ECSPR Passporting: Why Your Home Country Does Not Limit Your Market

Lithuania has 16 licensed crowdfunding platforms. Germany, the EU's largest economy with 83.6 million people, has 6. That gap is not an accident of market size, and it is not a story about German founders being less ambitious. But a story about where founders choose to ask for permission, because under ECSPR passporting one licence gives access to all 27 EU member states, and a founder who understands that stops treating their home country as their market. This post covers four things: the country asymmetry and what produces it, what "one licence for 27 markets" legally means, the three mechanics that decide whether the passport works for you (the notification procedure, the language of your disclosure document, and marketing rules), and how to think about where to apply.

One sentence on the licence itself, because this blog is not about getting one: the licence is granted by the national regulator of one member state, and the process, the capital requirement and the paperwork are a separate subject with their own guide.

What "one licence for 27 markets" actually means

ECSPR is the EU Crowdfunding Regulation, the rulebook governing investment-based and lending-based crowdfunding platforms across Europe. Before it, a platform that wanted investors in five countries needed permission from five national regulators, each with its own forms and its own opinions. ECSPR replaced that with one rulebook: get permission once and the others have to let you in. It has applied for years and the transition period for platforms running on older national licences is over, so operating without a licence in the activities it covers is no longer an option. Two footnotes: the count is 30 rather than 27, since the regulation took effect across the wider European Economic Area on 1 August 2026, and every country you enter keeps its own marketing rules.

The scope is narrow, because the licence is not a general permission to do finance. It covers crowdfunding only: project owners raising up to EUR 5 million each over the 12 months before the offer launches, counted across every crowdfunding platform in the EU they have used and including any securities offer in that window that needed no prospectus. It does not cover consumer lending, donation-based or reward-based models. Nor does it cover arranging a German subordinated loan: on the prevailing reading, a qualified subordinated loan carries no unconditional obligation to repay, so it does not count as a loan under the regulation and stays an investment product under German investment product law, needing separate permission.

Above EUR 5 million the instrument decides, not the amount. Transferable securities fall under the EU prospectus rules, where Germany has exempted offers up to EUR 12 million since 5 June 2026, so a three-page securities information sheet under German law covers the gap. A subordinated loan never touches those rules: German investment product law applies, with an investment information sheet up to EUR 6 million and a sales prospectus above it. Every instrument you want on your platform is a permissions question first and a technology question second.

The notification procedure: 10 working days, then you may start

Passporting is a notification, not a second application, and that distinction is the whole economic case for it. The platform files four things with its home regulator: the countries it intends to serve, the people and companies responsible for the service in those countries, the date it intends to start, and a list of any other activities it carries on outside the regulation. That regulator then has 10 working days to pass the information to the regulators of the target countries and to ESMA, the EU markets watchdog, which enters it in the public register. The home regulator has to tell the platform without delay once it has sent that message, and the platform may start from the day it receives that notice, or at the latest 15 calendar days after it filed.

Read the two deadlines together, because they can come apart. 10 working days is 14 calendar days in a clean fortnight, which sits just inside the platform's 15-day backstop, but one public holiday in either country pushes the regulator's deadline past day 15. This means a platform can become entitled to serve a market before that market's regulator has been told it is coming, so treat the 15-day date as the earliest theoretical launch and your home regulator's confirmation as the real one.

The country you are entering has no say over market access, and that is unusual enough to spell out. Its regulator cannot re-license the platform, demand additional capital, or hold up entry pending its own opinion: there is no approval step and no second sign-off to wait for, and supervision stays with the regulator that granted your licence. There is no entry fee either, because there is no second licence to pay for, though your home regulator's ongoing supervisory fees still apply. This is why adding one more country costs a form and a fortnight rather than a fresh application, and why the European crowdfunding service provider passport is the main reason founders choose this regime over a national one.

Market access is not full harmonisation, however, and two local rules survive the passport. If you advertise an offer in another country, the key investment information sheet, the standard disclosure document every offer carries, has to be available in at least one official language of that country. ESMA has confirmed that adverts running there must satisfy the EU marketing rules and that country's own marketing laws, which its own regulator polices. Every regulator also has to publish and keep current the national marketing rules it enforces. So budget a translation and a marketing rules check per country, and treat the fortnight as the regulatory cost of entry, not the total cost.

The register is also your competitive research tool, and most founders never open it. ESMA keeps it public on its website and updates it regularly, and for every provider it lists the countries that provider has notified it intends to serve. Before you pick a jurisdiction, that one field tells you which competitors have already moved into your target markets and which markets nobody has claimed. There is a second use, since withdrawn licences stay in the register for five years, showing you who lost a licence and where.

Your disclosure document may need a new language for every market

The key investment information sheet (KIIS) is where the passport starts costing money, and it is the part of cross-border crowdfunding in Europe that founders discover after they have committed. It does the work a prospectus would do: a standard document of at most six sides of A4 when printed, telling an investor what the project is, what the risks are and what they could lose. It has to be written in an official language of the country that licensed you, or another language that regulator accepts, and where you advertise an offer in another country it also has to be available in an official language of that country, or a language its regulator accepts.

Read that carefully, because the language decision sits with each national regulator rather than with you. There is no EU-wide right to use English. Every regulator has to tell ESMA which languages it accepts, and on ESMA's own table, last updated in January 2024, only 8 of 27 accept English: Belgium, Croatia, Denmark (for sophisticated investors), Hungary, Ireland, Luxembourg, Malta and Spain. English therefore clears fewer than a third of the markets you can passport into, which is why the industry is lobbying: in a joint position paper to the European Commission in September 2025, the European Digital Finance Association and national crowdfunding associations asked it to "permit the use of English as the sole language for the KIIS across all Member States, regardless of whether English is officially recognised by the relevant national competent authority". Nobody lobbies for a fix to a problem that is already solved.

There is also a liability wrinkle that shifts risk onto the platform. The project owner and its management are responsible for the information in the sheet, but your platform has to run proper procedures checking that the information is complete, correct and clear, and civil liability under national law covers the translations as well as the original. ESMA reads the split strictly: the project owner answers for the original document, and the platform alone answers for translation errors, unless the project owner prepared the translation itself and is then liable alongside the platform. The exposure therefore scales with where you advertise rather than with how many countries you notify, so name the three or four markets you will genuinely promote in, check them against ESMA's language table first, and put in writing who supplies and warrants each translation.

Marketing rules stay national. This is the part most coverage skips.

Here is the catch, and it is the single most important paragraph in this post: the passport does not harmonise how you are allowed to advertise. Your adverts have to run in an official language of the country where they appear, or a language that country's regulator accepts, and that regulator supervises them against its own national advertising laws and enforces those laws against you. In other words, one licence, 27 marketing rulebooks. Ireland, for example, requires every crowdfunding advertisement to carry the warning "Investment in crowdfunding projects entails risks, including the risk of partial or entire loss of the money invested. Your investment is not covered by a deposit guarantee scheme or by an investor compensation scheme", displayed at the same time as any benefit you advertise, a requirement in the Central Bank of Ireland's consumer protection rules. Nothing in your Lithuanian licence tells you that. [VERIFY: exact wording and "WARNING:" prefix against Provision 9.53 of the amended Consumer Protection Code]

The regulation tried to make this discoverable, and the fix is only half built. Every national regulator has to publish the marketing rules it enforces on its own website and send ESMA a summary in a language used in international finance, and ESMA has to publish those summaries and the links. ESMA does publish the summaries, but as a PDF annex filed as an undifferentiated line item rather than a consolidated page, and its marketing table is current only to April 2025. The links are the weaker half: roughly 6 of 27 entries carry a URL at all, and only France and Italy point to the regulator's own site rather than a national legal gazette. Five states, Bulgaria, Cyprus, Finland, Portugal and Slovenia, have supplied nothing. So the obligation is certain and the delivery is partial, which leaves the operator doing the work the regulation intended to have done for them.

One boundary worth drawing, because readers assume otherwise: this is not a case of national regulators quietly re-imposing approval. The regulation expressly forbids it: no regulator may require you to notify or clear your adverts before they run. Nor do investor limits differ by country in the way marketing rules do. The entry knowledge test, the loss-bearing simulation, and the trigger above the greater of EUR 1,000 or 5% of an investor's net worth, which requires a risk warning, explicit consent and proof that the investor understands the risk, are all set at EU level and apply identically in every member state. The European Digital Finance Association and some 25 national crowdfunding associations told the Commission's review of the regulation in September 2025 that differences in how platforms apply these tests "remain fully within the scope of the Regulation" and that they had "found no evidence of regulatory arbitrage" - an industry position rather than an independent study, and one that still flags genuine divergence in how member states define a sophisticated investor. The divergence is in marketing and language, not in caps. That is a narrower problem than the pessimists say and a real one nonetheless.

The numbers: the passport is held more than it is used

Founders should know what the data says before they build a strategy on the passport, because the take-up story is not flattering. In January 2025, according to the European Digital Finance Association, 72 of 227 licensed platforms had applied for a passport, and those that did declared an average of eleven countries each, with 19 platforms wanting to operate in all 27 member states and 12 platforms targeting just one additional country. Meanwhile ESMA's 2025 market report, covering calendar 2024, found that across all providers, an average of 8% of funding was raised cross-border, most of it from investors based in the European Economic Area. So roughly a third of the industry has asked for the right, the applicants claim eleven markets each on paper, and 8% of the money moves. Rights sought; markets not entered.

The obvious question is whether that gap is a failure of the regulation or a failure of execution, and the honest answer is that nobody has officially assessed it yet. The regulation itself required the European Commission, after consulting ESMA and the European Banking Authority, to report back on how ECSPR is working, specifically on the effect of the language requirements, the impact of the marketing rules and the volume of cross-border business. That report was due in 2023. As of August 2026 it has not been published, no consultation has been opened, and the Commission's December 2025 Market Integration and Supervision Package does not touch ECSPR at all. This means the friction described above is the friction you will actually operate under for the foreseeable future, not a temporary state awaiting a fix.

There is a more useful reading of the same numbers, and it is the reason this post exists. If a third of platforms have applied for passports and only 8% of funding crosses borders, then cross-border distribution is not saturated. It is unattempted. The platforms that have solved the language and marketing work, in markets where nobody has, are competing against an empty field, and the ESMA register will show you which fields are empty.

What this means if you are choosing where to apply

Choose the regulator for the markets you intend to serve.

Do not choose based only on the country you happen to live in. 3 factors decide it in practice, and only one of them is about your home country.

1: Check whether your target markets' regulators accept a language you can work in. The KIIS and your marketing must both meet local language requirements, and that cost recurs per market.

2: Look at your regulator's throughput and its familiarity with your model. The legal deadline is three months from a complete application file, but realistic timelines run six to nine months and, in the words of crowdfunding researcher Karsten Wenzlaff, some regulators processed licence applications "within six weeks" while "in other countries it took them sometimes 18 months".

3: Ask whether the regulator has seen your instrument before. This is where Lithuania's 2017 head start and 16 licensed platforms genuinely matter, and where a market with two licences does not.

Be clear on what the passport will not do.

It will not create demand. ECSPR gives you the right to offer, not investors to offer to, and 8% cross-border funding is what happens when platforms exercise a right without building a market.

It will not make an instrument tradable. A register entry makes an instrument transferable; it does not create a market for it, and the bulletin board ECSPR allows is expressly not a trading venue that matches buyers with sellers.

Treat cost as part of the jurisdiction decision.

Legal and advisory work on the application file sits indicatively in the region of EUR 30,000 to EUR 100,000 depending on jurisdiction and complexity. The capital buffer you have to hold is the higher of EUR 25,000 or one quarter of the prior year's fixed overheads.

The technology sits anywhere from a six-figure multi-year spend for a custom build to a white-label subscription commonly in the low-to-mid five figures per year. [REVIEW: commercial and product team to confirm all three ranges before publication]

Notifying into an additional member state carries no regulatory fee. The cost of a new market is the KIIS translation, the local marketing review and the distribution work, not the filing.

Do not mistake permission for a growth plan.

The mistake I see most often is treating the passport as a growth plan. It is a permission, and permissions are the cheap part. Eleven declared countries on the ESMA register and one country's worth of investors is a very expensive way to discover that distribution was always the hard problem.

If I were choosing today, I would pick two target markets I could actually sell into, then pick the regulator that makes those two cheapest, and I would leave the other 25 as an option I hold rather than a plan I have.

Keep the software role separate from the licence.

Where the software sits in this is deliberately unglamorous. ONINO is a software provider, and its white-label financing infrastructure is the stack a licensed operator runs its own branded platform on.

The ECSPR licence, the disclosure sheet, and the marketing compliance in each market you notify into all sit with the operator, never with the software vendor. For the wider EU framework around digital securities and financing, our overview of the EU regulatory landscape covers the neighbouring regimes.

If you want to walk through what a multi-market setup looks like on a specific instrument, book a demo.