ECSP Licence Explained: What EU Regulation Means for P2P Investors

Since 10 November 2021 there has been a single EU-wide authorisation for crowdfunding and crowdlending platforms: the ECSP licence (European Crowdfunding Service Provider) under Regulation (EU) 2020/1503. It replaced the earlier patchwork of national rules, applies in every member state and comes with concrete investor safeguards - from a standardised information sheet to a mandatory default-rate disclosure.

For you as a P2P investor, the regulation matters for two reasons. First: where it applies, it sets a genuine minimum standard. Second - and this is what many investors miss: the best-known P2P platforms on the European retail market aren't covered by it at all. This guide explains what the ECSP licence delivers, where its limits are, and how to read a platform's regulatory status correctly.

What is the ECSP licence?

The ECSP licence is the EU-wide authorisation for platforms that broker loans or securities to finance businesses - laid down in Regulation (EU) 2020/1503, applicable since 10 November 2021. It is granted by the national financial supervisor of the platform's home country: BaFin in Germany, the Bank of Lithuania in Lithuania, Latvijas Banka in Latvia. Once authorised, a platform may offer its services in every member state via the so-called EU passport, without applying for a separate permission in each country.

Before the regulation, a platform had to satisfy separate rules in every country - in Germany under the Vermögensanlagengesetz, elsewhere under entirely different regimes or none at all. That made cross-border crowdlending cumbersome and hard for investors to compare. This is exactly what the regulation set out to change: identical authorisation requirements, identical disclosure duties, identical protection rules - whether the platform sits in Tallinn, Vilnius or Hamburg.

The ESMA market report on crowdfunding in the EU 2025 shows how large the regulated market has become: in 2024, 181 authorised crowdfunding service providers were active across 21 countries of the European Economic Area and raised around €4.25 billion between them. More than half of that was loan-based crowdfunding - precisely the asset class P2P lending is about. Most investors are retail investors, putting in roughly €660 per person and project on average.

Which platforms does the ECSP regulation cover - and which not?

The scope is narrower than the name "EU crowdfunding regulation" suggests. The regulation only covers the financing of businesses and commercial project owners - and even that only up to €5 million per project owner, calculated over twelve months. Two groups are explicitly excluded (Art. 1(2)):

• Consumer loans: crowdfunding for project owners who are consumers is outside the scope. A platform brokering consumer loans to private individuals cannot obtain an ECSP licence for that business at all.
• Large issuances: anyone raising more than €5 million within twelve months needs the classic capital-market route with a securities prospectus.

Whether a platform is actually authorised can be looked up at any time in ESMA's public register of crowdfunding service providers. That splits the P2P market you know from our platform comparison into three regulatory worlds:

ECSP-licensed platforms broker business, property or agricultural loans directly between you and the project owner. They include EstateGuru and InRento (property), Crowdpear, Lande and Insoil (agriculture) as well as Capitalia (SME loans).

MiFID investment firms such as Mintos, Twino, Debitum and Viainvest took a different route: they securitise loan claims - often consumer loans from lending companies - as regulated securities (Notes or asset-backed securities) and are supervised as investment firms under the EU's MiFID II framework.

Platforms without an EU investment licence such as PeerBerry, Robo.cash or Iuvo operate outside both regimes. Bondora is a special case: the platform issues consumer loans itself under an Estonian creditor licence - which regulates the lending, not your investment.

What protections does the ECSP licence actually bring?

The regulation imposes a whole catalogue of duties. The most important ones from an investor's perspective:

Authorisation, supervision and own funds

An ECSP platform needs formal authorisation with a business plan, control procedures and a fit-and-proper check of its management - convictions in financial, insolvency or money-laundering law rule out a leadership role. On an ongoing basis, the platform must hold prudential safeguards of at least €25,000 or one quarter of its fixed overheads of the preceding year, whichever is higher (Art. 11). That is not a generous buffer, but it forces orderly finances - and the supervisor can step in before a platform collapses uncontrolled.

The key investment information sheet (KIIS)

Every project must come with a standardised information sheet: no more than six A4 pages covering the project owner, terms, risks and fees (Art. 23). The structure is identical across the EU - so you can compare a property project in Estonia directly with an agricultural loan in Lithuania. The sheet must also state unambiguously that neither a deposit guarantee nor an investor compensation scheme applies.

Knowledge test and loss-bearing simulation

Before you may invest as a non-sophisticated investor - the regulation's term for retail investors without proven professional status - the platform must assess your knowledge and experience (Art. 21). In addition, you simulate your ability to bear a loss of 10% of your net worth, based on income, assets and financial commitments. The assessment is repeated every two years, the simulation annually. It sounds bureaucratic, but it has a real effect: the platform must warn you if its services appear unsuitable for you.

Warning threshold for larger investments

If you invest more than €1,000 or more than 5% of your net worth in a single project (whichever is higher), the regulation requires an explicit risk warning, your express consent and evidence that you understand the risks (Art. 21(7)). You can still proceed afterwards - the threshold is a brake, not a ban.

Four days to reconsider

As a non-sophisticated investor you can revoke any investment offer within four calendar days, without giving reasons and at no cost (Art. 22). For illiquid investments that would otherwise tie you up for years, that is genuine protection against impulse decisions.

Mandatory default statistics

Platforms that broker loans must disclose the default rates of their projects covering at least the past 36 months every year - prominently on their own website - and publish an outcome statement within four months of each financial year-end, comparing expected and actual default rates per risk category (Art. 20). For you this is the single most valuable rule in the regulation: it makes actual credit quality comparable instead of pointing you at advertised interest rates.

Ban on self-dealing

An ECSP platform must not participate in the offers on its own platform; management, employees and shareholders holding 20% or more must not appear there as project owners (Art. 8). That rules out a conflict of interest which has repeatedly caused failures in the unregulated P2P world: platforms steering investors' money into projects of their own group.

What the ECSP licence does not do

Sensible as these rules are - the licence regulates the platform, not the credit risk. Three limits are worth knowing.

No protection against loan defaults. If a project owner defaults, you bear the loss - the authorisation changes nothing about that. There is no deposit guarantee and no investor compensation; every key investment information sheet says so explicitly. How to manage this risk through diversification is covered in our guide to P2P diversification.

Supervisors check processes, not projects. Neither BaFin nor the Estonian or Lithuanian authorities assess whether an individual property loan is well secured or an agricultural project viable. What is checked is whether the platform meets its obligations - project selection and credit assessment remain the platform's own work, and quality varies considerably.

A licence and a default record are two different things. EstateGuru is the clearest example: ECSP-licensed since May 2023, supervised by Estonia's Finantsinspektsioon - and yet by August 2025 around €133.6 million, more than 60% of its portfolio under management, sat in recovery, the result of loose lending standards in 2021 and 2022. The licence increased transparency about these problems; it did not prevent them.

Why don't Mintos, Bondora and PeerBerry have an ECSP licence?

The short answer: because their business model doesn't fit the scope. The ECSP regulation covers business financing only - but the core of the Baltic P2P market is consumer loans, issued to private individuals by lending companies and refinanced through marketplaces. For that model, two routes were available.

Mintos, Twino, Debitum and Viainvest obtained licences as investment firms under MiFID II and have since offered loan exposure as securitised instruments. That is not a weaker form of regulation than ECSP - in one respect it goes further: as the client of an investment firm you are covered by a statutory investor compensation scheme of up to €20,000 if the firm itself cannot return client assets. The limit of that compensation matters, though: it covers the firm's failure, not the default of the loans you invest in.

Bondora issues consumer loans itself and holds an Estonian creditor licence for doing so - a permission that regulates the lending business, not your investment product (such as Go & Grow). PeerBerry and Robo.cash, finally, operate without any EU investment licence; there, investor protection rests solely on the solvency and goodwill of the lending groups behind the platforms.

For your risk assessment this means: "Does the platform hold an ECSP licence?" is the wrong question when judging consumer-loan platforms - the right one is "Which licence does it hold instead, and what does that cover?". How regulation feeds into our platform grades is documented in our rating methodology.

What changes in 2026?

The ECSP regulation's transition period is history: existing platforms were initially allowed to continue under national law until 10 November 2022, and the European Commission extended that deadline once, to 10 November 2023. Since then the rule is simple: anyone offering crowdfunding within the regulation's scope needs the licence - no exceptions. Even so, the regulatory landscape keeps moving in 2026, in three places:

The new Consumer Credit Directive applies from 20 November 2026. Directive (EU) 2023/2225 (CCD2) had to be transposed into national law by 20 November 2025 and applies from 20 November 2026. For the first time it explicitly addresses crowdfunding credit services: platforms that grant consumer credit directly face the obligations of creditors; platforms that facilitate lending between professional lenders and consumers face those of credit intermediaries. That closes a gap on the borrower side which the ECSP regulation had deliberately left open. On the investor side, however, nothing changes: an EU-wide protection regime for investments in consumer-loan P2P still doesn't exist.

The review of the ECSP regulation is pending. The regulation obliges the Commission to review its application and report to the European Parliament - including on whether the scope should be extended (Art. 45). That report is overdue and had not been published as of July 2026; industry associations are already positioning themselves on possible changes, from the €5 million threshold to the treatment of credit services to consumers. For investors this is the most interesting open question: extending the scope to consumer-loan platforms would close the regulatory gap in the largest P2P segment.

Robust market data for the first time. The ESMA market report published in December 2025 provides the first complete, EU-comparable dataset on the licensed market - the factual basis for every reform debate to come.

What should you actually check as an investor?

All of this boils down to a sober, four-step check:

1. Verify the licence status: look the platform up in ESMA's register (for ECSPs) or the national supervisor's register (for investment firms) to see which authorisation actually exists - not what the marketing implies.
2. Understand what the licence covers: ECSP regulates the brokering of business financing, MiFID the securitisation of loans, a creditor licence only the lending itself. None of them protects you from loan defaults.
3. Use the transparency duties: on ECSP platforms, the key investment information sheet and the 36-month default statistics belong on your reading list before the first investment - that is exactly what they are for.
4. Treat unlicensed platforms deliberately: without a licence there is no supervision, no own-funds requirement and no standardised disclosure. Other factors can partly offset that - but it remains an additional risk that a higher return has to justify.

P2P lending remains a risk investment in every regulatory world: the return exists because you carry default, platform and liquidity risk - our guide to returns and risks shows how they interact. A licence doesn't remove those risks; it makes them more visible.

For a quick overview, our P2P platform comparison flags the regulatory status of every platform - filterable, with the grade right next to it; the specific licence behind it is covered in each platform article.