Clone firms and borrowed FSP numbers

Some platforms show a real FSP number but a different company name or contact details, or the name of a licensed firm with a different domain. This page explains how impersonation works and what an FSCA clone warning means.

How impersonation works

Impersonation works by copying a real firm's name, FSP number, or contact details. A clone site may show the name of a licensed firm but use a different domain. A site may show a real FSP number but a different company name. A site may copy the website of a licensed firm and change only the contact details.

The clone is not the licensed firm. It is a different entity that is using the licensed firm's details to look legitimate. The clone may not have any connection to the licensed firm. The licensed firm may not know that its details are being used.

Why a match must hold on name, number and contact details together

A match must hold on name, number and contact details together. If the name matches but the website is different, the reader is not dealing with the licensed firm. If the number matches but the name is different, the reader is not dealing with the licensed firm. If the contact details are different, the reader is not dealing with the licensed firm.

The reader should compare all three: the legal name, the FSP number, and the contact details. The contact details include the website, the email address, and the phone number. If any of these do not match the FSCA's register, the platform is not the licensed firm.

What an FSCA clone warning means

An FSCA clone warning means the FSCA has found that an entity is impersonating an authorised firm. The warning names the clone and the firm it is impersonating. The FSCA may also give the clone's website and contact details. The warning is a public notice that the clone is not authorised.

The warning does not mean the licensed firm did anything wrong. The licensed firm is the victim of the impersonation. The warning tells the public to avoid the clone. The reader should not conclude that the licensed firm is unsafe because a clone is using its name.

How to spot a clone

To spot a clone, the reader should compare the platform's details with the FSCA's register. The register shows the legal name, the FSP number, and the contact details of the licensed firm. If the platform's website is different from the register's website, the platform may be a clone. If the platform's email domain is different, the platform may be a clone.

A clone may also use a name that is very similar to the licensed firm's name but not identical. The reader should look carefully at the spelling and the domain. A clone may use a domain that is one letter off or a different top-level domain.

Why clones are dangerous

Clones are dangerous because they look legitimate. A reader who checks only the FSP number may be fooled. The clone may show a real FSP number from a licensed firm. The reader may think the clone is the licensed firm. But the clone is not the licensed firm, and the reader's money may go to the clone.

The clone may also use the licensed firm's name in its advertising. The reader may search for the licensed firm and find the clone's website. The clone may rank higher in search results. The reader should always go to the licensed firm's website from the FSCA's register, not from a search engine.

What to do if you suspect a clone

If you suspect a clone, you should report it to the FSCA. The FSCA has a complaints process for unauthorised entities. You should also avoid sending any money to the clone. If you have already sent money, you should contact your bank and the FSCA.

The FSCA's warnings page may already have a warning about the clone. You should check the warnings table on this site and the FSCA's own site. The FSCA's site is the authoritative source for warnings.

The same FSP number can appear on two different websites

A number is not a fingerprint. The FSCA register lists the legal entity that was granted a licence, but anyone can copy that number onto a different website. The regulator does not issue a unique code for each website, and it does not monitor every page that displays an FSP number. When a number appears on a site that is not mentioned in the register, the number has been borrowed.

Borrowing works because readers often stop at the number. They type it into the search box, see that it belongs to a licensed firm, and assume the site they are looking at is that firm. The assumption fails when the legal name on the register does not match the name on the site, or when the contact details lead somewhere else. The number alone proves nothing.

A match must hold on three things at once: the exact legal name, the FSP number, and the contact details the regulator has on file. If any one of these differs, the site is not the licensed firm. A cloned number is a warning sign, not a confirmation. The reader should compare the site against the register entry line by line, not just glance at the first result.

A clone can copy the look of a licensed firm without copying its register entry

Impersonation often copies the visual surface of a licensed firm: the logo, the colour scheme, the layout of the landing page. These elements are easy to lift from a screenshot. The clone does not need to copy the register entry because most readers will never open it. The clone relies on the visual familiarity to lower suspicion before the reader thinks to check.

The register entry is harder to fake because it is not a design choice. It is a set of records maintained by the FSCA, and the clone cannot edit those records. When a reader compares the site with the register, the differences appear quickly: a different legal name, a different physical address, a different telephone prefix, or a domain that was registered long after the licensed firm's own domain.

A clone does not need to copy the register entry; it only needs to copy the parts that a reader sees before checking. That is why the order of operations matters. Check the register before trusting the look of the site. If the look is familiar but the register entry does not match, the familiar look is part of the impersonation, not evidence of legitimacy.

The FSCA warns about clones only after it has enough evidence to publish

A clone warning is not issued the moment a suspicious site appears. The FSCA first receives reports, checks the register, and compares the details. It may contact the licensed firm whose number has been borrowed to confirm that the site is not affiliated. Only after this process does the regulator publish a warning. The delay means a clone can operate for some time before it appears in the warnings list.

The absence of a warning therefore does not mean a site is legitimate. It may simply mean the FSCA has not yet completed its review, or that no one has reported the site. A reader who finds a site that borrows an FSP number but is not yet in the warnings list should not conclude that the site is safe. The register check remains the first and most reliable step.

When a warning is published, it describes the clone's methods and the details that do not match. The warning is a public record of the FSCA's finding, not a verdict on the people behind the clone. The regulator does not prosecute through a warning; it informs. The reader uses the warning to confirm a suspicion that began with a register check, not as a substitute for that check.

A borrowed FSP number can be used to sell products the licensed firm does not offer

The licensed firm's register entry lists the categories of financial services it may provide. A clone that borrows the number is not bound by those categories. The clone can advertise contracts for difference, forex, crypto assets, or any other product, regardless of what the licensed firm is actually allowed to offer. The number is used as a shield, not as a description of the clone's own authorisation.

This creates a mismatch that a careful reader can spot. The register entry for the borrowed number will not include the product being offered on the clone's site. For example, if the register lists only advisory services but the site offers derivative trading, the site is not the licensed firm. The product mismatch is often the clearest sign that the number has been borrowed.

The reader should compare the products on the site with the categories on the register. If the site offers something that the register does not list, the site is not operating under that licence. The licensed firm cannot lend its number to another entity, and the FSCA does not allow a firm to offer products outside its registered categories. A mismatch means the number is being misused.

The licensed firm often does not know its number is being used

A clone does not need permission from the licensed firm to copy its number. The number is public information, published on the FSCA register for anyone to read. The licensed firm may learn of the clone only when a client complains about a loss or when the FSCA contacts it during an investigation. Until then, the firm's own operations continue normally.

This means the licensed firm is a victim of the impersonation, not a participant. The firm's reputation suffers when readers confuse the clone with the real entity. The firm may issue its own notice on its website, but that notice reaches only readers who already know the real firm. The clone continues to attract new readers who have never seen the real firm's site.

A reader who suspects a clone should not contact the licensed firm to ask whether the site is real. The firm may not know, or may not respond quickly. The reader should instead compare the site with the register directly. The register is always available and always current. If the site does not match the register, the reader has enough information to avoid it, regardless of what the firm says.

A clone can copy a live firm's address and phone number while routing calls and emails elsewhere

A clone does not need to invent a new identity from scratch. It can lift the physical address, landline and even the names of key individuals straight from a real firm's disclosure on the FSCA register. The clone then publishes those details on its own website or in its app, knowing that a reader who checks only the address or phone number will see a match. That match is real, but it is copied, not operated.

The danger sits in the routing. When a reader calls the number shown on the clone's page, the call does not reach the licensed firm whose number appears in the register. It reaches the clone's own line, often answered with the real firm's name. The same happens with email: the clone uses an address that looks similar but differs by one character, or it simply uses a free mail service and the real firm's name in the display field.

The FSCA's register lists the contact details it has on file for the licensed entity, but the regulator does not verify that every website displaying those details is operated by the same people. The only safe comparison is to go to the licensed firm through a channel you already trust, such as a number from a bank statement or a previous invoice, and ask whether the website or representative you are dealing with belongs to them.