A Regulator Logo Is Not Identity Proof: Verify the Exact Firm and Domain

Treat Every Logo as a Claim

What can a displayed regulator logo establish alone?

A displayed regulator logo establishes only that an image or regulatory association is being presented. It does not, by itself, authenticate the operator, prove that the domain belongs to an authorised firm, establish permission for the advertised service or show that a particular use of the logo is licensed.

The FCA states that its logo is a registered trademark and its use is controlled. That makes display a fact to check, not identity evidence. Exact official records and current contact details carry the comparison.

Evidence. The FCA logos page and GEN 5.1 support controlled use. They do not classify an unnamed display as licensed or lawful.

Apply a simple independence test to each reassuring cue: could the website operator have placed it there without the regulator confirming this exact page? Preserve such cues as presented claims, then seek evidence controlled by a source independent of the presentation.

Fictional example. A badge and reference number look coherent, but who controls the page remains unknown. Record PRESENTED_CLAIM, not verified identity.

Risk or failure. The page’s logo, number and link cannot prove one another. Design and HTTPS do not repair that circular evidence.

Checklist.

• Label every badge, number and status statement as presented evidence.
• Do not copy the page’s link into your official-source route.
• Keep licence, identity, permission and consumer protection as separate questions.

Once the trust furniture is demoted to a claim, the next task is to freeze exactly what the page is claiming.

Capture the Presented Identity First

Which identity fields should you record before searching?

Record the displayed legal entity, trading name, firm reference number, full hostname, redirects, email domain, telephone number, address, exact product or service, source URL and retrieval time as separate fields. Preserving the original presentation prevents later searches from silently changing what you thought you saw.

Capture controls evidence; it does not authenticate. The FCA warns that names, addresses or reference numbers may be copied while contacts or websites differ. Separate fields expose those differences.

Evidence. FCA clone-firm guidance describes copied identities, altered websites and different contacts. A mismatch still does not prove cloning, fraud or intent.

Use a two-column worksheet headed Presented and Official. Fill the presented column before opening the FCA route, retaining spelling, spaces, country codes, path redirects and the final hostname reached. Leave the official column blank until independently retrieved. This order prevents the official record from unconsciously “correcting” what was actually displayed and gives a second reviewer a replayable comparison.

Fictional example. A page presents “Example Markets”, FRN 000000 and accounts.example-markets.test. These invented placeholders show why each field must remain separate.

Risk or failure. Memory normalises small variations. Writing only “the name matched” can hide a changed suffix, extra subdomain or contact digit.

Checklist.

• Capture names exactly, including punctuation and suffixes.
• Record the hostname separately from the page title and displayed brand.
• Preserve email, telephone, address and exact service in separate rows.
• Retain the source URL, date, time and any redirect.

With a frozen presentation, you can open the regulator’s route without letting the page choose the evidence source.

Open the Official FCA Route Independently

Which FCA source answers each verification question?

Where a service is within the FCA’s remit, or a presentation claims FCA-regulated status, use the FCA Firm Checker for the consumer check of current authorisation and permission for that service. Use the Financial Services Register for fuller or historical regulatory records. Open the route independently, retain the official URL and time, and never treat a firm-level status as permission for every activity.

The FCA distinguishes authorised and registered statuses and says an authorised firm can also offer services outside regulation. Identity, status, exact permission, restrictions and possible protection therefore need separate evidence.

Evidence. FCA checking guidance defines the consumer route; the Register landing page describes its scope. Its application returned a CSS-error shell during research, so no named result was inferred.

If the presentation refers to an appointed representative, do not stop at the representative’s appearance in a record. Check the activities its principal has permitted and seek confirmation through independently retrieved official details where anything is unclear. Companies House or directory evidence may corroborate a corporate name, but it cannot replace the FCA status, exact-service permission and contact-route checks.

Fictional example. A made-up worksheet matches a name, but the exact service is absent from permission wording. Keep that field INCONCLUSIVE.

Risk or failure. “Authorised” and “registered” are not interchangeable. The Firm Checker says updates average about 24 hours and firm-supplied information can contain errors; this is not a fixed upper limit.

Checklist.

• Type or navigate to the known FCA route independently.
• Preserve the exact status wording, permission and restrictions.
• Record the official URL and retrieval time.
• Mark inaccessible or ambiguous evidence CONTROLLED_UNAVAILABLE or INCONCLUSIVE.

The official record supplies a comparison side; the next section tests whether the presented domain and contacts actually align with it.

Match Domain and Contacts Character by Character

How do you compare official and presented contact routes?

Compare the full presented hostname, email domain, telephone number and address with the independently retrieved official details, character by character. Initiate any confirmation through the official route, not through a link or number supplied by the page. One matching field cannot cancel a material mismatch elsewhere.

Compare hostname, subdomain, top-level domain and redirects. Check email domains separately from display names and retain complete telephone and address details. Another reviewer should be able to replay the comparison.

Evidence. FCA guidance requires contact matching. NCSC guidance explains that branding can be duplicated and domains made deceptive; it does not determine FCA status.

Compare in a fixed order: legal entity, reference number, hostname from right to left, email domain, telephone number, postal address and exact service. Mark every row separately rather than issuing one overall tick. If clarification is needed, start a fresh contact using the official record; do not reply to the presented email or ask the presented caller to verify itself.

Fictional example. If fictional example.test redirects to example-support.test, record MISMATCH and clarify through official details without alleging fraud.

Risk or failure. Rankings, adverts, padlocks and similar spelling can mislead. Asking the presented contact to authenticate itself repeats the evidence loop.

Checklist.

• Compare hostnames from right to left and inspect every suffix.
• Compare email domains independently from sender display names.
• Compare numbers and addresses without “close enough” matching.
• Start clarification through the official contact route only.

Even exact contact alignment has limits, so warning evidence must be added without turning silence into clearance.

Read Warning Evidence Asymmetrically

What does a warning or no search result mean?

A relevant FCA Warning List entry is material attributed evidence that must be read and retained in its exact scope. No result is only an absence from that search at that time. It does not prove authorisation, legitimacy, safety, quality or that the FCA has no concern.

The FCA explains that it may not yet know about a firm and that firms may change names. A missing result is therefore not clearance, so warnings complement rather than replace identity, permission and contact checks.

Evidence. The FCA Warning List supports an attributed current warning and explains why a missing result is not clearance. No named party was searched here.

Treat each warning search as a dated query, not a permanent certificate. Record the exact terms used, retrieval time and URL, and compare the warning’s name, domain and contacts with the presented fields before treating it as relevant. If nothing appears, write NO RESULT AT RETRIEVAL TIME; keep every unresolved identity or permission field open.

Fictional example. No warning appears, but an email domain differs from the official field. The result remains MISMATCH; silence cannot override conflict.

Risk or failure. Converting “nothing found” into “approved” reverses the evidence burden. Any warning must also match the relevant domain, contacts and scope.

Checklist.

• Search the exact captured names and relevant domain terms.
• Open and preserve any relevant warning’s current URL and scope.
• Record “no result at retrieval time”, never “cleared”.
• Keep any identity, contact or permission mismatch active.

The final task is to combine the separate fields into a bounded disposition that says neither more nor less than the evidence supports.

Record a Bounded Evidence Disposition

When should unresolved evidence stop material reliance?

Stop relying on the presentation when a material identity, domain, contact, status or permission field conflicts or remains unresolved. Record MISMATCH for a material non-match, INCONCLUSIVE for missing or ambiguous evidence, and OFFICIAL_WARNING_FOUND only for a relevant current warning. None is an accusation beyond its evidence.

A full match remains MATCHED_WITH_LIMITS because tools can lag and firm-supplied details may err. Financial Services Compensation Scheme or Financial Ombudsman Service coverage is fact-specific and needs a separate current check.

Evidence table.

Keep a short decision log beside the worksheet: disposition, fields supporting it, fields still open, official URLs, retrieval time and the next permitted action. Never average one mismatch against several matches. Before later material reliance, refresh the official evidence rather than treating the old worksheet as current. The record supports a bounded decision process; it does not authenticate a named party.

Fictional example. A worksheet matches name and number but lacks exact permission. Record INCONCLUSIVE; if the domain differs, preserve a separate MISMATCH.

Risk or failure. A checklist organises evidence but cannot authenticate a firm or decide regulatory questions. Averaging contradictions hides material mismatch.

Checklist.

• Give every material field its own status and evidence link.
• Preserve conflicts rather than averaging them into a pass.
• State tool limits, retrieval time and unresolved questions.
• Refresh official evidence before any later material use.

The method ends with a reproducible record, not a verdict on any named party.

FAQs