A licence number on a website proves nothing on its own. Six checks, all on regulators' own registers, separate a regulated firm from a clone of one.
Every regulated broker publishes a licence number. So do the fraudsters who copy them. The UK’s Financial Conduct Authority warns that clone firms “may use the name and address of a genuine firm, or they may copy the firm reference number (FRN),” and may “copy the website of an authorised firm, making small changes (for example, to the phone number).”
The defence is to verify everything at the source. These checks work for any firm, whether you are a trader opening an account or a business taking on a partner.
Brokers trade under one brand but contract through several companies, each licensed in a different country. The legal entity name and its licence number are usually in the website footer and in the client agreement. Write down the entity your contract is with: that is the only one whose licence matters to you.
ESMA makes the same point for crypto firms: protections “only apply to the specific authorised legal entity,” and providers “may operate under the same brand across multiple companies or countries.”
Go to the regulator’s site directly, never through a link the firm gives you:
| Regulator | Register | Search by |
|---|---|---|
| FCA (UK) | Financial Services Register | Firm name or FRN |
| CySEC (Cyprus) | Regulated entities: investment firms | Firm name or licence number |
| ASIC (Australia) | Professional Registers Search | Name, licence number, ACN or ABN |
| ESMA (EU, crypto) | Interim MiCA register | Authorised CASPs list |
This is the step that catches clones. The FCA’s instruction is to “check the firm’s contact details listed on the Firm Checker and make sure they match the contact details you’ve been given.” CySEC’s register lists each firm’s approved website domains.
For example, CySEC’s register entry for Pepperstone EU Limited shows licence 388/20, an authorisation date of 3 August 2020, and pepperstone.com as the approved website. A site using a different domain while quoting that licence is not that firm.
A licence is not a blanket approval. The FCA advises checking “that the firm is authorised and has permission for the product or service you selected.” A firm licensed to advise is not necessarily permitted to deal on its own account or to hold client money.
Regulators publish warnings about unauthorised firms and known clones. Search the firm’s name and website on the FCA Warning List and on CySEC’s warnings pages before relying on anything else.
Licences are suspended and withdrawn. Check the status on the register on the day you rely on it, not from a screenshot or a review written months ago.
A February 2026 statement tells firms that the commercial name of a leveraged derivative is irrelevant. What matters is whether it meets the definition of a CFD, and most perpetuals likely do.
The UK's FSCS and Cyprus's ICF protect clients when a firm fails. Neither covers trading losses, and the limits differ by a factor of four.
The grandfathering window for crypto-asset service providers has closed across the EU. Unauthorised firms must wind down, and the protections clients get now depend on exactly which legal entity they deal with.
