CySEC has flagged ten unlicensed investment websites in a notice dated 14 August 2026, warning consumers that none of the sites belong to entities authorised to provide investment services in Cyprus. Two of the names closely resemble those of firms that actually hold licences from the Cypriot watchdog, raising the risk that investors could confuse them for regulated brokers.
Ten Unlicensed Investment Websites Named in the Warning
The Cyprus Securities and Exchange Commission (CySEC) named the following sites: m4-platform.com, m4-markets-latam.vercel.app, waltonmarketltd.com, investiumlimited.com, evercrest.capital, gofx.com, tazerpro.com, quantacfd.com, cypriantrustbank.com, and omnixmarkets.com.
The regulator said none of the sites are connected to entities authorised under Article 5 of Law 87(I)/2017, the Cypriot legislation that governs investment firms operating in the country. CySEC did not name the operators behind any of the websites.
Firms operating outside CySEC’s authorisation framework are not subject to its supervision, which means clients may not have access to the investor protections that apply when dealing with a licensed investment firm. Those protections include access to the Investor Compensation Fund, which covers eligible clients of Cypriot Investment Firms (CIFs) if a firm cannot meet its obligations.
When a Name Looks Familiar but the Domain Does Not Match
Two of the flagged domains are particularly worth examining, because they echo the branding of firms that genuinely appear on CySEC’s register.
The site investiumlimited.com resembles Investium Limited, which holds CySEC licence number 421/22 and registration number 412142. According to the CySEC register entry for Investium Limited, the firm’s approved domain is flexinvest.com and its contact email is info@flexinvest.com. The flagged site investiumlimited.com is a different address entirely and is not approved by the regulator.
Similarly, m4-platform.com and m4-markets-latam.vercel.app resemble the M4Markets brand. Harindale Ltd, which operates the M4Markets trade name, holds registration number 346662 and its approved domain is www.m4markets.eu, as shown in the CySEC register entry for Harindale Ltd. Neither of the flagged addresses matches the approved domain.
This pattern, where an unauthorised site adopts a name close to a regulated brand, is a known tactic. It can lead investors to believe they are dealing with a supervised firm when they are not. Checking the exact domain against the regulator’s register is the only reliable way to confirm you are in the right place.
How to Check Before You Deposit
CySEC maintains two useful public tools. Its main register lets investors look up company names, licence numbers, approved domains, and contact details for every authorised investment firm. Separately, the regulator publishes a list of non-approved domains, which is updated as new warnings are issued. Checking both before opening an account or sending money takes a matter of minutes.
For UK investors, the equivalent process at the Financial Conduct Authority (FCA) is the Financial Services Register, which performs the same function: verifying that a firm and its specific website are genuinely authorised. The principle is identical whether you are dealing with a CySEC-regulated broker or an FCA-authorised firm.
CySEC issues these warnings regularly, and the August notice follows the same structure as previous rounds. The regulator urges investors to check its official website before doing business with any investment firm.
The practical takeaway for anyone approached by one of these ten sites, or by any firm they cannot verify on a regulator’s public register, is straightforward: an unverified domain is an unverified firm. The next update to CySEC’s non-approved domains list will show whether further sites have been added since this notice.
