You do not need us. Every check below uses a free public source, takes minutes, and can be done before you give anyone your phone number. These are the same checks behind the verdict at the top of each of our reviews.
Last reviewed: 9 September 2026.
Before you start: get the exact name and address
Write down two things: the exact brand name as spelled on the site, and the domain name in the address bar. Both matter. Regulators publish warnings against a website address as often as against a company name, and brands in this category frequently operate several near identical names at once. A search for the brand alone can miss a warning filed against the domain.
1. Search the regulator’s register for the company
If the platform claims a licence, it names a regulator and usually a licence number. Ignore both as printed and go to the regulator’s own register.
- FCA Financial Services Register - United Kingdom
- CySEC register of Cypriot investment firms - Cyprus, where a large share of these licences are claimed
- ESMA Registers - EU-wide, covers firms authorised in member states
- BaFin company database - Germany
- CNMV entity search - Spain
- ASIC registers - Australia
- FINRA BrokerCheck - United States
Three failure modes to watch for, in order of how often we see them:
- No entry at all. The licence number returns nothing. The claim is simply false.
- An entry for a different company. The number belongs to a real firm with a similar name that has no connection to the platform. This is the most common trick, because a casual check finds a real register page and stops there.
- A real entry that does not cover the activity. The firm exists and is authorised, but for something narrower than what is being offered to you. The register page states the permitted activities: read them.
2. Search the same regulator’s warning list
Registers list who is authorised. Warning lists name firms regulators believe are operating without authorisation or soliciting improperly. They are separate searches.
- FCA ScamSmart - the UK entry point for checking an unauthorised firm
- CySEC announcements - where Cypriot warnings are published
- ASIC Moneysmart investor alert list - Australia
Search the domain as well as the brand name. Warnings are often filed against the address.
3. Search IOSCO I-SCAN for every jurisdiction at once
IOSCO I-SCAN collects investor alerts from securities regulators worldwide into one search box. It is the fastest single check available to a member of the public, and it catches warnings from countries you would never think to visit individually.
Two things to know about how it behaves. Search for the distinctive part of the name rather than the full brand: these platforms recombine a small vocabulary of words, and searching a fragment surfaces the whole family. And read the results carefully, because a search will also return unrelated firms that happen to share a word. A warning only counts against the platform in front of you if the entry names that platform or its website address.
4. Check how old the domain is
Public WHOIS and RDAP records show when a domain name was first registered. Free lookup tools will tell you in seconds.
This check exists because of one specific pattern: a platform presented as established, with testimonials and a history, running on a domain registered weeks ago. That is not proof of anything on its own. Combined with an unverifiable licence claim it is a strong signal, and it is the check that most often exposes a rebrand.
5. Read the corporate details in the footer and terms
Legitimate financial firms state who they are: a registered company name, a company number, and a registered address. Look in the footer, the terms of use and the privacy policy, and compare them against each other.
What we see repeatedly on platforms that later attract warnings: no company name anywhere; a company registered in a jurisdiction unrelated to the regulator named on the homepage; a different company named in the terms than in the footer; an address that resolves to a virtual office or a residential building. Any single one of these is a reason to slow down.
6. Look at where the money actually goes
Before depositing, look at what the platform asks for and who receives it. A regulated firm receives client money in the name of the licensed entity. If the deposit page routes funds to a differently named company, to a personal account, or to a crypto wallet address with no counterparty named at all, then the licensed entity, if it exists, is not the one holding your money. Regulators cannot help you recover funds sent to an entity they do not oversee.
What none of these checks can tell you
Passing all six does not make a platform good. It means it is not obviously fraudulent by the checks a member of the public can run for free. Nobody outside a regulator can confirm from the outside whether client funds are segregated, whether quoted prices are real, or whether withdrawals are honoured in practice.
That limit applies to us too. We publish what the registers say on the day we checked, we date every verdict, and where we could not verify something we say so instead of guessing. Our own funding is set out on how we make money, and the patterns worth reacting to are listed under trading platform red flags.
Frequently Asked Questions
How long does it take to check whether a trading platform is regulated?
About fifteen minutes for all six checks. The single most important one, searching the regulator’s own register and warning list for the platform name and its website address, takes under five minutes and is free.
A platform says it is regulated. How do I confirm it?
Do not accept a licence number printed on the platform’s own website. Open the regulator’s public register yourself and search for the company name. If the entry does not exist, or exists under a different company doing something unrelated, the claim is false. Also check that the register entry actually covers the activity being offered.
The platform is not on any warning list. Does that mean it is safe?
No. Warning lists are reactive: a platform is added after complaints reach the regulator, which can take months. The absence of a warning means nobody has reported it yet, not that it has been examined and cleared.
What is IOSCO I-SCAN?
A single searchable database that collects investor alerts published by securities regulators around the world. It is the fastest way to check many jurisdictions at once instead of visiting each regulator’s site separately.
Why does the age of a domain name matter?
Platforms in this category are frequently rebranded: the same offer reappears under a new name once the previous one attracts warnings. A domain registered a few weeks ago behind a brand presented as long established is a direct contradiction you can check in seconds.