Key Takeaways
- • BaFin warned on 14 October 2026 about 23 near-identically built investment websites offering financial and crypto-asset services without a German licence, according to the regulator's consumer notice headed with the address GainLiteX(.)co.
- • The regulator's notice describes a shared identifying template across the run, rather than a single provider, and lists the 23 addresses in defanged form.
- • BaFin's notice states the operators are not supervised by BaFin; it does not claim the sites steal client money or invent profits.
- • Two recurring sales sentences across the sites, promising tailored financial advice and membership in "the world's leading provider of financial investments", serve as a fingerprint for identifying further sites in the run.
- • BaFin's company database holds crypto-asset service providers in a separate category, so checks should search under "all companies" or the matching category to avoid false negatives.
Summary
BaFin warned on 14 October 2026 about 23 websites built to a single blueprint that offer financial and crypto-asset services without a licence, according to the regulator's consumer notice. The notice is headed with the address GainLiteX(.)co and lists the 23 further sites in the body, written in defanged form. According to the authority's findings, the operators are not supervised by BaFin. The list includes names such as Acmedividends(.)com, cmetrustgroup(.)com, globalcapitalshares(.)com, and zenithwealthglobals(.)org, with endings ranging from .com and .org to .live, .pro, .trade and .ltd.
The form of the notice is unusual. Rather than naming one provider, BaFin describes an identifying feature shared by every site in the run and then attaches the list of known addresses. Under German law, anyone offering financial and investment services requires a BaFin licence, and the same has applied to crypto-asset services under the EU crypto regulation MiCAR. BaFin quotes two recurring sales formulations: one promising comprehensive financial advice tailored to individual needs, and another inviting visitors to join "the world's leading provider of financial investments".
The notice distinguishes unlicensed operation from proven fraud. BaFin does not allege that the 23 sites steal client money or invent profits. Without a licence, however, the supervisory protections attached to authorised firms are absent, including the duty to hold client crypto-assets separately, formal complaints channels, and the authority's power to prohibit the business. In the same notice, BaFin joined the Federal Criminal Police Office and state criminal police offices in a general warning about online financial fraud.
For verification, BaFin's company database places crypto-asset service providers in a separate category from credit institutions and investment firms, so a search limited to "all institutions" can return a false negative. The database's data was last updated on 13 October 2026, meaning a recently granted licence may be missing, while an unlicensed new platform will also be absent. A hit in the correct category is a strong indicator of supervision; a missing hit is a reason not to transfer funds.
The form of the notice is unusual. Rather than naming one provider, BaFin describes an identifying feature shared by every site in the run and then attaches the list of known addresses. Under German law, anyone offering financial and investment services requires a BaFin licence, and the same has applied to crypto-asset services under the EU crypto regulation MiCAR. BaFin quotes two recurring sales formulations: one promising comprehensive financial advice tailored to individual needs, and another inviting visitors to join "the world's leading provider of financial investments".
The notice distinguishes unlicensed operation from proven fraud. BaFin does not allege that the 23 sites steal client money or invent profits. Without a licence, however, the supervisory protections attached to authorised firms are absent, including the duty to hold client crypto-assets separately, formal complaints channels, and the authority's power to prohibit the business. In the same notice, BaFin joined the Federal Criminal Police Office and state criminal police offices in a general warning about online financial fraud.
For verification, BaFin's company database places crypto-asset service providers in a separate category from credit institutions and investment firms, so a search limited to "all institutions" can return a false negative. The database's data was last updated on 13 October 2026, meaning a recently granted licence may be missing, while an unlicensed new platform will also be absent. A hit in the correct category is a strong indicator of supervision; a missing hit is a reason not to transfer funds.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.