FinCEN Whistleblower Says Visa and Mastercard Kept Processing OnlyFans Payments After Being Warned About Child Sexual Abuse Material

The complaint that landed at the U.S. Treasury in January 2023 did not accuse OnlyFans of hosting a video. It accused Visa and Mastercard of clearing the charge after they had already been told what the charge was buying.

Two years later, when Reuters published the filing, the allegation was specific: a senior payments-compliance specialist told the Financial Crimes Enforcement Network that the two largest card networks had been warned, repeatedly, that their rails were moving money for child sexual abuse material and sex-trafficking content on OnlyFans, and the payments kept settling anyway. That is a Bank Secrecy Act problem dressed up as a content-moderation story. Card brands sit in the middle of every paid view. If the claim holds, they processed the proceeds of a crime they had already been put on notice about.

What the Filing Says Happened

Reuters reported on January 24, 2025 that the whistleblower, who asked to remain unnamed, sent the complaint to FinCEN and also routed it to the Justice Department and the Department of Homeland Security. The filing says the card companies knew by at least 2021 that illegal content was being monetized on OnlyFans through their networks.

According to the complaint, the whistleblower, anti-trafficking researchers, and federal agents joined calls in 2021 and 2022 to put both brands on notice. The whistleblower leaned on a 2022 review by the Anti-Human Trafficking Intelligence Initiative, a U.S. nonprofit that said it found a high volume of OnlyFans accounts with common indicators of child sexual abuse material or trafficking. That review, the complaint says, was shared with Visa and Mastercard.

The legal theory is not that a network stored the files. It is that by continuing to settle OnlyFans transactions after those warnings, the companies «willfully failed» to keep an effective anti-money-laundering program and handled the proceeds of illicit activity. FinCEN’s AML whistleblower program exists for that kind of claim. The proceedings stay secret. Reuters confirmed FinCEN received an email about the complaint. The agency’s standard line is that it will neither confirm nor deny any particular filing. Justice and DHS declined to comment.

The Script the Brands Always Read

Mastercard said it runs «strong governance standards through a comprehensive compliance program and strong internal controls» and that it «work[s] with partners to act» when illegal activity is identified. Visa said it uses «best-in-class controls to deter, detect and remediate illegal activity» and that merchants that stay non-compliant can have their contracts terminated.

OnlyFans issued its own denial: a zero-tolerance rule for child-exploitation content and a claim that it «work[s] aggressively to target, report, and support the investigations and prosecutions of anyone who attempts to abuse our platform.»

Those sentences are the same ones the brands used when similar heat hit other adult sites. In 2020, Visa, Mastercard, and Discover cut Pornhub off after documented failures around underage content. In 2021, the BBC documented explicit videos of underage teens on OnlyFans. Payment partners then pushed OnlyFans toward a porn ban. The company announced one and reversed it within days after creators revolted. A group of 102 members of Congress asked the Justice Department to investigate the same year. What became of that letter has never been made public.

The contrast is the point. When a card network wants a platform gone, the platform is gone in a week. When the same network says it «acts when it sees» illegal activity, the question is who is doing the seeing, and how long the seeing is allowed to take.

Why the Real Defendant Is the Pipe

Adult platforms can write trust-and-safety policies until the page runs out of ink. The money still has to clear. That is the angle in this complaint, and it is why plaintiffs’ firms treated the Reuters story as a possible class action rather than a one-day scandal.

Sauder Schelkopf and Girard Sharp both announced investigations after the report landed. They pointed to the path survivors used against JPMorgan Chase and Deutsche Bank over those banks’ ties to Jeffrey Epstein: if a financial institution keeps a relationship after it has notice of predicate crimes, the institution can be pulled into civil court even when prosecutors stay quiet. The AEGIS Alliance has covered that same money trail in other files, including reporting on how Bank of America later settled with Epstein abuse survivors and how card networks remain the quiet half of every exploitation case.

Reuters later described police complaints alleging that explicit images of minors had appeared on OnlyFans as far back as 2019. In late 2025 the newsroom reported that a child-exploitation investigator flagged a cluster of accounts that appeared to feature underage girls. Those accounts came down quickly once they were reported. Speed after a tip is not the same thing as catching the material before it is sold.

The platform’s business model makes the card brands hard to peel away. Hundreds of millions of users pay a few million creators. Almost all of that traffic runs on Visa and Mastercard. Kick a platform off the network and the revenue engine stalls. That is leverage. It is also why a whistleblower would argue that «we act when we see it» is not a compliance program if the seeing depends on someone else sending a screenshot.

What Has Not Happened

No public FinCEN enforcement action against Visa or Mastercard over OnlyFans has been announced. No Justice Department indictment has been unsealed on these facts. The complaint’s confidentiality rules mean the public cannot tell whether the file is active, declined, or sitting in a queue. That vacuum is not a clearance. It is a sealed room.

Civil firms can still file even if Treasury never speaks. Whether they do depends on survivors who can show they were monetized on the platform and on discovery that would force the networks to produce the 2021 and 2022 warning calls. The whistleblower program is designed to keep those documents inside the government. Plaintiffs’ lawyers are designed to drag copies into a courtroom. Those two machines do not talk to each other unless someone makes them.

The AEGIS Alliance has covered other failures to protect children that never produced a clean institutional reckoning, including the Tempe case in which Arizona’s child-welfare agency had years of prior contact before a disabled teenager died, and reporting on how long it can take to drag a child-rape fugitive back into a U.S. courtroom. Different systems. Same delay.

Card networks like to describe themselves as pipes. Pipes that can shut off Pornhub in a week are not passive. The question the whistleblower put in front of FinCEN is whether those pipes were left open after the people who run them had already been told what was flowing through.

Notice Is the Whole Case

Bank Secrecy Act cases turn on willfulness. Willfulness, in this setting, is not a confession. It is a paper trail that shows a company was told about a predicate crime and kept the account anyway. The complaint says that trail exists in the form of calls, a 2022 nonprofit review, and continued settlement of OnlyFans charges after those contacts.

Visa and Mastercard will say they cannot watch every clip on a creator platform with four million accounts. That is true. It is also not the standard the statute uses. The standard is whether the AML program is effective once the company has reason to know the merchant is a problem. Pornhub proved the off switch works. The OnlyFans file asks why the same switch stayed on.

Until FinCEN speaks, or a civil complaint is filed and survives a motion to dismiss, the public is stuck with denials and a sealed Treasury docket. The whistleblower already did the part that is supposed to start the machine. The machine has not made a sound.