Terrorist financing risks in crowdfunding

On 30 May 2024, the European Union issued new regulations to combat money laundering and terrorist financing. The Anti-Money Laundering Regulation will extend the group of entities subject to anti-money laundering obligations to include crowdfunding providers from 2027. The new requirements create an acute need for action.

Crowdfunding has steadily gained in importance in recent years. According to information from the German Crowdfunding Association, there were almost 600 crowdfunding platforms in Europe in March 2023, more than 100 of them in Germany alone. On average, these platforms processed a volume of €19 million in 2022, which corresponds to an increase of 17 per cent compared to the previous period. This means that billions are being moved across the industry.

Projects are presented and advertised on crowdfunding platforms with the aim of financing these projects through small-scale investments by numerous investors ("crowd"). The investment opportunities can essentially be divided into four models:

• Crowdinvesting: backers receive a share in the future profits of a project or, if the investment is linked to securities investments, shares or debt instruments.
• Crowdlending: backers receive a pro rata repayment claim from a loan agreement between the project organiser and a credit institution.
• Consideration-based crowdfunding: Backers receive a symbolic, non-monetary consideration, such as personal items from an artist.
• Donation-based crowdfunding: backers donate to a specific project without receiving anything in return.

Companies use crowdfunding as an alternative form of financing if they are unable or unwilling to raise the funds required to realise their projects in the traditional way. Crowdfunding is suitable, for example, for early financing rounds of start-up companies ("seed phase"). A minimum amount is defined that must be reached within a certain period of time. If this fails, the investors receive back the money they have already invested.

In a report published in 2023, the Financial Action Task Force highlighted the risks of misuse of crowdfunding services for terrorist financing purposes. This applies in particular to donation-based crowdfunding. The division of labour in the crowdfunding model can lead to a lack of monitoring measures or a lack of interaction between them. The misuse of crowdfunding by criminals is also favoured by the heterogeneous supervisory regime and the lack of transparency regarding the identity of project sponsors. Most crowdfunding platforms do not require a licence from the German Federal Financial Supervisory Authority (BaFin) to operate and are classified as part of the "grey capital market".¹ This makes it easier for dubious providers to sell their products or embezzle funds. In addition, these providers are not subject to the statutory protection schemes. For example, when the German restaurant chain COA went bust, investors had to accept a loss of 1.5 million euros.

In response to the risks identified, the European legislator decided to include crowdfunding service providers in the group of companies subject to money laundering regulations.

Not all forms of crowdfunding fall within the scope of the new regulation. Accordingly, legal entities that offer crowdfunding services are subject to the obligation. The legislator defines crowdfunding services as the bringing together of business financing interests of investors on the one hand and project promoters on the other with the help of a crowdfunding platform through one of the following activities²:

• the brokering of loans,
• the placement of transferable securities and instruments authorised for crowdfunding purposes issued by promoters or a special purpose vehicle, and
• the acceptance and transmission of client orders in relation to these transferable securities and instruments authorised for crowdfunding purposes.

In addition, the legislation also imposes obligations on crowdfunding intermediaries. These include companies whose business activity consists of facilitating or enabling the bringing together of promoters and donors via an internet-based information system that is accessible to the public or a limited number of donors.

Donation-based crowdfunding in particular is therefore exempt from the new regulations. It is doubtful whether this sufficiently fulfils the approach of combating terrorist financing.

Crowdfunding providers and intermediaries are subject to extensive requirements. Their new obligations include, among other things

• Carrying out a risk analysis to identify and assess the specific risks of money laundering and terrorist financing,
• drawing up internal guidelines, procedures and controls
• setting up a compliance function and
• reporting suspicious cases to the Financial Intelligence Unit

In future, the obliged entity's risk management must not only prevent money laundering and terrorist financing, but also ensure that targeted financial sanctions are not implemented or circumvented. Firstly, the obliged entities determine their individual risk exposure in order to establish (Group-wide) security measures on this basis and thereby reduce the residual risk to an appropriate level. The money laundering officer is responsible for the implementation and management of risk management and reports regularly to the responsible member of management ("compliance manager") and the supervisory body. He is largely independent in the fulfilment of his duties, in particular when deciding whether a suspected case should be reported to the competent authority. For this purpose, the compliance manager relies on a dedicated anti-money laundering organisation, which must be provided with appropriate financial and human resources.

Customer due diligence obligations are of particular importance. For crowdfunding providers, customers are natural or legal persons who seek funding ("promoters") or provide funding ("investors"). When establishing the business relationship, obliged entities must identify their customers and their beneficial owners and monitor the business relationship, including the transactions carried out during the course of the relationship, in a risk-oriented and continuous manner.

It can be assumed that the obligation arises as soon as these persons register on the platform and thus have the opportunity to participate in projects. This is independent of whether a fee is payable in this context or whether the platform is financed exclusively by a pro rata share of successfully brokered transactions. Once identification has been carried out, it can be reused for further participations, so that not every contract brokerage automatically results in the renewed application of due diligence obligations.

Crowdfunding providers still have time to prepare for their new obligations. The regulation will apply from 10 July 2027. As crowdfunding providers have not had to fulfil any obligations under money laundering law to date, they should prepare for the new catalogue of requirements at an early stage. In particular, carrying out a risk analysis for the first time and setting up an appropriate and effective risk management system often proves to be complex and time-consuming in practice, as the necessary structures, human and material resources and databases need to be set up initially.

The experts at KPMG will be happy to answer any questions you may have about preventing money laundering and terrorist financing.

^{1 BaFin article (22 November 2023) "Crowdfunding", available at: https://www.bafin.de/DE/Verbraucher/GeldanlageWertpapiere/GrauerKapitalmarkt/Crowdfunding/crowdfunding_node.html (last accessed on 26 September 2024).}

 ^{2 See Art. 2 para. 1 lit. a in conjunction with lit. e. of Regulation (EU) 2020/1503 on European crowdfunding service providers for companies.}