Why should a business check a firm before money moves?
A business should check a firm before money moves because the check takes an afternoon and a wrong payment can cost the whole amount. Money sent to the wrong account is often never recovered. Companies may also have fewer protections than private investors: in some countries, larger businesses can't use the same complaint or compensation schemes.
The check protects the people who sign, too. A director who approved a payment to a firm nobody verified will have to explain that to the board, the auditor and perhaps the insurer. A dated record of who checked what, against which source, is ordinary good governance whatever happens next.
Check every new firm. Re-check existing ones whenever something changes: new contact details, a new bank account, a new product, a new person dealing with you. Fraudsters often slip into an existing relationship rather than start a fresh one, which is why a sudden change of payment route sits high on our list of investment fraud red flags.
How do you check a firm on the regulator's register?
Open the financial regulator's public register by typing its address yourself, then search for the firm's full legal name and reference number. Confirm the status is current, the permissions cover the service offered to your company, and the contact details match. Most financial regulators publish a searchable register of the firms they authorise.
Reach the register yourself
Type the regulator's web address or use a bookmark you trust. Don't follow a link from the firm: fake register pages exist, and they look convincing.
Match the exact legal entity
Search by full legal name and by reference or licence number. It must be the same entity named in the contract you're being asked to sign, not a sister company or a near-identical name.
Read the status
You want a current status, such as authorised or registered. Cancelled, lapsed or 'no longer authorised' means the firm can't offer you regulated services. If it acts as an agent of another firm, look that firm up as well.
Compare permissions with the service
Registers list what each firm may do: dealing, arranging, managing investments, advising, holding client money. Permission to arrange insurance, say, tells you nothing about whether it may handle your company's cash.
Check where it may operate
For a firm based abroad, search its home regulator's register too, and confirm it's allowed to serve businesses in your country.
Bookmark the register of the regulator in the firm's country, and of any country where it says it can serve your company, so you never rely on a link somebody sent you.
How do you spot a clone firm?
You spot a clone firm by comparing every contact detail you've been given with the regulator's register. A clone copies a genuine firm's name and reference number, so the register search looks clean. The difference shows in the phone number, email domain or website. Ring the real firm on its registered number and ask who you're dealing with.
A fictional example shows how small the gap can be. An adviser emails your finance director about a deposit platform. The firm named in the signature is on the register, with the right reference number. But the email domain has an extra hyphen, the website ends in .com where the register shows .co.uk, and the phone number is a mobile where the register lists a switchboard. That's a clone.
Make the call-back a fixed rule, not something people decide case by case. Use a number from the register or from documents you already hold, never one from the email, letter or website you were sent. Ask the firm to confirm the name of the person who contacted you, the product on offer and the bank account it would ask your company to pay. If the real firm has never heard of them, tell the regulator.
What do warning lists and company registers tell you?
Warning lists and company registers fill in the picture, but neither proves a firm is genuine. A regulator's warning list names firms it has flagged as unauthorised or suspected scams. A company register confirms that a company exists, who runs it and whether it files accounts on time. Only the regulator's main register shows authorisation.
Search warning lists by the firm's name, its website and its phone number, because scam outfits rename themselves often. A match means stop. No match means only that nobody has reported this one yet. International groupings of securities regulators also combine warnings from many countries into a single search, which helps when a firm claims to be based abroad.
On the company register, look for facts that don't fit the story you've been told. A firm boasting twenty years' experience but incorporated last spring. Every director replaced last month. Accounts overdue. A registered office at a mail-forwarding address. None of these proves fraud on its own. Each needs a convincing answer before you go any further.
Who will hold your company's money and investments?
Before paying, find out exactly who will hold your company's money and investments, and in whose name. Normally that's a regulated custodian or bank, keeping client assets apart from the firm's own money. Get the custodian's name, look it up on the register as well, and make sure the account is in your company's name.
Put these questions to the firm in writing, and keep the answers with your checklist.
- Which account will we pay, and is it in the name of the firm or its custodian, exactly as the signed agreement states?
- Is our money kept separate from the firm's own, and what happens to it if the firm fails?
- Will statements or online access come to us directly from the custodian or platform, and not only as reports from the person selling to us?
- How do withdrawals work, how long do they take, and can money only ever be paid back to our own nominated account?
Never pay an individual, whatever the explanation. For spare cash these answers matter as much as the rate, which is why our safe investing work for company cash puts access and safety ahead of any return.
What should a written due-diligence checklist include?
A written due-diligence checklist records each check, the evidence, who did it and when. At minimum it covers the register entry and permissions, contact details, the call-back, warning list and company register searches, the custodian, fees and terms, and any conflicts of interest. It's filed with the payment approval, so the approver sees it.
| Check | What to record | Stop if |
|---|---|---|
| Regulator's register | Firm name, reference number, status, date checked | Not listed, or status not current |
| Permissions | The permissions that cover this service | The service isn't covered |
| Contact details | Website, phone and email compared with the register | Any detail differs |
| Call-back | Number used, who you spoke to, what they confirmed | The firm doesn't recognise the contact |
| Warning lists | Lists searched, search terms, result | The name, website or number appears |
| Company register | Date formed, directors, filing record | The record doesn't match the story |
| Custody | Custodian, account name, how withdrawals work | Payment to a third party or a person |
| Terms, costs and conflicts | Fees, notice periods, who else pays the firm | Anything material isn't in writing |
Adapt the list to your company. If cash is spread across several banks or funds, add the limit that applies to each; our guide to business cash reserves explains how to set those limits. The same checks work on a lender or investor who approaches you, with a few additions covered in how to check that a funder is genuine.
Who should sign off before money moves?
Sign-off should come from someone other than the person who found the firm, with board approval for any new firm or any amount above a set limit. The approver reads the completed checklist, not the sales brochure. No payment goes until the checklist, the signed agreement and the bank details all agree with each other.
Put this in a short written policy: which checks are required, who may approve, which amounts go to the board, and how often existing firms are re-checked. Once a year is a sensible minimum. A change of contact or bank details triggers an immediate re-check.
After that, your ordinary payment controls take over: two people to release the money, and the receiving account confirmed on a number you already hold. Our guide to invoice and payment fraud sets those controls out in full.
Which official records should you bookmark?
- The public register of the financial regulator in the firm's country: authorisation, permissions, status and registered contact details.
- The register of any other country where the firm says it can serve your company.
- The regulator's warning list of unauthorised firms and clones.
- The official company register in the firm's country: when the company was formed, who its directors are and whether it files accounts on time.
Open each one by typing its address yourself or from a bookmark, never through a link in an email or message.
How can Ledgantic help?
Ledgantic helps your company build its own due-diligence routine: the checklist, a short policy on who checks and who approves, and a record format your auditor can follow. If a particular firm, fund or broker is in front of you now, we can run the checks and give you a written record of what was confirmed and how.
Only you pay us, so the firm being checked has no influence over what we write. This work belongs to our safe investing service, and the other projects we take on are listed on our services page. Get in touch with the firm's name and how it approached you; the introductory consultation is where we agree the scope and the fixed fee.