Stripe has now blocked the Company Registry fraud – but why did it facilitate it?

We reported on Monday that, if you incorporate a UK company, you are likely to receive an official-looking letter from “Company Registry” charging you £45. It’s a scam, and a large and well-organised one.

We’ll be naming and shaming the legitimate businesses who are facilitating the scam. The first was Tide, who signed up the scammers as an affiliate and paid them referral fees.

Today it’s Stripe, the payment company, who processed all of the victims’ payments to Company Registry. But, to their credit, Stripe have responded quickly to our report, and blocked the scammers from their systems.

The scam

If you incorporate a UK company, you are likely to receive a letter like this from “Company Registry” (company-registry.org⚠️):

It looks like an official document – an invoice for a service that has already been purchased (“Pending”, “Complete activation”, “These are the next steps”, “IMPORTANT!”).

The reference to a “COVID 19 New Business Relief Deduction” again gives the impression this is an official letter.

It isn’t. It’s a scam. More about that in Monday’s report.

The link to Stripe

If you “activate your account” with Company Registry, you’re presented with this payment page:

The code for the page shows that Stripe processes the payments:

Stripe is an “Authorised Electronic Money Institution” regulated by the Financial Conduct Authority (FCA). Needless to say, they shouldn’t be proceeding payments for a fraudster.

FCA rules require electronic money institutions to have effective procedures to prevent them being used to facilitate financial crime. That includes customer due diligence and ongoing monitoring.¹ Most financial institutions have very sophisticated² “know your client” (KYC) and anti-money laundering (AML) systems for this purpose.³

But in this case, sophisticated systems weren’t required, merely one look at Trust Pilot⁴ or a Google search:⁵⁶

We understand Stripe was Company Registry’s payment processor from when the scam started around October 2021. At that point there wouldn’t have been obvious signs that Company Registry was a scam. But in April 2023, Companies House published a warning about Company Registry which was widely circulated. The obvious conclusion: Stripe doesn’t update its KYC/AML checks on its clients effectively enough, and/or frequently enough.

Stripe’s response to our report

We have been regularly checking Company Registry’s website – at some point in the last week, its payment processing system failed. Attempts to make payment result in an error.⁷

We infer that Stripe stopped processing payments for Company Registry, either as a result of our reports, or as a result of earlier tweets. That breaks the Company Registry scam, at least for now – which is excellent news.

We reached out to Stripe for comment: they said that (understandably) they are unable to comment on individual users/clients.

The good and bad news

The bad news is obvious: Stripe didn’t spot obvious signs that their client was fraudulent, and processed payments that furthered their criminal enterprise.

But there is some good news:

• We expect Stripe will be making a “suspicious activity report” to the regulator. That should include the details of the people behind Company Registry (which Stripe should have obtained during its KYC process). This information should assist law enforcement with pursuing those responsible.
• Stripe now knows that all the payments made to Company Registry are suspicious – it should reverse them, and refund the victims of the scam.

We’ll also be asking the FCA to investigate Stripe’s KYC/AML processes.

We assume Company Registry will try to change their payment provider. It would be extremely disappointing if any regulated institution were to accept Company Registry as a client – but watch this space.

---

<