Bank of Italy - FAQ - Crowdfunding service providers for business

How are supervisory competences shared between Banca d'Italia and CONSOB?

Under the TUF:

Banca d'Italia is responsible for compliance with the requirements relating to:

capital adequacy, risk mitigation, holdings, and public disclosure on these matters;
corporate governance and general organizational and business continuity requirements;
administrative and accounting organization, internal controls, remuneration and incentive systems, risk management (including for risks relating to the determination of the default rate), internal audit where applicable, and outsourcing of operational functions;
shareholder requirements;
checks on project owners;
requirements for members of the management board;

CONSOB is responsible for

compliance with transparency and fairness requirements, including procedures for the proper provision of crowdfunding services, management of conflicts of interest that may be detrimental to clients, inducements, complaint handling, arrangements for the exercise of the regulatory compliance control function, where provided for;
the identification of national provisions applicable to marketing communications disseminated in the territory of the Italian Republic, and monitoring in accordance with the ECSP Regulation.

What services or activities can providers offer in connection with crowdfunding services?

When submitting their licensing application, crowdfunding service providers may request to be authorized to provide additional activities in accordance with Commission Delegated Regulation (EU) 2022/2112, including:

the safekeeping of assets;
the use of special purpose vehicles for the provision of crowdfunding services;
payment services, subject to licensing as a payment service provider under Directive (EU) 2015/2366;
the application of credit scores to crowdfunding projects;
the suggestion of prices and/or interest rates for crowdfunding offers;
the management of an electronic board;
the establishment and management of risk-bearing funds.

Only lending-based crowdfunding service providers are allowed to provide individual management of loan portfolios.

The crowdfunding service provider may carry out other activities, in accordance with EU or national law, including activities that are reserved or subject to other forms of licensing, provided that they are related and instrumental to the main activity.

Can a crowdfunding service provider also operate in other Member States?

Yes, business crowdfunding service providers may provide their services in a Member State other than the one where they were licensed.

To do so, at the same time as or after the licensing application, applicants must provide the following to CONSOB, as the authority designated as the single point of contact under the ECSP Regulation:

a list of the Member States in which it intends to provide crowdfunding services;
the identity of the natural and legal persons responsible for providing the crowdfunding services in those Member States;
the start date of the intended provision of crowdfunding services;
a list of any other activities carried out by the crowdfunding service provider that do not fall within the scope of the ECSP Regulation.

What does the ECSP Regulation foresee with regard to conflicts of interest in connection with the operation of crowdfunding platforms?

Under the ECSP Regulation, business crowdfunding service providers are not allowed to:

participate in any crowdfunding offer on their platform;
accept any of the following entities as project owners on their platform:

shareholders holding 20 per cent or more of share capital or voting rights;
their managers or employees;
natural or legal persons linked to these shareholders, managers or employees.

Providers that accept any of the entities referred to in points (a), (b) and (c) as investors in the projects offered on their platform must make this known on their website, where they must also publish information on the specific crowdfunding projects in which those entities have invested; they must also ensure that such investments are made on the same terms as those offered to other investors and that these entities do not receive preferential treatment or privileged access to information.

Providers must also have policies and procedures in place for the management of conflicts of interest, which must comply with the provisions of Commission Delegated Regulation (EU) 2022/2111.

Can crowdfunding service providers appoint a third-party intermediary to register shares in limited liability companies (società a responsabilità limitata, Srl)?

In transposing the new rules on crowdfunding, the TUF introduced the possibility of offering financial products to the public, including through crowdfunding platforms, by way of derogation from the first paragraph of Article 2468 of the Italian Civil Code.

For the subscription and subsequent disposal of units, the TUF explicitly allows the use of financial intermediaries authorized to provide investment services. This alternative unit transfer regime must be clearly indicated on the crowdfunding platform, which must also provide for appropriate arrangements to enable investors to exercise this option.

When applying for authorization, applicants must indicate the appointed intermediary and a summary of the agreements governing the relationship between the parties.

Is there a form for submitting applications?

Yes, applicants must use the 'Application form' (see the 'Downloads' section) provided by Banca d'Italia and CONSOB and defined on the basis of the form annexed to Commission Delegated Regulation (EU) 2022/2112.

The Guide by Consob and Banca d'Italia contains useful information for filling in the application form.

What documents should I attach to my application?

The information and documents to be submitted with your licensing application are set out in the relevant EU legislation (ECSP Regulation and Commission Delegated Regulation (EU) 2022/2112) and in the application form to be used for submitting your application.

Useful information is also contained in the Guide by Consob and Banca d'Italia.

What information is required for the licensing of a crowdfunding service provider for business?

The information required under Article 12 of the ECSP Regulation is:

the name (including the legal name and any other business name to be used) of the applicant crowdfunding service provider, the internet address of the website operated by that crowdfunding service provider and its physical address;
the legal form of the applicant crowdfunding service provider;
the articles of association of the applicant crowdfunding service provider;
a business plan setting out the types of crowdfunding services that the applicant crowdfunding service provider intends to offer and the crowdfunding platform it intends to operate, including where and how crowdfunding offers are marketed;
a description of the applicant crowdfunding service provider's governance arrangements and internal control mechanisms - particularly its risk management and accounting procedures - to ensure compliance with the ECSP Regulation;
a description of the systems, resources and procedures for monitoring and protecting the applicant crowdfunding service provider's data processing systems;
a description of the applicant crowdfunding service provider's operational risks;
a description of the prudential safeguards of the applicant crowdfunding service provider in accordance with Article 11 of the ECSP Regulation;
proof that the applicant crowdfunding service provider complies with the prudential requirements under Article 11 of the ECSP Regulation;
a description of the applicant crowdfunding service provider's business continuity plan which, taking into account the nature, scale and complexity of the crowdfunding services that the applicant crowdfunding service provider intends to provide, sets out measures and procedures to ensure, in the event of failure of the applicant crowdfunding service provider, the continuity of the provision of essential services relating to existing investments and the sound administration of agreements between the applicant crowdfunding service provider and its clients;
the identity of the natural persons responsible for the management of the applicant crowdfunding service provider;
evidence that the natural persons referred to in point (k) are of sufficiently good repute and possess sufficient knowledge, skills and experience to manage the applicant crowdfunding service provider;
a description of the applicant crowdfunding service provider's internal rules to prevent the persons referred to in the first subparagraph of Article 8 (2) of the ECSP Regulation from participating as project owners in crowdfunding services offered by the applicant crowdfunding service provider;
a description of the applicant crowdfunding service provider's outsourcing arrangements;
a description of the applicant crowdfunding service provider's procedures for dealing with clients' complaints;
confirmation that the applicant crowdfunding service provider intends to provide payment services itself or through a third party, in accordance with Directive (EU) 2015/2366, or by means of an agreement pursuant to Article 10 (5) of the ECSP Regulation;
a description of the applicant crowdfunding service provider's procedures for verifying that the information contained in the key investment information sheet is complete, accurate and clear;
a description of the applicant crowdfunding service provider's procedures in relation to the investment limits for non-sophisticated investors referred to in Article 21 (7) of the ECSP Regulation.

Can existing companies apply for authorization?

Yes, existing companies may apply for authorization under the ECSP Regulation (in this case the business plan must include a description of previous operations, see FAQs on the business plan).

Can a banking or financial intermediary apply for authorization to provide crowdfunding services for business?

Banks, securities investment firms, financial intermediaries under Article 106 of the TUB, payment institutions and electronic money institutions may apply for authorization to provide crowdfunding services for business. Licensed financial intermediaries are not required to provide any information that they have already provided to Banca d'Italia by submitting a declaration stating that this information has not changed and therefore does not need to be updated. They must still provide all the specific information relating to the provision of crowdfunding services (see Banca d'Italia's provisions implementing Article 4-sexies.1 of the TUF).

Moreover, in line with the provisions of the ECSP Regulation, the provisions on prudential requirements for crowdfunding service providers do not apply to these financial intermediaries: they remain subject to their relevant legislation.

What should the corporate purpose clause detail in the articles of association?

Since the articles of association must reflect the activities actually carried out and the organizational and governance structure specifically adopted by the company, the corporate purpose clause should specify the crowdfunding services offered, using the definitions contained in the ECSP Regulation, as well as any additional ancillary and related activities provided.

How does Banca d'Italia assess the ownership structure of crowdfunding service providers (other than banks and financial intermediaries)?

As required by the TUF, Banca d'Italia verifies that the holders of qualifying holdings, i.e. those who hold directly or indirectly at least 20 per cent of the capital or of the voting rights, do not have a criminal record.

When the holder of a qualifying holding is a legal person, the requirements of the following persons must be verified:

each member of the management body and any other persons who effectively direct the business;
the participants in the capital of the legal person who, either alone or jointly, control it.

In its assessment, Banca d'Italia shall also take into account any information on the integrity profile (e.g. administrative sanctions, dismissals, roles in failed, sanctioned or compulsorily wound up companies) to be provided by the crowdfunding service provider in accordance with Commission Delegated Regulation (EU) 2022/2112.

These checks are carried out on the basis of Ministerial Decree 144/1998, adopted pursuant to Article 25 (2) of the TUB. See also Banca d'Italia's Provisions implementing Article 4-sexies.1 of the TUF.

How does Banca d'Italia assess the members of the management bodies of crowdfunding service providers (other than banks and financial intermediaries)?

As required by the TUF, Banca d'Italia shall ensure that:

the natural persons involved in the management of the crowdfunding service provider do not have a criminal record, in accordance with the ECSP Regulation. This check is carried out on the basis of Ministerial Decree 169/2020, issued pursuant to Article 26 (3) of the TUB;
the members of the crowdfunding service provider's management body have sufficient knowledge, skills and experience and devote sufficient time to the performance of their duties.

In its assessment, Banca d'Italia shall also take into account the information to be provided by the crowdfunding service provider in accordance with Commission Delegated Regulation (EU) 2022/2112.

Please note that the rules on the prohibition of interlocking directorates do not apply to crowdfunding operators.

For more information on the procedures for assessing and verifying provider requirements, please refer to Banca d'Italia's Provisions implementing Article 4-sexies.1 of the TUF.

Are crowdfunding service providers required to appoint a statutory auditor?

The ECSP Regulation requires crowdfunding service providers to calculate prudential requirements on the basis of audited annual financial statements (Article 11). Therefore, for the annual audit of their financial statements, crowdfunding service providers must use an auditor, to be identified in accordance with the provisions applicable to their legal form (e.g. joint stock companies SpA or limited liability companies Srl).

SpA firms not subject to consolidated financial reporting and Srl firms that have appointed a collegial audit body (or a single auditor) may entrust that body with auditing the accounts.

As a prospective crowdfunding service provider, what information should I provide about my organizational set-up?

The ECSP Regulation requires crowdfunding service providers to have governance and organizational arrangements in place that ensure their effective and prudent management.

Your application should therefore include a description of:

the governance arrangements adopted, indicating the composition, role and functioning of your management bodies (organizational chart, etc.), the distribution of tasks and relevant powers and hierarchical relations, the existing staff responsible for performing the services or any recruitment plan for the following three years and a progress report on its implementation;
the internal control mechanisms in place (e.g. compliance and risk management functions), including information on the resources employed and their skills, roles and responsibilities, the hierarchy//chain of command, and the reports to the management body;
any foreseen outsourcing arrangements (see FAQs below);
the systems, resources and procedures for monitoring and protecting your data processing systems, specifying the internal arrangements in place to ensure the proper processing of personal data and information received from investors, including the use of cloud services, as well as your fraud prevention and data protection policies, and your document storage policy, specifying where and how the documents are stored and whether you use any cloud services.

In addition, you must submit:

your risk management procedure: a risk map and a description of the risk management policies and procedures in place to identify, manage and monitor the risks associated with your activities, processes and systems;
the accounting procedures for the recording and reporting of financial information;
your customer complaint management procedures;
your procedures to verify//ensure that the key investment information sheet is clear, correct and complete;
your procedures regarding investment limits for non-sophisticated investors.

What information should I provide if I want to outsource any of my business functions?

You must provide a description of your outsourcing arrangements, including:

the operational functions to be outsourced, including cloud services;
the third parties to whom the operational functions will be outsourced and their headquarters;
the internal arrangements and resources allocated to the control of the outsourced functions (contact persons);
a summary of your outsourcing agreement, if the third party is located in a third country (if this information is available);
service level agreements with service providers;
an analysis of the alternatives to the third parties selected with an assessment of how and when to implement an exit strategy;
business continuity plans, including ways to ensure assistance during the transition to a new provider (or insourcing) in the event of contract termination.

You must provide the information necessary to ensure that the solution adopted: (i) does not impair your ability to comply with your obligations under the relevant legislation; (ii) does not alter the relationship with your clients; (iii) does not impair the quality of your internal control system; (iv) does not impede supervision.

In accordance with the ESCP Regulation, crowdfunding service providers remain fully responsible for compliance with the rules applicable to outsourced activities.

For more details, please refer to Commission Delegated Regulation (EU) 2022/2112 and the relevant supervisory guidelines issued by Banca d'Italia (only in Italian).

What should the business plan and forecast accounting plan contain?

Under the ECSP Regulation, the business plan must set out the types of crowdfunding services that the crowdfunding service provider intends to provide, explaining in detail how, and the crowdfunding platform that it intends to operate, including where and how crowdfunding offers are to be marketed.

The forecast accounting plan for the first three business years must include: (i) the forecast balance sheets; (ii) the forecast profit and loss accounts; and (iii) the planning assumptions for the above forecasts and explanations for the figures provided.

Your plans must include:

a description of the business development lines with the expected volumes broken down by type of crowdfunding service provided;
if the company is already operational, a description of the activities carried out so far, indicating the volumes, the number of projects financed and the results achieved, as well as the annual accounts for the last three years, if available;
fees charged to project owners and investors;
growth estimates with a detailed explanation of the assumptions underlying the assumptions made; estimates should also be made for an adverse scenario, which is worse than the baseline scenario, in order to self-assess the provider's ability to achieve and maintain economic equilibrium even under adverse conditions;
a forecast report on technical and capital adequacy profiles.

Banca d'Italia examines this documentation to assess - based on the reliability of the forecasts and the sustainability of the operations//activities - the intermediary's compliance with prudential requirements from the start of operations and throughout the forecast period, both in the baseline and adverse scenarios.

You may use the following excel template to collect the required information and, once completed, attach it to your licensing application (see Downloads).

Table for budget forecast data

Are there any measures in place to protect client funds?

No, crowdfunding services are not covered by deposit guarantee schemes and transferable securities or other instruments authorized for crowdfunding purposes acquired through the platform are not covered by investor-compensation schemes. Therefore, investors must always bear in mind the risk of losing the entire amount invested.

What prudential requirements apply to crowdfunding service providers?

Crowdfunding service providers must, at all times, have prudential safeguards equal to at least the higher of €25,000 and one quarter of the fixed overheads of the previous year, which must include the cost of servicing loans for three months if the crowdfunding service provider also facilitates the granting of loans. Under Article 11 of the ECSP Regulation, these safeguards may take one of the following forms:

own funds, calculated in accordance with Regulation (EU) No 575/2013 (Capital Requirements Regulation, CRR);
an insurance policy covering the territories of the EU where crowdfunding offers are actively marketed or a comparable guarantee;
a combination of points (a) and (b). In this case, you must make sure that the sum of the value covered by the policy (per claim limit) and the amount of available own funds is at least equal to the minimum amount required.

Providers must produce the following:

for own funds: (a) documentation demonstrating how the applicant calculated the amount in accordance with Article 11 of the ECSP Regulation; (b) in the case of an existing undertaking, an audited statement of accounts or a public register certifying the amount of own funds; and (c) in the case of a newly created undertaking, a bank statement issued by a credit institution certifying that the funds are deposited in the applicant's account;
for the insurance policy: a copy of the final or preliminary contract containing all the information necessary to comply with Article 11 (6) and (7) of the ECSP Regulation, signed by an undertaking authorized to provide insurance under EU or national law. The policy must be signed before the conclusion of the licensing procedure (with a suspension clause, if needed, until the authorization is issued).

How does Banca d'Italia assess the adequacy of the crowdfunding service provider's own funds?

Applicants must provide evidence of their own funds by submitting the following:

documentation showing how they calculated the amount in accordance with Article 11 of the ECSP Regulation;
the projected calculation of the applicant's prudential requirements for the first three financial years, both in the baseline and adverse scenarios;
in the case of an existing undertaking, audited accounts or a public register certifying the amount of own funds;
in the case of a newly created undertaking, a bank statement issued by a credit institution certifying that the funds are deposited in the applicant's account;

Banca d'Italia will examine the above documents to verify the existence and composition of applicants' own funds, the correctness of the calculations in accordance with Articles 26 to 30 of Regulation (EU) No 575/2013 (CRR) and the adequacy of these funds to ensure compliance with prudential requirements not only at the licensing stage, but also on an ongoing basis. Failure to comply with prudential requirements may lead to the withdrawal of authorization.

How does Banca d'Italia assess the adequacy of the insurance policies taken out by crowdfunding service providers?

The insurance policies submitted by crowdfunding service providers to cover prudential requirements must:

have all the characteristics referred to in Article 11 (6) of the ECSP Regulation, i.e.: (i) they have an initial term of no less than one year; (ii) the notice period for their cancellation is at least 90 days; (iii) they are taken out from an undertaking authorized to provide insurance under EU or national law; and (iv) they are provided a third-party entity;
cover at least the risks referred to in Article 11 (7) of the ECSP Regulation; the subject matter of the policy must therefore expressly indicate the risks referred to in the Regulation and there must be no clauses - including exclusion clauses - which could limit its coverage compared with the provisions of the Regulation;
provide for a per claim limit that is aligned with the aggregate limit and, in any event, adequate to cover the prudential requirement.

Crowdfunding service providers must: (i) assess the adequacy of the financial clauses provided for in the policy, taking into account the risks they expect to assume for future operations, and that limits and deductibles do not affect their ability to meet any claims for compensation from users; and (ii) describe the monitoring mechanisms to continuously check whether the limits are reached during the coverage period.

What should the business continuity plan include?

The business continuity plan should include a description of the measures and procedures that will ensure, in the event of the failure of the crowdfunding service provider, the continuity of the provision of critical services for existing investments and the good management of the arrangements with clients, including, where applicable, any arrangements for the ongoing management of outstanding loans, notifications to clients and transfers of asset safekeeping arrangements. The business continuity plan should also include a description of three more likely scenarios of failure identified by the crowdfunding service provider and the measures to be taken to mitigate their impact on the continuity of critical services. Examples of scenarios to be considered include: (i) voluntary liquidation or crisis of the company; (ii) disruption of IT services due to an operational problem of the platform; and (iii) revocation or suspension of the licence.

If the measures envisaged to manage a bankruptcy scenario involve third parties, the plan must also describe the thid parties' processes and roles, with the platform retaining oversight and monitoring responsibilities.

The measures and procedures of crowdfunding service providers' business continuity plans must comply with Commission Delegated Regulation (EU) 2022/2116.

How should payment services be provided for investment transactions made on crowdfunding platforms?

Crowdfunding service providers may:

provide payment services:
- either directly, if licensed as a payment service provider under Directive (EU) 2015/2366;
- or through a third-party payment service provider under Directive (EU) 2015/2366, in which case the crowdfunding service provider must provide a copy of the final or preliminary agreement with the third party, when submitting its licensing application;
establish and maintain arrangements to ensure that project owners only accept funding for crowdfunding projects or other payments through payment service providers in accordance with Directive (EU) 2015/2366.

It should be noted that if providers of crowdfunding services for business who use exclusively or preferentially an Italian payment service provider (banks, payment institutions, electronic money institutions) to manage payment flows relating to campaigns published on crowdfunding platforms are qualified as payment services agents, they must be registered with the Italian Body for the management of the lists of financial agents and credit brokers (Organismo Agenti e Mediatori, OAM). One of the conditions for registration is compliance with specific obligations to prevent the risk of money laundering and terrorist financing, as laid down in Legislative Decree 231 of 21 November 2007 (Chapter V, Articles 43 et seq.), such as: participation in specific training programmes for the recognition of operations potentially linked to money laundering and terrorist financing; acquisition and storage of customer identification data, to be transmitted to the principal payment service provider; communication to the principal payment service provider of all circumstances and information relevant to the transmission of a suspicious transaction report to the Financial Intelligence Unit (FIU).

How should the safekeeping of crowdfunding assets be managed?

The crowdfunding service provider may provide asset safekeeping services directly or through a third party. In either case, the custodian of the assets must be authorized to act as a credit institution under Directive 2013/36/EU (Capital Requirements Directive, CRD) or as an investment firm under Directive 2014/65/EU (Markets in Financial Instruments Directive II, MIFID II).

All transferable securities and instruments authorized for crowdfunding purposes which are offered on crowdfunding platforms and which can be registered in a securities account opened in the name of an investor, or which can be physically delivered to a custodian may be held for safekeeping.

What checks should providers carry out regarding the owners of projects to be published on their platforms?

The ECSP Regulation requires crowdfunding service providers to carry out a minimum level of due diligence in respect of project owners who submit projects for funding through crowdfunding platforms. These due diligence checks must verify:

that the project owner has no criminal record for breaches of national commercial, insolvency, financial services, anti-money laundering, anti-fraud or professional liability rules;
that the project owner is not established in a jurisdiction recognized as non-cooperative under the relevant Union policy or in a third country considered as high risk in accordance with Article 9 (2) of Directive (EU) 2015/849.

The provider must define the criteria for these checks in advance and have appropriate procedures and tools to verify the declarations made by the parties concerned, in line with the relevant supervisory guidelines issued by Banca d'Italia (only in Italian).

How should projects be evaluated before being published on crowdfunding platforms?

Crowdfunding service providers should define a structured project selection process, including: (i) the use of sound methodologies for substantive due diligence, thorough compliance checks (e.g. conflicts of interest, usury rates) and financial assessments (e.g. unprofitable projects); (ii) the use of qualified professionals, including external ones; and (iii) effective internal dialogue in the process, ensuring separation between the investigation and decision-making phases, including in order to avoid conflicts of interest.

Providers using a platform that specializes in lending-based crowdfunding projects must establish appropriate procedures to ensure compliance with usury laws in relation to the interest rates applied.

Are crowdfunding service providers subject to anti-money laundering obligations?

The ECSP Regulation requires crowdfunding service providers to carry out at least a minimum level of due diligence (see Article 5) on project owners by verifying that they are not established in a jurisdiction recognized as non-cooperative under the relevant Union policy or in a high-risk third country pursuant to Article 9 (2) of Directive (EU) 2015/849.

Regulation (EU) 2024/1624 of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing includes providers specialized in offering crowdfunding services among the recipients of crowdfunding obligations. As of 10 July 2027 (date of entry into force of the new provisions), crowdfunding service providers will be required, for example, to: (i) have internal procedures and controls in place to mitigate and manage money laundering and terrorist financing risks effectively; (ii) conduct customer due diligence and record the transactions and transfers carried out by customers; and (iii) establish a monitoring system to detect transactions that may give rise to suspicion of money laundering or terrorist financing and report such transactions to the Financial Intelligence Unit (UIF).

The specific obligations imposed on supervised intermediaries providing crowdfunding services remain unaffected.

Under what conditions is a crowdfunding service provider's licence withdrawn?

Under the ECSP Regulation, a licence may be withdrawn by the competent authorities if the crowdfunding service provider:

has not used the licence within 18 months of the date on which it was granted;
has expressly renounced its licence;
has not provided crowdfunding services for 9 consecutive months and is no longer involved in the administration of existing contracts;
has obtained the licence irregularly;
no longer meets the conditions under which the licence was granted;
is in serious breach of the ECSP Regulation;
is also a payment service provider and has infringed national anti-money laundering or terrorist financing rules, or its managers, employees or third parties acting on its behalf have done so;
the same crowdfunding service provider, or a third party acting on its behalf, has lost its licence to provide payment or investment services.

FAQ - Crowdfunding service providers for business