Due diligence

A broker safety checklist you can actually use

No checklist can remove market risk or guarantee that a company will never have problems. It can, however, prevent a surprising number of avoidable mistakes: opening the account with the wrong entity, trusting a copied licence number, sending money through an unofficial channel, or discovering the withdrawal rules too late.

The brand is not the legal counterparty

A broker's public name may cover several companies in different countries. The company offered to you can depend on your residence, the website you visit, the product you choose, or the route through which you sign up. Do not assume that a regulation claim made for one group company automatically applies to every account under the brand.

Find the full legal name in the application, client agreement, and account confirmation. If those documents name different entities, stop and ask for a clear explanation before funding. Save the answer and the version of the agreement that applies to you.

01Exact company nameRecord the legal entity, registration or reference number, and registered address—not only the trading name.
02Current regulatory recordConfirm the status directly in the relevant official register and look for restrictions, warnings, or a changed name.
03Correct permissionsCheck that the entity is allowed to provide the particular service or product being offered to you.
04Official contact detailsMatch the website, email domain, address, and phone number rather than trusting details sent in a message.

Use the official register as a matching exercise

A licence number on a website is not proof by itself; numbers and company names can be copied. Reach the regulator's register independently, search for the entity, and compare the details line by line. Pay particular attention to the authorised website and contact information. A look-alike domain can differ by one letter, a hyphen, or an unfamiliar ending.

CheckWhat should matchWhy it matters
Legal nameThe name in the register, signup flow, account confirmation, and client agreement.A legitimate group brand does not prove that the company taking your money is the authorised entity you found.
Status and reference numberA current status and the same number shown in the broker's documents.Records can be suspended, withdrawn, limited, or associated with a different company.
PermissionsThe activities and products the entity is permitted to offer to a client like you.Authorisation for one activity does not automatically cover every service promoted under the brand.
Website and contactsThe domain, phone, email, and address you are using should agree with the official record or be confirmed through it.Clone firms often borrow genuine registration details while directing clients to different contact channels.
Warnings and historyPublic warnings, restrictions, disciplinary records, former names, or linked entities where the register provides them.Context can reveal that you are looking at an old name, an unauthorised clone, or a firm with relevant restrictions.
Complaints and protectionsThe complaint route and any protection scheme that actually applies to this entity, product, and client category.Group-level wording can make protections sound broader than they are. Eligibility varies, so confirm rather than assume.

Read the documents that matter when something goes wrong

You do not need to memorise every paragraph, but you should know where the important answers live. Read the client agreement alongside the fee schedule, order-execution policy, conflicts policy, risk disclosure, withdrawal rules, and complaints procedure. Search for terms such as counterparty, client money, margin close-out, negative balance, inactivity, conversion, termination, and jurisdiction.

Watch for broad clauses that allow the broker to change leverage, close positions, reject instructions, move the account, or revise fees. Some discretion is normal in a trading agreement; the question is whether the rule is clearly described and whether you understand the circumstances in which it can be used.

Lock down the account before you fund it

  • Use a unique password stored in a reputable password manager. Reusing an email-and-password combination from another site is an unnecessary risk.
  • Enable the strongest multi-factor authentication available. An authenticator app or security key is generally preferable to relying on a password alone.
  • Bookmark the verified login page and use that bookmark instead of links in advertisements, direct messages, or unexpected emails.
  • Turn on login and withdrawal notifications. Review trusted devices, active sessions, API keys, and connected applications.
  • Never give a salesperson or support agent your password, one-time code, recovery phrase, or remote access to your device.
  • Keep copies of identity submissions, deposit receipts, statements, withdrawal confirmations, and important support conversations.

Test the payment path while the amount is small

Read the funding rules before making the first transfer. Check which payment methods are accepted, whether the payment account must be in your own name, how currencies are converted, which documents may be requested, and whether withdrawals normally return through the original funding route.

  1. Make a small deposit through a method and provider you recognise.
  2. Confirm that the amount, currency, date, and account holder are recorded correctly.
  3. Place only a few small test trades and download a statement that shows the resulting fees and balance.
  4. Request a small withdrawal before the balance becomes important to you.
  5. Keep every confirmation and resolve any discrepancy before sending more money.

Red flags that deserve a hard stop

  • Pressure to deposit immediately, borrow money, increase the transfer, or keep a “limited” offer from expiring.
  • Guaranteed profits, risk-free trading, secret signals, or claims that losses can be recovered by one more deposit.
  • Payment instructions to a personal account, an unrelated company, or a wallet that is not documented in the official funding process.
  • A request to install remote-access software, share your screen during banking, reveal one-time codes, or hand over a crypto recovery phrase.
  • Contact details that do not match the official register, especially when the caller insists that the register is out of date.
  • An unexplained move to a new domain, platform, or legal entity after you have already completed verification.
  • A withdrawal delay followed by an unexpected demand for a separate payment to “release,” “insure,” or “unlock” your money.

Pressure is not documentation. A genuine answer can be written down, checked, and compared with the official record. Urgency, secrecy, and changing payment instructions are reasons to stop—not reasons to move faster.

What regulation does—and does not—tell you

A current authorisation can show that an entity is subject to rules for specified activities. It does not guarantee profits, eliminate the risk of insolvency, promise flawless execution, or prove that every protection applies to every product and client. Regulation is a starting point for due diligence, not a substitute for it.

Recheck the essentials after a long break, before a large deposit, or whenever the broker asks you to accept new terms. Company names, domains, permissions, payment methods, and account arrangements can change. Treat a move to another entity as a new decision rather than a routine update.

Use independent routes. Type or bookmark the regulator's official address yourself, use the contact details shown in the official record, and compare those results with your own account documents. The broker's website should never be the only source used to verify the broker.