pleenk
enfrespt
Book a demo
← Blog
pt-brfresende

Ofcom is investigating two adult services over non-consensual intimate images: what a PSP should ask its merchants

Published 6 November 20267 min readBy Pleenk Approve

Ofcom is investigating two adult services over non-consensual intimate images: what a PSP should ask its merchants

Monday, 26 October 2026. An alert lands in your inbox. Ofcom, the UK's online safety regulator, has opened two investigations. Both target adult services, and neither is named. You look at your portfolio: about ten adult merchants have customers in the UK. Is one of them the target? And are the others ready?

The short answer: you may never find out who is under investigation. But within a few days, you can find out which merchants would struggle with the same questions. Ofcom is looking at three things: risk assessment, preventing the images from being shared, and how fast they are taken down. Those are also the three questions to put to your merchants.

This article is for the risk and compliance teams at PSPs (the payment providers that let a merchant accept card payments) and acquirers.

What exactly happened?

On 9 September 2026, Ofcom launched an enforcement programme on non-consensual intimate images. They are often called NCII. These are intimate photos or videos shared without the person's consent, including deepfakes, images faked with AI. The programme focuses on two sectors seen as high risk: adult services and messaging services.

The programme is based on the Online Safety Act, the UK's online safety law. It mainly checks one measure: hash matching. The idea is simple. Each reported image gets a digital fingerprint, called a "hash". The platform then compares every new upload against a database of these fingerprints and blocks known copies.

Ofcom added this measure to its codes of practice on illegal content. It has applied since 30 September 2026. It covers, among others, high-risk services whose main purpose is to distribute pornography. The tool Ofcom gives as an example is StopNCII.org. With this tool, the fingerprint is created on the victim's own device, and the image is never sent. A platform can use another solution, but it must show that it works just as well.

On 26 October, Ofcom moved to the next step. It opened two formal investigations: one into an adult content-sharing service, the other into an adult image-hosting service. According to the specialist press, Ofcom is examining whether these services assessed the risk of NCII. It is also looking at whether they stop these images from being shared, and whether they remove them quickly. An investigation does not mean anyone has broken the rules.

Why is this your problem, and not just the merchant's?

There are three reasons.

A fine can weaken your merchant. Ofcom can impose fines of up to £18 million or 10% of worldwide revenue, whichever is higher. A merchant that pays a fine like that becomes a credit risk for you. You then face chargebacks (refunds that cardholders claim through their bank) and the risk of default.

Ofcom can reach you indirectly. In serious cases, Ofcom can ask a court for a "service restriction order". The court can require the providers of a non-compliant service to stop working with it in the UK. The law names payment services explicitly. You could therefore be ordered to cut off a merchant, within a deadline set by the court.

The card networks already ask the same questions. Since 2021, Mastercard has required adult merchants to review content before it is published. Complaints must be handled within seven business days at most. A merchant that is weak in front of Ofcom is often weak against card network rules too.

The questions to ask your adult merchants

Start by sorting your portfolio. Which merchants have users in the UK? Which ones let users or creators upload images? Those merchants come first.

Then send them short questions. Here is what we would ask:

QuestionA strong answerA weak answer
Have you assessed the risk of NCII on your service?A dated document, recently reviewed, with measures linked to each risk"Our policy bans this content"
Have you used hash matching since 30 September?The tool chosen, the go-live date, the number of blocks"Our AI catches everything"
What happens when an image matches?Block, human review, decision recorded and datedNo written procedure
How quickly do you remove reported content?A measured average time, and the number of reportsA "usual" time, with no figure
Who appears in the published content?Creators and co-performers verified, consents archivedOnly the main creator is verified
Can a banned user come back?Ban tied to the person's identityBan tied to an email address
Have you received a letter from Ofcom?A clear answer, and a promise to tell youNo answer

The last question matters. Ofcom says it has already written to some services. A merchant that tells you early is managing its risk. A merchant that hides it puts you at risk.

How should you read the answers?

A document is not enough: ask for numbers. A well-written policy does not prove that the controls are running. Ask for recent data: number of reports, takedown times, number of blocks. A serious merchant can produce them within a few days.

Hash matching does not cover everything. It blocks images that are already known. A new image, never reported, gets through. That is why checks earlier in the chain matter just as much. Who is uploading? Who appears on screen? Did these people agree? A merchant that can answer these three questions reduces the risk at the source.

The evidence must hang together. Is the verified creator really the person who receives the money? Does a ban apply to a person, or only to an account? Evidence spread across five different tools often contradicts itself. In front of a regulator, those contradictions are costly.

What if one of your merchants is under investigation?

Do not cut them off on reflex. An investigation is not a penalty, and a sudden exit can expose you to other risks. Here is what we would do:

  1. Ask the merchant what Ofcom is concerned about, and its timeline for responding.
  2. Run the questions in the table against this merchant, with evidence to back each answer.
  3. Watch its numbers closely: chargebacks, complaints, volumes coming from the UK.
  4. Write down your decision and the reasons for it: keep the merchant, keep it under conditions, or exit. If Ofcom or a card network asks, you can show that you acted.

One last thing. These investigations are not only about the big names. Ofcom's programme targets an entire sector. The best time to ask your merchants these questions is before the regulator does.

How Pleenk Approve can help

Pleenk Approve helps adult platforms produce the evidence you expect from them. At the heart of Pleenk is a single digital identity. Every creator, co-performer, agency or affiliate is verified with a liveness check. Pleenk encrypts that identity and stores it in a single wallet. The platform receives proof, never the ID document. Everything is linked to that wallet: the person's accounts, consents, the bank account that receives their earnings and any bans. The evidence is therefore consistent from end to end. Moderation is still done by the platform: Pleenk connects to its AI moderation tool and keeps proof of the controls. Pleenk also measures timings, such as how long it takes to remove content after consent is withdrawn. From Pleenk, your merchant generates its report and shares it with you in one click. Want to talk about your adult portfolio? Write to us at contact@pleenk.com.

This article is for information only and is not legal advice. Regulations and card network rules change. Have your choices checked by your legal advisers.

Sources

More articles
9 November 2026 · 8 min read
Human trafficking and cam studios: what a live streaming platform must check
4 November 2026 · 7 min read
When an agency runs a creator's account: what your platform needs to control
2 November 2026 · 8 min read
The regulator asks for your moderation figures: could you answer within 15 days?