Crypto & Virtual Assets Compliance in Moldova

Moldova is closed to crypto-asset service providers until 17 March 2027 and will then open under a licensing regime closely aligned with MiCA. Crypto services are delivered online, so remote onboarding design is the main product question for any entrant.

The CNPF authorises and supervises crypto-asset service providers and most token issuers; the National Bank of Moldova (NBM) covers e-money tokens issued by banks and e-money institutions; the Office for Prevention and Fight against Money Laundering (SPCSB) is the financial intelligence unit and AML lead.

The biggest obstacle is legal sequencing: the licensing law starts in March 2027, but the matching anti-money laundering law is still a draft and the CNPF's secondary rules are not yet published. Entrants should plan for authorisation from spring 2027 and track both closely.

1. Who regulates this sector

All authorities are national. Law No. 180 of 24 August 2026 on the crypto-asset market (art. 85) names the CNPF and the NBM as competent authorities and divides their remits by activity.

2. Licensing and authorisation

Today: prohibition

Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing, art. 4(1¹), prohibits providing virtual asset services in Moldova, including as an ancillary activity. Covered services are exchange between virtual assets and fiat or other virtual assets, transfer, safekeeping or administration, and services linked to an issuer's offer or sale (art. 3).

Banks and payment firms may not open accounts for non-residents to deal with foreign virtual asset service providers, hold accounts for or at foreign providers, or carry out occasional transactions with them. Resident customers may transact with providers authorised abroad up to the equivalent of 50,000 lei a month in total (art. 5(4¹)-(4⁴)), through special accounts with enhanced due diligence and transaction-tracing tools (art. 8(3)(q), 8(5¹)).

Foreign platforms and Moldovan customers

The law tolerates residents using foreign authorised platforms through this capped bank channel while banning services on Moldovan territory. MONEYVAL describes the regime as a ban "except when provided by foreign VASPs and to local clients" but also records that the authorities interpret the ban as covering services provided to persons located in Moldova, supported by case law (follow-up reports of 2024 and June 2025). The statute does not define when a foreign provider is providing services on Moldovan territory. A foreign platform that targets people in Moldova should assume it is within the ban; from 17 March 2027 the reverse-solicitation rule (art. 55) sets the test.

From 17 March 2027: authorisation under Law 180/2026

[Adopted, applies 17 Mar 2027] Law 180/2026 was published on 17 September 2026 and enters into force six months later (art. 104(1)). It follows MiCA's structure: white papers, asset-referenced and e-money tokens, CASP authorisation and market abuse. Non-fungible crypto-assets and crypto-assets that qualify as financial instruments, deposits or insurance products are out of scope (art. 2(3)-(4)).

Who may provide services

A Moldovan limited liability or joint stock company authorised by the CNPF, with its registered office and effective management in Moldova and at least one director domiciled or resident there (art. 53(1)-(2)). Investment firms, market operators, fund managers and the central securities depository may instead notify the CNPF 40 working days in advance for equivalent services; banks and e-money institutions may notify only custody and transfer of tokens they issue themselves (art. 54).

Minimum capital

EUR 50,000 for execution, placing, transfer, reception and transmission, advice and portfolio management; EUR 125,000 adding custody and exchange; EUR 150,000 for a trading platform (Annex 4, lei equivalent).

Timeline

Acknowledgement within 5 working days; completeness check within 25 working days; decision within 40 working days of a complete file (art. 57). The SPCSB has 30 working days for its AML opinion.

Application content

Know-your-customer, due diligence and transfer-traceability policies, including originator and beneficiary information (art. 56(2)(i)), and the ML/TF risk framework (art. 56(2)(j)).

A payment institution authorised as a CASP may offer only custody and transfer (art. 53(6)). Firms intending to operate must file within six months of entry into force (art. 106(1)), but filing confers no right to operate: until authorised they may not attract clients, transact, exchange, hold in custody, transfer or promote crypto services, and earlier activity in breach of the ban is not legalised (art. 106). Until EU accession, authorisations have effect only in Moldova (art. 105(1)). Foreign firms may serve a Moldovan customer only on that customer's exclusive initiative; any solicitation in Moldova, by any channel, defeats the exemption (art. 55).

3. AML, KYC and customer due diligence

Law 308/2017 does not list crypto-asset service providers among its reporting entities (art. 4(1)); it bans them, and Law 180/2026 does not amend it. Both are organic laws; under Law No. 100/2017 on normative acts, the later act prevails in a conflict between acts of equal force and a special rule prevails over a general one (arts. 5(3), 7(3)), which supports reading Law 180 as permitting authorised activity from 17 March 2027, but no authority had published a position as of November 2026. Law 180 requires the Government to propose consequential amendments, and the CNPF, NBM and SPCSB to adopt implementing acts, within six months of publication, by 17 March 2027 (art. 104(4)-(5)). At authorisation the CNPF must check, with the SPCSB, that the applicant has AML procedures (art. 57(6)(e)).

[Proposed, consultation closed 2 Nov 2026] The SPCSB's draft Law on preventing and combating money laundering and terrorist financing would repeal Law 308 and apply from 10 July 2027 (draft art. 124). It lists CASPs as reporting entities (draft art. 4(1)), requires CDD for occasional crypto transactions of EUR 1,000 or more and identification below that (draft art. 19(3)), bans anonymous crypto accounts (draft art. 18) and requires risk measures for transfers to or from self-hosted addresses (draft art. 37).

Until a new law applies, the Law 308 obligations that bind reporting entities are:

• CDD triggers (art. 5(1)): start of a relationship; occasional transactions above 20,000 lei in one operation through payment service providers, or above 200,000 lei in linked operations; suspicion; doubts about earlier data.
• Identification (art. 5(2)(a), 5(3)): identity documents and reliable independent sources; no relationship if CDD cannot be completed.
• Beneficial ownership (art. 5²): more than 25%, or 25% plus one share, directly or indirectly, or control by other means.
• Enhanced due diligence (art. 8): higher-risk situations, including customers not identified in person (unless identified electronically) and new technologies and distribution channels (art. 8(3)(c), (l)).
• Reporting (art. 11): suspicious activity within 24 hours; cash of at least 200,000 lei in a month.
• Records (art. 9): 5 years after the relationship ends.

[In force 13 Aug 2026] Law No. 146/2026 added art. 13¹: AML training and certification at least every three years for the responsible senior manager, the compliance officer and compliance staff.

4. Identity verification and onboarding

Under Law 308, art. 5¹, electronic identification is allowed only for Moldovan citizens, and for resident legal persons whose representatives, founders, administrators and beneficial owners are all citizens. Based on risk, the firm uses one or more of:

• an electronic identification means of sufficient assurance under Law No. 124/2022 on electronic identification and trust services, which sets low, substantial and high levels (art. 5¹ of Law 124);
• live video and audio, or a live photo, with physical-presence checks, recording of the original identity document during the session and capture of the face;
• other electronic means of an accredited qualified trust service provider (art. 5¹(2)).

[Adopted, effective date not yet set] Law No. 144 of 19 June 2025 (art. XII) will extend art. 5¹ electronic identification to EU citizens holding a qualified certificate issued by an EU trust service provider, once the technical conditions in art. XVIII(4) of that law are in place.

Technical requirements are set by each supervisor (art. 5¹(3)). The CNPF's AML Regulation for its current reporting entities (Decision No. 63/1 of 19 December 2023, point 59) applies in-person identification standards to remote customers, with certified copies, document-authenticity safeguards and an independent contact channel, but sets no liveness or video standard; no crypto-specific rule existed as of November 2026. The draft AML law would accept identity documents or e-ID at the substantial or high level under Law 124/2022, without a citizenship limit (draft art. 22(9)).

5. Digital channels: what's different

Bottom line: authorisation and due diligence duties are the same online and offline, but remote identification is limited to Moldovan citizens, which shapes how any crypto app can grow beyond domestic users.

Remote identification is a citizenship test

Art. 5¹(1) of Law 308 turns on nationality, not residence. A foreign resident, or a Moldovan company with one non-citizen owner or director, cannot be onboarded electronically. The live session must capture the original document and the face (art. 5¹(2)(b)); uploaded document images do not meet that description.

Pending change

[Proposed] The draft AML law would replace the citizenship test with e-ID at the substantial or high assurance level, open to any customer with such means (draft art. 22(9)). Separately, [Adopted, effective date not yet set] Law No. 144/2025 will extend electronic identification under art. 5¹ to EU citizens holding a qualified certificate from an EU trust service provider, once the technical conditions in art. XVIII(4) of that law are in place.

Online marketing by foreign platforms

From 17 March 2027, a foreign exchange that advertises to or contacts customers in Moldova through any channel cannot rely on reverse solicitation (art. 55(2)-(3)); the CNPF will define when a firm is soliciting (art. 55(5)) and keeps a public register of non-compliant entities by trade name or website (art. 96).

6. Data protection and biometrics

Law No. 195 of 25 July 2024 on personal data protection, which transposes the EU General Data Protection Regulation, has applied since 23 August 2026 (art. 89(1)). Biometric data processed to uniquely identify a person are a special category, prohibited unless an exception in art. 9(2) applies, such as explicit consent (art. 9). Face matching used to identify a customer falls within this category, so CASPs need a documented art. 9 ground alongside the Law 308 duty to identify, and must keep identification records for five years (Law 308, art. 9).

7. Sector-specific obligations

Custody and transfer services

Transfer services need a written client agreement covering the parties, transfer method, security systems, fees and governing law (art. 75(1)). Custodians must keep client crypto-assets separate from their own holdings on the distributed ledger (art. 68(7)).

Travel Rule and self-hosted wallets

As of November 2026 Moldovan law sets no threshold-based Travel Rule for crypto transfers; Law 180 does not implement the EU regulation on information accompanying transfers of funds and crypto-assets. Applicants must still show how they manage and share originator and beneficiary information (art. 56(2)(i)). The draft AML law refers to future rules on transfer information and adds self-hosted address controls (draft art. 37).

Stablecoins

E-money tokens may be offered to the public only by an issuer that is a credit or e-money institution and has notified a white paper to the NBM, or by others with its written consent (art. 45); asset-referenced tokens need CNPF authorisation, or a credit institution meeting art. 17, plus reserve arrangements (arts. 16-44).

Sanctions and tax

Reporting entities check customers against restrictive measures, block matching funds and inform the State Tax Service immediately and within 24 hours (Law 25/2016, art. 28(1)); a register of sanctioned subjects is published on date.gov.md. The Tax Code contains no crypto-specific provisions or customer reporting duty (as of November 2026).

8. Risk indicators and red flags

The SPCSB's national risk assessment of virtual assets (December 2024) rates Moldova's exposure as High and finds that the ban pushed activity into the informal economy.

Crypto typologies identified for Moldova

• Informal peer-to-peer exchange: trades arranged in encrypted messaging channels with informal escrow.
• Fraud proceeds: scams and computer fraud, the most frequent predicate offences involving virtual assets in 2021-2023.
• Accounts held abroad: residents reaching foreign platforms through bank accounts outside Moldova.
• Privacy coins and mixers: anonymity-enhancing coins, mixers and DeFi protocols used to break the trail.
• Prepaid cards and vouchers: loaded with virtual assets to move value.
• Transnistrian mining: large-scale mining in the Transnistrian region since 2018.
• Sanctions evasion: virtual assets used to bypass restrictive measures.

9. Enforcement and penalties

Providing virtual asset services today is a contravention fined 1,000 to 1,500 conventional units, or 50,000 to 75,000 lei (Contravention Code, arts. 263(9) and 34(1)). Where it yields profit on a large scale it is a crime: 1,350 to 2,350 units (67,500 to 117,500 lei) or community service for individuals, and 2,000 to 4,000 units (100,000 to 200,000 lei) plus an activity ban for companies (Criminal Code, arts. 241(1)(b) and 64). MONEYVAL reported 17 sanctioned cases of unlawful virtual asset services since 2024, about EUR 42,000 in total, and kept Moldova at "partially compliant" on virtual assets (June 2025).

From 17 March 2027, unauthorised activity is punishable under the Criminal Code (Law 180, art. 106(4)). Administrative fines are capped at the higher of a fixed amount or a turnover share, or a multiple of profits gained or losses avoided (art. 97(9), (13)):

Fines convert to lei at the NBM rate. The CNPF may also suspend or withdraw an authorisation (art. 97(11)), suspend managers (art. 97(12)) and impose a ten-year management ban for repeated market abuse (art. 97(13)). On 5 August 2026 the police detained a suspect accused of converting phone-scam proceeds into crypto-assets.

10. Recent changes and what to watch

• 26 Oct 2026: [Proposed, consultation closed 2 Nov 2026] SPCSB draft AML law: CASPs become reporting entities and Law 308 is repealed from 10 July 2027; a companion draft sets maximum AML fines for credit and financial institutions (a category that includes CASPs in the draft AML law) of at least EUR 10 million or 10% of turnover.
• 21 Oct 2026: [Drafting started] The CNPF began drafting rules on CASP authorisation, notification, fit and proper assessment, qualifying holdings and white papers.
• 17 Sep 2026: [Adopted, applies 17 Mar 2027] Law 180/2026 published; implementing acts due by 17 March 2027.
• 23 Aug 2026: [In force] Law 195/2024 on personal data protection applies.
• 13 Aug 2026: [In force] Law 146/2026 requires AML certification every three years.
• 9 Jul 2026: [In force] National AML programme 2026-2030 (Parliament Decision No. 140, adopted 9 July 2026, published 16 July 2026) sets risk-based supervision of virtual asset service providers by the NBM, CNPF and SPCSB as an objective.
• On EU accession: [Adopted, effective on accession] Law 180 becomes the implementing law for the directly applicable MiCA, and proposals for EU cross-border mechanisms are due within six months (Law 180, arts. 104(3), 105(4)).

11. What this means for identity verification

• Route by citizenship today, plan for assurance levels tomorrow. Law 308 limits remote identification to citizens; the draft AML law would key it to substantial or high e-ID instead.
• Use live capture with liveness. Live transmission, presence checks, recording of the original document and face capture.
• Accept national e-ID and qualified trust services. Check egov.md for the current availability of state services.
• Verify business ownership. Apply the 25% plus one share test.
• Capture transfer counterparty data, including for self-hosted addresses.
• Plan retention and legal basis together. Five-year records and an art. 9 ground under Law 195/2024 for biometrics.