Insurance & Insurtech Compliance in Moldova

Moldova's insurance market is open to new entrants online. The NBM has licensed and supervised insurers and intermediaries since taking over from the National Commission for Financial Markets (CNPF) on 1 July 2023. The CNPF supervises consumer protection, and the Office for Prevention and Fight against Money Laundering is the financial intelligence unit that receives reports.

The biggest obstacle for a digital insurer is the nationality limit on remote identification. Non-life products sit outside the AML regime. A life or investment-linked product can be onboarded remotely only for Moldovan citizens, through one of four methods the NBM prescribes. Foreign customers still need face-to-face identification.

1. Who regulates this sector

Law No. 92 of 7 April 2022 on insurance or reinsurance activity names the NBM as supervisory authority (art. 4). Consumer protection sits with the CNPF under Law No. 189/2025 (art. I), and insurers file policy conditions, premiums and contract templates with it within 30 days (Law No. 92/2022, art. 87(3)).

2. Licensing and authorisation

Insurance or reinsurance business may be carried on in Moldova only under a licence issued by the NBM (Law No. 92/2022, art. 9(1)). There is no separate online licence.

Insurers

An insurer must be a joint-stock company (third-country branches excepted, art. 9(2)). Under art. 10, the NBM first grants prior approval of incorporation (decision within five months); the company then has five months to apply for the licence, which the NBM decides within two months of a complete file. The fee is 50,000 lei. The absolute floor of the minimum capital requirement (art. 74) is the lei equivalent of:

• EUR 2,200,000 for general insurers;
• EUR 3,200,000 for general insurers writing any of classes 10 to 15 (motor, aviation, marine and general liability, credit and suretyship);
• EUR 3,200,000 for life insurers and for pure reinsurers (composites add the relevant amounts).

A new insurer must hold this floor in cash, paid in by its founders, at state registration (art. 74(2)). Art. 123(1) phases in the full minimum capital requirement, reaching 100% on 1 January 2028.

Intermediaries

• Insurance agents act under an insurer's written mandate and may sell only once entered in the NBM's register (fee 200 lei for individuals, 2,000 lei for legal entities; art. 107).
• Bancassurance agents must be banks, savings and loan associations or non-bank credit organisations, with professional liability cover of at least 5 million lei per claim.
• Brokers need their own NBM licence (art. 110).

An embedded-insurance partner that helps customers conclude contracts needs one of these statuses; incidental information and claims handling are not intermediation (art. 106(2)).

3. AML, KYC and customer due diligence

Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing (last amended by Law No. 146/2026, in force 13 August 2026) applies to some insurance firms only. Its art. 4(1)(e) covers insurers, reinsurers and intermediaries that operate within the life insurance classes, including investment-linked insurance. Non-life insurers and intermediaries are not reporting entities and have no statutory customer due diligence (CDD) duty.

The NBM supervises the life sector for AML (art. 15(1)(a)). Its detailed rules are in NBM Regulation No. 280 of 7 November 2024 on anti-money laundering and counter-terrorist financing (AML/CFT) requirements for non-bank financial institutions, which expressly covers life insurers and life intermediaries (point 1).

When CDD applies

CDD applies when a relationship starts, to occasional transactions over 20,000 lei (single, through payment service providers) or over 200,000 lei (linked), and on suspicion or doubt (art. 5(1)). Regulation 280 (point 25) sets the minimum data, including identity document details and the personal identification number (IDNP), occupation and source of income. Data are refreshed every one, two or three years for high, medium and low-risk customers (point 38).

Life-policy beneficiaries

At issuance

Record the name of each beneficiary named in the policy. For beneficiaries designated by class, obtain enough information to identify them at payout (art. 5(1^1)).

At payout

Verify the beneficiary's identity (art. 5(1^2)) and, at the latest then, check whether the beneficiary or its beneficial owner is a politically exposed person (art. 8(7)).

On assignment

Identify the beneficial owner who receives the policy's value when it is assigned (art. 5(1^2)).

Higher-risk payout

Inform senior management before payment, scrutinise the whole relationship and report the payout to the SPCSB (art. 8(7)).

Simplified and enhanced due diligence

Simplified CDD may apply to low-risk cases, never on suspicion; lower-risk factors include life policies with an annual premium up to 20,000 lei or a single premium up to 50,000 lei (art. 7). Verification may then follow the start of the relationship, within one month, with transactions blocked or limited until it is done (Regulation 280, point 53).

A beneficial owner is a person who holds more than 25% directly or indirectly (art. 5^2).

Reporting and records

Under art. 11, suspicious activity is reported to the SPCSB within 24 hours; cash transactions of at least 200,000 lei in a month by the 5th of the next month; other single transactions of at least 200,000 lei by the 10th. Records are kept for five years after the relationship ends or after the occasional transaction (art. 9). If CDD cannot be completed, the insurer must not start, or must end, the relationship and report to the SPCSB (art. 5(3)). Reports are filed through the SPCSB's goAML platform.

4. Identity verification and onboarding

In person, the customer presents a valid photo identity document in original or as a certified copy (Regulation 280, point 36). Remote identification follows the NBM's electronic identification rules.

Electronic identification is permitted by art. 5^1 of Law No. 308/2017 and detailed in NBM Regulation No. 281 of 7 November 2024 (the e-KYC Regulation), which applies to life insurers and intermediaries (point 3). It is available only for Moldovan citizens and resident legal entities whose representatives, founders, administrators and beneficial owners are all Moldovan citizens (point 13).

The insurer chooses, by risk, a qualified electronic signature, live video with liveness checks of the original identity document, a live photo with liveness checks, or a method offered by an accredited qualified trust service provider (point 21).

Automated solutions must detect movement, check document security features against the machine-readable zone (MRZ), reject copies and pre-recorded uploads, capture at least 8 megapixels or Full HD, and match the face to the document photograph (point 23).

Solutions must be certified against international standards, including ISO/IEC 30107 on biometric presentation attack detection (point 29). Operator-led video sessions are recorded without interruption (point 22).

An insurer may rely on another supervised reporting entity's CDD, but final responsibility stays with the insurer (art. 10 of Law No. 308/2017).

5. Digital channels: what's different

Bottom line: life and investment-linked policies can be sold fully online, but only to Moldovan citizens, through one of four NBM-prescribed methods, and only after the insurer has notified the NBM 30 days in advance; non-life policies carry no statutory identity-verification method either way.

Nationality, not product, decides who can go remote

The citizenship limit (art. 5^1(1); e-KYC Regulation, point 13) applies whatever the premium, so a foreign resident buying a savings policy online is still identified face to face. Electronic identification is not itself a higher-risk factor: art. 8(3) lit. c excludes customers "identified by electronic means", while art. 8(3) lit. j flags distance dealings without safeguards such as an electronic signature.

Remote-specific controls

The insurer captures device data, IP address and location (point 24), verifies phone or email by one-time password (point 25) and controls VPN and proxy masking (point 16). Enhanced due diligence is mandatory for remote applicants previously exited for failed CDD, residents of high-risk jurisdictions and trustees (point 38).

Timing, evidence and motor policies

The first transaction may run only after all CDD measures are complete (point 5(d)). Recordings, screenshots, document copies, device fingerprint and IP data are kept for five years after the relationship ends (point 46). Compulsory motor liability (RCA) contracts may be concluded electronically, and paying the premium counts as consent if the customer does not sign (Law No. 106/2022, art. 8(1)). Accident reports can be completed in the government e-services app when both drivers identify electronically (art. 21(2^1)).

Pending changes

Law No. 144/2025 rewrites art. 5^1(1) to admit EU citizens who hold a qualified certificate issued by an EU trust service provider. [Adopted, effective date not yet set] It applies once the technical conditions in art. XVIII(4) exist. The NBM's draft amendment to the e-KYC Regulation would require high-assurance eID (including EU-notified means, the EVO app and the EU Digital Identity Wallet), authentication of EU identity documents only by chip (NFC) reading or the EU Digital Identity Wallet, and presentation attack detection certified to at least PAD Level 2 under ISO/IEC 30107-3. [Proposed, consultation closed 2 Mar 2026]

6. Data protection and biometrics

Law No. 195 of 25 July 2024 on personal data protection, modelled on the EU General Data Protection Regulation, has applied since 23 August 2026. It repealed Law No. 133/2011 (art. 90(3)), which Regulations 280 and 281 still cite; consent obtained under the old law remains valid if it meets the new conditions (art. 90(8)).

Facial images used for liveness and face matching are biometric data for unique identification, a special category under art. 9, processed only under an art. 9(2) exception such as explicit consent. The e-KYC Regulation requires consent before identification (point 19) and an impact assessment before launch (point 6(b)). Large-scale biometric processing is on the CNPDCP's list of operations needing one (Order No. 27/2022, as amended).

Fines reach 2,000,000 lei or 2% of total annual turnover, whichever is higher (art. 88(2)), applied at 10% of the amount set in the first year, 40% in the second and in full from the third (art. 90(4)).

7. Sector-specific obligations

AML programme and distribution channels

Regulation 280 requires an AML programme naming life insurance as vulnerable (point 12), yearly review of monitoring (point 39) and risk assessment by channel, including agents and online sales (point 18(4)).

AML training certificates

Law No. 146/2026 inserted art. 13^1 into Law No. 308/2017. In life insurers and life intermediaries, the senior manager responsible for AML compliance, the compliance officer and compliance staff must hold a valid AML training certificate, renewed at least every three years. If a certificate is missing, the insurer gets up to three months to remedy it (art. 13^1(2)).

Restrictive measures

Under art. 28 of Law No. 25 of 4 March 2016 on the application of international restrictive measures (last amended by Law No. 244/2025, in force 23 July 2025), a reporting entity checks whether its customers are subjects of restrictions, freezes their funds, informs the State Tax Service within 24 hours and keeps the freeze until it decides. The national register of sanctioned subjects is published on date.gov.md.

Product information before sale

Since 25 June 2026, art. 89^1 of Law No. 92/2022 requires the insurer or intermediary, before concluding any insurance contract, to assess the consumer's demands and needs; for general (non-life) products it must also provide a standard product information document, free and in Romanian unless otherwise agreed. CNPF Decision No. 60/1 of 16 December 2025 sets the format and delivery rules. Online delivery is allowed:

• on another durable medium, if the customer was offered paper and chose otherwise (point 24);
• on a website or app, with consent and the address sent electronically (point 25).

A free paper copy must be given on request (point 23).

8. Risk indicators and red flags

The SPCSB's 2025 national risk assessment rates life insurance as low risk (about 26,000 contracts, no non-resident business) but flags reliance on brokers, who intermediate 88 to 89% of activity, and the absence of suspicious transaction reports in 2021 to 2024.

Life insurance indicators (NBM Regulation 280, point 57(b))

• Indifference to the product: no interest in policy features, or a product that does not fit.
• Early unexplained cancellation: surrender despite penalties, refunds to a different account.
• Premiums out of line: premiums high against income, or unusual increases in sum insured.
• Overpayment and refund: excess premiums followed by a refund request, or premiums paid by unconnected third parties.
• Late beneficiary change: the insurer learns of a new beneficiary only when a claim is filed.
• Cross-border spread: insurer, customer, beneficiary or beneficial owner in different or high-risk jurisdictions.

9. Enforcement and penalties

• AML breaches (art. 35 of Law No. 308/2017). Sanctions range from public statements to licence withdrawal. For life insurers and intermediaries, fines reach twice the benefit derived, or the lei equivalent of EUR 5,000,000 or 10% of the previous year's turnover.
• Insurance law breaches (art. 122 of Law No. 92/2022). The NBM may fine an insurer up to 15% of its minimum capital requirement and an intermediary up to 15% of its share capital. Managers and key-function holders face fines of 1 to 100 times their average salary, other individuals up to 1 million lei; licences can be suspended or withdrawn.

Recent NBM actions, as published by the NBM:

• A fine of 2,015,365.12 lei on Intact Asigurări Generale SA for underwriting-risk, governance and internal-control breaches (decision No. 246 of 5 November 2025; the NBM rejected the prior challenge, and the decision has been challenged at the Chișinău Court of Appeal).
• A fine of 264,292.57 lei on the administrator of an insurance agent, partly for issuing motor policies without collecting the full premium (decision No. 180 of 30 July 2026).

10. Recent changes and what to watch

• 23 August 2026[In force] Law No. 195/2024 on personal data protection applies, including its biometric special-category rules.
• 13 August 2026[In force] Law No. 146/2026 adds art. 13^1 to Law No. 308/2017: AML compliance managers and staff of life insurers and intermediaries need a valid training certificate, renewed at least every three years.
• 25 June 2026[In force] Art. 89^1 of Law No. 92/2022 and CNPF Decision No. 60/1/2025 require a needs assessment and a standard product information document, deliverable by website or app with consent.
• 16 February 2026[Proposed, consultation closed 2 Mar 2026] The NBM's draft e-KYC amendment would require high-assurance eID, recognise the EU Digital Identity Wallet and give existing remote solutions 12 months to meet its certification rules.
• 25 October 2025[In force] Law No. 189/2025 brings insurers and intermediaries under the CNPF's consumer protection supervision.
• 20 June 2025[Adopted, effective date not yet set] Law No. 144/2025 opens remote identification to EU citizens with qualified certificates, once trust service providers certified under Government Decision No. 977/2023 can perform it.

11. What this means for identity verification

• Route by product and nationality first. Life journeys need the e-KYC flow for Moldovan citizens and a face-to-face fallback for others; non-life journeys need no statutory method.
• Check the original document with certified liveness. Verify security features and MRZ, block copies and pre-recorded uploads, and keep the ISO/IEC 30107 certificate for the NBM notification; for EU documents, the draft would require NFC or the EU wallet.
• Log the session, not just the result. Device, IP, location, OTP and media records join the five-year file.
• Plan for a second identity event at payout. Verify and PEP-screen the beneficiary before paying a life claim or on assignment.
• Re-verify on a schedule. Refresh data every one, two or three years by risk; the remote solution may be reused for updates (e-KYC Regulation, point 30).