Fintech & Digital Payments Compliance in Moldova

The Moldovan market is open to non-bank payment and e-money firms, but entry runs through a single gatekeeper: the NBM licenses and supervises payment companies and e-money issuers and is also their anti-money laundering (AML) supervisor. The Office for Prevention and Fight against Money Laundering (SPCSB), the financial intelligence unit, receives every suspicious activity and threshold report.

The biggest obstacle for a digital-first entrant is the citizenship limit on remote identification. An app can onboard Moldovan citizens entirely online, but any other customer must be identified in person, for example through a registered payment agent, until the EU extension takes effect.

1. Who regulates this sector

2. Licensing and authorisation

Law No. 114 of 18 May 2012 on payment services and electronic money, which transposes the EU Second Payment Services Directive and the E-Money Directive, reserves payment services to listed providers (Article 6). Non-banks operate as payment companies, e-money companies, branches of foreign ones, or postal providers.

Payment company licence

Required before any service listed in Article 4(1) is offered (Article 10). The NBM has exclusive licensing power (Article 11). Minimum own funds at application: 350,000 lei for money remittance only, 900,000 lei for payment initiation only, and 2,200,000 lei for account-based services or the full range (Article 12).

E-money company licence

Issuing e-money needs a separate NBM licence and own funds of at least 6,000,000 lei at application (Articles 8¹ and 8²). E-money is issued at par value, and redemption for residents is made only in Moldovan lei (Article 8).

Account information services

A firm providing only account information services is registered rather than licensed (Article 10(1¹)). Payment initiation and account information providers must hold professional indemnity insurance or a comparable guarantee (NBM Regulation No. 11/2024, Chapter VI).

Agents and branches

Agents may be used in Moldova or abroad only after NBM registration (Article 27). The NBM decides within 30 working days; agents handling up to 5,000,000 lei a year file fewer documents (NBM Regulation No. 10/2024, points 37 and 45).

The NBM decides on a complete application within 60 working days (Article 18). Applicants need a Moldovan registered office, lawful capital and sound governance (Article 15), and the NBM must clear the information systems used before services launch (Article 7(8)). Under NBM Regulation No. 289/2024, providers need NBM confirmation, requested through its web portal, before issuing or accepting electronic payment instruments or launching internet or mobile banking; the NBM decides within 30 working days (points 169, 182 and 188). Outsourcing must be notified at least one month ahead, and significant functions, including information system management, need prior approval (Article 28; NBM Regulation No. 28/2025).

Since 10 July 2026, acquirers of qualifying holdings without the NBM's prior permission lose voting and dividend rights and must sell within six months if permission is not sought or is refused (Law No. 121/2026).

3. AML, KYC and customer due diligence

Payment companies, e-money companies and postal providers are reporting entities under Article 4(1)(i) of Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing. Payment initiation and account information service providers are expressly excluded. The NBM is their AML supervisor (Article 15(1)(a)).

When customer due diligence applies

Customer due diligence (CDD) is required at the start of every relationship, for single occasional transactions through a payment service provider above 20,000 lei, for linked occasional transactions above 200,000 lei, on suspicion, and when earlier data are in doubt (Article 5(1)). If CDD cannot be completed, the firm must not proceed and must report to the SPCSB (Article 5(3)). Anonymous accounts and anonymous prepaid cards are prohibited (Article 5(4)).

A beneficial owner holds more than 25% (or 25% plus one share), directly or indirectly, or otherwise controls the customer (Article 5²). NBM Regulation No. 202/2018 on AML in non-bank payment service providers (last amended 16 January 2025) requires customer data refreshes at least yearly for high risk, every two years for medium and every three years for low risk (point 33).

Simplified and enhanced measures

On a documented low-risk assessment, payment and e-money providers may apply simplified CDD to e-money where stored value and monthly transfers each stay at or below 3,000 lei and transactions are monitored. The relief does not cover cash redemption or withdrawal above 1,000 lei or remote payment transactions (Law No. 308/2017, Article 5(9)); the statute excludes all remote payments, which is stricter than Regulation No. 202/2018, point 49¹ (remote payments above 1,000 lei each).

Enhanced due diligence (EDD) applies to politically exposed persons, high-risk jurisdictions and the risk factors in Article 8(3), including customers not present in person unless identified electronically.

Reporting and records

• Suspicious activity or transactions: immediately, and no later than 24 hours after the suspicion arises (Article 11(1)).
• Cash transactions of at least 200,000 lei in a month (single or linked): by the 5th of the following month (Article 11(2)).
• Single non-cash transactions of at least 200,000 lei: by the 10th of the following month (Article 11(3)).
• Money remittances of at least 40,000 lei: within 5 days, by banks and payment entities (Article 11(3¹)).

Reports go through the SPCSB's goAML platform. Records are kept for five years after the relationship ends, extendable by up to five years, then deleted (Article 9). Funds of sanctioned subjects must be blocked and the State Tax Service informed within 24 hours (Law No. 25/2016); the national list is on date.gov.md.

4. Identity verification and onboarding

In person, customers present valid identity documents in original or legalised copy (Regulation No. 202/2018, point 32). Remote identification is governed by Article 5¹ of Law No. 308/2017 and the NBM Regulation on requirements for identifying and verifying customers by electronic means, approved by Executive Committee Decision No. 281 of 7 November 2024 (the e-KYC Regulation), which applies to banks, life insurers, non-bank credit organisations and payment and e-money companies.

Who may be onboarded remotely

Electronic identification is permitted only for natural persons who are Moldovan citizens, and for resident legal persons whose representatives, founders, administrators and beneficial owners are all Moldovan citizens (Article 5¹(1); e-KYC Regulation, point 13).

Permitted remote methods

Point 21 allows four methods: a) electronic identification means of sufficient assurance under Law No. 124/2022 (qualified electronic signature); b) live video and audio with physical-presence checks, recording of the original ID and capture of the face; c) a live photo with presence checks and recording of the original ID; and d) other means offered by a qualified trust service provider. Checks may be automated, operator-led or combined (point 18).

Technical minimums

Automated checks need liveness detection, document authenticity checks (security features and machine-readable zone), cameras of at least 8 megapixels or Full HD, face matching against the document photo, and blocking of pre-recorded uploads (point 23). Operator-led video must be continuous and recorded (point 22). Firms must capture device data, IP address and location (point 24), confirm the phone or email by one-time password before completion (points 25 and 26), check data against the State Population Register (point 27) and screen for sanctions and politically exposed persons (point 28). Solutions must be certified to listed standards, including ISO/IEC 30107 on presentation attack detection and NIST SP 800-63 (point 29).

Before go-live, firms run a pre-implementation assessment, including the solution's ability to detect VPN or proxy use (point 6), and notify the NBM at least 30 days before starting (point 49). The first transaction may run only once all CDD measures are complete (point 5).

Firms relying on a third party's CDD keep final responsibility (Article 10).

5. Digital channels: what's different

Bottom line: remote onboarding is permitted and not treated as higher risk when the NBM's e-KYC methods are used, but it is available only to Moldovan citizens, and the technical and notification requirements apply only online.

Citizenship gate

A payment app must route non-citizens to in-person identification. Law No. 144 of 19 June 2025 rewrites Article 5¹(1) to admit EU citizens holding a qualified certificate from an EU trust service provider, through trust service providers accredited under Government Decision No. 977/2023. [Adopted, effective date not yet set] That article takes effect only once the technical conditions in Article XVIII(4) are in place.

Account security

Providers must apply strong customer authentication, with two or more independent elements, when a payer accesses an account online, initiates an electronic payment or takes any remote action carrying fraud risk; remote payments need dynamic linking to amount and payee (Law No. 114/2012, Article 52⁴). NBM Regulation No. 12/2024, in force since 1 February 2025, allows exemptions such as contactless payments up to 1,000 lei and remote payments up to 600 lei, within cumulative caps (points 24 and 31).

Pending change

An NBM draft amending the e-KYC Regulation [Proposed, consultation closed 2 March 2026] would add EU citizens, require high-assurance electronic identification (including eIDAS-notified means, the EVO app and the EU Digital Identity Wallet) and tighten rules for qualified electronic signatures. Existing solutions would get 12 months to comply.

6. Data protection and biometrics

Law No. 195/2024 on personal data protection, which transposes the GDPR, has applied since 23 August 2026, replacing Law No. 133/2011. Biometric data used to identify a person are a special category (Article 9), so face matching needs an Article 9(2) exception such as explicit consent. The e-KYC Regulation requires consent before electronic identification begins, a data notice shown to the customer (points 19 and 20) and a data protection impact assessment before go-live (point 6). Remote onboarding evidence is kept for the relationship plus five years (point 46) and then deleted (Law No. 308/2017, Article 9(5)).

7. Sector-specific obligations

Transfers involving crypto providers

Providing virtual asset services in Moldova is prohibited (Law No. 308/2017, Article 4(1¹)). Payment firms may not hold accounts for foreign virtual asset service providers or for non-residents dealing with them, may not process occasional transactions with them, and must cap each resident customer's transactions with them at 50,000 lei a month (Article 5(4¹) to (4⁴)). Such resident customers need special accounts and specialised monitoring tools (Article 8(5¹)). Under Law No. 180/2026 on the crypto-asset market [Adopted, effective 17 Mar 2027], a payment institution authorised by the CNPF as a crypto-asset service provider may provide only custody and transfer of crypto-assets (Article 53(6)); e-money companies may issue e-money tokens and, after notifying the CNPF 40 working days ahead, provide custody and transfer of their own e-money tokens only (Article 54(5)). It does not amend Law No. 308/2017, whose ban still stands as of November 2026; the Government must propose aligning legislation by March 2027 (Article 104(4)). The SPCSB's draft AML law (No. 864/SPCSB, consultation 26 October to 2 November 2026, proposed to apply from 10 July 2027) would make crypto-asset service providers reporting entities under the general AML law [Proposed, consultation closed 2 Nov 2026].

Information accompanying transfers

Regulation No. 202/2018 (as amended on 16 January 2025) requires payer and payee information on transfers. Cross-border transfers up to 20,000 lei must carry at least names and account numbers (point 68); purely domestic chains may carry account numbers only, with full data supplied within three working days on request (point 69¹). Transfers that do not meet these requirements must not be executed (point 70).

Agent oversight and certified compliance staff

Providers must train and monitor agents and keep a register of high-risk agents (Regulation No. 202/2018, points 57 to 60). Since 13 August 2026, Law No. 146/2026 requires the senior manager and staff responsible for AML compliance to hold a valid training certificate, renewed at least every three years; supervisors verify it, and a missing certificate triggers a remediation period of up to three months (new Article 13¹ of Law No. 308/2017). The SPCSB runs the national course and certification exam (curriculum approved by SPCSB Order No. 9 of 13 March 2026, which predates Law No. 146/2026).

8. Risk indicators and red flags

Suspicious activity criteria for payment and e-money providers (SPCSB Order No. 15/2023, section 8)

• Rapid cross-border flows: transfers to and from different countries within a short period.
• Structuring: repeated small or identical amounts that appear to avoid identification or reporting.
• Wallet top-ups from many devices: exact or limit-level top-ups of one wallet from different devices or cash terminals in a short time.
• Incomplete details: transactions with inaccurate or missing data on the parties.
• Same-day cash-out: transfers from one sender withdrawn in cash on the same day, or small cash deposits moved on at once.
• Foreign cards and high-risk links: top-ups with cards issued abroad, or parties in high-risk jurisdictions.

9. Enforcement and penalties

Under Law No. 308/2017, Article 35, AML breaches can bring public statements, cease orders, licence suspension or withdrawal, management bans and fines of up to EUR 5,000,000 or 10% of the previous year's turnover for payment and e-money companies (Law No. 75/2020 sets the procedure). Under Law No. 114/2012, Article 99, the NBM can fine a payment or e-money company up to 10% of its required regulated capital, fine managers one to 100 average monthly salaries, suspend the licence for one to six months or withdraw it.

On 26 February 2026 (Decision No. 43) the NBM fined Paynet Services S.R.L. 1,530,000 lei for CDD, beneficial owner, monitoring and suspicious transaction reporting failures. On 29 October 2025 (Decision No. 245) it fined the same firm 1,700,000 lei, including for not opening special accounts or monitoring residents' transfers to foreign crypto providers; the firm challenged that decision on 28 November 2025. On 7 November 2024 it withdrew the licence of Fintecly S.R.L.

10. Recent changes and what to watch

• 17 March 2027[Adopted, effective 17 Mar 2027] Law No. 180/2026: CNPF-authorised payment institutions may offer only crypto custody and transfer; e-money companies may issue e-money tokens and, with notice, hold and transfer their own; the AML ban is not yet amended.
• 23 August 2026[In force] Law No. 195/2024 on personal data protection applies to biometric onboarding.
• 13 August 2026[In force] Law No. 146/2026 requires certified AML compliance staff; the SPCSB had three months from publication to adopt implementing acts (Article III(2)).
• 16 July 2026[In force] National AML programme 2026 to 2030, adopted 9 July 2026 (Parliament Decision No. 140), published 16 July 2026, targeting risk-based supervision of financial institutions.
• 10 July 2026[In force] Law No. 121/2026 tightens prior NBM permission for qualifying holdings in payment companies.
• 16 February 2026[Proposed, consultation closed 2 March 2026] NBM draft amending the e-KYC Regulation for EU citizens, high-assurance e-ID and digital identity wallets.
• 20 June 2025[Adopted, effective date not yet set] Law No. 144/2025 extends remote identification to EU citizens with an EU qualified certificate once technical conditions exist.
• 16 January 2025[In force] NBM Decision No. 8/2025 updates the transfer information rules in Regulation No. 202/2018.

11. What this means for identity verification

• Route by citizenship first: only Moldovan citizens, and companies whose key persons are citizens, can finish onboarding online.
• Build to the e-KYC specification: liveness, document checks, face matching, device and IP capture, a one-time password and certified components, plus register and sanctions checks before the first transaction.
• Keep, refresh and plan: retain evidence for the relationship plus five years, refresh data by risk level, and prepare for eIDAS means and EU wallets.