How to verify a financial app before sending it money

A financial app can look like one company while several companies operate behind the screen. One runs the app, another manages investments, a dealer carries the account, and a bank holds the cash.

That is common. The problem begins when you cannot tell which company has your money or what each one is responsible for.

Start with legal names

Open the account agreement and funding instructions. Find the exact legal name of the company you are contracting with, the bank holding cash, the dealer carrying investments, and any portfolio manager or adviser.

Then follow one dollar. Who receives it? Where does it sit? Which company appears on the statement? Who sends it back when you withdraw?

The answers should agree across the agreement, funding screen, and statement. A request to send money to an employee, unrelated business, or unexplained third party is a reason to stop.

Check each company for its actual job

Do not ask whether the app is regulated. Ask which company is regulated to do what.

• Cash: Check a claimed bank, federal credit union, trust company, or loan company in the Office of the Superintendent of Financial Institutions financial-institution directory. Check Canada Deposit Insurance Corporation (CDIC) membership separately. Provincial credit unions have provincial regulators and deposit insurers.
• Investments: Search the adviser or portfolio manager through the official registrant search. Check the carrying dealer in the Canadian Investment Regulatory Organization (CIRO) dealer directory, then confirm its Canadian Investor Protection Fund (CIPF) membership in the directory for investment dealers or mutual fund dealers.
• Payments: A listing in the Bank of Canada's payment service provider registry or the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) Money Services Business Registry supports that narrow role. Neither listing makes the company a bank or investment dealer, and neither is an endorsement.

A badge on the app is not enough. Search the exact legal name yourself.

Know what the protection covers

If an app says cash is held at a CDIC member bank, find out whether it is held in your name or in trust. CDIC explains that protection for money held through a fintech can depend on records identifying each customer as a beneficiary.

CDIC covers eligible deposits if a member institution fails. It does not insure stocks, exchange-traded funds (ETFs), crypto assets, or a mistaken transfer.

CIPF concerns eligible property missing when a member firm becomes insolvent. It does not cover market losses, poor advice, or crypto values. The member that matters is the dealer carrying your account, not a dealer whose logo appears somewhere in the app.

Test the way out

Check for multi-factor authentication (MFA), new-device alerts, and a clear recovery process if you lose your phone or email access. Contact support through a number or domain found independently, not through a suspicious message. CIRO recommends verifying unusual requests through another official channel.

Once the legal names and account structure make sense, send a small deposit and withdraw it again. That tests the ordinary route, but it does not replace the directory searches.

The useful question is not whether the app looks safe. It is who holds your money, under which rules, and how you get it back.