount to £10,000 or more, whatever the payment method. Online art marketplaces acting as intermediaries can fall within it. Artists selling their own work are excluded.

Both thresholds were set in sterling by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621), which converted euro amounts on a 1:1 basis with effect from 30 June 2026 and aligned the transaction-based customer due diligence triggers for art market participants with those for high value dealers. HMRC is the supervisory authority for both (regulation 7). In-scope firms must apply the full regime: risk assessment, customer due diligence, enhanced due diligence where required, record keeping and suspicious activity reporting to the National Crime Agency.

For everyone else there is no customer identification rule for buyers. Identity duties come instead from the tax reporting regime for platforms (sellers) and from age-of-sale and online safety law (buyers and users), described below.

4. Identity verification and onboarding

Sellers: tax due diligence

Regulation 3 of SI 2023/817 requires reporting platform operators to collect and verify seller information by applying the due diligence procedures in section II of the OECD model rules, and to keep records of the steps taken and the information collected for five years. HMRC's guidance lists the data to collect:

Verification uses all information available to the operator, including what it can obtain from a third party, and remains the operator's responsibility even when outsourced. A seller's primary address is valid for 36 months, after which the seller must confirm it. Where an operator already checks documents such as driving licences, it must update records when they reveal a change. A seller who refuses to provide information may have access limited until they do. Sellers of goods paid €2,000 or less (about £1,700) for fewer than 30 sales in a year are not reported.

Buyers: age checks for restricted goods

For bladed articles sold remotely in England and Wales, the due diligence defence to the under-18 sale offence is available only if the seller meets four conditions in section 141B of the Criminal Justice Act 1988: it operated an age-checking system likely to prevent under-18 purchases; the package was marked as containing a blade for delivery only to an adult; it took all reasonable precautions to ensure delivery into the hands of a person aged 18 or over; and it did not deliver to a locker.

Users: age assurance on platforms

Marketplaces with user-generated content (listings, reviews, messaging) can be user-to-user services under the Online Safety Act 2023. Since 25 July 2025, services likely to be accessed by children must use highly effective age assurance to prevent children accessing pornography and content encouraging self-harm, suicide or eating disorders (DSIT). Under the ICO's Children's code standard 3, a service must either establish age with certainty proportionate to the risk or apply the code's protections to all users.

Digital verification services

The sections of the Data (Use and Access) Act 2025 establishing the digital verification services trust framework and register came into force on 1 December 2025 (SI 2025/1213). No eCommerce rule yet requires a certified provider, but certification offers a recognised benchmark when choosing one.

5. Digital channels: what's different

Bottom line: the identity duties that matter in this sector exist only, or mainly, online: platform seller due diligence, remote-sale age verification for knives and online safety age assurance have no counter-sale equivalent.

Remote knife sales are getting stricter

Section 32 of the Crime and Policing Act 2026 [Adopted, commencement date not yet set] will replace Condition A in section 141B. Before the sale, the seller must obtain a copy of a physical identity document (UK or foreign passport, or UK driving licence) plus a photograph of the buyer, or take verification steps prescribed by regulations, such that a reasonable person would be satisfied the buyer is 18 or over. Delivery must be to the buyer personally. Section 35 creates delivery offences for couriers and their subcontractors, with a defence where the recipient showed a physical identity document or passed prescribed checks.

Self-declaration is not age assurance

The ICO fined Reddit £14.47 million on 24 February 2026 for processing under-13s' data without a lawful basis, having no robust age assurance, and told the platform that self-declaration is easy to bypass. The ICO and Ofcom published a joint statement on age assurance on 25 March 2026 covering both regimes.

Pending changes

The government's July 2026 response to its consultation on children online set out plans to ban social media services for under-16s and to require rigorous age checks [Government policy, not yet law]. Product safety proposals for marketplace seller verification are described in section 7.

6. Data protection and biometrics

The UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, govern identity data collected for seller due diligence and age checks; the ICO regulates them.

Seller data

Seller data collected under SI 2023/817 is processed to meet a legal obligation, which limits what must be collected but also how long it is kept: the five-year retention period in regulation 3(4) runs from the day after the end of the reportable period.

Age assurance and children

The Children's code expects proportionate, risk-based age assurance. Collecting more data than the risk requires conflicts with data minimisation, so the method should match what is being restricted: a knife sale, adult content and a general marketplace call for different levels of certainty.

Biometrics

Face matching against an identity document is biometric recognition, and biometric data used to identify a person is special category data. The ICO's biometric recognition guidance addresses the special category condition, the role of explicit consent, accuracy and discrimination risks, and data protection impact assessments; the ICO notes it is under review following the 2025 Act.

7. Sector-specific obligations

Reporting cycle for platforms

Reportable periods run from 1 January to 31 December. The report goes to HMRC electronically by 31 January (regulation 4), with the same information sent to each reportable seller. An operator may rely on another platform to report a seller if it notifies HMRC, but not for UK-resident sellers reported abroad (regulation 4(5A), added in November 2024). Operators may elect to verify only active sellers, and have until the end of the second reportable period to verify pre-existing sellers.

Consumer law on marketplaces

Since 6 April 2025 the CMA can decide consumer law infringements itself under the Digital Markets, Competition and Consumers Act 2024 rather than going to court. Drip pricing and fake reviews are prohibited, and the CMA's fake reviews guidance (CMA208, April 2025) sets out what businesses that publish reviews must do to prevent and remove them.

Proposed marketplace product safety duties

Under the Product Regulation and Metrology Act 2025, the OPSS consultation on a new product safety framework (31 March to 23 June 2026) [Consultation closed 23 Jun 2026, response pending] proposes making online marketplaces a regulated supply chain actor with a duty of due care. Expected activities include recognising sellers with multiple profiles, removing repeatedly non-compliant sellers and Know-your-business checks; the one specific requirement proposed is to verify seller contact details and keep them up to date. Further checks are floated for higher-risk products, including a UK-based responsible person for overseas sellers.

Tobacco and vapes

Section 1 of the Tobacco and Vapes Act 2026 makes it an offence in England and Wales to sell tobacco, herbal smoking products or cigarette papers to anyone born on or after 1 January 2009, from 1 January 2027 [Adopted, effective 1 Jan 2027], with equivalent provisions for Scotland and Northern Ireland. The defence is to have taken verification steps specified in regulations, or all reasonable steps.

8. Risk indicators and red flags

Seller and buyer identity abuse on marketplaces

• Multiple seller profiles: one operator behind several accounts, a pattern OPSS expects marketplaces to detect.
• Repeat non-compliance: sellers relisting products after removal or warnings.
• Unverifiable tax numbers: National Insurance or tax numbers with missing characters or flagged as incorrect by HMRC.
• Stale details: addresses unconfirmed for over 36 months or contact details that fail on recall.
• Payments to third-party accounts: seller proceeds paid to an account in another person's name.
• Age by self-declaration only: the ICO treats this as easy to bypass where children are at risk.
• Locker or third-party delivery for blades: incompatible with the remote knife sale conditions.
• Review manipulation: fake or misleading consumer reviews, which the CMA's guidance requires publishers to prevent and remove.

9. Enforcement and penalties

On 23 June 2026 the CMA fined StubHub UK close to £900,000, one of the largest UK ticket marketplaces, for adding mandatory fees at the final checkout stage between 6 April and 7 December 2025, and ordered refunds of over £590,000 to more than 50,000 customers; the penalty reflected a 40% reduction for settlement. The ICO's £14.47 million fine on Reddit (24 February 2026) for age assurance failures is under appeal to the First-tier Tribunal.

10. Recent changes and what to watch

• 1 January 2027 [Adopted, effective 1 Jan 2027]: tobacco age-of-sale offence for anyone born on or after 1 January 2009; age checks for tobacco must account for date of birth, not just age 18.
• 15 July 2026 [Government policy, not yet law]: plan to bar under-16s from social media with rigorous age checks; watch for regulations that may reach marketplaces with social features.
• 30 June 2026 [In force]: AML thresholds for high value dealers and art market participants set at £10,000; check whether art sales on the platform reach it.
• 23 June 2026 [Consultation closed, response pending]: product safety framework consultation closed; marketplace seller contact verification proposed.
• 29 April 2026 [Adopted, commencement date not yet set]: Crime and Policing Act 2026 requires ID document copy and photo for remote knife sales; build the capability before commencement.
• 25 March 2026 [In force]: ICO and Ofcom joint statement on age assurance across online safety and data protection.
• 1 December 2025 [In force]: digital verification services trust framework and register provisions of the Data (Use and Access) Act 2025.

11. What this means for identity verification

Seller onboarding must capture date of birth and a tax identifier as well as name and address, and must be able to verify them, flag inconsistencies and limit accounts until data is complete. Entity sellers need registry-based checks against company or charity numbers. Records of the verification steps, not just the results, must be retained for five years.

Buyer-side checks should be configured per product category and nation. Knives sold into England and Wales need an age check before dispatch now, and a document-plus-photo capability (or a prescribed alternative) once the 2026 Act commences; the physical-document requirement excludes purely digital credentials unless regulations add them. Tobacco checks from 2027 must confirm a birth date before 1 January 2009.

For platforms in scope of the Online Safety Act, age estimation or verification must be "highly effective", and self-declaration should not be the only control. Any face matching or estimation involves biometric processing requiring a special category condition, a data protection impact assessment and accuracy testing across demographic groups. Re-verification triggers include address expiry after 36 months, HMRC notices of incorrect tax numbers and changes revealed by documents the platform already checks.