Stripe has now blocked the Company Registry fraud – but why did it facilitate it?

We reported on Monday that, if you incorporate a UK company, you are likely to receive an official-looking letter from “Company Registry” charging you £45. It’s a scam, and a large and well-organised one.

We’ll be naming and shaming the legitimate businesses who are facilitating the scam. The first was Tide, who signed up the scammers as an affiliate and paid them referral fees.

Today it’s Stripe, the payment company, who processed all of the victims’ payments to Company Registry. But, to their credit, Stripe have responded quickly to our report, and blocked the scammers from their systems.

The scam

If you incorporate a UK company, you are likely to receive a letter like this from “Company Registry” (company-registry.org):

It looks like an official document – an invoice for a service that has already been purchased (“Pending”, “Complete activation”, “These are the next steps”, “IMPORTANT!”).

The reference to a “COVID 19 New Business Relief Deduction” again gives the impression this is an official letter.

It isn’t. It’s a scam. More about that in Monday’s report.

The link to Stripe

If you “activate your account” with Company Registry, you’re presented with this payment page:

The code for the page shows that Stripe processes the payments:

Stripe is an “Authorised Electronic Money Institution” regulated by the Financial Conduct Authority (FCA). Needless to say, they shouldn’t be proceeding payments for a fraudster.

FCA rules require electronic money institutions to have effective procedures to prevent them being used to facilitate financial crime. That includes customer due diligence and ongoing monitoring.¹See paragraph 3.80 et seq of the relevant FCA guidance). Most financial institutions have very sophisticated²And historically also very fallible “know your client” (KYC) and anti-money laundering (AML) systems for this purpose.³I know these systems well, because I used to advise some of the world’s largest financial institutions on how to make sure these systems didn’t facilitate tax evasion. Stripe were not a client, but if I was advising them now I’d say there is a risk they could be criminally liable if – as seems plausible – Company Registry has committed tax evasion.

But in this case, sophisticated systems weren’t required, merely one look at Trust Pilot⁴The handful of positive reviews are all from users in the US, where Company Registry doesn’t conduct business. or a Google search:⁵Unsurprisingly, a Google search (“open source research”) is usually one of the first steps a KYC/AML team takes when onboarding clients or counterparties.⁶This Google search, as with others we refer to in our reports, was conducted via a UK VPN using Chrome in “incognito” mode, so it should be representative of the results for a general UK user, and not customised for Tax Policy Associates.

We understand Stripe was Company Registry’s payment processor from when the scam started around October 2021. At that point there wouldn’t have been obvious signs that Company Registry was a scam. But in April 2023, Companies House published a warning about Company Registry which was widely circulated. The obvious conclusion: Stripe doesn’t update its KYC/AML checks on its clients effectively enough, and/or frequently enough.

Stripe’s response to our report

We have been regularly checking Company Registry’s website – at some point in the last week, its payment processing system failed. Attempts to make payment result in an error.⁷Company Registry’s API fails to receive a response from Stripe, and fails with a 500 error.

We infer that Stripe stopped processing payments for Company Registry, either as a result of our reports, or as a result of earlier tweets. That breaks the Company Registry scam, at least for now – which is excellent news.

We reached out to Stripe for comment: they said that (understandably) they are unable to comment on individual users/clients.

The good and bad news

The bad news is obvious: Stripe didn’t spot obvious signs that their client was fraudulent, and processed payments that furthered their criminal enterprise.

But there is some good news:

• We expect Stripe will be making a “suspicious activity report” to the regulator. That should include the details of the people behind Company Registry (which Stripe should have obtained during its KYC process). This information should assist law enforcement with pursuing those responsible.
• Stripe now knows that all the payments made to Company Registry are suspicious – it should reverse them, and refund the victims of the scam.

We’ll also be asking the FCA to investigate Stripe’s KYC/AML processes.

We assume Company Registry will try to change their payment provider. It would be extremely disappointing if any regulated institution were to accept Company Registry as a client – but watch this space.

• 1
  See paragraph 3.80 et seq of the relevant FCA guidance).
• 2
  And historically also very fallible
• 3
  I know these systems well, because I used to advise some of the world’s largest financial institutions on how to make sure these systems didn’t facilitate tax evasion. Stripe were not a client, but if I was advising them now I’d say there is a risk they could be criminally liable if – as seems plausible – Company Registry has committed tax evasion.
• 4
  The handful of positive reviews are all from users in the US, where Company Registry doesn’t conduct business.
• 5
  Unsurprisingly, a Google search (“open source research”) is usually one of the first steps a KYC/AML team takes when onboarding clients or counterparties.
• 6
  This Google search, as with others we refer to in our reports, was conducted via a UK VPN using Chrome in “incognito” mode, so it should be representative of the results for a general UK user, and not customised for Tax Policy Associates.
• 7
  Company Registry’s API fails to receive a response from Stripe, and fails with a 500 error.