Key Points and News of European Regulations on Crowdfunding and Digital Operating Resilience
This article summarises the main points and novelties introduced by the European regulations on crowdfunding (Regulation (EU) 2020/1503) and digital operational resilience in the financial sector (Regulation (EU) 2022/2554 - DORA), together with the implementing provisions of the Bank of Italy and CONSOB in Italy.
Regulation (EU) 2020/1503 on European Crowdfunding Services Providers for Enterprise
The purpose of this regulation is to establish a European harmonised legal framework for crowdfunding services, facilitating access to finance for SMEs and offering more protection to investors.
Key Points and News:
- Definition and Authorisation of Crowdfunding Service Providers: The Regulation clearly defines crowdfunding service providers and introduces a single authorisation scheme at European level. Suppliers authorised in one Member State may operate cross-border in other Member States, after notification to the competent authorities. In Italy, the Bank of Italy is responsible for the authorisation of specialized suppliers of crowdfunding services for companies. The application for authorisation must follow specific requirements.
- Summary of Key Investment Information (KIIS): One of the most important innovations is the introduction of a Standardised investment key information card (KIIS) that crowdfunding service providers must provide potential investors for each offer. This card, drawn up by the project holder but whose clarity, correctness and completeness is guaranteed by the crowdfunding service provider, must warn potential investors that crowdfunding investments involve risks not covered by deposit guarantee or investor compensation schemes. The KIIS shall reflect the specific characteristics of the loan and investment-based crowdfunding and shall be available in at least one of the official languages of the Member State where the supplier is authorised or where the bid is promoted. In Italy, the form must be written in Italian and simultaneously made available to CONSOB.
- Investor protection: The Regulation introduces several investor protection measures, including the obligation to provide KIIS prior to the crowdfunding operation, clear information on investor rights and on commissions and warnings about risks. Crowdfunding service providers must establish effective procedures for dealing with customer complaints.
- Transparency and Information Obligations: Crowdfunding service providers shall make available in a clearly identified section of their website relevant information, such as interest rates, maturity dates and loan risk categories. If they apply credit score schemes or offer reference prices, they shall make available a description of the method used. The competent authorities (in Italy, Banca d'Italia and CONSOB) must be informed annually about the types of private limited liability companies and their shares. ESMA shall collect and publish aggregate statistics on the crowdfunding market in the Union.
- Responsibility for Information: Member States should provide for the responsibility of the project holder or its administrative bodies for the information provided in the KIIS.
- Marketing Communications: Marketing communications must be clearly distinguishable from KIIS and contain a warning on risks. For communications spread in Italy, the Italian language must be used and the warning must be present "before accession read the card containing the key information on investment".
- Vigilance and Health: The competent authorities have investigative powers, including access to premises (excluding private homes) in the event of reasonable suspicion of violations. Member States must ensure appropriate arrangements to enable informants to report violations and protect them from retaliation. The decisions of the competent authorities shall be subject to the right of appeal. The Bank of Italy and CONSOB exercise supervisory powers in Italy.
Regulation (EU) 2022/2554 on Digital Operational Resilience in the Financial Sector (DORA)
DORA introduces a Complete regulatory framework to strengthen the digital operational resilience of financial entities in the European Union, recognizing that ICT accidents and lack of operational resilience may impair financial stability.
Key Points and News:
- External Application Area: DORA applies to a wide range of financial entities, including credit institutions, investment firms, payment institutions, authorized crowdfunding service providers under Regulation (EU) 2020/1503, and many others.
- Information Risk Management (ICT): Financial entities must establish, implement and maintain a solid and complete risk management framework. This framework must include strategies, policies, procedures, protocols and tools to adequately protect all ICT and information resources. The management body has the ultimate responsibility for ICT risk management. Financial entities must keep their knowledge and skills up to date on cyber risks.
- ICT Incident Report: DORA introduces a harmonised obligation on financial entities to report serious ICT accidents directly to their competent authorities. Processes for ICT accidents management must be defined, including identification, management and notification. Financial entities must classify computer accidents as significant according to specific criteria. In case of serious accidents affecting the financial interests of customers, they must be informed without undue delay.
- Digital Operating Resilience Test: Financial entities must carry out regular tests to assess the effectiveness of their ICT defenses. Some entities, considered particularly relevant, must undergo Real Threat-based penetration test (TLPT).
- ICT Risk Management of Terzi: DORA places a strong emphasis on risk management arising from third party providers of ICT services. Financial entities must adopt a third party ICT risk strategy and keep a record of all contractual agreements relating to ICT services provided by third parties. Contracts with third party providers of ICT services that support essential or important functions must include specific clauses.
- Surveillance of the Third Critical Providers of ICT Services: The Regulation lays down a Surveillance framework for third-party providers of ICT services considered critical for the financial sector. A supervisory authority will be responsible for their supervision at European level.
- Sharing Information on Computer Threats: DORA promotes voluntary sharing of information and analysis on cyber threats between the financial entities, in compliance with the rules on competition and data protection.
- Competenti Authorities: DORA compliance is ensured by the competent authorities existing for the different financial entities.
- Changes to Other Regulations: DORA makes changes to several existing regulations in the financial sector to integrate the requirements for digital operational resilience.
Implementation provisions in Italy
The Bank of Italy has issued implementing provisions of Article 4-sexies.1 of the TUF on crowdfunding service providers for enterprises, repealing some previous provisions. These provisions, together with Supervisory guidelines of the Bank of Italy, specify the ways in which specialist crowdfunding service providers must comply with Regulation (EU) 2020/1503, with particular attention to the corporate government, internal controls, evaluation of the suitability of the exponents and the due diligence on project owners.
The Consob has adopted Regulation No 22720 of 2023 that governs the mode of transmission to the Consob of KIIS and the rules relating to marketing communications of authorized crowdfunding service providers in Italy.
In summary, the Regulation (EU) 2020/1503 introduces a Harmonized framework for crowdfunding, facilitating cross-border operations and strengthening investor protection through information standardization. Regulation (EU) 2022/2554 (DORA) represents a significant innovation in the financial regulatory landscape, focusing on digital operational resilience as a crucial element for the stability of the financial system as a whole, imposing stringent requirements on ICT risk management, accident reporting, testing and risk management of third parties. The national authorities, such as the Bank of Italy and CONSOB, have the task of implementing and monitoring compliance with these regulations at national level.