CySEC, the Cyprus Securities and Exchange Commission, has published a fresh list of CySEC unauthorised investment websites, naming ten domains that may be offering investment or crypto-asset services without the required regulatory approval. The warning carries a date of 4 September 2026.
The regulator confirmed the listed websites are not connected to any entity authorised to provide investment services or carry out investment activities under Article 5 of Law 87(I)/2017. None of the domains are registered crypto-asset service providers under the EU’s Markets in Crypto-Assets Regulation (MiCA), which sets the framework for crypto services across the bloc.
The Ten Websites CySEC Has Flagged
The September warning lists the following domains: amazon-forex.com, novatradecore.com, vall-fin.com, daoroyal.com, capitaldealhub.com/AI_app_es, digiteamagency.com/second-income/, seamanfx.com, newfuturevip.com, trademarketcup.com, and fxtrade.app.
CySEC did not identify the operators behind any of the websites, nor did it confirm whether investor complaints had been received. The warning is limited to authorisation status: these domains are simply not on the regulator’s approved list. The regulator also stopped short of describing any of the sites as clones of licensed firms, even though some names could be mistaken for established financial brands.
This September notice is the latest in a series of such warnings. On 14 August 2026, CySEC published a separate warning listing nine websites also flagged as unauthorised under Article 5 of Law 87(I)/2017, including m4-platform.com, waltonmarketltd.com, investiumlimited.com, evercrest.capital, gofx.com, tazerpro.com, quantacfd.com, cypriantrustbank.com, and omnixmarkets.com. Between the two notices issued in less than three weeks, CySEC has flagged 19 domains as operating outside its authorisation framework.
What CySEC Unauthorised Investment Websites Mean for Retail Investors
Firms that sit outside CySEC’s supervisory framework are not bound by the investor protections that apply to licensed investment firms. For retail clients, that means no access to dispute resolution through the regulator, no mandatory segregation of client funds, and no recourse to compensation schemes that licensed firms are required to maintain.
CySEC was direct on one practical point: a convincing website, a professional logo, a Cyprus office address, or a claimed licence number does not confirm that a firm is genuinely authorised. Anyone can display those details.
Before committing money to any investment platform, CySEC advises checking the regulator’s List of Non-Approved Domains, which is updated as new warnings are issued and sits separately from CySEC’s general warnings page. The authorised-firms register is the other essential check: if the firm’s name does not appear there under its exact trading name, it is not licensed.
If you have already been contacted by an unlicensed firm, CySEC operates a formal complaints mechanism for non-regulated entities, where members of the public can submit a complaint directly to the regulator. That route is worth using even if no money has changed hands, as it helps CySEC build a picture of which firms are actively soliciting Cypriot residents.
Cyprus has been active in shaping its crypto regulatory environment. The regulator removed Binance Cyprus Ltd from its Register of Crypto Asset Service Providers on 1 August 2023, citing a continuous six-month period in which the firm had not provided crypto-asset services, under a board decision published by CySEC. The episode illustrates that even firms that were once registered can lose that status, and that checking current authorisation rather than relying on past knowledge is the only reliable approach.
These warnings are not enforcement actions. CySEC has not fined or prosecuted the operators of the listed sites, and the notices carry no legal consequence for the domains themselves. What they do establish is the regulator’s public position: use any of these platforms and you are on your own, with no supervisory backstop if something goes wrong.
With CySEC issuing multiple batches of warnings within weeks of each other, investors using any Cypriot-adjacent forex, CFD (contracts for difference, a leveraged product tracking an underlying asset), or crypto platform should treat an authorisation check not as a one-off task but as a standing habit before any new deposit.
