Why authorisation matters
FCA authorisation is the foundation of every consumer-protection right in UK financial services. The Financial Ombudsman Service can only adjudicate complaints against authorised firms. The Financial Services Compensation Scheme can only pay out where the failed firm was authorised. The Consumer Duty only binds authorised firms. Where the firm is unauthorised, all of these protections fall away.
Operating a financial business in the UK without FCA authorisation is a criminal offence under section 19 of the Financial Services and Markets Act 2000. The maximum sentence is two years in prison. Despite this, unauthorised firms continue to operate, often by impersonating authorised ones (clone firms) or by exploiting consumers who do not realise the firm should be authorised in the first place.
Without FCA authorisation, the firm sits outside the entire consumer-protection system. No FOS. No FSCS. No Consumer Duty. No regulatory oversight at all.
The basic position
The check is quick, free and unambiguous. The FCA maintains a public register of every authorised firm. Two consumer-facing tools draw on the same database: the full Financial Services Register and the simpler FCA Firm Checker. Both confirm whether the firm is authorised, what activities it is permitted to carry out and the verified contact details for it. There is no excuse for skipping the check.
The four-step check
The FCA publishes a four-step process for verifying authorisation. It is the same process the FCA's own consumer team would walk through. Every step matters: skipping any one of them risks dealing with a clone firm even where the underlying authorised firm is genuine.
-
Search for the firm on the FCA Firm Checker
Go to the FCA Firm Checker and search for the firm by name. The Firm Checker is the consumer-facing version of the Register and is designed to be straightforward to use. If the firm does not appear, this is the first warning sign. Do not assume the firm has a different trading name; if it does, the trading name should also be on the Register.
-
Select the product or service the firm is offering you
Authorisation is granular. A firm may be authorised to broker loans without being authorised to lend. A firm authorised for investment advice may not be authorised for discretionary investment management. The Firm Checker asks what product or service the firm is offering and confirms whether the firm has the specific permissions for that activity.
-
Confirm the firm is authorised for that specific activity
The check returns one of several statuses. "Authorised" with the correct permission for the activity is the only status that confirms the firm can lawfully provide the service. "No longer authorised", "Revoked" and "Not authorised" all mean the firm cannot lawfully provide the service in question.
-
Cross-check the contact details against those listed on the Register
This is the step most often skipped. It is also the step that defeats clone firms. The Register lists the firm's verified phone number, email and postal address. If the contact details given by the firm do not match those on the Register, the consumer is dealing with a clone firm. The genuine authorised firm has no connection to the clone.
Always use the contact details from the Register, not from the firm
If the firm's contact details do not match the Register, do not call or email the firm using their stated contact details to ask why. The firm is likely a clone. The contact details given to you are the scammer's contact details. Either call the genuine firm using only the Register-listed number or call the FCA directly on 0800 111 6768 to confirm.
Understanding what the Register shows
The Register entry for an authorised firm contains several pieces of information. Each one matters and the absence or modification of any can be a warning sign.
| Field | What it means | Why it matters |
|---|---|---|
| Firm name | Legal name of the entity | Trading names should also be listed; absence is a warning |
| Firm Reference Number (FRN) | Unique identifier issued by the FCA | Genuine firms display this; clones often misuse a real FRN |
| Status | Authorised, Revoked, Cancelled, AR or No longer authorised | Only "Authorised" confirms current permission to operate |
| Permitted activities | Specific FCA permissions held | A loan broker is not authorised to lend; check the activity matches |
| Registered office address | Verified head office address | Mismatch with the firm's stated address is a warning sign |
| Telephone number | Verified contact phone number | Use this number rather than any number provided by the firm |
| Email address and website | Verified digital contact | Free webmail addresses (Gmail, Hotmail) are typically clones |
| Disciplinary history | Any FCA enforcement action | Pattern of action may indicate ongoing concerns |
What does "Appointed Representative" status mean?
An Appointed Representative (AR) is a firm that operates under another firm's FCA authorisation. The "principal firm" takes legal responsibility for the AR's regulated activities. ARs do not hold their own authorisation but are listed on the Register with their principal identified. Where a firm shows as an AR, the consumer must verify that the principal firm is authorised for the relevant activity. The AR can only do what the principal is authorised to do. Some scams exploit AR status by pretending to be ARs of major firms; the principal firm should always be confirmed independently.
Clone firms: the most common scam pattern
A clone firm is a fraudulent operation that impersonates an authorised firm. Clone firms have become the dominant scam pattern in UK financial services because they are designed specifically to defeat partial authorisation checks. A consumer who searches the firm name on the Register will find the genuine firm. A consumer who only checks the firm name has been deceived.
The FCA publishes regular warnings about clone firms. Recent named clones have included impersonations of legitimate UK lenders, investment platforms, insurance brokers and motor finance providers. The fraudsters typically use the genuine firm's name, registered address and Firm Reference Number, but substitute their own phone number, email and bank account for any payments.
-
Phone number does not match the Register
The single most reliable indicator. The fraudster needs you to contact them directly, so they will give you a different phone number. The Register shows the genuine firm's phone number. A mismatch is conclusive: the firm contacting you is not the authorised firm.
-
Email address uses a free webmail provider
Authorised financial firms operate professional email systems on their own domains. An email from a Gmail, Hotmail, Outlook.com or Yahoo address claiming to represent an FCA-authorised firm is almost always a clone or a scam. The Register lists the firm's official email domain.
-
Website domain looks similar but is not identical
Clone websites use domains that look almost like the genuine firm's: an extra hyphen, a different top-level domain (.co rather than .co.uk), a slight misspelling. The Register lists the firm's official website domain. Anything else is the clone.
-
Pressure to act quickly or move money offshore
Clone firms cannot afford to wait while the consumer carries out checks, because every check has a high probability of revealing them. Pressure tactics include limited-time offers, claims that funds must be moved by tomorrow and refusal to allow the consumer to verify the firm independently. Legitimate firms expect customers to take their time.
Where a consumer suspects a clone firm, the FCA should be informed via the scam reporting service. The FCA publishes warnings about identified clones and will list them on its Warning List. Reporting helps the FCA protect other consumers; investigations cannot retrieve the consumer's money in most cases, so prevention through verification matters more than reporting after the fact.
A worked example
The following example shows how a complete check works in practice and where each step interacts with a clone firm pattern.
A loan offer arrives by email
A consumer receives an email from "MoneyLine Lender" offering a £5,000 personal loan at competitive rates. The email asks for a £150 application fee to be paid before the loan can be released.
Step 1, Search for the firm: The consumer searches "MoneyLine" on the FCA Firm Checker and finds Moneyline UK Ltd, a genuine authorised lender. Reassuring at first glance.
Step 2, Select the activity: The Firm Checker confirms Moneyline UK Ltd holds permission to lend on credit agreements. The activity matches.
Step 3, Confirm authorisation: The status is "Authorised". So far the firm passes the check.
Step 4, Cross-check contact details: The Firm Checker shows Moneyline UK Ltd's registered address and phone number. The email the consumer received uses a different phone number, a Gmail address and a slightly different web domain. The consumer is being contacted by a clone, not by the authorised firm.
Outcome: The clone is identified. The consumer does not pay the £150 fee. The matter is reported to the FCA, which adds the clone to its Warning List. No legitimate lender requires an upfront fee before releasing the loan funds.
The fourth step is the one that reveals the scam. Without it, the consumer would have paid the application fee to the clone, lost the £150 and never received any loan. The first three steps confirmed the genuine firm exists and is authorised. The fourth confirmed that the contact attempting to reach the consumer was not the genuine firm.
Dealing with a firm that turns out to be unauthorised
Where the check reveals the firm is genuinely unauthorised (not a clone, but a firm operating without permission), several steps are appropriate. None will fully restore consumer protection, but each limits further harm and supports enforcement against the firm.
-
Stop dealing with the firm immediately
Do not enter into any further transactions, do not provide bank details and do not pay any further fees. Any agreement entered into with an unauthorised firm engaged in regulated activity is potentially unenforceable; the courts have power to set aside agreements made in breach of section 19 of the Financial Services and Markets Act 2000. Authorised lending is also subject to the Consumer Credit Act 1974, which provides further consumer protections including the right to challenge unfair relationships.
-
Report the firm to the FCA
The FCA's scam reporting service accepts reports of unauthorised firms. The FCA cannot recover money for an individual but uses reports to take enforcement action against the firm and to warn other consumers via the Warning List.
-
Report the matter to Action Fraud where money has been lost
Where money has been paid to the firm, Action Fraud is the UK's national reporting centre for fraud. A report generates a crime reference number and feeds into police investigations. Recovery of funds is rare but not impossible, particularly where the bank where the funds were sent can freeze the account quickly.
-
Contact the bank that made the payment
If the consumer paid by bank transfer to the unauthorised firm on or after 7 October 2024, they may be eligible for reimbursement under the new Payment Systems Regulator (PSR) authorised push payment fraud rules, which require banks to reimburse most APP fraud victims up to £85,000. Card payments may be reversible via chargeback. Bank transfers are harder but still worth pursuing.
-
Avoid follow-up scams
Victims of unauthorised firms are often targeted by "recovery scams" promising to retrieve lost funds in exchange for an upfront fee. These are themselves scams. The FCA, Action Fraud and the PSR are the only legitimate routes; they do not charge upfront fees and do not require the consumer to pay anything to recover money.
Where the unauthorised firm has effectively committed fraud rather than simply operated without permission, the matter will be considered for criminal investigation. Section 19 prosecutions are available against unauthorised regulated activity even where the consumer suffered no specific financial loss. For more on loan sharks and unauthorised lenders specifically, see our guide on scams and loan sharks. Where the lender is authorised but the lending was unfair, see our guide on claiming compensation for unfair lending.