How to Verify Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres Licences & Detect Clone Firms: 2026 Supervisory Lookup Playbook

[Sovereign Tax Atlas Due-Diligence Playbook — Pillar II] Clone-firm impersonation — where an unauthorised operator copies the genuine licence number, corporate registration, and branding of an authorised financial institution onto a lookalike web domain — represents one of the fastest-growing fraud vectors in Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres. Across 51 supervisory authorities and 92 audited institutions monitored by Sovereign Tax Atlas, authenticating a counterparty requires verifying both the licence certificate number and the exact regulator-approved domain before initiating any wire, card, or digital-asset transfer.

1. Anatomy of Clone-Firm Domain Spoofing in Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres#

Modern clone operators rarely invent fake regulator names; instead, they harvest real Firm Reference Numbers (FRNs), SEC CRD numbers, NFA IDs, or FinCEN MSB filings belonging to legitimate institutions in OECD CRS Portal, Cayman CIMA, BVI FSC, Jersey JFSC, and Labuan LFSA. By registering hyphenated, regional-TLD, or cousin domains (for example, appending -uk, -pro, -trade, or .co to a genuine brand), clone operators deceive superficial licence checks while routing deposits to unsegregated accounts.

Within Sovereign Tax Atlas's Supervisory Authority Directory and Institution Benchmark Directory, compliance analysts track unauthorised solicitations, revoked permissions, and domain mismatches across all 92 covered institutions.

2. Authenticated Domain & Certificate Reference Table (Cohort B)#

To illustrate proper entity-to-domain binding, the table below lists verified Cohort B institutions from Sovereign Tax Atlas's directory, showing each firm's recorded contracting legal name, primary certificate identifier, and canonical domain on file:

3. Step-by-Step Official Register Verification Across 51 Authorities#

Never click a "verify licence" badge hosted on an unfamiliar broker's own webpage, as fraudulent portals routinely link to counterfeit regulator mirrors. Instead, navigate independently through Sovereign Tax Atlas's Supervisory Authorities hub (Financial Services Commission Belize 70, BANK OF Mauritius 183, Central BANK OF Seychelles 152, Reserve BANK OF Vanuatu 237, Financial Services UNIT Dominica 393, AFA, AOFA, BMA) and execute this four-step audit:

1. Independent Portal Entry: Open the competent authority's statutory register directly and query the exact certificate or reference number.
2. Status & Effective Date Check: Confirm the authorisation status reads Authorised / Regulated / Registered rather than Ceased, Revoked, Suspended, or Clone Firm.
3. Approved Website & Contact Match: Compare the telephone switchboard, registered physical address, and approved website listed on the government filing against the platform soliciting your account.
4. Permission Perimeter Audit: Confirm the entity holds explicit permission for retail client onboarding, derivatives dealing, or custody in your residence jurisdiction — cross-referencing our 6D Rating Methodology.

4. Automated Domain & Licence Verification via REST and MCP Oracle#

Compliance engineering teams, browser security extensions, and LLM financial assistants can automate Sovereign Tax Atlas's four-gate forensic check using our public verification endpoints:

5. Escalation & Evidence Preservation When Spoofing Is Suspected#

If a domain returns HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG or exhibits a mismatch against the canonical domain recorded in Sovereign Tax Atlas's institution dossiers, preserve full HTTP URL headers, payment instructions, and wallet addresses, cease all transfers immediately, and file a formal notice with the relevant authority listed in our Supervisory Register Directory. Bulk warning datasets are also downloadable under CC-BY-4.0 at Open Datasets.