Four firms claimed the Dubai regulator licensed them. One built a copy of its register to prove it

Between 30 June and 22 July 2026 the DFSA published four separate alerts about firms claiming it regulated them. Two had built counterfeit versions of the DFSA's own public register. Here is what each one did, and the check that defeats all of it.

Between 30 June and 22 July 2026, a span of twenty-three days, the Dubai Financial Services Authority published four separate alerts about firms falsely claiming it regulated them. Two of the four had gone beyond claiming a licence and built counterfeit copies of the DFSA’s own public register to prove it. We read all four alerts at source on 12 September 2026.

Four alerts in three weeks is not a coincidence of timing. It is a technique spreading, and the technique is worth understanding because it is aimed specifically at the person who checks.

Why the DIFC gets impersonated

The Dubai International Financial Centre is a financial free zone with its own civil and commercial laws and its own regulator, the DFSA. A DIFC licence carries real weight: capital requirements, supervision, a named authorised entity on a public register, and authorised individuals who are personally registered.

It also carries something a fraud can use. To most people outside the Gulf, “regulated in Dubai” sounds substantial and unfamiliar at the same time. Substantial enough to reassure, unfamiliar enough that few will know what the register looks like or where to find it. That gap is what these four firms were working in.

The four alerts

1. The cloned register

Two of the four built a fake version of the regulator’s register. The DFSA’s wording on Tasenovass LTD. is that the operation used “a fake website similar to the DFSA’s Public Register which represents that Tasenovass LTD. is licensed by the DFSA”. On RETINARXIV, the alert says the site “includes a link to a cloned version of the DFSA’s Public Register”, and that the clone lists “Retinarxiv Limited” as a Non-DIFC Company authorised to provide the Financial Services of “Investments” and “CFDs”.

Note the care in that second one. Not a made-up category, but “Non-DIFC Company”, which is a real classification the DFSA uses, paired with two real permission types. Somebody studied the genuine register closely enough to reproduce its vocabulary.

Now consider who a cloned register is for. It is not for the visitor who reads a footer and deposits. That person is already convinced. It is for the more careful visitor, the one who thinks “I should check that licence”, clicks the verification link the broker helpfully provides, sees the firm listed, and relaxes.

The check defeats the casual claim and is defeated in turn by the clone. Which inverts the usual advice: doing a check is not protection by itself. Where you do the check is the protection.

2. Faces that do not exist

The AmpliFi Capital alert of 1 July 2026 contains a sentence that would have read as science fiction in a regulatory notice five years ago. The website, the DFSA says, “lists three individuals, none of whom are DFSA Authorised Individuals and all of whom are named under portrait images generated using Artificial Intelligence.”

The DFSA also records that the site “makes unrealistic returns and guaranteed performance claims”, and that no company called AmpliFi Capital appears in the DIFC or on the UAE’s National Economic Register.

The synthetic photographs matter beyond the novelty. A management team page used to carry a real cost: you needed photographs of real people, which meant either paying models, which is traceable, or stealing images from LinkedIn, which is findable by reverse image search. A generated face has neither problem. It does not reverse-search to anyone, because it does not depict anyone.

One tell survives. On the DFSA’s finding here, the names were real-sounding and the faces were generated, but none of the three was a DFSA Authorised Individual. A genuinely licensed firm has individually registered people, searchable by name on the same register as the firm. Searching the names is a check that generated imagery does nothing to defeat.

The site now returns HTTP 451, “unavailable for legal reasons”, behind a takedown notice. It is the only one of the four that has been removed.

3. The regulator’s name inside the contract

TRADEMARKET FZCO, alerted on 7 July 2026, did something quieter and in some ways worse. It did not just claim DFSA oversight in its marketing. According to the DFSA, it stated in investor contracts that the fund was “subject to the Dubai Financial Services Authority (DFSA) and its supplementary regulations”.

A claim in a footer is aimed at somebody browsing. A clause in a contract is aimed at somebody who has already decided to invest and is doing the last responsible thing before transferring the money: reading the document they are about to sign. Finding the regulator named there is precisely the reassurance a careful person is looking for at that moment.

The DFSA ran two register searches and published both results: no company named TRADEMARK in the DIFC, and no investment fund named PERSONAL registered with the DFSA. Neither the firm nor the product existed in the records that would have had to contain them.

TRADEMARKET247 was already known to another regulator. In February 2026 South Africa’s FSCA published a public warning naming Trade Market 247 and its website, recording that it solicited funds through WhatsApp and that the FSCA could not reach it using the contact details the firm itself published. Our full file is at TradeMarket247, and the site has since disappeared entirely.

4. Naming regulators without naming licences

RETINARXIV is the one of the four still trading, and reading it alongside the DFSA alert shows the pattern in its finished state.

Its licences page claims four authorities: the CSSF in Luxembourg, the FCA in the United Kingdom, the DFSA in the UAE and the VFSC in Vanuatu. Each gets a logo and a paragraph explaining what that regulator does. None gets a licence number. None gets a register link or the name of an entity said to hold it.

Copy explaining that the FCA “protects clients and ensures the honesty of operations” is entirely true about the FCA and says nothing at all about the broker printing it. A licences page that describes regulators instead of naming licences is not making a claim. It is arranging an impression, and an impression cannot be checked because there is nothing in it to check.

The four claimed regimes do not belong together either. Luxembourg and the UK are tier-one, with capital requirements, reporting and compensation schemes. Vanuatu is offshore with no compensation scheme at all. A firm holding all four would hold them through four separate entities and would name every one, because naming them is the point of having them.

What the four have in common

Read together, the alerts describe a single progression rather than four unrelated firms.

1. Claim the regulator. Cheapest step, defeated by anyone who checks.
2. Build somewhere for the check to land. A cloned register, so the person who checks finds what they were hoping to find.
3. Populate the company with people. Generated portraits under real-sounding names, which cost nothing and reverse-search to nobody.
4. Move the claim into the contract. Where it reaches the careful investor at the moment of deciding.

Every one of those steps is aimed at somebody doing more diligence than average, not less. That is the finding worth taking away from this cluster. The advice to “always check the regulator” is right, and on its own it is no longer sufficient.

The check that defeats all four

It is a small change and it costs nothing.

Never follow a verification link the broker gives you. Type the regulator’s own address into your browser yourself and search there. A cloned register only works on somebody who arrived through the broker’s site. Opening the DFSA’s public register directly defeats it completely, and the same holds for the FCA, the CSSF or any other authority a firm names.

Then run these four searches on the regulator’s own site:

If the firm names a regulator and publishes no licence number, you can stop there. That is not an omission. Across the reviews on this site, every firm that has claimed regulation without a checkable number has turned out not to have one.

Sources

• DFSA, “False Claim of DFSA Authorisation by Tasenovass LTD. and Akanivutar”, 30 June 2026
• DFSA, “False Claims by AmpliFi Capital that it is Regulated by the DFSA”, 1 July 2026
• DFSA, “False Claims by TRADEMARKET FZCO that it is Regulated by the DFSA”, 7 July 2026
• DFSA, “False claims by RETINARXIV Brokers that it is regulated by the DFSA”, 22 July 2026
• FSCA public warning naming Trade Market 247 and Cuntrade, February 2026, as reported by IOL and Business Report on 20 February 2026. The FSCA’s own page was not reachable on 12 September 2026 and this citation should be replaced with it when the site is available
• retinarxiv.net and amplifi-capital.com read directly on 12 September 2026

All four DFSA alerts are published on the regulator’s own site and are free to read. Our scoring method is at our methodology page, and every broker we have rated is at the full broker list.