Direct answer: an OnlyFans agency does not have one global compliance checklist. Obligations depend on where the entity, creators, workers, customers, data, and services are located; how the business is structured; what contracts say; and which platforms and payment providers are used. Begin with a jurisdiction selector, assign an evidence owner to each obligation, and obtain qualified advice before relying on a general guide.
1. Jurisdiction selector
Record the agency’s legal entity and place of registration, directors or owners, trading locations, creator locations, worker locations, subscriber markets, data storage and access locations, payment flows, advertising channels, and contract governing law. A remote team can create obligations in several places. Do not assume an Australian company can treat every overseas worker, creator, or customer only under Australian rules.
| Connection | Jurisdiction record | Question for adviser | Owner |
|---|---|---|---|
| Entity | ABN, ACN, business name, addresses | Which registrations and licences apply? | Director or company secretary |
| Creators | Location, contract, tax and data flow | Which consumer, contract, privacy, or tax rules attach? | Legal and finance |
| Workers | Location, actual relationship, hours, control | Employee, contractor, payroll, award, or local law? | HR and legal |
| Data | Collection, access, vendor, storage, transfer | Privacy, security, breach, and transfer duties? | Privacy and security |
| Platform | Current terms, account owner, content workflow | Who is authorised and accountable? | Operations |
2. Australia evidence map: entity and registration
Choose the structure with professional input. An ABN identifies a business but does not by itself create a company or grant a trade mark. Register a business name when required and understand that registration does not provide exclusive brand rights. Companies have director, annual review, solvency, and record obligations that differ from sole traders or partnerships. Check licences and permits for the actual activities and locations.
Keep registration confirmations, constitutions or partnership documents, officeholder records, authorised signers, insurance, domain ownership, and renewal dates. Verify suppliers and counterparties using independent registers where appropriate. Update changed details within required periods.
3. Tax, GST, payroll, and financial recordkeeping
Map creator receipts, agency fees, reimbursements, advertising costs, foreign currency, contractor invoices, payroll, superannuation, PAYG withholding, GST, and owner payments. The ATO states that most Australian businesses must register for GST when turnover reaches the applicable threshold, but turnover, taxable supplies, exports, and entity treatment require advice. Do not call creator gross volume agency turnover without an accounting basis.
Maintain invoices, receipts, statements, contracts, calculation sheets, tax records, payroll records, and reconciliations for the required periods. Separate creator and agency money according to legal and contractual authority. Current ASIC company record-keeping guidance says company officeholders must ensure required records are kept and that financial records track and explain transactions, position, and performance. The agency owner P&L guide provides a management model, not tax treatment.
4. Privacy, security, and breach response
Inventory identity documents, contact details, content, messages, analytics, payment data, contracts, and worker records. For each, document collection purpose, legal basis where applicable, notice, access, vendors, cross-border flow, retention, deletion, and incident owner. Determine whether the Privacy Act and Australian Privacy Principles apply and whether other country rules also apply.
Use least privilege, named accounts, multi-factor authentication, secure sharing, device controls, logs, backups, and offboarding. Prepare a breach response plan and assess notification requirements with qualified help. Do not paste sensitive creator or subscriber data into an unapproved AI or messaging service. The agency tools selector includes access and exit checks.
5. Contracts, consumer claims, IP, and consent
Creator agreements should define parties, scope, fees, authority, account and data access, intellectual property, likeness, confidentiality, subcontractors, termination, disputes, and governing law. Standard-form and small-business protections may affect terms. Advertising and sales statements must not mislead; retain evidence for objective results, ranking, fee, or service claims before publication.
Obtain participant consent and rights for every identifiable person and asset. Define rights to raw files, edits, captions, brand materials, templates, and marketing uses. Business name registration does not settle copyright or trade mark ownership. Use the agency contract checklist to prepare for a lawyer review.
6. Employment and contractor status
A contract label does not necessarily determine worker status. Document the actual relationship: control, delegation, tools, risk, integration, hours, payment, and conduct. Current Fair Work Ombudsman contractor guidance says constitutionally covered businesses use a whole-of-relationship test for work from 26 August 2024, while different rules can apply to other businesses and earlier periods. Contractors and employees have different rights and obligations, and overseas workers may trigger local rules.
Address minimum pay, awards, hours, breaks, leave, superannuation, payroll, tax, health and safety, monitoring, training, adult-content exposure, harassment, privacy, and termination as applicable. Avoid repeated unpaid production trials. Keep worker agreements, time and pay records, policies, training evidence, complaints, and classification reviews.
7. Platform, content, and operational controls
Read current OnlyFans terms, acceptable-use rules, referral terms, and applicable community or safety materials. Identify the account owner and authorised operators. Maintain age and identity verification, participant consent, prohibited-content review, approval, pricing authority, message boundaries, reporting, and incident escalation. Platform acceptance does not prove broader legal compliance.
Review advertising rules on every acquisition platform. Do not assume adult content or links permitted on one service are allowed on another. Keep a policy register with source URL, version or retrieval date, owner, affected workflow, change decision, and staff acknowledgement.
8. Compliance register and review rhythm
For each obligation, record source, jurisdiction, applicability decision, adviser, evidence, system owner, review date, incident trigger, and status. Review registrations and insurance at renewal; contracts and claims before publication or signing; user access monthly; vendors and data flows quarterly; worker status when the relationship changes; and platform rules on a scheduled cadence and after notices.
A “compliant” badge is not evidence. Keep the underlying decision and record. Escalate uncertainty rather than copying a global template. This guide is a map of questions, not a legal conclusion for an agency.
Entity and contractor evidence packet
Keep one controlled packet for the agency entity and a separate file for each worker or supplier. The entity packet should identify the legal name, structure, ABN or ACN where applicable, registered and business addresses, officeholders, ownership records required for the structure, business-name registrations, bank and payment authorities, tax registrations, insurance, licences identified by advisers, contract signers, domains, and renewal dates. Link each record to its issuing source and restrict identity material to people who need it.
A contractor packet should contain the signed agreement, statement of work, actual duties, location, right to delegate, equipment and account access, working arrangements, invoices, tax or business details collected lawfully, confidentiality and privacy terms, training, incidents, performance records, and offboarding evidence. Revisit classification when the real relationship changes. Current Fair Work guidance retrieved 29 July 2026 says constitutionally covered businesses use the whole-of-relationship test for work from 26 August 2024, while different rules may apply to other business types or earlier periods. That is a classification prompt, not a conclusion about any individual.
Privacy and consent control lifecycle
Map the lifecycle from collection to deletion. At collection, identify the person, purpose, fields, notice, authority, consent where relied on, and a secure transfer path. Before use, confirm the data is necessary and the proposed use matches the notice and contract. During storage, apply role-based access, encryption where appropriate, logs, backups, vendor restrictions, retention dates, correction paths, and incident escalation. At exit, return required records, revoke access, delete unnecessary copies, and document lawful retention.
Adult-content consent requires more than a checkbox attached to an upload. Keep evidence for every identifiable participant, the specific production and publication permission, allowed edits and channels, date, withdrawal or dispute contact, and any platform-specific verification. Separate consent to appear in content from consent to be used in agency advertising, training, AI processing, or a public case study. For operational privacy controls, read the anonymous creator privacy guide; creators reducing public identity exposure can also use the faceless creator guide. Neither approach removes platform verification or legal record duties.
Advertising and adult-content compliance map
Build the map by channel because the same asset can be lawful but prohibited by a platform, or allowed by a platform but misleading in context. Retrieve current rules immediately before launch, then retain the approved creative and the final published version. The official eSafety register of Online Safety Codes and Standards says Age-Restricted Material Codes for three service classes began taking effect from 27 December 2025 and six additional service-class codes from 9 March 2026, with some measures staged. Determine with counsel whether the agency itself operates a covered service; do not assume obligations aimed at service providers automatically describe every creator or advertiser.
| Control area | Evidence to retain | Approval question | Stop trigger |
|---|---|---|---|
| Adult participants | Age, identity, consent and rights records | Is every person cleared for this exact use? | Missing, conflicting or withdrawn evidence |
| Creative claims | Claim source, date, scope and final asset | Can an objective claim be proven as published? | Unsupported earnings, ranking or guarantee |
| Influencer promotion | Agreement, consideration and disclosure copy | Is the commercial relationship immediately clear? | Hidden, vague or removed disclosure |
| Platform rules | Policy URL, retrieval date and approval record | Are content, link and targeting allowed today? | Policy uncertainty or enforcement notice |
| Age-restricted access | Legal assessment and service-level controls | Which code, standard or local rule applies? | Unassessed high-risk service or geography |
The ACCC's current social media promotions guidance says Australian Consumer Law applies to paid and incentivised social-media promotion and that claims must be accurate and able to be substantiated. Keep the commercial brief, disclosure wording, claim substantiation, audience restrictions, approvals, live URL or post identifier, complaints, and corrective actions. The creator legal and compliance guide provides a parallel creator-side checklist. SirenCY's privacy policy and site terms describe this site; they are not templates for another agency.
Jurisdiction change control
Re-run the selector before onboarding a person in a new country, opening a new entity, changing payment flows, storing data with a new vendor, launching in a new subscriber market, adding an advertising channel, producing content with a new participant type, or providing a new online service. The change record should state what changed, which jurisdictions may connect, who reviewed it, sources consulted, controls updated, staff notified, and unresolved advice.
Use a clear evidence state: confirmed by current primary source, confirmed by adviser for stated facts, contract-specific, platform-support response, pending, not applicable with reason, or unknown. “Compliant” without scope and date is not useful. High-risk unknowns pause the affected workflow; low-risk administrative gaps receive an owner and deadline. This makes compliance an operating discipline rather than a collection of undated links.
Primary sources and limitation
Source register, retrieved 29 July 2026: the Australian Government's Business Registration Service covers ABN, business name, company, and tax registrations; ASIC company record-keeping guidance covers company and financial records; business.gov.au tax registration guidance describes general registration questions; the OAIC security guide covers personal-information controls; Fair Work contractor guidance covers status; the eSafety register provides the current codes and standards; and the ACCC social media promotions guidance covers commercial disclosures and claim substantiation. This is general information, not legal, tax, privacy, employment, or financial advice.