Norway FSA Publishes Warning on MelzaPlay S.A., Luxembourg Issuer Tied to CSSF Website Alert

Key Takeaways

• The Norway Financial Supervisory Authority has published a warning about MelzaPlay S.A., an entity identified as a Luxembourg issuer, and it references a CSSF warning about the website www.melzapay.com.
• The notice indicates that the entity or its website may be offering financial services without proper authorization.
• Compliance teams should screen for exposure and strengthen controls against potential fraud and unauthorized activity.

Deep Dive

The source material is brief and contains no detailed findings. It names MelzaPlay S.A. as the subject, lists Luxembourg as the issuer's location, and links to a CSSF (Luxembourg's Commission de Surveillance du Secteur Financier) warning about the website www.melzapay.com. The metadata attributes the publication to the Norway Financial Supervisory Authority, with a Norway jurisdiction tag and a date of 2026-09-03. The CSSF URL path suggests the original warning was issued in August 2026. The Norwegian publication therefore appears to be a relayed or cross-referenced alert. Because the text is limited, the specific conduct is not confirmed here. Such warnings typically concern entities that are unauthorized, impersonate licensed firms, or solicit customers fraudulently. Teams should read the linked CSSF notice before drawing conclusions.

The warning creates no new regulatory obligations and sets no deadlines. Its significance is as an intelligence signal. Regulators issue these notices to alert the public and industry that a named entity or website is not authorized or may be misusing the identity of a supervised firm. Cross-border relaying of such warnings indicates that the activity may target consumers in multiple jurisdictions, including Norway and the wider EEA.

Compliance teams should take several steps. First, add MelzaPlay S.A. and the domain www.melzapay.com to sanctions, adverse media, and internal watchlist screening, and review customer and counterparty databases for matches. Second, review transaction monitoring for payments to or from the entity, and consider filing suspicious activity or transaction reports if links are found. Third, have fraud and cybersecurity teams consider blocking or monitoring the domain, and prepare customer-facing guidance on investment and payment scams. Fourth, confirm the entity's status independently through the CSSF register and other official sources, and document the outcome.

The main risks are fraud losses, facilitation of money laundering through accounts used by the entity, and reputational and conduct exposure if the institution handles funds linked to an unauthorized provider. Name similarity with legitimate payment brands also creates a risk of confusion or impersonation. Overall impact on regulated firms is low to moderate and is mainly operational: it calls for screening, monitoring, and customer awareness rather than program changes. Note that the Norway attribution and the Luxembourg source should be reconciled, and the original publication verified.

Source: Norway Financial Supervisory Authority