Agencies: how to structure Business Manager so one client cannot freeze the others

A twelve-person agency lost its Business Manager on a Friday morning. Fourteen client ad accounts, about forty thousand dollars of monthly spend, all frozen by one client who had rewritten their own landing page without telling anyone. The restriction took seventeen days to reverse and a further week to restructure so that it could not happen again. The restructuring is the part worth writing about, because almost every agency we meet is set up the same way that one was.

Why the cascade happens

Meta enforces at the asset level and propagates restrictions along two links: ownership and payment. If your Business Manager owns a client’s ad account, a policy violation on that account is a violation inside your Business Manager, and the system can restrict the container to stop the behaviour. If several ad accounts share one payment method, a flag on one can spread to the others through the card. Agencies that own everything and pay for everything have built a single point of failure and then put every client inside it.

The structure that isolates risk

The principle is simple: the client owns, the agency operates.

1. The client’s own Business Manager owns the client’s assets. Ad account, Page, pixel, catalogue, Instagram account. If the client does not have a Business Manager, help them create one under their legal entity and verify it. This takes an hour and is the single most protective step on this list.

2. The agency receives partner access. From the client’s Business Manager, the client shares each asset with the agency’s Business Manager and assigns a role per asset. Your team works inside the ad account exactly as before. The difference is that a restriction on the client’s asset stays on the client’s side of the link, and a restriction on your Business Manager does not take the client’s assets down with it.

3. Payment belongs to the owner. The client’s card or credit line sits on the client’s ad account. If the agency must pay, use a separate payment method per client rather than one card across all accounts. Shared payment is the second cascade path and it is invisible until it fires.

4. Roles are minimal. A media buyer needs “advertise” on the ad account and a content role on the Page. Analysts need “view”. Nobody needs Business Manager admin to run campaigns. Every full admin is a login that, if phished, can trigger an unusual-activity restriction across the whole container.

5. Two-factor authentication is enforced, not suggested. Business Settings lets you require it for everyone with access. Turn it on. Authenticator apps, not SMS.

The change log that wins appeals

Structure prevents the cascade; documentation shortens the recovery when something still goes wrong. Keep a simple, shared log for every client: who changed which landing page, creative or targeting, and when. When a restriction hits, the log tells you the trigger in minutes instead of days, and the appeal can say precisely what happened and what was corrected. The agency in the opening case had no log; identifying the rewritten landing page took most of a week. The appeal that finally worked, described in our Account Quality appeal guide, was two paragraphs long once the cause was known.

Onboarding without tripping the wire

Fast onboarding is a known trigger for unusual-activity flags: many new accounts, admins and payment methods appearing in one afternoon looks like a Business Manager being carved up after a takeover. Stagger it. Create or connect one client per day, add people one at a time with the lowest workable role, raise budgets in steps, and let each change settle. Our guide to unusual activity restrictions lists the other triggers.

Migrating an existing setup

If you currently own client assets, do not move them all at once, and do not delete anything during an active restriction. Move one client at a time: the client creates and verifies a Business Manager, requests ownership transfer of the Page, creates a new ad account under their entity if the existing one cannot be transferred, and grants you partner access. Run old and new in parallel for a short period, then wind the old down. A staged migration looks like housekeeping; a bulk migration can look like circumvention.

What this does not fix

Structure does not make anyone immune to a genuine violation. A client who runs prohibited content will still be restricted; the point is that only that client is. It also does not protect against a compromised agency login with partner access to many accounts, which is why the role and two-factor rules matter as much as the ownership rule.

When to get help

If an agency Business Manager is already restricted with client accounts inside, the recovery and the restructuring are two projects that have to be run in the right order: appeal first, then migrate, never both at once. That is the work behind our Business Manager and ad account appeals service, which includes the structural cleanup so that the next flag stays where it belongs. Official channels only, no purchased accounts, no guaranteed outcomes, and a free case review before anything else.