Affiliate and influencer promotions: keeping evidence of what your partners published

The blind spot: content you answer for but do not control

Comparison sites, review blogs, cashback portals, tipsters and creators on Instagram, TikTok and YouTube: much of the marketing of a fintech, a broker or a gambling operator is published by partners. The account, the page and the edit button belong to them. When a regulator, a complainant or your own audit asks what a partner actually showed, the post may already have been edited, deleted or, in the case of a story, simply expired.

• Affiliates update landing pages, bonus terms and comparison tables without telling you.
• Influencers edit captions after a complaint or delete a post once the campaign ends.
• Stories and live streams disappear on their own.
• Platforms refresh or remove older material, so the platform is not your archive.

A screenshot sent in by the partner is the weakest version of this record: you did not take it, you cannot tell exactly when it was taken, and it shows only what the partner chose to show.

What the UK rules expect

The detail depends on your permissions and products, but the main UK rules point in the same direction:

• FCA FG24/1, the finalised guidance on financial promotions on social media (March 2024): firms remain responsible for every promotion they make or cause to be made, should take proactive responsibility for how their affiliates communicate promotions, monitor affiliates on an ongoing basis and not rely on digital media channels to keep their records.
• Section 21 FSMA 2000: in the course of business, a financial promotion may only be communicated by an authorised person, or with its content approved by one, unless an exemption applies. FG24/1 warns that unauthorised influencers who promote without approval may be committing a criminal offence.
• FCA COBS 4.11.1R: a firm must make an adequate record of each financial promotion it communicates or approves and keep it, for example five years for MiFID business and three years in other cases.
• Gambling Commission LCCP 1.1.2: licensees are responsible for the actions of third parties they contract with, must bind them to the same licence conditions and codes, and must be able to end the contract promptly, including when an affiliate breaches an advertising code.

This is not legal advice; check what applies to your firm with your compliance adviser. The practical consequence is the same in every case: you need your own dated record of what partners published, and you need it before you ask them to change anything.

What a usable record of a partner promotion contains

• The exact URL and account handle, plus the page or profile the promotion sits on.
• The full content: image or video, caption, the risk warning and terms as shown, and whether the warning appears on every frame of a story or carousel.
• The landing page the tracking link leads to, because the promotion and the offer behind it are read together.
• The date and time, recorded by a process you control rather than reported by the partner.
• The technical layer: HTML, a network log, TLS certificates and DNS data, so the record shows what the server delivered and not just a picture.
• A SHA-256 hash of every artifact bound into a qualified electronic timestamp, so any later change to the files is detectable.

Routine checks: an evidence series for affiliate pages

Review sites, comparison tables, bonus pages and landing pages are public web pages, and they change quietly. Website Monitoring captures each of them daily or weekly at a time you choose. Every check is a full sealed proof with a qualified eIDAS timestamp, and you get an e-mail when the page differs from the previous run. Over a quarter you end up with a dated series per partner page instead of a folder of screenshots.

• Business, 99 EUR a month excl. VAT (119.79 EUR incl. VAT): 10 monitors, 400 proofs per 30 days, 10 users.
• Monitoring 50, 399 EUR a month excl. VAT (482.79 EUR incl. VAT): 50 monitors, 1,800 proofs per 30 days.
• Monitoring 100, 599 EUR a month excl. VAT (724.79 EUR incl. VAT): 100 monitors, 3,500 proofs per 30 days.

Each check uses one proof, so a weekly monitor needs about 4 to 5 proofs a month. Monitoring covers publicly accessible pages only, nothing is recorded between two runs, and sites with hard bot protection can block it. Social posts behind a login are captured one by one, as described next.

Social posts, stories and videos

• Posts and profiles you can see while logged in: the browser extension captures the page in your own browser and the server seals it on receipt. The timestamp proves integrity and the time of receipt, not independent observation. It is included in every paid plan, from the 9 EUR pack of 3 proofs (10.89 EUR incl. VAT).
• Videos, reels and stories: Forensic Browser, a Windows desktop app, adds the video with sound to the capture, as the platform's original file where the platform serves it and otherwise as a labelled playback recording, and seals it with the post under one qualified timestamp. From 290 EUR a year excl. VAT (350.90 EUR incl. VAT).
• No time or no staff: Assisted Capture, where an operator captures the URLs for you, video included. Rush covers up to 5 URLs within a guaranteed 60 minutes for 249 EUR excl. VAT (301.29 EUR incl. VAT).

When you find a breach: capture first, then contact the partner

• Capture the promotion and its landing page before you contact the partner. Once they know, the content usually changes.
• Write a short note: who found it, when, which rule it may breach, which account and which campaign.
• Ask the partner in writing to correct or remove it, with a deadline.
• Capture the same URL again after the deadline to document the correction or the removal and when it happened.
• Keep everything in one case per partner or campaign and export the whole case as one ZIP for your file, the regulator or a termination under the contract.

What the timestamp proves, and what it does not

Under Article 41(2) of the eIDAS Regulation a qualified electronic timestamp enjoys the presumption of the accuracy of the date and time it indicates and of the integrity of the data it is bound to, and Article 41(3) requires its recognition in all EU member states. Outside the EU, including the UK, how such a record is weighed depends on national rules of evidence; what the seal gives you everywhere is a technical way to show the files have not changed since capture.

It does not prove that every visitor saw the same page, that a claim is true, or that a regulator or court must accept the record. A sealed, documented record that anyone can verify offline with the open-source gpa-verify tool is simply much harder to dismiss than a screenshot from the partner.

A starting setup for a compliance team

• List active partners and their promotional URLs; start with those that bring the most traffic or complaints.
• Put landing and bonus pages under weekly monitoring, and daily monitoring during large campaigns.
• Agree a routine for social content: a capture when each paid post goes live, then spot checks.
• Add a clause to partner contracts allowing you to capture and keep their promotional content.
• Match retention to the strictest rule that applies to you and keep the evidence ZIP files, not only the reports.
• Run a test verification with gpa-verify once a quarter.

FAQ

Sources

• FCA FG24/1: Finalised guidance on financial promotions on social media
• FCA FG24/1, full text (PDF)
• Financial Services and Markets Act 2000, section 21
• FCA Handbook, COBS 4.11: Record keeping for financial promotions
• Gambling Commission, LCCP 1.1.2: Responsibility for third parties
• Regulation (EU) No 910/2014 (eIDAS), Article 41