KYC and AML for Crowdfunding Platforms: ECSP Compliance 2026

The EU Crowdfunding Service Provider (ECSP) Regulation (EU) 2020/1503, in force since 10 November 2023, has reshaped compliance obligations for investment and lending-based crowdfunding platforms across the European Union. For UK platforms operating post-Brexit, the Financial Conduct Authority (FCA) regulates crowdfunding under its own framework — but with requirements that closely mirror ECSP principles. This guide covers what both EU- and UK-based crowdfunding platforms must do to meet KYC, AML, and investor protection requirements in 2026.

This article is provided for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of the publication date (June 2026). Consult a qualified professional for advice tailored to your specific situation.

ECSP Regulation 2020/1503: The EU Crowdfunding Legal Framework

The ECSP Regulation applies to platforms offering equity and lending-based crowdfunding to European investors and issuers. Since 10 November 2023, all EU crowdfunding service providers must hold an ECSP authorisation from their national competent authority — in France from the AMF, in Germany from BaFin, in the Netherlands from the AFM — enabling EU-wide passporting under a single licence (Regulation EU 2020/1503, Art. 12).

In the UK, the FCA regulates peer-to-peer lending platforms under Chapter 14A of the FCA Handbook and investment-based crowdfunding platforms under the Conduct of Business Sourcebook (COBS 4.7 and 18A). The FCA's PS22/11 policy statement (2022) introduced stricter investor categorisation and appropriateness rules for high-risk investments, including crowdfunding, effective February 2023.

For a broader compliance overview, see our document compliance guide.

KYC Requirements for Investors on Crowdfunding Platforms

Investor Identity Verification

UK crowdfunding platforms must comply with the Money Laundering Regulations 2017 (MLR 2017) and, where applicable, the Joint Money Laundering Steering Group (JMLSG) guidance for crowdfunding. Under MLR 2017 Regulation 28, platforms must verify the identity of all customers using government-issued photo ID (UK/EU passport, UK driving licence, or national identity card) before establishing a business relationship (Legislation.gov.uk — MLR 2017).

Electronic verification is explicitly permitted: biometric checks, database verification, and document scanning tools are all accepted methods. The FCA expects platforms to apply a risk-based approach — enhanced due diligence (EDD) for higher-risk investors, simplified due diligence for lower-risk profiles.

A common question from compliance professionals on forums like r/compliance: "Does a crowdfunding platform need to register for AML with HMRC?" The answer depends on the activities: if the platform handles customer funds or provides payment services, it likely qualifies as a financial institution or money service business under MLR 2017 and must register with the FCA or HMRC for AML supervision.

Knowledge Test and Investor Categories

The FCA's PS22/11 requires platforms to conduct an appropriateness assessment before allowing retail clients to invest in high-risk investments, including P2P loans and equity crowdfunding. The assessment must cover understanding of the investment product, risk of capital loss, illiquidity, and the absence of FSCS protection for most crowdfunding investments. If a retail client fails the assessment, the platform must issue a risk warning and give 24 hours before the client can proceed.

EU ECSP platforms must apply a similar knowledge test under Art. 21(1) before an investor's first transaction. Both frameworks distinguish between sophisticated and non-sophisticated investors, with the former subject to fewer restrictions.

Investment Limits and Safeguards

For non-sophisticated investors under EU ECSP:

• Maximum €1,000 per project, or 5% of net worth if this exceeds €1,000 (ECSP Art. 21(7))
• 4-day cooling-off period without penalty (ECSP Art. 22)

For UK retail investors under FCA PS22/11:

• £1,000 per 12 months, or 10% of net investable assets (whichever is higher)
• 14-day cancellation right for distance contracts (COBS 15A)
• Prominent risk warnings: "Don't invest unless you're prepared to lose all the money you invest"

CheckFile supports over 3,200 document types across 32 jurisdictions for KYC workflows on crowdfunding platforms, enabling rapid multi-layer document verification in compliant onboarding flows.

KYB: Verifying Project Owners

Before listing any crowdfunding offer, platforms must conduct Know Your Business (KYB) due diligence on project owners. ECSP Art. 5 and the EU AML Regulation 2024/1624 Art. 20 require platforms to verify the legal existence of the entity, identify beneficial owners (UBO) with interests of 15% or more (reduced from 25% under AMLD6), and check for criminal convictions of directors (Regulation EU 2024/1624).

Required KYB documents for a UK-incorporated project owner:

1. Companies House certificate of incorporation (Companies House search)
2. Current registered articles of association
3. Photo ID for each director and UBO (≥15% interest under AMLD6)
4. Proof of registered address
5. Persons of Significant Control (PSC) register extract

For cross-border projects, additional apostille or legalisation of foreign documents may be required. Automated cross-document validation — checking that the UBO named in the PSC register matches the beneficial ownership declaration — is a core use case for CheckFile's verification solutions.

AML Obligations: Screening, Transaction Monitoring, and Suspicious Activity Reports

Sanctions and PEP Screening

All UK-regulated crowdfunding platforms must screen investors and project owners against the UK financial sanctions list (OFSI), the EU consolidated sanctions list, and UN Security Council lists. Platforms must also identify Politically Exposed Persons (PEPs) and apply enhanced due diligence to PEPs and their associates — this includes source of funds and wealth verification. Failure to screen can result in criminal prosecution under the Proceeds of Crime Act 2002 (POCA) or the Terrorism Act 2000.

Suspicious Activity Reports (SARs)

UK platforms must file a Suspicious Activity Report (SAR) with the National Crime Agency (NCA) under POCA 2002 s.330 if they know, suspect, or have reasonable grounds to suspect that a person is engaged in money laundering or terrorist financing. There is no minimum threshold — any suspicious transaction, regardless of amount, must be reported via the NCA UKFIU portal. The tipping-off prohibition (POCA s.333A) means platforms cannot alert the customer that a SAR has been filed.

For ongoing monitoring requirements under the AMLD6 framework, platforms must maintain a documented transaction monitoring programme with risk-based rules and thresholds.

Data Protection: UK GDPR and Record-Keeping

UK GDPR (as retained post-Brexit) and the Data Protection Act 2018 govern how crowdfunding platforms process personal data. KYC data must be retained for 5 years after the end of the customer relationship under MLR 2017 Reg. 40, and no longer than necessary under UK GDPR's data minimisation principle. The ICO (Information Commissioner's Office) can impose fines up to £17.5M or 4% of global turnover for serious breaches.

Platforms collecting biometric data (e.g. facial recognition for liveness checks) must conduct a Data Protection Impact Assessment (DPIA) before processing, register the processing activity, and implement appropriate technical and organisational measures.

For platform security and data handling standards, see our security page and review CheckFile's pricing for fintech use cases.

Automating KYC/AML Compliance for ECSP Platforms

Manual KYC onboarding for a single investor — collecting documents, manual review, knowledge test, sanctions screening — takes between 15 and 45 minutes per case and introduces material human error risk. Automated document verification via API reduces this to under one minute for standard cases, with multi-layer coverage including OCR, metadata analysis, and configurable business rules.

Explore the due diligence checklist by sector to understand the specific requirements per industry before selecting a KYC solution for your crowdfunding platform.

CheckFile's API delivers high-fidelity data extraction across 3,200+ document types with cross-field validation tailored to ECSP and MLR 2017 onboarding requirements. Contact us for a free platform walkthrough.

Frequently Asked Questions

Does a UK crowdfunding platform need to register for AML with HMRC or the FCA?

UK crowdfunding platforms that are authorised by the FCA under the Financial Services and Markets Act 2000 are supervised for AML by the FCA and do not need separate HMRC registration. Platforms that handle customer funds but are not FCA-authorised (e.g. some donation-based platforms) may need to register with HMRC as a money service business under MLR 2017. Most investment-based and P2P lending platforms will be FCA-authorised.

What KYC documents must a UK crowdfunding platform collect from investors?

At minimum: one government-issued photo ID (passport, UK driving licence, or national identity card) and one proof of address (bank statement, utility bill, or HMRC correspondence dated within 3 months). Electronic verification via certified providers is accepted under MLR 2017. For higher-risk investors or larger investments, enhanced due diligence requires additional source-of-funds documentation.

How does the ECSP investor protection framework differ from the UK FCA approach?

The EU ECSP caps non-sophisticated investor exposure at €1,000 per project or 5% of net worth, with a 4-day cooling-off period. The UK FCA under PS22/11 applies a £1,000 or 10%-of-net-investable-assets cap per year across all such investments, plus a mandatory appropriateness assessment and a 14-day cancellation right. The FCA framework covers a broader scope of high-risk investments beyond crowdfunding. Both require prominent risk warnings and ongoing suitability monitoring.

What triggers a Suspicious Activity Report (SAR) on a crowdfunding platform?

A SAR must be filed with the NCA when a platform knows, suspects, or has reasonable grounds to suspect that funds are linked to money laundering or terrorist financing — there is no minimum amount. Common triggers include: source of funds inconsistent with stated income, unusual transaction patterns, attempts to invest through multiple accounts linked to the same individual, or project owners with adverse media or sanctions hits. The SAR must be filed promptly, and the platform must not "tip off" the customer.

Can a crowdfunding platform use electronic verification for KYC?

Yes. UK MLR 2017 and EU ECSP regulations both accept electronic identity verification as equivalent to in-person checks, provided the method is reliable and uses trusted data sources. The FCA expects platforms to document their verification methodology and apply a risk-based approach — electronic verification for lower-risk clients, video or in-person verification for higher-risk cases.

---

Regulatory information in this article is based on rules in force as of June 2026. The ECSP framework continues to evolve with ESMA guidance — check EUR-Lex and the FCA website regularly for updates.