When a brand pays a creator through a marketer's own personal PayPal or Venmo instead of the company's contracted vendor system, the immediate problem usually isn't hidden intent — it's that nobody, including the brand's own legal team, can later reconstruct which payment went to which creator for which post. Politico reported in mid-2026 that Polymarket's chief marketing officer routed more than $2.5 million to over 800 people through a personal PayPal account between January 2025 and February 2026, including at least $350,000 to content creators; at least 24 of those creators posted about the platform on X more than 490 times without a single disclosure. The lesson for a marketing operations team isn't just "creators must disclose" — it's that the payment channel itself is the evidence a disclosure requirement was ever enforceable in the first place.
What actually happened at Polymarket?
According to Politico's reporting, Polymarket's CMO used a personal PayPal account — not a company account — to send over $2.5 million to more than 800 people across roughly 13 months, and at least $350,000 of that went specifically to content creators who promoted the prediction-market platform. At least 24 of those creators posted about Polymarket on X over 490 times combined, and none of the posts carried a disclosure identifying the paid relationship. Separately, the Wall Street Journal reported that Polymarket built a near-identical replica of its live trading interface so creators could film videos of "winning bets" they never actually placed, and instructed creators to keep the paid relationship out of the post — a campaign WSJ says drew roughly 140 million views before the CFTC opened an inquiry. The FTC's disclosure standard doesn't care which platform or which country the audience is in: any material connection — a cash payment, an affiliate cut, a free product — has to be disclosed clearly enough that an ordinary viewer would actually notice it, and 2026 guides to the rule put the civil penalty ceiling at roughly $51,744 to $53,088 per violation, stacking per post.
Why does the payment channel matter more than the disclosure rule itself?
The disclosure rule is about what the audience sees in a post. Proving compliance — or non-compliance — after the fact depends entirely on something the audience never sees: whether anyone can trace a specific payment to a specific creator, a specific deliverable, and a specific post, and check whether a disclosure obligation was ever attached to it. Route that payment through an individual's personal account instead of the company's own AP system, and several things disappear at once. There's no purchase order tied to a signed contract, so there's no disclosure clause to point to later. There's no review step for legal or finance before the money moves. And the person who authorized the payment becomes the entire audit trail — which is exactly the position Polymarket's CMO ended up in. Regulators, investigative reporters, and the plaintiffs' counsel behind the recent wave of disclosure class actions against brands like Gymshark don't need to prove intent to hide a relationship; an unreconstructable payment history reads as an aggravating fact on its own, whether or not anyone meant to hide anything.
How should a normal creator payment process actually be built?
None of this requires new legal infrastructure — it requires routing payment through the same discipline a company already applies to any other vendor.
- Pay from the company's own account or vendor-payment system, never an employee's personal app. This holds even for a small gifted-product reimbursement — the exception is exactly where the habit starts.
- Require a signed agreement with a disclosure clause before the first payment goes out, not after. Pay only against a contract or purchase-order number, so the payment record and the disclosure obligation are the same document.
- Tie each payment to a specific deliverable — post URL, platform, date — at the time you pay it, not reconstructed months later from a Slack thread or a marketer's memory.
- Keep one centralized ledger legal or finance can pull without asking the person who ran the campaign, the same way you'd keep records for any other paid vendor relationship.
- Route payment approval through someone other than the person negotiating with the creator, so no single individual is both the negotiator and the payer of record.
Why does gifting need a different process than paid deals?
The FTC's material-connection standard technically covers free products too, not just cash — but a one-off unsolicited PR box sits in a genuinely lower disclosure-risk tier than a negotiated cash payment, and treating every gifted item like a formal vendor contract would grind a seeding program to a halt. The line moves once gifting becomes a program rather than a one-off: recurring boxes sent with an expectation of content, or gifting tied to a specific campaign calendar, start to look like ongoing sponsorship in substance even if no cash changes hands, and at that point they need the same contract-first, company-account discipline as paid work. The contract itself is where this gets specific — usage rights, posting duration, and disclosure responsibility are exactly the terms we break down in our influencer contract checklist, and getting the disclosure clause into that document is what makes the payment record above actually mean something. It's also worth checking that the platform's own disclosure tools aren't doing less than they look like they're doing — we cover where native "Paid Partnership" labels fall short of the FTC's actual standard once a post gets boosted.
What should you check right now?
Pull last quarter's creator payments and sort them into two piles: paid through the company's vendor system with a signed agreement on file, and everything else. For anything in the second pile, check three things — was there a contract with a disclosure clause, is the associated post still live, and does it actually carry a disclosure an ordinary viewer would notice. Example: if 20 of those payments turn out to be undisclosed on review, and a regulator or plaintiff's counsel treats each as a separate violation, the theoretical maximum exposure at the FTC's roughly $53,088-per-violation ceiling works out to 20 × $53,088 ≈ $1.06 million. That's a hypothetical ceiling, not a typical outcome — actual penalties vary by case — but it's a reason to know the number of undisclosed posts before a regulator or a plaintiff's counsel does. Getting the payment process right is also where a centralized creator relationship system pays off: everyone on the team works from the same contract, payment, and content record instead of a marketer's personal inbox and PayPal history. If you want your creator contracts, payments, and content all tracked in one place your whole team can see, Hyperstar keeps that record centralized while still attributing real sales back to each creator, so you're never reconstructing who you paid, for what, from memory. Get started.
