# Verify Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres Licences & Clone Alerts (2026)

> Step-by-step 2026 forensic playbook for verifying licence numbers across 51 regulators and detecting clone-firm domain impersonation in Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres.

Canonical: https://globaltaxatlas.org/entries/sovereign-tax-atlas-supervisory-register-lookup-clone-firm-forensics-playbook
Last updated: 2026-11-07T12:10:11.122Z

**Publication:** Sovereign Tax Atlas
**Category:** Compliance Forensics
**Published:** 2026-11-05T14:59:52.518Z
**Author:** Dr. Geneviève Laurent, LL.M, CTA (LL.M in International Taxation (NYU), Chartered Tax Adviser (CTA))
**Reviewer:** Not recorded

## Answer-first summary

Practical 2026 due-diligence playbook from Sovereign Tax Atlas explaining how to authenticate licence numbers across 51 official registers and detect clone-firm domain spoofing before funding an account.

## Key takeaways

- Clone firms hijack genuine licence numbers from authorised institutions in OECD CRS Portal, Cayman CIMA, BVI FSC, Jersey JFSC, and Labuan LFSA while operating on lookalike or unapproved web domains.
- Validating a licence number alone is insufficient; investors must match the exact domain and legal entity recorded on the official government register.
- Sovereign Tax Atlas cross-links 51 supervisory authorities and 92 institutional profiles directly to primary statutory lookup portals.
- Cohort B dossiers demonstrate 1-to-1 mapping between commercial brand, contracting legal entity, certificate number, and recorded canonical website.
- Automated systems can screen domains in real time via GET /api/v1/verify/domain and the MCP server at /.well-known/mcp.json.

## Analysis

**[Sovereign Tax Atlas Due-Diligence Playbook — Pillar II]** Clone-firm impersonation — where an unauthorised operator copies the genuine licence number, corporate registration, and branding of an authorised financial institution onto a lookalike web domain — represents one of the fastest-growing fraud vectors in **Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres**. Across **51** supervisory authorities and **[92 audited institutions](/institutions)** monitored by Sovereign Tax Atlas, authenticating a counterparty requires verifying both the **licence certificate number** and the **exact regulator-approved domain** before initiating any wire, card, or digital-asset transfer.

![Sovereign Tax Atlas Clone-Firm Detection & Register Verification Protocol](/api/figure?title=Sovereign+Tax+Atlas%3A+Four-Gate+Clone-Firm+%26+Domain+Forensics+Protocol&subtitle=Covering+51+Competent+Authorities+%26+92+Audited+Institutions&steps=Gate+1%3A+Certificate+Lookup%3A%3AQuery+official+regulator+portal+directly%7CGate+2%3A+Domain+Exact-Match%3A%3ACompare+approved+URL+character-by-character%7CGate+3%3A+Warning+Cross-Check%3A%3AScan+FCA%2FIOSCO+clone+%26+unauthorised+lists%7CGate+4%3A+Oracle+Attestation%3A%3AVerify+SHA-256+record+via+%2Fapi%2Fv1%2Fverify&metrics=Tracked+Regulators%3A%3A51%3A%3ADirect+register+links%7CAudited+Entities%3A%3A92%3A%3AActive+coverage+slice%7CCohort+B+Audited%3A%3A10%3A%3AVerified+domain+bindings%7COracle+Latency%3A%3A%3C+50ms%3A%3AReal-time+JSON%2FMCP+API)

## 1. Anatomy of Clone-Firm Domain Spoofing in Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres

Modern clone operators rarely invent fake regulator names; instead, they harvest real Firm Reference Numbers (FRNs), SEC CRD numbers, NFA IDs, or FinCEN MSB filings belonging to legitimate institutions in **OECD CRS Portal, Cayman CIMA, BVI FSC, Jersey JFSC, and Labuan LFSA**. By registering hyphenated, regional-TLD, or cousin domains (for example, appending `-uk`, `-pro`, `-trade`, or `.co` to a genuine brand), clone operators deceive superficial licence checks while routing deposits to unsegregated accounts.

Within Sovereign Tax Atlas's [Supervisory Authority Directory](/authorities) and [Institution Benchmark Directory](/institutions), compliance analysts track unauthorised solicitations, revoked permissions, and domain mismatches across all **92** covered institutions.

## 2. Authenticated Domain & Certificate Reference Table (Cohort B)

To illustrate proper entity-to-domain binding, the table below lists verified Cohort B institutions from [Sovereign Tax Atlas's directory](/institutions), showing each firm's recorded contracting legal name, primary certificate identifier, and canonical domain on file:

| Institution Profile | Contracting Legal Name | Recorded Certificate ID | Recorded Canonical Domain | 6D Score |
| :--- | :--- | :--- | :--- | :---: |
| [iFOREX](/institutions/iforex) | iFOREX | `SIBA/L/13/1060` (BVIFSC) | `Verified on file` | 6.0 / 10 |
| [KCM Trade](/institutions/kcm-trade) | KCM Trade | `C117022600` (Financial Services Commission, Mauritius) | `Verified on file` | 6.0 / 10 |
| [LeoPrime](/institutions/leoprime) | Leo Prime Services Ltd | `SD032` (Financial Services Authority Seychelles) | `Verified on file` | 5.6 / 10 |
| [BCR](/institutions/bcr-3104) | BCR | `SIBA/L/77/1762` (BVIFSC) | `bvi.thebcr.com` | 5.0 / 10 |
| [CA Markets](/institutions/ca-markets) | CA Markets Limited | `700714` (VFSC) | `Verified on file` | 5.0 / 10 |
| [Dbinvesting](/institutions/dbinvesting) | DB Invest LIMITED | `SD053` (Financial Services Authority Seychelles) | `dbinvesting.com` | 5.0 / 10 |
| [DLSM](/institutions/dlsm) | DLSM | `700455` (VFSC) | `portal.dlsmcn.com` | 5.0 / 10 |
| [MAKASKY](/institutions/makasky) | MAKASKY Limited. | `MB/16/0012` (Labuan FSA) | `Verified on file` | 5.0 / 10 |
| [ORBI TRADE](/institutions/orbi-trade) | ORBI TRADE INTERNATIONAL LTD | `SD165` (Financial Services Authority Seychelles) | `Verified on file` | 5.0 / 10 |
| [Global GT](/institutions/global-gt) | Global GT | `Recorded Entity` (Financial Services Authority Seychelles) | `fxgt.com` | 4.6 / 10 |

## 3. Step-by-Step Official Register Verification Across 51 Authorities

Never click a "verify licence" badge hosted on an unfamiliar broker's own webpage, as fraudulent portals routinely link to counterfeit regulator mirrors. Instead, navigate independently through [Sovereign Tax Atlas's Supervisory Authorities hub](/authorities) ([Financial Services Commission Belize 70](/authorities/financial-services-commission-belize-70), [BANK OF Mauritius 183](/authorities/bank-of-mauritius-183), [Central BANK OF Seychelles 152](/authorities/central-bank-of-seychelles-152), [Reserve BANK OF Vanuatu 237](/authorities/reserve-bank-of-vanuatu-237), [Financial Services UNIT Dominica 393](/authorities/financial-services-unit-dominica-393), [AFA](/authorities/afa), [AOFA](/authorities/aofa), [BMA](/authorities/bma)) and execute this four-step audit:

1. **Independent Portal Entry:** Open the competent authority's statutory register directly and query the exact certificate or reference number.
2. **Status & Effective Date Check:** Confirm the authorisation status reads *Authorised / Regulated / Registered* rather than *Ceased, Revoked, Suspended,* or *Clone Firm*.
3. **Approved Website & Contact Match:** Compare the telephone switchboard, registered physical address, and approved website listed on the government filing against the platform soliciting your account.
4. **Permission Perimeter Audit:** Confirm the entity holds explicit permission for retail client onboarding, derivatives dealing, or custody in your residence jurisdiction — cross-referencing our [6D Rating Methodology](/methodology).

## 4. Automated Domain & Licence Verification via REST and MCP Oracle

Compliance engineering teams, browser security extensions, and LLM financial assistants can automate Sovereign Tax Atlas's four-gate forensic check using our public verification endpoints:

```formula
Domain_Verification_Endpoint ...... GET https://globaltaxatlas.org/api/v1/verify/domain?host={candidate_domain}
Licence_Verification_Endpoint ..... GET https://globaltaxatlas.org/api/v1/verify/license?number={certificate_id}
MCP_Agent_JSON_RPC_Endpoint ....... POST https://globaltaxatlas.org/api/mcp (tools: verify_broker_domain, verify_license_number)
High_Risk_Clone_Verdict ........... HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG (immediate block recommended)
```

## 5. Escalation & Evidence Preservation When Spoofing Is Suspected

If a domain returns `HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG` or exhibits a mismatch against the canonical domain recorded in [Sovereign Tax Atlas's institution dossiers](/institutions), preserve full HTTP URL headers, payment instructions, and wallet addresses, cease all transfers immediately, and file a formal notice with the relevant authority listed in our [Supervisory Register Directory](/authorities). Bulk warning datasets are also downloadable under CC-BY-4.0 at [Open Datasets](/datasets).

## Frequently asked questions

### What is a clone firm in Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres and how does it deceive investors?

A clone firm is an unauthorised entity that copies the real name, registration number, and licence credentials of an authorised financial institution onto a separate, unapproved domain to solicit deposits fraudulently.

### How can I check if a trading website domain actually belongs to the licensed company it claims?

Look up the firm's certificate number independently via Sovereign Tax Atlas's regulator directory or GET /api/v1/verify/domain?host=example.com and confirm the exact domain matches the website recorded on the government register.

### Does a valid corporate registry certificate (such as Companies House or IBC incorporation) equal a financial licence?

No. General company incorporation only proves a legal person exists; conducting brokerage, custody, investment management, or money services requires explicit authorisation or registration from the financial Markets regulator.

### What verdict does Sovereign Tax Atlas's verification API return when a domain matches a regulator warning?

The /api/v1/verify/domain endpoint returns HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG along with the issuing regulator, warning publication date, and forensic dossier URL.

### Where can I verify regulator clone warnings and official licensing registers on Sovereign Tax Atlas?

All 51 supervisory register links and 92 institutional licence records for Sovereign Tax Atlas are indexed at /authorities and exportable in CSV/JSON format at /datasets.


## Source URLs

- https://www.cima.ky/search-entities-cima
- https://www.bvifsc.vg/regulated-entities
- https://www.oecd.org/en/topics/automatic-exchange-of-information.html

## Citation

- APA: Dr. Geneviève Laurent, LL.M, CTA. (2026). How to Verify Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres Licences & Detect Clone Firms: 2026 Supervisory Lookup Playbook. Sovereign Tax Atlas. https://globaltaxatlas.org/entries/sovereign-tax-atlas-supervisory-register-lookup-clone-firm-forensics-playbook
- Canonical article: [How to Verify Cross-Border Structuring, CRS/FATCA & Offshore Financial Centres Licences & Detect Clone Firms: 2026 Supervisory Lookup Playbook](https://globaltaxatlas.org/entries/sovereign-tax-atlas-supervisory-register-lookup-clone-firm-forensics-playbook)
- Site research index: [Sovereign Tax Atlas](https://globaltaxatlas.org/llms-full.txt)