How do you check whether a financial or crypto firm is regulated?
A licence number in a website footer proves nothing until you check it yourself. Official registers are free, public and take a few minutes. Here is which one to use and what to look for.
Education only, not investment, tax or legal advice. Crypto-assets are high-risk — risk disclosure.
The short answer
Find the regulator for the country and product, search its official register yourself (FCA register, FINRA BrokerCheck, SEC's Investor.gov search, NFA BASIC or ESMA's MiCA register), confirm the firm's status and permissions match what it offers, and contact it only through the details the register shows.
Key takeaways
- Check on the regulator's own register, never through a link or number the firm gives you.
- Look beyond the name: check the status, the exact permissions and the firm's contact details.
- In the UK, only authorised firms come with Financial Ombudsman and FSCS protection; registered crypto firms do not get these by default.
- Since 1 July 2026, crypto service providers in the EU need MiCA authorisation, which you can check on ESMA's register.
- Clone firms copy real firms' names and reference numbers, so always contact a firm using the details on the register.
Why does it matter whether a firm is regulated?
Regulation decides what happens when something goes wrong. In the UK, the Financial Conduct Authority (FCA) says that if you use a firm that is not authorised, you cannot complain to the Financial Ombudsman Service or claim compensation from the Financial Services Compensation Scheme (FSCS) if it fails1.
It is also the simplest fraud filter there is. The US Securities and Exchange Commission (SEC) says unlicensed, unregistered people commit much of the investment fraud in the US3, and the Commodity Futures Trading Commission (CFTC) says most scams involve unregistered entities, people and products5. A few minutes on a register will not prove a firm is good, but it can quickly show that a firm is not what it claims to be.
Risk warning
Regulated does not mean risk-free
A regulated firm can still sell you a product that falls in value, and many crypto activities are only partly covered by financial rules. Registration checks who you are dealing with; it does not protect you from market losses. Never invest money you cannot afford to lose.
Which official register should you use?
Each regulator keeps its own public database. Use the one that matches where the firm says it is regulated and what it is offering you.
Where to check, by country and type of firm (as of October 2026)
| If the firm is… | Check here | What you can see |
|---|---|---|
| Any UK financial firm, including crypto | FCA Firm Checker or Financial Services Register1 | Authorised or registered status, permissions, contact details |
| A US broker or brokerage firm | FINRA BrokerCheck4 | Licences, employment history, disciplinary events, customer disputes |
| A US investment adviser | Investor.gov search (SEC)3 | Registration with the SEC, states or FINRA, disciplinary history |
| A US futures, options or forex firm | NFA BASIC5 | Registration status and regulatory or disciplinary history |
| An EU crypto-asset service provider | ESMA interim MiCA register6 | Authorised providers and a list of non-compliant entities |
| A US company selling securities | SEC EDGAR8 | Registration statements, prospectuses and annual reports |
How do you check a firm, step by step?
How to check whether a firm is regulated
- 1
Write down exactly who you are dealing with
Note the firm's full legal name, any reference number it quotes, its website address and the phone number or email that contacted you.
- 2
Open the regulator's register yourself
Type the regulator's address into your browser or search for it. Do not follow a link the firm sent you, because clone firms copy real websites2.
- 3
Search by name and reference number
Look for an exact match. Check the status: in the UK, avoid firms shown as no longer authorised or revoked1.
- 4
Check the permissions, not just the listing
Make sure the firm is allowed to do what it is offering you. The FCA advises avoiding firms that are not authorised or lack permission for the service you want1.
- 5
Compare the contact details
The website, phone number and address should match the register. If they do not, contact the firm only through the register's details2.
- 6
Figure · Three questions every check must answer
- 01Is it listed?exact name and number
- 02Is it allowed?status and permissions
- 03Is it really them?contact details match
What does "registered" mean for a crypto firm?
Crypto is where the wording matters most. In the UK, crypto exchanges and custodian wallet providers must register with the FCA under the anti-money-laundering rules, but the FCA says registration is not an endorsement and does not automatically give customers access to the Ombudsman or FSCS9. The FCA's consumer guidance adds that registered firms cannot offer regulated products1. A full UK authorisation regime for crypto starts in October 2027; see our UK crypto regulation explainer.
In the European Union, the Markets in Crypto-Assets Regulation (MiCA) has applied in full since 30 December 2024, and its transitional period ended on 1 July 20266. ESMA, the EU securities authority, has told unauthorised providers to stop taking on new EU clients and warned that their customers do not benefit from MiCA safeguards, including protection of client assets7. It advises users to check whether their provider is authorised on the ESMA register7. More background is in our MiCA explainer.
In the US, crypto platforms may fall under several regulators or none, depending on what they do. In a 2023 investor alert, the SEC warned that crypto platforms may lack important protections and that, at that time, none of the major crypto entities was registered with it as a broker-dealer, exchange or investment adviser10. Our SEC vs CFTC explainer covers who oversees what.
Tip
White papers are not approvals
ESMA's register lists crypto-asset white papers, but it states that these documents have not been reviewed or approved by any authority6. Seeing a token's white paper on the register is not a sign of official endorsement.
How can you spot a clone firm?
A clone firm is a scam that pretends to be a real, authorised firm. The FCA says criminals copy a genuine firm's name, address, firm reference number and website, often changing the contact details slightly2. A register search on the name alone will look reassuring, which is exactly the trap.
- Contact the firm only with the phone number, email and website listed on the register2.
- Be wary of free email services such as Gmail or Outlook used for business contact, and of website addresses that differ slightly from the real one2.
- Be suspicious if you were contacted out of the blue, or told that the regulator's records are out of date2.
- In the UK you can call the FCA's consumer helpline on 0800 111 6768 to check or report a suspected clone2.
What mistakes do people make when checking a firm?
Common beginner mistakes
Trusting a number in the footer
Anyone can paste a real firm's reference number onto a website. The number only helps if the register's contact details match the people you are dealing with.
Stopping at "it's on the register"
Being listed is not enough. The status may be revoked, or the firm may lack permission for the service it is selling you.
Confusing registered with authorised
For UK crypto firms, registration covers anti-money-laundering checks only and does not bring Ombudsman or FSCS protection with it.
Checking the wrong country
A licence in one country does not necessarily cover services where you live. Check the register of your own country's regulator too.
Frequently asked questions
Is a firm safe if it is regulated?
Regulation means the firm is supervised and, for authorised UK firms, that complaint and compensation schemes may apply1. It does not protect you from investment losses or guarantee the product is suitable for you.
What is BrokerCheck?
BrokerCheck is a free FINRA tool that shows the professional background of US brokers, brokerage firms and investment adviser firms, including licences, employment history and disciplinary events4.
How do I check a crypto exchange in the EU?
Search ESMA's interim MiCA register, which lists authorised crypto-asset service providers and a separate list of non-compliant entities6.
What should I do if a firm is not on the register?
Can I check a company's financial reports for free?
Yes. In the US, the SEC's EDGAR database gives free access to company filings such as annual and quarterly reports and offering documents8.
The bottom line
Checking a firm takes minutes: find the right regulator, search its register yourself, confirm the status and permissions match what you are being offered, and use only the contact details the register shows. For crypto, read the exact status closely, because registered, authorised and unregulated mean very different levels of protection.
Sources
- How to check a firm or individual is authorised (page updated 22 September 2026) — Financial Conduct Authority, 2026 Primary source
- Clone firms and individuals — Financial Conduct Authority, 2025 Primary source
- Check Out Your Investment Professional — Investor.gov, U.S. Securities and Exchange Commission Primary source
- About BrokerCheck — FINRA Primary source
- Be Smart: Check Registration & Backgrounds Before You Trade — U.S. Commodity Futures Trading Commission Primary source
- Markets in Crypto-Assets Regulation (MiCA) — European Securities and Markets Authority, 2026 Primary source
- Public Statement on the end of the MiCA transitional period (ESMA75-113276571-1710) — European Securities and Markets Authority, 2026 Primary source
- Using EDGAR to Research Investments — Investor.gov, U.S. Securities and Exchange Commission Primary source
- Cryptoassets: AML / CTF regime — Financial Conduct Authority, 2026 Primary source
- Exercise Caution with Crypto Asset Securities: Investor Alert — Investor.gov, U.S. Securities and Exchange Commission, 2023 Primary source
How we checked this page: every figure above links to the numbered source it came from. Spotted an error? Tell the desk — see our editorial policy.
Read next
Policy · ExplainerHow is crypto regulated in the UK, and what changes in 2027?Today the UK regulates crypto mainly through anti-money-laundering registration and strict advertising rules. A full licensing regime has been written into law and starts in October 2027. Status as of October 2026.
Policy · ExplainerWhat is MiCA, and how does the EU regulate crypto-assets?Since the end of 2024 one law has set the ground rules for crypto issuers and service providers across the European Union. Here is what it covers and what changed when its transition ran out in July 2026.
Policy · ExplainerSEC vs CFTC: which US regulator is in charge of crypto?For years the answer to "who regulates crypto in America?" was "it depends". In 2026 the two main market regulators published a shared map, but Congress has not yet written the split into law.
Policy · ProfileWhat is the FCA, and how does it regulate crypto in the UK?The FCA polices how around 35,500 UK firms treat their customers. Here is where its powers come from, what it does with crypto as of October 2026, and how to use its register and scam tools.
Finance · ExplainerWho really holds your crypto? Custody, keys and wallets explainedWith crypto, whoever controls the private key controls the asset. Custody is the question of who holds that key, and the answer decides what you can lose, and to whom.
Fintech · ExplainerWhat are KYC and AML, and why does every financial app want your ID?Uploading a passport photo to open an account can feel intrusive. It is the visible end of a global rulebook designed to stop criminals from moving money through the financial system.