🇪🇺Crowdfunding platform in the EU: the ECSP licence

Concept

The ECSP licence is the authorisation under which an EU legal person runs a crowdfunding platform for business under Regulation (EU) 2020/1503 on European crowdfunding service providers (ECSP). The platform matches investors with businesses that need funding: it facilitates loans to them or places their securities and shares without a firm commitment, receiving and transmitting investors' orders (Article 2(1)(a)). One licence covers both lending-based and investment-based crowdfunding.

The Regulation has applied directly in every Member State since 10.11.2021 and replaced national crowdfunding laws for the services it covers; the transition for platforms licensed under those laws ended on 10.11.2023 (Delegated Regulation 2022/1988). Directive 2020/1504 took these providers out of MiFID II at the same time (Article 2(1)(p) MiFID II).

The regime is designed for business funding of up to €5 m per project owner over 12 months, with no consumer lending (Article 1(2)). Within those limits one regulator's licence is valid across the Union by notification (Article 18). Its place among other licences is shown in the “Financial Licences” hub.

One path from start to finish

A platform funding developers' residential projects wants investors from Lithuania and Germany; the route takes five steps.

1. The company is incorporated in Lithuania and applies to the Bank of Lithuania with a programme of operations and three-year forecasts.
2. It builds prudential safeguards of at least the higher of €25 000 and one quarter of its fixed overheads.
3. A PSD2 payment service provider handles payments: investors' money reaches the developer only through it.
4. The building is placed in a special purpose vehicle (SPV), whose bonds the platform offers with a key investment information sheet (KIIS) after a knowledge test for non-sophisticated investors.
5. Once licensed, the platform notifies the Bank of Lithuania of activity in Germany and may start there at the latest 15 calendar days after notification.

What defines the model

Three features of the regime determine how it is used.

Key parameters

The Regulation itself sets the services, the cap and the capital; national regulators add fees, filing practice and document language.

What is licensed

Crowdfunding services match the business funding interests of investors and project owners through a publicly accessible internet platform run by a legal person (Article 2(1)(a), (d), (e)). The three variants differ in what the investor holds.

Admitted instruments for crowdfunding purposes are shares of private limited companies whose transfer is not effectively restricted; the authorising regulator may permit their use (Article 2(1)(n) and 2(2)). Member States may not require a banking licence from project owners who receive loans through a platform or from investors who grant them, unless they are credit institutions (Article 1(3)).

SPVs: one asset

An SPV, an entity created solely for securitisation, may offer only one illiquid or indivisible asset, such as a residential building or a solar plant in ESMA's examples; the rule applies on a look-through basis, and only investors decide on exposure to the asset (Article 3(6)). An SPV offers no loans, and the platform may hold a stake in it only if the regulator accepts that this creates no interest beyond service fees (ESMA and Commission Q&A).

What stays outside

The Regulation and the ESMA and Commission Q&As take four groups of cases outside the regime.

According to the AFM, an offer open to the public stays within the Regulation however few investors take part and whatever their experience. Consumer crowdfunding falls under consumer credit law: under recital 22 of CCD2 a platform that lends to consumers itself is a creditor, and one that matches them with professional lenders is a credit intermediary. More in “CCD2: the new EU Consumer Credit Directive and BNPL” and the “Lending licences” map.

Other investment services stay within MiFID II, and services under the two regimes may share a website only in clearly separated areas; more in “MiFID II Investment Firm” and the “Broker and investment firm licences” map.

The €5 m cap

How the cap is counted

Under Article 1(2)(c) the cap is counted per project owner over 12 months and adds up its crowdfunding offers of securities and shares, loans raised through platforms and public offers of securities made without a prospectus under Article 1(3) or 3(2) of the Prospectus Regulation. ESMA and the Commission clarified four points (Q&A 2437 and 2438 of 12.02.2025):

• offers made in the 12 months before the crowdfunding offer is launched count;
• there is one cap whether the offer runs on one platform or on several;
• among prospectus-exempt offers, only those under the two provisions above count;
• the platform itself checks the cap, or it risks providing investment services beyond its licence.

The project owner is identified by the economic and business reality of the project: an entity with an insufficient or artificial link to it cannot be designated, and the regulator may challenge the platform's choice (Q&A 2502, 03.04.2025).

The prospectus threshold since 05.06.2026

From 05.06.2026 Regulation (EU) 2024/2809 (the Listing Act) exempts from the prospectus obligation public offers that are not notified for a passport under Article 25 and total less than €12 m per issuer or offeror over 12 months (Article 3(2) Prospectus Regulation). A Member State may apply a €5 m threshold instead, after notifying the Commission and ESMA (Article 3(2a)–(2b)). The ECSPR cap and the crowdfunding exemption from the prospectus (Article 1(4)(k)) stayed at €5 m.

In a state applying €12 m, a project owner can raise more without a prospectus through a domestic offer than through a platform; where €5 m was chosen, the ceilings coincide. The link runs one way: the ECSPR counts offers under the prospectus exemptions it names toward its cap, while the Prospectus Regulation leaves offers under the Article 1(4) first-subparagraph exemptions, crowdfunding included, out of its own threshold (Article 3(2c)).

Authorisation

Application and timeline

The application goes to the regulator of the Member State where the applicant is established, on the form in Delegated Regulation 2022/2112. Its core is a programme of operations with a marketing strategy, a three-year staffing plan and three-year forecasts — in effect a regulatory business plan — plus governance, risk and payment arrangements, proof of capital, fit and proper evidence on managers and criminal-record evidence on shareholders of 20% or more (Article 12).

Banks, investment firms, e-money institutions and payment institutions need not resubmit documents the regulator already holds (Article 12(12)). The statutory timeline has four stages.

If an application stays incomplete after the set deadline, the regulator may refuse to review it (Article 12(4)).

Capital

Prudential safeguards must at all times equal at least the higher of €25 000 and one quarter of the previous year's fixed overheads. For a lending platform, overheads include three months of loan-servicing costs, and a new firm uses forecasts for its first year (Article 11).

The rule does not apply to firms already holding capital under the CRR or IFR, or to payment and e-money institutions subject to their own rules; regimes are compared in “Regulatory Capital”.

Governance and conflicts of interest

The platform may not take part in its own offers or accept as project owners its shareholders of 20% or more, managers, employees or persons they control (Article 8), so a developer cannot fund its own projects through a platform it controls. They may invest in other projects with disclosure and no preferential terms. Remuneration for routing investors to a particular offer is prohibited (Article 3(3)), and the platform answers for anything it outsources (Article 9).

Project owners — for a company, also its shareholders of 20% or more and its management body — are checked at a minimum for commercial, financial, anti-money-laundering and fraud convictions and for establishment in a non-cooperative or EU-listed high-risk jurisdiction (Article 5; Q&A 2747, 05.01.2026). Owner vetting is covered in “Qualifying Holdings and Fit & Proper”.

Client money

The ECSP licence does not include payment services: the platform provides them itself or through a third party only if that entity is a PSD2 payment service provider; otherwise project owners receive funds only through such a provider (Article 10(4)–(5)). Funds for payments in securities are held with a central bank or credit institution, and securities are kept by a bank or a MiFID II-authorised custodian (Article 10(2)–(3)). The diagram shows who holds money and securities.

The PSD2 provider may be the platform itself. If the platform or its partner loses its PSD2 or MiFID II licence and this is not remedied within 40 calendar days, the regulator may withdraw the ECSP licence (Article 17(1)). Payment licences are compared in “Financial Licenses by Jurisdiction”.

Investor protection

Sophisticated and non-sophisticated investors

A sophisticated investor is a per se professional client under MiFID II or a person the platform approves as sophisticated on request, for two years; everyone else is non-sophisticated (Article 2(1)(j)–(k), Annex II). A legal person needs one criterion, a natural person two of three.

Protection mechanisms

Four mechanisms apply to non-sophisticated investors, and every investor receives the key information sheet; none of them prevents anyone from investing.

The project owner draws up the KIIS, with a disclaimer that no regulator or ESMA has verified or approved the offer and a warning not to invest more than 10% of net worth. The regulator may require notification at least seven working days before release but does not approve it in advance; the KIIS satisfies the PRIIPs KID requirement (Article 23(14)–(15)). Lending platforms disclose default rates for at least the past 36 months each year (Article 20).

Bulletin boards and marketing

A platform may run a bulletin board where clients advertise interest in buying or selling loans, securities and shares first offered on it, but not an internal system executing orders multilaterally (Article 25). In September 2025 the Dutch Authority for the Financial Markets (AFM) warned that "buy" and "sell" buttons creating a contract require a trading venue licence.

Marketing must match the KIIS and use a language of the state where it appears. The host regulator applies its national marketing rules, but no regulator may require ex ante notification or approval (Articles 27–28).

Passport, register and market

How the passport works

The platform tells its regulator the host states, responsible persons and start date. Within 10 working days the regulator forwards this to host regulators and ESMA, and the platform may start on confirmation or at the latest 15 calendar days after notifying (Article 18). No presence in the host state is required (Article 12(14)), and there is no branch or tied-agent regime. Other regimes' passports are covered in “EU Passporting”.

The ESMA register

The ESMA register shows each provider's regulator, services, passport states and penalties; withdrawn authorisations stay visible for five years (Article 14). The extract of 02.10.2026 (entries last updated 02.09.2026) lists 261 providers: 239 active and 22 with authorisation withdrawn.

In the same extract, 141 of the 261 licences were granted in 2023, when the transitional period ended, and seven in 2026. Withdrawals date from 29.03.2024 to 07.05.2026; Italy (6) and France (5) account for half, and Spain, Lithuania and Bulgaria have none. A regulator may withdraw a licence, among other grounds, if it is unused for 18 months or no services are provided for nine successive months (Article 17(1)).

Cross-border activity and market size

In the same extract, 92 of the 239 active providers have notified at least one host state. The most frequent are Germany (39 providers), Spain and Belgium (35 each); notifications also reach Norway, Iceland and Liechtenstein.

According to ESMA's market report of 22.12.2025, built on the annual reports platforms file with their regulators (Article 16), 181 providers raised €4.25 bn in 21 Member States in 2024. The ranking by volume differs from the ranking by number of platforms.

About 58% of funding was loan-based, 23% debt securities and 12% equity. Retail investors made up 88% of investors, and about 8% of funding was raised cross-border: 5.8% from other EU and EEA states and 2.2% from third countries.

Tokens and DLT-issued securities

The Regulation is technology-neutral: it covers transferable securities as MiFID II defines them (Article 2(1)(m)), with no rule excluding instruments issued on a distributed ledger (DLT), and since the DLT Pilot Regime (Regulation 2022/858) MiFID II counts DLT-issued instruments as financial instruments. The regimes divide as follows.

The first row is a reading of the texts: as at 02.10.2026 neither ESMA nor the Commission had addressed DLT-issued instruments under the ECSPR. Any other token cannot be offered as a crowdfunding service and falls under MiCA only if it is a crypto-asset within MiCA's scope, which excludes financial instruments and unique, non-fungible crypto-assets (Article 2 MiCA). Tokenisation models are covered in “Real-World Asset Tokenization (RWA)”, crypto-assets in “MiCA”.

Choosing the home Member State

Services, capital, investor protection and statutory timelines are the same everywhere. States differ in regulator, fee, document language and local market; fees are as published on 02.10.2026 unless dated otherwise.

These are fees charged on application; the total cost of ownership of a licence is a separate question. Lithuania repealed its national crowdfunding law from 10.11.2022; the Bank of Lithuania's other licences are covered in “Lithuania: EMI, Payment Institution and Specialised Bank Licences”.

Spain's Law 5/2015 keeps a national regime without a passport for platforms serving consumer project owners or offers above €5 m, and such platforms must tell clients so. The FSC as a regulator is covered in “Bulgaria's Financial Licences”.

The UK: a separate regime

The ECSPR began to apply after the Brexit implementation period ended on 31.12.2020 and never became part of UK law, so there is no ECSP passport into or out of the UK. Loan-based crowdfunding there is the regulated activity of operating an electronic system in relation to lending (RAO article 36H); the Financial Conduct Authority (FCA) regulates it and investment-based crowdfunding, and investors in both have no access to the Financial Services Compensation Scheme (FSCS).

What changes in 2026–2027

The Regulation itself has changed since 2020 only through the extension of the transitional period; changes come from neighbouring acts.

By statute the Article 45 report must assess, among other things, the €5 m cap, the sophisticated-investor definition, the capital rules, AML coverage and access for third-country entities. The ECSPR itself does not make platforms AML obliged entities; Regulation (EU) 2024/1624 does, with due diligence on both those seeking and those providing funding.

Licence boundaries and risks

The regime is narrow, and its risks sit at the boundaries with MiFID II, payments law and trading venues.

A nominee structure, in which one holder owns securities for many investors, is permitted if described to the regulator and disclosed in the KIIS, with the holder buying only the securities investors chose; actual custody requires a CRD or MiFID II licence (Q&A 2601, 04.07.2025). Member States must provide for maximum fines on companies of at least €500 000 or up to 5% of annual turnover, as well as orders and management bans (Article 39(2)).