ECSP License in 2026: The Complete European Crowdfunding Guide

What an ECSP licence authorises

A Crowdfunding Service Provider (CSP or ECSP) licence is the single EU authorisation issued under Regulation (EU) 2020/1503, the European Crowdfunding Service Providers Regulation (ECSPR). It lets a platform match investors with project owners across the EEA under one rulebook, replacing the patchwork of national crowdfunding regimes that existed until 2021.

ECSPR covers two business models on the same licence.

ECSPR is explicitly scoped to business crowdfunding. Reward-based, donation-based and consumer-credit crowdfunding are out of scope. Tokens that qualify as financial instruments under MiFID fall under ECSPR if offered through a crowdfunding platform; crypto-assets under MiCA do not.

The regulation entered into application on 10 November 2021 and the transitional period for pre-existing national platforms ended on 10 November 2023. Every EU platform that still provides crowdfunding services in 2026 either holds an ECSP licence or operates outside the scope of ECSPR.

The EUR 5 million per-project threshold and why it matters

ECSPR caps each project at EUR 5 million of funds raised over any 12-month period across all ECSP platforms combined. A project owner that raises more than EUR 5 million in 12 months is pushed into the MiFID/prospectus regime instead. The cap applies to the project owner, not to the platform.

• Calculation basis. All crowdfunding offers by the same legal person (the project owner) across all platforms, rolling 12 months, at the moment the new offer launches.
• Platform responsibility. The ECSP must verify, not just believe, that the project owner is within the threshold. Platforms operate a project-owner declaration plus a commercial check against known offers.
• Breaching the cap. A project raising above EUR 5 million requires a full prospectus under Regulation (EU) 2017/1129 and is outside ECSPR scope. Platforms cannot self-prospectus. Either use a MiFID firm or pause the raise at EUR 5 million.
• Project owner restrictions. Project owners cannot be credit institutions, MiFID firms, payment institutions, AIFs, collective investment undertakings or holding companies of any of those.

For platforms that plan larger offerings, the natural companion licence is a MiFID investment-firm authorisation or a co-issue with a bank. ECSPR handles the SME-funding bucket; anything above it moves to the investment-firm rulebook.

Capital: EUR 25,000 or a quarter of operating expenses

Article 11 of ECSPR sets the regulatory capital at the higher of EUR 25,000 or one quarter of the platform's prior-year operating expenses. This is the headline floor; it is also the only EU prudential regime that uses a fixed-overhead-only own-funds formula without Pillar 1 or Pillar 2 adjustments.

Regulatory capital must be held as own funds (paid-up capital, reserves) or substituted entirely or partially by an appropriate insurance policy or guarantee issued by a credit institution or insurance undertaking. The insurance substitution is rarely used because policies price in to similar annual costs as holding the capital.

Own funds are reported at least annually. Most ECSPs hold a buffer above the floor to avoid mid-year top-ups and to absorb growth-driven opex increases.

The authorisation file and process

ECSPR Article 12 sets the authorisation procedure and it is implemented the same way by every NCA. The file is lighter than a MiFID firm file but heavier than an AISP registration.

1. Programme of operations. Investment-based, lending-based or both. Target markets, sectors of project owners, investor types, distribution channels, revenue model, fee structure.
2. Business plan and projections. Three-year forecast. No stressed scenarios required at MiFID depth but internal consistency is verified.
3. Governance. Management body (at least two natural persons running the business), collective suitability, organisational chart, reporting lines, conflicts-of-interest policy.
4. Internal rules and procedures. Due-diligence process on project owners, risk-assessment methodology, default-rate and exit-strategy disclosures for lending-based crowdfunding, business continuity, complaints handling, outsourcing register, record-keeping.
5. ICT and security. Systems architecture, cybersecurity, data protection. DORA alignment expected (DORA applies to ECSPs from 17 January 2025 as financial entities).
6. Capital evidence. Bank statement or insurance policy showing the required own funds or guarantee.
7. Fit and proper. Questionnaires for management and qualifying shareholders (20% or more). Clean criminal record, no bankruptcy, adequate experience, sufficient time commitment.

Timeline: 3 months from a complete file by statute, 6 to 9 months in practice. Fast NCAs (Lithuania, Estonia, Malta) land closer to the statutory clock; France, Spain and Germany run longer with tougher due-diligence expectations.

Sophisticated vs non-sophisticated investors and the KIIS

ECSPR introduces a two-tier investor regime and a mandatory standardised disclosure document.

The Key Investment Information Sheet (KIIS) is the ECSPR analogue of a prospectus summary. Maximum 6 pages in a standardised format, produced per project, approved by the project owner, displayed on the platform before the investment. For lending-based crowdfunding the platform publishes a platform-level KIIS that covers the pool.

Platforms are liable for ensuring KIIS accuracy and completeness under ESMA technical standards. Misleading or incomplete KIIS is the most common supervisory breach reported since 2022.

Single-licence passport across the EEA

ECSPR Article 18 provides a true single licence with a notification-based passport. Once authorised in a home Member State, the ECSP provides services to project owners and investors across the EEA by notifying the home NCA of the host states. Services can start 15 calendar days after the notification.

Host states cannot re-authorise, impose additional capital or re-apply their national rules on disclosure, conduct or investor protection. Language, marketing and tax rules remain national. ESMA maintains a public register of all ECSPs including the countries each platform passports into.

In practice, the ECSP passport is the primary reason founders pick this regime: 500+ ECSPs authorised by early 2026 across the EU, with leading populations in Spain, France, Italy and the Nordic states. A Lithuanian or Estonian ECSP can serve French or Spanish project owners and investors with no further local file.

Popular ECSP jurisdictions in 2026

Due diligence, defaults and operational obligations

ECSPR is light on prudential capital but heavy on operational conduct. Platforms must deliver:

• Project-owner due diligence. Identity, criminal record, insolvency history, sector-level risk, KYB. Verify the EUR 5 million per-year cap is not breached.
• Credit-risk assessment (lending). Pricing framework, risk categories, default-rate methodology, disclosure of past default performance. ESMA technical standards prescribe the format.
• Default management. Published recovery strategy, escalation to enforcement, investor communication. Lending platforms have been hit with supervisory action over silent defaults.
• Conflicts of interest. Platform cannot invest in offers on its own platform except under strict conditions (skin-in-the-game is allowed but must be disclosed and limited).
• Payment services. Where the platform collects or disburses investor funds, a PI, EMI or credit-institution payment service is required (by the platform or a partner).
• Complaints and record-keeping. Minimum 5-year retention; complaints policy; outsourcing register.

Enforcement since 2022 has focused on KIIS errors, silent defaults and conflicted platform-affiliate investments. Platforms that treat ECSPR as a light-touch regime get hit first.

Ship a compliant ECSP platform with Crassula

An ECSP licence is the legal layer. The product layer is the platform itself: investor onboarding, KYB of project owners, KIIS workflow, risk scoring, investment flow, payment rails, secondary-matching bulletin board, investor dashboard and default handling. Crassula delivers the operational core as a composable platform.

We work alongside your legal counsel on the authorisation file and integrate the platform with your chosen payment and custody partners.

FAQ