MelzaPay (melzapay.com) Claims to Be Regulated. Luxembourg’s CSSF Says Otherwise

MelzaPay presents itself as a regulated European financial platform offering IBAN accounts, international transfers, payment cards and cryptocurrency services. Luxembourg’s financial regulator has now directly contradicted that presentation.

On 26 August 2026, the Commission de Surveillance du Secteur Financier (CSSF) published an official warning concerning www.melzapay.com and classified the matter as “Illicit activities.”

The regulator identifies the name MelzaPay S.A., the website melzapay.com, a Luxembourg address, two MelzaPay email addresses and a Luxembourg telephone number. Most importantly, the Commission de Surveillance du Secteur Financier (CSSF) states that MelzaPay S.A. is not supervised by it and has received no authorisation to provide investment or other financial services in or from Luxembourg.

The warning has also been circulated through the International Organization of Securities Commissions (IOSCO) I-SCAN alert system.

AssetVault Recovery considers melzapay.com unsafe. The website presents itself as a regulated financial institution while the regulator it claims as its supervisor says MelzaPay S.A. is not supervised or authorised by it. Anyone considering transferring money or cryptocurrency to MelzaPay should stop and independently verify where the funds would actually go.

The CSSF Warning Identifies the Exact MelzaPay Website

There is no uncertainty about which online operation the Luxembourg warning concerns.

The Commission de Surveillance du Secteur Financier (CSSF) identifies:

• Name used: MelzaPay S.A.
• Website: www.melzapay.com
• Claimed address: 35, avenue de la Gare, L-1611 Luxembourg
• Email: support@melzapay.com
• Email: dpo@melzapay.com
• Telephone: +35226259031
• Authorisation in Luxembourg: None

The regulator’s conclusion is equally direct: MelzaPay S.A. is not supervised by the Commission de Surveillance du Secteur Financier (CSSF) and has not received authorisation to provide investment services or other financial services in or from Luxembourg.

That finding matters because regulatory supervision is one of the central trust signals MelzaPay itself has used to promote its services.

MelzaPay Says It Is Licensed and Regulated by the CSSF

This is where the case becomes much more serious than an ordinary licensing omission.

MelzaPay has publicly described itself as a “Payment Institution licensed and regulated” by the Commission de Surveillance du Secteur Financier (CSSF) in Luxembourg.

The operation has also associated itself with registration number B00057906 and claimed that it operates under the EU Payment Services Directive 2 framework.

Its public descriptions promote services that would naturally encourage consumers to believe they are dealing with an established European financial provider, including:

• personal European IBAN accounts;
• SEPA and SWIFT transfers;
• a virtual Visa Platinum card;
• multi-currency services; and
• cryptocurrency wallets supporting assets including Bitcoin, Ethereum and USDT.

Those representations create an apparent picture of regulatory legitimacy.

But the official warning destroys the most important part of that picture.

The Commission de Surveillance du Secteur Financier (CSSF) does not merely say consumers should exercise caution. It explicitly records “Authorisation in Luxembourg: None” and says MelzaPay S.A. is not supervised by the regulator.

For consumers, the contradiction is straightforward: MelzaPay claims regulatory supervision that the named regulator says it does not have.

What Is B00057906?

The registration number used in MelzaPay’s public-facing information raises another serious question.

Independent research into B00057906 indicates that the number is associated with ECOBAT S.A., rather than establishing MelzaPay S.A. as the regulated payment institution represented by melzapay.com.

This is important because company-registration information can make an online financial operation appear substantially more credible than it actually is.

A registration number, address or company name should never be treated as proof of financial authorisation without checking it against the regulator’s own records.

The same principle has appeared repeatedly in AssetVault investigations. In our examination of NextGen Strategie AG, the key question was not simply whether corporate-looking information existed, but what the regulator actually said about the financial activity. Similar verification problems emerged in our investigations into Finanzbase AG and CTI Capital.

In the MelzaPay case, the authoritative answer concerning Luxembourg financial authorisation comes directly from the Commission de Surveillance du Secteur Financier (CSSF): there is none.

melzapay.com Is Also a Very Young Domain

MelzaPay’s apparent financial history deserves scrutiny for another reason.

Public domain-registration information indicates that melzapay.com was registered on 7 June 2026.

Less than three months later, on 26 August 2026, the Commission de Surveillance du Secteur Financier (CSSF) published its warning.

A young domain does not prove fraud on its own. But it becomes much more significant when a recently created financial website presents itself as a regulated European institution and the regulator it names publicly denies supervising or authorising it.

AssetVault has seen similarly important domain-history discrepancies in other investigations. Our TITAN investigation, for example, showed how the timeline between domain creation and regulatory intervention can reveal information that the website’s own presentation does not.

Why MelzaPay’s Crypto Services Increase the Risk

MelzaPay does not restrict itself to conventional payment services. Its public material also promotes cryptocurrency functionality, including Bitcoin, Ethereum, Litecoin and USDT.

That means someone using the platform could potentially be asked to transfer cryptocurrency directly to wallet addresses rather than making only conventional bank payments.

If you have already transferred cryptocurrency to MelzaPay, the most useful evidence is not simply a screenshot showing a balance inside your account.

Preserve the actual blockchain transaction.

Record the transaction hash, receiving wallet address, cryptocurrency, network, amount and date of every transfer. If USDT was used, identify whether the transfer took place over TRON, Ethereum or another network.

This distinction between a displayed balance and the actual movement of funds has been important in previous AssetVault investigations involving cryptocurrency platforms, including aakbnw / cryptovip99.

If MelzaPay is currently asking you to transfer additional cryptocurrency before allowing a withdrawal, do not assume another payment will release the existing funds.

IOSCO Has Circulated the MelzaPay Warning

The warning concerning MelzaPay has also been reported through the I-SCAN system maintained by the International Organization of Securities Commissions (IOSCO).

The regulatory roles should be kept clear.

The Commission de Surveillance du Secteur Financier (CSSF) is the originating Luxembourg authority. Its warning establishes that MelzaPay S.A. is not supervised by it and has no authorisation to provide the financial services identified in the notice.

The International Organization of Securities Commissions (IOSCO) I-SCAN record gives that warning international regulatory circulation. It should not be misrepresented as a separate enforcement proceeding by the International Organization of Securities Commissions (IOSCO).

AssetVault’s Finding on MelzaPay

MelzaPay’s own presentation is what makes this case particularly concerning.

This is a website promoting European financial accounts, payment cards, international transfers and cryptocurrency services while presenting itself as a regulated Luxembourg financial institution.

Yet the regulator supposedly responsible for that supervision says otherwise.

The Commission de Surveillance du Secteur Financier (CSSF) classifies the matter as illicit activities, identifies the exact melzapay.com domain, confirms that MelzaPay S.A. is not supervised by it and states that the entity has no Luxembourg authorisation to provide investment or other financial services.

There are further concerns surrounding the registration number used in MelzaPay’s public presentation and the very recent registration of melzapay.com.

AssetVault Recovery’s assessment is that these findings are consistent with a scam financial operation. We consider melzapay.com unsafe and advise consumers not to transfer money or cryptocurrency to MelzaPay.

If you have already deposited, focus now on preserving the real payment trail rather than relying on balances or assurances displayed inside the platform.

Already Sent Money to MelzaPay?

If you have transferred funds to MelzaPay, preserve your evidence immediately. This should include bank-transfer records, beneficiary details, cryptocurrency transaction hashes, receiving wallet addresses, emails from support@melzapay.com or dpo@melzapay.com, screenshots of your account and all withdrawal requests.

Also preserve any demand for an additional tax, verification payment, account activation charge, withdrawal fee or cryptocurrency transfer.

AssetVault Recovery can review the available transaction evidence to establish where payments were actually directed and, where cryptocurrency was involved, examine the subsequent blockchain trail.

👉 Request a confidential MelzaPay case assessment

👉 Speak directly with our recovery team

👉 Submit your MelzaPay transaction information for review

Each case is assessed individually using the available transaction records, communications and supporting evidence.

No upfront recovery fees. Fees are payable only after a successful recovery.

Disclaimer

This article is based on publicly available regulatory information, website representations, domain information and independent research reviewed by AssetVault Recovery.

The Commission de Surveillance du Secteur Financier (CSSF) identifies MelzaPay S.A. and www.melzapay.com in an official warning classified as illicit activities and states that MelzaPay S.A. is not supervised or authorised by it to provide investment or other financial services in or from Luxembourg.

The warning’s circulation through the International Organization of Securities Commissions (IOSCO) I-SCAN system represents international distribution of regulatory-warning information and should not be interpreted as a separate judicial determination.

AssetVault Recovery’s conclusion concerning melzapay.com is our independent assessment of the combined evidence. AssetVault Recovery is not a financial regulator, law-enforcement authority or court, and this article does not constitute a judicial determination of criminal liability.

This publication is provided for scam awareness, investor education and general informational purposes and does not constitute legal, financial or investment advice.