Due diligence is the check you perform before entrusting money, data, or orders to someone. It is not a search for positive reviews; it is a comparison between independent information and the platform's claims.
In plain terms — You need evidence that the entity exists, that it may provide the specific service, and that you are genuinely dealing with that entity.
The five checks
1. Legal entity
Read the contract, terms, and account disclosure. Record the legal name, country, address, and identifying number. A brand displayed in an app may be used by several group companies with different permissions and protections.
2. Service and permission
Start from the competent authority's website and open its official register. Check that the entity is active and authorised for the service you intend to use: receiving or executing orders, dealing on own account, custody, or another activity. A register entry does not mean that every product may be offered in every country.
3. Official contact details
Compare the domain, phone number, email address, and physical address with the register. If they differ, contact the firm only through the official details. A clone can copy an authentic firm's name, logo, licence number, and documents.
4. Custody and protections
Ask who holds the cash and instruments, how the accounts are titled, which sub-custodians are involved, and what happens to withdrawals or transfers in a crisis. Client asset protection distinguishes segregation, custody, and compensation.
5. Current status and warnings
Search the national authority's warnings and, for a cross-border offer, check international resources such as IOSCO I-SCAN. Absence from a warning list does not prove legitimacy: no list can be complete or instantaneous.
How to interpret the outcome
The process does not produce a “safe” badge. It produces a file of facts: the identity, authorised perimeter, authentic channel, asset structure, contractual conditions, and status observed on a specific date.
An identity mismatch, a missing permission for the proposed service, or contact details inconsistent with the register prevents the check from being completed. Do not deposit until an independent source resolves the issue. An operational risk or a limited protection calls for an exposure decision, not an allegation of fraud.
Common mistake — Searching for the brand, finding a similar name in a register, and stopping there. The entity, service, permission, contact details, and date must all match.
Worked example
An advert links to alpha-invest.example and displays the licence number of
“Alpha Investments Ltd”. The firm exists in the register, but its official
domain and phone number are different. The proper check is to call the number
in the register and ask whether the advertised domain belongs to the firm. The
mere existence of the licence does not authenticate the website in the advert.
The same logic applies to exchanges, crypto apps, and advisers. Registers and legal categories vary; the need to match the entity, activity, jurisdiction, and channel does not.
Verification continues after opening the account
Save the contract, terms, execution policy, and register result together with the date checked. Review any change in contractual entity, domain, authorisation, fees, custodian, payment instructions, or withdrawal rules. Broker risk also includes continuity, routing, access to assets, and complaint handling.
For crypto-assets in the European Union, MiCA changed the applicable regimes and registers. The maximum transitional period ended on 1 July 2026. A provider's current status must therefore be checked in the updated register and with the competent national authority, without reusing outdated claims about grandfathering.
Sources
- ESMA — Is the firm regulated? — access to European authorities' registers.
- ESMA — Markets in Crypto-Assets Regulation — MiCA register and information for firms and investors.
- ESMA — Statement on the end of transitional periods under MiCA — the transitional period ended on 1 July 2026.
- FCA — How to check a firm or individual is authorised — permissions, status, contact details, and clone checks.
- CFTC — Check Registration — intermediary registration checks in CFTC-regulated markets.
- Investor.gov — Ask and Check — independent checks on an investment professional and an investment.
- IOSCO — I-SCAN — international alerts about unauthorised entities and clones; the list is not exhaustive.
Sources whose status can change were checked on 18 August 2026. Registers, permissions, and warnings must be checked again on the date of the decision.