iGaming & Gambling Compliance in Romania

The Romanian online market is open but tightly licensed. The state keeps the monopoly and grants time-limited rights to private operators. Remote operators get the same licence and authorisation as land-based ones, plus extra technical and banking conditions. The National Lottery has exclusive rights to lotto games, including online.

The National Gambling Office licenses, supervises and is the AML supervisor for the sector. The National Office for the Prevention and Combating of Money Laundering (ONPCSB) receives suspicious transaction and cash reports.

For a new entrant, the biggest obstacle is local infrastructure. Player funds must be held at a Romanian bank, and game data must be mirrored in real time to servers in Romania that ONJN can access.

1. Who regulates this sector

Romania is a unitary state, so licensing is national. Since Emergency Ordinance 7/2026, the definition of a licensed operator also includes an operating authorisation from the local authority where it carries on its activity.

2. Licensing and authorisation

Government Emergency Ordinance (OUG) no. 77/2009 on the organisation and operation of gambling is the framework law. Under article 1(1), organising and operating gambling in Romania is a state monopoly administered by ONJN. Article 1(2), as amended by OUG 82/2023, lets the state grant this right to companies registered in Romania. It may also grant it to companies from the European Union (EU), the European Economic Area (EEA) or Switzerland that have a Romanian permanent establishment. Two documents are needed: an organisation licence for each type of activity and an operating authorisation.

Class I licence

Held by the operator offering games to players. Under article 12(1) it is valid for 10 years. Remote games (lotto, casino, betting, poker, bingo and similar) are listed in article 10(1)(h) to (n). Lotto games, including remote lotto, are reserved to the National Lottery under article 1(2^1).

Class II licence

For B2B providers: game software, platform hosting and management, payment processing, and affiliates. Since December 2025, class II holders may not serve operators that target Romanian players without a class I licence (article 1(5^2) to (5^4), as amended by Law 239/2025).

Extra conditions for remote operators

Article 15(1)(B) adds five conditions for remote gambling on top of the general ones:

• a bank account at a bank in Romania to hold player funds;
• a central IT system with a player registration and identification system;
• real-time mirror and safe servers located in Romania and made available to ONJN free of charge;
• game software approved by ONJN on the basis of tests by a licensed laboratory;
• for EU, EEA and Swiss companies, an authorised representative domiciled in Romania.

Fees and minimum share capital are set in the ordinance's annex (article 14(1)); for remote games the authorisation fee is paid monthly as a percentage of estimated revenue, subject to an annual minimum (article 14(2)(b)(iii)). ONJN keeps a public online register of licensed operators (article 13(1^1)).

3. AML, KYC and customer due diligence

Law no. 129/2019 on preventing and combating money laundering and terrorist financing makes "providers of gambling services" reporting entities (article 5(1)(d)). Article 2(p) defines gambling services as any service involving a stake with monetary value, provided in a physical venue or by any means at a distance, that requires an ONJN licence. ONJN supervises their compliance (article 26(1)(c)). Its sector instructions are approved by ONJN President's Order no. 370/2021 (Official Gazette Part I no. 21 of 7 January 2022).

When CDD applies

When a business relationship is established (article 13(1)(a)). For gambling providers, also when winnings are collected or chips are bought or exchanged in transactions of at least the lei equivalent of EUR 2,000 in a single operation (article 13(2)). CDD is also required on any suspicion, whatever the amount.

Verification

Identity must be verified from reliable, independent sources. Where available, these include eIDAS electronic identification and trust services, or any secure remote process recognised by ADR (article 11(1)(a)). Order 370/2021 lists the documents hardest to forge: identity card, passport, residence permit and driving licence.

Enhanced due diligence

Required for politically exposed persons (PEPs) and high-risk third countries, among other cases (article 17(1)). Remote relationships without safeguards such as eIDAS means or an ADR-recognised process count as a potentially higher-risk factor (article 17(14), point 2, letter c).

Casinos

Casino providers must identify every transaction a customer makes in the casino and link it to the customer's profile (article 11(11)).

Reporting and records

• Suspicious transactions: report to ONPCSB immediately, before carrying out any related transaction (articles 6 and 8(1)). The transaction is then held for 24 hours, and ONPCSB may suspend it for up to 48 hours (article 8(3) and (4)).
• Cash transactions: report transactions in cash of at least EUR 10,000 equivalent, including linked operations, within 3 working days (article 7(1) and (7)).
• Winnings records: for remote games, keep an individual record of winnings of at least EUR 2,000 in the IT system, through the authorised platform (Order 370/2021).
• Retention: keep CDD data, including data from electronic identification, and transaction records for 5 years after the relationship ends or the occasional transaction takes place (article 21(1)).

Beneficial owners of corporate customers and partners must be identified; the central register is kept by the National Trade Register Office (article 19). EU sanctions apply directly, implemented nationally by OUG 202/2008.

4. Identity verification and onboarding

Remote onboarding rules are in the norms approved by Government Decision (HG) no. 111/2016 (Official Gazette Part I no. 151 of 26 February 2016) and in Order 370/2021.

• Age: only adults aged 18 or over may play, and minors are barred from every type of game (OUG 77/2009, article 7(1) and (3)). The operator's website must state the under-18 ban in Romanian (norms, article 128).
• Registration data: name, date of birth, e-mail, home address, username, password, acceptance of the terms and a voluntary confirmation of age over 18. The platform assigns a unique player code (norms, article 129(2)). One account per player per operator (article 130(1)).
• Verification: the operator collects citizenship or tax residence and, for Romanian citizens, the personal numeric code (CNP). It must complete verification within 30 calendar days of registration (article 129(4)).
• Before verification: deposits are capped at EUR 200 and withdrawals are blocked (norms, article 129(3); Order 370/2021, article 14(3)).
• Failure: if data is not confirmed within 30 days, or the player is on the self-excluded or undesirable list, the account is closed. The remaining balance is retained and paid to the state budget (article 129(5)). Order 370/2021, article 14(4), likewise bars the business relationship if verification is not completed within 30 days of the first deposit.

Neither the gambling norms nor Order 370/2021 lists approved remote methods; Law 129/2019 recognises eIDAS identification, trust services and ADR-recognised remote processes. Under ADR President's Decision no. 564/2021 (Official Gazette no. 1119 of 24 November 2021), a provider registered in Romania may carry out video identification only after obtaining an ADR endorsement.

5. Digital channels: what's different

Bottom line: online operators work under the same licence and AML law as land-based venues, but must register every player before play and confirm identity within 30 days, with deposits capped at EUR 200 and withdrawals blocked until then.

Location and B2B gatekeeping

Law 141/2025 added article 1(5^5) to (5^9) to OUG 77/2009 with effect from 28 July 2025. Class II licensees supplying software, platform hosting or payment processing must deploy technology that finds the real location of players in their own systems, independently of what the operator's platform reports. When an operator without a class I licence lets players in Romania access their system, they must block those players. They must also report blocked players and the domains used to ONJN by the 10th of each month.

Blacklist and player fines

ONJN's Supervisory Committee puts unlicensed domains, platforms and apps on a public blacklist. Its decisions are sent to electronic communications and advertising service providers (article 1(5^9) and (5^10)); the list was last updated on 8 October 2026. Since 24 August 2025, a person in Romania who plays on an unauthorised remote site faces a fine of 5,000 to 10,000 lei (article 22(6)).

6. Data protection and biometrics

The GDPR applies directly. Law no. 190/2018 adds national rules, and article 15^1(3) of OUG 77/2009 confirms that all player data processing follows the GDPR. Two national rules matter for onboarding:

• Biometric data: processing biometric data for automated decision-making or profiling is allowed only with the person's explicit consent or under express legal provisions with appropriate safeguards (Law 190/2018, article 3(1)). Gambling law does not provide for biometric checks, so a face-match or liveness step needs its own legal basis, usually explicit consent.
• Personal numeric code: processing a national identification number, including by collecting documents that contain it, must rest on a GDPR article 6(1) ground. Processing based on legitimate interest needs extra safeguards (Law 190/2018, article 4). For Romanian players, the CNP request is a legal obligation (norms, article 129(4)).

7. Sector-specific obligations

Self-exclusion

Under article 15^1 of OUG 77/2009 (replaced by OUG 82/2023), ONJN runs a national database of self-excluded and undesirable persons. Organisers have real-time access to it. Requests can be filed with ONJN or with an operator, which must forward them within 2 working days. Operators must also send ONJN their internal lists of undesirable persons within 5 working days. Breaches carry fines of 50,000 to 100,000 lei (article 22(5)). ONJN's website showed 61,473 self-excluded persons on 21 October 2026.

Article 15^1(1) is worded around venue access; for online accounts, the norms require closing the account of any listed player (article 129(5)). Online operators must also offer deposit limits (applied within 24 hours, increases only after 48 hours) and temporary or permanent exclusion or a break of up to 7 days (article 132). Withdrawal from self-exclusion is possible only at ONJN.

Player accounts and payments

Remote operators may not extend credit, allow transfers between player accounts or accept stakes without funds in the account. Winnings go back only to the payment account the funds came from (norms, article 130). Where there are well-founded suspicions, an operator may hold a payout for up to 10 working days for checks, and then pay or notify the authorities (article 130(7)). A reality-check message must appear every 60 minutes (article 128(j)).

Winnings tax

Winnings are taxed by withholding at source. For income paid from 1 August 2025, Law 141/2025 sets bands of 4% up to 10,000 lei, 400 lei plus 20% of the amount above 10,000 lei up to 66,750 lei, and 11,750 lei plus 40% of the amount above 66,750 lei (Fiscal Code, article 110(2)).

8. Risk indicators and red flags

Remote gambling indicators (ONJN Order 370/2021)

• No physical presence: the player is never seen, which hampers customer knowledge.
• False or stolen identity documents used to open accounts.
• Concealed beneficial owners behind player accounts.
• Several platforms or collections accessed by the same player within one platform.
• E-wallets that make the source of funds hard to identify.
• Collusion on bonuses or other benefits between operator staff and players.
• Play through intermediaries, including informal value transfer systems.
• Remote gambling used as a front for cash deposits later moved to bank accounts as apparent winnings.

9. Enforcement and penalties

Gambling law. OUG 77/2009 sets fixed fine bands in lei. Tampering with player identification or financial management systems, extending credit to players, and breaching the advertising rules carry fines of 50,000 to 100,000 lei (article 22(3)). For these, the Supervisory Committee may also revoke the licence (article 22(4)). Self-exclusion breaches carry 50,000 to 100,000 lei (article 22(5)).

AML law. Under article 43 of Law 129/2019, CDD, reporting and record-keeping breaches are fined per contravention:

• individuals: 25,000 to 150,000 lei for the most serious category;
• legal persons: the upper limit rises by 10% of total revenue for the last closed fiscal period (article 43(3));
• serious, repeated or systematic breaches by entities outside banking and financial-market supervision: the upper limits rise by a further 5,000,000 lei for legal persons (article 43(5)).

Complementary sanctions include suspension for one to six months and licence withdrawal (article 44).

Recent action. On 20 August 2026 ONJN sanctioned TG Malta Limited, remote operator of totogaming.ro, for a campaign that used a doctor character to present play "between appointments" as routine, in breach of the principle of responsible participation. On 24 March 2026 ONJN filed a criminal complaint with the Directorate for Investigating Organised Crime and Terrorism (DIICOT) against a class II licensed affiliate.

10. Recent changes and what to watch

• [In force] 25 September 2026: an ONJN President's order sets fixed hours at territorial offices for processing self-exclusion requests.
• [Proposed, not adopted] 2026: ONJN is consulting on draft orders on minimum standards for remote operators' game rules, terms and promotions, and on test accounts and demo sessions.
• [In force] 25 February 2026: OUG 7/2026 adds a local operating authorisation to the definition of a licensed operator; it remains subject to parliamentary approval.
• [Proposal to Government] 30 January 2026: ONJN proposed an emergency ordinance creating a single self-exclusion procedure through ONJN, binding on online and land-based operators. If adopted, every registration flow will need a real-time database check.
• [In force] 18 December 2025: Law 239/2025 bars class II licensees from serving operators that target Romania without a class I licence or that appear on the blacklist. It also limits play in public places to the player's own device.
• [In force] 28 July to 24 August 2025: Law 141/2025 introduced supplier geolocation and blocking duties, fines for players on unlicensed sites and, from 1 August 2025, new winnings tax bands.
• [Bill, not enacted] 10 June 2025: the Senate adopted a bill amending OUG 77/2009 to create a real-time self-exclusion register. As of October 2026 it has not become law.
• [Adopted, applies 10 July 2027] EU AML Regulation (EU) 2024/1624: gambling providers must apply CDD when winnings are collected, a stake is wagered, or both, at EUR 2,000 or more (article 19(5)). Romania's current trigger covers winnings and chips, not stakes.

11. What this means for identity verification

• Design for a 30-day window. Allow registration and deposits up to EUR 200, keep withdrawals locked, and complete verification well inside 30 days; unverified accounts are closed and their balances go to the state.
• Capture the CNP and citizenship and verify them against the documents Order 370/2021 treats as hardest to forge.
• Prefer recognised remote methods (eIDAS identification, qualified trust services, ADR-endorsed video identification) to offset the higher-risk treatment of remote relationships.
• Treat biometrics as consent-based under Law 190/2018, since gambling law does not mandate them.
• Check the ONJN exclusion database in real time, expect suppliers to require location data, and retain identification evidence for 5 years.