How we check

This page is written to be copied. Everything the desk does to a platform name is listed here in order, and none of it requires access that a member of the public lacks. If you follow the sequence yourself and reach a different result from ours, we want to hear about it.

Step one: record the claim before checking it

We read the promotional material first and write down what it actually says, keeping the platform's own wording where the wording matters. This happens before any searching, because it is much harder to record a claim honestly after you have formed an opinion about it.

Two things get separated at this stage. Claims that could in principle be checked: a company name, a regulator, a jurisdiction, a figure with a source. And claims that could never be checked by anyone: potential, advanced, secure, trusted. The first list becomes the work. The second list is quoted and labelled as advertising.

Step two: find the entity

A brand is not a company. The question is which legal entity a customer would be contracting with, and the answer should appear in the terms of use, the privacy notice or the footer. A privacy notice in particular has to name a data controller to mean anything at all.

When we find a name, it goes into the company register of the country named: is the entity real, is it active, what is it registered to do, and when was it incorporated. When we find no name, the dispatch says so, because you cannot search a register for a company you have never been told the name of.

Step three: verify the licence claim, or record its absence

A usable licence claim has three parts: the regulator, the jurisdiction and a reference number that can be typed into a public database. With all three, verification takes about a minute and produces a fact rather than an impression.

We check three things about any entry we find. That the entity name matches exactly, not approximately, because similar names are the oldest trick in this category. That the permission covers the activity being advertised, since a payments registration is not an investment licence. And that the entry is current rather than lapsed or withdrawn.

We also search the warning lists of the regulators we can reach, in the country claimed and in the countries where the promotion is running. If a licence claim carries fewer than three parts, that is recorded as a finding in itself.

Step four: follow the money

Deposit routes get design attention; withdrawal routes rarely do. So we look for four things: who holds client funds, whether those funds are segregated from the operator's own money, which institution the account sits with, and what procedure releases money back to the customer.

Where none of that is published, the dispatch says so plainly. A balance displayed on a screen is a statement by the operator about itself, and it becomes money again only when it arrives in your bank account.

Rina runs this part. What does the form ask for, and how much of it is necessary to do the thing being offered. Does the page say who receives the data. Is consent a real choice or a pre ticked box. What tends to happen after submission, described from how this category generally operates rather than from a claim about any one brand.

Two behaviours get flagged whenever the category displays them, because both turn an ordinary risk into a severe one: a request to install remote access software on your own device, and pressure to add money while an existing balance is still stuck.

Step six: separate product risk from brand risk

Some risk belongs to the instrument rather than the operator. Leveraged trading can cost more than the amount deposited. Positions can be closed automatically at a loss. Automated systems fail in their own ways, including at the exact moment when a market is moving fastest.

These paragraphs are in every dispatch and they stay true even if the operator behind a particular name is entirely honest. A reader deciding what to do needs both risks, added together rather than traded off.

Step seven: choose a verdict word

Four words are available. Unverified when the checks return nothing that identifies or supervises the operator. High risk when specific, demonstrable features raise the probability of loss beyond ordinary market risk. Avoid when a supervisor has published something, or when the operator's own material contradicts itself in a way we can show. No red flags found when the sequence above completes without turning anything up.

There is no fifth option and there are no half steps, because a scale invites a precision we have not earned. The verdict carries the date it was checked, and an old date is itself information.

What we will not do

We do not deposit money in order to test a platform, so we never describe an experience we have not had. We do not publish a licence number, a company name or a jurisdiction that we have not read in a primary source. We do not treat a syndicated article as evidence: the same paragraphs appearing on twenty sites is one source, not twenty.

We do not use the word scam about a name we have only failed to identify. Failing to find a company is a finding about the public record. It is serious, it is worth knowing before money moves, and it is not the same thing as proof of fraud.

When we get it wrong

Send the correction to [email protected] with something we can check. We would rather fix a file than defend it, and the fix is published on the page with its own date so that a reader can see what changed.