# Business Portfolio Restricted From Advertising: What to Do

> Business portfolio restricted from advertising in Malaysia? What the notice means, the three usual causes, how an admin asks for review and scams to avoid.

- URL: https://www.awarexone.com/research/business-portfolio-restricted-advertising-malaysia
- Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone
- Published: 2026-09-29
- Topics: Facebook, Account recovery, Malaysia
- Related service: Business Manager recovery: https://www.awarexone.com/business-manager-recovery

## Short answer

It means Meta has stopped that business portfolio from advertising, usually for a policy problem, suspected hacking or missing two-factor authentication. On a computer, open Account status overview in Meta Business Support Home. Remove unknown admins and turn on two-factor authentication before an admin requests a review, because reviews are limited and Meta's decision is final.

## Summary

- A restricted business portfolio means Meta has stopped that portfolio from advertising, usually for a policy problem, suspected hacking or missing two-factor authentication.
- Start in Meta Business Support Home on a computer, open Account status overview and read what the restricted portfolio is asking you to do.
- If anything looks like a takeover, remove unknown admins, secure every admin's Facebook profile and turn on two-factor authentication before you ask for a review.
- Only an admin can press Request review, the number of reviews is limited, and Meta says the decision after a completed review is final.
- Emails and messages that copy this notice are a common phishing trick, so never click their links, and never give anyone your password or login codes.
- Meta alone decides whether the restriction is lifted, and some portfolios stay restricted even after a careful, honest review request.

Your ads stopped overnight. Meta Business Suite shows the whole business portfolio as restricted from advertising. The Page still works, but the weekend sale campaign is dead and you cannot even create a new ad account.

This is an enforcement or security hold on the portfolio, not a bug that clears itself. The fix is to find out which of three causes applies (a policy problem, suspected hacking, or missing two-factor authentication), deal with that cause, and only then ask Meta for a review from Business Support Home.

This guide covers each cause, how an admin requests the review, the fake notices scammers send, and what to do if Meta says no.

Last checked: 29 September 2026.

## What Does "Your Business Portfolio Is Restricted From Advertising" Mean?

It means Meta has blocked that business portfolio from running ads. Meta's page [about advertising restrictions](https://www.facebook.com/business/help/975570072950669) says a restricted business portfolio "isn't allowed to advertise", and names the usual reasons: a policy breach, suspected hacking of the portfolio or its assets, missing two-factor authentication, and unusual payment or account activity. The notice usually reads close to "Your business portfolio is restricted from advertising", but the wording varies by app version, language and reason. The route back is the same: open [Meta Business Support Home](https://www.facebook.com/business/help/254088759757736), fix what it points to, and have an admin request a review. Nobody outside Meta can lift the restriction for you.

## Which Kind of Restriction Do You Have?

A business portfolio is Meta's container for your Pages, Instagram accounts, ad accounts and catalogues. Meta can restrict the portfolio, one ad account, a Page or a person's own profile. Business Support Home says a portfolio's status affects the ad accounts, shops and assets it owns, so this restriction reaches furthest.

Meta's restrictions page also separates two families. A restriction for a policy breach can stop advertising altogether. A restriction for unusual activity is described as temporary while Meta investigates, and can include lower spending limits, losing some payment features, losing the ability to add admins, partners or users, and losing the ability to create new ad accounts.

*Business portfolio notices and the first step for each, at the time of writing. Labels vary by region and app version.*

| What you see | What it most likely means | What to do first |
| --- | --- | --- |
| The portfolio is marked restricted and cannot advertise | A portfolio-level restriction, for a policy issue, suspected compromise or missing security settings | Open Account status overview in Business Support Home and read the reason and the steps under "What you can do" |
| You cannot add admins, partners or users, or create a new ad account | An unusual-activity restriction while Meta investigates | Check the people, partners and ad accounts in Business Suite settings for changes you did not make |
| A prompt to turn on two-factor authentication | You, or someone in the portfolio, does not meet Meta's two-factor requirement | Turn it on from each person's own Facebook profile, then recheck the status |
| Lower spending limit or payment features missing | A temporary limit, often tied to failed or disputed payments | Fix the payment method and look for card disputes you did not raise |
| Only one ad account is disabled; the portfolio looks fine | An ad account restriction, not a portfolio one | See our guide to [a disabled Facebook ad account](https://www.awarexone.com/research/facebook-ad-account-disabled-malaysia) |
| Your own profile cannot advertise in any portfolio | A restriction on your personal profile | Read [what a personal advertising restriction means](https://www.awarexone.com/research/restricted-from-advertising-meta-malaysia) |
| An email or DM says the portfolio will be deleted unless you click | Very likely phishing | Do not click. Check Business Support Home instead |

## Cause One: Meta Suspects the Portfolio Was Hacked

This is the cause to rule out first, because a review cannot succeed while someone else still has access. Meta's page on [recovering a hacked or compromised business portfolio](https://www.facebook.com/business/help/25302697499431030) says compromises usually start when one person's account is hacked or reached through malware or phishing. It lists the signs: new users or admins nobody approved, new or reactivated ad accounts and campaigns, sudden jumps in spend or charges, and posts that do not look like your business.

If you see any of those, treat it as a takeover and work in this order:

1. Secure the Facebook profile of every admin. Change the password, sign out of other sessions, and use [facebook.com/hacked](https://www.facebook.com/hacked) for any profile that someone else has got into.
2. Secure the email inbox behind each admin profile too. Check its forwarding rules and recovery options, because whoever holds that inbox can reset the Facebook password again.
3. In Business Suite settings, remove people, partners and ad accounts you do not recognise, where Meta still lets you.
4. Pause or turn off campaigns you did not create, and screenshot them first as evidence.
5. Call your bank's 24-hour hotline if your card was charged for ads you did not run, and ask about disputing the charges.
6. Contact Meta Support from Business Support Home and say plainly that the portfolio was compromised and roughly when.

Meta's page also recommends Security Checkup in portfolio settings, two-factor authentication for every user, removing users with email addresses unrelated to the business, and closing ad accounts that have not run ads in the last year. Our guide to [a hacked Facebook Business Manager](https://www.awarexone.com/research/facebook-business-manager-hacked-malaysia) goes through the takeover side in more depth.

## Cause Two: Missing Two-Factor Authentication

Meta can restrict a portfolio simply because people in it are not using two-factor authentication. Its page [about two-factor authentication for your business portfolio](https://www.facebook.com/business/help/865384580786591) says advertisers may be required to complete it to publish ads, including users targeting certain regions and business portfolios more than 90 days old. If it is not turned on, Meta says it may restrict or remove access to advertising, remove permission to manage a shop, or remove a payment method.

The detail that trips people up: Meta says people must set up two-factor authentication using their personal Facebook profile, not inside the portfolio. So the fix is per person:

- Each admin and employee turns on two-factor authentication on their own Facebook profile, ideally with an authenticator app rather than SMS.
- Each person saves their own backup codes somewhere safe and offline. Never collect everyone's codes in a shared chat or spreadsheet.
- Anyone who cannot or will not set it up, such as a former staff member or an old agency login, comes out of the portfolio.
- Once everyone is covered, recheck Account status overview. If the restriction remains, follow the steps it shows.

## Cause Three: A Policy or Payment Problem

If there was no hack and security is in order, the restriction usually traces back to ads or payments. Meta's restrictions page names breaches of its Community Standards, Advertising Standards and Commerce Policies, and separately names unusual payment activity and high rates of failed or disputed payments. Check the rejected ads in Business Support Home, their landing pages and your billing history, and fix what is plainly wrong before you ask for a review.

## How to Request a Review of a Restricted Portfolio

The review lives in Business Support Home, and only an admin can file it. Meta's page on [requesting a review for a restricted advertising account](https://www.facebook.com/business/help/530209463124901) gives these steps, and its [troubleshooting page](https://www.facebook.com/business/help/422289316306981) says to start on a computer:

1. On a computer, log in with the Facebook profile of a portfolio admin and open Meta Business Support Home.
2. Select "Account status overview" in the left menu, then the restricted business portfolio.
3. Read the "What you can do" section. Meta may ask you to confirm your identity, complete verification or secure your account before a review is offered. Do those first.
4. Select "Request review" and complete the on-screen steps with short, accurate answers.
5. Wait for the result in Business Support Home and the admin's email. Do not file again while it is open.
6. If Meta lifts the restriction, turn your ads back on in Ads Manager. Meta says ads that were running before do not restart on their own.

Meta says the review is typically completed in 48 hours but can take longer. It also says there is a limited number of times you can request a review of an advertising restriction, and that once the review is completed, the decision is final. That is why the security and policy fixes come first: a rushed review spends a chance you may not get back.

> Note: **Meta makes the decision.** A review asks Meta to look again. It is not a right to reinstatement. Some portfolios are cleared within days, some take longer, and some stay restricted. Nobody outside Meta can promise an outcome.

## What to Gather Before You Press Request Review

Review screens give you little space, so prepare the facts first:

- Screenshots of the restriction notice and of Account status overview, with dates visible.
- Your business portfolio ID, the IDs of the ad accounts and Pages it owns, and the names of every admin.
- Company registration documents and a utility bill or bank statement in the business name, in case Meta asks you to complete verification.
- For a hack: login alerts, emails about changed admins, screenshots of campaigns you did not create, and the bank statement lines for those charges.
- Proof that each admin now has two-factor authentication on, such as a screenshot of their security settings.
- Three or four calm sentences saying what the business is, what went wrong, and what you have changed since.

## Mistakes That Waste Your Review

- Requesting a review before removing the unknown admin or turning on two-factor authentication.
- Filing several requests from different admins at once. Meta limits how many reviews you get.
- Opening a fresh portfolio or new ad accounts to keep advertising. It does not fix the cause and can spread the problem to new assets.
- Writing a long, angry explanation, or blaming a staff member without saying what you changed.
- Buying "aged" portfolios or ad accounts online. You inherit someone else's history and give a stranger access.
- Clicking a link in an email or DM that claims to be the appeal.

## Is That Restriction Email Real?

Treat any email, DM or call about a restricted portfolio as suspect until Business Support Home confirms it. Meta's page on [suspicious emails claiming to be from Facebook](https://www.facebook.com/help/225602007465207) says scammers send fake notices falsely claiming a business breaks the Advertising Standards or Commerce Policies, often warning that something will happen unless you act. Meta asks you to report them to phish@fb.com and to check Business Support Home, where the account overview also confirms whether a message from a supposed Meta representative is genuine.

In Malaysia these fakes commonly arrive as a Messenger message from a Page with a name like "Meta Business Support", sometimes in BM (along the lines of "Akaun perniagaan anda telah disekat") or Chinese (such as "您的广告账号已被限制"), with a deadline and a link to an "appeal" form. The form asks for your password and then your login code. Our breakdown of [the fake Meta support scam](https://www.awarexone.com/research/fake-meta-support-scam-malaysia) shows how these pages look.

> Warning: **Nobody genuine needs your codes.** Meta does not ask for your password in an email, and a real review never needs your login code, backup codes or two-factor codes from you. Do not pay "unban" sellers or "hackers for hire" who claim they can get you back in. If you already paid or shared a banking code, call your bank's 24-hour hotline or the National Scam Response Centre on 997 straight away, then make a police report.

The [National Scam Response Centre](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) says to call your bank's 24-hour hotline or 997 straight away, and to make a police report within 24 hours. If the attack came through a phishing site or malware on a company laptop, you can also report it to [Cyber999](https://www.cybersecurity.my/portal-main/services/cyber999-overview), CyberSecurity Malaysia's incident response centre, through its online form or email.

## What If Meta Keeps the Restriction?

Meta says the decision after a completed review is final, so a rejection usually ends that route for the portfolio. Before you accept it, check two things. Was the portfolio compromised, and did you tell Meta Support that clearly? And did you request a review of the right asset: the portfolio, rather than a single ad account or your own profile?

If both are covered, plan for the portfolio not coming back. Do not shuffle Pages and ad accounts around to get past the restriction, and keep your records of what happened and what you fixed.

## When Expert Recovery Help Makes Sense

Many owners clear a portfolio restriction alone with the steps above. A second opinion helps when ads carry your income, when a takeover and a policy restriction are tangled together, or when you want your limited review right. SocialSafe by AwareXone, AwareXone's recovery service, looks at the notice and what has already happened, then tells you honestly whether an official route is still open. We work only through Meta's own forms and reviews. Our [Business Manager recovery service](https://www.awarexone.com/business-manager-recovery) explains how that review works, and our [Trust Center](https://www.awarexone.com/trust) lists what we will never ask you for. If the problem is on another platform, the [recovery hub](https://www.awarexone.com/all-types-of-social-media-problem-solutions) is the place to start.

## Frequently Asked Questions

### How long does a business portfolio review take?

Meta says its review is typically completed in 48 hours, but it can take longer in some cases. Check Business Support Home and the admin's email rather than filing again.

### Can a non-admin request the review?

No. Meta says you must be an admin on the account to request a review. If your only admin has left the company, you need that person, or another existing admin, to act.

### Will my ads restart automatically once the restriction is lifted?

No. Meta says ads that were running before the restriction do not restart on their own. Turn them back on in Ads Manager after you confirm the status has changed.

### I turned on two-factor authentication but the portfolio is still restricted. Why?

Check that every person in the portfolio has set it up on their own Facebook profile, not only you. If the restriction stays, follow the steps in Account status overview.

### Can AwareXone get Meta to lift the restriction?

No. Only Meta can lift a restriction. AwareXone can review your case and help you prepare an accurate request through Meta's official review route, and will never ask for your password or login codes.

## Official sources

- [Meta Business Help Center: About advertising restrictions (read 29 September 2026)](https://www.facebook.com/business/help/975570072950669)
- [Meta Business Help Center: Request a review for a restricted advertising account (read 29 September 2026)](https://www.facebook.com/business/help/530209463124901)
- [Meta Business Help Center: Troubleshoot a disabled or restricted account (read 29 September 2026)](https://www.facebook.com/business/help/422289316306981)
- [Meta Business Help Center: About Meta Business Support Home (read 29 September 2026)](https://www.facebook.com/business/help/254088759757736)
- [Meta Business Help Center: Recover a hacked or compromised business portfolio (read 29 September 2026)](https://www.facebook.com/business/help/25302697499431030)
- [Meta Business Help Center: About two-factor authentication for your business portfolio (read 29 September 2026)](https://www.facebook.com/business/help/865384580786591)
- [Facebook Help Center: You got a suspicious email or message claiming it's from Facebook (read 29 September 2026)](https://www.facebook.com/help/225602007465207)
- [NFCC, Prime Minister's Department: About the National Scam Response Centre (read 29 September 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc)
- [CyberSecurity Malaysia: Cyber999 overview (read 29 September 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview)

---

AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.