Netrios enforcement records connect a white-label network to four brands with $391m of cumulative deposits

US enforcement records describe how Netrios LP Ltd. and Red Acre, Ltd. supplied infrastructure and services behind at least 15 white-label brokerage businesses owned or operated primarily by US residents. A CFTC action published on 9 November 2026 connects eight US operators to that provider network, adding a direct documentary link to the earlier SEC cases.[1][2]

The four named brands—KOT4X, EnviFX, Prosperity4x and FxSway—received approximately $391 million in cumulative customer deposits over partly overlapping periods between 2019 and 2025, based on the figures in the operator orders. That total is an independently checked aggregation of the SEC's brand-by-brand findings. It is not a measure of money held at one time, customer losses, provider revenue or unique capital. Deposits can be withdrawn, redeposited or transferred, and the four periods do not align perfectly. Even with those limitations, the figure shows that the white-label model was not a marginal website service: it sat behind substantial retail money flows.[3][4][5][6]

The infrastructure provider did far more than license a front end

The SEC's order against Netrios LP Ltd. and affiliate Red Acre, Ltd. describes a ready-to-operate brokerage stack. Netrios created the technology and infrastructure, designed branded websites, provided back-office systems, sublicensed a third-party trading application, supplied prices and liquidity, held or arranged custody for customer funds, supported trading and executed orders. The order says Netrios controlled the underlying trading data and assumed the profit-or-loss risk on customer trades, hedging the portfolio as it considered appropriate.[1]

Red Acre's role, according to the order, included know-your-customer verification, customer support, marketing and assistance with legal terms. The two companies were under common control. The combined functions covered the parts of a brokerage operation that ordinarily determine who is accepted, what customers see, how prices are generated, where funds are held, how orders are executed and who bears the resulting market risk.[1]

That architecture matters because it separates the visible broker from the economic counterparty. A customer could arrive through a brand promoted by a trader or influencer, see that brand's name on the website and account display, and communicate with people attached to the brand. Yet the SEC found that products, technology, prices, liquidity, custody, execution and risk assumption were supplied by the white-label providers. The operator orders repeatedly say customers understood themselves to be trading through the branded broker, while the operational engine sat behind it.[1][3][5][6]

Four brands, one recurring template

The SEC operator orders describe a recurring launch model: an operator contracted for a ready-to-run platform, marketed it to customers and shared transaction-linked revenue with its provider. Those individual orders did not themselves name Netrios. The later CFTC release identifies the connection to Netrios and Red Acre, so the link should be attributed to that record rather than inferred from similar business descriptions.[7][2]

KOT4X was launched in 2019 by Anthony Tyler Williams and another individual. The Williams order says customers deposited approximately $296 million into KOT4X trading accounts during the 2019–2025 relevant period. It describes commissions, spread and overnight-swap fees being shared between the brand and the service providers, while Williams received part of the commissions and spreads. KOT4X also referred other people to launch brokers with the same providers.[3]

The EnviFX order attributes approximately $34 million of cumulative deposits to that brand between 2020 and 2025. The Prosperity4x order puts deposits at approximately $35 million during 2020–2023. The FxSway order puts deposits at approximately $26 million during 2021–2023. Adding those amounts to the KOT4X figure produces the approximately $391 million total across four unique platforms.[4][5][6][3]

The calculation deliberately counts each brand once. KOT4X had two co-owners covered by separate SEC orders; using both orders would double-count the same $296 million. Prosperity4x had three operators, but its $35 million is likewise a brand-level figure, not an amount attributable separately to each owner. The total therefore combines four platform figures, not seven respondent figures.[7][3][5]

The instruments moved the case beyond ordinary offshore FX

The SEC cases did not rest on the proposition that every foreign-exchange or commodity CFD was a security. The orders focused on CFDs tied to single stocks. Because those contracts referenced the value of individual securities, the SEC treated them as security-based swaps under U.S. federal securities law. The orders say the platforms offered stock-based CFDs to U.S. retail investors without the required registration and exchange framework, while the individual operators acted as unregistered brokers.[8][7]

The operator orders say foreign exchange accounted for most trading activity, but customers were able to and did trade stock-based CFDs. KOT4X, Prosperity4x and FxSway each offered stock CFDs referencing 37 equities listed on U.S. and European exchanges. The legal significance therefore came from a component of the product menu rather than the largest asset class by volume.[3][5][6]

The SEC’s June 2026 Netrios and Red Acre settlements imposed civil penalties of $1.75 million and $750,000 respectively. Its September operator action covered seven people and $590,000 in penalties. The subsequent CFTC action covered eight operators, imposed two-year trading and registration restrictions and recognised monetary penalties from related SEC actions. These are separate proceedings with different respondent counts; their penalties should not be added as though each represented a new customer loss. The settlements must be read on their stated terms, including the respondents’ non-admission provisions.[8][7][2]

What combining the records establishes

The provider order describes at least 15 US-owned or operated white-label brokerage businesses. The four named platforms in the operator orders permit a reproducible deposit total; they do not constitute a census of every brand in the network. The CFTC’s November action supplies the connection between provider and operators, while the SEC files supply the platform-level amounts and reporting periods.[1][3][4][5][6][2]

The orders also show that the business was distributed commercially even where it was centralised operationally. Brand operators marketed to their own audiences, recruited affiliates, interacted with customers, escalated trade questions, processed or approved some withdrawals and received transaction-linked compensation. In several instances, operators referred others to launch additional brands with the same providers and received compensation connected to trading through those brands. That referral mechanism offers one explanation for how a common infrastructure stack could proliferate across nominally separate broker identities.[3][5][6]

Why the $391 million figure needs discipline

Cumulative deposits are a flow measure. They can be much larger than end-of-period customer balances because the same customer may deposit repeatedly and may withdraw funds between deposits. The orders do not provide a common calculation method beyond the approximate brand totals, nor do they disclose total withdrawals, customer profits and losses, provider hedging results or current recoveries. The $391 million sum should therefore be used to show activity scale, not to imply that the providers possessed that amount at one time or that it was lost.[3][4][5][6]

The periods also differ. KOT4X's figure covers 2019–2025, EnviFX's 2020–2025, Prosperity4x's 2020–2023 and FxSway's 2021–2023. The total cannot be converted into a reliable annual run rate without monthly data. Nor can one infer unique customers: no order supplies a consolidated customer count across the network.[3][4][5][6]

The customer-facing brand was only one layer of responsibility

The network demonstrates why due diligence limited to a broker's logo, incorporation record and marketing personality can miss the decisive counterparty. A branded operator may control solicitation and customer relationships while another company controls prices, execution, custody and risk. In such a structure, a customer needs to know who issued the instrument, who held the funds, who could approve a withdrawal, who bore the trading exposure and which law governed each relationship.[1][3]

The records also complicate the usual distinction between a technology vendor and a broker. The SEC did not describe Netrios as a passive software seller. Its findings attribute to Netrios the provision of products, pricing, liquidity, custody, execution and risk assumption. Red Acre's KYC, support and marketing functions filled additional regulated-operational roles. That combination is central to the SEC's theory that the providers participated in the offer and sale of the instruments rather than simply licensing code.[1][8]

What remains unanswered

The orders do not identify every one of the at least 15 brands, disclose consolidated customer numbers or reconcile deposits with withdrawals and remaining balances. They do not provide a complete map of banks, crypto custodians, payment processors or hedging venues. They also do not establish that every customer trade, every instrument or every service violated U.S. law. The findings concern the described stock-based CFDs and related broker activity during the relevant periods.[1][7]

The commercial chain divided revenue as well as responsibility

The operator orders describe commissions, spread income and overnight-swap charges being divided between the branded broker and the service providers. That revenue-sharing design connected marketing directly to trading activity. Affiliates received transaction-based compensation, operators received portions of customer trading charges and providers earned through the infrastructure and instrument layer. The chain therefore rewarded customer acquisition and continued trading at several points rather than charging only a fixed software licence.[3][5][6]

A transaction-linked chain can be commercially rational, but it complicates conflict analysis. The customer may perceive the promoter, brand, platform and product issuer as one broker even though each participant has a different contractual and economic role. Disclosures need to explain not just that third-party technology is used, but who receives which trading charges and who wins or loses when the customer position moves.[1][3]

Crypto funding added a second infrastructure layer

The named platforms accepted Bitcoin or other crypto assets for account funding, according to the operator orders. The providers custodied those assets in margin accounts, while branded operators agreed to maintain specified margin balances. This arrangement placed a crypto transfer and custody process in front of a leveraged CFD account, adding wallet controls, valuation, conversion and blockchain tracing to the ordinary broker-account chain.[3][5][6]

The orders do not provide a consolidated wallet map or explain whether customer crypto was converted immediately, pooled, hedged or retained in kind. They also do not state the amount of the $391 million total that was funded in crypto versus other methods. Those omissions prevent a complete safeguarding reconstruction. They do, however, show that customer funding was not simply received into a conventional bank account controlled by the visible brand.[3][5][6]

The published cases do not map the entire network

Subtracting four identified brands from a minimum of 15 leaves at least 11 brokerage businesses outside this four-brand reconstruction. That arithmetic describes the limits of the selected records, not secrecy or an accusation against an unidentified firm. Additional names may appear in other proceedings or records; no claim is made that this review inspected every enforcement file worldwide.[1][7]

Identifying the remaining brands requires documentary links such as contracts, common account terms, provider invoices, custody addresses or regulator records—not shared design elements alone. White-label sites routinely use common templates and technology. Visual similarity can generate leads but cannot establish ownership, regulatory responsibility or participation in the conduct found by the SEC.[1]

The orders allocate conduct but leave private remedies unresolved

Regulatory orders allocate responsibility under the laws each agency administers. They do not by themselves settle every private contractual claim or establish the final recoveries of all customers. The cited deposit amounts cannot be converted into a compensation requirement without withdrawals, balances, trading results and the terms of any relevant remedy.[7][2]

The lack of a consolidated balance reconciliation is therefore central. Deposit flows show scale but not what customers ultimately withdrew, lost through trading, paid in charges or retained when a platform closed. A complete customer-impact investigation would require account-level data and wallet or payment records across provider and brand layers.[3][4][5][6]

The findings here remain within the published settlement records. No new claim of missing funds, customer loss or concealed ownership is made. The unresolved reporting question is a network-wide reconciliation of brands, customers and balances; the available cases do not supply it. The respondents’ settlement positions and the distinction between agency findings and court judgments remain part of that account.[1][7][2]

The four-brand sum has also appeared in external reporting and is not presented as an exclusive discovery. Its value is the independently checked reconstruction: approximately $296 million at KOT4X, $34 million at EnviFX, $35 million at Prosperity4x and $26 million at FxSway, counted once per brand. The later provider link explains how the cases fit together while leaving the limits of the money figures visible.[3][4][5][6][2]

Report an error or submit an update