DORA for Crowdfunding Service Providers (ECSPR)

Yes. DORA applies to all crowdfunding service providers authorised under ECSPR, regardless of size and regardless of whether you hold client funds, because the regulation targets ICT risk rather than balance-sheet risk. What changes with size is the calibration, not the framework: Article 16 is not open to CSPs, so a small platform applies Articles 5 to 15 scaled through Article 4 proportionality and the microenterprise reliefs. So the answer is that DORA applies, but proportionately.

No. Article 16(1) of DORA reserves the simplified framework to a closed list: small and non-interconnected investment firms, payment and e-money institutions benefiting from the PSD2 and EMD exemptions, certain exempted credit institutions and small IORPs. Crowdfunding service providers are not on it, whatever their size. What DORA does give a small CSP is Article 4: the framework must be implemented in proportion to size, risk profile and the nature, scale and complexity of services, and several provisions expressly relieve microenterprises, for example on the independent internal-audit review of the framework and on the use of independent testers. You still need governance accountability, an ICT risk management framework, a Register of Information and DORA incident handling; advanced Threat-Led Penetration Testing applies only to entities identified by their authorities, which a small CSP will not be.

For a microenterprise CSP the main cost is staff time to document and operationalise a proportionate implementation of the framework rather than expensive tooling, because much of what DORA requires (backups, access control, a continuity plan, third-party contracts) overlaps with existing ECSPR and GDPR obligations you already meet. Budget for an initial gap assessment, updating your key cloud and PSP contracts with DORA clauses, and an annual review and incident-response test. A focused programme reusing existing controls is far cheaper than building from scratch.

Almost certainly not. TLPT under DORA Articles 26 and 27 is reserved for entities identified by authorities as significant from an ICT and systemic perspective, which excludes the typical small or micro CSP. You do still owe proportionate digital operational resilience testing under Articles 24 and 25, meaning periodic vulnerability assessments and reviews appropriate to your size, but not the full TIBER-EU style red-team exercise.

Your PSP or e-money partner is an ICT third-party provider supporting a critical function (investor payments), so it must appear in your register of information and be covered by a contract with the required DORA provisions on access, audit, incident notification, sub-outsourcing and exit. You should also assess concentration risk and understand the PSP's own resilience, because an outage on their side directly halts investor fund flows on your platform. Engage them early, as many PSPs are updating contracts sector-wide.

Your national competent authority (NCA), the same body that authorised you under ECSPR, is responsible for supervising your DORA compliance, with ESMA playing a coordinating and standard-setting role at EU level and maintaining the public ECSPR register. There is no separate DORA licence; supervision is integrated into the existing ECSPR relationship with your NCA. Expect DORA matters, including your register of information and incident reporting, to be handled through that authority.