Crowdfunding for business projects in the European Union is a regulated financial service. Since 10 November 2023 no platform may match companies seeking loans or selling securities with investors anywhere in the EU without an authorisation under Regulation (EU) 2020/1503, the European Crowdfunding Service Providers Regulation (ECSPR). The crowdfunding platform licence is issued by the financial supervisor of one member state and is valid in all of them; national permits and tied-agent arrangements are no longer a lawful basis for operating.
The sections below cover who needs the authorisation, what it permits, what the regulator checks, and what the process costs in time and money. The term itself and the four funding models are covered in our crowdfunding glossary; country procedures are on the pages about the crowdfunding licence in Estonia and the crowdfunding licence in Lithuania.
In short
An ECSP authorisation, in practice called an ECSP licence, is mandatory for any platform arranging business loans or offers of securities of up to EUR 5 million per project owner per year. It is granted once by the home supervisor, after a review of the business plan, governance, IT systems, capital of at least EUR 25,000 and the reputation of managers and major shareholders, and it is passported across the EU and the EEA. Operating without it exposes the company to fines of up to EUR 500,000 or 5% of turnover, and in some member states to criminal liability.
Is crowdfunding regulated in the EU?
Yes, by a single EU crowdfunding regulation. Until 2021 every member state had its own crowdfunding rules, or none, and a platform licensed in France could not serve German investors without a second permit. The ECSPR has applied since 10 November 2021, with a transitional period for existing platforms that ended on 10 November 2023. Since then the only lawful status for a business crowdfunding platform is authorisation as a crowdfunding service provider (CSP), granted by the national competent authority of the home member state and recorded in ESMA’s public register.
The regime produced a smaller, more professional market: ESMA counts 181 active providers in 21 member states, which raised EUR 4.25 billion in 2024, more than half through business loans. The Commission’s review of the regulation is expected in 2026, with the EUR 5 million cap among the open questions.
Who needs a crowdfunding licence in the EU
The regulation applies to a crowdfunding service: the matching of business funding interests of investors and project owners through a publicly accessible online platform. Two models fall within it: lending-based crowdfunding (facilitating loans to businesses) and investment-based crowdfunding (placing transferable securities or admitted instruments, typically shares of private limited companies, issued by a project owner). A platform operating either model needs authorisation; the obligation attaches to the platform operator, not to the companies raising money on it.
Activities outside the ECSPR
Services to project owners who are consumers are outside its scope, so consumer peer-to-peer lending stays under national consumer-credit law. Offers above EUR 5 million per project owner over twelve months fall under the prospectus regime instead, and ESMA has clarified that the cap also counts prospectus-exempt offers made outside the platform. Donation and reward campaigns involve no financial return and are not crowdfunding services. Token sales are governed by MiCA, a distinction explained in our article on crypto crowdfunding in the EU.
| Activity | Authorisation required? | Applicable regime |
|---|---|---|
| Peer-to-peer business lending platform | Yes | ECSPR authorisation |
| Equity or debt crowdfunding platform placing shares, bonds or admitted instruments | Yes | ECSPR; prospectus rules above EUR 5 million |
| Individual portfolio management of loans for investors | Yes, as an additional service | ECSPR with extra disclosure duties |
| Consumer peer-to-peer lending | Not under ECSPR | National consumer-credit rules |
| Donation or reward campaigns | No | Consumer, contract and charity law |
| Offers of crypto-assets or tokens | Not under ECSPR | MiCA; MiFID II for security tokens |
What an ECSP authorisation allows: one licence, an EU passport
The authorisation is a single European crowdfunding licence. Once granted and notified to ESMA, the provider is entered in the public ESMA register of crowdfunding service providers and may passport its services to every member state. Host states cannot demand a second authorisation, extra capital or their own investor-protection rules; only language, marketing and tax stay national. The regulation is also part of the EEA Agreement: Norway applied it from 1 August 2026, extending the passport beyond the EU.
Passporting a crowdfunding platform to other member states
Cross-border activity starts with a notification, not a new application. The provider notifies its home regulator of the member states it intends to serve, the platform it will use and the services it will offer; the notification is forwarded to the host authorities and ESMA within ten working days, and cross-border services may begin on confirmation, or fifteen calendar days after submission at the latest.
ECSPR requirements: what the application must contain
Article 12 of Regulation (EU) 2020/1503 lists what an applicant must submit, and Commission Delegated Regulation (EU) 2022/2112 turns that list into a standard application form used by every supervisor in the Union. The applicant must be a legal person established in the EU; a branch of a third-country company cannot be licensed, although its shareholders may be located anywhere.
| Area | What the regulator expects to see |
|---|---|
| Programme of operations | Services, target project owners and investors, fee model, outsourced functions |
| Governance and internal control | Management structure, accounting, risk management, record keeping |
| Management body | Directors of good repute with sufficient collective knowledge and experience |
| Qualifying shareholders | Identity and good repute of anyone holding 20% or more of capital or voting rights |
| Prudential safeguards | Own funds or insurance covering the higher of EUR 25,000 and one quarter of last year’s fixed overheads |
| IT and business continuity | Systems, security controls and a plan for servicing loans and offers if the platform fails |
| Conduct rules | Complaints handling, conflicts of interest, due diligence on project owners |
| Payment services | Confirmation of how payments will run: own payment institution licence, a licensed payment partner, or no payment flow at all |
Prudential requirements and minimum capital
The ECSPR does not impose a fixed share capital like that of an investment firm. It requires safeguards of at least EUR 25,000 or one quarter of the preceding year’s fixed overheads, whichever is higher, reviewed annually; for lending platforms the overheads include three months of loan-servicing costs. The amount may be held as Common Equity Tier 1 capital, as an insurance policy meeting the conditions of Article 11, or as a mix of both. A provider in operation for less than twelve months calculates the figure from its business plan, so the EUR 25,000 floor rarely remains the binding figure for long.
Client money, payment services and custody
The licence does not cover holding or transferring investor funds. A platform that moves money between investors and project owners must either hold a payment institution authorisation or contract a licensed payment service provider, and must tell investors which of the two applies. A platform that stays out of the payment flow altogether must still ensure that project owners receive funds only through a licensed payment provider. Securities that can be held in a financial instruments account must be kept in custody by a bank or investment firm.
Investor protection rules for crowdfunding platforms
The authorisation is an operating regime, not a certificate. Investors are classified as sophisticated or non-sophisticated; the latter must pass an entry knowledge test and a simulation of their ability to bear loss, receive a warning whenever an investment exceeds EUR 1,000 or 5% of their net worth, and may withdraw any offer or expression of interest within a four-day reflection period. The EU sets no hard cap on how much a retail investor may invest; the knowledge test and the warnings take its place. For each offer the project owner drafts a key investment information sheet (KIIS) of at most six A4 pages, which the provider checks for completeness and clarity. Lending platforms publish annual default rates by risk category, marketing must be fair, clear and not misleading, and the provider reports to its supervisor once a year.
Conflicts of interest are handled by exclusion: a provider may not participate in offers on its own platform, and its shareholders holding 20% or more, its managers and employees, and persons linked to them may not act as project owners. Companies preparing a first offer will find guidance in our note on running a crowdfunding campaign in the EU.
AML, DORA and other EU rules for crowdfunding service providers
Two further EU regimes sit on top of the ECSPR. Crowdfunding service providers are financial entities under the Digital Operational Resilience Act (DORA), applicable since 17 January 2025, which requires ICT risk management, incident reporting and contractual controls over technology suppliers. From 10 July 2027 they also become obliged entities under the EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624), with full customer due diligence and suspicious-transaction reporting; until then AML duties follow national law, and supervisors already expect an AML framework at the application stage.
Operating without authorisation
Article 39 of the regulation obliges member states to provide for maximum fines of no less than EUR 500,000 or 5% of annual turnover for legal persons, fines of at least twice the benefit derived from the infringement, public statements naming the person responsible, cease orders and bans on managers from working in any crowdfunding service provider. National law may go higher, and several member states add criminal liability on top.
How to get a crowdfunding licence in Europe: steps, timeline and cost
The route to an ECSP authorisation is the same in every member state:
- Confirm that the business model falls within the ECSPR and decide which services to apply for, including whether to offer individual portfolio management of loans.
- Incorporate a legal person in the chosen member state and appoint a management body that will pass the fit-and-proper assessment.
- Prepare the file: programme of operations, governance and risk framework, IT and business continuity, conflicts and complaints policies, prudential safeguards, payment arrangement.
- File the application with the national competent authority on the prescribed form and answer its questions.
- After authorisation, check the entry in the ESMA register and file passport notifications for each member state to be served.
The regulation sets a statutory clock. Within 25 working days of receipt the supervisor must confirm whether the application is complete and, if not, set a deadline for the missing items; a file not completed in time may be refused. From the date it is complete the supervisor has three months to issue a reasoned decision. Steps one to three take about as long as the review, so a realistic horizon is four to nine months.
The cost of a crowdfunding platform licence in Europe is driven by much more than the state fee. Application and supervisory fees are set nationally and vary widely: the Bank of Lithuania charges EUR 710 for the application, Latvia EUR 2,500 plus an annual fee, Luxembourg EUR 30,000. The larger items are the prudential safeguards, a management team the supervisor accepts as fit and proper, a compliance function, the platform software, the payment partner, insurance and legal advice. Budget the authorisation and the first year of operation together; that is exactly what the supervisor reads the business plan for.
Choosing the home member state for an ECSP application
Because the authorisation and the crowdfunding rules are identical everywhere, the choice of home state is practical: the supervisor’s experience with crowdfunding files and real processing speed, the language of the procedure, the cost of the local presence it expects to see, access to a bank or payment institution, and the tax environment of the holding company. Most authorised platforms are in France, Italy and Spain and serve domestic investors; platforms built for cross-border operation more often choose a smaller state with an English-language procedure and a supervisor used to fintech applicants. Estonia, through Finantsinspektsioon, and Lithuania, through the Bank of Lithuania, are the two jurisdictions in which we file applications; both are described on the Estonian and Lithuanian service pages.
How Eesti Firma can help
We assess the business model against the scope of the regulation, incorporate the licensed entity, draft the programme of operations and the full policy set, structure the prudential safeguards and payment arrangement, and represent the applicant before the supervisor until the decision; afterwards we handle passport notifications, reporting and licence amendments.
Frequently Asked Questions
Yes, for platforms that arrange business loans or offers of securities and admitted instruments of up to EUR 5 million per project owner per year. Donation, reward and consumer-loan platforms are outside the ECSPR and follow national rules.
Yes. The home-state authorisation is valid across the EU and the EEA after a notification procedure; host states may not add licensing, capital or investor-protection requirements.
Only through a company established in the EU with its management located there; its shareholders may be from anywhere, subject to a good-repute check for holdings of 20% or more.
The regulation requires prudential safeguards of at least EUR 25,000 or one quarter of the fixed overheads of the preceding year, whichever is higher, held as own funds, an insurance policy or a combination of both; a new provider uses its business-plan figures.
The supervisor has 25 working days to confirm completeness and three months from a complete application to decide. Including preparation of the file, a realistic total is four to nine months.
No fixed limit. Non-sophisticated investors pass a knowledge test, receive a warning above EUR 1,000 or 5% of net worth per investment and have a four-day reflection period; the EUR 5 million cap applies to the project owner, not the investor.
