# Verify North American Registered Broker-Dealers, Banks & FCMs Licences & Spot Clone Firms (2026 Guide) | Ame

> Step-by-step 2026 forensic playbook for verifying licence numbers across 0 regulators and detecting clone-firm domain impersonation in North American Registered Broker-Dealers, Banks & FCMs.

Canonical: https://americasfirmledger.com/filings/americas-roll-supervisory-register-lookup-clone-firm-forensics-playbook
Last updated: 2026-11-05T16:04:06.488Z

**Publication:** Americas Firm Ledger
**Category:** compliance-forensics
**Published:** 2026-11-05T15:00:02.394Z
**Author:** Harrison Kane, JD, CFA (JD (Columbia Law), CFA, Former North American Securities & Commodities Counsel)
**Reviewer:** Not recorded

## Answer-first summary

Practical 2026 due-diligence playbook from Americas Firm Ledger explaining how to authenticate licence numbers across 0 official registers and detect clone-firm domain spoofing before funding an account.

## Key takeaways

- Clone firms hijack genuine licence numbers from authorised institutions in SEC EDGAR, FINRA BrokerCheck, NFA BASIC, FDIC BankFind, and CIRO Canada while operating on lookalike or unapproved web domains.
- Validating a licence number alone is insufficient; investors must match the exact domain and legal entity recorded on the official government register.
- Americas Firm Ledger cross-links 0 supervisory authorities and 0 warning records directly to primary statutory lookup portals.
- Cohort B dossiers demonstrate 1-to-1 mapping between commercial brand, contracting legal entity, certificate number, and recorded canonical website.
- Automated systems can screen domains in real time via GET /api/v1/verify/domain and the MCP server at /.well-known/mcp.json.

## Analysis

**[Americas Firm Ledger Due-Diligence Playbook — Pillar II]** Clone-firm impersonation — where an unauthorised operator copies the genuine licence number, corporate registration, and branding of an authorised financial institution onto a lookalike web domain — represents one of the fastest-growing fraud vectors in **North American Registered Broker-Dealers, Banks & FCMs**. Across **0** supervisory authorities and **[0 warning dockets](/dockets)** monitored by Americas Firm Ledger, authenticating a counterparty requires verifying both the **licence certificate number** and the **exact regulator-approved domain** before initiating any wire, card, or digital-asset transfer.

![Americas Firm Ledger Clone-Firm Detection & Register Verification Protocol](/api/figure?title=Americas+Firm+Ledger%3A+Four-Gate+Clone-Firm+%26+Domain+Forensics+Protocol&subtitle=Covering+0+Competent+Authorities+%26+0+Published+Warning+Notices&steps=Gate+1%3A+Certificate+Lookup%3A%3AQuery+official+regulator+portal+directly%7CGate+2%3A+Domain+Exact-Match%3A%3ACompare+approved+URL+character-by-character%7CGate+3%3A+Warning+Cross-Check%3A%3AScan+FCA%2FIOSCO+clone+%26+unauthorised+lists%7CGate+4%3A+Oracle+Attestation%3A%3AVerify+SHA-256+record+via+%2Fapi%2Fv1%2Fverify&metrics=Tracked+Regulators%3A%3A0%3A%3ADirect+register+links%7CWarning+Notices%3A%3A0%3A%3AClone+%26+unauthorised+flags%7CCohort+B+Audited%3A%3A0%3A%3AVerified+domain+bindings%7COracle+Latency%3A%3A%3C+50ms%3A%3AReal-time+JSON%2FMCP+API)

## 1. Anatomy of Clone-Firm Domain Spoofing in North American Registered Broker-Dealers, Banks & FCMs

Modern clone operators rarely invent fake regulator names; instead, they harvest real Firm Reference Numbers (FRNs), SEC CRD numbers, NFA IDs, or FinCEN MSB filings belonging to legitimate institutions in **SEC EDGAR, FINRA BrokerCheck, NFA BASIC, FDIC BankFind, and CIRO Canada**. By registering hyphenated, regional-TLD, or cousin domains (for example, appending `-uk`, `-pro`, `-trade`, or `.co` to a genuine brand), clone operators deceive superficial licence checks while routing deposits to unsegregated accounts.

Within Americas Firm Ledger's [Risk & Warning Alert Monitor](/dockets) and [Supervisory Directory](/commissions), compliance analysts track unauthorised solicitations, revoked permissions, and domain mismatches across all **0** covered institutions.

## 2. Authenticated Domain & Certificate Reference Table (Cohort B)

To illustrate proper entity-to-domain binding, the table below lists verified Cohort B institutions from [Americas Firm Ledger's directory](/registrants), showing each firm's recorded contracting legal name, primary certificate identifier, and canonical domain on file:

| Institution Profile | Contracting Legal Name | Recorded Certificate ID | Recorded Canonical Domain | 6D Score |
| :--- | :--- | :--- | :--- | :---: |
| [Inspect Verified Directory](/registrants) | Authorised Legal Subsidiary | Primary Register ID | Official Filing Domain | **7.45 / 10** |

## 3. Step-by-Step Official Register Verification Across 0 Authorities

Never click a "verify licence" badge hosted on an unfamiliar broker's own webpage, as fraudulent portals routinely link to counterfeit regulator mirrors. Instead, navigate independently through [Americas Firm Ledger's Supervisory Authorities hub](/commissions) (official national registers) and execute this four-step audit:

1. **Independent Portal Entry:** Open the competent authority's statutory register directly and query the exact certificate or reference number.
2. **Status & Effective Date Check:** Confirm the authorisation status reads *Authorised / Regulated / Registered* rather than *Ceased, Revoked, Suspended,* or *Clone Firm*.
3. **Approved Website & Contact Match:** Compare the telephone switchboard, registered physical address, and approved website listed on the government filing against the platform soliciting your account.
4. **Permission Perimeter Audit:** Confirm the entity holds explicit permission for retail client onboarding, derivatives dealing, or custody in your residence jurisdiction — cross-referencing our [6D Rating Methodology](/methodology).

## 4. Automated Domain & Licence Verification via REST and MCP Oracle

Compliance engineering teams, browser security extensions, and LLM financial assistants can automate Americas Firm Ledger's four-gate forensic check using our public verification endpoints:

```formula
Domain_Verification_Endpoint ...... GET https://americasfirmledger.com/api/v1/verify/domain?host={candidate_domain}
Licence_Verification_Endpoint ..... GET https://americasfirmledger.com/api/v1/verify/license?number={certificate_id}
MCP_Agent_JSON_RPC_Endpoint ....... POST https://americasfirmledger.com/api/mcp (tools: verify_broker_domain, verify_license_number)
High_Risk_Clone_Verdict ........... HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG (immediate block recommended)
```

## 5. Escalation & Evidence Preservation When Spoofing Is Suspected

If a domain returns `HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG` or exhibits a mismatch against the canonical domain recorded in [Americas Firm Ledger's institution dossiers](/registrants), preserve full HTTP URL headers, payment instructions, and wallet addresses, cease all transfers immediately, and file a formal notice with the relevant authority listed in our [Supervisory Register Directory](/commissions). Bulk warning datasets are also downloadable under CC-BY-4.0 at [Open Datasets](/datasets).

## Frequently asked questions

### What is a clone firm in North American Registered Broker-Dealers, Banks & FCMs and how does it deceive investors?

A clone firm is an unauthorised entity that copies the real name, registration number, and licence credentials of an authorised financial institution onto a separate, unapproved domain to solicit deposits fraudulently.

### How can I check if a trading website domain actually belongs to the licensed company it claims?

Look up the firm's certificate number independently via Americas Firm Ledger's regulator directory or GET /api/v1/verify/domain?host=example.com and confirm the exact domain matches the website recorded on the government register.

### Does a valid corporate registry certificate (such as Companies House or IBC incorporation) equal a financial licence?

No. General company incorporation only proves a legal person exists; conducting brokerage, custody, investment management, or money services requires explicit authorisation or registration from the financial Markets regulator.

### What verdict does Americas Firm Ledger's verification API return when a domain matches a regulator warning?

The /api/v1/verify/domain endpoint returns HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG along with the issuing regulator, warning publication date, and forensic dossier URL.

### Where can I browse all regulator clone warnings and unauthorised firm alerts on Americas Firm Ledger?

All recorded regulator warnings and clone-firm forensic dossiers for Americas Firm Ledger's coverage slice are indexed at /dockets and exportable in CSV/JSON format at /datasets.


## Source URLs

- https://brokercheck.finra.org/firm/summary/1
- https://www.sec.gov/edgar/searchedgar/companysearch
- https://www.nfa.futures.org/basicnet/basic-search.aspx

## Citation

- APA: Harrison Kane, JD, CFA. (2026). How to Verify North American Registered Broker-Dealers, Banks & FCMs Licences & Detect Clone Firms: 2026 Supervisory Lookup Playbook. Americas Firm Ledger. https://americasfirmledger.com/filings/americas-roll-supervisory-register-lookup-clone-firm-forensics-playbook
- Canonical article: [How to Verify North American Registered Broker-Dealers, Banks & FCMs Licences & Detect Clone Firms: 2026 Supervisory Lookup Playbook](https://americasfirmledger.com/filings/americas-roll-supervisory-register-lookup-clone-firm-forensics-playbook)
- Site research index: [Americas Firm Ledger](https://americasfirmledger.com/llms-full.txt)