A restricted Meta Business Portfolio is an ownership and governance incident as well as an advertising incident. The portfolio can contain ad accounts, Pages, Instagram accounts, datasets, apps, catalogs, domains and partner access. If the team reacts only by rewriting ads, it may never address the portfolio-level fact that controls the restriction.
The first move is to preserve the Business Support Home notice and identify the exact portfolio, people and connected assets. Meta says Business Support Home surfaces account status, outstanding issues and available actions (Meta: About Business Support Home). The action shown in the authenticated portfolio—not a generic recovery checklist—controls the next step.
This guide is for legitimate business owners, growth leads, paid-social operators, agencies and compliance teams. It is not legal advice, a route around enforcement or a promise of restoration.
The short answer
When a Meta Business Portfolio is restricted, freeze non-essential changes, capture the portfolio notice and ID, confirm who legally owns the business and assets, map every person and partner with access, reconcile verification and payment identity, identify the policy or security dependency, correct it across connected assets, and have a person with the required full access use the review path displayed in Business Support Home.
Do not move campaigns into a replacement portfolio, borrow somebody else's profile, transfer assets to conceal ownership or submit altered documents. Those actions can add integrity and circumvention concerns without resolving the original restriction.
Why portfolio restrictions need a different diagnosis
A Meta ad-account restriction concerns one advertising account. A personal advertising restriction concerns one person's ability to advertise. A Page restriction concerns the Page. A Business Portfolio restriction sits above multiple owned or connected assets and can affect who can advertise, who can administer the business and which dependencies must be resolved first. Meta's restriction guidance distinguishes people and business assets, including business-level enforcement (Meta: About advertising restrictions).
Build an asset register before making changes:
Asset Legal or business owner Full-access people Partner access Current status Review owner --- --- --- --- --- --- Business Portfolio Registered operating business Named trusted administrators Agency partner when documented Eligible, restricted or prerequisite shown Business owner with full access Ad account Portfolio or documented owner Named administrators Campaign/task roles Active, disabled or restricted Account administrator Page and Instagram Brand owner Named administrators Content and ads tasks Eligible or restricted Brand owner Dataset, pixel or app Product/business owner Named technical owners Minimum required integration access Active or separately restricted Data/product owner Domain and catalog Business or brand owner Named operations owners Scoped partner access Verified or issue shown Business owner Payment profile Legitimate payer Authorized finance owners No shared credentials Current, failed or flagged Finance owner
This table reveals whether the team is dealing with a portfolio restriction, a person's lost access, a disconnected asset or several simultaneous states.
Preserve the before-state
Create one incident record containing:
the exact portfolio notice, date, status, ID and available action;
every prerequisite shown under “What you can do”;
people with full access, task access and recent role changes;
partner businesses, agencies and asset assignments;
owned and connected ad accounts, Pages, Instagram accounts, apps, datasets, catalogs and domains;
business-verification state and submitted legal details;
payment profiles, amounts due and legitimate payer ownership;
security alerts, unexpected administrators and unauthorized changes;
relevant rejected ads, landing pages and product categories;
prior review requests, case IDs and decisions; and
a dated change log before and after the restriction.
Do not remove people, disconnect assets or change the legal entity before preserving what Meta reviewed. Security containment may need immediate action, but document the unauthorized access and the supported steps used to remove it.
Diagnose ownership before policy
Meta's permissions model distinguishes people with full portfolio access from task-based access to individual assets (Meta: Business portfolio and asset permissions). That difference matters because a media buyer who can edit campaigns may not be able to complete verification, resolve a portfolio restriction or manage ownership.
Ask:
Which legal business owns the portfolio?
Which person has full access and can see the restriction?
Are there at least two trusted internal administrators, or is one external person a single point of failure?
Is the agency connected as a partner, or has it become the undocumented owner?
Do the portfolio, domain, app publisher, Page, payer and verification records describe the same legitimate operating relationship?
Did a former employee, contractor or compromised profile retain access?
Were assets transferred shortly before the restriction?
An agency can help organize the incident and operate eligible campaigns, but it should not ask for personal passwords, receive authentication codes or replace the real owner's identity. Supported partner access and minimum necessary permissions are easier to audit and revoke.
Map the restriction to an enforcement layer
Layer Evidence to inspect Typical conflict Correction focus --- --- --- --- Portfolio scope Portfolio notice, ID and owned assets Team is appealing from the wrong account Work from the restricted portfolio with an authorized person Verification Security Center, legal name, address, registration and domain Genuine records do not match submitted details Reconcile authentic information through the official flow Access and security People, partners, sessions and changes Unknown admin, compromised profile or obsolete partner Contain access and document legitimate ownership Policy pattern Rejected ads, Pages, destinations and prior warnings Repeated or systemic issue across assets Correct the pattern everywhere, not one ad Payment Billing notices, payer, invoices and amounts due Ownership mismatch or unresolved payment Resolve through the supported billing path Product and market Product function, app, category, licence and targeting Ineligible or misclassified offering Confirm eligibility before relaunch Destination Domains, redirects, app/store listing and disclosures Ads and live experience describe different products Restore a truthful, functional and consistent path
More than one layer can be open. Verification does not cure an ineligible product. Removing a compromised person does not correct misleading ads. Paying an invoice does not prove the portfolio is policy-compliant.
Reconcile business verification carefully
Meta's verification guidance requires authorized access and legitimate business information in the relevant settings (Meta: Verify your business). Create a reconciliation table with the submitted value, the current official record, the live website or domain disclosure and the legitimate relationship among advertiser, payer, app publisher and licence holder.
Do not alter documents, crop out inconvenient details or create a new entity merely to match the account. If several genuine entities are involved, explain the relationship: for example, a parent company owning the portfolio, an operating subsidiary selling the product and an agency managing campaigns. Include only evidence relevant to the issue and minimize unnecessary personal data.
Verification is a dependency, not a guarantee. A verified portfolio can still be restricted for policy, security, payment, product or connected-asset reasons.
Audit connected assets as one system
A portfolio-level review can fail if the business corrects one campaign while connected surfaces still contradict it. Check:
whether Page and Instagram identity match the promoted business;
whether ad-account ownership and payment profile are legitimate;
whether final URLs, redirects and domains lead to the represented product;
whether the app name, store publisher and in-app offering match the ads;
whether catalogs and product feeds contain eligible products;
whether datasets and apps are owned and administered by the documented business;
whether age, geography and category restrictions are applied where required; and
whether previous violations remain live in other accounts or Pages.
The objective is not to make every asset look identical. It is to make the real relationships and product facts coherent and verifiable.
Correct in dependency order
Unless the private notice requires another sequence:
Contain security and billing risk. Preserve evidence, remove unauthorized access through supported controls and resolve any controlling amount due.
Establish the owner and review authority. Confirm the legal business and full-access person who can act.
Confirm product and market eligibility. Do not prepare a relaunch for an ineligible product or territory.
Reconcile verification and entity relationships. Align genuine records without manufacturing a story.
Repair connected assets and destinations. Correct Pages, domains, apps, stores, catalogs and disclosures that control the issue.
Correct the policy pattern. Address all affected ads and business practices.
Validate the complete portfolio. Have accountable owners sign off on each dependency.
Request review through the displayed action. Submit one coherent packet from the restricted portfolio.
If the review button is absent, check whether the signed-in person has the required access, whether prerequisites remain incomplete, whether the issue belongs to another object and whether Business Support Home displays an official support option. Meta's public review guidance says an administrator may be able to select a restricted account and follow the current action (Meta: Request review); it does not promise the same interface or path for every portfolio.
What belongs in the portfolio review packet?
Include the portfolio ID and notice, legitimate business and product, affected assets, root-cause statement, ownership-and-access table, policy-to-asset inventory, before-and-after evidence, authentic verification or authorization records when material, security or payment evidence when relevant, change timeline and relaunch-control plan.
Keep the explanation factual. State what was observed, what was corrected and how the owner verified it. Do not say “we have always complied” if the evidence cannot support that statement. Do not promise that a control eliminates all future enforcement; describe who checks which fact before launch.
Relaunch safeguards
If access returns, do not immediately reactivate every campaign. Reconfirm the eligible portfolio and accounts, administrators, partners, payer, domains, apps, stores, product category, target markets, audience controls, claims and disclosures. Use a change register for access, verification, payment, domains and high-risk creative. Separate policy status, account security, billing, measurement and campaign performance in reporting.
The broader Meta account restriction guide covers other enforced objects. The ad rejection versus restriction guide helps when the team has not yet identified the scope. App advertisers should connect governance to the operating model in our mobile app growth resources.
When Sharply Labs can help
Sharply Labs' growth and performance marketing practice can help legitimate advertisers build the portfolio asset map, reconcile ownership and permissions, organize policy and destination evidence, define the correction order and prepare eligible campaign operations. The output is an evidence-backed incident record, access map, gap list and bounded relaunch plan.
It is not legal advice or a promise of restoration, approval, refunds, account stability, lower CPA or campaign performance. If you need that compliance-first diagnosis, contact Sharply Labs for a Meta Business Portfolio and campaign audit.