How to check a broker licence, step by step

To check a broker's licence, find the exact legal entity name and licence number in its website footer or client agreement, then search for them on the regulator's own register, reached by typing the regulator's address yourself. Confirm that the firm is authorised for the service you want, that the website and contact details on the register match the ones you are using, and that the entity you will sign up with is the one that holds the licence. Then check the regulator's warning list.

This is the single most useful five minutes you can spend before depositing money anywhere. Our own reviews do exactly this for every broker (see How we rank), and the links to every major register are on our regulator registers page. This guide explains each step in more detail, with examples of what goes wrong.

Why the broker's website is not proof

Anyone can put a regulator's logo and a licence number on a website. Fraudsters do it routinely, and some copy the details of a real, licensed firm precisely so that a quick search appears to confirm them. The only reliable source is the regulator's own public register, which is maintained by the regulator and updated regularly.

There is also a subtler problem that has nothing to do with fraud. Most large brokers are groups of companies, each licensed in a different country. The brand you see on adverts may hold a top-tier licence in one place and onboard you through a lightly regulated offshore company in another. The licence on the homepage is real; it just may not be the one that covers you.

Step 1: find the legal entity and licence number

Scroll to the footer of the broker's website, or open the client agreement or terms and conditions. A regulated broker will state something like: "[Company name] Ltd is authorised and regulated by [regulator] under licence number [number]". Note down:

• the exact legal name of the company, including "Ltd", "Limited", "Pty Ltd", "GmbH" and so on;
• the licence or reference number;
• the regulator named;
• the registered address.

If several entities are listed for different regions, note them all. If you cannot find any of this, stop there. A legitimate regulated firm has no reason to hide it.

Licence numbers have recognisable formats. CySEC licences for Cyprus investment firms (CIFs) look like a number and a two-digit year separated by a slash, for example 123/10. The FCA uses a Firm Reference Number (FRN), usually six or seven digits. ASIC issues an Australian Financial Services Licence (AFSL) number. A format that does not match the regulator's style is an early warning sign.

Step 2: go to the regulator's register yourself

Type the regulator's web address into your browser, or use the links on our regulator registers page. Do not click a link in the broker's site, an email, a chat message or an advert: fake regulator websites exist, and both CySEC and the FCA have warned about sites impersonating them.

The main registers for retail forex and CFD brokers are:

• Cyprus (CySEC): list of Cyprus investment firms, with a separate warnings page.
• United Kingdom (FCA): the Financial Services Register, which the FCA also calls Firm Checker, plus the FCA Warning List.
• Australia (ASIC): professional registers search, choosing the Australian financial services licensee register, plus the Moneysmart investor alert list.
• Germany (BaFin): the BaFin company database.
• EU-wide: the ESMA registers, useful for checking EU investment firms and where they are passported.
• Worldwide warnings: IOSCO I-SCAN, which collects warnings from regulators in many countries in one search.

Search by licence number first, then by company name. If you find nothing under either, the claim is false or the firm has lost its licence.

Step 3: match every detail

Finding a matching name is not enough. Compare the register entry with what you have in front of you:

• Legal name: exactly the same, not just similar. "Example Markets Ltd" and "Example Markets Group Ltd" may be different companies.
• Licence number: the same number belongs to the same entity.
• Status: authorised or licensed now, not cancelled, suspended, withdrawn or "no longer authorised".
• Contact details and websites: compare the phone numbers, email domains and any websites or trade names listed with those you were given. ASIC has begun publishing licensees' website addresses on its register specifically so consumers can make this comparison.
• Address: the registered address should match.

If the register entry exists but any contact detail differs, treat it as a probable clone (see below).

Step 4: check the permissions

A licence is not a blanket permission. Regulators authorise firms for specific activities. A firm might be authorised to give advice but not to deal as principal, or to manage portfolios but not to hold client money.

For a forex or CFD broker, you are looking for permission to deal in derivatives or contracts for difference with retail clients, and to hold client money. On the FCA register, this is shown in the permissions section of the firm's entry. On ASIC's register, the licence conditions list the financial products and services covered. On CySEC's list, the firm's entity page lists the investment services and financial instruments it is licensed for.

If a firm is only authorised for something unrelated, such as payment services or insurance, its licence does not cover what it is selling you.

Step 5: confirm which entity will hold your account

This is the step most people skip, and it matters as much as the others.

Many broker groups have a top-tier licensed company for EU or UK clients and a separate offshore company, often in a jurisdiction with lighter rules, for everyone else. Some will move you to the offshore company if you tick a box during sign-up, or if you ask for higher leverage. The offshore entity may not offer the same protections: retail leverage caps, negative balance protection, segregation rules or access to a compensation scheme. Our guide to ESMA leverage limits and negative balance protection explains what EU retail clients are entitled to.

To check, look at:

• the client agreement you are asked to accept, which names the contracting company;
• the account opening confirmation email;
• the payment details: the company receiving your deposit should match the licensed entity.

If the company on your agreement is not the one you checked on the register, go back to Step 2 with the new name.

Step 6: check the warning lists, and know their limits

Search the broker's name and website on the regulator's warning list and on IOSCO I-SCAN. If it appears, do not deal with it.

But absence from a warning list means very little. The FCA says plainly that a firm not on its Warning List may still be unauthorised or a scam, because fraudsters change names and websites faster than regulators can publish warnings. Warning lists help you rule firms out; they cannot rule firms in. Only the register can do that.

Brokers regulated elsewhere

The same method works for any regulator: find the official register, reach it by typing the address yourself, and match the entity, number, permissions and contact details. In the United States, retail forex dealers must be registered with the CFTC and be members of the National Futures Association, whose BASIC database shows registration and any disciplinary history. In Switzerland the regulator is FINMA; elsewhere in the EU each national authority keeps its own register, and the ESMA registers link them together.

If you cannot find a regulator's official website, or the only information about it comes from brokers it supposedly licenses, treat it with suspicion. Fake regulators with professional-looking websites are a known tactic. IOSCO's member list is a quick way to check that a securities regulator is real.

Clone firms: the trap that defeats a quick check

A clone firm copies the identity of a genuine regulated firm: its name, its licence or reference number, its address and sometimes a near-identical website. Someone who searches the register for the name will find a real, authorised entry and assume they are safe.

The giveaway is in the contact details. According to the FCA's guidance on clone firms, signs include:

• unexpected contact by phone, email or social media;
• website or contact details that differ slightly from the genuine firm's, such as a different phone number;
• email addresses that resemble the real firm's or use free providers such as Gmail or Outlook;
• claims that the register details are out of date. The FCA says this is unlikely, since its register is updated roughly every 24 hours.

The fix is simple: contact the firm only through the phone number, email or website listed on the regulator's register, never the ones you were given, and ask whether you are dealing with them. If the register shows no contact details, or something does not add up, call the regulator. For the UK, the FCA's consumer helpline is 0800 111 6768. The FCA's page on clone firms has more detail.

Worked example: spotting a clone

This example is invented, but follows a common pattern. You receive a call from "Northgate Capital Markets", who say they are FCA-regulated and give you an FRN. You search the FCA register and find Northgate Capital Markets Ltd, authorised, with the same FRN. So far, so good.

Then you compare details. The register lists a website ending in .co.uk and a London phone number beginning 020. The caller's website ends in .com, the email address you were sent is from a free webmail service, and the callback number is a mobile. The bank account you are asked to pay into is in a different company name, in another country.

The licence check passed. The detail check failed in four places. This is a clone, and the right response is to stop, contact the real firm through the details on the register, and report the clone to the FCA.

What a licence does and does not protect

A licence from a strong regulator gives you real protections, which vary by country. In the EU and UK they typically include segregation of client money from the firm's own funds, retail leverage limits, negative balance protection, clear cost disclosures and a mandatory risk warning showing what percentage of retail accounts lose money. Some jurisdictions add an investor compensation scheme if the firm fails: in Cyprus, the Investor Compensation Fund covers eligible clients of member firms up to the lower of 90% of the claim or 20,000 euros; in the UK, the FSCS covers eligible investment claims up to 85,000 pounds. Eligibility rules apply in both cases.

What a licence does not do is protect you from trading losses. Leverage magnifies losses as well as gains, and most retail CFD accounts lose money whichever broker you use; regulated brokers' own disclosures commonly range from about 61% to 89%. A licence makes it far more likely that you are dealing with a real company that will execute your trades and return your money. It does not make CFDs safe. See why most retail CFD traders lose.

Common mistakes when checking a licence

• Trusting the regulator logo on the broker's site, or a link the broker provides.
• Checking the brand name rather than the exact legal entity.
• Stopping when the name matches, without comparing website, phone and email.
• Assuming a licence in one group company covers the company holding your account.
• Treating absence from a warning list as a clean bill of health.
• Accepting a licence from a regulator you cannot find any information about. Some "regulators" are themselves fake.
• Checking once and never again. Licences can be suspended or withdrawn; check again before large deposits.

For the broader picture of choosing a provider, see how to choose a forex broker. For the warning signs that go beyond licensing, read forex scam red flags.

Frequently asked questions

How do I know if a forex broker is regulated?

Find the legal entity name and licence number on the broker's website or client agreement, then search for them on the regulator's own register, which you reach by typing the regulator's address yourself. Check that the details, including website and contact information, match, and that the firm is authorised to deal in CFDs with retail clients.

What is a clone firm?

A fraudulent operation that copies a real regulated firm's name, licence number and address so that a register search seems to confirm it. You spot it by comparing the contact details and website on the register with the ones you were given, and by contacting the real firm only through the register's details.

Is an offshore licence as good as a CySEC or FCA licence?

Usually not for retail clients. Offshore regulators generally impose fewer requirements on leverage, client money, capital and dispute resolution, and many have no compensation scheme. The protections you get depend on the regulator of the specific company that holds your account.

Can a broker licensed in Cyprus serve clients in other EU countries?

Yes. Under MiFID II, an investment firm authorised in one EU or EEA country can provide services in others through a passport, after notifying its home regulator. The firm remains supervised mainly by its home regulator. The ESMA registers and the host country's regulator can confirm the passport. EU passports no longer apply in the UK, where firms need FCA authorisation.

What should I do if the broker is not on any register?

Do not deposit money. If you have already deposited, request a withdrawal in writing, keep records of all communication and report the firm to your national regulator and the police. Be wary of anyone who then offers to recover your money for a fee: this is a common follow-up scam.

How often should I recheck a broker's licence?

Before you open an account, before any large deposit, and whenever you are asked to sign a new agreement or move to a different entity. It takes minutes and licences do change.