Romania
All regulators in Romania are national. For anti-money laundering, the National Bank of Romania supervises banks and payment firms, the Financial Supervisory Authority covers insurers and investment firms, and the National Gambling Office covers gambling operators. Reports go to the ONPCSB. Remote onboarding is allowed through eIDAS electronic identity, trust services or ADR-endorsed video identification; telecom, health, travel and public services follow their own identity rules.
Compliance guides by industry
More countries in this region
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
Supervision is split by sector under Law 129/2019. The National Bank of Romania supervises banks, payment institutions and e-money institutions, the Financial Supervisory Authority supervises insurers and investment firms, and the National Gambling Office supervises gambling operators. Crypto-asset service providers fall to the ASF or the BNR when those authorities already regulate them. Reports go to the ONPCSB, Romania's financial intelligence unit.
Yes. The AML law accepts eIDAS electronic identification, trust services and remote processes recognised by the Authority for the Digitalisation of Romania. Providers registered in Romania need an ADR endorsement before running video identification, and remote onboarding without these safeguards is a higher-risk factor. Some new electronic identity cards do not print the address, so firms read it from the chip with the holder's PIN.
Suspicious transactions are reported to the ONPCSB immediately and before they are carried out. The transaction is then held for 24 hours, and the ONPCSB may suspend it for up to 48 hours. Cash transactions of at least the lei equivalent of EUR 10,000, including linked operations, are reported within three working days. Banks also report external transfers of EUR 10,000 or more.
Usually, yes. Under Law 190/2018, biometric data used for automated decision-making or profiling, such as an automated face match, needs explicit consent or an express legal provision with safeguards. ADR video identification norms also require express consent to image capture, stored with the recording. Large-scale biometric identification of patients needs a prior impact assessment, and telecom operators usually offer a non-biometric alternative.
Telecom operators, healthcare providers, online shops and marketplaces, most travel businesses and public bodies are not reporting entities, and non-life insurance such as motor or property cover is outside due diligence rules. Exceptions include traders handling cash of EUR 10,000 or more and hotels buying foreign currency from guests. Identity duties come from sector rules instead, such as porting checks, health cards and marketplace trader verification.