REP27 · Compliance · DSA trader verification
Regulation (EU) 2022/2065 · article 30 · know your business customer
Since the Digital Services Act took full effect, every online marketplace has to verify the traders it hosts before letting them sell: identity, bank account, contact details, a self-certification that the products comply with Union law. Sellers pass it, receive a confirmation, and reasonably assume they are now compliant. They are compliant with one regulation out of three. This page separates them, because the other two are the ones that generate fines rather than account suspensions.
Article 30 DSAIdentityPayment accountSelf-certificationAmazoneBayEtsyTikTok Shop
Article 30 calls it traceability of traders. In practice it is a know-your-business-customer procedure: the platform collects documents, checks them against registers, and must make reasonable efforts to assess whether the information is reliable before the trader can offer anything.
A non-EU company selling physical goods to consumers in the Union through a marketplace typically holds all three at once. They are created by three regulations, enforced by three different bodies, and none of them substitutes for another.
| Obligation | Source | Enforced by | What failure looks like |
|---|---|---|---|
| Trader verification | Article 30 DSA | The marketplace | Account suspended, cannot list |
| Responsible person | Article 16 GPSR | Marketplace and market surveillance authorities | Listings blocked, consignments stopped |
| EU representative | Article 27 GDPR | Supervisory authorities | Fines up to €10 million or 2% of turnover |
The order in which they bite is the reverse of the order in which they matter. The platform stops you first, which is why sellers fix that one first and discover the other two during an audit or a complaint.
A platform hosting your offer is not the manufacturer, importer or authorised representative of your product, and will not accept those duties under Article 16.
Under Article 27 the representative acts on behalf of the controller. A marketplace is a controller for its own processing, not a mandate holder for yours.
Article 30 identifies the trader. Article 16 identifies who answers for the product, and Article 27 identifies who answers for the data.
Every platform has built collection fields for the other two regimes. Collecting your details is the opposite of taking on your obligation.
Registration extract, legal name and address, VAT or tax number, ID of the signatory, bank account in the company name. This one pack serves every platform.
Named on the product and in the marketplace fields, holding the technical documentation for ten years.
Signed, published in the privacy notice, with the record of processing activities held by the representative.
The same legal name and address everywhere. Divergence between the trader details, the label and the privacy notice is what triggers a second look.
Trader verification is periodically re-checked; designations renew annually. Putting them on one calendar prevents the lapse nobody notices.
None of this was designed to be checked by marketplaces, and yet every seller now meets it there first. Three legal changes converged, and the platforms took the operational load.
| Change | What it obliged platforms to do | What sellers experienced |
|---|---|---|
| Article 30 DSA | Verify traders before allowing offers | Documents requested, accounts suspended until provided |
| Article 16 GPSR | Ensure an EU operator is identified for products | New compliance fields, listings blocked when empty |
| Market surveillance rules | Cooperate with authorities on unsafe products | Removals triggered by authority notices, not by the platform |
| Consumer information duties | Publish trader identity to buyers | Business name and address visible on the listing page |
The practical consequence: your compliance is now judged by an automated field check long before an authority looks at anything. Passing the field check is necessary and never sufficient.
Trader verification is a platform condition. Article 27 and Article 16 are statutory designations with named liability. Price them differently.
Establishment in the Union is the whole point. Ask for the registration number and check it in the national register.
Certificates with a public verification code survive procurement questions; PDFs do not.
Ask what happens the day an authority writes. If the answer is vague, that is the day you will find out what you bought.
The same company, the same product, three different files. Seeing them next to each other is the fastest way to work out what is missing.
| Item | DSA | GPSR | GDPR |
|---|---|---|---|
| Legal name and address | Verified against a register | Printed on the product | Named in the privacy notice |
| Someone established in the EU | Not required of the trader | Required | Required |
| A contact channel for the public | Published on the listing | On the label | In the privacy notice |
| Documents kept | Whatever the platform asks | Technical file, ten years | Record of processing activities |
| Who comes after you | The platform | Market surveillance | Supervisory authorities |
Registration extract, VAT number, signatory ID, company bank account. Every platform asks for the same set; preparing it once ends the repeated suspensions.
Trader verification, then the responsible person fields. Both are commercial blockers with same-day resolutions.
The Article 27 designation and the privacy notice paragraph. This one carries the fines and nobody blocks you until it is too late.
Same legal name, same address, everywhere. Inconsistency is the trigger for a manual review at every stage.
Verification is re-checked periodically, designations renew annually. One calendar entry prevents the lapse nobody notices.
No. It identifies you as a trader to the platform. Article 27 requires a written designation of a representative established in the Union, published in your privacy notice.
No. That is a separate regulation requiring an economic operator established in the Union, named on the product itself.
Online platforms that allow consumers to conclude distance contracts with traders. In practice every marketplace operating in the Union.
Legal name and address, registration number, VAT number where applicable, identification of the representative signing, a payment account in the trader's name and contact details.
It is the most reliable way to detect fronts and resellers hiding behind an unrelated entity. A mismatched account is the most common reason verification stalls.
A declaration that you will offer only products and services that comply with Union law. That is the hook that pulls product safety obligations into the platform relationship.
The platform must suspend your ability to offer products until the information is corrected. It is a commercial consequence, not a fine.
The same information is requested, with personal identification instead of a corporate extract. The obligations that follow are identical.
No. Article 30 applies to platforms hosting third-party traders, not to your own shop. Consumer information duties still apply to you directly.
Yes, where you offer services to recipients in the Union. Platforms apply the verification to non-EU traders as a matter of course.
It requires providers of intermediary services without an establishment in the Union to designate a legal representative. That duty falls on platforms, not on the traders selling through them.
Platforms re-check periodically and when details change. Keeping your registration extract current avoids a suspension at the worst moment.
We provide two of them: the Article 27 representative and the Article 16 responsible person. Trader verification is between you and each platform; nobody can pass it on your behalf.
Whichever is blocking revenue today, usually the platform. Then the responsible person, because it blocks listings. Then the representative, because it carries the fines.
Expect scrutiny. Authorities and platforms both treat inconsistent identification as a sign that nobody is really answerable for the product.
Within 24 hours of a completed form, both signed, each with its own certificate and verification code.
Related: the responsible person marketplaces check · the data side for marketplace sellers
The Article 27 GDPR representative and the Article 16 GPSR responsible person, both signed within 24 hours, on one invoice and one renewal date.
See the plans