Crowdfunding Compliance in Europe: ECSP Payment Obligations

Since 10 November 2023, when the transition period of Regulation (EU) 2020/1503 came to an end, no crowdfunding platform may raise funds in the European Union without an ECSP licence: the authorisation created for "European crowdfunding service providers". The regulation replaced a patchwork of national regimes with a single rulebook covering all twenty-seven member states.

Most founders preparing a licence application concentrate on governance: fit-and-proper management, conflict-of-interest policies, business continuity. Yet that is rarely where applications stall. What the AMF in France, BaFin in Germany or the AFM in the Netherlands scrutinise line by line is the flow of money, who holds investor funds, how they are segregated, how they travel back when a campaign fails, and who performs identity checks at every step.

This guide walks through the payment obligations of the ECSP regulation as they apply in 2026, and what they mean in concrete terms for your platform's payment infrastructure.

One rulebook for European crowdfunding: what the ECSP regulation covers

Adopted on 7 October 2020 and applicable since 10 November 2021, Regulation (EU) 2020/1503 covers two activities: facilitating interest-bearing loans, and placing, without a firm commitment, transferable securities issued by project owners. It applies to offers of up to €5 million per project owner, calculated over a rolling twelve-month period across the Union. Above that threshold, the prospectus regime takes over.

Three boundaries define its scope:

• Donation and reward-based campaigns sit outside it. Pre-sales and symbolic-reward models are not financial services under the regulation; they remain governed by national rules and consumer law.
• Consumer lending is excluded. The regulation targets the financing of business and professional projects, not personal credit, which falls under separate legislation.
• The licence travels. A platform authorised in one member state can passport its services across the entire Union after a simple notification procedure. ESMA maintains a public register of every authorised provider.

Harmonisation has a flip side: operational requirements (payments above all) are now identical everywhere, and noticeably heavier than under most of the national regimes they replaced. By 2026, the ESMA register lists platforms from nearly every member state and cross-border campaigns have become routine, which makes consistent payment compliance a baseline expectation rather than a differentiator.

The ECSP licence: what your national authority actually examines

In France the licence is granted by the AMF, with the ACPR consulted whenever the platform facilitates lending; every member state has designated an equivalent competent authority. The application file includes a programme of operations, evidence of the management body's good repute and competence, internal policies (complaints handling, conflicts of interest, outsourcing) and a business continuity plan.

One prudential requirement tends to surface late in the process: the platform must hold, at all times, own funds equal to at least the higher of €25,000 or one quarter of the previous year's fixed overheads. The regulation allows an insurance policy covering equivalent risks to stand in for part of that amount.

Timelines are codified too: once your file is submitted, the authority has twenty-five working days to confirm that it is complete, then three months to grant or refuse the licence. Any gap in the payment arrangements (a missing service agreement with your payment partner, an unclear refund procedure) sends the file back, restarts the clock and adds months to your launch date.

The payment file is the heart of the application

The programme of operations must describe the money flow precisely: the identity of the partner payment service provider, the service agreement, the segregation arrangements, and the refund procedure when a campaign fails. A platform that files without a contracted payment partner will not be authorised. In other words, choosing your payment provider comes before the licence application, not after it.

Fund segregation: safeguarding accounts are not optional

Article 10 of the regulation shapes the entire payment setup. A crowdfunding service provider may not hold client funds or provide payment services itself unless it is separately authorised as a payment service provider under PSD2. Because that dual authorisation is heavy to obtain and to maintain, the vast majority of platforms take the other branch of the alternative: entrusting every flow to an authorised payment institution or e-money institution.

In practice, the partner institution opens safeguarding accounts kept strictly separate from the platform's own accounts. Investor money flows into them directly: it never touches the platform's balance sheet, never appears in its cash position, and remains protected if the platform itself fails. When a campaign closes successfully, the segregated funds are paid out to the project owner net of fees; when it fails, they travel back to contributors, to the original payment method: a card-scheme requirement as much as a customer protection.

That segregation protects everyone: investors against platform insolvency, the platform against any accusation of handling client money without authorisation, and project owners against disputes over when funds were actually made available.

Expect the arrangement to be audited. The platform must be able to demonstrate, transaction by transaction, that every euro collected can be traced from the contributor to the safeguarding account and onwards: either to the project owner or back to the investor. That reconciliation trail is part of the ongoing supervision exercised by your competent authority, not a one-off exhibit for the licence file.

KYC and AML: knowing the project owner and every single investor

The regulation first requires a minimum level of due diligence on project owners: checking that they have no convictions for breaches of commercial law, insolvency law, financial services legislation, anti-money-laundering rules or fraud, and that they are not established in a high-risk third country or a non-cooperative jurisdiction.

On the investor side, identification is in practice carried out by the payment partner, itself an obliged entity under anti-money-laundering law. Several member states, France among them, have additionally brought crowdfunding providers into the scope of their national AML frameworks: customer due diligence, transaction monitoring, asset freezes, suspicious-activity reporting.

Investor protection adds one more layer: an entry knowledge test for non-sophisticated investors, a simulation of their ability to bear losses, and a key investment information sheet capped at six A4 pages per offer.

The real challenge is industrial rather than legal. A campaign that works attracts hundreds, sometimes thousands of investors within a few weeks. KYC therefore has to run end to end without manual steps (remote identity verification, automated sanctions screening, project-owner scoring) without adding friction at the precise moment a contributor decides to pay. A contributor who abandons at the identity step is a contributor the campaign loses for good.

All-or-nothing, withdrawal rights, caps: the financial mechanics of a campaign

The dominant model in crowdfunding is all-or-nothing: if the target is not reached by the deadline, every contributor gets refunded. Easy to state, and one of the most demanding principles a payment system can face.

Three ways to run all-or-nothing

• Capture immediately, refund en masse on failure. Expensive (refund fees multiply) and risky, because slow refunds convert directly into disputes.
• Pre-authorise and capture only on success. Elegant on paper, but a card pre-authorisation stays valid for days while a campaign runs thirty to forty-five. Re-authorisation cycles become necessary, and their failure rate climbs with every iteration.
• Collect into a safeguarding account with conditional payout. Funds are captured and secured as the campaign progresses, then released to the project owner only if the target is met. It is the most robust approach at scale, and the one that aligns most naturally with Article 10.

The four-day reflection period

Non-sophisticated investors benefit from a pre-contractual reflection period of four calendar days, during which they can revoke their offer to invest free of charge and without giving a reason. Your payment stack must therefore handle individual refunds in the middle of a live campaign without breaking its accounting.

The €5 million cap

The threshold applies per project owner, over a rolling twelve-month period and across all offers. Tracking that cumulative amount falls on the platform, which implies a consolidated view of the owner's past raises, including those completed through other channels.

And the work does not stop when a campaign succeeds. Lending platforms then manage repayment schedules (monthly payouts split across hundreds of lenders, sometimes for years) while equity platforms handle occasional dividend or exit distributions. Mass payout capability ends up mattering as much as mass collection.

Why generalist payment providers fall short

On paper, any payment provider can process a card transaction. Crowdfunding, however, combines four characteristics that put generalist players in difficulty:

• No conditional escrow. The terms of service of the large generalist providers prohibit or restrict holding funds on behalf of third parties; crowdfunding is typically subject to prior approval, and that approval is rarely granted.
• Extreme load peaks. A campaign concentrates thousands of small payments (usually between €20 and €150) into its final forty-eight hours. Generic anti-fraud engines read the spike as an anomaly and trigger cascading declines, exactly when every payment counts.
• Mass refunds as a normal outcome. A failed campaign is not an incident; it is a nominal scenario of the all-or-nothing model. Yet a high refund ratio mechanically degrades the risk score of a generalist merchant account, up to and including frozen funds.
• Complex payouts. Net-of-fee transfers to project owners, repayment schedules for lending platforms, multi-contributor reconciliation: all of it sits outside the perimeter of a standard offer.

Before you sign, test any provider against these exact scenarios. Our guide on choosing a PSP covers the criteria worth reviewing, from safeguarding arrangements to how easily you can exit the contract.

Payment infrastructure built for ECSP platforms

ECSP compliance is not a documentation exercise: it is a payment architecture. Systematic segregation, native all-or-nothing handling, automated mass refunds, KYC embedded in the contribution flow: those building blocks must exist before you file your licence application, and they must work flawlessly from the very first campaign.

That is exactly the ground Bridge Pay covers: a gateway designed for crowdfunding platforms, with native all-or-nothing management (segregated collection, conditional payout, automatic contributor refunds), the capacity to absorb thousands of simultaneous payments, and an average acceptance rate of 88% in the sector. Payouts arrive within 3 business days, and our team replies within 2 business days, including during a campaign's final sprint.

To design an ECSP-compliant payment flow for your platform, visit our crowdfunding sector page: it details the multi-contributor features and the support we provide for your licence application file.