How to check a financial licence on a regulator's register

To check a financial licence, identify the firm's exact legal entity, search for it on the regulator's own public register, and confirm that its status is current and its permissions cover the service you are being offered. Then check the regulator's warning list and compare the phone numbers, emails and websites on the register with the ones you were given, because clone firms copy the names and reference numbers of real, authorised companies.

The same method works for a payment service provider (PSP), an electronic money institution (EMI), an investment firm or CFD broker, and a crypto-asset service provider. This guide sets out the steps, then covers the specific registers we checked on 3 November 2026.

The method in seven steps

Why the legal entity matters

Payment and broker groups often trade under one brand but operate through several legal entities, each licensed in a different country. The brand name on an app may not be the name on the register. The entity you contract with, named in the terms and conditions, is the one to check. Our company profiles list each group's licensed entities, with the regulator and reference number taken from the register. For why the contracting entity matters in payments, see payment gateway vs PSP vs acquirer.

Registered is not the same as authorised

Some firms are only registered, with lighter requirements, rather than fully authorised. In the UK, a firm that only provides account information can register as a registered account information service provider (RAISP), while a firm that initiates payments must be authorised and hold at least EUR 50,000 in initial capital (FCA, page last updated 17 September 2024). The FCA's December 2018 approach document also describes small payment institutions, which register rather than seek authorisation, cannot provide account information or payment initiation, and are limited to average monthly payment transactions of no more than EUR 3 million. A status that is real but narrower than the service on offer is a warning sign.

United Kingdom: FCA Financial Services Register

The FCA's Financial Services Register is the public record of firms, individuals and other bodies that are, or have been, authorised by the FCA or the Prudential Regulation Authority. It also records firms the FCA has been told are operating without authorisation, and whether an unauthorised firm is falsely claiming to be an authorised one. The register is at register.fca.org.uk; the FCA also offers a simpler Firm Checker tool.

What the FCA says to check (guidance last updated 22 September 2026):

• Status and permissions. The firm must be authorised or registered and have permission for the product or service you want. The FCA's consumer page on payment services warns that without the right permission you may not have access to the Financial Ombudsman Service or the FSCS if something goes wrong.
• History. The register shows historic fines, whether a firm can approve financial promotions, and whether it can hold client money. You can also see whether a firm was authorised at the time you bought a product.
• Status labels. "No longer authorised" means the firm cancelled its own authorisation. "Revoked" means the FCA cancelled it after enforcement action. The FCA advises avoiding both, and the reason appears under "Disciplinary and regulatory action".
• Contact details. Firms supply their own registered and trading names, main address and complaints contacts. Compare these with what you were given.
• Appointed representatives and agents. These act under a principal firm. Check the principal on the register and ask it which activities the representative may carry out. An appointed representative acting outside its permitted activities may not be covered by the Ombudsman or the FSCS.
• Individuals. Not every employee needs approval, so some staff will not appear. The FCA notes that its own employees are not listed.

FCA Warning List and clone firms

Published FCA warnings show up on the Firm Checker and the register when you search for the firm, and the FCA keeps a separate Warning List of unauthorised firms. A clone firm uses a genuine firm's name, reference number or address but gives you different contact details. The FCA's advice is to check that the details you were given match those on the Firm Checker, and to contact the firm only through the details shown there. Suspected scams can be reported to the FCA.

For UK rules on promoting crypto to UK consumers, see our explainer on FCA crypto promotions.

European Union: ESMA registers

ESMA is not a licensing authority for most firms; national regulators are. But it publishes EU-wide registers built from national data, which help when a firm claims an authorisation in another member state.

Interim MiCA register (crypto-asset service providers)

Under the Markets in Crypto-Assets Regulation, crypto-asset service providers (CASPs) need authorisation from a national competent authority. ESMA publishes an interim MiCA register, set up to meet the 30 December 2024 deadline in Articles 109 and 110 of MiCA. It consists of five CSV files:

Source: ESMA MiCA page, last updated 30 October 2026.

ESMA updates the files weekly and warns that entries reported by national authorities may appear with a delay, so the national register remains the first place to look. Withdrawn authorisations stay in the file with the date the withdrawal took effect. ESMA also notes that the white papers listed have not been approved by any national authority.

Timing matters. MiCA applied in full from 30 December 2024. Under the transitional rule in Article 143(3), firms already providing crypto services under national law could continue until 1 July 2026 at the latest, or until their MiCA application was granted or refused. As of 3 November 2026 that window has closed, so a firm offering crypto services in the EU should appear as an authorised CASP. For the wider rules, see our MiCA explainer.

Investment firms register (MiFID)

ESMA's registers page links to a register of investment firms authorised by national authorities, with the services each is authorised to provide, and to a separate register of sanctions published by member states under MiFID, MAR and other laws. This is useful for brokers and CFD providers that claim an EU licence.

Ireland: Central Bank of Ireland registers

The Central Bank of Ireland keeps individual registers for the financial service providers and investment funds it regulates, plus lists of some providers it must disclose but does not regulate. You can search for a single firm or download full lists. The Central Bank says that if you cannot find a provider, or are unsure of its status, you should contact it directly. It also links to a warning list of unauthorised firms.

Other regulators

The seven-step method applies in the same way to other registers, including those of CySEC in Cyprus (see our CySEC explainer), the MFSA in Malta, BaFin in Germany, VARA in Dubai, the FSC in Mauritius and the FSA in Seychelles. In every case, reach the register from the regulator's own website, check the legal entity rather than the brand, and read the regulator's warnings or unauthorised entities notices.

Passporting and cross-border claims

Under the EU payments framework, authorised payment institutions and e-money institutions can passport their services from their home state into other EEA states, as the FCA's December 2018 approach document describes; small institutions cannot. The home regulator's register is the main record of the licence itself. When a firm claims a licence from one country but markets to you in another, check the home register first, then the regulator of the country where you live.

Red flags

• The firm sends you a link to "its" register entry instead of letting you search.
• The legal name on the website does not match any register entry.
• The register entry exists but the website, phone or email differs.
• The status is "registered" or "small" but the firm offers services that need full authorisation.
• The firm's entry shows a cancelled, revoked or suspended status.
• The regulator's warning list names the firm, its website or a similar brand.
• A crypto firm serving EU customers does not appear as an authorised CASP after 1 July 2026.

For how licensing works for payment firms, see open banking payments explained, and for more regulator coverage visit the regulation hub.

Key terms

• Authorised firm: a firm granted full permission by a regulator to carry out regulated activities.
• Registered firm: a firm entered on a register under a lighter regime (for example, a RAISP in the UK).
• CASP: crypto-asset service provider authorised under MiCA.
• Clone firm: a fraudster using the name, reference number or address of a genuine authorised firm.
• Passporting: the right of a firm authorised in one EEA state to provide services in another.
• Permissions: the specific activities a firm is allowed to carry out.
• Warning list: a regulator's published list of firms it believes are operating without authorisation.