eCommerce & Marketplaces Compliance in Romania

The Romanian online retail market is open: there is no licence for e-commerce as such, and Romanian and EU businesses can sell into it freely, subject to sector rules for regulated goods. The obligations come from consumer law, the EU Digital Services Act and tax transparency rules rather than from anti-money laundering law.

Three authorities matter most. The National Authority for Consumer Protection (ANPC) enforces consumer rights and online information duties; the National Authority for Management and Regulation in Communications (ANCOM) is the Digital Services Coordinator for platforms; and the Authority for the Digitalisation of Romania (ADR) supervises the electronic commerce law. The biggest practical burden for a new marketplace is trader verification: collecting, checking and retaining identity, register and payment data for every seller before it goes live.

1. Who regulates this sector

Romania is a unitary state, so all supervision is national. EU regulations apply directly and are enforced by the authorities named in Romanian implementing law.

Sector authorities, such as the customs authority, also act against illegal online offers in their fields through ANCOM's e-commerce task force (first met December 2025).

2. Licensing and authorisation

There is no e-commerce licence. Under Law no. 365/2002 on electronic commerce (republished in Official Gazette Part I no. 959 of 29 November 2006), an online seller is an information society service provider and must give users and authorities free, direct and permanent access to its name, address, contact details, trade register number, tax code, any supervising authority and price information (art. 5). Breaches are fined 1,000 to 100,000 lei (art. 22, as amended by Law 50/2024 from 18 April 2024), with ADR as the competent authority (art. 17).

Notification to ANCOM

Law no. 50/2024 on measures to apply the Digital Services Act (Official Gazette Part I no. 232 of 19 March 2024) requires intermediary service providers established in Romania, or whose legal representative is in Romania, to notify ANCOM within 45 days of starting to provide services, with identification and contact data and any later changes (art. 5). This covers hosting services, including online marketplaces; it is a declaration, not an authorisation. Failure to notify is fined 5,000 to 30,000 lei (art. 33).

Regulated goods

Products such as tobacco, alcohol and medicines keep their own sector authorisations, and the online channel does not replace them. ANPC Order no. 225/2023 requires online sellers to display the series and number of every authorisation, permit or licence their activity requires, and the issuer (arts. 1 and 2).

3. Identity framework (AML rules do not apply)

Online retailers and marketplaces are not, as such, reporting entities under Law no. 129/2019 on preventing and combating money laundering and terrorist financing (consolidated text of 19 December 2025). The only route into scope is cash: professionals that trade in goods are reporting entities "only to the extent" they carry out cash transactions of at least the lei equivalent of EUR 10,000, in one operation or several linked ones (art. 5(1)(i)), and must then apply customer due diligence to those occasional cash transactions (art. 13(1) lit. c). Card, transfer and wallet payments do not trigger it. Payment processing for the shop is regulated on the payment provider's side.

Where a seller does fall in scope, ONPCSB supervises it as a reporting entity not supervised by the central bank, the Financial Supervisory Authority or the gambling regulator (art. 26(1)(d)), and ANAF checks cash transaction reporting (art. 26(1)(b)). From 10 July 2027 the EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) caps cash payments for goods and services at EUR 10,000 across the EU (art. 80) [Adopted, applies 10 Jul 2027].

Identity duties for the sector come instead from three other frameworks, set out in section 4:

Trader traceability

Digital Services Act art. 30: marketplaces identify and check business sellers before they can sell.

Tax transparency

Fiscal Procedure Code art. 291^5 (DAC7): platforms collect and report seller tax data.

Age-restricted goods

Law 349/2002, Law 201/2016 and Law 61/1991: under-18 sales bans, ID checks and delivery limits.

Sanctions screening is a general obligation: EU restrictive measures apply directly and Government Emergency Ordinance no. 202/2008 implements them nationally.

4. Identity verification and onboarding

Verifying business sellers on marketplaces

Article 30 of the Digital Services Act (Regulation (EU) 2022/2065) applies to online platforms that allow consumers to conclude distance contracts with traders. Before a trader can offer products to consumers in the EU, the platform must obtain: name, address, telephone and email; a copy of the trader's identification document or an electronic identification under eIDAS; payment account details; the trade register and registration number where the trader is registered; and a self-certification that it offers only compliant products (art. 30(1)). The platform must make best efforts to assess whether that information is reliable and complete, using freely accessible official databases or supporting documents from reliable sources (art. 30(2)); traders remain liable for accuracy. If it has reason to believe data are inaccurate or out of date it must request correction and, failing that, suspend the trader (art. 30(3)). Micro and small platforms are exempt (art. 29).

For Romanian companies, the register number and company data come from ONRC. The beneficial owner register is not open to everyone: since Law 86/2025, access for private persons requires online registration on ONRC's portal and proof of a legitimate interest, which ONRC checks before access is granted.

Tax due diligence on sellers

Platform operators must collect, for individual sellers, name, main address, tax identification number and issuing state (or place of birth), VAT number and date of birth; for entity sellers, legal name, registered office, tax number, VAT number and trade register number (ANAF DAC7 guide, 2024). ANAF's guide notes that sellers identified through an official EU or member state electronic identification service may be exempt from some of these data requirements.

Romanian identity documents

Some of the new electronic identity cards do not show the holder's address. ONPCSB points reporting entities to the Ministry of Internal Affairs' RO CEI Reader application, which reads the card's chip, including the domicile; marketplaces that need a verified address face the same issue.

Age verification for restricted goods

Romanian law sets the age (18) and the in-person check, but prescribes no remote age verification method. The Digital Services Act requires platforms accessible to minors to protect them, but does not oblige them to process additional personal data to assess age (art. 28(3)).

5. Digital channels: what's different

Bottom line: online sellers carry duties a physical shop does not: identity disclosure before the order, a 14-day withdrawal right with an online withdrawal button, and, for marketplaces, verification and tax reporting of every business seller.

Disclosure before the order

ANPC Order no. 225/2023 (Official Gazette Part I no. 1110 of 11 December 2023, in force 25 January 2024) requires operators selling online, and operators that run or are present on sales pages, including marketplaces, to display name, unique registration code, trade register number, registered address and all authorisations in the consumer's field of vision at first contact and before the order is placed, not hidden behind other material (arts. 1 to 3). Operators that refuse are delisted from the sales page at the authorities' request (art. 4).

Withdrawal and online interfaces

Government Emergency Ordinance no. 34/2014 gives consumers 14 days to withdraw from distance contracts (art. 9). Emergency Ordinance no. 18/2026 (Official Gazette Part I no. 236 of 26 March 2026) added art. 11^1: from 19 June 2026, contracts concluded through an online interface must offer a withdrawal function labelled "retrageți-vă din contract aici", available throughout the withdrawal period, with a confirmation step and a confirmation on a durable medium. Breaches are fined 5,000 to 15,000 lei [In force; approval law pending].

Age-restricted goods online

Law no. 349/2002, as amended by Law 64/2024, bans sales of tobacco, e-cigarettes, heated tobacco devices and nicotine pouches to under-18s, bans their sale through easybox or locker devices, and requires courier parcels containing them to carry a printed warning (art. 3(6^1) to (6^3)). Law no. 201/2016 bans cross-border distance sales of tobacco products, e-cigarettes and refill containers to consumers in Romania (art. 18(1)). Law 61/1991 (art. 2^1, added by Law 233/2024) obliges staff of public venues and sellers in commercial units to ask for identity documents before selling alcohol, energy drinks or tobacco products; its text does not address distance sales.

Pending

The "online majority" bill (L190/2025, PL-x 356/2025) would require verifiable parental consent before under-16s use online services, a term the Senate text defines to include e-commerce, with ANCOM setting the technical methods [Bill, passed Senate 6 Oct 2025].

6. Data protection and biometrics

The GDPR applies directly, supplemented by Law no. 190/2018 and supervised by ANSPDCP. Two national rules bite on seller and buyer verification. First, processing genetic, biometric or health data for automated decision-making or profiling is allowed only with the data subject's explicit consent or under express legal provisions, with appropriate safeguards (art. 3). A face match used to decide whether a seller is admitted falls within this rule. Second, the personal numeric code (CNP) printed on Romanian identity documents may be processed on the basis of legitimate interest only with safeguards: technical and organisational measures, a data protection officer, set retention periods and regular staff training (art. 4).

Retention differs by purpose. The Digital Services Act requires marketplaces to store trader traceability data securely for six months after the contractual relationship ends and then delete them (art. 30(5)), while ANAF's DAC7 guide sets a retention period of five to ten years after the reporting period for platform reporting records.

7. Sector-specific obligations

Platform reporting to ANAF (DAC7)

Government Ordinance no. 16/2023 (Official Gazette Part I no. 86 of 31 January 2023) transposed the EU platform reporting rules into the Fiscal Procedure Code (Law 207/2015, art. 291^5 and Annex 5). Platform operators that facilitate sales of goods, personal services or rentals must complete due diligence by 31 December and file form F7000 by 31 January of the following year. Sellers with fewer than 30 sales of goods and total consideration up to the lei equivalent of EUR 2,000 in the period are excluded. If a seller does not provide the data after two reminders and at least 60 days, the operator may close the account or withhold payments.

Product safety on marketplaces

The General Product Safety Regulation (Regulation (EU) 2023/988), applicable since 13 December 2024, requires marketplaces to register on the Safety Gate Portal, designate contact points for authorities and consumers, and act on orders to remove dangerous product offers within two working days (art. 22).

Hosting liability and illegal content orders

Law 50/2024 repealed the hosting liability rules of Law 365/2002 (arts. 14 and 15) in favour of the Digital Services Act. Romanian sector authorities may order platforms to act against illegal content, including offers of illegal products, or to provide information (Law 50/2024 arts. 7 to 9); ANCOM's 2025 report records 4,191 such orders to act and 10 orders to provide information in 2025.

Dispute resolution notices

ANPC Order no. 449/2022, as amended by Order no. 270/2026 (Official Gazette Part I no. 420 of 19 May 2026), requires an alternative dispute resolution pictogram of 250 x 50 pixels linked to the ANPC platform at reclamatiisal.anpc.ro.

8. Risk indicators and red flags

Outside the AML regime, the indicators concern trader identity, product legality and minors.

Marketplace seller and age-restricted sale indicators

• Unverifiable trader data: register number, address or contact details that official databases do not confirm (DSA art. 30(2)).
• Payment account mismatch: bank account not in the name of the trader or company identified.
• Data drift: trader details that become inaccurate or out of date after onboarding (DSA art. 30(3)).
• Missing authorisations: regulated goods listed without the permit or licence series the seller must display (Order 225/2023).
• Locker delivery of nicotine products: tobacco or nicotine orders routed to easybox or locker points (Law 349/2002 art. 3(6^2)).
• Cross-border tobacco offers: tobacco or e-cigarette listings shipped to Romanian consumers from other member states (Law 201/2016 art. 18).
• Silent sellers: sellers who ignore tax data requests after reminders (DAC7 due diligence).
• Large cash settlements: cash payments approaching EUR 10,000, which bring the seller into AML scope.

9. Enforcement and penalties

ANPC publishes weekly control results; its release of 16 October 2026 reported 1,800 operators checked and fines of more than 4.6 million lei in one week. In data protection, ANSPDCP fined MyConnector Platform SRL 31,451 lei (16 October 2026) after an attack on a test server exposed personal data, noting that real data had been used for testing instead of fictitious data.

10. Recent changes and what to watch

• 19 June 2026: online withdrawal function and distance financial services rules of Emergency Ordinance 18/2026 apply; the remaining rules on green claims and durability apply from 27 September 2026. The approval law (PL-x 348/2026) passed the Senate on 24 April 2026 and awaits the Chamber of Deputies, which may amend it. [In force]
• 19 May 2026: ANPC Order 270/2026 sets the online dispute resolution pictogram format. [In force]
• 6 October 2025: Senate adopts the online majority bill (parental consent under 16, ANCOM supervision, fines of 0.1% to 0.4% of national turnover); before the Chamber of Deputies since 13 October 2025. [Bill, not enacted]
• May 2025: ANPC Order 331/2025 (published 11 April 2025, in force 30 days later) requires in-store notices on the under-18 tobacco sales ban. [In force]
• 25 July 2024: Law 233/2024 makes ID checks mandatory before selling alcohol, energy drinks or tobacco in public venues and shops. [In force]
• 31 March 2024: Law 64/2024 bans locker delivery of tobacco and nicotine products and adds parcel warnings. [In force]
• 10 July 2027: EU cash payment limit of EUR 10,000 under Regulation 2024/1624. [Adopted, applies 10 Jul 2027]

11. What this means for identity verification

• Verify sellers, not buyers. The mandatory identity step in Romanian e-commerce is trader onboarding on marketplaces: identity document or eIDAS electronic identification, payment account and trade register data, checked against official sources before listing.
• Capture tax data at the same time. DAC7 fields (tax number, date of birth, address) can be collected in the same flow; official electronic identification can reduce what must be collected.
• Plan for addresses. Some Romanian electronic identity cards carry the address only on the chip, so address capture may need chip reading or a separate proof of address.
• Age checks have no prescribed remote method. The under-18 bans apply online, but the law specifies only an in-person ID check; firms choose and document their remote method, with data minimisation under the Digital Services Act and GDPR.
• Biometrics need a basis. Face matching that drives an admission decision falls under Law 190/2018 art. 3, which requires explicit consent or a legal basis and safeguards.
• Set retention per purpose. Six months after the end of the relationship for trader traceability data; longer periods for tax reporting records.