How to Vet a Meta Ad Account Provider: 12-Point Compliance Checklist

The market for Meta ad account infrastructure has matured in exactly the wrong direction. There are now hundreds of Telegram channels, .shop storefronts, and Discord servers offering "aged BM accounts," "agency ad accounts," and "verified spend history" at price tiers from $80 to $4,000 per unit. A small fraction of those providers are running legitimate, defensible infrastructure operations. The rest are either resellers sitting one tier above a farm operation, manual-rep arbitrage plays that collapse the moment their internal Meta contact rotates, or outright exit scams.

For a US or UK media buyer operating at scale — running $50K to $500K+ per month across verticals — vetting the wrong provider is not a minor inconvenience. It's a kill event. A shared account that arrives already flagged or linked to a poisoned BM history will torch your entire ad account portfolio through asset association. A provider with no replacement SLA will leave you dark for 72 hours while their Telegram goes quiet. A storefront that requires you to take ownership of a BM (versus receiving shared access) puts your name on assets whose full history you cannot audit.

This checklist is designed to be applied before you send a single dollar. Twelve points, each with a red/yellow/green signal framework. Some points are binary disqualifiers. Others are risk-adjustable based on your vertical, volume, and operational tolerance. Run through all twelve on any provider you're evaluating, including ones you've used before — the infrastructure landscape shifts fast enough that a provider who cleared this list six months ago may not clear it today.

Point 1: Ownership Structure — Do They Keep It or Transfer It?

This is the most structurally important question in the entire vetting process. There are two fundamentally different operating models in the market:

• Transfer model: The provider moves ownership of a BM, ad account, or fanpage to you. You become the entity of record. Whatever history that asset carries is now yours.
• Shared access model: The provider retains ownership. You receive a collaborator or partner access role. The provider's entity stays on record with Meta.

Red: Any provider who pushes BM ownership transfer to you as the primary product. Once that BM is in your name, its full history — including any prior policy violations, spend patterns, or flagged payment methods — is your inheritance. You cannot audit what you don't know.

Yellow: Transfer model offered alongside a clean-history certification you cannot independently verify. The certification is only as good as the provider's integrity, which this checklist is designed to assess.

Green: Provider retains ownership; you operate via shared ad account access dropped into your existing Business Manager. You can plug in, run campaigns, and unplug. When an account gets restricted, it's their asset on their BM — you request a replacement, and you're not carrying a contaminated asset in your own structure.

The shared access model is structurally cleaner for the buyer. It separates operational risk from structural liability.

Point 2: Replacement SLA — Is It in Writing and What Does It Actually Cover?

Ad accounts get restricted. That is not a risk that can be eliminated; it's a frequency to be managed. The question is what happens in the 15-minute window after restriction, not whether restriction can happen.

Ask the provider: what is your replacement SLA? Get the answer in writing — screenshot, Telegram message, email, anything that creates a record. Then ask the follow-up questions that reveal whether the SLA is real:

• Does the SLA clock start from restriction confirmation or from when you submit a ticket to the provider?
• Is the SLA for a new account to be shared into your BM, or does it cover account review and reinstatement attempts?
• Does the SLA apply 24/7 or only during business hours in their timezone?
• What is the per-account limit — do you get unlimited replacements per week, or is there a cap?

Red: No written SLA. Verbal assurances only. Any provider who says "we move fast, don't worry" without documentation is telling you what they want you to believe, not what they're contractually committed to.

Yellow: SLA exists but is scoped to business hours with a 24-48 hour target. Workable for lower-stakes operations, but if you're running time-sensitive campaigns — flash sales, live events, limited-window offers — a 24-hour replacement window is operationally expensive.

Green: Written SLA of 1-4 hours, 24/7, with a clear ticketing mechanism (not just "DM us"). Provider has enough account inventory that replacements are drawn from a live pool, not spun up on demand.

Point 3: Payment Method — Is the Transaction Traceable?

The payment method a provider accepts is a signal about how they want to operate, not just a convenience preference.

• Red: Crypto-only, no exceptions. USDT on Tron, Bitcoin, Monero — any payment method that eliminates your ability to dispute, trace, or recover funds. Crypto as the only option is a structural choice that benefits the provider in every scenario where a dispute arises.
• Yellow: Crypto accepted alongside PayPal, Wise, or card. The presence of a traceable option doesn't guarantee recourse, but it suggests the provider is willing to have a paper trail on at least some transactions.
• Green: ACH, wire, Stripe, or Paddle — payment processors that create a traceable record and allow for dispute mechanisms if the product is not delivered as described. For high-volume arrangements, a formal invoice and NET-15 or NET-30 terms signal that the provider operates as a real business.

Ask directly: "Do you accept Wise or ACH for invoice settlement?" The answer — and the speed and comfort with which it's given — tells you something about the operation behind the storefront.

Point 4: Provider Identity and Longevity — How Old Is the Telegram, the Domain, the Operator?

This is basic counterparty due diligence, but most buyers skip it entirely in the rush to get accounts live.

• Check the Telegram handle's creation date. Telegram shows approximate join dates for channels and some account properties. A handle created 60 days ago offering high-volume infrastructure is a structural mismatch.
• Search the domain in archive.org. When was the first snapshot? What did it look like then versus now? A domain registered three months ago with no archived history is a new entrant whose operational continuity is unproven.
• Ask the operator directly: how long have you been providing Meta infrastructure? Who are your longest-running clients? Can you provide any reference from a client who has been with you over 12 months?

Red: No verifiable history, new Telegram handle, domain registered under 90 days, operator deflects identity questions.

Yellow: Operator has been running 6-12 months, can provide references but they're unverifiable ("ask in the group"), domain is real but thin on history.

Green: Operational track record of 12+ months with consistent handle and domain, references you can independently verify via LinkedIn or direct contact, and an operator who answers identity questions without escalating defensiveness.

Point 5: Asset History — Can You Audit Fanpage Age, BM Creation Date, Spend History?

Every Meta asset carries a history. Fanpages have creation dates, post histories, follower acquisition patterns. Business Managers have creation timestamps and associated payment method records. Ad accounts carry spend curves that Meta's systems use to assess account quality.

A legitimate provider should be able to, at minimum, show you:

• The creation date of the BM the shared accounts are sitting in
• The fanpage's public creation date (visible on the page's About section)
• A screenshot of the ad account's spend history (cumulative) prior to handoff

Red: Provider refuses to share any history, claims it's proprietary, or provides screenshots you cannot verify (e.g., cropped images with no account identifiers visible).

Yellow: Partial history available — BM creation date but no spend curve, or fanpage age but no BM verification. Workable if other checklist points are green, but proceed with caution.

Green: Full disclosure of creation dates, spend history, and asset linkage. You can cross-reference the fanpage creation date against its public Facebook profile. You can verify BM age via the Business Manager's own settings when you receive access.

Point 6: KYC of the Buyer — Do They Ask Who You Are?

This is a counterintuitive one. Most buyers expect vetting to be one-directional — you vet the provider. But a provider who requires some form of KYC from the buyer is demonstrating operational maturity.

Why? Because a provider who accepts any buyer, for any vertical, without any screening is either running a volume play with no concern for downstream consequences, or they're not operating at a level where client identity matters to them. Neither is a signal of longevity.

Red: Zero buyer screening, instant checkout on a .shop storefront, no questions asked. This isn't buyer-friendly — it's a signal that the provider doesn't care about the asset quality downstream, because they're not invested in the relationship past the initial transaction.

Yellow: Light screening — asks your vertical, your monthly spend volume, your BM ID. Minimal but present. Shows some operational awareness.

Green: Provider runs a real intake process. They ask about your vertical, your spend history, your BM health, your use case. They may decline certain buyers (extreme gray verticals, buyers with recently banned primary BMs who haven't isolated the root cause). This is a provider who is invested in the operational success of the relationship because they have inventory to protect.

Point 7: Refund Policy on Stillborn Accounts

A "stillborn" account is an ad account that arrives already restricted — either flagged on delivery, in a permanent review loop from the first impression, or unable to pass payment method verification. It happens, especially with accounts that were previously active in different geographies or verticals.

Ask for the refund or replacement policy on stillborn accounts, in writing, before you pay. Specifically:

• What is the window for reporting a stillborn (24 hours? 48 hours? first spend attempt only)?
• Is the resolution a refund to your payment method or a credit toward replacement accounts?
• Who determines whether an account is classified as stillborn vs. user-restricted post-delivery?

Red: No stated policy, operator says "all sales final," or policy language is vague enough to exclude any scenario where the account fails at your hands.

Yellow: Replacement credit offered but no cash refund. Workable if the replacement process is fast and the credit doesn't expire within an unreasonable window.

Green: Documented policy with a clear definition of "stillborn," a 48-hour reporting window, and either a cash refund or a priority replacement with an expedited SLA. Provider proactively shares this before you ask.

Point 8: Volume Scalability — Can They Actually Grow With You?

A provider who can comfortably handle your initial order of 5 accounts may fall apart when you need 50 in a week. The infrastructure behind the relationship matters.

Ask directly:

• What is your current inventory of active, unallocated accounts available for sharing?
• What is your maximum weekly provisioning capacity?
• Have you serviced clients at my target scale (e.g., $200K/month across 30+ accounts)?

Red: Evasive answers, "we can handle it" without specifics, or evidence that accounts are being sourced reactively (delivered 3-5 days after order vs. from live inventory).

Yellow: Confirmed capacity at your current scale but uncertain above it. Reasonable for an early-stage relationship — but get a commitment in writing about lead time if you scale.

Green: Provider can demonstrate inventory depth, has a clear process for bulk provisioning, and has a stated maximum throughput that aligns with your roadmap. Ideally they've handled operations at or above your target volume before.

Point 9: Account-Level Reporting Access

This is a practical operational point that gets overlooked in initial vetting. When you're running shared accounts, you need access to the Ads Manager interface for each account — not just a summary report from the provider.

You need:

• Direct Ads Manager access to view delivery, spend pacing, CPM trends, and restriction notices in real time
• Ability to run your own pixel events (or server-side CAPI events) tagged to the account
• Admin or advertiser role on the account, not just a viewer role

Red: Provider offers a dashboard they built, or restricts you to a reporting export. You cannot see live delivery data without their intermediary. This creates a blind spot in your operation and makes it impossible to diagnose issues in real time.

Yellow: Full Ads Manager access but restricted pixel or CAPI configuration. Workable if your tracking is fully server-side and doesn't depend on pixel association.

Green: Advertiser-level access with full reporting visibility, pixel configuration rights (or the ability to connect an existing dataset), and no provider intermediary between you and the account data.

Point 10: Compliance Posture — Which Verticals Do They Explicitly Exclude?

A provider's vertical exclusion list tells you about their operational maturity and the risk profile of the account pool you're drawing from.

A provider who will run anything — financial fraud adjacent, explicit content, unregistered pharmaceuticals — is contaminating their account pool. The accounts you receive have co-tenants in that same pool. The blast radius of a policy event on a co-tenant can reach your accounts through BM-level association.

Ask explicitly: what verticals do you not support? A clear, specific answer (e.g., "we don't support unlicensed financial products, gambling without a licensed operator, or adult content") is a green signal. An answer that implies anything goes is red.

Red: No vertical restrictions stated, "we support all niches," any language that suggests the account pool is undifferentiated.

Yellow: Some restrictions but vague — "we prefer white-hat verticals" with no specifics. This is marketing language, not operational posture.

Green: Specific exclusions stated clearly, plus a stated process for how they handle a buyer who brings a policy violation into the shared infrastructure (e.g., immediate access revocation without refund for policy-violating campaigns). A provider willing to lose a buyer to protect their pool is a provider invested in long-term quality.

Point 11: Price Per Tier — Is It Defensible?

Pricing in this market ranges from too-cheap-to-be-real to high enough to suggest a manual Meta rep relationship that may not be what it appears. Both extremes warrant scrutiny.

• Too cheap (sub-$100 per account for "agency" or "high-spend-history" assets): These accounts are almost certainly farmed, resold, or have undisclosed restriction history. The economics of a legitimate infrastructure operation don't support $80 "verified BM" pricing.
• Suspiciously expensive with vague justification ("direct Meta rep access", "whitelisted agency line"): Verify what the premium actually covers. A genuine enterprise-tier Meta relationship has specific, verifiable characteristics — not just a higher price tag and vague claims.

A defensible price is one the provider can explain in terms of:

• Account age and spend history
• BM tier and payment method
• Provisioning model (shared vs. transfer)
• Replacement SLA cost embedded in the pricing
• Vertical clearance (accounts cleared for regulated categories carry legitimate compliance overhead)

Red: Price with no structured justification, or pricing that requires you to take their word on the asset quality underlying it.

Yellow: Clear pricing tiers but limited disclosure on what differentiates tier A from tier B beyond "quality."

Green: Pricing with a documented breakdown of what each tier covers — account age range, spend history threshold, BM creation date window, replacement SLA, and vertical clearances. You can evaluate whether the price is fair against the specifics, not the pitch.

Point 12: Referenceable Client List — Can You Verify Anyone?

This is the final and often most revealing point. References are easy to fabricate in anonymous markets. Screenshots of "happy clients" in a Telegram group are not references. The bar here is specific:

• Can the provider give you a name (not a Telegram handle) of a client who has been with them for over six months?
• Can you contact that client independently — through LinkedIn, a business email, or a verifiable channel outside the provider's control?
• Does the reference describe specific operational details (account types, verticals, volume range, replacement experience) that match what you're evaluating?

Red: References are all anonymous handles, testimonials are only visible inside the provider's own Telegram channel, or the provider declines to provide any reference at all.

Yellow: Provider offers to introduce you to a current client via Telegram. Better than nothing — a live conversation is harder to script than a screenshot — but still unverifiable as to identity.

Green: Provider can name a client and give you an out-of-channel contact method. The client gives you a specific, detailed account of their operational experience — including what went wrong and how the provider handled it. A reference that only mentions positives is rehearsed. A reference that includes friction points and how they were resolved is credible.

When One Red Is Enough to Walk

The twelve points above are not all equal weight. Some reds are hard disqualifiers regardless of how green everything else is:

• Point 1 red (ownership transfer to you): Walk immediately. The structural risk of inheriting unknown asset history is not compensated by any other factor.
• Point 3 red (crypto-only payment): Walk unless you are operating in a geography or vertical where this is the only option and the operational need is acute. Even then, size the first order to what you can absorb as a total loss.
• Point 2 red (no written SLA): Walk for any time-sensitive operation. For low-stakes testing, acceptable with careful position sizing.
• Point 10 red (no vertical exclusions): Walk if you are running white-hat or regulated verticals. The pool contamination risk is real.

For yellow signals, use a scoring approach: three or more yellows across the twelve points is a meaningful risk signal even if no individual point is red. A pattern of yellows indicates an operator who is not fully invested in the quality or longevity of the relationship.

Running the Checklist Under Time Pressure

Most buyers evaluate providers when they're already in operational crisis — BM restricted, spend at zero, campaigns paused. Time pressure is real and providers know it. A rushed buyer is less likely to run due diligence and more likely to wire on a vague promise.

The way to handle this: build the checklist relationship before you need it. Identify two or three candidate providers, run them through all twelve points, and establish a pre-qualified relationship — even a small test order — before your primary structure is under stress. When the event happens (and it will), you have a verified option available immediately rather than starting a cold evaluation under pressure.

If you are in crisis right now and have no pre-qualified provider, compress the checklist to the five hardest disqualifiers: ownership model, replacement SLA in writing, traceable payment, some form of buyer KYC, and a verifiable reference. Skip none of these five even under maximum time pressure. If a provider can't clear these five in under two hours of communication, they're not operationally equipped to solve your problem regardless of what they claim.

The 2026 operational environment makes downtime progressively more expensive. CPMs in US and UK core verticals are running 15-40% higher than 2023 baselines across most categories. Every day your primary structure is in appeal review is a day your Advantage+ campaigns are losing delivery momentum and your custom audience signals are going stale. Your CAPI-connected events aren't flowing. Your lookalikes are degrading. The urgency to get back to spending is legitimate — which is exactly why a bad provider choice made in panic has compounding consequences that go beyond the cost of the accounts themselves.

While your primary BM or ad accounts are in appeal — which can run anywhere from 3 to 30+ days depending on the violation type and current Meta support queue depth — you can keep spending by dropping shared ad accounts straight into your existing BM via ADS FLOW. No ownership transfer, no asset contamination risk, accounts provisioned into your structure so your campaigns, pixels, and CAPI events run without interruption. Talk: t.me/oadsflow.