AMLR-ready due diligence for crowdfunding platforms, live before 10 July 2027
Onboard and review investors and project owners with an AMLR-aligned questionnaire, risk scoring, sanctions and PEP screening and a complete audit trail. AML Hub collects, checks and keeps the record. Your team takes the decisions.
Free sandbox with synthetic test data · EU hosting · Operated by Criptalia S.r.l.
Live in three steps
The same engine runs behind every link, campaign and API call.
Configure
Start from the AMLR-EU v1 template, with investor and project-owner tracks for natural persons and legal entities. Add your own questions and tune risk weights, classes and review periods. Mandatory AMLR fields stay locked.
Embed
Send hosted links or bulk campaigns from day one, then embed the widget or call the REST API as you grow. Outcomes reach your platform through signed webhooks.
Decide
Answers, provider checks and scores land in one case. Your AML officer proposes, a second reviewer approves, and every step is written to a hash-chained audit log.
Who it's for
Obliged entities that need solid customer due diligence without building and maintaining it in-house.
Crowdfunding platforms (ECSPs)
Obliged entities from 10 July 2027 under Art. 3(3)(h), with investors and project owners both treated as customers (Art. 19(5)(e)).
Lending platforms
Due diligence on lenders and borrowers, individuals and companies, including beneficial owners.
SGRs and small asset managers
A configurable CDD process with scoring, periodic reviews and record keeping, without a custom build.
Payment and e-money firms
Structured onboarding and periodic reviews alongside the transaction monitoring you already run.
ProfessionalsLater
Accountants, notaries and other professionals are planned as a later segment.
Built around what the AMLR asks of you, and what it leaves to you
AML Hub works as an outsourced service: it collects, verifies, screens, scores and stores. The decisions the regulation reserves to you stay in your team's hands.
AMLR provisions covered
- Art. 3(3)(h)Crowdfunding service providers become obliged entities.
- Art. 19(5)(e)Investors and project owners are both customers, so each gets its own questionnaire track.
- Art. 20(1)(d)Sanctions screening runs as part of customer due diligence.
- Art. 18(2)Risk profiles, onboarding decisions and suspicious-transaction reports stay with you. AML Hub never auto-approves.
- Art. 77Records are kept for 5 years after the business relationship ends.
- ReviewsCustomer data refreshed at least every year for high risk and every 5 years for everyone else.
The AMLA RTS on customer due diligence went to the Commission as a final draft on 30 September 2026 and is not yet adopted. Questionnaires are versioned configuration, so they can follow the final text without a software release.
Controls your supervisor will ask about
Data separated per platform
Each platform gets its own data plane and its own encryption key. No pooling and no cross-platform customer records.
EU hosting
The service and its data are hosted in the European Union.
DORA-ready contract pack
Outsourcing agreement, DORA contract clauses, GDPR data processing agreement and exit plan, signed in one flow.
4-eyes and audit trail
Configurable 4-eyes approvals and an append-only, hash-chained audit log you can export for an inspection.
ISO 27001 on the roadmap
ISO/IEC 27001 certification is targeted within 12 months of launch. We are not certified today.
AML Hub supports your compliance work; it does not take over your obligations as an obliged entity. Article references are to Regulation (EU) 2024/1624.
Fits the way your platform works
Start with no code, move to the API when you are ready. Every channel runs the same questionnaire and scoring.
Hosted link
Reusable or single-use links per track, in your branding, to drop into your platform, emails or CRM.
Bulk campaigns
Upload existing customers, send personalised links and reminders, and track remediation progress.
Embeddable widgetFrom v1
Run the flow inside your own pages with a session token minted by your backend.
REST APIFrom v1
Create customers and cases, post answers and documents, read results. OpenAPI 3.1, sandbox and production keys.
Webhooks
Signed events when a case is submitted, checked, decided or due for review.
Openapi and other data providers
Tax ID, company registry, beneficial owners, PEP, sanctions and adverse media, IBAN. Use the default bundle or bring your own contract.
EUDI walletFrom v1
Identification with the EU Digital Identity Wallet.
Simple, usage-based pricing
A one-off setup, then you pay per completed verification and per case file kept.
- Setupfrom €5,000one-off
- Per verificationfrom €2.50natural person, Core plan
- Record keeping€0.30per case file per year
- SandboxFreesynthetic test data
Indicative prices in EUR, excluding VAT, subject to commercial validation.
See plans and calculator →Resources
AMLR readiness checklist for crowdfunding platforms
What to have in place before 10 July 2027: customer tracks, data set, screening, review cycles, record keeping and outsourcing. Free PDF, sent to your inbox once you confirm your email address.
Frequently asked questions
What changes on 10 July 2027?
The EU AML Regulation (EU) 2024/1624 starts to apply. Crowdfunding service providers become obliged entities (Art. 3(3)(h)) and must treat both investors and project owners as customers (Art. 19(5)(e)). Sanctions screening becomes part of customer due diligence, customer data must be refreshed at least every year for high-risk customers and every 5 years for the others, and records must be kept for 5 years after the relationship ends (Art. 77). The detailed AMLA standards on due diligence were sent to the Commission as a final draft on 30 September 2026 and are not yet adopted.
Who takes the decisions: AML Hub or us?
You do. Under Art. 18(2) of the AMLR, decisions such as approving a customer's risk profile, accepting a customer and reporting suspicious transactions cannot be outsourced. AML Hub collects data, runs checks, proposes a score and keeps the record; named users on your team decide, with 4-eyes approval where you configure it. AML Hub never auto-approves.
How is our data kept apart from other platforms?
Each platform has its own data plane and its own encryption key. Customer data is never pooled: the same person onboarded by two platforms exists as two unrelated records. AML Hub staff have no access to your customer data by default.
Can we bring our existing customers up to standard?
Yes. Bulk remediation campaigns let you upload your existing customer base, send personalised links and reminders, and follow progress against the review deadlines for high-risk and other customers.
Which data providers do you use?
The default bundle runs through Openapi for checks such as tax ID, company registry data, beneficial owners, PEP, sanctions and adverse media, IBAN and identity verification. You can also connect your own provider contracts. Coverage differs by country; where a source is not covered yet, documents can be uploaded and reviewed manually.
Do you file suspicious-transaction reports for us?
No. AML Hub prepares the draft report and the evidence pack from the case. Your reporting officer files it on your FIU's portal and records the protocol number and date in AML Hub.
Where is AML Hub hosted, and what about DORA?
AML Hub is hosted in the EU. DORA applies to crowdfunding providers, so the contract pack includes DORA contract clauses, data for your register of information and an exit plan with full export. ISO/IEC 27001 certification is on our roadmap, targeted within 12 months of launch; we are not certified yet.
How much does it cost, and can we try it first?
The sandbox is free and uses synthetic test data. In production you pay a one-off setup fee, a fee per completed verification and a yearly fee per case file kept. The pricing page has a calculator for a monthly estimate.
Book a demo
Tell us about your platform and we will walk you through a live case, from questionnaire to 4-eyes approval, using your own customer mix.