Due Diligence Kit
Crowdsphere | LendCap | Fundsmart
Information for Financial Advice Providers, compliance officers and commercial partners
- Document status: Public due diligence information
- Version: 1.0
- Prepared: September 2026
- Review: At least annually and following any material change
Purpose
This kit provides the information normally required for an initial supplier, referral or outsourcing due diligence review. It is intended to be read together with the relevant agreement, privacy information and any service-specific disclosure.
Contents
1. Company information
2. Group structure and services
3. Governance and management
4. Regulation and compliance
5. Capacity and expertise
6. Risk management
7. Privacy, conflicts and complaints
8. Information for FAP due diligence
A. Cyber security due diligence
1. Company information
- Group: Crowdsphere Holdings Limited (Group)
- Holding structure: Crowdsphere Limited and Fundsmart Limited are part of the same ownership group. LendCap is a trading name of Crowdsphere Limited. Crowdsphere Holdings Limited is the ultimate parent company
- Primary regulated entity: Crowdsphere Limited
- Company number: 5021681
- New Zealand Business: 9429041127551 Number
- Financial Service: FSP360186 Provider number
- Incorporation date: 2 April 2014
- Operational office: Suite 1, Soho Works, 142 Hurstmere Road, Takapuna, Auckland 0622
- Registered office: Level 2, City Chambers, 142 Featherston Street, Wellington 6011
- Postal address: PO Box 105 926, Auckland 1143
- Websites: crowdsphere.co.nz | lendcap.co.nz | fundsmart.co.nz
- Industry: Financial services, capital raising, peer-to-peer lending and business finance
Financial stability
The group is privately owned. Crowdsphere Limited prepares annual financial statements which are audited. Current company and shareholding information can be verified through the New Zealand Companies Office and supporting financial information can be made available where reasonably required for a material commercial engagement.
Business continuity
The group maintains business continuity, backup, data protection, privacy, disaster recovery and continuity procedures. Core business information is held in cloud based systems, including Microsoft services and other approved providers, enabling operations to continue or be restored if a particular device or office is unavailable.
2. Group structure and services
- Entity / brand: Principal service Description
- Crowdsphere: Equity Licensed equity crowdfunding platform connecting
- Limited: crowdfunding New Zealand businesses seeking capital with investors. The platform undertakes offer review, due diligence and disclosure processes before opportunities are made available.
- LendCap: Peer to peer Trading name of Crowdsphere Limited. LendCap
- lending: connects lenders with property backed lending opportunities. Opportunities are assessed before listing and are supported by registered property security. Investment returns are not guaranteed.
- Fundsmart Limited: Business finance Business finance and funding facilitation for New Zealand businesses, including cashflow, asset and property backed business finance. The current group operating model is focused on business and non consumer finance rather than Riverhorse mortgage lead generation.
Crowdsphere services
(*) Pre campaign readiness and offer preparation support. (*) Due diligence and pitch quality review. (*) Campaign hosting and investor communications. (*) Access to investor networks and capital markets experience. (*) Ongoing reporting and post campaign support as applicable.
LendCap services
(*) Property backed peer to peer lending opportunities. (*) Loan assessment and risk information for lenders. (*) Service disclosure and opportunity information. (*) Loan administration, interest processing and ongoing reporting. (*) Default management and security enforcement where required.
Fundsmart services
(*) Business funding enquiry assessment and qualification. (*) Referral or allocation to appropriate business finance providers. (*) Cashflow, asset and property backed business funding pathways.
(*) Business finance customer communication and application support.
3. Governance and management
Governance is provided through the boards and management of the relevant group companies. Crowdsphere Limited also benefits from the involvement of Armillary Private Capital in the management and operation of the Crowdsphere and LendCap platforms.
- Governance area: Approach
- Board oversight: Strategic direction, regulatory oversight, risk, financial performance and material business decisions.
- Day to day: General management, operations, business development and
- management: implementation.
- Finance: Financial control, reporting, budgeting and audit coordination.
- Compliance assurance: Internal monitoring, policy review, complaints oversight, regulatory reporting and external professional support where required.
- Armillary Private: Capital markets, opportunity assessment, due diligence, investor and
- Capital: lender experience supporting the regulated platform activities.
Compliance assurance
The group uses a combination of internal controls, management oversight, documented procedures, external advisers and regulatory reporting. The level of assurance applied reflects the service, the licence requirements applying to the relevant legal entity and the risk of the activity.
4. Regulation and compliance
Crowdsphere Limited
Crowdsphere Limited is registered as FSP360186. It holds active Financial Markets Authority licences for crowdfunding services and peer-to-peer lending services. Crowdsphere obtained its crowdfunding licence in November 2014 and its peer-to-peer lending licence in July 2020. (*) Directors and senior managers are required to remain fit and proper. (*) The licensed entity must remain capable of effectively performing the licensed services. (*) Borrower or issuer checks and relevant risk assessments are undertaken in accordance with the applicable service requirements. (*) Material checks, risks and disclosures are communicated to investors or lenders through the applicable service documentation. (*) Fair dealing, conflicts, complaints, reporting and record keeping controls are maintained. (*) Crowdsphere Limited is a member of Financial Services Complaints Limited for applicable disputes.
Fundsmart and financial advice
Fundsmart is a separate legal entity within the group. Where any Fundsmart activity constitutes regulated financial advice, that activity must only be undertaken under the appropriate Financial Advice Provider permissions and disclosures applying at the time. The live Financial Service Providers Register should be checked before a FAP relies on any regulatory status.
5. Capacity and expertise
The group combines internal management, specialist external support and the capital markets experience available through Armillary Private Capital. The operating model provides access to the following capabilities: (*) Capital markets and investment banking experience. (*) Business and property finance assessment. (*) Financial analysis and due diligence. (*) Legal and regulatory interpretation through specialist advisers where required. (*) Investor and lender communications. (*) Loan administration and security enforcement processes. (*) Technology, data and platform management. (*) Marketing and business communications.
Capacity to undertake work
The group is structured to use permanent management and operational resources together with specialist professional advisers and technology providers. This allows resources to be matched to the volume and complexity of capital raising, lending, business finance and compliance work.
6. Risk management
- Risk area: Control
- Information: Third-party IT support is used together with Microsoft and cloud-based
- technology: business systems.
- Device security: PC data is encrypted using BitLocker and endpoint protection is maintained.
- Microsoft 365: Microsoft 365 accounts use multi-factor authentication. Data is protected in transit and at rest within the Microsoft environment.
- Endpoint protection: Windows Defender and Microsoft Defender for Office 365 are used for endpoint and email protection.
- Updates: Computers and applications are maintained through managed update tools.
- Risk area: Control
- Backup: Microsoft 365 data is backed up using SkyKick, with multiple backup points each day.
- Business continuity: Cloud-based systems and documented recovery procedures allow replacement devices and alternative working locations to be used.
- Insurance: Current insurance information can be supplied during contractual due diligence where relevant. Professional indemnity insurance is not represented in this kit as a standard FAP licence condition.
7. Privacy, conflicts and complaints
Privacy and data protection
The group handles personal and financial information in accordance with the Privacy Act 2020 and the privacy notices applying to each service. Access is restricted to authorised people and approved service providers for legitimate business purposes. (*) Personal and financial information is treated as confidential. (*) Access to operational information is limited according to role and need. (*) Information is retained in accordance with legal, regulatory and operational requirements. (*) Individuals may request access to, and correction of, personal information held about them. (*) Privacy policies and collection notices are maintained on the relevant websites.
Conflicts of interest
(*) Material interests and relationships are identified and disclosed where required. (*) Fees and commercial arrangements are disclosed where applicable. (*) Opportunities are assessed on their merits. (*) Potential conflicts are reviewed and recorded. (*) A documented conflicts register is maintained for relevant activities.
Complaints and dispute resolution
Complaints are handled under documented procedures designed to ensure fair and timely investigation and resolution. Crowdsphere Limited is a member of Financial Services Complaints Limited. Where a complaint relates to another FAP's advice, the matter is referred to that FAP for handling under its regulated complaints process.
Client information
Client, borrower, investor and lender information is held securely, treated as confidential, made available only to authorised people and retained for the period required by the relevant legal, regulatory and operational obligations.
8. Information for FAP due diligence
This section helps a FAP compliance officer use this kit as part of the FAP's own supplier or referral due diligence. It is not intended to restate the financial advice legislation.
FMA position on key outsourcing
Where a FAP relies on an external supplier to meet a FAP licence obligation, the FMA expects robust background checks, formal written contracts, performance monitoring, rights to act if performance is inadequate, access to relevant records and regular review. The FAP remains responsible for outsourced functions. Ordinary referral arrangements are not generally treated as key outsourcing arrangements in the FMA self assessment tool.
- Due diligence area: Group response
- Legal entity and ownership: Company identity and group structure are set out in this kit. Current Companies Office information can be supplied or independently checked.
- Regulatory status: Crowdsphere Limited FSP360186. FMA crowdfunding and peer-to- peer lending licences can be checked on the FMA register. Any separate Fundsmart FSP or FAP status should be checked on the live FSPR if relevant.
- Capability: Operating history, management, Armillary support, due diligence, lending and technology capabilities are summarised in this kit.
- Privacy and confidentiality: Privacy Act controls, restricted access and relevant website privacy notices apply.
- Complaints: Documented complaint handling and external dispute resolution arrangements apply where required.
- Business continuity and: Business continuity, cloud infrastructure, MFA, encryption,
- cyber: endpoint protection, managed updates and backups are summarised here and in Appendix A.
- Conflicts: Material interests, fees and conflicts are subject to disclosure and register controls.
- Records: Records required for the group service are retained. If a FAP relies on group systems to hold a regulated advice record, the retention and access period should be expressly agreed in the service contract.
- Due diligence area: Group response
- Contract and oversight: Material supplier or outsourcing arrangements should be governed by written terms defining service scope, responsibilities, monitoring, escalation, record access and termination rights.
- Ongoing review: The group will update this public due diligence information following material changes and at least annually. A FAP should apply its own risk based supplier review cycle.
Supporting information available on request
(*) Current Companies Office extract. (*) Current licence or registration evidence relevant to the service. (*) Service or referral agreement. (*) Privacy and complaints policies. (*) Business continuity and cyber security information proportionate to the engagement. (*) Financial or audited information where reasonably required for a material engagement. (*) Insurance information where relevant and available.
Appendix A. Cyber security due diligence
The following is a high level description of the controls currently used to protect the group's business systems and information. Detailed technical information is provided only where proportionate to the service and subject to appropriate confidentiality controls.
- Control: Current approach
- IT support: External specialist IT support is used for core business technology and endpoint management.
- Cloud services: Microsoft 365 and approved cloud infrastructure are used for business information and platform services.
- Encryption: PC data is encrypted using BitLocker. Microsoft 365 provides encryption in transit and at rest.
- Authentication: Multi factor authentication is used for Microsoft 365 accounts.
- Endpoint and email: Windows Defender and Microsoft Defender for Office 365 are used. protection
- Patching: Managed tools are used to keep operating systems and applications updated.
- Control: Current approach
- Backup and recovery: Microsoft 365 data is backed up through SkyKick with multiple backup points each day. Recovery can be performed to replacement devices or alternative locations.
- Access: Client and investor information is limited to authorised personnel and providers with an operational need.
- Incident response: Technology and privacy incidents are escalated through management and the relevant service providers. Regulatory or client notifications are made where legally required.
- Review: Security controls and provider arrangements are reviewed when systems or material risks change.
FMA reference
For FAP supplier due diligence, the principal FMA reference is the Key Outsourcing Arrangements self assessment tool. It states that a FAP remains responsible for functions it outsources and should undertake robust background checks, contractual controls and regular supplier reviews for key outsourced functions. Relevant public sources: Financial Markets Authority licensed providers register, Financial Service Providers Register, Companies Office, Privacy Commissioner and Financial Services Complaints Limited.