Norway FSA Issues Warning on Finlto Clone Impersonating FCA-Authorized Firm

Key Takeaways

• The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning about "Finlto (Clone)," which appears to be a clone of a UK FCA-authorized firm.
• The source material is limited, but clone-firm warnings signal active impersonation fraud that compliance teams should factor into onboarding, screening, and customer protection controls.

Deep Dive

The notice is brief. It identifies "Finlto (Clone)" as the subject, lists the United Kingdom as the issuer, and links to a warning on the UK Financial Conduct Authority (FCA) website titled "Finlto (Clone) - FCA Authorised Firm." The Norwegian authority appears to be relaying or republishing the FCA warning. The notice itself gives no details on the fraudulent entity's domains, contact details, or specific conduct, and I have not independently verified the linked content. Teams should review the FCA page directly for the identifiers needed to act.

A "clone" warning typically means that fraudsters are using the name, firm reference number, or other details of a genuine authorized firm to appear legitimate. The legitimate firm is generally not involved in the misconduct. The warning creates no new regulatory obligations and has no stated deadlines or effective dates. It is an alert that raises the expected standard of diligence around counterparties and customer payments linked to this name.

Compliance teams should take the following steps: - Retrieve the FCA warning and extract all listed identifiers, including websites, email addresses, phone numbers, and any firm reference numbers. - Add those identifiers to internal watchlists, sanctions and adverse media screening, and web or email blocklists where appropriate. - Run lookbacks on customer payments, counterparties, and onboarding records for any connection to Finlto. - Verify any claimed FCA authorization against the FCA Register using independently sourced contact details, not those supplied by the firm. - Alert fraud, AML, and customer service teams, and consider a customer advisory if exposure is plausible.

The main risks are investment or payment fraud affecting customers, the possible use of the institution's accounts to move scam proceeds, and reputational harm if the institution is seen to facilitate impersonation scams. Where suspicious transactions are identified, evaluate suspicious activity reporting obligations in the relevant jurisdictions, including Norway and the UK. The direct impact on most institutions is low, but the exposure is meaningful for those with retail clients in Norway or payment flows to the UK. Because the source content is limited, document the review and the sources used.

Source: Norway Financial Supervisory Authority