XTB review

A clean authorisation with clean disciplinary history, surrounded by four separate FCA warnings. One of the warned entities is listed at E14 5AA, which is the same postcode as the authorised firm. The impersonator is using the real company's address.

Last verified 26 August 2026 · how we check

The authorised record here is unremarkable in the best sense. What surrounds it is not.

What the registers return

Companies House number 07227848. ASIC returns nothing.

Four warnings, and one of them uses the real address

The authorised firm, XTB Limited, is registered at postcode E14 5AA.

The warning-list entry for XTB Trading is also listed at E14 5AA.

That is not a coincidence of geography. Whoever built that operation put the authorised firm’s own postcode on it, which is the logical endpoint of the clone technique: copy not just the name and the firm reference number but the address, so that every field a cautious person checks comes back matching.

Three further entries are marked explicitly as clones: XTB GROUP, XTB Coin Trading and XTB Global. Four warnings around one brand is the largest cluster we have found, ahead of the four at FxPro only because of that shared postcode.

What this breaks

Most advice about avoiding broker fraud reduces to “check the details against the register”. This cluster shows the limit of that advice. If the impersonator copies the name, the firm reference number and the address, then every field you compare will match, and matching is exactly the feeling of having verified something.

The check that still works is directional. Start at the regulator and go outward, not at the website and go inward.

Open register.fca.org.uk yourself, type the firm reference number, and read the contact details the regulator holds. Then compare those against the site you were about to use. The domain, the phone number and the email on the register are the authoritative ones. A site that does not match them is not the firm, however well its own page copies the paperwork.

Done in that direction, the shared postcode stops mattering: you are no longer checking whether the site’s claims are internally consistent, you are checking whether the site is the one the regulator names.

The authorised record itself

XTB Limited, FRN 522157, authorised since 17 January 2011, disciplinary history empty after the check we now run on every firm following the Plus500 finding.

The name history is unusually busy. The company has been registered as XTB Limited since 8 January 2015, traded as XTB UK from 30 May 2012 and as X Open Hub from 17 August 2015, and previously traded as XTB Direct until January 2015. One FRN therefore carries both a retail brand and a separate institutional one.

Two entries for X-Trade Brokers Dom Maklerski S.A. read No longer authorised, which is the ordinary post-Brexit outcome for a passported European firm rather than an enforcement event, as at Tickmill and across Swissquote’s Malta entities.

The Cyprus entity, XTB Ltd, holds CySEC licence 169/12, bringing the Investor Compensation Fund for EU clients. Nothing appears in Australia.

The warning list across fourteen brands

Having now read the list against every brand in this series, the entries fall into three kinds, and the difference between them is the whole value of the exercise.

Twelve of the entries we found are in the first two rows. Two are in the third, and those two are the ones that changed a verdict.

The tell is mechanical: open the entry and read the address and the URL. If they belong to the broker, the warning is about the broker. If they do not, somebody else is using the name. It takes ten seconds and it is the difference between an irrelevant entry and a material one.

This brand adds the case that breaks the shortcut. When the impersonator copies the address as well as the name, the address stops being evidence, and only the direction of the check saves you.

What the licences cap

Retail leverage is capped at 30:1 on major FX under the FCA and CySEC, with lower limits by asset class, per leverage limits by regulator. Compensation is the FSCS behind the UK entity for eligible claimants and the ICF behind the Cyprus entity.

What to check before funding

Start at the regulator’s own site, not at the broker’s. This review is the clearest argument in the series for doing it in that order.

Compare the domain and contact details the register holds against the ones in front of you. Four entities on the warning list are using this brand, and one has copied the address.

Confirm the entity in your client agreement, since the group runs UK, Cypriot and other companies with different protections.

Read the leverage on offer. It identifies the rulebook in one line.

What we checked, and what we didn’t

We read the FCA register record for FRN 522157 including permissions, name history and disciplinary history, the four warning-list entries around this brand with their stated postcodes, and the CySEC and ASIC registers we hold locally, on 26 August 2026.

The firm’s site blocked automated access, so account specifics are left unstated rather than taken from third-party reviews. We have not contacted any of the warned entities and we make no claim about who operates them beyond what the FCA has published.

We have not opened an account, deposited money, or tested spreads, execution, support or withdrawals. caution is our default where we have not been a client; the authorised record raised nothing.

Sources

• FCA — Financial Services Register, FRN 522157, and the warning list
• CySEC — register of Cypriot investment firms
• ASIC Financial Services Licensee Register