iGaming & Gambling Compliance in Moldova

Moldova's gambling market is closed to private online operators. The Law on gambling reserves all gambling except casinos to the state, including every game offered over electronic communications networks, and runs it through the National Lottery of Moldova. Private companies can take part only as licensed casino operators on physical premises, or as tendered partners of the state operator under public-private partnership contracts.

The Public Services Agency (ASP) licenses casinos, registers game rules and keeps the list of prohibited gambling websites. The State Inspectorate for Supervision of Non-Food Products and Consumer Protection (ISSPNPC) carries out state supervision and control, and the Office for Prevention and Fight against Money Laundering (SPCSB) supervises gambling organisers for AML purposes.

For a new entrant, the biggest obstacle is structural: there is no licence to apply for online. For the National Lottery and its partners, the main tension is between the gambling law's light registration rules and the AML law's narrow list of accepted remote identification methods.

1. Who regulates this sector

Operators send fiscal data to the State Tax Service through the state online monitoring system and gaming data to the single electronic monitoring system under ASP (Law No. 291 of 16 December 2016 on gambling, art. 2, 5(2)(k), 7(2)). ARCOM relays ASP list updates to providers (ARCOM, 2 November 2026).

2. Licensing and authorisation

Under Law No. 291/2016 (last amended by Law No. 227/2025, in force 30 December 2025), casinos are the only activity open to licensed private operators; everything else is reserved to the National Lottery, which needs no licence (art. 3, 30, 31).

Online gambling: state monopoly [In force]

Only the state-owned monopoly operator may organise gambling over electronic communications networks, under rules approved by ASP; unauthorised online gambling is prohibited (art. 47(1) to (4)). Equipment, software, control server and website domain must be in Moldova (art. 47(5)), and all financial transactions with players are archived for five years (art. 49).

Private partners of the National Lottery [In force]

Private capital enters through public-private partnerships, not licences. Government Decision No. 639 of 14 August 2017 provides for tendered contracts of at least 15 years between the Public Property Agency, the National Lottery and private partners for lotteries, betting and slot machines, including online; partners finance the investment for a share of revenue (pt. 5 to 7, 12, 13). In 2023 the Court of Accounts found the public partner lacked complete data on online stakes and payouts (Decision No. 52 of 15 December 2023).

Land-based casinos [In force]

ASP issues casino licences, valid indefinitely subject to an annual fee of 600,000 lei per gaming table and 130,000 lei per roulette unit, and decides within 10 working days (art. 31(2), (3) and (9)). The applicant must be a Moldovan-resident company with share capital of at least 5,000,000 lei (70% in cash, not borrowed), clean management records, five years' gambling experience in Moldova or the EU, and winnings insurance (art. 11). Casinos operate only in separate buildings or hotels of at least four stars (art. 32).

Unauthorised organisation of monopoly games, and any promotion, facilitation or payment service for it, are violations, as is a player's participation in unauthorised gambling, including online (art. 54(2)(b1) to (b3)).

3. AML, KYC and customer due diligence

Gambling organisers are reporting entities under Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing (art. 4(1)(k); last amended by Law No. 146/2026, in force 13 August 2026), supervised by SPCSB (art. 15(1)(h)). SPCSB's requirements for supervised entities are set out in SPCSB Order No. 21 of 4 August 2023 (last amended by Order No. 8 of 28 May 2025).

When CDD applies

At the start of a business relationship; when collecting winnings, buying or exchanging chips or staking in transactions of at least 40,000 lei, single or linked; on suspicion; and when identification data are in doubt (art. 5(1)).

What CDD covers

Verified identity, beneficial owner (over 25%), purpose of the relationship and ongoing monitoring (art. 5(2), 5²). SPCSB requires name, date and place of birth, citizenship, ID data including IDNP, address, occupation and source of funds (Order 21/2023, pt. 22).

Enhanced due diligence

For politically exposed persons, high-risk jurisdictions, cash-intensive activity and other higher-risk cases; non-face-to-face customers are a risk factor unless identified under art. 5¹ (art. 8, 8¹).

Reporting

Suspicious activity to SPCSB within 24 hours; cash transactions of 200,000 lei or more in a month by the 5th of the following month; single transactions of 200,000 lei or more by the 10th (art. 11(1) to (3)).

Online accounts. Law 308 does not say whether a registered gaming account is a business relationship, and SPCSB has issued no guidance (as of November 2026). The definition, a relationship expected at first contact to have some duration (art. 3), fits a long-term account, and occasional transactions are by definition those outside a business relationship; on that reading, full CDD applies at registration. The narrower reading applies AML CDD only from the 40,000 lei trigger. The draft replacement law's definition supports the first reading.

If CDD cannot be completed, the operator must refuse the transaction or relationship and report to SPCSB (art. 5(3)). Records, including electronic identification data, are kept for five years (art. 9). Reliance on a regulated third party is permitted, but the operator stays responsible (art. 10). Separately, reporting entities must check whether customers are subjects of international restrictive measures, freeze their funds and inform the State Tax Service within 24 hours (Law No. 25 of 4 March 2016 on the application of international restrictive measures, art. 28(1)).

4. Identity verification and onboarding

Gambling law: registration and age

An online player registers for a single gaming account with name and personal identification number (IDNP); resident foreigners add ID document number and series, date of birth and address (Law 291/2016, art. 50(1) and (2)). The Government's standard rules add a photo from the identity document and let the operator request further documents by email or website upload (Government Decision No. 777 of 1 August 2018, annex 4, pt. 4(2)(d) and 11(2)). The operator verifies the data no later than the first deposit and records the paying bank account for payouts (art. 50(2)).

The minimum age is 21 for high-social-risk games (casino games, slot machines) and 18 for lotteries and sports betting, in every channel (art. 6(2), 13(3)(b)). People under judicial guardianship or notified by public authorities as barred are excluded (art. 13(3)(a)).

AML law: accepted remote methods

Electronic identification is allowed only for Moldovan citizens, so resident foreigners need a non-electronic check (Law 308/2017, art. 5¹(1)); it uses one or more of: an electronic identification means with a sufficient assurance level under Law No. 124/2022; a live video and audio session, or photo, with physical-presence checks, capture of the original ID document and of the customer's face; or a qualified trust service provider (art. 5¹(2)). Otherwise SPCSB expects a valid identity card, passport, residence permit or travel document, checked for authenticity and against reliable databases (Order 21/2023, pt. 29).

Law 308 leaves detailed requirements to each supervisor (art. 5¹(3)); as of November 2026, SPCSB's regulation for supervised entities sets none for electronic identification. Law No. 144 of 19 June 2025 [Adopted, effective date not yet set] will extend art. 5¹ electronic identification to EU citizens holding a qualified certificate from an EU trust service provider, once the technical conditions in its art. XVIII(4) are in place (art. XII, XVIII(1)). A document emailed or uploaded under the gambling rules does not by itself meet art. 5¹(2).

5. Digital channels: what's different

Bottom line: online gambling is reserved to the state operator, and it carries rules that land-based play does not: one verified account per player, verification by the first deposit, bank-only payments, infrastructure located in Moldova, and blocking of unlicensed sites and their payments.

Bank-only payments

Online payments run only through bank accounts or cards outside jurisdictions on the National Bank's list of those not implementing international transparency standards (Law 291/2016, art. 50(3); NBM Decision No. 91 of 2 May 2013).

Blocking of unlicensed sites and payments

ASP lists unauthorised gambling websites, platforms and apps (art. 50¹(1) and (2)); communications providers block them immediately and tell users so on their websites (art. 50¹(3); ANRCETI, now ARCOM, Board Decision No. 1 of 21 January 2021) and payment providers refuse payments to notified accounts within three working days (art. 50²). ASP reported more than 7,600 sites in the blocking mechanism on 2 September 2026; its list had grown to 10,454 entries by 27 October 2026.

6. Data protection and biometrics

Law No. 195 of 25 July 2024 on personal data protection, modelled on the EU General Data Protection Regulation, has applied since 23 August 2026 (art. 89) and replaces Law No. 133/2011. Biometric data used to uniquely identify a person are a special category, processed only under an exception such as explicit consent or a substantial public interest set in law (art. 9). Breaches can cost up to 2,000,000 lei or 2% of turnover (art. 88(2)), but only 10% of a fine applies in the law's first year, 40% in the second and the full amount from the third (art. 90(4)).

Operators must inform customers that data are processed for AML purposes (Law 308/2017, art. 5(14)) and delete them when retention ends (art. 9(5)); face images from live sessions fall under art. 9 of Law 195/2024.

7. Sector-specific obligations

State monitoring system

Operators must connect their software to the single electronic state monitoring system, which also monitors AML compliance, and answer for the accuracy of the data sent (Law 291/2016, art. 7(2), 8(1)(‌c), 9(3)). The 2025 national risk assessment reports that only the National Lottery is connected so far.

AML training certificates [In force]

Since 13 August 2026, a gambling organiser's senior manager responsible for AML compliance, its compliance officer and its compliance staff must hold a valid AML training certificate, renewed at least every three years; where a certificate is missing, the organiser gets up to three months to remedy (Law 308/2017, art. 13¹, inserted by Law No. 146/2026).

Advertising and sponsorship

Gambling advertising, online included, is prohibited, with narrow exceptions for low-risk games such as broadcasts between 22:00 and 07:00 carrying warnings over at least 20% of the material (art. 53(2) to (2⁸)).

8. Risk indicators and red flags

The 2025 national risk assessment summary (SPCSB, December 2025) rates gambling organisers at medium money laundering risk. SPCSB's guide on identifying suspicious activity (Order No. 15 of 20 July 2023) lists sector indicators, including for remote gambling. The assessment notes very few suspicious activity and transaction reports in 2022 to 2024.

Gambling indicators from SPCSB guidance

• Remote cash-in, bank cash-out: online accounts funded in cash or through cash-in payment terminals, then withdrawn to bank accounts as apparent winnings (Order 15/2023, pt. 6(i)).
• Many funding sources: a gaming account topped up from multiple cards or from payment accounts issued abroad (pt. 6(j)).
• Unusual sports bets: large or odd stakes, such as a big bet on a team with minimal chances (pt. 6(k)).
• Card in, cash out: chips bought by card, winnings or unused funds taken in cash (pt. 6(b)).
• Formal play: chips bought in cash, including from other players, with little or no play, then refunded by bank transfer (pt. 6(‌c); NRA 2025).
• Threshold management: asking staff to warn when bets near the reporting threshold, or having others cash out part of a win (pt. 6(d) and (f)).
• Identity reluctance: refusal to give identification data, or false or stolen data (pt. 6(g)).
• Collusive losses: large losses to particular players in games not played against the house (pt. 6(h)).

9. Enforcement and penalties

AML penalties. Law 308/2017 provides for public statements, orders, licence suspension or withdrawal, management bans and fines of up to double the benefit or EUR 1,000,000 for non-financial reporting entities such as gambling organisers (art. 35(2)). Under Law No. 75 of 21 May 2020 (amended by Law No. 146/2026), fines are set per violation and per person: a gambling organiser failing to apply CDD faces 50,000 to 1,000,000 lei, EDD failures carry bands up to EUR 5,000,000, and for CDD failures employees and managers face 4,500 to 50,000 lei (art. 41).

SPCSB publishes anonymised sanction decisions; in 2026 fines ranged from 20,000 lei (on an employee) to about 680,000 lei.

Contraventions. Under the Contravention Code, where one conventional unit equals 50 lei (art. 34), operating without a valid licence costs a legal entity 120 to 180 units (6,000 to 9,000 lei), and admitting under-age players costs 150 to 270 units (7,500 to 13,500 lei), with or without a ban on the activity for 5 months to a year (art. 277¹(2) and (3)). A casino licence can also be suspended for admitting under-21s and withdrawn for breaching AML procedures (Law 291/2016, art. 31(12) and (13)).

Unauthorised monopoly gambling, including online. Organising monopoly games without authorisation, or importing, promoting, facilitating or providing payment services for them, is a crime: individuals face 2,000 to 4,000 units (100,000 to 200,000 lei) and legal entities 6,000 to 8,000 units (300,000 to 400,000 lei) plus an activity ban, rising to up to five years' imprisonment or 8,000 to 10,000 units for entities where the profit is especially large, an organised group is involved or the aim is money laundering (Criminal Code, art. 242³). ASP reported more than 7,600 sites in the blocking mechanism on 2 September 2026 (ASP); its list had grown to 10,454 entries by 27 October 2026.

10. Recent changes and what to watch

• 26 October to 2 November 2026: new AML law consultation[Proposed, consultation closed 2 Nov 2026]. SPCSB's draft law aligning with the 2024 EU AML package would replace Law 308/2017, set the gambling CDD threshold at the equivalent of EUR 2,000, let operators identify customers at the entrance of physical premises, and accept verification by identity document or by electronic identification at substantial or high assurance (draft art. 19(6) and (9), 22(9)). The draft proposes entry into force on 10 July 2027 (particip.gov.md).
• 27 October 2026: ASP blocklist update[In force]. The list of prohibited gambling sites reached 10,454 entries; ARCOM instructed providers to block them on 2 November 2026.
• 23 August 2026: new data protection law[In force]. Law 195/2024 applies to biometric identity data.
• 13 August 2026: AML training certificates[In force]. Law 146/2026 inserted art. 13¹ into Law 308/2017: the AML senior manager, compliance officer and compliance staff of every gambling organiser must hold a valid AML training certificate, renewed at least every three years, with up to three months to remedy a missing certificate.
• 30 December 2025: gambling law amendment[In force]. Law 227/2025 amended casino licensing: indefinite validity subject to the annual fee, decisions within 10 working days.
• 19 June 2025: EU citizens and remote identification[Adopted, effective date not yet set]. Law 144/2025 will extend art. 5¹ electronic identification to EU citizens holding a qualified certificate from an EU trust service provider, once the technical conditions in its art. XVIII(4) are in place.

11. What this means for identity verification

• Documents: online registration needs name, IDNP and an ID document photo (more for resident foreigners); AML verification relies on an identity card, passport, residence permit or travel document.
• Timing: verification must be completed no later than the first deposit; on the better reading of Law 308, apply full CDD when the account is opened.
• Remote methods: for citizens, use e-ID at a sufficient assurance level, live video or photo with liveness and capture of the original document, or a qualified trust service provider. Documents sent by email alone do not meet the AML standard.
• Foreign nationals: remote AML identification is not available; plan a non-electronic route for resident foreigners who reach a CDD trigger.
• Age and payments: apply 21 for casino-type games and 18 for lotteries and betting; record the first-deposit bank account and pay out to it.
• Biometrics and retention: obtain a valid art. 9 basis for face matching, keep CDD evidence for five years, then delete it.
• Watch 2027: the proposed AML law would replace the 40,000 lei threshold with EUR 2,000.