An authorization number displayed in an investment platform’s legal notices means nothing until it has been cross-checked against the relevant register. Fraudsters copy genuine identifiers, use existing company names and build sites that look completely legitimate. Verification is less about whether the required information is present and more about whether it matches official records.
Regulatory identity theft: the trap legal notices alone won’t expose
A website can display a valid company name, an authentic REGAFI number and an existing AMF authorization while still being fraudulent. The method is to copy the details of an authorized provider, then change the domain name or contact information.
The only reliable safeguard is to compare the domain name of the site you’re visiting with the one listed in the official register. REGAFI, ORIAS’s register of financial investment advisers and the AMF register of crowdfunding service providers list the contact details declared by each authorized entity. If the URL you’re visiting differs from the one in the register, that’s a sign of identity theft.
We recommend contacting the company through a channel found independently of the suspicious website—for example, by calling the number listed in the REGAFI register—to confirm that it operates the domain in question.
Reviewing Épargne & Bourse’s legal notices provides an example of a well-structured page listing a company name, registration number and verifiable contact details—a useful format for comparison.
Financial registers and AMF warning lists: which tool for which check
A website’s absence from a warning list does not prove that it is trustworthy. The AMF and ACPR point out that these lists are not exhaustive, as new unauthorized operators appear all the time. A warning list is a safety net, not a certificate of compliance.
The relevant register depends on the status claimed by the platform:
- REGAFI for investment service providers and payment institutions, maintained by the ACPR.
- ORIAS for financial investment advisers (CIFs), insurance intermediaries and crowdfunding intermediaries.
- The AMF register for crowdfunding service providers authorized at the European level under the ECSP Regulation.
A platform that presents itself as a CIF but does not appear in ORIAS has no recognized status to carry out this activity in France. Cross-checking the stated status against the relevant register is the most effective way to identify discrepancies.
Checking an authorization number in the register
An authorization number alone is not enough. You need to check that the company name, address and website associated with the number match those on the site you’re visiting exactly. Even one discrepancy is reason to suspend any investment activity and report the site to the AMF using its dedicated form.
Legal notices on an investment website: technical details to check
In addition to the requirements that apply to all professional websites (company name, legal form, share capital, registered office, RCS number and hosting provider’s identity), a website offering financial services must display information specific to its regulated activity.
- The registration or authorization number issued by the relevant authority (AMF, ACPR), with the authority clearly identified.
- The precise regulatory status: investment service provider, CIF, authorized crowdfunding platform or registered digital asset service provider.
- The contact details of the supervisory authority and, where applicable, the relevant ombudsman.
- Warnings about the risks associated with the financial instruments offered, which must appear on the home page for certain products.
Charging access fees before users can view basic information about the products on offer is a red flag. Supervisory authorities consider that pre-contractual information, including the key information document (KID), must be available without requiring users to pay to register first.
The KID as an additional verification document
The key information document describes the product, its associated risks, fees and past or simulated performance. Its absence from a platform offering packaged products (funds, SCPI real estate investment trusts, structured bonds) is a regulatory breach. Its presence, however, does not guarantee that the issuer is trustworthy, but it does indicate a compliant distribution framework.
Practical warning signs in legal notices and beyond
Some clues have less to do with the content of the legal notices than with their presentation and context:
A hosting provider based in a jurisdiction with no judicial cooperation can make it harder to pursue a complaint. Checking the host’s declared country in the legal notices gives you an idea of how easy it may be to seek recourse in the event of a dispute.
A website that displays AMF authorization while offering products outside the scope of that authorization—for example, a CIF offering direct custody of crypto-assets—is exceeding its permitted status. The ORIAS or REGAFI register specifies the exact scope of activities authorized for each entity.
In 2024, the AMF handled nearly 17,000 reports, a 27% increase on the previous year. This volume confirms that the sophistication of fraudulent websites makes manual checks necessary whenever you visit a new platform.
Online advertising for highly speculative investments and digital asset services is regulated by law and generally prohibited, subject to limited exceptions. A website that runs aggressive ads for leveraged products without visible warnings is breaching these rules—a sign of the operator’s credibility even before you review its legal notices.
Checking the legal notices on an investment website is not just a matter of confirming that a number is present. It requires systematic cross-checking against the REGAFI, ORIAS and AMF registers, careful attention to the scope of authorized activities, and vigilance about access to pre-contractual information. A website that makes these checks difficult has already answered the question of whether it can be trusted.
