European crowdfunding regulation: how ECSPR works, and what licensing actually costs

ECSPR is Regulation (EU) 2020/1503, the EU framework under which authorised crowdfunding service providers match business project owners with investors through platforms for qualifying loans or investment instruments. It applies across the EU, subject to instrument, activity and offer-size limits. It is a platform authorisation, not a founder's permission to run any securities campaign anywhere in Europe. That distinction determines nearly every practical decision that follows.

Why did Europe need a crowdfunding rule at all?

Before ECSPR, an intermediary that wanted to connect investors in several member states to businesses could encounter a patchwork of national crowdfunding, securities and lending rules. A platform authorised to perform a specific activity in one state could not assume that its permission travelled with it. The EU chose to harmonise the intermediary's regime rather than create a universal exemption for every issuer and instrument. That choice explains both the passport's appeal and its edges.

Article 1 says what the regulation does: uniform requirements for provision, organisation, authorisation, supervision, platforms, transparency and marketing communications. It also says what it does not cover: crowdfunding services provided to consumer project owners, some nationally regulated related services and offers exceeding the threshold. A real estate borrower that is a business might be in scope; a consumer borrowing for personal use is not brought in just because a website labels the transaction “crowdfunding.” A founder cannot diagnose scope from the homepage of a portal.

The EU framework is not the same thing as the US Regulation Crowdfunding. US Reg CF is an issuer exemption and prescribes use of a registered intermediary. ECSPR directly authorises a category of service provider and standardises rules that apply to its covered offers. Both make retail participation possible; neither makes the investments safe or liquid.

Which services and instruments can an ECSPR provider actually offer?

Under Article 2, the service is matching the business funding interests of investors and project owners through a platform. It covers facilitation of granting loans, and, for investment instruments, placement without firm commitment and reception/transmission of client orders in relation to transferable securities or admitted instruments for crowdfunding purposes. Those technical words matter. ECSPR is not a blanket authorisation for custody, running an exchange, managing any portfolio of securities or accepting deposits.

“Transferable securities” takes its meaning from MiFID II. “Admitted instruments for crowdfunding purposes” is a narrower concept involving, among other things, shares of a private limited liability company not subject to restrictions that effectively prevent transfer, including restrictions on how they are offered or advertised. Local corporate law matters here: describing a share as equity does not make it a qualifying, conveniently transferable platform instrument.

For lending, the regulation's definition requires an investor to make an agreed amount available to a project owner for an agreed period, with the project owner assuming an unconditional obligation to repay that amount with accrued interest. A provider may additionally apply to offer individual portfolio management of loans; that activity has its own disclosure and risk-assessment provisions. Approval for one service does not imply approval for every service in the regulation.

The Austrian FMA's overview explicitly distinguishes its national Alternative Financing Act regime from ECSPR and notes that precise instruments and activities decide which regime applies. This is a useful corrective to the assumption that a web-based crowd raise must belong to one EU category.

How does the €5 million threshold really work?

The threshold belongs to the project owner, not the crowdfunding service provider. Article 1(2)(c) excludes offers with consideration of more than €5 million calculated over 12 months. Its aggregation includes the owner's qualifying ECSPR securities and admitted-instrument offers and amounts raised by loans through a platform, plus specified public offers of transferable securities made by the owner under prospectus-regulation exemptions. It is therefore not necessarily safe to put two €4 million campaigns on two portals and call them separate.

Consider a fictional company, Rivet Works GmbH, planning a €2.2 million qualifying securities crowdfunding offer and an additional €2 million qualifying platform loan within the same twelve-month window. Ignoring other relevant offers, €4.2 million stays below the limit. If it then proposes another €1 million in qualifying consideration in that window, the resulting €5.2 million crosses it. This is an illustration of aggregation, not a determination that either proposed German instrument qualifies. Counsel must check the terms, earlier offers, prospectus treatment and the relevant dates.

The FMA warns that ECSPR authorisation does not cover services concerning that project owner above the threshold. Above it, the financing cannot simply continue under the same ECSPR licence: another applicable regime, possibly a securities prospectus or licensed intermediary activity, must be assessed. “€5 million per year” is convenient shorthand; the legal calculation is a rolling twelve-month offer test with specified aggregation.

What does it take to obtain a provider authorisation?

The application under Article 12 goes to the competent authority of the member state where the prospective provider is established. It is more than an incorporation form. The applicant describes its programme of operations, services, governance, internal controls, risk-management systems, operational risks, continuity arrangements, outsourcing and complaint handling; it supplies information on managers and shareholders and on prudential safeguards. The authority checks completeness and assesses compliance. An application is not an authorisation, and a platform does not get to take investment orders merely because it has requested a meeting with a regulator.

For a provider established in Germany, BaFin's authorisation page describes a 25-working-day completeness check and a further three-month examination of a complete application under Article 12, and states that the application carries a fee under German supervisory-fee rules. Those are regulatory process periods, not a promise that a particular applicant will receive approval on a certain date. BaFin also tells approved providers to notify it before providing cross-border services. This regulator-specific guidance is more useful to a German applicant than an unverified pan-European “licence in weeks” sales claim.

Authorisation is granted to a provider for particular crowdfunding services. The public ESMA register of crowdfunding service providers, maintained under Article 14, is the starting point for checking a claimed licence and its scope. Also check the home competent authority and current status: a logo on a platform's marketing page is not a substitute for an official record. ESMA's listing is not an approval of a particular issuer, KIIS or return projection.

Having a licensed provider is not equivalent to the founder being “licensed by ESMA.” The project owner remains responsible for information provided for its offer. The provider has its own duties to conduct minimum due diligence on project owners under Article 5, including checks concerning certain criminal records and establishment in non-cooperative or high-risk jurisdictions. These checks are not a warranty that the business will succeed. For practical differences between a provider's onboarding duties and general identity checks, see our KYC, KYB and AML guide.

Is €25,000 the price of a crowdfunding licence?

No. Article 11 specifies prudential safeguards maintained at all times: at least the greater of €25,000 or a quarter of the previous year's fixed overheads, subject to the article's calculation provisions. These may be held as own funds, provided by an insurance policy (or comparable guarantee meeting the regulation's conditions), or a combination. The amount is not a cheque paid to the regulator, an application fee or a universal start-up budget.

Suppose a provider's relevant preceding-year fixed overheads are €240,000. One quarter is €60,000, so on those illustrative inputs €60,000, not €25,000, is the minimum prudential safeguard. That says nothing about whether its insurer will quote it a policy, its regulator will accept its application, or its IT controls meet requirements. A newly operating provider should have counsel or an accountant apply the regulation's overhead methodology rather than guessing its first-year requirement from a forecast.

No reliable uniform EU “licence package price” follows from these statutes. Vendor proposals depend on product and market; where pricing is quote-only, it is unknown until quoted. Treat anyone advertising a single all-in regulatory cost without stating jurisdiction, activity and assumptions with caution. The arithmetic minimum is useful for planning capital, not for pricing the complete business.

Two details are especially important when turning Article 11 into a runway model. First, where a provider has operated for fewer than twelve months, Article 11(5) permits forward-looking business estimates for fixed overheads, with historical data used as soon as it is available. The point is not that young companies owe only €25,000; the quarter-of-overheads limb must still be calculated on the applicable basis. Second, Article 11 contains exclusions for certain entities already subject to specified banking, investment-firm, e-money or payment-institution prudential rules. An incumbent entering crowdfunding therefore cannot be priced like a newly formed stand-alone platform simply by reading the headline figure.

The choice between own funds and insurance is not purely cosmetic. An insurance policy has to satisfy requirements concerning duration, cancellation, territorial cover and risk coverage in Article 11. A standard general-liability policy bought online is not necessarily the qualifying policy contemplated by the regulation. Ask a prospective insurer exactly which risks are insured and whether the proposed wording satisfies the competent authority. Likewise, an operator considering outsourcing payments should identify who receives client funds and which entity needs a payment-services permission. ECSPR authorisation does not quietly grant every related financial-service licence. A quote for building the website without a compliant operating model is not a licence budget.

Does the passport let you operate in all 27 member states tomorrow?

Authorisation in one EU member state is a foundation for providing the covered service across the Union. The operational mechanism is Article 18. Before serving another member state, the provider submits to its home authority the intended host states, the people responsible, the intended start date and its other activities, together with the article's specified information. The home authority communicates this to host competent authorities and ESMA. The provider may begin cross-border services on receiving confirmation of that communication or 15 calendar days after submitting the information to its home authority, whichever comes first. That is a notification process, not an unrestricted instant switch-on.

The host location still matters. Article 23 sets language rules for the KIIS when promoting offers in another member state: it must be made available in an official language of that state or another language accepted by its authority. Article 27 addresses marketing communications, including national competent-authority requirements. Privacy, consumer-facing advertising and tax questions are not erased by the passport either. “Passportable” means no fresh ECSPR provider authorisation for the same covered service in each host state; it does not mean every translation, advertisement and payment flow is automatically ready.

There are two clocks in Article 18 that are easily confused. The home state's designated single point of contact has ten working days to send a complete notification's specified information to the host authority and ESMA. The provider's cross-border start provision refers to the notification being communicated to it or, at the latest, fifteen calendar days after it submitted the information. Neither number is an estimated time to obtain the original Article 12 authorisation. Neither says the underlying instrument or translated offer becomes lawful merely because a day has passed. When a launch plan depends on an exact date, ask the home authority and counsel how to evidence a complete submission and the applicable start condition.

Example: a provider authorised in Austria wants to promote a qualifying business offer to residents in France. It should confirm the scope of its Austrian permission, complete the Article 18 process for France, provide the KIIS in an accepted language and examine applicable marketing requirements. If the underlying instrument is not in scope, notification does not rescue it. The regulator can be consulted, but founders should engage counsel familiar with both the instrument and cross-border distribution.

What does an investor see before deciding?

For an ordinary offer, Article 23 requires the project owner to draw up a KIIS for that offer and the provider to make it available to prospective investors. The sheet covers information from Annex I, including the project, owner, offering, investment risks and rights. It must be fair, clear and not misleading. It carries a prescribed warning that the crowdfunding offer has been neither verified nor approved by competent authorities or ESMA and that an investor can lose all or part of the money. It is not a prospectus “approved” by ESMA simply because a registered platform displays it. Different requirements apply where the provider offers individual portfolio management of loans under Article 24.

Articles 19 through 22 add further investor-facing protections: clear and not misleading information, a pre-contractual entry-knowledge test for prospective non-sophisticated investors, simulation of ability to bear loss, and risk warnings when an intended investment crosses specified thresholds. Sophisticated and non-sophisticated status here is an ECSPR concept, not a synonym for the US “accredited investor” test. Even a compliant portal must explain risks; a suitability warning is not a regulator's recommendation to buy.

Article 22 gives a prospective non-sophisticated investor four calendar days in which to revoke an offer to invest or expression of interest in a particular crowdfunding offer without reason or penalty. The provider must explain and facilitate that right, and the rule addresses when funds may be collected or transferred. It is not an all-purpose four-day cancellation right for sophisticated investors, nor a US testing-the-waters rule. Our testing-the-waters guide separates pre-offering interest from this EU offer-specific protection.

For a retail investor, the process should prompt questions the glossy campaign page cannot answer. What security or loan claim will I legally hold? Who owes repayment and under what conditions? Are there voting, transfer or enforcement restrictions? Which losses would I bear before another creditor takes a loss? How could I exit, if there is no active market? The KIIS warning about possible total loss is not boilerplate to scroll past. If a platform describes projected income as assured, reconcile the claim with the actual contract and risk disclosure before making any decision. An authorised intermediary can run a risky offering; authorisation is oversight of a service, not public underwriting of the project.

Why are German GmbH shares an awkward crowdfunding instrument?

German company law, not ECSPR's marketing language, controls the transfer formalities of GmbH shares. §15(3) and (4) GmbHG generally require notarial form for the assignment of shares and agreements creating an obligation to assign shares. Repeating a retail transaction hundreds of times can become operationally difficult. ECSPR's definition of admitted instruments also turns on transfer restrictions. It would be unsafe to say that receiving a provider licence waives notarisation or that every GmbH share automatically qualifies.

Some German fundraising models instead use a debt-like economic claim, such as a profit-participating subordinated instrument, or another structured arrangement. Do not infer that all subordinated loans are ECSPR loans. A deeply subordinated claim whose repayment depends on profits or that lacks an unconditional repayment obligation may not meet Article 2's “loan” definition; other national regimes and prospectus questions can arise. Conversely, labelling an instrument “equity” does not solve a transfer formality. Ask German securities and corporate counsel to map the exact cash flows, contractual subordination, transfer mechanics, investor rights and applicable national regime.

A fictional German founder wanting 600 community investors to own a slice of a GmbH should first ask: are these actual shares, a qualifying transferable instrument, or merely contractual claims? Who holds legal title? What rights can be sold or assigned later? How are subscriptions and notarial acts executed? An SPV may change the investor-facing cap table but creates its own costs and legal analysis; see our SPV explainer. No structure is automatically compliant just because it is popular elsewhere.

How does ECSPR compare with US Reg CF?

A US platform cannot passport into the EU merely because it complies with Reg CF; an ECSPR provider cannot run a US Reg CF campaign merely because it has an EU licence. Cross-border founders need advice on location of issuer, investors, communications and services, not an analogy between two headline caps.

What should a founder or operator do before spending money?

1. Draw the transaction. Identify owner, issuer, provider, instrument, investor, payment flow and every relevant jurisdiction. “Community raise” is a marketing description, not a legal classification.
2. Test scope before price. Is the project owner a business? Does the security or loan match Article 2? Add all offers that Article 1 requires to be aggregated within the twelve-month window.
3. Verify the intermediary. Check ESMA's register and the home authority. Record the permitted activities rather than assuming “registered” covers lending and securities equally.
4. Budget a functioning service. Separate the prudential floor from counsel, people, controls, translations, KIIS preparation, cybersecurity, payment arrangements and supervision. Get current written quotes.
5. Plan distribution. For each host country, plan notification timing and marketing language. An approved application does not retrospectively legalise prior solicitation.
6. Get specialist advice. A German GmbH share and a profit-linked claim may lead to very different legal results even if each is called crowdfunding.

For OBridge, the boundary is straightforward. OBridge is an early-access discovery network, not an ECSPR-authorised crowdfunding service provider or transaction venue. An Investable signal communicates nonbinding interest without an amount; it does not accept money, create an investment commitment, execute a transaction, act as a broker or assure anyone of regulatory compliance. If parties later consider an actual offering, qualified counsel and any required authorised provider must assess it independently. That boundary is a product description, not a legal safe harbour.

Frequently asked questions

What is ECSPR?

Regulation (EU) 2020/1503 is the EU framework for authorised crowdfunding service providers matching business project owners with investors through a platform for qualifying loans or investment instruments. It is not a general licence to sell every financial product.

Is the ECSPR limit €5 million per platform?

No. Offers exceeding €5 million for a particular project owner over 12 months fall outside ECSPR; the calculation also aggregates specified other public securities offers by that owner. It is not a platform-wide annual ceiling.

Does an ECSPR authorisation allow immediate operation across the EU?

No. For cross-border provision, the provider first notifies its home authority under Article 18. It may start after receiving confirmation that its information has been communicated to host authorities and ESMA, or after 15 calendar days from submission to its home authority, whichever is earlier, subject to applicable rules.

Is €25,000 the total cost of an ECSPR licence?

No. Article 11 sets ongoing prudential safeguards of at least the higher of €25,000 or one quarter of the preceding year's fixed overheads, subject to its calculation rules, met through own funds, insurance or a combination. Legal, operational, staffing and supervisory costs are separate and depend on the provider and jurisdiction.

Can a German GmbH crowdfund its shares under ECSPR without a notary?

An ECSPR provider licence does not override §15 GmbHG. Transfers of GmbH shares and agreements obliging a transfer generally require notarisation. Whether a particular proposed instrument qualifies and how issuance is structured needs German legal advice.

Are all subordinated loans covered by ECSPR?

No. ECSPR defines a loan as an agreement under which an investor makes money available to a project owner for an agreed period and the owner assumes an unconditional repayment obligation with accrued interest. The precise terms of a subordinated or profit-participating instrument must be assessed; some fall outside that definition and may instead be governed by national rules.

Who prepares the key investment information sheet?

For an ordinary crowdfunding offer, Article 23 requires the project owner to draw up the KIIS and the provider to make it available to prospective investors. Special rules apply to individual portfolio management of loans.

Do all EU investors receive a four-day cancellation right?

No. Article 22 gives prospective non-sophisticated investors a four-calendar-day pre-contractual reflection period for an offer to invest or an expression of interest in a particular crowdfunding offer. It is not a universal right for every investor or every investment.