Ad Account Structure: How to Stop One Strike Taking Down Everything

Most advertisers structure ad accounts for reporting convenience. One business manager, every brand inside it, one domain, one card, whoever happens to be around added as an admin. It works until something gets restricted, at which point the same structure that made reporting tidy makes the restriction spread.

Account structure is a risk decision before it is an organisational one. This is how to build it so a single problem stays a single problem, whatever you sell and wherever you sell it.

How restrictions actually spread

Platforms link assets on relationships you can see and signals you cannot. The ones that matter:

• People. A restricted personal profile stops that person advertising across every business asset they are connected to. On Meta this is the most common way a single issue becomes a total shutdown.
• Business portfolios. A restriction at portfolio level affects every user and every ad account inside it.
• Domains. A domain carrying a policy history brings that history with it into any account that advertises it.
• Payment instruments. A card that triggered a suspicious payment flag is a shared signal across every account it is attached to.
• Manager accounts. On Google, in certificate-gated categories, problems aggregate upward. Manager accounts carrying a significant volume of revoked gambling certificates lose the ability to apply for new ones, with no published threshold.
• Pixels, catalogues and pages. Adding an asset with a prior restriction into a clean portfolio can pull the restriction across.

Notice that only two of those are things most teams think about when setting up an account.

The seven rules

1. Separate by risk, not by convenience

The dividing line is how likely a product line is to attract enforcement, not which team runs it. A supplement line and a software line in the same portfolio means the software line inherits the supplement line's risk for no benefit.

In gated categories, separation is sometimes mandatory rather than advisable. Google grants gambling certification for real money gambling or social casino but not both on the same account, so an operator running both needs separate accounts by rule.

2. Clients own their accounts

This one is unpopular with agencies and it is still correct. The client owns the ad account, the business manager, the domain and the payment instrument. The agency gets access, not ownership.

Three reasons. Verification can only be completed by the entity that actually owns the business, so agency-owned accounts create a verification dead end. The client cannot be held hostage at the end of a relationship. And in certificate-gated categories, the agency is not aggregating client risk onto its own manager account, which protects every other client on it.

If you are a client reading this and your agency owns your ad account, that is worth fixing before you need to fix it. See advertiser verification for why.

3. One domain, owned outright, per risk tier

The domain has to be registered to the business, not to a developer, not to an agency, and not on a free platform. Free subdomains and host-owned second-level domains are increasingly ineligible in gated categories, and cannot be fixed once an application is in flight.

Where you genuinely need different content for different markets, use different URLs on domains you own. Never use the same URL serving different content by geography, which is cloaking regardless of intent.

4. Business payment instruments, in the entity name

A card in the entity name, not a founder's personal card, and not shared across unrelated businesses. This prevents suspicious payment suspensions and it prevents one entity's billing problem becoming another's.

5. Named humans, minimum access, reviewed

• Every person has their own login. No shared accounts.
• Two-factor authentication on every admin.
• At least two admins, so one person's restriction is not a lockout.
• Access removed when someone leaves, the same week.
• A quarterly review of who still has access and why.

The two-admin rule is the one people skip and regret. A single admin whose personal profile gets restricted takes the business with them.

6. Audit inherited assets before connecting them

Before adding a page, pixel, catalogue, domain or user to a clean portfolio, check its history. This matters most when taking over an account from a previous agency, acquiring a brand, or bringing a freelancer's assets in house.

A restriction that appears with no obvious trigger is frequently a linkage to an asset from a previous arrangement, and it is much easier to check first than to diagnose afterwards.

7. Never rebuild on the same infrastructure

When an account is lost, opening a new one on the same laptop, card, domain and personal profile is why the second account dies faster than the first. On Google that is multiple account abuse, which is the policy that suspended the first one.

A rebuild that works starts from a verified entity, a domain owned outright, a business payment instrument in the entity name, a portfolio containing only your own assets, and the original cause removed rather than hidden.

A structure that works for most businesses

For a single business with a few product lines and no gated categories, this is usually enough:

• One business portfolio owned by the legal entity, verified.
• One ad account per market where billing, currency or compliance genuinely differ. Not one per campaign.
• One domain owned by the entity, with market-specific paths rather than market-specific content on one URL.
• A business card in the entity name.
• Two named admins with 2FA, plus agency access at the minimum level that lets them work.

Add a separate portfolio only when a product line carries materially different enforcement risk, or when a certification rule requires it. Over-fragmenting has its own costs: fragmented learning data, duplicated pixels and attribution that no longer reconciles.

For agencies

Three positions worth writing down before a client asks you to bend them.

1. Client-owned accounts, always. You get access. This is not a trust issue, it is a verification and containment one.
2. Never run a certificate-gated category through your own manager account. Aggregated revocations can cost you the category across every client you serve.
3. Audit inherited accounts before you touch them. You are taking on whatever the last agency did, and you will be the one explaining it.

Related

Advertiser verification is the other half of this. Why ads get rejected covers the asset-level causes, and landing page compliance covers the destination. For gated categories, start with the restricted products guide.

We restructure accounts as part of a paid ads audit, and rebuild them properly inside ad account recovery when the first structure has already failed.