Norway FSA Relays Central Bank of Ireland Warning on Cloned Firm Carrowmore Financial Services

Key Takeaways

• The Norway Financial Supervisory Authority has published a warning that references a Central Bank of Ireland notice on "Carrowmore Financial Services (CLONE)," an unauthorized firm that appears to be impersonating a legitimate entity.
• Compliance teams should treat the name as a fraud and impersonation red flag and update screening and customer-warning controls.
• The source material is brief, so teams should consult the original Irish notice for specifics.

Deep Dive

The Norway Financial Supervisory Authority has published a warning that references a Central Bank of Ireland notice on "Carrowmore Financial Services (CLONE)," an unauthorized firm that appears to be impersonating a legitimate entity. Compliance teams should treat the name as a fraud and impersonation red flag and update screening and customer-warning controls. The source material is brief, so teams should consult the original Irish notice for specifics.

For compliance teams, the main implications are fraud prevention, third-party due diligence, and customer protection. Clone firms are commonly associated with investment scams, advance-fee fraud, and money mule recruitment. Institutions may encounter payments to or from accounts linked to the entity, customers asking about its legitimacy, or attempts to use the name in onboarding or counterparty relationships. No deadlines or effective dates are stated. The warning is dated 2026-09-11, and the response should be prompt and risk-based.

Recommended actions: (1) Review the Central Bank of Ireland notice and record the firm's identifiers, including domains, addresses, phone numbers, and any impersonated firm reference numbers. (2) Add the name and identifiers to internal watchlists, adverse media screening, and transaction monitoring rules. (3) Search existing customer, counterparty, and payment data for matches or links. (4) Escalate hits for review and, where suspicion arises, file suspicious activity or transaction reports with the relevant financial intelligence unit, in line with local requirements. (5) Brief client-facing and fraud teams and, where appropriate, issue customer alerts advising verification of firm authorization through official regulator registers.

The overall risk is moderate. The direct regulatory exposure for most institutions is low, but the potential for customer harm, fraud losses, and unwitting involvement in illicit fund flows is real if clone-firm payments are not detected. Institutions should also confirm that their processes for verifying a firm's authorization status do not rely solely on information supplied by the counterparty, since clone firms often replicate legitimate registration details.

Source: Norway Financial Supervisory Authority