TORCH Report: Envestio
It's finally here: How does Envestio score on the TORCH standards?
Unfamiliar with project TORCH? You can start by reading the intro.
This is my first evaluation of a direct crowdfunding platform, so the criteria is slightly different from what you’ve seen on the Mintos TORCH Report and Lenndy TORCH Report. This one also includes a new section – Information Security.
To maintain the integrity of a surprise inspection, the report was not sent to Envestio prior to publishing. However, Envestio is welcome to post a reply or send me an official comment.
As always, readers are encouraged to share this report and echo their concerns to the platform. Our goal is not to shame platforms, but to push them to improve. Reevaluations will occur over time.
Table of Contents
- Transparency: Platform
- Transparency: Loans
- Transparency : Performance
- Transparency: Safety
- Risk: Operations
- Risk: Information Security
- Concluding Remarks
Pass with remarks – there is room for improvement
Fail – needs to be amended
All screenshots were taken on the reviewed platform, unless otherwise stated. Red notes and markings have been added by me. Click to enlarge any screenshot.
The details of Envestio’s main legal entity are displayed in the website footer.
Some investors have raised concern about the fact that the address is in an industrial complex. Envestio explained that their operation is composed of three legal entities, one of which is legally registered to this address, and that part of the team actually works there. See this post by blogger Miguel Llamazares of The Coin Magnet.
While the details displayed on the platform are technically accurate, I would expect Envestio to add the address of their main office in Riga, where they meet investors (e.g. Jørgen Wolf of Financially Free).
Envestio’s executives are listed on the Team page with their LinkedIn profiles.
Envestio fails this topic for several reasons:
1. Time in business: The About page states Envestio’s year of incorporation as a private investment fund, 2014, but does not mention the time they launched the public platform, December 2017. This makes the platform look much older than it actually is.
2. Investor count: Envestio’s Homepage shows the number of “registered investors”. This is a false terminology: The act of signing up to a website does not make one an “investor” but a “user”. Honestly, no one cares how many users have signed up to a website. Instead, Envestio should show the current number of active investors – people who have money invested on the platform right now.
3. Portfolio growth: The top of Envestio’s homepage highlights the cumulative loan volume. To see the current portfolio size and monthly figures, users need to scroll all the way down to this chart:
It’s excellent that the chart includes both “made investments” and “exited investments”, which allows the viewer to extrapolate the current portfolio size (the gap between the two lines). However, the chart is too basic. Instead of a dynamic chart which updates automatically and allows users to hover their mouse to see exact numbers, Envestio uses a static image which needs to be updated manually (and is often outdated), which only conveys the general idea that “we are growing” with not enough concrete numbers.
Worse, Envestio is missing a chart for monthly loan volume – a TORCH requirement.
Envestio’s annual statements are not published on the platform.
Not addressed on the platform. This can be included in annual statements.
Each project page shows the borrower’s legal entity, registration country and year of foundation, and provides an overview of its operations.
Envestio provides a general summary of the loan purpose and how the borrower plans to repay it. Example from project Production of Sawn Timber – part 7: “Funds […] will be used for the purchase of raw round timber, financing the production process, and covering the time gap before the final payment is received from the customers”.
While these descriptions pass the minimum TORCH requirement, they also leave a lot to be desired. In this example, why does the borrower need €500k, specifically? Why did they need €250k in the previous funding round? How has the company progressed since their previous loan? What is their long-term business plan, and how are they planning to reduce their dependency on future loans?
To make matters worse, project descriptions seem copy-pasted from one tier to the next. The above-mentioned loan was listed in September 2019, but includes an overview of the timber market in the first half of 2018. Since then the market has seen major shifts, which are not covered in the outdated summary. This can be seen in some other projects as well.
I expect P2B platforms to provide investors with updates from funded projects. This is particularly relevant for real estate development projects, but also for business loans which are meant to advance the company’s operations.
A perfect example for the importance of these updates can be seen in Baltic Forest loans on Crowdestate (you need to be logged in). The borrower’s updates have revealed not only the positive progress of the timber processing workshop, but also the issues in the lumber market. This allowed some investors to foresee Baltic Forest’s cash-flow crisis, which eventually led the company to apply for reorganisational proceedings.
Envestio and its borrowers do not provide project updates. If you were to invest in Baltic Forest loans through Envestio, you would have no way of knowing that the borrower was in trouble until the loan defaulted.
In many of Envestio’s loans, no concrete information is provided about the exact assets used as collateral (e.g. equipment, land, buildings), nor the shareholders’ assets used to cover personal guarantees. Even the LTV isn’t mentioned. Other platforms typically offer photos and third-party valuations of the collateral, sometimes even scans of signed personal guarantees.
Public access to project info
For optimal transparency, direct P2B platforms should keep project information open to any website visitor. This allows potential investors, experts and regulators to assess investment opportunities, without signing up to the platform.
Every project on Envestio has two web pages: The first offers a textual overview, and the second lists the payment schedule and other technicalities. The overview page (example) is accessible publicly. However, some time after the successful funding of the project, Enevstio removes the text (example). This is a bad practice that should be abolished.
The payment schedule page is only accessible to logged-in users (example). These pages should be made public.
I also recommend merging the two page types into one (the information can be sorted into tabs: Summary, Description, Collateral, Schedule etc.).
Full loan book status
Envestio does not display the ratio of current/late/default loans in their loan book. This information should be available on the platform even if so far all loans were repaid on time.
I recommend showing this data using three dynamic pie charts:
– Entire portfolio: The ratio of outstanding loans, repaid loans, and bad debts.
– Outstanding portfolio: The ratio of newly-issued, repaying as usual, late, and default loans.
– Finished loans: The ratio of loans repaid on time, repaid early, repaid late, collected debt, and bad debt.
A similar display can be utilised in user portfolios as well.
Specific loan status
Every loan on the Projects page is listed as either “funded” or “completed” (repaid), and every loan under “My investments” is listed as either “active” or “paid”. However, I suspect that Envestio isn’t technically prepared to show a “late” status.
I’m basing this suspicion on the knowledge that the Projects page is updated manually rather than automatically. If a loan does run late, Envestio will be tempted to try and solve the situation before they perform a manual status update. Lending platforms must be set up in a way that automatically shows the status as “late” from the moment a payment date is skipped.
Full loan book returns
Envestio ‘s homepage highlights their average historic interest rate (18.3%), and advertises “up to 22% returns”, but does not specify the actual historic returns (XIRR). As long as every loan pays on time, the return should be similar to the average interest rate. However, if a loan runs late or defaults, it will only be reflected in returns. That’s why it’s important to include this figure.
Investor portfolio status and distribution
Envestio does not provide investors a direct way of seeing the distribution of loan statuses within their own portfolio, nor the distribution among different projects / borrowers. This means that when a new loan is published, investors need to manually go over their entire list of active loans to see if they already have money invested in this borrower, making diversification a hassle.
Investor portfolio returns
Not shown anywhere on the platform.
Stating the risk: platform-level
Envestio has a whole page dedicated to investment risks, as well as an FAQ article which includes the scary L-word: “In the worst case, the entire investment, including principal and interest amount may be lost.”
This is exactly what I expect to see on every platform. Contrary to what other platforms may think, a bold statement of risk actually increases my feeling of safety on a platform, because it shows that Envestio is conscious of the risks.
However… One topic is missing from the list of risks: information security. Envestio should inform investors of risks related to hacker attacks, and provide a short summary of the means used to mitigate them.
Stating the risk: loan-level
Sadly, the transparent attitude towards risk isn’t reflected in project pages. Envestio’s project descriptions tend to read more like a sales pitch than an objective analysis.
I would expect those pages to provide insight on the specific risks associated with the borrower (e.g. previous debts or cash shortage), the company’s operations (e.g. equipment malfunction or termination of contracts with clients), the market (e.g. fluctuations in product price) and the collateral (e.g. potential difficulty of liquidating professional equipment).
We can again compare to Crowdestate, where each project page includes a SWOT chart: Strengths, Weaknesses, Opportunities and Threats. This is a much more honest representation.
Envestio does not provide a risk scale for projects. Admittedly, such a scale would not be particularly useful on Envestio, as most projects seem to present a similar level of risk.
Enabling self-assessment of risk
The disregard to specific risks in project descriptions, the lackluster information about the collateral, and failure to state even the LTV, make it impossible for investors to gauge the riskiness of each loan without conducting extensive independent research.
Overview of operations
Envestio is a Peer-to-Business crowdfunding platform operated from the Baltic countries. It started out as a private investment fund, and these roots are still evident in Envestio’s business mentality and modus operandi. Although they now run a crowdfunding website, the company hasn’t transformed into a tech startup: They don’t work in fancy offices and don’t employ an arsenal of developers, designers, support representatives and media consultants.
Rather, Envestio consists of only a few investment professionals working independently, with the technological help of freelancers, to offer investors hand-picked investment opportunities. In many ways this is an excellent model, which contributes to low overhead costs and easy scaling: They only need to pay workers when they have work.
There are also three downsides to this model:
– The lack of technological orientation is evident in the basic platform interface, which sadly affects transparency.
– The company is heavily reliant on each of the three executives. If one of them quits or (God forbid) falls sick, operations may be affected.
– The small-team approach isn’t conducive to growth.
Lending practices and regulation
Envestio specialises in subprime business and real estate development loans. Its main legal entity is registered in Estonia, known for its extreme openness to technological innovation, and where crowdfunding regulation is lax to nonexistent.
As for lending regulation: Envestio’s lending practices are within the norm for Eastern European lenders (no instant credit and no interest rates above 25%), so I don’t foresee regulatory restrictions harming Envestio’s business model in Latvia, Poland, Estonia or other major markets.
Still, I would expect Envestio to at least mention the topic of regulation somewhere on the platform (other than the “Investment Risks” page). As a point of reference, competitor Crowdestor has an entire page dedicated to crowdfunding regulation.
The biggest risk I identify for Envestio is its dependency on a relatively small number of repeat borrowers and large-scale projects. If and when a loan defaults, it will have a bigger impact on Envestio compared to most other platforms, where projects tend to be unrelated to one another. This risk is aggravated by Envestio’s buyback guarantees, covered in depth in the Contingencies section.
In its two years in business, Envestio has maintained a perfect track record: 0 late payments and defaults. Their team deserves praise for their due diligence process.
I do have to mention that such a perfect record can also be seen as suspicious.
As Envestio does not offer a detailed monthly growth chart, I had to manually analyse their project history to prepare the following charts, updated 21/11/19:
We can see a very interesting trend: The monthly number of loans was at its peak around the end of 2018, but the funding volume reached its peak in September 2019, and remains much higher than in 2018. In other words, Envestio is focusing on fewer, larger projects. This can also be seen in the following pie charts:
The currently outstanding portfolio is larger than ever, although most issued loans were already repaid, because the newer loans are larger.
So, is Envestio growing? Should we look at loan number or volume? The answer is: both. Envestio charges borrowers a percentage of the loan value, so higher funding volume means bigger profits. But fewer loans mean higher dependency on each project / borrower. I was less scared of a €200k project defaulting than I am currently scared of a €2m project defaulting, as it will have a greater impact on Envestio.
It’s worth noting that smaller loans also had more tiers, so the numbers might be misleading. I wish it were possible to see the number of unique projects / borrowers in each period without so much manual labour.
As the financial reports are not published on the platform, investors have no way of telling whether Envestio is a profitable business. Normally I would say that we ought to treat the platform as unprofitable, but this page shows that Envestio has had a positive taxable turnover since 2018 Q3. Since outside sources don’t count towards TORCH evaluations, Envestio fails this topic until I can see their annual reports on the platform itself.
Safeguarding of funds
Updated 25/11/19: Changed to “remarks”, see comment at the end.
To protect investor funds against embezzlement or in case of platform bankruptcy, they need to be either insured or separated from the platforms’s own funds.
However, there is no indication that this is an official escrow account.
Most of Envestio’s borrowers are in Latvia, with occasional projects in Poland, Estonia, Czech Republic and Lithuania. Projects include real estate development and business loans from several industriesץ Overall, a nice mixed bug of opportunities, albeit mostly in the Baltics and Eastern Europe.
The risk level of most projects seems similarly high, so Envestio is mostly suitable for the “high-risk, high-reward” part of investor portfolios.
Risk: Information Security
This segment was written in cooperation with InfoSec expert Victor Truica, and focuses on risks related to potential hacker attacks. To understand the terminology you are invited to read my intro to this topic, as well as Victor’s posts.
Envestio’s encryption is graded A by SSL Labs – a good score.
However, they still support TLS versions 1.0 and 1.1, allowing users to connect to the platform using less-secure protocols. Major web browsers intend to remove support for these old protocols in 2020 Q1, and websites are encouraged to do so even sooner. If Envestio doesn’t fix this by January, their SSL Labs score will drop to B, and they will fail this TORCH criterion.
Envestio does not offer 2-factor authentication.
Envestio allows withdrawal to any bank account as long as the name of the recipient matches the name on Envestio. This likely prevents most unauthorised withdrawals, but it is not the most secure method, as some transfers may be accepted by the recipient’s bank even if the recipient’s name does not match the IBAN. Also, if the hacker happens to share the same name as the account holder (unlikely, but not impossible), there is nothing stopping him from withdrawing into his own account.
We strongly recommend that platforms send a confirmation email or SMS to the user before accepting new withdrawal details (or to confirm each withdrawal).
External security assessments
I could not find any mention of external security tests ordered by Envestio, nor any security certificates provided by professional, third-party experts.
Listing data processors and 3rd party vendors
Again, here is a detailed explanation of the above criteria, and why these topics are important for safeguarding platforms, user accounts, and user data.
Depletion of reserves (buyback guarantees / mass withdrawal)
Envestio commits to buy back loans from investors upon request or when the loan defaults, using the company’s own capital. When asked about their volume of reserves, Envestio has provided the following reply:
Unfortunately, this information isn’t available on the platform itself. It also reveals a major flaw in Envestio’s guarantees. The currently active loan volume is €11,2m. 15% of that makes €1,65m. The largest active loan is worth €2,6m. So Envestio’s reserves cannot even cover a single large default, not to mention a series of defaults or a mass withdrawal event.
I will be very clear here: Envestio must make the reserve fund totally transparent. The current value of the fund must be listed on the platform (take an example from Crowdestor). This money must be visible in annual statements. And Envestio must define clear boundaries to the use of the reserves.
Until then Envestio is putting itself is serious risk of a cash-flow crisis, as investors will expect them to honour buyback guarantees all the way to the bitter end.
This scenario is covered in Envestio’s Risk statement: “Operational risks are directly related to the business of Envestio as a company, when due to certain reasons the unlikely event of liquidation of the company would take place. In case this event is taking place, certain operational and legal actions aimed at preservation of Envestio’s participants’ investments, which should not suffer from this occurrence.
While it’s good to see that Envestio is aware of the risk and notifies investors about it, I expect a more detailed explanation of the measures put in place to protect investors. Is the transaction data backed up and kept by a third party? Who would be in charge of collecting and distributing payments?
I recommend reading NEO Finance’s business continuity plan – the most detailed and level-headed plan I have seen on any loan financing platform for dealing with difficult times.
Envestio does not provide a classic provision fund, where a small percentage is taken from investors’ capital to create a separate fund. Instead they offer buyback guarantees using Envestio’s own capital, which is very comfortable for investors, but may put the platform itself at risk, as explained above.
Sadly, Envestio has failed the majority of the TORCH criteria. In their defence, I believe that most transparency-related issues are the result of neglect rather than intentional concealment. Envestio has not fully adapted to the fact that it is no longer a private investment fund, but a public crowdfunding platform, where higher standards of transparency are expected.
The bare-boned website is missing detailed information and statistics, and is not secure enough. The buyback guarantees are an excellent selling point for Envestio, but may lead to its collapse. Remember: All investors combined can withstand a loss of €2m, but Envestio itself probably can’t.
With plenty of investors rushing to fund every new project, it’s easy for Envestio to disregard my criticism. However, everything will change at the first sign of trouble: a hacker attack, a large default, an economic downturn causing a series of defaults, a scandal involving a borrower, or some other panic-inducing event leading to mass withdrawals – all of these can put Envestio in a difficult spot.
Envestio’s great track record still makes it a good addition to investors portfolios – but the level of exposure needs to be adjusted to the risk. I only hope they fix their shortcomings before they are tested by fire.
I am not a financial expert nor an investment professional. My observations are based on knowledge gathered online, as well as my thoughts and personal experience as an investor.
While I put a lot of effort in research and fact-checking, it is possible that some errors or inaccuracies have escaped my notice. Readers are encourage to point out any mistake or missing piece of information.