DORA Certifications Bundle
399 € excl. VAT
DORA Sector Guide
DORA for Crowdfunding Service Providers (ECSPR)
Proportionate DORA compliance for lean, ECSPR-authorised crowdfunding platforms.
Proportionate DORA compliance for lean, ECSPR-authorised crowdfunding platforms.
Which statement best describes your crowdfunding platform?
Applies in full, calibrated by the proportionality principle of Article 4. That includes a control function for ICT risk, internal audit of the framework, independent testers and yearly tests of systems supporting critical or important functions. TLPT applies only if your competent authority identifies you.
Next step: DORA Gap AnalysisFewer than 10 persons and turnover and/or balance sheet total up to EUR 2 million. Articles 5 to 15 still apply. Among other reliefs, DORA lifts the internal audit of the framework, the independent internal audit review of response and recovery plans, the independent-tester requirement and TLPT. Incident reporting and the Register of Information still apply.
Next step: DORA Compliance ChecklistArticle 16(1) covers small and non-interconnected investment firms, exempted payment and e-money institutions, certain institutions exempted under Directive 2013/36/EU and small IORPs. Crowdfunding service providers are not on it, whatever their size. Record that, and document how Article 4 scales your framework.
Next step: DORA Gap AnalysisDORA covers crowdfunding service providers whether or not they hold client funds. If a payment service provider or e-money institution moves investor funds for you, the ICT services it provides belong in your Register of Information, and its outage belongs in your continuity plan.
Next step: Register of Information BuilderNot sure your entity is a financial entity at all? Run the free scope determination.
Crowdfunding service providers authorised under Regulation (EU) 2020/1503 (ECSPR) are financial entities within the scope of DORA from 17 January 2025. Because the platform itself is the entire service, ICT resilience is not a back-office concern for a CSP, it is the core of the business model: if the platform is down, no investment offers can be made, no investors can be onboarded, and no funds can flow to project owners.
DORA is proportionate, but not through Article 16. The simplified framework of Article 16 is reserved to a closed list (small and non-interconnected investment firms, exempted payment and e-money institutions, certain exempted credit institutions and small IORPs) and crowdfunding service providers are not on it. A CSP applies the full framework of Articles 5 to 15 and gets its proportionality from Article 4, which requires implementation in proportion to size, risk profile and the nature, scale and complexity of services, and from the specific reliefs DORA grants to microenterprises. The challenge is translating a regulation written with large banks in mind into a workable, affordable programme for a team that may number a dozen people, all while keeping the platform available and investor data secure.
DORA applies to crowdfunding service providers authorised under ECSPR (Regulation (EU) 2020/1503), per Article 2(1)(s) of DORA, regardless of size and regardless of whether they hold client funds. The simplified framework of Article 16 does not extend to CSPs: Article 16(1) is a closed list and crowdfunding is not on it. A CSP therefore applies Articles 5 to 15, detailed in Delegated Regulation (EU) 2024/1774, scaled through the proportionality principle of Article 4 and the provisions that expressly relieve microenterprises (definition in Article 3 of DORA), for example on the independent internal-audit review of the framework and on the use of independent testers. The supervisory expectation is a full framework scaled down with documented reasons, not a lighter regime claimed by category.
National Competent Authorities (NCAs) that authorise CSPs under ECSPR act as DORA supervisors, coordinated by ESMA which maintains the public register of authorised providers.
DORA layers on top of, and does not replace, the operational and organisational requirements that CSPs already meet under ECSPR Articles 4 to 12 (sound governance, business continuity, conflicts of interest, and the use of third parties). Most CSPs do not hold client funds directly and rely on an authorised payment service provider or e-money institution to execute investor payments, so PSP dependency becomes a critical ICT third-party relationship that must be mapped and contractually managed under DORA. Platform availability, the integrity of the bulletin board, and accurate processing of investment commitments are where ECSPR conduct duties and DORA resilience obligations most clearly converge.
Six obligations that play out differently in your sector. Open a card for the detail.
For a CSP the website or app is the entire service offering, so uptime and recovery objectives sit at the heart of the DORA ICT business continuity requirements (Articles 11 and 12). An outage during an active offer can stop investment commitments, freeze the bulletin board, and trigger conduct issues under ECSPR. Set realistic RTO and RPO targets and test that the hosting and CDN configuration can meet them.
The entry-knowledge test, appropriateness assessment and AML or KYC checks under ECSPR run through ICT systems that must be resilient and protected under DORA. A failure or compromise here can let unsuitable investors through or expose identity documents. Treat the onboarding pipeline as a high-criticality function in your asset and risk inventory.
Because most CSPs route investor funds through an authorised PSP or e-money institution rather than holding them, that provider is a key ICT third-party service supporting a critical function. Map this dependency, ensure the contract carries DORA-compliant clauses (audit, sub-outsourcing, exit, incident notice), and understand what happens to in-flight investments if the PSP suffers an outage.
DORA expects ICT business continuity and response-and-recovery plans, but for a small CSP these must be proportionate and genuinely usable by a handful of people. Document who does what when the platform fails, including key-person backups, and avoid plans that assume a 24x7 operations centre you do not have. A short, tested, role-based plan beats a 60-page document nobody can execute.
CSPs hold sensitive personal and financial data on retail and sophisticated investors and on project owners. DORA requires protection and prevention measures such as access control and encryption (Article 9) and backup and restoration policies (Article 12), which also reinforce GDPR obligations. A breach of investor data is both a DORA-relevant ICT incident and a personal-data breach, so align your detection and notification workflows across both regimes.
Lean CSPs typically run on cloud infrastructure and SaaS tooling rather than owned data centres, which concentrates risk in a few critical providers. DORA requires a register of information on all ICT third-party arrangements and a pre-contractual risk assessment, whatever the size of the firm. Identify which providers support critical or important functions and ensure exit and portability are realistic.
8 questions drawn from the requirements above. Each gap you declare comes back with the course that covers it and the tool that does the work. Your answers stay in this browser.
Has your management body approved an ICT risk management framework under Articles 5 to 15, with a written record of how Article 4 proportionality and any microenterprise reliefs scale it?
Have you set RTO and RPO targets for the platform, onboarding and payment-instruction flows, and tested that your hosting and CDN configuration can meet them during a live offer?
Is the investor onboarding pipeline (entry-knowledge test, appropriateness assessment, AML and KYC checks) recorded as high-criticality in your ICT asset inventory and protected by access control and encryption?
Can whoever is on call classify an ICT-related incident against the criteria of Delegated Regulation (EU) 2024/1772 and file the initial notification within 4 hours of classifying it as major, out of hours included?
Are your detection and notification workflows aligned so that an investor-data breach is handled both as an ICT-related incident under DORA and as a personal-data breach under the GDPR?
Are the ICT services you receive from your payment service provider, cloud host and KYC provider in your Register of Information, with Article 30 clauses and an exit plan where they support critical or important functions?
Do you test the platform on a documented, risk-based plan (vulnerability assessments, backup restoration, recovery tests), and have you recorded whether TLPT applies to you?
Does your management body follow specific ICT risk training on a regular basis, and does everyone on the team complete digital operational resilience training?
You declared 0 areas to work on, gaps first. Each one names what to learn and what to use.
Indicative self-assessment based on your own answers, not a compliance opinion. Prices exclude VAT.
Three reports to your competent authority, each with its own clock. Enter two times to see your deadlines.
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
Enter the classification timeWithin 72 hours of submitting the initial notification, and updated when the situation changes.
Follows the initial notificationWithin one month of the latest intermediate report, once the root cause analysis is complete.
Follows the intermediate reportDelegated Regulation (EU) 2025/301, Article 5; classification under Delegated Regulation (EU) 2024/1772. The later deadlines assume each report goes in at its latest permissible time. A deadline falling on a weekend or bank holiday moves to noon of the next working day (Article 5(4)), except for the initial notification and intermediate report of credit institutions, central counterparties, operators of trading venues and essential or important entities under NIS2, or where your competent authority has decided otherwise (Article 5(5) and (6)); the dates shown do not apply that extension.
For a CSP the most consequential ICT incident is usually a platform outage during a live funding campaign or a compromise of the onboarding and payment flow, both of which can disrupt investor fund flows and harm project owners mid-raise. CSPs detect, classify, manage and report ICT-related incidents under Articles 17 to 23 like every other financial entity: the classification criteria and materiality thresholds of Delegated Regulation (EU) 2024/1772 and the reporting sequence of Delegated Regulation (EU) 2025/301 (initial notification within 4 hours of classification as major and 24 hours of awareness, intermediate report within 72 hours, final report within one month) apply regardless of size; what scales with size is the impact a small platform is likely to generate. Keep a simple incident log and a pre-drafted notification template on the Implementing Regulation (EU) 2025/302 model so a small team can react quickly when the platform that is your entire business goes dark.
On a lean crowdfunding platform the same few people carry the DORA decisions. Whoever is on call when the platform fails during a live offer classifies the incident and starts the reporting clock: the initial notification is due within 4 hours of classifying it as major. Whoever manages the payment service provider and cloud contracts negotiates the Article 30 clauses. The management body approves the framework and how Article 4 scales it, and must keep its ICT risk knowledge current. Each needs to know what DORA expects of it, and to show it.
Members of the management body must “actively keep up to date with sufficient knowledge and skills” to understand and assess ICT risk, including by following specific training on a regular basis.
Regulation (EU) 2022/2554, on EUR-Lex Article 13(6) · All staffICT security awareness programmes and digital operational resilience training are “compulsory modules” of staff training, for all employees and senior management, at a level that matches each function.
Regulation (EU) 2022/2554, on EUR-LexRecords why Article 16 is not available, how Article 4 and any microenterprise reliefs scale the framework, and keeps the evidence your competent authority will ask for.
The first lesson is open to read before you buy.
Classifies a platform outage or onboarding compromise against Delegated Regulation (EU) 2024/1772 and drafts the initial, intermediate and final reports, out of hours included.
The first lesson is open to read before you buy.
Owns the cloud stack, access control and encryption of investor data, backups, and the RTO and RPO targets the hosting and CDN configuration must meet.
The first lesson is open to read before you buy.
Handles the payment service provider, cloud host and KYC provider: Register of Information, Article 30 clauses, concentration risk and a realistic exit plan.
The first lesson is open to read before you buy.
Approves the ICT risk management framework and its proportionality record, and must keep its ICT risk knowledge current, including through specific training (Article 5(4)).
The first lesson is open to read before you buy.
Several people to train? Team seats cost less per learner from 2 seats, on one invoice: see team pricing.
Starting out? DORA Fundamentals is free, certificate included.
The tools that matter most for your sector, and what each one does for you.
Draft the initial notification for a platform outage during a live offer, with the 4-hour, 72-hour and one-month deadlines computed.
Open Free to build · export licence €249 a yearEnter the ICT services from your payment service provider, cloud host and KYC provider in the ITS templates and run the validation rules before submission.
Open FreeTest a past platform outage or investor-data breach against the major-incident criteria of Delegated Regulation (EU) 2024/1772.
Open FreeAnswer 16 questions on the five pillars and get a prioritised list of the gaps a small team should close first.
Open €149Set MTPD, RTO and RPO for the platform, onboarding and payment-instruction flows in one workbook.
Open FreeScore your ICT third-party service providers and see where cloud or SaaS concentration calls for an exit plan first.
OpenAll tools: browse the full list. Prices exclude VAT.
Everything tailored to your sector, ready to use on day one.
Yes. DORA applies to all crowdfunding service providers authorised under ECSPR, regardless of size and regardless of whether you hold client funds, because the regulation targets ICT risk rather than balance-sheet risk. What changes with size is the calibration, not the framework: Article 16 is not open to CSPs, so a small platform applies Articles 5 to 15 scaled through Article 4 proportionality and the microenterprise reliefs. So the answer is that DORA applies, but proportionately.
No. Article 16(1) of DORA reserves the simplified framework to a closed list: small and non-interconnected investment firms, payment and e-money institutions benefiting from the PSD2 and EMD exemptions, certain exempted credit institutions and small IORPs. Crowdfunding service providers are not on it, whatever their size. What DORA does give a small CSP is Article 4: the framework must be implemented in proportion to size, risk profile and the nature, scale and complexity of services, and several provisions expressly relieve microenterprises, for example on the independent internal-audit review of the framework and on the use of independent testers. You still need governance accountability, an ICT risk management framework, a Register of Information and DORA incident handling; advanced Threat-Led Penetration Testing applies only to entities identified by their competent authority (Article 26(8)) and never to microenterprises (Article 26(1)).
For a microenterprise CSP the main cost is staff time to document and operationalise a proportionate implementation of the framework rather than expensive tooling, because much of what DORA requires (backups, access control, a continuity plan, third-party contracts) overlaps with existing ECSPR and GDPR obligations you already meet. Budget for an initial gap assessment, updating your key cloud and PSP contracts with DORA clauses, and an annual review and incident-response test. A focused programme reusing existing controls is far cheaper than building from scratch.
Almost certainly not. TLPT under DORA Articles 26 and 27 is reserved for entities identified by authorities as significant from an ICT and systemic perspective, which excludes the typical small or micro CSP. You do still owe proportionate digital operational resilience testing under Articles 24 and 25, meaning periodic vulnerability assessments and reviews appropriate to your size, but not the full TIBER-EU style red-team exercise.
The ICT services your PSP or e-money partner provides for investor payments (platform integration, APIs, account and transaction data) belong in your Register of Information (Article 28(3)), under a contract with the DORA provisions on access, audit, incident notification, sub-outsourcing and exit; where they support a critical or important function, the additional clauses of Article 30(3) apply too. You should also assess concentration risk and understand the PSP's own resilience, because an outage on their side directly halts investor fund flows on your platform. Engage them early, as many PSPs are updating contracts sector-wide.
Your national competent authority (NCA), the same body that authorised you under ECSPR, is responsible for supervising your DORA compliance, with ESMA playing a coordinating and standard-setting role at EU level and maintaining the public ECSPR register. There is no separate DORA licence; supervision is integrated into the existing ECSPR relationship with your NCA. Expect DORA matters, including your register of information and incident reporting, to be handled through that authority.
Need the full risk view? See the Risk Assessment Toolkits or compare all kits. All prices exclude VAT; an EU VAT invoice is issued at checkout. Professional templates, not legal advice.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.