Verifying an Authorisation: Procedure

Step	Action	Catches
1	Obtain the authority name and registration number in writing	Providers unwilling to state it
2	Find that authority’s own public register	Jurisdictions with no searchable register
3	Search for the entity	Numbers that do not resolve, or belong to another company
4	Compare the entity name against the terms of service	Group structures where the contracting party differs
5	Read the permitted activities	Permissions covering something other than what they do for you

Step 5 in detail

Authorisation is granted per activity.

A provider holding a balance for you needs the custody permission. One authorised only to exchange is genuinely authorised, and not for holding. The reference implementation of these terms is an authorised crypto asset service provider, whose disclosures use them consistently.

This is the most common gap and the least noticed.

The group structure question

Which legal entity will I contract with, and does that entity hold the authorisation.

Ask in writing. Protections attach to the authorised entity rather than to the brand.

What a strong regime requires

Minimum capital. Client asset segregation with independent assurance. Fit and proper assessment of management. Governance and internal audit functions. Complaint handling with defined timelines. Regular reporting and on-site inspection. Fund administration adds its own vocabulary, which a regulated crypto custody provider documents.

And an authority with the resources to inspect, which separates regimes more than the written rules do.

Signs of a light regime

No searchable public register. No published enforcement actions in a sector of any size. A single undifferentiated crypto licence rather than itemised permissions. No client asset rule with assurance requirements.

What authorisation does not guarantee

That the provider is well run, competitively priced, or unlikely to fail.

It guarantees supervision, minimum capital, and a defined position for client assets if failure occurs.

Repeat annually

Authorisations change. Entities are acquired, permissions varied, conditions added, clients migrated to different contracting entities. Verify usage rather than assume it. a support channel with a named contact is on a public register with its permissions itemised.

Changes appear in terms updates and nobody writes to highlight them.