Legit/Regulated Exchanges

Loading broker comparison data…

What Broker Regulation Actually Covers

Regulation is not a single binary status — it is a stack of overlapping protections, each governed by different rules and covering different failure scenarios. A broker can be genuinely registered with the SEC or CFTC while still exposing clients to significant risk through poor custody design, inadequate capital reserves, or a license that does not extend to the products you are trading. Understanding what each layer of regulation covers — and what it explicitly does not — is the starting point for any serious due diligence process.

The major regulatory categories each address a distinct slice of client protection. Conduct regulation (FCA, ASIC, SEC) governs how a firm must treat clients: suitability obligations, order execution standards, disclosure requirements, and restrictions on misleading promotions. Prudential regulation sets minimum capital thresholds the firm must maintain to meet obligations — the SEC's net capital rule for broker-dealers, for example, requires a specific liquid-asset ratio computed daily. Compensation schemes (SIPC in the US, FSCS in the UK, ICF in Cyprus) operate as a separate insurance layer that only activates on firm insolvency, and coverage amounts differ materially by jurisdiction. None of these protections apply to market risk: if you hold a losing position, no regulator will reimburse you.

• Tier-1 Regulators — The SEC, CFTC, FCA, ASIC, MAS, and BaFin are the gold standard because they maintain public registries, enforce capital requirements, and operate compensation schemes. A broker regulated only in Vanuatu, Marshall Islands, or Saint Vincent and the Grenadines offers no meaningful client protection; those jurisdictions issue licenses as a revenue exercise with no substantive oversight.
• License Scope — A license authorizes specific activities, not all financial services. An FCA-authorized firm might hold a license for investment advice but not for executing CFD orders as principal; a CFTC-registered introducing broker cannot hold customer funds. Always confirm the license category matches the service you are using — check the FCA's "Regulated Activities" tab or the CFTC's registration status page, not just the firm's marketing page.
• Client Money Segregation — MiFID II in the EU and FCA CASS rules in the UK require that retail client cash be held in a segregated account at an approved bank, separate from the firm's operational capital. In practice, some firms use "title transfer collateral arrangements" (TTCAs) that legally transfer asset ownership to the firm, bypassing segregation — read the client agreement carefully for this language.
• Investor Compensation Schemes — SIPC covers up to $500,000 per customer (including $250,000 cash) for US broker-dealer failures, but does not cover commodity futures or forex accounts held at an FCM. The UK FSCS covers up to £85,000 per eligible claimant. CySEC's ICF covers up to €20,000. These caps matter if you hold a large balance at a single firm.
• Leverage Caps — Regulation directly dictates the maximum leverage available to retail clients. ESMA rules in the EU cap retail forex leverage at 30:1 for major pairs; US CFTC/NFA rules cap retail forex at 50:1 for majors and 20:1 for minors; ASIC caps retail CFD leverage at 30:1 for forex majors. Higher leverage offers from an "offshore" account at the same brand often indicate the client is being moved outside the regulated entity.

The practical conclusion is that no single data point confirms legitimacy. A firm can be technically registered while routing your orders through an unregulated subsidiary, holding your cash in a non-segregated account, or using a license category that does not cover your instruments. The verification process must cover the specific entity you are contracting with, the specific license type, and the specific products you intend to trade.

How to Verify Regulatory Status Step by Step

Every tier-1 regulator maintains a freely searchable public registry, and each takes less than five minutes to query if you know the firm's legal entity name. The critical discipline is to search the regulator's own database, not the broker's "About" or "Regulatory" page — clone firms routinely copy legitimate registration numbers and paste them into their own websites. The verification sequence below covers the five most commonly cited jurisdictions.

For US clients, the two primary lookups are FINRA BrokerCheck (finra.org/brokercheck) for broker-dealers and investment advisers, and NFA BASIC (nfa.futures.org/BasicNet) for commodity pool operators, FCMs, and forex dealer members. BrokerCheck shows registration history, disclosure events, qualifications, and employment history for both firms and individual registered representatives. NFA BASIC displays the firm's registration categories, any reparations cases, and whether the entity is currently in "good standing" — look specifically for the "Firm Actions" tab, which shows past sanctions. For FCA-regulated firms (UK), use the Financial Services Register at register.fca.org.uk, search by firm name or reference number, and check the "Permissions" tab to confirm the exact regulated activities. The ASIC register is accessible at asic.gov.au/check; enter the Australian Financial Services (AFS) licence number and verify the "Authorised Financial Products" section covers the product category you intend to trade. For MAS-regulated firms in Singapore, use MAS's Financial Institutions Directory at mas.gov.sg/financial-institutions.

• FINRA BrokerCheck — Search by firm name and confirm the CRD number matches what the broker publishes on its own site. A mismatch or a number that returns no results is an immediate red flag. The "Disclosures" section will show customer complaints that resulted in arbitration awards, regulatory sanctions, and criminal disclosures — one or two old customer complaints is normal for a large firm; multiple sanctions or a pattern of fraud-related disclosures is not.
• NFA BASIC for Forex/Futures — US retail forex must be conducted through an NFA-registered Forex Dealer Member (FDM). The NFA maintains a specific list of current FDMs; if a broker claiming to operate in the US is not on that list, they are operating illegally. Check NFA BASIC for "Forex Dealer Member" under registration type — not just "NFA Member," which is a broader category that does not authorize forex dealing.
• FCA Warning List — The FCA publishes a regularly updated Warning List of firms operating without authorization or using clone tactics (fca.org.uk/consumers/warning-list). Search the warning list separately from the register; a firm can appear on the warning list without having a known registration number. The FCA also publishes "ScamSmart" guidance specifically for clone firm identification, including how to verify callback numbers and email domains.
• Clone Firm Red Flags — Clone firms copy the name, registration number, and sometimes the website design of a legitimate regulated entity. Cross-check the firm's published FRN or CRD number by searching it in the official registry and confirming the registered address and contact details match. If the broker's phone number, email domain, or mailing address differs from the registry record, you are likely dealing with a clone.
• Offshore and Non-Jurisdiction Red Flags — Offers of leverage above 500:1, no address on the website, payment requests via cryptocurrency or wire transfer to a personal account, and registration in jurisdictions such as Saint Vincent, Vanuatu, or the Comoros are each standalone disqualifiers. These are not exotic edge cases — the FTC and FCA each document hundreds of complaints per year from victims of such schemes.

Once you have confirmed the regulatory status, record the registration number, the specific regulated entity name, and the date of the check. Regulatory status can change — licenses are suspended, transferred to different entities after acquisitions, or narrowed in scope following enforcement actions. Setting a calendar reminder to recheck once per quarter, and immediately following any significant news about the firm, ensures your due diligence remains current.

Official Verification, Not Marketing

Every major fraudulent broker caught by regulators in the past decade displayed some version of regulatory badges on its website. The badges looked real, the registration numbers were plausible, and the customer service staff confidently cited them when challenged. None of it was true. The only reliable data source is the regulator's own public registry — not a screenshot, not a PDF the broker sends you, and not a third-party review site whose business model depends on affiliate commissions from the same brokers it rates.

The verification process takes five to ten minutes per broker and requires nothing more than a browser. Navigate to the official regulator website (links: finra.org/brokercheck, nfa.futures.org/BasicNet, register.fca.org.uk, asic.gov.au/check, mas.gov.sg/financial-institutions). Enter the firm's legal entity name — not its trading name, which is often different — and cross-reference the registration number the broker publishes on its own site. Confirm the number maps to the entity whose website you are on, not to a different entity in a different country. The FCA's website, for example, shows you the exact registered address and telephone number for the authorized firm; if those differ from what the broker shows on its contact page, you are likely dealing with a clone.

A licensed broker has no incentive to obscure any of this information, and legitimate firms will readily direct you to their official registration records. If a firm hesitates, provides only a PDF rather than a registry link, or claims the registry is "temporarily unavailable," treat that as a disqualifying red flag — not a minor inconvenience.

• Go directly to the regulator's official URL — Type it manually or use a verified bookmark; phishing sites mimic regulator URLs with subtle misspellings. The real FCA register is at register.fca.org.uk — not fca-register.com or any domain other than fca.org.uk.
• Search by legal entity name, not trading name — Interactive Brokers LLC is the FINRA-registered entity; "IBKR" is a trading brand. Saxo Bank A/S is the Danish FSA entity; its UK sub is Saxo Capital Markets UK Limited, FCA-authorized. Always confirm which legal entity you are opening an account with.
• Match the registration number the broker publishes — Copy the number from the broker's website footer or regulatory disclosure page, then search it in the official registry. A mismatch — or a result showing a different firm at a different address — means the broker is using a stolen or fabricated registration number.
• Check the license scope, not just the existence of a license — An FCA-authorized firm's record shows its specific "Regulated Activities" — for example, "Dealing in investments as principal" (required for CFD issuers) versus "Arranging deals in investments" (a much narrower permission). If the activity listed does not match the product you are trading, the firm is operating outside its license for that product.
• Review disclosed enforcement actions and warnings — FINRA BrokerCheck's "Disclosures" tab, NFA BASIC's "Firm Actions" tab, and the FCA's enforcement actions page (fca.org.uk/news/search-results) each list past sanctions. A pattern of customer harm findings, repeated fines, or a suspension — even a historic one — warrants scrutiny proportional to the amounts you intend to deposit.
• Verify the NFA Forex Dealer Member list for US forex accounts — NFA maintains a specific approved list of Forex Dealer Members at nfa.futures.org. If a firm claims to offer retail forex in the US but does not appear on that list, it is operating in violation of CFTC regulations regardless of any other registration it holds.

Custody And Operational Risk

Regulatory status confirms that a firm is authorized to operate; it does not, by itself, confirm that your assets are safe if the firm fails. The collapse of MF Global in 2011 — a CFTC-registered Futures Commission Merchant — resulted in a $1.6 billion shortfall in customer segregated accounts after the firm transferred funds to cover proprietary trading losses. Customers waited years for partial recovery. MF Global was registered, audited, and publicly traded. The lesson is that registration and custody design are separate issues, and both require independent verification.

The key custody question is whether your cash and securities are legally isolated from the firm's own capital. Under FCA CASS rules, a UK-authorized firm must hold retail client money in a segregated bank account designated as a "client money account" and must perform daily internal reconciliations. The practical check: find the "Client Money" or "Segregation" section of the firm's terms and conditions and look for the specific language confirming CASS compliance. Also look for "title transfer collateral arrangements" (TTCA) language, which — if present — means the firm can legally use your cash as its own, bypassing segregation protections entirely.

For crypto exchanges, the custody picture is materially different and generally weaker. Most crypto exchanges do not hold client assets at a custodian bank and are not subject to CASS or equivalent segregation rules. The FTX collapse in November 2022 illustrated this: customer assets nominally held on the exchange were commingled with Alameda Research trading capital, and billions in customer funds were unrecoverable. When evaluating a crypto exchange, look specifically for Proof of Reserves audits by a reputable accounting firm, the jurisdiction of the custodian holding cold-storage assets, and whether the exchange maintains a user protection fund (Binance SAFU, for example, holds over $1 billion).

• Client Money Segregation Confirmation — Ask the broker directly or check the terms: which bank holds client money, under what account title, and under which regulatory rule? A response of "your funds are held in a pooled client account at Barclays under CASS 7" is informative; a vague response referencing the firm's own "secure vault" is not.
• Investor Compensation Scheme Coverage — SIPC covers up to $500,000 per customer for US broker-dealer insolvency (not market losses), including up to $250,000 cash. The UK FSCS covers up to £85,000. CySEC's ICF covers up to €20,000. None of these schemes cover commodity futures accounts, retail forex accounts at FCMs, or crypto exchange balances — confirm whether your account type is within scope before assuming coverage applies.
• Net Capital and Reserve Requirements — The SEC's net capital rule (Rule 15c3-1) requires broker-dealers to maintain liquid assets above a minimum threshold computed daily; firms must notify the SEC if they drop below. Ask the broker whether it publishes its net capital computations or annual PCAOB-audited financial statements. Firms that refuse to disclose financial health data should be treated with significant caution.
• Withdrawal Terms and Lockup Risk — Read the broker agreement for any clauses that allow the firm to delay or suspend withdrawals. Some forex and crypto firms include "market dislocation" or "liquidity event" clauses that permit them to freeze accounts with no liability. These clauses are common in offshore jurisdictions and are specifically absent from FCA and ASIC-regulated client agreements by regulatory requirement.
• Title Transfer vs. Segregated Custody — A title transfer arrangement means you are an unsecured creditor of the firm, not the legal owner of assets held in your name. This distinction is consequential only in insolvency — but insolvency is exactly when it matters most. If you see TTCA language in a retail client agreement for a standard brokerage account, that is a serious structural risk that regulation itself does not protect you against.
• Proof of Reserves for Crypto Exchanges — Coinbase publishes quarterly proof-of-reserve attestations. Kraken has conducted third-party Proof of Reserves audits since 2014. Binance publishes a Merkle tree-based reserve proof monthly. For any crypto exchange where you hold a material balance, verify the most recent proof-of-reserves report and confirm the attestation was performed by a recognized accounting firm — not merely a self-published spreadsheet.

Continuous Monitoring

A regulatory check performed at account opening can become outdated within months. Licenses are suspended after enforcement actions; firms are acquired and their regulated entities restructured; brokers voluntarily withdraw authorizations from certain jurisdictions when compliance costs rise. Saxo Bank, for example, restructured its European entities in 2020 following MiFID II implementation, transferring UK client relationships to a new FCA-authorized entity. Clients who had not noticed the entity change found their regulatory protections technically unchanged — but the legal entity backing those protections was different. Staying current with these changes requires a structured monitoring process, not just an initial lookup.

The most efficient monitoring approach combines automated alerts with a quarterly manual verification cycle. Google Alerts set to "[broker name] regulatory" and "[broker name] enforcement" will surface most material news within days. Regulator websites publish enforcement actions publicly and with reasonable timeliness — the FCA's enforcement page is updated weekly; NFA BASIC's "Firm Actions" tab updates within days of a new action. For firms operating in multiple jurisdictions, you need to monitor each relevant regulator separately, since an enforcement action in one jurisdiction does not automatically appear on another regulator's record.

Ownership and corporate structure changes deserve particular attention. When a broker is acquired, the acquiring entity may or may not maintain the original regulatory authorizations. Interactive Brokers' acquisition of Folio Investing in 2020, for example, was handled with a clean transfer of accounts to the IBKR entity. Less careful acquisitions have resulted in accounts being transferred to less-well-capitalized entities with narrower regulatory coverage. Check FINRA BrokerCheck and other registries for ownership history and note any changes in the registered agent or control persons — these are indicators of structural shifts that may affect your protections.

• Quarterly Registry Recheck — Set a calendar event once per quarter to revisit the official registry entry for each broker you use. Confirm the registration is still active, the license scope is unchanged, and the registered address and contact details match the broker's current website. This takes less than five minutes per broker and is the single most reliable early-warning indicator.
• Enforcement Action Monitoring — Subscribe to the FCA's enforcement actions RSS feed, NFA's "Recent Notices" page, and the CFTC's enforcement actions press release list. A new enforcement action against a broker does not necessarily require immediate account closure, but it warrants a careful review of the nature of the violations and whether they involve custody, fraud, or capital adequacy — the categories most directly relevant to your asset safety.
• Terms and Conditions Change Notifications — Brokers are required by most regulators to provide advance notice of material changes to client agreements. When you receive a T&C update notification, read it — specifically for any changes to the segregation policy, leverage terms, compensation scheme membership, or withdrawal rights. These notifications are frequently ignored, but they are legally significant acknowledgments from the broker that something has changed in your contractual relationship.
• Ownership and Acquisition Alerts — Track corporate filings in the broker's home jurisdiction. In the US, ownership changes for registered broker-dealers are disclosed in Form BD amendments filed with FINRA. In the UK, FCA-authorized firms must notify the regulator of material ownership changes. These filings are public and often predate any press announcement.
• Warning List Sweeps — The FCA's Warning List, the CFTC's fraud advisories, and NFA's "News/Notices" page each publish alerts about unregistered firms, clone operations, and pump-and-dump schemes. Even if you are not actively considering a new broker, reviewing these lists monthly will alert you to emerging tactics being used in your trading space — forex, crypto, and options each have distinct fraud patterns that regulators document in real time.
• Post-Announcement Immediate Reviews — Trigger an immediate out-of-cycle verification following any public news event: a regulatory fine, a change in CEO or CFO, a significant withdrawal of capital from the firm, or a sudden change in account terms. These events do not necessarily indicate imminent insolvency, but they are the precise circumstances under which quick due diligence has historically made the difference between recovering assets and becoming an unsecured creditor in bankruptcy proceedings.