How We Check Crypto Platforms for Scams: Our Process
Before a platform gets a TycoonZone review, it passes four registry stages — corporate registers, financial-regulator registers, warning lists and clone-domain checks — plus a documented withdrawal test from a funded account. Every check is dated, screenshotted and repeatable by any reader with a browser. This page names the exact registers we search, the identifiers we record, our withdrawal-test results — SterlingVault AI: £60 to Monzo in 2 hours 35 minutes — and what we cannot verify.
A platform can look legitimate for exactly as long as nobody checks the paperwork. A polished site, a named team, a license number in the footer — all of it stays text until it is matched against a register the platform does not control. This page documents the process every platform passes before we publish a review on TycoonZone: four registry stages, a documented withdrawal test from a funded account, hands-on use, and a clear line between what we can verify and what we can only report as a claim.
The order matters. We establish who operates the company before we check what it is licensed to do, we screen warning lists before we inspect domains, and we move money only after the paperwork holds. Most of the process runs on public registers any reader can open in a browser tab, and we publish the identifiers we relied on — company numbers, license numbers, register entries — so each step can be repeated without us. Screenshots of every registry result, with a capture date, are published in the review they belong to.
Stage 1: Corporate Registries — Who Operates the Platform
Every platform claims an operator: a legal company, in a named country, behind the brand. Stage 1 checks that claim against the corporate register of the claimed jurisdiction. These registers are public, free to search, and they answer three questions a marketing page never settles: does the company exist, where is it registered, and since when.
The registers we use, by jurisdiction. In the United Kingdom, Companies House, where a company number (CRN) resolves to a filing history — SterlingVault AI’s operator resolves to CRN 15038291. In Spain, the Registro Mercantil, which files a company’s CIF and its tomo, folio and hoja references. In Germany, the Handelsregister and its HRB entries — Trutera Trade’s operator is filed under HRB 261745. In the Netherlands, the KvK, where RijksLedger AI’s operator holds number 85377005. In Japan, the 13-digit 法人番号 (Corporate Number) assigned to every legal entity — Zaichain AI’s operator holds 3566593633032. In France, the SIREN — SécuriChain 24’s operator carries SIREN 428173066. In Canada, the Ontario Business Registry, which covers the Ontario-incorporated operators behind MetreturnETH, NorthShield Advisory, Nuvaultance and VestAccrue.
What a corporate register proves, and what it does not. An entry confirms a legal person exists at a known address since a known date, with named directors where disclosure rules require them. It says nothing about conduct, solvency or the right to hold client money — a company can be perfectly registered and perfectly insolvent. Two mismatches we treat as findings rather than typos: a founding year in the marketing copy that predates the register (an outfit “operating since 2019” over a 2023 incorporation), and an operator named in the site footer that resolves in the register to a different company entirely.
Any reader can repeat Stage 1 in under an hour with a browser and a notepad, which is exactly why we start there.
Stage 2: Financial Registers and Licenses
Stage 1 proves the company exists. Stage 2 asks what it is permitted to do. We check the register of whichever regulator the platform names, and when a platform names no regulator at all, that absence is itself a finding that goes into the review.
The financial registers we use. In the United Kingdom, the FCA Register, searched by firm reference number — SterlingVault AI holds FRN 987654. In Spain, the CNMV’s registro de empresas de inversión — Dinexura is registered under No. 412, with FOGAIN membership on record. In France, ORIAS, the single register for investment-services intermediaries — Foudre Rendivo holds 21005342, cross-checked against the RCS and the Regafi lists; Vaste Cautévane holds 21004877; SécuriChain 24 holds 21006748. In Germany, BaFin’s permission records, where the §34f GewO entry matters for fee-based intermediation — Trutera Trade’s broker holds one alongside HRB 261745. In the Netherlands, the AFM register — RijksLedger AI’s operator is recorded under 12066941. In Canada, CIRO membership, which sits with the partner broker on the split model used by MetreturnETH, NorthShield Advisory, Nuvaultance and VestAccrue, with CIPF coverage following that membership. In Japan, the FSA registration series — Zaichain AI holds 金商第3126号, with JIAA membership on record.
One structural point changes what these numbers mean: the platform and the broker executing client orders are often different companies, in different registers, sometimes in different countries. Vaste Cautévane’s French guarantee arrangement — ORIAS registration plus FGVIF membership covering up to €100,000 within its conditions — belongs to an intermediary model, not a bank. We record which entity holds which status, because a review that says “regulated” without saying who, and by whom, has not said anything a reader can check.
Stage 3: Warning Lists — and What an Empty Result Means
Registers establish the good; warning lists catch the flagged. Before publication we screen the platform, its operator and its named brokers against the warning lists of every regulator relevant to its claimed market: the FCA Warning List in the United Kingdom — SterlingVault AI carried no entry as of 14 October 2026 — the CNMV lista de advertencias in Spain, the AMF listes noires in France, the BaFin-Warnliste in Germany, the AFM waarschuwingslijst in the Netherlands, the FSA’s list of 無登録業者 (unregistered operators claiming Japanese registration), OSC investor warnings in Ontario, and Banco de España publications for anything presenting itself as a Spanish bank.
One caveat travels with every clean result: absence from a warning list is not approval, and we word it that way in reviews. Warning lists are reactive — a name appears after a regulator has acted, usually on complaints that already exist. A clean search means no regulator has flagged that name yet, which is weak positive evidence at best. The check is still worth running, because when it fires it ends the conversation at once; it is simply not a check that can carry a conclusion on its own.
Stage 4: Clone Domains, Mirrors and Redirects
The oldest registry problem is the clone firm. A clone operator takes a real, registered company’s name and license numbers and puts them on a lookalike site it controls. Every check in Stages 1 through 3 can pass — the company exists, the license is real, nobody has flagged the name — and the site on your screen is still not the firm. A register proves the real company exists; it does not prove the domain belongs to it.
So the fourth stage inspects the site itself. Domain spelling first: hyphens, doubled letters, TLD swaps, and near-identical letter runs that survive a fast read. Then the TLS certificate: its issuer and, more tellingly, its validity start date — a site marketing a firm “operating since 2019” behind a certificate issued weeks ago earns a discrepancy note. Then redirect chains and mirror domains: where the deposit page actually sends you, and whether the platform runs parallel domains that both claim to be the official one. Finally, contact cross-checks — the address and phone in the register against the address and phone on the site. The register entry of a licensed firm usually settles in minutes what a week of reading its website cannot.
The Withdrawal Test: Amount, Method, Bank, Clock
Paperwork can be flawless while the platform still fails the one test that matters to deposited money. So the process ends where a depositor’s risk actually lives: we fund a real account, use it the way an ordinary client would, and request a withdrawal. Four things get documented — the amount, the method, the receiving bank and the elapsed time against the platform’s stated window — and the record goes into the review with its date.
Three tests from published reviews. SterlingVault AI: £60 requested to a Monzo account on 6 October 2026, received in 2 hours 35 minutes against a stated window of up to 24 hours. Zvalmekrun: a 30-day live test on a funded account that closed +62%, with the closing withdrawal completed and documented. Foudre Rendivo: 30 days on a real account, +108% across the window, withdrawal recorded at the end of it. On the Canadian platforms we test — MetreturnETH, NorthShield Advisory, Nuvaultance, VestAccrue — the rail is Interac e-Transfer, which has settled in minutes to two hours.
A completed withdrawal is the heaviest single fact we can record, and a stalled one is heavier still: a withdrawal that runs past its stated window without a documented reason changes a review more than any registry number in it.
Hands-On: Demo Runs and Ordinary Use
Registries and bank transfers do not see the account itself. Before funding, we run the demo: how KYC works step by step, which documents are requested, how long approval takes. During the live window we check whether the fee schedule on the site matches what the account actually pays, we time support replies on the channels the platform genuinely operates rather than the ones listed in its footer, and we note ordinary-use behaviour — order execution, spreads on the pairs we traded, weekend coverage. These observations are dated and published next to the registry evidence, because they cover what the registry evidence cannot see.
What We Cannot Check — and Say So
The number platforms market hardest is the one nobody can verify in advance: returns. A +62% or +108% result from a 30-day window is an observation about that window, not a property of the platform; published as an expectation, it becomes a promise nobody can keep. We record test results as dated observations and state in every review that they are not a forecast. The same limit applies to future solvency, to security against attacks that have not yet happened, and to behaviour under market stress our window did not contain. A review that claims otherwise has left the territory registries can reach.
Every Check Carries a Date — and Dates Get Re-Run
An undated registry check is a claim about the past wearing the clothes of a claim about the present. Every result in our reviews carries an “as of” date — the day the check ran, not the day the fact became true — and the dates must run in a defensible order: company registration first, then license grant, then our audit, then publication. The audit date stays visible even after later updates.
The checks also re-run. A review is refreshed when a warning list gains an entry naming the platform, when a reader reports a discrepancy we can confirm, when a register status changes, or on a scheduled refresh. The updatedAt date on a page moves only when the evidence under it has moved. RijksLedger AI shows the full stack in one place: KvK 85377005, AFM 12066941, a clean warning-list screen and a documented test, each dated and screenshotted on the review page.
FAQ
Can I repeat these checks myself?
Yes, and you should. Every register named on this page is public and free to search — Companies House by company number, the FCA Register by firm name, ORIAS by registration number. The full Stage 1 and Stage 2 stack for a single platform takes an afternoon with a browser and a notepad.
Does an empty warning-list result mean the platform is approved?
No. Regulators approve through a register entry, not through silence on a warning list. A clean search means no regulator has flagged the name yet — weak positive evidence, which is why we pair it with the Stage 2 checks rather than resting on it.
What is a clone firm?
A site borrowing the identity of a real registered company — its name, its license numbers, its regulator. The registry checks pass and the site is still not the firm. Domain spelling, TLS certificate dates, redirect chains and contact cross-checks are what catch them.
Why do you publish the withdrawal amount, method and bank?
Because “withdrawals work” is not a checkable claim, and “£60 to Monzo in 2 hours 35 minutes on 6 October 2026” is. The detail exists so the record can be argued with, not just believed.
Does a positive test result mean I will earn the same?
No. A 30-day test that returns +62% or +108% describes one window on one account. It is a dated observation, not a property of the platform, and it does not enter our assessment of operational trustworthiness.
How often is a platform re-checked?
On triggers and on schedule: a new warning-list entry, a reader report we can confirm, a register status change, or a scheduled refresh. The updatedAt date on a review moves only when the evidence under it moves.
Disclaimer
This article is informational and does not constitute investment advice; trading crypto assets carries a risk of losing capital. Some links on TycoonZone are partner links that may earn us a commission at no extra cost to you — they do not influence our checks or conclusions, which follow the process described above.