Almost every trading broker describes itself as regulated. The word does a great deal of work in marketing and very little on its own. A licence tells you that one company in a group answers to one regulator for certain activities. It does not tell you whether that company is the one holding your money, what happens to that money if the firm fails, or whether a withdrawal will arrive when you ask for it.
Verifying a broker means answering those questions one at a time, and most of the answers are public. What follows is how the checks work, in the order that tends to surface problems fastest, and where independent audits, such as those published by Trading Business Review, fit in.
Key Takeaways
- A licence belongs to a company, not a brand. The first check is which entity in a broker group you are actually signing with.
- Search the regulator's own register by legal name and licence number, and confirm that the website you are using is one the register lists for that firm.
- Protections differ by entity. UK and EU retail clients get leverage caps, negative balance protection and compensation schemes; most offshore entities offer none of them.
- Read enforcement records with their dates. Recent action over client money weighs far more than an old, minor fine, and a clean record proves less than it seems.
- A small live withdrawal is the most revealing test a trader can run, and the one most often skipped.
- Independent audits, such as Trading Business Review's, add register checks and hands-on testing, but each is a dated snapshot to read alongside your own checks.
- Who: Anyone choosing a trading or CFD broker, and especially traders comparing firms that operate across several jurisdictions.
- What: The checks that show whether a broker can be relied on: the entity, the register, the protections, the enforcement record, withdrawals and independent audits.
- When: Before funding an account, and again whenever a broker moves clients to a different entity, changes licence or rewrites its terms.
- Where: On regulators' own registers and warning lists, in the broker's client agreement, and in published audit reports.
- Why: Because "regulated" describes one company in a group, not necessarily the one that holds your money.
Start With the Entity, Not the Brand
Large brokers are groups. One brand can sit on top of a UK company, an EU company in Cyprus, a firm licensed in Dubai or Australia and an offshore entity in a jurisdiction with much lighter rules. Each company has its own licence, its own client terms and its own level of protection. Which one you join usually depends on where you live, and sometimes on which version of the website you happened to sign up through.
The company you contract with is named in the client agreement, on the account-opening pages and in the small print at the foot of the website. That legal name, rather than the brand, is what you check. When a group leads its marketing with a strong licence while onboarding you through its offshore arm, the strong licence is not the one that covers you.
Check the Register Yourself
Every serious regulator publishes a register. The UK's Financial Services Register lists each authorised firm with its reference number, permissions, trading names and websites. CySEC lists Cyprus investment firms with their licence numbers and approved web domains, and the Dubai Financial Services Authority and Australia's ASIC keep their own. Search by the legal name and by the licence number the broker quotes, and check that the two match each other and the website in front of you.
That last step matters because of clone firms: fraudsters who copy a real firm's name, number and branding onto a website the real firm does not run. Regulators publish warnings about them, among them the FCA's Warning List, and IOSCO's I-SCAN portal, launched in 2025, gathers alerts from securities regulators around the world in one place. A licence number that checks out, on a domain the register does not list, is a warning sign in itself.
What the Licence Actually Protects
Once you know the entity, look up what its regime gives a retail client. In the UK and the EU, retail CFD clients get leverage caps (30:1 on major currency pairs), negative balance protection, segregated client money and a ban on trading bonuses. If a firm fails, clients of UK firms can claim from the Financial Services Compensation Scheme, up to £85,000 per person per firm, and clients of Cyprus firms from the Investor Compensation Fund, up to €20,000 or 90% of the claim, whichever is lower.
Offshore entities typically offer none of that: higher leverage, bonuses and no compensation scheme behind the account. For an experienced trader that can be a lawful and deliberate choice, but it should be made knowingly. The useful question is not whether the group is regulated, but whether the protections you are counting on apply to your account.
| What you are checking | Where to find it |
|---|---|
| Which company you are signing with | Client agreement, account-opening pages, website footer |
| That the licence is real, current and covers this website | The regulator's own register |
| Clone sites and firms operating without authorisation | FCA Warning List, IOSCO I-SCAN |
| What you could recover if the firm failed | FSCS, Investor Compensation Fund, or none |
| How the firm has behaved, and how recently | Regulator announcements and fines |
| Whether money comes back on time and in full | A small live withdrawal |
Read the Enforcement Record With Dates
Regulators publish fines, settlements and licence actions. A broker with a decade or more of history will often have something on the record, and the date and substance matter more than the existence of an entry. A small fine from many years ago reads very differently from recent action over client money, or from a licence suspended as a sanction.
The reverse holds too. A clean record is encouraging, but the absence of a published finding is not proof of good conduct; it only means nothing has been published. Licences also change for ordinary commercial reasons, as HTFX's exit from Cyprus showed, so the reason behind a change matters as much as the change itself.
Test the Withdrawal
Paperwork cannot tell you how a firm behaves when you ask for your money back. A small live test can. Fund an account with an amount you are comfortable losing, place a trade or two, and request a withdrawal. Note how long it takes, whether fees appear that were not disclosed, and whether the money returns to the account it came from.
Most complaints about brokers are, in the end, complaints about withdrawals. That makes this the most telling check of all, and the one most traders skip.
Where Independent Audits Fit
Doing every check above, for every broker on a shortlist, takes time, and few traders can open live accounts at several firms to compare them. That is the gap independent broker audits try to fill. Trading Business Review publishes audits that ask a single question, whether a client can rely on a firm, and score the answer across seven pillars: regulation and licensing, corporate structure and ownership, client money and payouts, execution and pricing, conduct and disclosure, operational resilience, and people and community. The weighted score maps to a grade from AAA down to C, and every audit follows the same published methodology.
TBR publishes two kinds of audit. Desk audits are carried out on its own initiative from public sources: registers, enforcement records, filings and the firm's own documents. Verified audits add the firm's own evidence and hands-on testing, with TBR's trading experts funding real accounts, placing trades and withdrawing money. The methodology sets out how each kind is arranged and paid for, and a firewall that keeps fees and commercial contact away from the people who grade. The Verified mark describes how an audit was done, never the result, and every audit is published whatever the grade.
The first Verified audit, of XM, shows what the format adds. Published in October 2026, it graded the broker AAA, with a score of 83 out of 100. TBR confirmed the group's UK, Cyprus and Dubai licences on the regulators' own registers, and in live testing on 2 October a withdrawal was paid out on the same day it was requested. The report is just as specific about the weaknesses. The group also onboards clients through XM Global Limited, licensed in Belize, whose clients sit outside any compensation scheme, and its lowest pillar score was for corporate structure, because the group is privately held and its group accounts were not among the public sources. A CySEC fine from 2013, reported at €5,000, is recorded but not scored, because it is more than eight years old.
Just as useful is what the report says it cannot tell you. Live testing covered one account over a single day, and an audit stays current for twelve months before it has to be renewed. That is the right way to read any audit: as a dated, evidence-based snapshot that narrows your own checks rather than replacing them. The full XM report lists every finding, licence and source.
A Short Checklist Before You Fund an Account
- Find the legal entity you are signing with, and check it on the regulator's register by name and licence number.
- Confirm the website you are using is a domain the register lists for that firm, and search the warning lists.
- Look up what that entity's regime gives you: leverage limits, negative balance protection, segregated client money and compensation.
- Read the enforcement record with dates, giving most weight to recent actions over client money or licences.
- Test a withdrawal with a small amount before committing more.
- Use independent audits and reviews to narrow the list, and check the date and scope of each one.
What This Means for Traders
Regulation sets the minimum standard. The trust that matters is built on evidence a client can see for themselves, a theme we explored in why forex broker trust is no longer built by regulation alone. Licences change hands and firms leave jurisdictions, so a check done once is not a check done for good. Our directory of brokers and trading platforms lists firms with their licences, as a starting point for your own checks.
Trading CFDs and other leveraged products carries a high risk of losing money quickly, and most retail accounts lose money. Nothing here is a recommendation to open an account with any firm. XM is a Preferred Partner in The Luxury Playbook directory.
We last reviewed this analysis on 17 October 2026.
