How to Check Whether a Bank Is Actually Licensed (in About Ten Minutes)
Written with AI assistance and reviewed by the NorwegianSpark SA editorial team.
Every claim a financial provider makes about its own regulation can be checked, free, in a public register, in about ten minutes. Almost nobody does it. This is the procedure.
It matters because a licence is a live status, not a permanent credential. FlowBank held a genuine Swiss banking licence right up until FINMA withdrew it. Any check done once, at signup, describes a moment that has passed.
Step 1 — Find the entity, not the brand
Start in the provider's own terms and conditions, or the small print in the app's footer. You are looking for a sentence naming a legal entity and a regulator. It usually reads something like "X Ltd is authorised by Y as an electronic money institution, reference number Z".
This step is the one that catches people out. The brand on the app is frequently not the licensed entity, and sometimes the licensed entity is a partner company you have never heard of. Write down the exact legal name, including the company-form suffix — UAB, SA, AS, Ltd, GmbH — because registers search on it literally.
If you cannot find a named entity and a named regulator anywhere in the provider's own documentation, you have already learned something important and you can stop here.
Step 2 — Go to the right regulator's register
Go to the regulator directly. Do not use a comparison site's summary, and do not trust a licence number quoted in an article, including ours — the whole point of this exercise is to read the current status rather than someone's snapshot of it.
The registers you are most likely to need:
- United Kingdom — the Financial Conduct Authority's Financial Services Register, at register.fca.org.uk
- Euro area and EU — each national regulator publishes its own: BaFin in Germany, the Bank of Lithuania, the Central Bank of Ireland, the AFM and DNB in the Netherlands, the MFSA in Malta. The European Banking Authority also maintains EU-wide registers of payment and e-money institutions.
- Switzerland — FINMA publishes lists of authorised institutions.
- United States — the FDIC's BankFind for insured banks, and the NCUA for credit unions.
For any other country, search for the central bank or financial supervisor plus the word "register". Every serious jurisdiction has one and they are free.
Step 3 — Read four things on the entry
Finding the entry is not the same as reading it. Four fields carry almost all the meaning.
The permission type. This is the field that decides your protection. "Credit institution" or "bank" means deposits and a deposit guarantee scheme. "Electronic money institution" or "payment institution" means safeguarding instead — real protection, but no guarantee scheme and no fixed payout limit. The two are not interchangeable regardless of what the marketing says, and the difference is set out in full in what happens when a neobank fails.
The status. Authorised, or something else. Registers carry entries that are cancelled, lapsed, restricted or subject to requirements, and a cancelled entry still appears. Read the word, not just the presence of a row.
Any requirements or restrictions. Regulators attach conditions to licences — limits on taking on new customers, on holding client money, on specific activities. These are published and they are informative. A firm operating under restrictions is telling you something about its supervisory history.
The address and the trading names. Confirm the entity in the register is the one in the app's terms, and that the brand you are using is listed among its trading names. A mismatch here is the single most common shape of an impersonation scam: a real licence, a real number, and a fake company quoting both.
Step 4 — Cross-check the other direction
Now reverse it. Take the entity name from the register and search for it alongside the brand you are actually using. You are confirming that the licensed firm publicly acknowledges the brand, not merely that a firm with that name exists.
If a provider quotes a licence number, look up the number rather than the name. Cloned-firm fraud works by reproducing a genuine firm's registration details on a fake site, so the number will check out — but the contact details, domain and address on the register will not match the ones you were given. Regulators publish warning lists of known clones; the FCA's is the best known.
Step 5 — Write down what you found, and diarise it
Note the entity name, the permission type, the protection scheme that follows from it, and the date you checked. Then set a reminder to repeat this annually, and again before you materially increase your balance.
That last habit is the one that would have mattered most in the cases we have documented. FlowBank's licence was withdrawn in March 2024 after more than two years of supervisory concern that was never visible to a customer looking at the app.
Five things that should stop you
Certain findings are worth treating as answers rather than as questions to investigate further.
No named entity or regulator anywhere in the provider's own documentation. Legitimate firms are required to state this and are generally keen to. Absence is not an oversight.
A register entry whose address, domain or phone number does not match what you were given. This is the classic cloned-firm pattern: genuine registration details attached to a fake operation. The details check out precisely because they belong to someone else.
"Regulated" without a permission type. The word on its own means very little — a firm can be registered for anti-money-laundering purposes alone, which says nothing about deposits or safeguarding. Ask what it is authorised to do.
Deposit protection claimed by an e-money institution. If the register says e-money institution and the marketing says your deposits are guaranteed up to a fixed amount, those two statements cannot both be right, and the register is the one that governs.
Pressure to act before you have checked. A limited-time rate, a closing window, an urgent transfer request. Every one of these is designed to shorten exactly the ten minutes this article describes.
If the check comes back badly
Finding a problem is useful, and what you do next depends on which problem it is.
If the entity is authorised but as something other than you assumed — an EMI rather than a bank, say — nothing dramatic has happened. Reclassify what you keep there: operational balances yes, savings no. That is a five-minute decision, not an evacuation.
If the register shows a cancelled or restricted status, stop adding money and move what is there in an orderly way. Restricted does not mean fraudulent, but it does mean the supervisor has concerns you cannot see the detail of.
If the details do not match, or the firm is not on the register at all, do not transfer anything and do not act on instructions received from them. Report it to the regulator — every major supervisor has a reporting route, and clone warnings exist because people report them.
What a good result looks like
You should end up able to complete this sentence without hedging: my money is held by [entity], which is authorised by [regulator] as a [permission type], which means it is protected by [scheme] up to [amount], and I last checked this on [date].
If any bracket is empty, that is where your risk is. It is not necessarily a reason to leave — plenty of good providers are e-money institutions and the answer is simply "safeguarded, no scheme, so I keep only working balances here". It is a reason to know.
The same procedure works for brokers, insurers and lenders
Nothing above is specific to banking, which is worth knowing because the highest-risk moments usually involve the other three.
Brokers and investment platforms. Check the permission covers holding client assets, and find out which investor compensation scheme applies and to what — investor protection covers a firm failing to return your assets, not your investments falling in value. The two get conflated constantly, including by firms that should know better.
Insurers. Check the entity is authorised to write the class of business you are buying in your country. Cross-border insurance sold into a market the insurer is not authorised for is a live problem, and the policy is the thing you discover it with.
Lenders and credit brokers. Check whether the firm is the lender or a broker, because the two have different obligations to you and different complaint routes. A broker presenting itself as a lender is a common shape in consumer credit.
In every case the four fields are the same: permission type, status, restrictions, and whether the details match. Learn the procedure once and it applies to every financial relationship you will ever have.
Where this fits
This check is the foundation under every comparison on this site. Fees, apps and interest rates are all worth comparing, and none of them matters if the protection question is unanswered. Once you have the answer, our neobank ranking, business account comparison and savings accounts guide are the places to compare on everything else.