Paying a stranger on the internet is easy. Knowing who you paid is harder, and sometimes required. As an affiliate program grows past friends and customers, two checks become worth running before money moves: verifying identity, and screening against sanctions lists. This guide explains both. It is general information, not legal advice.
Why it matters for an affiliate program
Affiliate programs attract people you have never met, in countries you may never have sold to. Most are exactly who they say they are. A few are not:
- someone opening several partner accounts under different names to refer themselves;
- someone collecting commissions through a stolen identity;
- rarely, someone a government has placed under sanctions.
Paying a sanctioned person can expose a business to serious penalties, and in the US, sanctions obligations apply regardless of company size. Identity verification also makes fraud expensive: one verified person, one account.
Know your customer (KYC), applied to partners
Identity verification — usually called KYC — confirms that a partner is a real person and is who they claim to be. Modern checks typically ask for:
- a photo of a government-issued ID;
- a live selfie, matched against the ID photo;
- automatic checks that the document is genuine and not tampered with.
The result is a verified name you can match against the payout account. If the name on the PayPal account or bank account does not match the verified identity, that is worth a second look.
Run the check once, before the first payout, not at sign-up. Partners who never earn anything never need to be verified, and asking for an ID before someone has earned a dollar discourages good partners.
Sanctions screening
Governments publish lists of people and organisations that may not receive payments. In the US the best known is the Office of Foreign Assets Control’s Specially Designated Nationals and Blocked Persons List (the SDN list); the UN, the EU and the UK publish their own.
Screening compares each partner’s name — and ideally date of birth and country — against these lists. Two things make it more than a lookup:
- Lists change. People are added regularly. A partner who was clear in January may not be clear in June, so screen before every payout run, not just once.
- Names are ambiguous. Common names produce possible matches that are not the same person. A possible match should hold the payout for a human review, not reject the partner automatically.
Services that aggregate many lists into one search make this practical without building it yourself.
What to do with a possible match
- Hold that partner’s payout; pay everyone else.
- Compare the details you hold — full name, date of birth, country, verified ID — with the list entry.
- If it is clearly a different person, record why and release the payout.
- If you cannot rule it out, do not pay, and take advice. Do not tip the person off in a way that helps them evade the check.
Keep partners on side
Checks frustrate people when they are surprising, slow or unexplained. Make them painless:
- Say it up front. Mention in your terms and welcome email that identity and tax checks happen before the first payout.
- Ask at the right time. When a partner’s first payout is approaching, not on day one.
- Do it in one place. Verification, tax form and payout details all in the partner portal.
- Explain holds. “Your payout is waiting for identity verification — it takes about two minutes” beats “Payout on hold”.
- Never hold the run. One partner’s missing check should delay only their payout.
Store the minimum
Keep what you need and no more. A verification provider can hold the ID images; you keep the result, the verified name and the date. For tax numbers, many systems store only the last four digits after the form is processed. Less data stored is less data to protect.
A simple policy
- Verify identity before a partner’s first payout.
- Screen every partner against sanctions lists before every payout run.
- Hold, review and record possible matches; pay everyone else.
- Collect a valid tax form in the same flow.
- Tell partners what is checked and why, before they ask.
These checks take minutes per partner and protect the program for everyone in it.
Doing this in Affiligato
With managed payouts, partners verify their identity with a photo ID and a live selfie through a regulated identity provider before their first payout, in the portal. Every partner is screened against sanctions lists before every payout run; a possible match is held for review while everyone else is paid. A partner who is not ready — no verified identity, no valid tax form, no payout method — is held with the reason shown, and rolls into the next run once they fix it.
