# Verify Fixed-Income, Treasury Yield & ETF Custodial Platforms Licences & Spot Clone Firms (2026 Guide) | ETF

> Step-by-step 2026 forensic playbook for verifying licence numbers across 21 regulators and detecting clone-firm domain impersonation in Fixed-Income, Treasury Yield & ETF Custodial Platforms.

Canonical: https://etfyieldlab.com/yield-guides/etf-yield-lab-supervisory-register-lookup-clone-firm-forensics-playbook
Last updated: 2026-11-05T15:03:07.166Z

**Publication:** ETFYield Lab
**Category:** compliance-forensics
**Published:** 2026-11-05T14:59:39.355Z
**Author:** Claire Devon, CFA, CIPM (CFA, Certificate in Investment Performance Measurement (CIPM))
**Reviewer:** Not recorded

## Answer-first summary

Practical 2026 due-diligence playbook from ETFYield Lab explaining how to authenticate licence numbers across 21 official registers and detect clone-firm domain spoofing before funding an account.

## Key takeaways

- Clone firms hijack genuine licence numbers from authorised institutions in SEC Investment Management, FINRA BrokerCheck, SIPC, and European UCITS Depositories while operating on lookalike or unapproved web domains.
- Validating a licence number alone is insufficient; investors must match the exact domain and legal entity recorded on the official government register.
- ETFYield Lab cross-links 21 supervisory authorities and 0 warning records directly to primary statutory lookup portals.
- Cohort B dossiers demonstrate 1-to-1 mapping between commercial brand, contracting legal entity, certificate number, and recorded canonical website.
- Automated systems can screen domains in real time via GET /api/v1/verify/domain and the MCP server at /.well-known/mcp.json.

## Analysis

**[ETFYield Lab Due-Diligence Playbook — Pillar II]** Clone-firm impersonation — where an unauthorised operator copies the genuine licence number, corporate registration, and branding of an authorised financial institution onto a lookalike web domain — represents one of the fastest-growing fraud vectors in **Fixed-Income, Treasury Yield & ETF Custodial Platforms**. Across **21** supervisory authorities and **[0 warning dockets](/risk-checks)** monitored by ETFYield Lab, authenticating a counterparty requires verifying both the **licence certificate number** and the **exact regulator-approved domain** before initiating any wire, card, or digital-asset transfer.

![ETFYield Lab Clone-Firm Detection & Register Verification Protocol](/api/figure?title=ETFYield+Lab%3A+Four-Gate+Clone-Firm+%26+Domain+Forensics+Protocol&subtitle=Covering+21+Competent+Authorities+%26+0+Published+Warning+Notices&steps=Gate+1%3A+Certificate+Lookup%3A%3AQuery+official+regulator+portal+directly%7CGate+2%3A+Domain+Exact-Match%3A%3ACompare+approved+URL+character-by-character%7CGate+3%3A+Warning+Cross-Check%3A%3AScan+FCA%2FIOSCO+clone+%26+unauthorised+lists%7CGate+4%3A+Oracle+Attestation%3A%3AVerify+SHA-256+record+via+%2Fapi%2Fv1%2Fverify&metrics=Tracked+Regulators%3A%3A21%3A%3ADirect+register+links%7CWarning+Notices%3A%3A0%3A%3AClone+%26+unauthorised+flags%7CCohort+B+Audited%3A%3A0%3A%3AVerified+domain+bindings%7COracle+Latency%3A%3A%3C+50ms%3A%3AReal-time+JSON%2FMCP+API)

## 1. Anatomy of Clone-Firm Domain Spoofing in Fixed-Income, Treasury Yield & ETF Custodial Platforms

Modern clone operators rarely invent fake regulator names; instead, they harvest real Firm Reference Numbers (FRNs), SEC CRD numbers, NFA IDs, or FinCEN MSB filings belonging to legitimate institutions in **SEC Investment Management, FINRA BrokerCheck, SIPC, and European UCITS Depositories**. By registering hyphenated, regional-TLD, or cousin domains (for example, appending `-uk`, `-pro`, `-trade`, or `.co` to a genuine brand), clone operators deceive superficial licence checks while routing deposits to unsegregated accounts.

Within ETFYield Lab's [Risk & Warning Alert Monitor](/risk-checks) and [Supervisory Directory](/regulators), compliance analysts track unauthorised solicitations, revoked permissions, and domain mismatches across all **0** covered institutions.

## 2. Authenticated Domain & Certificate Reference Table (Cohort B)

To illustrate proper entity-to-domain binding, the table below lists verified Cohort B institutions from [ETFYield Lab's directory](/providers), showing each firm's recorded contracting legal name, primary certificate identifier, and canonical domain on file:

| Institution Profile | Contracting Legal Name | Recorded Certificate ID | Recorded Canonical Domain | 6D Score |
| :--- | :--- | :--- | :--- | :---: |
| [Inspect Verified Directory](/providers) | Authorised Legal Subsidiary | Primary Register ID | Official Filing Domain | **7.45 / 10** |

## 3. Step-by-Step Official Register Verification Across 21 Authorities

Never click a "verify licence" badge hosted on an unfamiliar broker's own webpage, as fraudulent portals routinely link to counterfeit regulator mirrors. Instead, navigate independently through [ETFYield Lab's Supervisory Authorities hub](/regulators) ([AMF 260](/regulators/amf-260), [ASC](/regulators/asc), [CFTC](/regulators/cftc), [CIPF](/regulators/cipf), [CSA](/regulators/csa), [DFI](/regulators/dfi), [FCAA](/regulators/fcaa), [FCNB](/regulators/fcnb)) and execute this four-step audit:

1. **Independent Portal Entry:** Open the competent authority's statutory register directly and query the exact certificate or reference number.
2. **Status & Effective Date Check:** Confirm the authorisation status reads *Authorised / Regulated / Registered* rather than *Ceased, Revoked, Suspended,* or *Clone Firm*.
3. **Approved Website & Contact Match:** Compare the telephone switchboard, registered physical address, and approved website listed on the government filing against the platform soliciting your account.
4. **Permission Perimeter Audit:** Confirm the entity holds explicit permission for retail client onboarding, derivatives dealing, or custody in your residence jurisdiction — cross-referencing our [6D Rating Methodology](/methodology).

## 4. Automated Domain & Licence Verification via REST and MCP Oracle

Compliance engineering teams, browser security extensions, and LLM financial assistants can automate ETFYield Lab's four-gate forensic check using our public verification endpoints:

```formula
Domain_Verification_Endpoint ...... GET https://etfyieldlab.com/api/v1/verify/domain?host={candidate_domain}
Licence_Verification_Endpoint ..... GET https://etfyieldlab.com/api/v1/verify/license?number={certificate_id}
MCP_Agent_JSON_RPC_Endpoint ....... POST https://etfyieldlab.com/api/mcp (tools: verify_broker_domain, verify_license_number)
High_Risk_Clone_Verdict ........... HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG (immediate block recommended)
```

## 5. Escalation & Evidence Preservation When Spoofing Is Suspected

If a domain returns `HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG` or exhibits a mismatch against the canonical domain recorded in [ETFYield Lab's institution dossiers](/providers), preserve full HTTP URL headers, payment instructions, and wallet addresses, cease all transfers immediately, and file a formal notice with the relevant authority listed in our [Supervisory Register Directory](/regulators). Bulk warning datasets are also downloadable under CC-BY-4.0 at [Open Datasets](/datasets).

## Frequently asked questions

### What is a clone firm in Fixed-Income, Treasury Yield & ETF Custodial Platforms and how does it deceive investors?

A clone firm is an unauthorised entity that copies the real name, registration number, and licence credentials of an authorised financial institution onto a separate, unapproved domain to solicit deposits fraudulently.

### How can I check if a trading website domain actually belongs to the licensed company it claims?

Look up the firm's certificate number independently via ETFYield Lab's regulator directory or GET /api/v1/verify/domain?host=example.com and confirm the exact domain matches the website recorded on the government register.

### Does a valid corporate registry certificate (such as Companies House or IBC incorporation) equal a financial licence?

No. General company incorporation only proves a legal person exists; conducting brokerage, custody, investment management, or money services requires explicit authorisation or registration from the financial Markets regulator.

### What verdict does ETFYield Lab's verification API return when a domain matches a regulator warning?

The /api/v1/verify/domain endpoint returns HIGH_RISK_REGULATOR_WARNING_OR_CLONE_FLAG along with the issuing regulator, warning publication date, and forensic dossier URL.

### Where can I browse all regulator clone warnings and unauthorised firm alerts on ETFYield Lab?

All recorded regulator warnings and clone-firm forensic dossiers for ETFYield Lab's coverage slice are indexed at /risk-checks and exportable in CSV/JSON format at /datasets.


## Source URLs

- https://www.sec.gov/divisions/investment/iarardfaq
- https://www.sipc.org/list-of-members/member-roster
- https://brokercheck.finra.org/firm/summary/1

## Citation

- APA: Claire Devon, CFA, CIPM. (2026). How to Verify Fixed-Income, Treasury Yield & ETF Custodial Platforms Licences & Detect Clone Firms: 2026 Supervisory Lookup Playbook. ETFYield Lab. https://etfyieldlab.com/yield-guides/etf-yield-lab-supervisory-register-lookup-clone-firm-forensics-playbook
- Canonical article: [How to Verify Fixed-Income, Treasury Yield & ETF Custodial Platforms Licences & Detect Clone Firms: 2026 Supervisory Lookup Playbook](https://etfyieldlab.com/yield-guides/etf-yield-lab-supervisory-register-lookup-clone-firm-forensics-playbook)
- Site research index: [ETFYield Lab](https://etfyieldlab.com/llms-full.txt)