The Financial Conduct Authority gives consumers one instruction that most people skip: “Always use the website address above to visit the Firm Checker. Never click on links in emails or on company websites.” It exists for a reason — convincing copies of regulators’ registers are a standard part of investment fraud.
The second thing worth knowing: regulators do not issue licence certificates for firms to forward to clients. A PDF with a stamp, a screenshot of a register, a “verification link” from a salesperson — none of it proves anything. The only proof is the public record you open yourself.
This guide covers three registers: the FCA in the United Kingdom, CySEC in Cyprus, and the EU-wide ESMA register. More to the point, it covers how to read what a record actually says. Most people stop at “the firm is listed”, and that is exactly where it goes wrong.
Start with the legal entity, not the brand
Before you search anything, you need the exact name of the legal person: the company name from your client agreement or from the website footer, including the legal form (Ltd, GmbH, a.s.), plus the registered address.
It sounds like a formality, and it is where verification most often fails. Large groups run a different entity in each jurisdiction, each with a different licence. Search for the brand and you either find nothing, or you find a company that is not the one holding your money.
United Kingdom: the FCA Firm Checker
Type the address into the browser yourself: www.fca.org.uk/consumers/fca-firm-checker/search. Here is the FCA Firm Checker, and the reasoning behind typing it manually is on the FCA’s own page about protecting yourself from scams.
- The form opens at “Step 1 of 3”. In “Firm name”, enter the exact legal name from the client agreement, not the marketing brand.
- Click “More search options”. That opens fields for “Website address”, “Email address”, “Firm’s head office postcode”, “Firm Reference Number (FRN)” and “Companies House Number” — the last field carries its own example, 01920623. Fill in the domain where your account sits and the FRN the firm quotes, then press “Search for firm”.
- Compare the result line by line. The FCA puts it plainly: “Check that the firm reference number (FRN) and contact details you’ve been given match the details on the Firm Checker.” A different phone number or email under an otherwise correct name and FRN is the classic clone.
- For the full record — scope of permissions, history, branches, appointed representatives — open the Financial Services Register and look the firm up by FRN.
The Firm Checker is only the consumer slice of the register. The FCA’s own summary of the tool lists what it leaves out and notes that entries can take up to 24 hours to update. If the firm is missing, or the contact details do not match, the FCA consumer helpline is 0800 111 6768.
Cyprus: the CIF list and the domain check
A large share of CFD brokers serving European clients are licensed in Cyprus, so this is the register many readers actually need. Open the CySEC list of Cypriot Investment Firms. The page carries the validity date in its heading — at the time of writing, “CIF REGULATED ENTITIES LIST AS OF 04 MAY 2026” — plus a button to download the whole list as an Excel file.
Find the firm through the alphabetical index above the table, searching the exact legal name including the form. Then read two columns: “Licence Number”, written as a sequence number and year, and “Licence Date”. Both have to match what the firm states in its website footer. The name alone is not enough.
Read the note attached to the row as well. Some entries carry “Voluntary Suspension” or “Under examination for voluntary renunciation of the authorisation”. A firm in that state does not have a fully functioning licence for taking on new clients, even though it still appears on the list.
Now the step almost nobody takes. Open the List of Approved Domains, which pairs “Regulated Entity” with “Domains” — 248 firms when we checked. The website where you hold your account has to be listed against that firm. If it is not, you are dealing with somebody else, however well the name and licence number match.
The counter-check is the List of Non Approved Domains, with columns “Non Approved Domains” and “Date Listed” — 708 entries as of 12 June 2026. CySEC describes them as domains that “are not owned or operated by Cyprus Investment Firms (CIFs) which have been authorized by CySEC to provide Investment Services”.
The EU-wide check: ESMA’s register of investment firms
ESMA’s register of MiFID investment firms collects data that national supervisors across the EU and EEA send in. One practical warning: it is a JavaScript application protected by a captcha, so a direct link will not hand you a result. You have to run the search in the interface — which also means any “register link” that jumps straight to a finished result is not this register.
In the keyword search box, enter the legal name and confirm. Underneath there is a “Select criteria to add” dropdown for extra filters such as country, LEI or authorisation date, a results-per-page switch and a CSV export.
Then check the two fields ESMA itself tells you to check: “entity type” has to read “Investment firm” and “Status” has to read “active”. Open the record and go through the list of services, each with its own status and date.
A forex or CFD broker needs “Reception and transmission of orders” and “Execution of orders”; a broker that takes the other side of your trade also needs “Dealing on own account”.
If you do not know the national register of the country where the firm is based, ESMA keeps a directory of supervisors’ registers across the EU and EEA on its page Is the firm regulated?. ESMA also suggests a blunt question for the seller: “Are you authorised to sell me this investment product?”
Four things that have to line up at once
Category. The licence has to cover the service you are being sold. In ESMA’s register that is entity type “Investment firm”, plus the specific services inside the record. A payment institution licence, an e-money licence or a registration as a tied agent or appointed representative is not an investment firm licence. On the FCA side, look for the status “Authorised” and the scope of permissions.
Status. Being listed means nothing on its own. Registers keep history, so firms whose authorisation ended stay visible. ESMA’s status field has to read active; CySEC writes the qualification as a note next to the row; the FCA shows whether the firm is permitted for the service it is offering you.
Date. Every register carries an authorisation date, and it has to precede the moment the firm started offering you the service. “We’re in the process of obtaining a licence” means the firm does not have one. Check the freshness of the list itself too: CySEC prints the validity date at the top, the FCA warns about a lag of up to 24 hours.
Domain and legal person. The name in the register belongs to a legal person, not to a brand. Compare the exact name from your agreement with the entry, and compare the website where you hold your account against the approved-domain list. A domain that is not recorded against that firm ends the check, regardless of how well everything else matches.
The European passport, and where it stops
Under MiFID II, a firm authorised by one national supervisor may serve clients across the whole EU and EEA without applying for a second licence — either cross-border or through a branch. That is why it is entirely legal for a broker serving Czech, Polish or German clients to be licensed in Cyprus or Ireland, and why so many CFD brokers are based there.
To verify the passport, use the “Home Member State” field (the country that issued the licence) and “Host Member State” (the countries it has been notified into), plus “Office Type”, which distinguishes a head office from a branch. You can also check from the other side: national registers usually keep a separate list of foreign firms notified for cross-border services.
Where the passport stops matters just as much. It does not reach outside the EU and EEA. The United Kingdom is no longer inside the single passport, so an FCA licence carries no automatic right to serve EU clients and vice versa. And it never covers a group’s offshore entity — Seychelles, Belize, Vanuatu, St Vincent, Mauritius sit outside the European system entirely.
Crypto services need their own licence
Since MiCA, authorisation as a crypto-asset service provider under Article 63 is a separate licence. It does not include the right to provide MiFID investment services, and an investment firm licence does not automatically cover crypto services either.
CySEC keeps that list apart from the CIF list, under the heading “Authorised (Article 63)” — fourteen firms when we checked. So a crypto exchange advertising that it is “regulated in the EU” while also offering CFDs or shares is claiming something its authorisation does not give it.
At EU level the picture is still provisional. ESMA publishes the interim MiCA register as CSV files — one of authorised providers, one of non-compliant ones — refreshed weekly. The authorised file records the competent authority that granted the licence, the entity name, the permitted website and the country codes the authorisation is passported into.
ESMA plans to move the data into its own systems, so start from its MiCA page rather than a saved file path.
The transition period argument no longer works either. Either the firm is in the European CASP register, or it may not provide the service in the EU.
Traps that catch people out
The cloned firm. A fraudster copies the name, address and licence number of a genuinely licensed broker and changes only the phone number, email and domain. Name and number check out, and you are still dealing with a fraudster. Search by domain and contact details, not by name, and only ever use the contacts from the register.
A domain outside the list. A Cypriot firm may only run websites recorded in the approved-domain list. If the site writing to you is not there, one look settles it — and a fair number of those addresses already sit on the non-approved list with the date they were added.
An offshore licence sold as a European one. The group markets its European entity, but the agreement you sign is with an offshore one. The website advertises supervision in the EU while the contract names Seychelles, Belize, Vanuatu or Mauritius.
What counts is the legal person in the agreement, not the logo in the footer. The European entity means a compensation scheme, client-money segregation and leverage limits; the offshore one means none of that.
A company registration passed off as a licence. “Registered in St Vincent and the Grenadines” is sold as regulation, but the local authority does not license forex and CFD activity at all — it is a company registration, nothing more.
Same trap with a FinCEN “registration” in the US, or a Companies House number in the UK. That number is a company identifier, which is exactly why the FCA keeps it as a separate field next to the FRN.
The certificate as a PDF. Regulators do not issue certificates for firms to send you as proof. The only document that counts is the register entry you open yourself.
Listed, but not active. The firm appears in the register with an authorisation that has been withdrawn or suspended. Registers do not delete history, so the broker can truthfully say “we are in the CySEC register” and it means nothing. Always read the status, not just the presence of the name.
The wrong licence category. A payment institution, an e-money institution or an appointed representative of somebody else’s licensed firm, presented as permission to offer securities and CFDs. For appointed representatives the FCA suggests the direct route: “You can ask the principal to confirm what activities the AR has permission for.”
Similar names and swapped group entities. Big brands run a different entity, with a different licence, in every jurisdiction. Enter the full legal name including the form, and confirm that the entity in your agreement is the one you found — not its namesake.
Warning lists, and what they cannot tell you
The FCA’s list of unauthorised firms is searchable at register.fca.org.uk. CySEC publishes its warnings to investors alongside the non-approved domain list.
One clarification that saves false confidence: ESMA does not run an EU-wide warning list of unauthorised investment firms. Those are issued by national supervisors, which is what the ESMA directory page is for. ESMA’s list of non-compliant providers covers crypto-asset services only.
And the rule works the other way round from what people expect. The FCA points out that a firm missing from the warning list may still be unauthorised or fraudulent, because unauthorised firms change names constantly. What decides is presence in the register of authorised firms, never absence from a blacklist.
The whole sequence takes about ten minutes. That is a fraction of the time it takes to chase money from a firm that never held a licence in the first place.