How to Verify a Crypto Platform Is Real

Introduction

A crypto platform that wants your deposit will usually tell you it is safe, licensed or regulated. Those words cost nothing to type, and a scam site can use them as easily as a genuine firm can. What a scammer cannot easily fake is a matching entry on a public register kept by a regulator, under the same name, website and phone number the platform gave you. This guide shows you how to find that entry yourself, how to read it, and how to notice when it does not say what the platform implied.

The guide is built on five questions to ask before any deposit. Our crypto scam protection guide sets them out in short form, beside the three questions to ask of any message that wants your money. This page is the long version: where each register lives, what a real entry looks like line by line, and what a genuine entry still does not promise you.

The worked example is a real UK register entry, read in a browser on 5 October 2026. It was chosen because it shows how far a crypto registration goes and where it stops, and it is an illustration rather than a recommendation. Nothing on this page recommends a platform, and nothing on it links to one.

The page is UK-first, because the UK register is publicly searchable, and it also covers the EU's interim register and the US registrations a crypto platform may hold. Each sentence that reports what a regulator says names the jurisdiction and either dates the page it comes from or points back to the dated sentence before it, because registers change daily and a dated sentence tells you how old the check is.

Some claims fail before you open a register at all. In the UK, the FCA expects its new regime for crypto firms to come into force on 25 October 2027 (last updated 30 September 2026). In the EU, the MiCA transitional period for crypto firms operating under national rules ended on 1 July 2026 (ESMA, 23 June 2026). A platform that describes its status in a way neither timetable allows has already told you something about itself.

If you have already deposited and are now unsure whether the platform is real, stop adding money first. Our guide to what to do after a crypto scam covers the first hour, the evidence to keep and where to report.

The Five Questions Before You Deposit

Ask these five questions of the platform, app or person handling your money, in this order, and stop at the first answer that fails or that you cannot get. They match the checklist in our scam protection guide, and the rest of this page supplies the detail behind each one.

• 1. Is it on the register for your country, for this activity? In the UK that is the FCA's Financial Services Register, in the EU it is ESMA's register of authorised crypto-asset service providers, and in the US it is the federal and state registrations the firm needs for what it offers you. A firm you cannot find is a firm you do not deposit with.
• 2. Do the details you were given match the register entry exactly? Compare the website address, the email domain and the phone number character by character with the register entry, not with the details on the firm's own pages or in the message that reached you.
• 3. Does the entry cover what you are being offered? A registration for one purpose is not permission for another, and a registration is not a promise of compensation if the firm fails.
• 4. Is there a warning about it? Search the regulator's warnings, and search the firm's name and web address with the words scam and fraud. A warning is enough to stop; the absence of one proves nothing.
• 5. Does the website or app hold up? Check when the domain was registered, type the address yourself rather than following a link, and treat the padlock and an app-store listing as no proof that the service is genuine or legal.

Why the order matters

The order runs from the strongest signal to the weakest. A missing register entry settles the question on its own, while a domain that is several years old proves very little, because domains can change hands. Running the questions in order means you spend your time where an answer can actually stop you, and you never mistake a passed weak check for a passed strong one.

The questions also assume nothing about how you found the platform. A friend's recommendation, an advert, a search result and a message from a stranger all lead to the same five checks, because none of those routes tells you who runs the site in front of you. In the US, the CFTC says that the vast majority of frauds involving cryptocurrency or forex trading begin on social media or through messaging apps (April 2023 brochure).

Stop at the first failure

A failed answer is not a puzzle to solve with the platform's help. If the details do not match, its support team may have an explanation ready, and a convincing explanation is exactly what a cloned site is built to supply. Treat the first failure as the end of the check.

Claims of Regulation That Cannot Be True

Before you search any register, test the claim itself. Some statements about a crypto platform's status cannot be true in October 2026, whatever the platform's website says, because the rules they describe are not yet in force or have already ended. A platform that makes one of them has answered the first question for you.

First test: the UK regime has not started

In the UK, the FCA says that regulations made on 4 February 2026 will bring cryptoassets within its regulatory remit (last updated 30 September 2026). In the UK, the FCA expects the new regime to come into force on 25 October 2027 (same page). In the UK, the FCA says that once the regime is in place, crypto businesses will need to be authorised by the FCA to do business in the UK (same page).

In the UK, the FCA's application period for the new crypto permissions started on 30 September 2026 and will close on 28 February 2027 (gateway page, last updated 30 September 2026). In the UK, the FCA describes those permissions as covering new cryptoasset regulated activities (same page). In the UK, the FCA has told firms registered with it under the Money Laundering Regulations that there will be no automatic conversion (same page). In the UK, the FCA says those firms will need to secure authorisation under the Financial Services and Markets Act (same page).

That gives you the first test. Until the UK regime starts, no platform can be running an exchange for cryptoassets such as bitcoin, or holding them in custody for you, under an FCA authorisation for that business, because those activities only become regulated activities when the regime begins. For an exchange or custody business in cryptoassets such as bitcoin, an anti-money laundering registration with the FCA is the ceiling in the UK until the regime starts. In October 2026, a platform that tells a UK customer the FCA has already authorised its exchange for cryptoassets such as bitcoin, or that its application amounts to approval, is describing something its register entry cannot show you.

Read the test narrowly, because it is about the activity you are offered and not about the word crypto. In the UK, the FCA says some crypto products, such as crypto contracts for difference, are already regulated by it, so firms dealing in them must be authorised (last updated 16 February 2026). In the UK, the FCA adds that these products should not be marketed to most consumers (same page).

Second test: a pending MiCA application is no longer a status

In the EU, ESMA said on 23 June 2026 that the MiCA transitional period would end on 1 July 2026, and set out how crypto-asset service providers without MiCA authorisation must wind down their activities while protecting investors. In the EU, ESMA warned in the same statement that clients of unauthorised providers, whether based in the EU or outside it, do not benefit from MiCA safeguards, including protections for client assets (23 June 2026).

So since 1 July 2026, a provider serving clients in the EU is either authorised under MiCA and listed on ESMA's register, or it is not authorised. A platform that tells an EU customer its MiCA application is pending is telling you it belongs to the second group, whatever reassurance comes with the sentence. In the EU, ESMA invites clients to verify in its register whether their provider is authorised under MiCA, and to act promptly where it is not (23 June 2026).

Third test: no compensation scheme stands behind it

In the UK, the FCA says most crypto-related activities are not regulated (last updated 16 February 2026). In the UK, the FCA says that if you invest in crypto, you generally will not have access to the Financial Ombudsman Service (same page). In the UK, the FCA says you also will not be protected by the Financial Services Compensation Scheme if the firm goes out of business (same page). In the UK, the FCA's list of registered crypto firms adds that most cryptoassets are not specified investments under the Financial Services and Markets Act (list read on 5 October 2026). In the UK, the list says this makes it unlikely that either scheme will protect you (same page).

In the EU, the three European supervisory authorities, the EBA, EIOPA and ESMA, warned on 6 October 2025 that MiCA's consumer protections are not as extensive as those for traditional financial products. In the EU, the example the three authorities gave was that you will not benefit from compensation schemes (6 October 2025). In the US, the FDIC states that its deposit insurance does not apply to crypto assets, and does not protect against the default, insolvency or bankruptcy of non-bank crypto custodians, exchanges, brokers or wallet providers (fact sheet, 28 July 2022).

A platform that promises its own protection for your crypto if it fails is therefore offering something that none of these public schemes provides, and its promise is only as strong as the firm making it. What happens when a real platform does fail is a separate question, covered in our guide to crypto platform failure and recovery.

Fourth test: registered is not endorsed

In the UK, the FCA tells crypto businesses that registration under the Money Laundering Regulations is a legal requirement to carry on business, not a recommendation or endorsement (last updated 12 February 2026). In the UK, the FCA tells registered firms to avoid language suggesting that registration is an endorsement (same page). In the UK, the FCA describes its responsibility under that regime as limited to anti-money laundering and counter-terrorist financing registration, supervision and enforcement (same page).

In the UK, a platform that presents its FCA registration as a seal of approval is using it in a way the FCA tells registered firms to avoid (last updated 12 February 2026).

How to Read an FCA Register Entry

The FCA's Financial Services Register is the record to check for any UK crypto firm, and reading an entry correctly matters as much as finding one.

Where crypto firms appear

In the UK, the FCA keeps a list of registered and formerly registered cryptoasset firms on its register (list read on 5 October 2026). In the UK, that list states that since 10 January 2020, firms carrying out specific cryptoasset activities in the UK have had to comply with the Money Laundering Regulations 2017 and register with the FCA (same page). In the UK, the FCA tells consumers checking a crypto firm to search the register by the firm's name or reference number and to check which activities and services it has permission for (last updated 16 February 2026). In the UK, the FCA also tells them to make sure the firm's contact details match the ones they were given (same page).

On 5 October 2026, the UK FCA's list of registered cryptoasset firms held 68 firms: 62 with the status “MLRs Registered” and six marked “Formerly MLRs Registered”, by our count of its rows that day. Each row of the UK list gives the firm's legal name, its reference number, its principal place of business, a contact number and the date its status took effect. A list that short is quick to scan, but scan it for the legal name as well as the brand, because the two are often different, as the example below shows.

One entry, line by line

The example is the UK FCA register entry for Payward Ltd, reference number 928768, read in a browser on 5 October 2026. It is used here because it is a clear example of a crypto registration, and for no other reason. On the UK FCA register, the entry's table of names lists the registered name Payward Ltd and two trading names, both beginning with the word Kraken, so the brand a reader knows appears among the trading names, not in the list's column of firm names.

As read that day, the UK register entry opens with the statement “This firm is registered for certain cryptoasset activities.” Its status panel shows the status Registered, since 23/11/2021, the type MLD cryptoassets, and a UK Money Laundering Regulations status of MLRs Registered from the same date. Its table of regulators shows a single entry, the UK's FCA, from 23 November 2021, and its restrictions section showed no requirements when we read it.

In its section on how customers are protected, the entry says that the UK's Financial Ombudsman Service will not be able to consider a complaint about the firm (read on 5 October 2026). The same entry says that the UK's Financial Services Compensation Scheme will not be able to consider a claim against the firm if it fails (read on 5 October 2026). The entry adds that for cryptoasset businesses, the register will only tell you whether a firm is registered for the purpose of compliance with the UK Money Laundering Regulations (read on 5 October 2026).

The firm details give a London postal address, a phone number and a Companies House number, but no website. When an entry lists no website, compare the details it does give with what you were sent, and make contact through the phone number on the register rather than one on a website. The UK register entry itself recommends asking the firm, through its main contact details, to confirm its permitted activities and the protections available to you (read on 5 October 2026).

What the entry does not promise

In the UK, the FCA says a firm that is registered but not authorised cannot provide regulated products and services that need authorisation (last updated 22 September 2026). In the UK, the FCA says that if you use such a firm, you are unlikely to have protection from the Financial Services Compensation Scheme if it goes out of business (same page). In the UK, the FCA says you are also unlikely to have access to the Financial Ombudsman Service if you want to complain (same page). In the UK, the FCA counts crypto exchanges, crypto ATMs and custodian wallet providers among the firms that must be registered with it for anti-money laundering purposes, and tells you to avoid them if they are not (same page).

Put plainly, the entry tells you who the firm is, that it sits inside the FCA's UK anti-money laundering supervision, and where to complain to the firm itself. It does not tell you that the firm is authorised under the Financial Services and Markets Act, that your money is covered if the firm fails, or that a website using its name is really its own. The entry also warns that the UK register does not detail the activities a firm undertakes that do not require FCA approval (read on 5 October 2026). An entry like this one therefore does not describe any staking, lending or yield product the same platform may sell you.

When the register's own text lags

Registers are maintained in pieces, and the same entry shows it. Read on 5 October 2026, the entry still told consumers in England, Wales or Northern Ireland who are concerned they have been scammed to contact the FCA and Action Fraud. In England, Wales and Northern Ireland, that service is now Report Fraud (replaced Action Fraud in December 2025), according to a GOV.UK news story of 4 December 2025.

In Scotland, the FCA tells people to report a scam to Police Scotland by calling 101 (last updated 19 January 2026). The error is small, but it is a reminder to read the date on every page you rely on, a regulator's included, and to treat a link as a route rather than a check. The register's footer, read the same day, still linked to ScamSmart, which the UK regulator's own scam-protection page stopped referring to in January 2026.

The FCA Warning List and Firm Checker

A register entry tells you what a firm is. In the UK, the FCA's warnings tell you what it knows about firms that are not what they claim to be, and its consumer pages that point to them changed in January 2026.

The Warning List, and what its silence means

In the UK, the FCA says that a warning it has published about an unauthorised firm will appear on the Firm Checker and on the Financial Services Register when you search for that firm (last updated 22 September 2026). In the UK, the FCA points to its Warning List for the full list of the firms it has published warnings about (same page). Search for the name you were given, the name on the website and the web address, because a scam may use more than one of each.

A warning is enough to stop. Its absence proves nothing, because a new scam site may simply not have been noticed yet, and scam sites tend to vanish and reappear under new names, as the domain checks below explain. Treat a clean search as the absence of one bad sign, never as a good one.

ScamSmart has gone, and Firm Checker is the FCA's consumer tool

In the UK, the update log of the FCA's Protect yourself from scams page records an editorial amendment on 19 January 2026 to remove ScamSmart references, and the old fca.org.uk/scamsmart address now redirects to that page (both read on 5 October 2026). In the UK, that page tells consumers that to find out whether a firm or individual is authorised, they can search the FCA Firm Checker (last updated 19 January 2026).

In the UK, the FCA tells consumers to reach the Firm Checker through the web address it publishes, fca.org.uk/consumers/fca-firm-checker, and never through links in emails or on company websites, which could be part of the scam (last updated 19 January 2026). Type the address yourself, or use a bookmark you saved from the UK FCA's own site, and check it again before you search.

Why the crypto check still ends on the register

In the UK, the FCA's Firm Checker page lists information the tool does not include, among it published restrictions relating to crypto activities (page read on 5 October 2026). In the UK, the Firm Checker page says that information can be found on the Financial Services Register (same page). In the UK, the Firm Checker page also says the tool cannot confirm whether Financial Services Compensation Scheme or Financial Ombudsman Service protection will definitely apply if something goes wrong (page read on 5 October 2026).

For a UK crypto platform, finish every check on the register itself, where the FCA keeps the crypto list and the full entry, whatever a quicker tool shows.

Checking an EU Platform on the ESMA Register

In the EU, the record to check is ESMA's register of crypto-asset service providers authorised under the Markets in Crypto-Assets Regulation, known as MiCA.

What the interim register is

In the EU, ESMA publishes its interim MiCA register as five CSV files on its MiCA web page, which showed a last update of 30 September 2026 when read on 5 October 2026. In the EU, the five files cover crypto-asset white papers, issuers of asset-referenced tokens, issuers of e-money tokens, authorised crypto-asset service providers and non-compliant entities (same page). In the EU, ESMA's page still described the files as an interim arrangement until mid-2026, when the register was to move into its IT systems, and on 5 October 2026 it was still a set of CSV files.

The file you need for a platform is the one for authorised crypto-asset service providers. On 5 October 2026, we counted 364 rows in it for 361 distinct legal entities, in the version of the EU file that ESMA last modified on 30 September 2026, and two of those rows carried a withdrawal date.

Reading a provider's row

In the EU file, the columns give the national authority that granted the authorisation, the provider's legal name and legal entity identifier (LEI), the country code of its head office, a commercial name and its website, though some rows leave the LEI, the country code or the commercial name blank (ESMA field descriptions and file, read on 5 October 2026). In the EU file, further columns give the date of authorisation, any date of withdrawal, the crypto-asset services covered and the member states where the provider intends to offer them (same descriptions). In the EU file, the services appear in MiCA's own wording, in most rows with their MiCA letters, such as providing custody and administration of crypto-assets on behalf of clients, or the exchange of crypto-assets for funds (file read on 5 October 2026).

Compare the website column with the address in your browser, character by character, and check the withdrawal column before anything else. Then check the services column against what you are being offered. In the EU, the three European supervisory authorities warned on 6 October 2025 that a firm may be authorised for only some of its services rather than all of them. In the EU, the three authorities told consumers to check which services a firm is allowed to provide (6 October 2025).

Weekly updates and withdrawals

In the EU, ESMA says it publishes the latest version of the register at weekly intervals, so information reported by national authorities, or listed in a national register, will not be displayed immediately (page read on 5 October 2026). In the EU, ESMA says a withdrawn authorisation stays in the file with the date on which the withdrawal took effect (same page).

A row is therefore a strong sign but not a final one. For very recent changes, check the register of the national authority named in the row, and treat a row with a withdrawal date as a firm that is no longer authorised. In the EU, ESMA reminded providers on 23 June 2026 that crypto-asset service providers established outside the EU cannot provide MiCA services to EU clients or solicit them, except where a client approaches them strictly on their own initiative. An offshore platform that advertised to you is not one you approached on your own initiative.

Checking a US Platform: What Registered Means There

In the US, no single register covers a crypto platform the way the FCA list or the ESMA file does. In the US, registration is spread across federal and state bodies, and the federal registration the CFTC says a crypto trading platform must hold is a money services business registration with FinCEN, which certifies far less than the word registered suggests (April 2023 brochure).

People and firms: the SEC and FINRA records

In the US, the SEC's Investor.gov says unlicensed, unregistered persons commit much of the investment fraud in the country, and tells investors to check the background of any financial professional to make sure the person is licensed (page read on 5 October 2026). In the US, Investor.gov's search box leads to the SEC's adviser disclosure records, which show whether a professional and their firm are licensed with the SEC, a state or FINRA, and any disciplinary history (same page). In the US, where necessary, the search passes you on to BrokerCheck, a site FINRA runs for broker-dealers (same page).

Those records cover people and firms that sell securities or give investment advice. Many crypto platforms are neither, so a platform with no record there has not necessarily failed a check. A person who pitches you an investment and has no record there has failed one, however many screenshots of profits they can show you.

FinCEN registration, and what it does not certify

In the US, the CFTC says cryptocurrency trading platforms are considered money services businesses by the Treasury and must register with the Financial Crimes Enforcement Network, FinCEN (April 2023 brochure). In the US, the CFTC adds that many states also require cryptocurrency trading websites to register (same brochure). In the US, the CFTC also says that firms soliciting US customers to trade forex or derivatives must register with the CFTC and be members of the National Futures Association, whose registrations can be checked at www.nfa.futures.org/basicnet (same brochure, which prints the address without www; that form did not resolve on 5 October 2026).

In the US, the FBI warned on 25 April 2024 against using cryptocurrency money transmitting services that are not registered as money services businesses, and advised checking FinCEN's registrant search first. In the US, the FBI noted in the same alert that inclusion on that search is not a recommendation, certification of legitimacy or endorsement of the business by any government agency. In the US, the CFTC says registration alone will not protect you from fraud, though most scams involve unregistered entities, people and products (April 2023 brochure).

So in the US, a FinCEN registration that you have found yourself in FinCEN's registrant search tells you that a registration was filed, not that a regulator examined the business or that your money is protected. Treat it as a first answer to question one, then check whether your state also requires the platform to register.

Domain and App Checks

Question five is the only one you can answer without a regulator, and it is also the one scam sites work hardest to pass. Run it after the register checks, never instead of them, because a well-built scam site can look better than a genuine firm's.

How old is the domain?

Since 28 January 2025, ICANN has treated the Registration Data Access Protocol (RDAP), rather than the older WHOIS service, as the definitive source of registration data for generic top-level domains, and it points users to its lookup service at lookup.icann.org (ICANN announcement, 27 January 2025). ICANN's announcement covers generic top-level domains, so for a country-code domain such as .uk, use the lookup run by that country's domain registry.

In the US, the CFTC advises looking up a trading website's domain registration at lookup.icann.org, and warns that a domain registered only a few weeks earlier marks a scam when the company claims to have been around for several years (April 2023 brochure). In the US, the CFTC also notes that scam sites tend to disappear once exposed and reappear under a different brand and web address (same brochure).

Use the date as a one-way test. A domain younger than the history a platform claims is a failed check. A domain that is old proves very little on its own, because domains can be bought and sold, so an old date sends you back to the register rather than ending the check.

Lookalike addresses

Scam sites rarely use a name that looks wrong. They use one that looks almost right, with an extra word, a swapped letter or a different ending. Our wallet drainer and phishing defence guide explains how search adverts and links that differ from a real domain by a character or two carry people to drainer sites.

The defence is the same for an exchange as for a wallet. Type the address yourself the first time, check it against the register entry or the ESMA row, and then save it as a bookmark and use only the bookmark. Our operational security guide covers the bookmark habit and the routine that goes with it.

The app store is not a check

In the US, the FBI warned on 25 April 2024 that just because an app can be found in an app store does not necessarily mean it is a legal service that complies with federal requirements. Before you install a platform's app, compare the publisher name shown in the store with the legal and trading names on the register entry, bearing in mind that a genuine app may be published by a parent company in another country. Install it from the link on a site you have already verified, never from an advert or a message.

A fake trading app can show a balance that grows every day, and that number is what keeps a victim depositing in the long con set out in our guide to pig butchering scams. An app that passes every visual test still has to pass the register test, because looking right is the one thing a fake app is built to do.

The padlock is not trust

In the US, the FBI warned on 10 June 2019 that criminals were increasingly using website certificates so that phishing sites show https and a lock icon. In the US, the FBI advised in the same alert not to trust a website just because it has a lock icon or https in the browser address bar. The padlock means the connection between your browser and the site is encrypted. It says nothing about who runs the site, so treat it like an app-store listing: a box that a scam site can tick as easily as a genuine one.

The Cloned-Site Pattern

A cloned site does not invent a firm. It borrows a real one, with its name, its address, its reference number and sometimes its whole website, and changes one or two details so that your money and your messages go to someone else. That is why question two asks for an exact match rather than a likeness.

How a clone borrows a real firm

In the UK, the FCA calls a scam that pretends to be a genuine firm it authorises a clone firm (last updated 14 May 2025). In the UK, the FCA warns that clone firms often use a genuine firm's name and address, or copy its firm reference number (same page). In the UK, the same FCA page lists the other moves a clone may make:

• A copied website with small changes, such as a different phone number on an otherwise faithful copy.
• The genuine website with different contact details, so that you check the real site but talk to the scammer.
• The genuine firm's details with the wrong phone number, which is why the number has to match the register.
• Lookalike email addresses, or addresses at webmail providers such as Outlook or Gmail.

In the UK, the FCA also warns that clone firms may claim the contact details on its Firm Checker or register are out of date (last updated 14 May 2025). In the UK, the FCA says this is unlikely, because it updates both services every 24 hours on average (same page). In the UK, the FCA names this excuse in its own guidance and tells you to call it if a firm says its contact details on the Firm Checker are out of date, so treat the excuse as a warning sign rather than an explanation (last updated 14 May 2025).

Check the regulator's address too

Clones copy regulators as well as firms. In the UK, the FCA tells you to check that the website address is correct whenever you visit its register or its Firm Checker (last updated 14 May 2025). In the UK, the FCA warns that small changes to that address would mean the site is fake (same page). In the UK, the FCA gives the register's address as https://register.fca.org.uk/s/ (same page). A link that a platform sends you so that you can verify it on the register deserves the same suspicion as the platform itself.

A dashboard is not evidence

In the UK, the FCA warns that crypto scam adverts often lead to professional-looking websites where fraudsters may manipulate software to fake prices and investment returns (last updated 16 February 2026). In the UK, the FCA adds that you may not realise you have invested in a scam until you try to sell (same page). A balance on a platform's dashboard is a number in the platform's own records, not something you can check on a blockchain, so it verifies nothing. How a fake platform uses that number, stage by stage, is set out in our pig butchering guide.

When a clone asks you to connect a wallet

Some cloned sites skip the deposit altogether and ask you to connect a wallet and approve a transaction instead. A site that does this is after a signature rather than a payment, because an approval can give a smart contract permission to move tokens out of your wallet, which is how a drainer works. What an approval grants, and how to read one before you confirm, is in our transaction signing hygiene guide, and how drainer sites operate is in our wallet drainer guide. Never type a recovery phrase or a private key into a site to verify an account, whatever the page calls the step.

When the Answer Is That You Cannot Verify It

In the UK, the FCA says that if you cannot find a firm on its register, it is unlikely the firm has permission to offer you crypto products, and you should avoid using it (last updated 16 February 2026). The same logic holds for every check on this page: an answer you cannot get counts as an answer that failed, and the decision that follows is simple, even when the pressure is not.

• 1. Do not deposit. Not a small amount to test the platform, and not a first payment to unlock a bonus; a test deposit tests nothing except whether you will send a second one.
• 2. Do not let the platform verify itself. A support agent, a document, a certificate or a link to a register page sent by the platform is part of what you were trying to check.
• 3. Ask for the details in writing, then check them yourself against the register entry, the ESMA row or the US records, using addresses you typed.
• 4. Take the time the platform says you do not have. A genuine firm's register entry will almost certainly still be there next week, and so will the firm.

If you have already sent money to a platform you now cannot verify, stop sending more, whatever fee, tax or deposit you are told will release your balance. Our guide to what to do after a crypto scam sets out the first hour, the evidence to keep and the reporting route for where you live.

Conclusion

Verifying a crypto platform comes down to replacing what the platform says about itself with what a register says about it. Find the entry for your country and for the activity you are being offered, compare every detail with what you were sent, and read what the entry covers and what it does not. Then look for warnings without trusting their absence, and check that the website and the app are what they claim to be. The first failure ends the check.

In the UK, read an entry the way the worked example reads. A UK crypto exchange's registration with the FCA is an anti-money laundering registration, and its register entry gives general information on whether the Financial Ombudsman Service and the compensation scheme can help, while saying that the final decision is theirs (entries read on 5 October 2026). In the UK, no platform can be running an exchange for crypto such as bitcoin, or holding it for you, under an FCA authorisation for that business before the new regime starts, which the FCA expects on 25 October 2027. In the EU, find the provider's row in ESMA's file and check its services and any withdrawal date. In the US, treat a FinCEN registration as a filing, not a verdict.

Some claims need no register at all. No platform serving EU clients can rely on a pending MiCA application after 1 July 2026, and no public compensation scheme pays you back for crypto lost when a platform fails: the UK's Financial Services Compensation Scheme does not, MiCA provides no such scheme and US deposit insurance does not apply. A platform that says otherwise has failed the check before it began. If a real platform you used does fail, our platform failure and recovery guide covers what happens next.

When you cannot get an answer, do not deposit, and do not let the platform answer for you. For the three questions to ask of any message that wants your money, and the short form of these five, start with our crypto scam protection guide. Keep the bookmark habit from our operational security guide for every platform that passes.

None of these checks makes a platform safe, and none of them can make a loss recoverable. What they do is move the decision to the one moment you control completely, which is before anything leaves your account.

Sources

Every primary source below was read on 5 October 2026, and the two FCA register pages were read in a browser that day. The counts marked as ours were made on 5 October 2026 and will change.

• FCA Financial Services Register, firm entry for Payward Ltd, reference number 928768, read in a browser on 5 October 2026 — the worked example, from status and trading names to the protections box and the scam-reporting line. register.fca.org.uk
• FCA Financial Services Register, Registered Cryptoasset Firms, read in a browser on 5 October 2026 — the 10 January 2020 start of registration, our row count and the list's note on the two schemes. register.fca.org.uk
• FCA, Crypto investment scams, last updated 16 February 2026 — searching the register, firms you cannot find, regulated crypto products, the two schemes, and faked returns. fca.org.uk
• FCA, How to check a firm or individual is authorised, last updated 22 September 2026 — registered against authorised, crypto firms' registration and where warnings appear. fca.org.uk
• FCA, Cryptoassets: AML/CTF regime, last updated 12 February 2026 — registration as a requirement, not an endorsement, and the limits of the FCA's role. fca.org.uk
• FCA, A new regime for cryptoasset regulation, last updated 30 September 2026 — the regulations of 4 February 2026 and the expected start on 25 October 2027. fca.org.uk
• FCA, Cryptoassets: How the gateway will operate, last updated 30 September 2026 — the application period, the new regulated activities and no automatic conversion. fca.org.uk
• FCA, Clone firms and individuals, last updated 14 May 2025 — clone tactics, the out-of-date excuse, the update interval and the register's address. fca.org.uk
• FCA, Protect yourself from scams, last updated 19 January 2026 — the removal of ScamSmart references in its update log, and reaching the Firm Checker by its published address. fca.org.uk
• FCA, FCA Firm Checker, tool page, read on 5 October 2026 — what the tool leaves out, crypto restrictions included. fca.org.uk
• FCA, Report a scam, last updated 19 January 2026 — Police Scotland on 101. fca.org.uk
• GOV.UK, Serious Fraud Office news story, Report Fraud: New service from City of London Police, 4 December 2025 — Report Fraud replacing Action Fraud. gov.uk
• ESMA, Markets in Crypto-Assets Regulation (MiCA) page with the interim MiCA register, last update 30 September 2026 — the five CSV files, weekly publication, withdrawals, the field descriptions, and the provider file whose rows we counted on 5 October 2026. esma.europa.eu
• ESMA, public statement ESMA75-113276571-1710, 23 June 2026 — the end of the transitional period, clients of unauthorised providers, and non-EU providers. esma.europa.eu
• EBA, EIOPA and ESMA, Warning on crypto-assets, published 6 October 2025 — partial authorisation and the absence of compensation schemes. esma.europa.eu
• SEC Investor.gov, Check Out Your Investment Professional, read on 5 October 2026 — background checks and BrokerCheck. investor.gov
• CFTC, 10 Signs of a Scam Crypto or Forex Trading Website, April 2023 brochure — FinCEN, state and NFA registration, where frauds begin, and domain age. cftc.gov
• FBI, public service announcement I-042524-PSA, 25 April 2024 — FinCEN registration and app-store listings. ic3.gov
• ICANN, ICANN Update: Launching RDAP; Sunsetting WHOIS, 27 January 2025 — RDAP in place of WHOIS, and the lookup service. icann.org
• FBI, public service announcement I-061019-PSA, 10 June 2019 — https and the lock icon on phishing sites. ic3.gov
• FDIC, Fact Sheet: What the Public Needs to Know About FDIC Deposit Insurance and Crypto Companies, 28 July 2022 — what it does not cover. fdic.gov
• The three questions to ask of any message, and the short form of the five questions, are on our crypto scam protection guide.
• How a fake platform shows profits, stage by stage, is in our guide to pig butchering scams.
• The first hour after a loss, the evidence to keep and the reporting routes are in our guide to what to do after a crypto scam.
• How drainer sites and lookalike links work is in our wallet drainer and phishing defence guide.
• What an approval grants, and how to read and revoke one, is in our transaction signing hygiene guide.
• The bookmark habit and the rest of a security routine are in our operational security guide.
• When a real platform fails rather than a fake one, see our guide to crypto platform failure and recovery.

Frequently Asked Questions

How do I check whether a crypto platform is real before I deposit?

Ask five questions in order and stop at the first one that fails. Is the platform on the register for your country, for this activity? Do the website, email domain and phone number you were given match the register entry exactly? Does the entry cover what you are being offered? Is there a warning about it? Does the website or app hold up? If any answer fails, or you cannot get an answer at all, do not deposit.

Does registration with the FCA mean a crypto exchange is safe?

No. In the UK, a crypto exchange is registered with the FCA for anti-money laundering purposes under the Money Laundering Regulations, and the FCA tells registered firms that registration is a legal requirement to carry on business, not a recommendation or endorsement (last updated 12 February 2026). In the UK, the FCA register entry for Payward Ltd, read on 5 October 2026, says the Financial Ombudsman Service will not be able to consider a complaint about the firm and the Financial Services Compensation Scheme will not be able to consider a claim against it if it fails.

Can a crypto exchange be authorised by the FCA yet?

Not yet for exchanging or holding cryptoassets such as bitcoin, because in October 2026 the FCA had only just begun taking applications and those activities become regulated only when the new UK regime starts. In the UK, the FCA expects that regime to come into force on 25 October 2027 and says crypto businesses will need its authorisation once it is in place (last updated 30 September 2026). In the UK, applications opened on 30 September 2026 and close on 28 February 2027, and the FCA says firms registered under the Money Laundering Regulations will not be converted automatically. In the UK, some crypto products, such as crypto contracts for difference, are already regulated by the FCA (last updated 16 February 2026).

What does a pending MiCA application mean after July 2026?

In the EU, it means the provider is not authorised under MiCA. In the EU, the MiCA transitional period ended on 1 July 2026, and ESMA said on 23 June 2026 that clients of unauthorised crypto-asset service providers do not benefit from MiCA safeguards, including protections for client assets. In the EU, ESMA invites clients to check in its register whether their provider is authorised and to act promptly if it is not (23 June 2026). In ESMA's EU file of authorised providers, also check the services covered and any withdrawal date.

What does registered mean for a US crypto platform?

In the US, the federal registration the CFTC says cryptocurrency trading platforms must hold is a registration with FinCEN as a money services business, alongside any registration their state requires (April 2023 brochure). In the US, the FBI noted on 25 April 2024 that a business's inclusion on FinCEN's registrant search is not a recommendation, certification of legitimacy or endorsement by any government agency, and the CFTC says registration alone will not protect you from fraud (April 2023 brochure). In the US, for anyone who pitches you an investment, check their background through the SEC's Investor.gov.

Does a padlock or an app-store listing prove a crypto platform is genuine?

No. In the US, the FBI warned on 10 June 2019 that criminals use website certificates so that phishing sites show https and a lock icon, and advised against trusting a website for that reason alone. In the US, the FBI also warned on 25 April 2024 that an app being available in an app store does not necessarily mean it is a legal service. The padlock shows that the connection is encrypted, not who runs the site, so check the register entry, the age of the domain and the name of the app publisher instead.

What should I do if I cannot verify a crypto platform?

Do not deposit, not even a small amount to test the platform. In the UK, the FCA says that if you cannot find a firm on its register, it is unlikely the firm has permission to offer you crypto products and you should avoid using it (last updated 16 February 2026). If you have already sent money, stop sending more, whatever fee or tax you are told will release your balance, and follow the reporting route for where you live.

Financial Disclaimer

This content is not financial advice. All information provided is for educational purposes only. Cryptocurrency investments carry significant investment risk, and past performance does not guarantee future results. Always do your own research and consult a qualified financial advisor before making investment decisions.