(Reuters) – Mastercard and Visa failed to stop their payment networks from laundering proceeds from child sexual abuse material and sex trafficking on the popular website OnlyFans, according to allegations in a previously undisclosed whistleblower complaint filed with the U.S. Treasury’s financial crimes unit.
The whistleblower, a senior compliance expert in the credit card and banking industries, said the two giant card companies knew their networks were being used to pay for illegal content on the porn-driven site since at least 2021, and accused them of “turning a blind eye to flows of illicit revenue.”
The complaint was filed in January 2023 with the Treasury’s Financial Crimes Enforcement Network (FinCEN) and the U.S. Justice and Homeland Security departments, the whistleblower said.
The complaint said that the whistleblower and other anti-trafficking experts, including U.S. federal agents, alerted Visa and Mastercard to unlawful content on OnlyFans in a series of calls in 2021 and 2022. The federal agents corroborated the presence of child sexual abuse material on OnlyFans, the complaint said.
It also drew heavily on a 2022 study by an anti-trafficking group that said it had found a “high volume” of OnlyFans accounts with “common indicators” of child sexual abuse material or sex trafficking. The whistleblower said he helped with the study, which was shared with the card companies.
On OnlyFans, Visa and Mastercard process payments between content creators and their customers. When the content is child sexual abuse material, the card companies are “directly handling the proceeds of these illicit transactions,” said the complaint.
By continuing to process payments on OnlyFans, Mastercard and Visa had “willfully failed” to maintain effective anti-money laundering programs required by the Bank Secrecy Act, said the complaint, which urged FinCEN and the two other federal agencies to take action against the card companies.
Reuters reviewed an email confirming FinCEN had received the complaint. In response to questions, the agency said it doesn’t confirm or deny the existence of whistleblower complaints. The Justice and Homeland Security departments declined to comment.
Reuters could not determine what action, if any, the agencies took in response to the complaint, which was filed under FinCEN’s anti-money laundering whistleblower program launched in 2021. Under that program, complaints are confidential and the identity of whistleblowers is protected. However, Reuters reviewed the complaint, interviewed the whistleblower on condition of anonymity, and corroborated his identity and credentials. The complaint said he had extensive expertise in fighting money laundering.
In an interview, the whistleblower said the agencies never contacted him to discuss his complaint. The card companies had “the power to turn off the switch” to stop illicit material from being monetized, he added.
Mastercard and Visa said they hadn’t heard of the 2023 whistleblower complaint until Reuters contacted them. They disputed the complaint’s allegations and cited their efforts to keep their networks free of illegal activity.
A Visa spokesperson said financial institutions and merchants that don’t comply with Visa’s “robust compliance requirements” will be terminated from its network. The company uses “best-in-class controls to deter, detect and remediate illegal activity,” the spokesperson said.
Mastercard holds all users of its payments system to high standards and, “if illegal activity is identified, we work with partners to act,” its spokesperson said. The three government agencies hadn’t “referred any specific illegal activity for us to investigate or act on,” the spokesperson added. “No evidence of current illegal activity has been provided to us,” despite the whistleblower’s claim, the spokesperson said.
The spokesperson denied that Mastercard had “failed” to maintain effective anti-money laundering programs. The company has “strong governance standards through a comprehensive compliance program and strong internal controls,” he said.
Since the whistleblower complaint was filed, Reuters uncovered more allegations of child sexual abuse and sex trafficking on OnlyFans, a porn-driven site that generates money through subscriptions and pay-per-view content.
In July, the news organization reported that hundreds of sexually explicit videos and images of minors, some as young as toddlers, have appeared on the site since 2019, according to allegations in police complaints. In December, a child exploitation investigator told Reuters that he reported 26 OnlyFans accounts to authorities that appeared to contain sexual content featuring underage teen girls. The accounts were quickly taken down, said the investigator. Another story focused on women who said they had been sexually enslaved, sometimes by a fiancé or boyfriend, to make money on the platform.
The Mastercard spokesperson called Reuters’ findings on child sexual abuse on OnlyFans “alarming” but said law enforcement or certain child-protection groups would need to provide evidence of illegal activity for the company to act or investigate. Visa didn’t comment on whether the company was investigating Reuters’ findings.
UK-based OnlyFans didn’t respond to questions about the whistleblower complaint. On its website, the company says it enforces a “zero-tolerance policy” against any content related to child abuse or trafficking, and blocks or takes down material that violates its rules. It said it also reports illegal content to law enforcement and child-protection groups. In a previous statement, OnlyFans told Reuters it works to “aggressively target, report, and support the investigations and prosecutions” of anyone who abuses the platform.
OnlyFans is one of the world’s fastest-growing and most lucrative creator platforms. It relies heavily on payment cards to process subscriptions, tips and other transactions between its more than 300 million users and its four million content creators. Its surging profits have made it a leader in the creator economy. In September, OnlyFans reported $6.6 billion in gross payments to creators, up 20% from the year before. It made $1.3 billion in revenue.
‘UNCOMFORTABLE IMAGES’
Many porn websites are free and make money mostly from advertising. OnlyFans, by contrast, takes a 20% cut of the income its creators earn from selling content to subscribers, who must enter their card details to pay for it.
OnlyFans accepts cards by Mastercard, Visa, Discover and some of their partners. In certain countries, it allows other options such as online payments provider Paysafe, which didn’t respond to a request for comment. American Express can’t be used on OnlyFans under a longstanding global policy that prohibits its cards from being used for online adult content, a spokesperson said. Payment services such as Apple Pay and Google Pay also have similar policies against online porn transactions.
In the U.S., OnlyFans’ main market, Visa and Mastercard account for the vast majority of all card purchases, according to industry data. The complaint did not make any allegations against Discover, saying its small market share meant it was “unlikely to be one of the main payment methods used on OnlyFans.” A spokesperson for Discover declined to comment.
In 2020, Visa, Mastercard and Discover blocked customers from using their cards to make purchases on Pornhub, another big adults-only platform, after a public outcry over alleged child sexual abuse material and other illegal content. This stopped card payments for Pornhub’s paid content and forced it to rely more on ads and sales of user data.
In May 2021, the BBC detailed several cases of explicit videos of underage teens on OnlyFans. Three months later, 102 members of Congress called for a Justice Department investigation into alleged child sexual abuse material on OnlyFans. The department declined to comment on the status of that request.
In November 2021, senior executives at Mastercard held a tense call with a group of anti-trafficking experts, some of whom wanted the company to cut ties with OnlyFans, according to a person who attended.
The site was hosting child sexual abuse material, the experts told the Mastercard executives. And one expert – a U.S. federal agent – said he could prove it. During the call, said the attendee, the agent accessed an OnlyFans account with sexually explicit images of what he said was a young girl. The agent described the images to others on the call but didn’t share them, which would have been illegal.
Mastercard told Reuters that its team had one call with a group in which “explicit and uncomfortable images” were discussed but said it couldn’t confirm when the call took place. Afterward, the card company requested that all financial institutions connecting OnlyFans to its payment network confirm the site’s compliance with “our standards and applicable law,” the Mastercard spokesperson said.
“Each of them affirmed that status,” he said, without identifying the institutions.
In April 2022, the Anti-Human Trafficking Intelligence Initiative (ATII), a U.S. nonprofit, published its study which the whistleblower complaint drew upon. ATII, whose work includes identifying illegal content online, reported that it had discovered numerous OnlyFans accounts with indicators of child sexual abuse material or sex trafficking.
The indicators included keywords and images found by searching the publicly available profiles of OnlyFans creators, said the ATII report. With these methods, researchers uncovered a “tremendous amount of troubling material” on the platform, it said. The whistleblower said he reviewed the report, which notes the anti-money laundering duties of financial institutions, before publication to ensure it reflected industry practice.
ATII’s investigation was shared with Mastercard and Visa, the whistleblower complaint said. The companies didn’t respond to questions about the ATII report. ATII declined to comment.
‘BUSINESS AS USUAL’
Both Mastercard and Visa have tightened their rules around porn sites in recent years. In October 2021, Mastercard introduced stricter rules aimed at “preventing illegal adult content on our network.” They were prompted by the ease with which people could now upload content to the internet, said John Verdeschi, a senior vice president, in a statement at the time.
Under those rules, merchants of adult content – in this case, OnlyFans – were required to verify the identity and age of people featured and obtain written consent from everyone depicted. The rules also required porn sites to produce monthly reports that flag “potentially illegal” content and send those to banks that process Mastercard payments.
In an interview in August that year with the Financial Times, OnlyFans founder and then-CEO Tim Stokely said his platform was “already fully compliant” with the Mastercard requirements.
In 2023, Visa also introduced stricter rules for its “high integrity risk merchants.” This included adult-related businesses, dating services, gambling and pharmacies. Under the rules, banks were expected to more closely monitor merchants to prevent illegal transactions.
The whistleblower complaint said the card companies appeared to be shifting the blame for processing payments related to child sexual abuse material onto banks “while carrying on with business as usual.” Visa and Mastercard did not comment on that assertion.
(Marshall reported from London. So reported from Washington. Additional reporting by Nupur Anand in New York. Editing by Julie Marquis and Jason Szep)
Comments