How to verify a broker licence and detect clone firms

A broker website that displays a regulator logo, a licence number or a company-registration number is making a claim about itself. Verification is the process of testing that claim against a register owned by the relevant regulator. The goal is to connect four things: the exact legal entity you would contract with, its entry on an official register, the specific permissions that entity holds, and the contact details or domain through which it actually communicates. If any of these do not line up, the claim remains unverified.

Authorisation does not make trading safe. Regulators state this directly in different ways: the FCA notes that using an authorised firm with the correct permission reduces but does not remove risk, and ASIC states that an Australian financial services licence is a point-in-time assessment that does not guarantee the probity or quality of a licensee's services. Verification narrows uncertainty about who you are dealing with. It does not assess investment merit or eliminate loss. [1] [4]

Start With Your Own Facts Before Opening Any Register

1. Record your country of residence, because it helps identify the regulator and register relevant to the service offered to you.
2. Record the product or service you intend to use, such as retail forex, contracts for difference, share dealing or commodity futures, because permissions are granted at product and activity level, not for a brand as a whole.
3. Record the exact website address and app you are using, including spelling and top-level domain, because imposter sites differ from genuine ones by small changes in these details. [2]
4. Collect every legal-entity name that appears in the account-opening pages, client agreement, account statements and deposit instructions. These documents show which entity claims to contract with you and which beneficiary would receive a proposed payment.

A brand may use different legal entities for different regions, products or corporate arrangements. Treat the entity named in your own contracting documents as the primary subject of verification rather than assuming that a brand name identifies one firm.

Brand Names, Trading Names, Companies and Regulated Entities Are Different Fields

Keep the labels used in each record separate. A brand or trading name shown in marketing may differ from the incorporated legal name. A corporate register and a financial-services register answer different questions. Record the company name and corporate identifier separately from the entity, status and permissions shown by the financial regulator.

A company-registration number displayed on a website is not automatically a financial-services authorisation. Even a matching corporate-registry entry establishes a different fact from a regulatory permission. Terminology also differs between jurisdictions, so record the exact words used by the relevant register rather than treating licensed, authorised and registered as interchangeable.

Reach the Register From the Regulator's Own Domain

Start from the regulator's own website, typed into your browser or reached through a previously verified bookmark. Do not rely on a register link supplied in an advert, direct message, email or broker chat window. The FCA warns that fraudsters can copy the name, address and firm reference number of a genuinely authorised firm while substituting their own phone number, email, website or other contact route. [2]

What to Inspect in the Full Register Record

• The exact legal name as recorded, not a shortened or stylised version.
• The official register identifier, such as a firm reference number, licence number or registration number, together with any corporate identifiers shown.
• The register type and current status, plus historical entries where shown, recorded verbatim with the date you checked.
• The permissions, services or regulated activities listed, and any conditions or restrictions attached to them where the register displays these. [3]
• Any principal or appointed-representative relationship shown, including which principal controls the representative's permitted activities. [1]
• The regulator-published address and any contact details or domains the regulator itself publishes, which you will later compare against what the broker shows you. [2] [8]

Why a Register Hit Is Not Enough

Finding a name in a register is only one check. The entity may appear with a status such as no longer authorised or former. It may lack permission for the service offered to you. The registered entity may differ from the company named in your client agreement. A clone can also reproduce a real firm's name, address and reference number while changing the contact route. [1] [2]

Verification therefore compares several fields rather than stopping at one. A correct reference number can appear in both a genuine firm's materials and a clone's copied materials. Status, permission, domain, contracting entity and proposed payment beneficiary must each be checked on their own evidence. [2]

United Kingdom: FCA Firm Checker and the Financial Services Register

In the UK almost all firms providing financial services must be authorised or registered by the FCA. Authorisation means meeting the FCA's standards and holding permission for certain products and services. Registration is a distinct status, so record which of the two applies. The FCA advises consumers to use its Firm Checker before buying, and points to the Financial Services Register as the official full and historical record. [1]

When checking a UK-facing broker, confirm the current status, the exact permissions held, the legal and trading names, and the contact information in the register. Note that an authorised firm can offer both regulated and unregulated services, so a valid authorisation does not mean everything the brand sells falls within the FCA's perimeter. If the entity is an appointed representative, it acts for a principal that controls its permitted activities; identify the principal and confirm the scope of activities with that principal if anything is unclear. [1]

Australia: ASIC Professional Registers and AFS Licensing

ASIC's Professional Registers Search covers Australian financial services licensees and authorised representatives. You can search by name, licence number, ACN or ABN. Records expose the relevant register type, status, services, conditions and address information, and ASIC states the data is updated daily. One person or organisation can appear against more than one licence or registration, so open each relevant entry rather than stopping at the first hit. [3]

Understand the two relationship types. An Australian financial services licensee holds the licence itself. An authorised representative provides covered services under a licensee's arrangements rather than holding its own licence. Depending on the facts, a business can sit in either position, so identify which structure applies to the entity in your documents. [4]

ASIC cautions that an AFS licence is a point-in-time assessment and does not guarantee the probity or quality of a licensee's services. Treat the register record as dated evidence of licence status, not as an endorsement. In 2026 ASIC announced that it was publishing principal and other website addresses for AFS and credit licensees in Professional Registers to help users distinguish genuine sites from imposter sites. Compare the exact domain where a register publishes one. [4] [8]

Cyprus: Using CySEC's Entity Lists as Separate Evidence

CySEC publishes a current list of Cypriot Investment Firms with individual entity pages. Entries may include the legal name, licence number, licence date, company registration number, phone number, email address and approved trade names, and some entries expose a qualification in the status text. Use the individual entity page, not the landing list alone, as your primary evidence. [5]

The site separately links former investment firms, a list of approved domains and a tied-agents public register. Treat these as separate evidence sources: inspect the relevant current or former entity record, compare the domain with the approved-domain list, and inspect any claimed tied-agent relationship in its own register. Do not infer permissions, passporting rights, compensation coverage or current status from the landing page alone. [5]

United States: Two Product Lanes, Two Registers

US checks split by product. For commodity futures, commodity options, retail off-exchange forex and certain derivatives activities, the CFTC advises checking whether a firm or person is required to register and using NFA BASIC to review registration and background information. The CFTC also notes that registration or a clean background record does not prevent fraud. Keep this lane limited to those products; it does not extend to securities brokerage. [6]

For FINRA-registered securities firms and professionals, BrokerCheck provides registration, employment, qualification and disclosure information about current and former registrants. Read each disclosure and its disposition in context rather than converting an allegation, pending matter, customer dispute or resolved event into a different claim. BrokerCheck does not cover every US product or business model. [7]

Clone-Firm Checks: Compare Every Contact Field

Clone firms can copy genuine details while changing the contact route. Compare the exact website domain, including spelling and top-level domain, plus the phone number, email domain and address against regulator-published details. Separately compare the beneficiary in proposed payment instructions with the verified legal entity. ASIC's 2026 publication of licensee website addresses is an Australian example of why domain-level comparison matters. [2] [8]

Treat any difference as an unresolved conflict to investigate independently, not automatically as proof of fraud. Legitimate reasons for small differences exist, such as rebranding or regional offices, but the burden sits with verification, not assumption. Resolve conflicts using contact details found on the regulator's own site, never using details the broker supplies to you. [2]

Warning Lists Are Supplementary Evidence Only

A regulator warning-list search is useful supplementary evidence, but absence from a list is not approval. The FCA says a firm may still be unauthorised or a scam even when it is not on its Warning List. A published warning is material evidence; no search result establishes only that you did not find a warning at the time checked. Do not use a clean warning-list search as the conclusion of a verification. [9]

Reading Status and History Fields Without Overstating Them

Copy the register's exact wording for status and history, with the date you checked. FCA records distinguish wording such as authorised, registered, no longer authorised and revoked; CySEC separates current and former firms and may add qualifications to individual entries. Do not paraphrase those labels into friendlier or harsher language. For BrokerCheck disclosures, preserve the event type and disposition shown instead of rewriting it as a settled finding. [1] [5] [7]

Permissions Are Granted at Product and Activity Level

Your conclusion should state only what the record supports. If the relevant register shows permission for one category of activity, do not extend that observation to a wider range of services. In the UK, the FCA says an authorised firm can offer regulated and unregulated services alongside each other. Write down the entity, jurisdiction and permission that correspond to the product you intend to use. [1]

Appointed Representatives, Tied Agents and Authorised Representatives

Registers use jurisdiction-specific relationship labels. The FCA describes appointed representatives acting for a principal that controls their permitted activities. ASIC's Professional Registers cover authorised representatives of AFS licensees. CySEC publishes a tied-agents register. These labels are not interchangeable legal conclusions. Record the relationship and principal exactly as the relevant register presents them, then check the activity shown for that relationship. [1] [3] [5]

The Seven-Field Match Framework

TraderJury uses a seven-field matching framework to organise verification evidence. Each field receives one of three values: matched, meaning the field currently reconciles with the official record; unresolved, meaning you could not yet confirm it; or conflict, meaning the field contradicts the official record. The framework is a TraderJury editorial workflow for organising evidence. It is not a regulator score, a compliance certification or a measure of trading safety.

Regulator-Register Routing Map

Broker-Licence Evidence Log

Keep a log while you check. The table below shows the format with hypothetical placeholder values only. Replace every cell with your own findings, cite the exact register URL you used, and timestamp each row. Never fill the log from memory or from broker-supplied screenshots alone.

A Reproducible Verification Workflow

1. Capture the claim. Save the broker's stated entity name, licence or registration numbers, addresses and contact details exactly as displayed, with screenshots.
2. Identify jurisdiction, entity and product. Determine your country of residence, the entity in your contracting documents and the specific service you intend to use.
3. Reach the official register by typing the regulator's domain yourself or using a saved bookmark, never a link from the broker. [2]
4. Open the exact entity record, not a search-result summary, and confirm the legal name and identifier correspond to your documents.
5. Check status and history, copying the register's exact wording and noting the date. [7]
6. Check the permission for your specific product or activity, including any conditions or restrictions shown. [3]
7. Match the contact and domain details against regulator-published information, comparing spelling and top-level domain character by character. [2] [8]
8. Reconcile the client agreement and the proposed payment beneficiary with the verified legal entity.
9. Save timestamped evidence: screenshots of the register entry, the approved-domain listing and your completed evidence log.
10. Resolve any conflict through the regulator or the principal, using contact details found independently on the regulator's own site. [1] [2]
11. Repeat the full check before any material change, such as a new account, a new entity name in documents, a changed payment route or a request to move funds.

Resolve a Mismatch Without Trusting the Disputed Contact Route

First classify the mismatch precisely. A formatting difference in a company suffix is not the same as a different legal entity. A redirect from an approved domain is not the same as an unrelated top-level domain. A bank beneficiary that abbreviates a verified legal name is not the same as a different company. Record the literal values, the source of each value and why they do or do not reconcile. Do not edit the evidence into a match.

Use an independent route to ask about an unresolved field. For an FCA appointed representative, the FCA says the principal can confirm what activities the representative may perform. For a suspected clone, use contact details reached from the regulator or its register rather than a number or email supplied in the disputed conversation. Ask a narrow question that can be recorded, such as whether a specific domain or legal entity belongs to the registered firm. [1] [2]

Keep the answer with the evidence log, including the date, channel and exact question. A verbal assurance without an independently sourced contact route does not resolve the identity problem. If the official record does not publish a field, mark it unresolved rather than guessing. If the answer conflicts with the proposed entity or payment route, preserve both records and stop the funding process while you seek appropriate independent help.

A Register Check Is a Dated Observation, Not a Permanent Certificate

Registers and business details change. ASIC says it processes changes to its Professional Registers once a day and shows an update timestamp. A saved result therefore describes what the official record showed when you checked it. Date every conclusion and repeat the relevant fields when a new account, entity, agreement, domain or payment instruction appears. Rechecking does not imply a fixed schedule; it keeps the evidence aligned with the transaction you are considering. [3]

Decision Rule for Matched, Unresolved and Conflict Results

Apply one rule per outcome. Matched means the seven fields currently reconcile with the official record; it does not mean trading is safe or that losses are unlikely. Unresolved means you could not confirm one or more fields; pause and gather more evidence before proceeding. Conflict means a field contradicts the official record; do not send money until the conflict is resolved through independent channels. This guide describes a verification process and does not constitute legal advice.

Finishing With a Dated, Reproducible Evidence Record

The output of this process is a dated evidence record another person can reproduce: the register URLs visited, the exact status and permission wording observed, the domain and contact comparisons made, the completed seven-field assessment and the timestamps for each check. It is not a rating, ranking, endorsement or recommendation of any broker. Anyone applying the same steps on the same date against the same registers should reach the same observations, which is what makes the record verifiable rather than opinion.