Access Verification Retired: Meta Tech Provider Update

Published 13 October 2026 · Source: Meta for Developers blog, 9 October 2026

Access Verification retired is the headline every Tech Provider has been waiting for. On 9 October 2026, Meta announced on its official developer blog that Access Verification will no longer be required in the Tech Provider onboarding flow. If your app accesses business data owned by your clients — WhatsApp Business Platform integrations, Instagram messaging tools, Marketing API dashboards — you no longer submit a separate access review before going live. Business Verification and App Review, however, stay exactly where they were.

Below is what Meta actually said about Access Verification retired, who it affects, what is still required, and what to do if you have an Access Verification submission sitting in your App Dashboard right now.

What changed: Access Verification removed, in Meta's exact wording

Meta's announcement, titled "Retiring Access Verification for Tech Provider Apps", opens with this:

"Access Verification will no longer be required in the Tech Provider onboarding flow. If you build apps that access Meta business data owned by your clients, you no longer submit business details for a separate access review, and you no longer wait on its outcome before going live."

Meta explains that it introduced Access Verification in 2022 "to confirm that businesses requesting access to other businesses' data were genuinely operating as Tech Providers," and that "since then, Business Verification and App Review have matured, and more sophisticated signals now address the Access Verification requirement."

The post lists three concrete changes:

• Removing Access Verification submission. "The Access Verification form, its prerequisites, and its status field will be removed from App Dashboard."
• No Access Verification gate on API calls. "Endpoints that previously rejected calls from businesses without a passing Access Verification status will no longer perform that check."
• Your app's classification stays yours. "Adding an app to a business will no longer change that app's business use. Tech Provider follows from you explicitly upgrading the app, or from the advanced permissions the app itself requests. Direct Integrator will be the default."

Effective date: Meta's post does not state a specific effective date or rollout schedule. It describes the form and status field as items that "will be removed" from App Dashboard. If you still see the Access Verification step today, treat it as a rollout in progress rather than a contradiction.

Who is affected

Access Verification retired affects any business that builds apps accessing Meta business data owned by other businesses — in other words, Tech Providers and anyone becoming one, including anyone planning Meta Tech Provider onboarding. In practice that includes:

• WhatsApp Business Platform Tech Providers onboarding clients through Embedded Signup.
• SaaS tools for Instagram and Messenger messaging, CRMs, help desks and chatbot platforms that connect client Pages and Instagram accounts.
• Marketing and ads platforms that read or manage client ad accounts and business assets.
• Agencies that built an app and found it worked for their own team but failed for clients — the classic Access Verification symptom.

With Access Verification retired, the classification change matters too. Previously, adding an app to a business could shift how Meta classified the app's business use. Now, per Meta, Direct Integrator is the default, and Tech Provider status follows from you explicitly upgrading the app or from the advanced permissions the app requests. If you serve clients, make sure your app is actually set up that way rather than assuming it happens automatically.

If you only use the API for your own business's assets (a Direct Integrator), Access Verification generally never applied to you, and nothing about your day-to-day changes.

Tech Provider requirements 2026: what is still required

This is the part that is easy to miss in the headlines. With Access Verification retired, Meta removed one gate, not all of them. The announcement is explicit:

"Business Verification is still required before your app can access data owned by other businesses."

"App Review is still required for advanced permissions, and the review standards for those permissions are unchanged."

And on data obligations:

"Platform Terms, Developer Policies, Data Use Checkup, the Data Handling Questionnaire, and Data Protection Assessment requirements continue to apply exactly as before. Removing Access Verification is not a change in what you are permitted to do with Meta Platforms Data."

Meta also notes it "may include additional requirements for Tech Providers or data access, as required for the sharing of any Meta Platforms Data." So the path to serving clients now looks like this:

1. Business Verification — your legal entity, documents and Business Portfolio must be verified. See our Meta Business Verification guide and, if you've been turned down, Business Verification rejected fixes.
2. App Review for advanced permissions — every advanced permission your clients' use case needs still has to be approved, with the same screencast, use-case description and test-access standards as before. Start with our App Review rejection reasons and screencast guide.
3. Tech Provider setup — explicitly upgrade the app to Tech Provider where your use case requires it. Our Meta Tech Provider verification guide covers the business-side setup.
4. Data handling compliance — Data Use Checkup, Data Handling Questionnaire and Data Protection Assessment, unchanged.

Fewer gates does not mean an easier App Review, even with Access Verification retired. If anything, with Access Verification gone, Business Verification and App Review now carry the full weight of Meta's checks on who gets client data, so submissions with vague use cases or weak screencasts are likely to stay exactly as rejectable as before.

What to do if your Access Verification is pending or rejected

Meta's post does not publish specific instructions for in-flight submissions. Based strictly on what Meta has said, here is a sensible approach:

• Pending submission: With Access Verification retired, Meta says you "no longer wait on its outcome before going live." Check whether the Access Verification form and status field are still showing in your App Dashboard. If they have been removed, focus on confirming Business Verification is complete and your advanced permissions are approved.
• Rejected submission: With Access Verification retired, the endpoints "will no longer perform that check," an Access Verification rejection should no longer be what blocks your API calls once the change reaches your app. But if you were rejected because of Business Verification problems or restrictions on your account, those problems still matter, because Business Verification remains mandatory.
• Calls still failing for client users: If your app works for people with a role on the app but fails for real clients, check (1) Advanced Access / App Review approval for each permission, (2) Business Verification status, (3) whether the app is classified as Tech Provider or Direct Integrator, and (4) whether the rollout has reached your app yet.
• Don't resubmit blindly: Resubmitting App Review won't fix a Business Verification or classification problem, and Access Verification retired does not change that. Work out which gate is actually blocking you first.

Older guides on this site (including our Access Verification case study, written before Access Verification retired) describe the process as it worked before this announcement. They are still useful for understanding the Business Verification and permission side, which hasn't changed.

FAQ