Germany's Federal Financial Supervisory Authority says a rebuilt EU register is "unofficial and su

EBA注册表造假警示：如何辨别真伪与防范风险

EBA（欧洲银行管理局）注册表是列出在欧洲经济区（EEA）内获得授权的信贷机构和支付机构的目录。任何想要确认某服务提供商是否真正持有授权的人，都会查阅该目录。然而，正是这种“查询”行为本身，成为了一种新型诈骗的目标。德国联邦金融监管局（BaFin）于2026年10月9日对此发出了警告：某些自称是欧洲银行的运营商，诱导潜在客户在其自行控制的域名下的注册表中查询其所谓的授权。

BaFin在声明中明确指出：“本网站上显示的注册表并非官方的EBA注册表，且疑似伪造。”同时，官方提供了真实目录的地址：euclid.eba.europa.eu。这一案例带来了一个令人不安的教训：验证过程比以往多了一步。仅仅在注册表中搜索提供商已不再足够，您首先必须确认您所查看的注册表本身是否真实。

10月9日的BaFin警告：运营商自建仿冒注册表

BaFin issued two consumer notices about unauthorized business on the same day. The first involves the website vantex-bank(.) com and vantex-bank(.) Publicity on. net. According to regulators, there is no credit institution called "Vantex Bank" in Germany or France. BaFin pointed out that the unidentified operators claimed that their alleged authorizations could be verified in the European Banking Authority's "public registry" at the website of euclide-eba(.) com。

This domain name is the key to the entire scam. It is very similar to the real address and may seem believable at first glance, but different enough that anyone can register for free. After clicking on the link provided by the provider, you will enter a directory controlled by the provider and find a record as expected. The check at this time does not confirm authorization, but only proves that someone has the ability to create a web page.

The second notice issued on the same day involved the website vaulttrades(.) co。According to BaFin's investigation, its operators provided crypto asset services without authorization and were not subject to its supervision. This information is based on Article 10, paragraph 7, of the Crypto Market Supervision Law. It should be noted that these two points are the results of investigations by regulatory agencies, not court decisions.

Euclid: The real EBA registry and its meaning

The European Banking Authority (EBA) is the regulatory authority of the European Union's banking industry. It maintains a central directory under the name "Euclid" to which national regulators submit information on authorized credit and payment institutions. EEA refers to the European Economic Area, which includes the member states of the European Union as well as Iceland, Liechtenstein and Norway. An entry in this catalog means that a national regulatory authority in the region has granted authorization to the agency and notified it to Brussels.

This directory is public and free, and exists only at a single address. Therefore, the safest but slightly inconvenient way to access is to manually enter the address into the browser's address bar rather than clicking on the link sent by the provider. Bookmarks you set yourself can do the same.

Regulatory agencies have only one official address. Entering manually ensures that you don't confuse it with a fake page.

Bank registries and crypto regulation: The two catalogs cannot prove each other

There is a second logical error here and is older than the current warning. Even if there is a real entry in the EBA registry, it cannot prove that the agency is legal to provide crypto asset services in Germany. The catalog only lists credit and payment institutions. Authorizations to carry out crypto business are individual licenses issued at the national level or under the European Regulation of Cryptographic Asset Markets (MiCA) and recorded in different other catalogs.

Any institution providing banking, financial, securities or crypto asset services in Germany needs to be authorized by BaFin. Relevant obligations and applicable deadlines for providers within the EU are detailed in our overview of crypto company MiCA licensing obligations. For investors, the opposite logic is equally important: a provider promoting a banking license does not prove that it has an authorization for the crypto business, and vice versa.

If you want to completely avoid the cumbersome process of checking through the registry, the most direct way is to choose platforms with unquestionable authorization status. For which platforms are regulated in Germany, please refer to our Regulated Crypto Exchanges Comparison Guide.

BaFin's corporate database: Verification of authorizations from source rather than relying on links

For Germany, the only competent authority is BaFin's corporate database. It lists the institutions that have been authorized by German regulators. Verification takes only three steps to complete, and each step should not go through the page to which the provider belongs:

1. First, open the database with the address you manually enter or save as a bookmark.
2. Second, search for the full name of the company, rather than the brand name or domain name of the application.
3. Third, compare the information in the database with what the provider claims. The registered office, legal form and type of business allowed must all be consistent.

If an institution is not included in the list, it does not automatically mean that there is a problem, as providers from other EU countries can operate through the "European Passport" mechanism. But this means that the authorization does not come from Germany and you need to continue to find its source.

We demonstrated in detail in September how to make such comparisons, and how to spot missing authorizations in minutes: how to check in three minutes whether the encryption provider holds authorizations. The procedure remains applicable. The new step lies in the preliminary step, that is, confirming the authenticity of the verification subject itself.

Seven of the thirteen warnings involve crypto assets: Eleven days of data statistics

We can count the frequency of crypto services appearing in these warnings. During the period from September 29 to October 9, 2026, BaFin issued thirteen consumer notices about unauthorized business. Seven of them explicitly mention crypto asset services, five are based on the Crypto Market Supervision Law, and ten are based on the Banking Law. In the first nine days of October alone, nine notices were issued.

More interesting than the total is the distribution of modus operandi. Five of the thirteen notices involved identity theft: a person posing as a real and regulated company and using its name or registration number. Of the thirteen cases, only one involved a forged registration form, the Vantex notice dated October 9. Regarding the pattern where the registration number is real but the sender is false, we once described in the nova-c-solutions.com case: When the registration number is real, what is hidden behind it.

From borrowing company names to rebuilding registries: Upgrading of methods

There are fundamental differences between these two variants, completely changing the difficulty of verification. Borrowing someone else's identity puts you in a vulnerable situation: the number belongs to another company, the name does not match the website, and the registered office is wrong. Rebuilding your own registry allows you to avoid this direct comparison. In this case, the name displayed on the page is the name of the website, the registered office is the address claimed by the website, and the number is a fake number issued by no one.

A counterfeit with its own verification step is more difficult to detect than a counterfeit that simply makes an assertion. Our assessment is that readers should focus on "Is the provider in the registry?" Move to "How did I enter this registry?". The evidence lies in the notice itself, in which BaFin classified the displayed catalog as suspected forgery and placed the real address next to it. On the other hand, this remains an isolated case so far: only one of the thirteen incidents in eleven days. Only when this blueprint is reused will it become a common approach. Given its extremely low cost, this possibility does exist.

The two directories may look identical, but only one is operated by an authoritative organization.

Money recovery fraud: using stolen cryptographic assets

在同一份通知中，BaFin记录称，这家所谓的银行也可能被用于所谓的“资金追回诈骗”。在这种诈骗中，犯罪者会再次联系之前的欺诈受害者，承诺帮助找回丢失的资金或加密资产。对于加密投资者来说，这是最危险的变种，因为它专门针对那些已经遭受损失且损失可在区块链上公开追踪的人群。

根据监管机构的描述，这一过程遵循固定模式。首先，以身份验证为由要求提供身份证件的副本。随后，犯罪者利用这些副本进行其他犯罪活动。接着，他们将支付所谓的费用或税款作为发放资金的先决条件。最终，没有任何资金到账。BaFin报告称，现在甚至开始接触那些根本没有损失资金的人，借口通常是礼物或补助。真正的权威机构绝不会要求预付费用来追回资产， reputable机构也不会通过电子邮件索要您的身份证件副本。

MiCA、KMAG与授权要求：两项警告背后的法律框架

BaFin有权发布此类通知是有法律依据的。对于Vantex通知，其依据是《银行法》第37条第4款；对于vaulttrades(.)co，其依据是《加密市场监督法》第10条第7款。KMAG是德国补充欧洲MiCA法规的法律，规范加密资产服务提供商的监管。它在近期警告中的作用，我们在此进行了拆解：九份BaFin警告中有五份基于《加密市场监督法》。

In practice, this means that BaFin's publications are not criminal sentences, but market information. Such notices document that a regulatory agency does not supervise a company and, based on its investigation, the company is engaged in business that requires authorization. In practice, this is completely enough, because without authorization, no protection mechanism attached to authorization exists.

Trading with unauthorized providers: Deposit insurance does not apply

This is the source of actual losses. In authorized agencies within the European Union, each customer's bank deposits are protected by law by up to 100,000 euros. This protection depends on authorizations, not on company names, and not on entries in a directory that someone runs. Agencies without authorization are not part of any protection program.

There is an additional point for crypto assets: Even at authorized providers, crypto assets are not covered by any deposit insurance. There, regulations provide different forms of protection through custody requirements and isolation requirements for customer positions. If authorization is lacking, these requirements are also missing. The only avenue left at this time is to file a civil lawsuit against the operator, which is usually listed as unknown in BaFin notices. In this case, the total loss is a normal outcome, not a marginal risk.

By the way, the same logic can appear in other disguises. How scammers invented so-called mandatory inspections to obtain wallet approval, please refer to our analysis of false anti-money laundering inspections on crypto-wallets.

EBA Registration Form: Two addresses determine the authenticity of a license

After all, you don't need a long checklist, just two manually entered addresses and a determination not to follow convenient links.

• Verify authorization in person: For Germany, this is the BaFin company database; for EEA, this is the registry at euclid.eba.europa.eu If you want to save the trouble of searching, start with an established authority: Regulated Crypto Exchange Comparison.
• Withdraw the balance while it can still be withdrawn: For an unauthorized provider, every day is extra. If you don't want to hand over the coins to a third party, please hold them yourself: Hardware Wallet Compare.
• Never pay in advance to get your own money: Fees, taxes, or deposits that are a condition for releasing funds are signs of recovery fraud. For users who want to start over and use an authorized provider, the exchange comparison guide is helpful.

The above two notices can be read on the regulatory agency's official website: Warning about the so-called Vantex Bank. (As of October 9, 2026. This article does not constitute investment advice. Price and fee structures will change; check terms with your provider before purchasing.)