On 20 September 2021 the SEC brought its first case under Regulation Crowdfunding, and a platform sat among the defendants. The SEC charged TruCrowd, a registered funding portal, and its chief executive, alleging that they hosted two offerings that raised $1,020,100 and $888,180 from retail investors. According to the SEC's release, the chief executive failed to address red flags, among them the criminal history of Robert Shumake and the role Shumake allegedly hid from the public.
Crowdfunding raises money for a project from a crowd of backers through an online platform, as donations, rewards, loans or shares. Each campaign is a payment flow with two groups of customers. That puts it among the newer money laundering typologies: money laundering can enter as backing and leave as a payout that looks earned.
How is crowdfunding used to launder money?
The plainest route is to back a campaign with illicit funds. The EBA names it in its risk factor guidelines, where platforms are used "to fund fictitious investment projects with illicit funds" (Guideline 17.2).
A second route needs an overpayment. A backer or a project owner sends the platform more than the project needs, then asks for the surplus back (Guideline 17.6). The refund leaves a regulated platform, and the bank that receives it sees a refund with no trace of where the money began.
The third route runs through the payout. Among the FATF's risk indicators are deposits pooled from several accounts and paid straight into a campaign, and campaign money moved to an unrelated third party or withdrawn in cash (FATF report, October 2023, p. 47). All three routes show up first in payment data: who paid in, from which account, and where the payout went. Transaction monitoring reads exactly that data on a platform's inflows and payouts.
The FATF ties the risks rising on crowdfunding to the growth of the channel. It counted over 6 million crowdfunding campaigns worldwide in 2022 and wrote that their volume and variety make illicit activity difficult to detect (p. 4). Its report deals with terrorist financing through campaigns and finds donation crowdfunding the most vulnerable type (p. 44).
Table 1 sets out the risks involved, who carries each one and the control a platform runs. A risk assessment of crowdfunding opportunities can start from the same rows.
Table 1. Crowdfunding risks: who carries each and what the platform controls
| Risk | Who carries it | Platform control |
|---|---|---|
| Money laundering | The platform, its payment provider and the bank that receives the payout | Know both sides; monitor inflows and payouts; refund only to the paying account |
| Fraud | Backers, and the platform that hosted the campaign | Background checks on the owner; remove the campaign and return funds when a red flag appears |
| Terrorist financing | Donation campaigns first (FATF, p. 44) | Screen promoters and campaign content; follow where donations go |
| Investment failure | The backer; UK loan and investment crowdfunding has no FSCS cover (FCA) | Under Regulation Crowdfunding, each investor confirms the whole investment may be lost (17 CFR 227.303(b)) |
How does crowdfunding fraud feed money laundering?
In the TruCrowd case the fraud sat with the issuers. The SEC alleged that the people behind the two companies kept a convicted person's role out of view and diverted investor funds for personal use rather than the purposes disclosed to investors. Once diverted, that money is the proceeds of crime and needs a clean way out.
Fraud sits upstream as a predicate offense: what a fraudster collects from backers is what then has to be laundered. Each of the crimes committed through crowdfunding platforms that takes money leaves the platform two problems: losses to explain to backers, and proceeds someone will try to move out clean.
Crowdfunding scams take two more forms that a platform sees first. The FATF lists projects that appear fictitious, carry a name close to a known association or campaign, or impersonate one (p. 46). It also describes fundraisers who exploit donors' sympathy for victims of natural or humanitarian disasters (p. 33). Fake appeals of this kind are charity fraud: they raise money that is criminal from the first payment.
Stolen cards are another way in. One FATF indicator is a campaign donor with many charges from the same credit card, or from several different cards (p. 49). Money paid in with stolen card details reaches the project owner as ordinary campaign income.
Which AML rules apply to crowdfunding platforms as of November 2026?
Table 2. Crowdfunding AML rules by jurisdiction, as of November 2026
| Jurisdiction | Who is covered | Project owner check | Backer check | Reporting | Source and date |
|---|---|---|---|---|---|
| US, Regulation Crowdfunding | Funding portals and broker dealers registered with the SEC; portals are FINRA members | Background and securities enforcement history check on the issuer, officers, directors and 20 percent owners; deny access where fraud is possible | Reasonable basis that each investor is within the limits, before every commitment | Broker dealers file SARs with FinCEN; funding portals have no BSA duty | 17 CFR 227.301 and 227.303 (1 October 2026); SEC order, 28 January 2016 |
| US, donation platforms | Not financial institutions under the BSA; the banks and MSBs that process the payments are | None set by a crowdfunding rule | None set by a crowdfunding rule | Through the bank or MSB that moves the money | FATF report, October 2023, p. 60 |
| EU now, ECSPR | Authorized crowdfunding service providers for business loans and securities | Evidence of no criminal record in listed fields and that the owner is not established in a non cooperative jurisdiction or high risk third country; for a company, also 20 percent shareholders and the management body | Through the payment service provider that handles the money; EBA Guideline 17 where the platform is an obliged entity | Under national AML law where the platform is an obliged entity | ECSPR Art. 5 and 10(4); ESMA Q&A 2747, 5 January 2026 |
| EU from 10 July 2027, AMLR | Crowdfunding service providers and crowdfunding intermediaries, donation platforms included | Customer due diligence as a customer | Customer due diligence as a customer | Suspicious transaction reports to the FIU | AMLR Art. 2(1)(16), 3(3)(h), 19(6)(e), 90 |
| Canada | Platforms that raise funds or virtual currency through donations, a money services business service since 2022 | Record of the fundraiser, the purpose and any third party the money is for | Identity check on a donor giving $1,000 or more | Reports to FINTRAC as an MSB | PCMLTFR ss. 29.1, 36.1, 95(1)(h), current to 19 October 2026 |
| UK | FCA authorization for loan based and investment based platforms; for other crowdfunding, the FCA regulates the payment services in some circumstances | Not stated in the FCA guidance | Not stated in the FCA guidance | Not stated in the FCA guidance | FCA guidance, updated 10 July 2026 |
| Norway | Crowdfunding firms (folkefinansieringsforetak) | The AML Act's customer due diligence | The AML Act's customer due diligence | Reports under the AML Act | Hvitvaskingsloven § 4(1)(q), from 1 August 2026 |
In the US, Title III of the JOBS Act put crowdfunding platforms under SEC registration with rules aimed at fraud. A donation platform is not a financial institution under the Bank Secrecy Act, although the banks and money services businesses that process its payments are (FATF report, p. 60).
In the EU, ECSPR Article 5 sets the project owner checks today. Article 10(4) lets the platform, or a third party, provide payment services only as a licensed payment service provider. The AMLR makes platforms obliged entities from 10 July 2027, donation sites included, and gives them no exemption from the business wide risk assessment (Article 10(3)).
Of 40 FATF Global Network members surveyed in March 2023, about 23 percent left crowdfunding out of their AML rules (p. 15). Investors can verify a platform's credentials before investing on the same two points. In the US, a funding portal is registered with the SEC and is a FINRA member.
Does a funding portal have to file SARs?
No. When the SEC approved FINRA's funding portal rules, its order of 28 January 2016 recorded FINRA's view that "the BSA and its implementing regulations do not currently apply to funding portals".
FinCEN proposed in April 2016 to bring portals under the BSA as brokers or dealers. Its regulatory agenda lists that rule as withdrawn on 16 April 2025.
A broker dealer acting as the intermediary does file a SAR with FinCEN. Anyone else who sees suspicious activity, investors and portal staff included, can submit a tip or complaint to the SEC.
What changed in crowdfunding AML in 2026?
- 5 January 2026. ESMA said Article 5(2) applies to every project owner and, for a company, to "shareholders who directly or indirectly hold 20% or more" and the management body (ESMA Q&A 2747).
- 10 April 2026. FinCEN's proposed AML and CFT program rule does not mention funding portals or crowdfunding.
- 27 May 2026. The FCA published its crowdfunding guidance for investors, last updated on 10 July: loan and investment crowdfunding is regulated, and where crowdfunding is not, "we do regulate the payment services" in some circumstances.
- 1 August 2026. Norway's AML Act began to list crowdfunding firms among its reporting entities (hvitvaskingsloven § 4).
- 22 September 2026. The SEC's statistics counted 9,851 Regulation Crowdfunding offerings to 30 June 2026, with $1,644 million reported raised, a total it calls a likely lower bound.
What must a platform check on a project owner before a campaign goes live?
Most of the six checks are ones crowdfunding platforms must implement by law. In the US, Rule 301 of Regulation Crowdfunding sets the floor; in the EU, ECSPR Article 5 does. Trusting the due diligence a platform runs means knowing it covers these six checks:
- Who owns and runs it. Identify each beneficial owner to 20 percent, the directors and anyone who in fact directs the business, the line both Rule 301 and ESMA draw. complead, formerly Sanction Scanner, runs this check through KYB and UBO verification. It confirms the company against official registers, traces every owner and parent upward to the natural persons behind them and screens each party it finds.
- Criminal and enforcement history. Rule 301 requires a background and securities enforcement history check on the issuer, its officers, directors and 20 percent owners. ECSPR asks for evidence of no criminal record in commercial, insolvency, financial services, AML, fraud or professional liability law.
- Where it is established. A project owner on an ECSPR platform may not be established in a non cooperative jurisdiction or a high risk third country.
- Adverse media, PEP status and past campaigns. The EBA counts negative news, PEP status and sanctions as higher risk. Where risk is high, it suggests open source or adverse media searches (Guidelines 17.6 and 17.16). Past campaigns count too: 1,094 issuers ran more than one Regulation Crowdfunding offering to 30 June 2026.
- The business and its statements. Ask for the business plan and the audit or financial statements. Rule 301 lets an intermediary rely on the issuer's representations only until it has reason to question them.
- Remove and refund. If later information points to fraud, Rule 301 requires the intermediary to "promptly remove the offering", cancel it and return committed funds, or for a portal, direct their return.
How do platforms verify backers and investments from retirement accounts and trusts?
Platforms verify each backer, then each payment. In the US, Regulation Crowdfunding caps an issuer at $5,000,000 in 12 months. It also limits a non accredited investor across all offerings in 12 months: the greater of $2,500 or 5 percent of income or net worth when either is below $124,000, otherwise 10 percent, up to $124,000. Before each commitment the intermediary needs a reasonable basis that the investor is within the limit, relying on the investor's statements unless there is reason to question them.
Legitimacy verification gets harder when the payer is not the backer. Picture a backer who funds a $20,000 commitment from a solo 401(k) with a designated Roth account; a 529 plan, a donor advised fund or an impact focused trust raises the same question. The money arrives from an account in the name of the plan, fund or trust. The record then has to show who controls that payer and which account the money left. The EBA counts funds drawn from an account in the customer's own name at a regulated institution as lower risk (Guideline 17.5).
Ask for source of funds when the EBA's triggers appear: the source is unclear and the investor will not explain it, the amount exceeds the investor's estimated liquid assets, or the money is borrowed (17.6). The FATF adds cash, prepaid cards and some virtual assets (p. 48).
From 10 July 2027 the AMLR counts as customers everyone "both seeking funding and providing funding" (Article 19(6)(e)), so backer CDD and KYC become the EU platform's own duty. Canada already requires an identity check on any donor who gives $1,000 or more. With complead's customer risk assessment and KYC, the backer and the project owner each carry one risk score, because onboarding, screening, monitoring, fraud checks and investigation share an engine.
Which payment patterns should the platform and its bank monitor?
Table 3. Payment red flags on a crowdfunding platform
| Indicator | Data | Control |
|---|---|---|
| Payments split across platforms, or instructions to split them (FATF, p. 45) | Payments per backer and campaign; campaign text | Aggregate by backer and by campaign over a period |
| Average contribution or goal out of line with similar projects (FATF, p. 45) | Contribution size against peer campaigns | Threshold per campaign type |
| Deposits pooled from several accounts, then paid into a campaign (FATF, p. 47) | Funding account per payment | Flag backers paying from accounts not in their name |
| Goal met fast, then the page closed or the project ended early (FATF, p. 47) | Time to goal; closure date | Hold the payout for review |
| Payout to an unrelated party or abroad (FATF, p. 47) | Payout account holder and country | Pay out only to an account in the owner's name |
| Cash withdrawals soon after a payout (FATF, p. 47) | Bank side: cash debits after a platform credit | Bank rule on platform credits followed by cash |
| Virtual assets only, or privacy coins (FATF, p. 47; EBA 17.4) | Payment method; wallet addresses | Wallet screening; higher risk rating |
| Many charges from one card, or one donor using several cards (FATF, p. 49) | Card per backer | Limit per card and per backer |
| More paid in than needed, then a refund request (EBA 17.6) | Overpayments and refund requests | Refund only to the paying account |
| One device or IP address behind several accounts (FATF, p. 48; EBA 17.5) | Device and IP data | One account per person |
The EBA lists two old controls among the factors that lower risk. One is a low value limit on the size and number of payments; the other is a fixed or longer holding period for investments (Guideline 17.5). On a donation campaign, where nothing is held as an investment, a minimum period between collection and payout plays the second part. A platform can set both before its first campaign. The EBA's enhanced measures add repayments and redemptions through the account first used, or one in the customer's own name (17.16).
The bank that holds the platform's or the owner's account sees the other half. In a US donation flow, the bank or money services business is the party with BSA duties (FATF, p. 60). The FATF's signals there are crowdfunding deposits followed by speedy structured cash withdrawals, and money passed on to unrelated third parties. Write each row as a monitoring rule with a named threshold and an owner.
In complead's rules engine, a team sets these thresholds without code. Before a rule goes live, the engine replays it on 30, 60 or 90 days of real history, and the team sees how many alerts it would have produced, how many of those were cleared and how many were true positives. Each rule edit gets a new version that records its author, its date and the reason for it.
Back to TruCrowd. Rule 301's minimum background check covers the issuer's officers, directors and 20 percent owners. The SEC alleged that Shumake's role was kept from the public, so only a check on whoever in fact directed the issuers could have reached the conviction. After launch, the chief executive allegedly left the red flags unaddressed. For an offering that points to fraud, the rule leaves one course: remove it, cancel it and direct the return of investors' money.
Where the facts come from. The case, rules and figures on this page were read at source on 7 November 2026: the SEC release of 20 September 2021, 17 CFR 227, the SEC's Regulation Crowdfunding statistics, the Federal Register records of 2016, 2025 and 2026, ECSPR, the AMLR, ESMA Q&A 2747, EBA Guideline 17, the FATF's 2023 crowdfunding report, Canada's PCMLTFR, Norway's AML Act and the FCA's guidance. Fact checked by Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay; reviewed on 8 November 2026.
