It is Friday morning. A press alert lands in the risk team's inbox. A regulator has opened an investigation into an adult content platform. If that platform is one of your merchants, your day just changed. Sales wants to know whether to worry. Management asks if you are exposed. And someone asks the question nobody likes to hear: "Should we cut them off?"
That is exactly what happened on 16 October 2026. That day, Arcom, the French digital regulator, announced an investigation into the French platform Mym. The investigation is based on the DSA (Digital Services Act), the EU regulation on digital services. The short answer: an investigation is not a penalty, and cutting off a merchant on reflex is rarely the right call. Instead, take a few days to reassess the risk yourself. Focus on the specific points the regulator is targeting. And write down everything you have checked.
This article is for risk and compliance leads at PSPs and acquiring banks with adult merchants. A PSP (payment service provider) is the company that lets a merchant accept card payments. We are not passing judgment on the platform involved. We use this public case to describe a method.
What exactly happened?
According to Arcom's press release, the regulator first reviewed the platform's compliance. It then sent the platform a request for information on 14 October 2026. The platform has fifteen days from receipt to respond. Otherwise, it risks a penalty.
Arcom suspects two sets of breaches. At this stage, they are not proven:
- protection of minors: Arcom questions the age-check method and the point at which the check is triggered;
- transparency of the service: Arcom considers the terms and conditions incomplete, and the information on recommender systems insufficient.
According to Reuters, the platform did not immediately respond to requests for comment. A Paris law firm analysed the case. According to that firm, the platform says it has verified ages for a long time and cooperates with the authorities.
Two details matter for a PSP. First, the platform is not a "very large online platform" under the DSA. This is a reminder that the rules on protecting minors also apply to smaller platforms. Second, Arcom enforces the DSA for platforms established in France. It has done so since the SREN law of May 2024, a French law to secure the digital space. So if you have merchants established in France, Arcom is your reference regulator.
Why should a PSP care?
Because in this sector, the merchant's risk always ends up becoming yours.
You registered this merchant. Visa runs a programme to monitor high-risk merchants, the Visa Integrity Risk Program (VIRP). Adult content (merchant category code, or MCC, 5967) sits in tier 1, the highest. The acquiring bank must register these merchants. It must also apply risk-based controls, including on the intermediaries that bring it these merchants. At Mastercard, the 2021 rules on adult content point the same way. Mastercard expects merchants to verify the age and identity of the people who appear in content. It also expects them to review content before it is published.
This merchant costs you more than before. Mastercard has overhauled its registration programme for high-risk merchants, the Specialty Merchant Registration. The new version has applied in Europe since 28 September 2026. It costs 1,000 dollars per merchant per year. Per-transaction fees and volume fees come on top. So every adult merchant you keep should be a merchant whose risk you understand.
The amounts at stake are serious. Under the DSA, a breach can cost up to 6% of annual worldwide turnover. Inaccurate, incomplete or misleading information can cost up to 1%. The same 1% cap applies to a failure to respond. The regulator can also impose a penalty for each day of delay. It can reach 5% of average daily turnover. A merchant hit with such a penalty can see its cash and traffic drop overnight. It may even become unable to cover its chargebacks, meaning the payments that customers dispute.
So the real question is not "Is this merchant guilty?" Only the regulator can answer that. The real question is: "Would I have seen what the regulator saw, and can I prove it?"
What should you look at first?
Good news: Arcom's press release gives you a roadmap. Take its concerns one by one. Ask yourself the same questions about this merchant and about similar merchants.
| What the regulator is targeting | The question to ask | The evidence to request |
|---|---|---|
| Age-check method | Is it a real verification, not just a statement from the user? | Provider name, method used, pass and fail rates |
| When the check is triggered | At what point in the journey does the check appear? Before any adult content? | Dated screenshots of the visitor journey, country by country |
| Terms and conditions | Are they complete, up to date and true to the actual service? | Current version and change history |
| Recommender systems | Can the merchant explain what it promotes, and to whom? | Public description and internal documentation |
On age, the European framework is clear. On 14 July 2025, the European Commission published guidelines on the protection of minors. For adult content, they recommend real age verification, not just age estimation. They also rule out a simple self-declaration by the user.
When the check is triggered is the most underestimated point. Take a strong age check that only appears after several pages of content. It protects almost no one. What we would do: browse the site yourself as an anonymous visitor, from several countries. Then note the point at which the check appears.
Don't forget the creators. A regulator interested in visitors will sooner or later look at three things. Who publishes? Who appears in the content? Who gets the money? The card networks also expect you to be able to answer these questions.
What should you actually do this week?
Don't cut off on reflex. A hasty termination creates other risks. Customers may be left without refunds, and chargebacks may soar. Your decision will also be hard to justify if the investigation ends without a penalty. Decide based on facts.
Open a conversation, not an interrogation. Ask the merchant what it can share. For example: what Arcom's request covers, when it plans to respond, and what it has already fixed. It cannot always pass everything on. But a fast, clear answer is already useful information.
Run your own test. Test the visitor journey like a mystery shopper. Check a sample of creators and co-performers. Make sure the verified identity matches the account that receives the payouts. Date and archive everything.
Document your decision. You have three options. You keep the merchant. You keep it under conditions, with a dated action plan. Or you end the relationship. In every case, write down what you saw and why you chose. If the card networks question you, this file is what will count.
Widen the review. This merchant may have had a blind spot. Other merchants with a similar profile may have it too. A public investigation is a free chance to test your portfolio.
What this case changes going forward
This case confirms a trend. Regulators no longer just check that an age check exists. They look at how and when it works, and whether the platform can explain it. The best-prepared PSPs have up-to-date evidence they can consult at any time. A questionnaire filled in once at onboarding is no longer enough.
How Pleenk Approve can help
The heart of Pleenk Approve is a single digital identity. At your merchants, each creator, co-performer, agency or affiliate is verified with a liveness check. Their identity is encrypted by Pleenk and stored in a single wallet (a digital identity wallet). The platform receives proof, never the ID document. Everything is linked to this wallet: their accounts, their consents, the IBAN that receives their earnings and any bans. With Certified Payment, an IBAN that does not belong to the verified person is flagged. Moderation remains the platform's own: Pleenk connects to its AI moderation tool and keeps proof of the checks. Today, your merchant sends you this evidence when you ask for it. Pleenk does not replace your sanctions screening or your anti-money laundering (AML) monitoring. Want to know what evidence to ask your adult merchants for? Write to us at contact@pleenk.com.
This article is for information only and does not constitute legal advice. An investigation does not mean a breach has occurred: only a decision by the regulator can establish that. Have your choices validated by your lawyer.
Sources
- Arcom – L'Arcom ouvre une enquête sur la plateforme française Mym (Arcom opens an investigation into the French platform Mym) (16 October 2026): https://www.arcom.fr/presse/larcom-ouvre-une-enquete-sur-la-plateforme-francaise-mym
- Next – Protection of minors: Arcom opens an investigation into Mym (October 2026): https://next.ink/brief-article/protection-des-mineurs-larcom-ouvre-une-enquete-sur-mym/
- Reuters via Devdiscourse – France opens probe into creator platform Mym (16 October 2026): https://www.devdiscourse.com/article/international/3993761-france-opens-probe-into-creator-platform-mym-over-suspected-rule-breaches
- Kohen Avocats – Arcom investigation into Mym: age checks, possible penalties (17 October 2026): https://kohenavocats.com/enquete-arcom-mym-controle-age-conditions-utilisation-sanctions-createurs-abonnes-2026/
- Regulation (EU) 2022/2065 (DSA), Article 52 – Penalties: https://www.springlex.eu/en/packages/dsa/dsa-regulation/article-52/
- Taylor Wessing – Commission guidelines on the protection of minors under the DSA (July 2025): https://www.taylorwessing.com/en/insights-and-events/insights/2025/07/rd-european-commission-guidelines-on-protection-of-minors-under-the-digital-services-act
- PayPal – Card network updates: Fall 2026 release guide (Mastercard Specialty Merchant fees): https://www.paypal.com/us/brc/article/card-network-updates-fall-2026-release-guide
- G2 Risk Solutions – Visa replaces Global Brand Protection Program (VIRP): https://g2risksolutions.com/resources/blog/visa-replaces-global-brand-protection-program/
- Mastercard – Protecting our network, protecting you: preventing illegal adult content (April 2021): https://www.mastercard.com/news/perspectives/2021/protecting-our-network-protecting-you-preventing-illegal-adult-content-on-our-network/