Cyprus ECSP Crowdfunding Licence 2026: CySEC Authorisation, the €5m Cap and EU Passporting

Cyprus has become a natural base for fintech platforms that match investors with growing businesses, but "crowdfunding" is a regulated activity, not a marketing label. Since Regulation (EU) 2020/1503 became applicable across the EU, anyone facilitating loans or placing securities to fund companies through an online platform needs a single, harmonised authorisation — the European Crowdfunding Service Provider (ECSP) licence — issued in Cyprus by CySEC.Regulation (EU) 2020/1503, Art. 3

This guide explains what the licence covers, the all-important €5 million ceiling that defines the regime, the capital and governance you must put in place, how the CySEC process runs, and how to structure and tax the Cyprus company that will hold the authorisation. For offers that outgrow the crowdfunding cap, see our companion guide to the Cyprus CIF / CySEC investment-firm licence.

What is a Cyprus ECSP crowdfunding licence?

An ECSP licence is a single EU authorisation, granted in Cyprus by CySEC under Regulation (EU) 2020/1503, that lets a company operate a crowdfunding platform for business finance — either lending-based or investment-based — and passport that service across the entire EU.

The Regulation defines a "crowdfunding service" as the matching of business-funding interests of investors and project owners through a platform, consisting of the facilitation of granting of loans, or the placing without a firm commitment basis of transferable securities and admitted instruments, together with the reception and transmission of client orders.Regulation (EU) 2020/1503, Art. 2(1)(a) In plain terms, that captures both peer-to-business lending platforms and equity/debt-securities platforms. Cyprus transposed the supporting national measures through the Provision of Crowdfunding Services for Business Law of 2024 and CySEC's policy statement on the Regulation's application.The Provision of Crowdfunding Services for Business Law of 2024 (L.123(I)/2024)

Because it is an EU Regulation rather than a directive, the substantive rules are the same in every Member State; the choice of Cyprus is about the supervisor, the cost base, corporate tax and talent — not a lighter rulebook. The authorised entity must be a legal person established in the Republic with a real presence, not a letterbox.Regulation (EU) 2020/1503, Art. 12(3)

Who needs authorisation and what does it cover?

Any legal person that intends to provide crowdfunding services for business must apply to CySEC before it operates. The licence covers lending-based and investment-based crowdfunding up to the €5 million ceiling, plus ancillary services such as asset safekeeping and payment arrangements where these support the core activity.

A single authorisation can cover both business models, and can include the individual portfolio management of loans, but each service you intend to provide must be specified in the application. What the ECSP licence does notcover is consumer lending to individuals, donation- or reward-based crowdfunding, or offers above the €5 million cap — those fall under other frameworks or none. Platforms that also hold client money or issue e-money frequently need to pair the ECSP with an EMI or payment authorisation, or partner with a licensed provider, because the crowdfunding licence itself does not confer full payment-institution rights.

How does the €5 million 12-month cap work?

The ECSP regime applies to crowdfunding offers with a consideration of up to €5,000,000 per project owner, calculated over a rolling 12-month period as the sum of the amounts raised through transferable securities, admitted instruments and loans.Regulation (EU) 2020/1503, Art. 1(2)(c)

The cap is measured at the level of the project owner(the business raising money), not the platform, and it is cumulative across the year: a company that raised €3m six months ago can only raise a further €2m under the regime in the following period. Cross the €5m line and the offer leaves the crowdfunding perimeter entirely — it generally triggers the full prospectus regime under the Prospectus Regulation and may require the issuer or intermediary to rely on a different licence. This ceiling is the single most important design parameter for any Cyprus platform: your deal-sizing, onboarding checks and disclosures should all be built around policing it per project owner.

What capital and prudential requirements apply?

A crowdfunding service provider must hold, at all times, prudential safeguards equal to at least the higher of €25,000, or one quarter of the fixed overheads of the preceding year (reviewed annually). These safeguards may take the form of own funds, an eligible insurance policy, or a combination of the two.Regulation (EU) 2020/1503, Art. 11

Capital is only the floor. CySEC will also expect sound governance: fit and proper directors, at least two persons effectively directing the business, effective business-continuity, conflicts-of-interest, complaint-handling and outsourcing arrangements, and due-diligence procedures on the project owners admitted to the platform. Because the overheads limb ratchets the requirement up as the business grows, plan capital against a realistic multi-year cost projection rather than the day-one €25,000 minimum.

How does the CySEC authorisation process work?

You incorporate a Cyprus company, build a complete application file, and submit it to CySEC. CySEC has 25 working days to confirm the file is complete, then must grant or refuse authorisation within three months of receiving a complete application.Regulation (EU) 2020/1503, Art. 12(4) and 12(8)

1. Incorporate the vehicle.Set up a Cyprus private company as the applicant — see the full company registration guide— with an appropriate object clause and substance in Cyprus.
2. Build the application. Programme of operations, business plan, governance and internal-control descriptions, risk and business-continuity policies, complaint-handling procedures, outsourcing arrangements, and the identity and fitness of directors and qualifying shareholders, per Article 12(2).
3. Evidence the prudential safeguards. Demonstrate the Article 11 own-funds or insurance position.
4. Completeness review. CySEC assesses completeness within 25 working days and may ask for missing information.
5. Decision. A reasoned decision to grant or refuse within three months of a complete application; once granted, CySEC notifies ESMA for the public register of authorised providers.Regulation (EU) 2020/1503, Art. 14

CySEC is the designated competent authority in Cyprus for the Regulation.CySEC Policy Statement on the application of Regulation (EU) 2020/1503 The statutory clock is generous; the real timeline is set by how long it takes to produce a genuinely complete, coherent file.

What investor-protection rules must an ECSP follow?

The Regulation splits investors into sophisticated and non-sophisticated categories and layers strong protections onto the latter: an entry knowledge test and loss-bearing simulation, a four-calendar-day reflection period, and a Key Investment Information Sheet for every offer.

• Entry knowledge test & loss simulation.Non-sophisticated investors must be assessed for their understanding of the investments, and shown a simulation of their ability to bear loss.Regulation (EU) 2020/1503, Art. 21
• Reflection period. A pre-contractual reflection period of four calendar days, during which a non-sophisticated investor may revoke an offer to invest without giving a reason and without penalty; no funds may be transferred to the project owner before it expires.Regulation (EU) 2020/1503, Art. 22
• Key Investment Information Sheet (KIIS). A standardised disclosure drawn up per offer, giving project, risk, rights and fee information, with the platform responsible for its clarity.Regulation (EU) 2020/1503, Art. 23
• Conflicts, due diligence and 24-hour rules. The platform must not participate in offers on its own platform beyond limited exceptions, must conduct minimum due diligence on project owners, and must apply fair, clear pricing and communication standards.

Can a Cyprus ECSP passport across the EU?

Yes. A single CySEC authorisation carries an EU passport. To provide services in other Member States the provider notifies CySEC of the host States and the services intended; CySEC transmits the notification to the host competent authorities and ESMA, and no separate local licence is required.Regulation (EU) 2020/1503, Art. 18

This is the commercial heart of the ECSP regime: a platform authorised in Cyprus can market to investors and onboard project owners in Germany, France, the Netherlands or anywhere else in the Union on the strength of one licence, supervised primarily by CySEC. ESMA maintains a public register of all authorised crowdfunding service providers, which counterparties and banks routinely check during onboarding.

How is a Cyprus ECSP taxed and structured?

The licence sits inside an ordinary Cyprus company, so the platform is taxed like any other Cyprus business: corporate income tax at 15% on profits from 1 January 2026, no withholding tax on outbound dividends to non-resident shareholders, and the standard audit and filing obligations.Income Tax Law N.118(I)/2002 (as amended, 15% rate from 1 Jan 2026)

A few structuring points matter for founders. First, the operating company must have real Cyprus substance — directors, office and decision-making in Cyprus — both to satisfy CySEC's establishment test and to support Cyprus tax residency; the mechanics are covered in our Cyprus corporate tax guide. Second, non-domiciled individual founders who relocate can draw dividends from the company free of the Special Contribution for Defence for up to 17 years, subject to the General Healthcare System contribution capped at €180,000 of income. Third, the regulated entity itself will need an ICPAC-licensed statutory audit each year, so budget for that alongside the CySEC supervisory fees.

Zeno is not a law firm: we coordinate independent Cyprus Bar advocates and ICPAC-licensed accountants to incorporate the vehicle, build the CySEC file, and stand up the tax and accounting function around it, so the licensing and the company sit on one coherent plan rather than two disconnected workstreams.