Starting an OFM agency: the checklist

A checklist, with the official pages to read attached to each line. France and the United States are covered because those are the two jurisdictions most readers of this handbook ask about. Nothing here is legal, tax or financial advice.

3.1Decide what you are actually selling

Three offers get called the same thing. Full management, where you run the account end to end and take a share. Chatting only, where you supply people or software for the inbox and nothing else. Traffic only, where you bring fans and are paid on what they spend. They have different cost structures, different contracts and different risk. Write down which one you sell before you register anything, because the answer changes the rest of this list.

3.2The legal entity, France

Everything starts at the guichet unique. Since 1 January 2023, creation, modification and closure formalities go through formalites.entreprises.gouv.fr, which replaced the centres de formalités des entreprises^[6].

Sources: official French administration pages, read 14 September 2026, each with the verification date printed on the page itself. Note one thing that is easy to get wrong: the service-public VAT page states that the single 25,000 euro threshold proposed in the 2025 finance law was abandoned and that 2026 thresholds are unchanged^[4].

If you go past the micro-entreprise, the official comparison of company forms is one page, and it is worth reading rather than a summary of it. In short, on that page: an EURL is taxed on income by default with an option for corporation tax, and its manager is under the self-employed regime; a SASU is taxed on profits by default, and a paid president is attached to the general social security regime as an assimilated employee^[5]. Liability is limited to contributions in both.

3.3The legal entity, United States

The Small Business Administration publishes the structure comparison. Its blunt line on the simplest option: sole proprietorships "do not produce a separate business entity. This means your business assets and liabilities are not separate from your personal assets and liabilities"^[11]. For an LLC it notes that profits pass through to personal income, and that members "are considered self-employed and must pay self-employment tax contributions towards Medicare and Social Security".

• EIN. Free, direct from the IRS. Their own warning is worth repeating: "Beware of websites that charge for an EIN. You never have to pay a fee for an EIN."^[12]
• Self-employment tax. "The self-employment tax rate is 15.3%. The rate consists of two parts: 12.4% for social security and 2.9% for Medicare", with a filing threshold of 400 dollars of net earnings^[13].
• Estimated tax. Income not subject to withholding is paid quarterly on Form 1040-ES^[20].
• Single member LLC. Treated as a disregarded entity for income tax, so its activity goes on the owner's return, but it is a separate entity for employment taxes^[15].

3.4Getting money in, and the paperwork attached to it

Two traps. First, cross-border VAT. For services sold to a business customer, the French rule is that VAT is due in the customer's state, with the reverse charge mechanism and a specific mention on the invoice; where the business customer is outside the EU, the official page instructs the seller to put "TVA non applicable, art. 259-1 du CGI" on the invoice^[7]. A creator in another country is a cross-border sale, not a domestic one.

Second, paying the people who work for you. A United States payer filing information returns should know that the 1099-NEC reporting threshold changed: the IRS instructions state that for tax years beginning after 2025 the minimum threshold increased to 2,000 dollars^[14]. And the form you collect depends on who you are paying: a W-9 from a United States person, a W-8 BEN from a foreign person who is the beneficial owner of an amount subject to withholding^[16]. Getting this backwards is one of the most common mistakes in a remote chatting team.

3.5The contract with the creator

This is the only contract that actually governs the relationship, because the platform is not party to it. The OnlyFans terms are explicit that if someone else helps operate an account, "this does not affect your legal responsibility. Our relationship is with you, and not with any third-party"^[18]. Whatever you agree, you agree it privately and you enforce it privately.

At minimum, write down: the scope of what you do and what you do not; the percentage and explicitly what it is a percentage of, gross fan payments or creator earnings after the platform fee; who owns the accounts, the content and the fan list; who holds credentials and what happens to them at the end; the term, the notice period and the exit terms; and what happens if an account is suspended. Exit terms deserve particular care: journalists reviewing agency contracts in 2026 reported one creator being told she would need to pay 10,000 pounds to leave^[19]. A contract that is expensive to leave is a contract that will be read out loud one day.

3.6The people who write the messages

If humans write the inbox, you have an employment or contracting relationship, with shifts, pay and turnover. Chapter 4 has the published rates and the rota arithmetic. Two rules cut across it wherever you are. You are responsible for what people do on your behalf: the FTC states the principle plainly for marketing, noting that "delegating part of your promotional program to an outside company doesn't relieve you of responsibility under the FTC Act"^[17]. And the creator carries the platform liability for everything your team sends from her account, which is a good reason for her to want quality control written into the contract.

3.7Data, which you will be handling from day one

An agency processes personal data belonging to someone else's business: fan identifiers, conversations, purchase histories. Under the GDPR the agency is usually a processor, which the CNIL defines as the entity that "traite des données pour le compte d'un autre organisme"^[8], and the CNIL lists the obligations that must appear in the contract: transparency and traceability, data protection by design and by default, security, and a duty to assist, alert and advise. Separately, a record of processing activities is required under article 30 of the GDPR, and the CNIL states the obligation "concerne tous les organismes, publics comme privés et quelle que soit leur taille"^[9], with a partial exemption under 250 employees.

3.8One French page to read before you sign anything

If you operate from France, read the official page on offences linked to prostitution before you write a contract, because the definitions there are broader than most people assume. The page, verified 20 August 2026, defines proxénétisme as consisting in "tirer profit de la prostitution d'une autre personne ou à la favoriser", lists acts including serving as an intermediary and taking profit, and states penalties of up to seven years and 150,000 euros, rising to ten years and 1,500,000 euros where the acts are committed "par le biais d'un service de communication en ligne"^[10]. The underlying texts are articles 225-5 to 225-12 of the penal code.

We quote it and stop there. This handbook does not tell you what it means for your business, because that is a question for a lawyer who knows your facts, and because any activity is a question of its own circumstances. What we will say is that reading the page is not optional for anyone operating this business in France.

3.9Tools, and the first creator

Buy tools last, and buy them against your own numbers. Published prices for the main CRM and AI chatting products are in chapter 4, and what the platforms publish about automation is in chapter 5. Before the first creator, you want: a registered entity, a bank account in its name, a signed contract, a way to pay whoever works on the account, a stack you have tested on a real account, and a written answer to the question of what everyone does if the account is suspended tomorrow. If you cannot answer the last one, you are not ready for a second creator either.