Insurance & Insurtech Compliance in Romania

Romania is open to digital insurers and insurtech distributors. There is no separate online licence: the same ASF authorisation or intermediary registration covers branches, brokers, websites and apps, and ASF's distribution rules set out who may run an online sales platform.

The ASF is the single licensing and anti-money laundering supervisor for the sector. Suspicious transaction and cash reports go to the National Office for the Prevention and Combating of Money Laundering (ONPCSB), Romania's financial intelligence unit.

The main obstacle for a new life or savings product is the beneficiary and payout regime: verification, politically exposed person checks and senior management sign-off happen at claim time, often years after the sale, so the payout journey needs the same identity design effort as onboarding.

1. Who regulates this sector

Licensing is national: Romania is a unitary state, and there are no regional insurance regulators.

2. Licensing and authorisation

Insurers and reinsurers

Under Law no. 237/2015 on the authorisation and supervision of insurance and reinsurance activity (Official Gazette Part I no. 800 of 28 October 2015), the ASF authorises companies to carry on insurance or reinsurance and to extend into classes not covered by the original authorisation (art. 20(1)). An insurance authorisation is granted either for life business or for general business (art. 20(3)), and a Romanian company must have its registered office and head office in Romania (art. 20(2)). Insurers authorised in another EU member state can operate under the right of establishment or the freedom to provide services (Chapter IX).

Carrying on insurance or reinsurance without an ASF authorisation, or without entry in the register of companies, is a criminal offence punishable by six months to three years in prison or a fine (art. 164(1)).

Intermediaries and embedded insurance

Law no. 236/2018 on insurance distribution (Official Gazette Part I no. 853 of 8 October 2018) governs agents, brokers and the registration of intermediaries with the ASF. Retailers, travel firms and platforms that sell cover complementary to their own goods or services act as ancillary insurance intermediaries (art. 3 pt. 12). They fall outside the law entirely when the cover protects against breakdown, loss or damage of the goods, or travel risks, and the premium does not exceed the lei equivalent of EUR 600 a year, or EUR 200 per person for services of three months or less (art. 2(1)). The insurer or intermediary behind an exempt seller must still give the customer prescribed information before the contract is concluded (art. 2(2)).

3. AML, KYC and customer due diligence

Which insurance business is in scope

Law no. 129/2019 on preventing and combating money laundering and terrorist financing (Official Gazette Part I no. 589 of 18 July 2019) treats as financial institutions, since its amendment by Law no. 315/2021 with effect from 1 January 2022:

• insurers when they carry on or distribute insurance-based investment products, life insurance (Annex 1 section C to Law 237/2015) or suretyship insurance (class 15 in Annex 1 section A) (art. 2(g)(2));
• insurance intermediaries when they distribute those products, except secondary intermediaries working under the full responsibility of a principal intermediary or insurer (art. 2(g)(2^1));
• all reinsurers, including captives, and reinsurance intermediaries (art. 2(g)(2^2)).

The ASF supervises these firms for AML purposes (art. 26(1)(a)) and has issued ASF Regulation no. 13/2019 (Official Gazette Part I no. 991 of 10 December 2019, amended most recently by Regulation 18/2022), whose Annex 2 sets risk factors and due diligence examples for life insurers and life intermediaries.

When and how due diligence applies

Triggers

On establishing a business relationship, and for occasional transactions of at least the lei equivalent of EUR 15,000, single or linked (Law 129/2019 art. 13(1)).

Standard measures

Identify and verify the customer from reliable, independent documents, data or information, the beneficial owner, and the purpose of the relationship (art. 11(1)). ASF Regulation 13/2019 art. 22(1) lists the data to collect, including the personal numeric code (CNP), occupation and source of funds.

Policy beneficiaries

For life and investment-linked policies, obtain the beneficiary's name (or enough information on a class of beneficiaries) when designated, and verify identity no later than payout or assignment (art. 13(4)-(5); ASF Regulation 13/2019 art. 25(8)).

Politically exposed beneficiaries

Take reasonable measures, no later than payout or assignment, to establish whether the beneficiary or its beneficial owner is politically exposed (art. 17(11)-(12)). If risk is higher: inform senior management before payout, scrutinise the whole relationship, and file a suspicious transaction report where a politically exposed beneficiary is involved and grounds for suspicion arise (art. 17(13)).

Life policies with annual premiums up to the lei equivalent of EUR 1,000, or a single premium up to EUR 2,500, are listed as a lower-risk factor (art. 16(2)(b)); simplified measures are allowed only for customers actually rated low risk (art. 16(1)).

Reporting and records

Suspicious transactions are reported to ONPCSB immediately and before any related transaction is carried out (arts. 6 and 8(1)). Cash transactions of at least the lei equivalent of EUR 10,000, including linked operations, are reported within three working days (art. 7(1) and (7)). Due diligence records are kept for five years after the relationship ends (art. 21(1)). Beneficial owners of corporate policyholders are checked against the central register kept by the National Trade Register Office (art. 19).

4. Identity verification and onboarding

ASF Regulation 13/2019 art. 22(6) requires verification against documents that are among the hardest to forge, such as an official photo identity document, or through the electronic identification means provided for by Law 129/2019. Data that documents cannot prove is checked against other credible, independent sources such as public registers and databases (art. 22(7)).

Romanian electronic identity cards

Some of the new electronic identity cards do not show the holder's address, which is a mandatory field in reports to ONPCSB. ONPCSB states that firms must find their own way to obtain it, for example the Ministry of Internal Affairs' free RO CEI READER app, which reads the card's chip, including the address, once the holder enters their PIN.

Remote and electronic methods

Law 129/2019 art. 11(1)(a) accepts electronic identification means and trust services under the eIDAS Regulation, or any other secure remote or electronic identification process regulated, recognised, approved or accepted at national level by the Authority for the Digitalisation of Romania. ADR's norms on remote identification by video means (President's Decision no. 564/2021, Official Gazette Part I no. 1119 of 24 November 2021) allow Romanian-registered providers to perform video identification only after obtaining an ADR endorsement (art. 3(1)), and ADR publishes the list of third-party identity verifiers.

Through ASF Instruction no. 4 of 11 October 2023, the ASF applies the European Banking Authority's Guidelines on remote customer onboarding solutions (EBA/GL/2022/15) to the firms covered by its AML regulation, with compliance required by 30 June 2024 (art. 9(2)). Unassisted solutions need liveness detection and algorithmic matching of the selfie to the document photo; assisted video sessions need trained staff, an interview guide and randomised checks; the process must stop if image quality or the connection fails.

5. Digital channels: what's different

Bottom line: online sale and onboarding are permitted on the same licence, but a remote relationship without electronic identification or trust services counts as a higher-risk factor, and the ASF expects every remote onboarding tool to be assessed, tested and monitored.

Remote sale as a risk factor

Law 129/2019 art. 17 lists remote relationships "without certain safeguards", such as electronic identification means or eIDAS trust services, among higher-risk factors. ASF Regulation 13/2019 Annex 2 (point 3.1) repeats this for life business, naming online, postal and telephone sales without electronic signature or eIDAS identification, together with long intermediary chains.

Online sales platforms

ASF Norm no. 22/2021 on insurance distribution (Official Gazette Part I no. 835 of 1 September 2021), Chapter VI, lets insurers and principal intermediaries build or deploy online sales systems (art. 42(2)). Platforms built by secondary intermediaries must be checked by the insurer or principal intermediary, including for customer identification measures (art. 42(3)), and exempt ancillary sellers can sell online only through, or with functionality supplied by, an insurer's or principal intermediary's platform (art. 42(7)-(8)). Annex 16 sets presentation, content and security requirements.

Pending

ASF draft norm amending Norm 22/2021 [Proposed, consultation closed 22 Aug 2026] aims, among other things, to make greater use of electronic means between distributors, the ASF and consumers.

6. Data protection and biometrics

The General Data Protection Regulation (Regulation (EU) 2016/679) applies directly, supplemented by Law no. 190/2018 (Official Gazette Part I no. 651 of 26 July 2018). Facial templates used to uniquely identify a person are biometric data, and underwriting often involves health data; both are special categories under GDPR art. 9.

• Automated decisions: processing genetic, biometric or health data for automated decision-making or profiling is permitted with the person's explicit consent or under express legal provisions with safeguards (Law 190/2018 art. 3).
• Personal numeric code: where the CNP, or documents carrying it, is processed on the basis of legitimate interests, the firm must appoint a data protection officer, minimise and secure the data, set retention and review periods and train staff (art. 4).
• Retention: the five-year AML retention period in Law 129/2019 art. 21 is the legal basis for keeping onboarding evidence, including images and session records captured under ASF Instruction 4/2023.

7. Sector-specific obligations

Sanctions screening for every insurer

ASF Regulation no. 3/2025 on supervising the application of international sanctions (Official Gazette Part I no. 689 of 23 July 2025, applicable from 21 September 2025) covers all ASF-regulated entities, including non-life insurers outside the AML regime. Article 6(1) requires screening systems that detect designated persons and entities among prospective customers, occasional transaction applicants and existing customers, plus a sanctions-evasion risk assessment covering customer, product, transaction and distribution channel, and procedures for frozen funds.

Intermediary oversight

ASF Regulation 13/2019 Annex 2 treats reliance on intermediaries as a risk factor in both directions: long chains or unexplained use of intermediaries raise risk, while an insurer that has satisfied itself that the intermediary applies proportionate due diligence reduces it. Secondary intermediaries are outside Law 129/2019, so the insurer or principal intermediary carries their customer identification obligations.

Free-look cancellations and payouts

Where a policyholder cancels within the free-look period in a high-risk situation, Annex 2 expects the premium to be refunded to the bank account it came from and identity to be verified before the refund. Other enhanced measures include verifying third-party payers and beneficiaries before the relationship starts and requiring the first premium to come from an account in the customer's name at a bank applying equivalent due diligence.

Digital operational resilience

Regulation (EU) 2022/2554 on digital operational resilience (DORA) has applied since 17 January 2025 to insurers, reinsurers and intermediaries other than micro, small and medium-sized intermediaries; Romania adopted implementing measures in Government Emergency Ordinance no. 14/2026.

8. Risk indicators and red flags

Life and investment-linked insurance (ASF Regulation 13/2019, Annex 2)

• Early surrender: frequent or unexplained cancellations, especially with refunds to different bank accounts, or accepting heavy surrender costs.
• Free-look abuse: repeated use of the cancellation period, with refunds to an apparently unconnected third party.
• Late beneficiary change: the insurer learns of a new beneficiary only when the claim is filed.
• Unrelated parties: policy assigned, or beneficiary changed, to an apparently unconnected third party.
• Payment pattern: cash or anonymous payment vehicles, payments from several accounts without explanation, or from banks outside the customer's country.
• Profile mismatch: contract inconsistent with the customer's wealth, or an age unusual for the product.
• Opaque ownership: policyholder or beneficiary with nominee shareholders or bearer shares, or a trust company acting for the customer.
• Cross-border spread: insurer, customer, beneficiary and beneficial owner in different jurisdictions.

9. Enforcement and penalties

For AML breaches by a financial institution supervised by the ASF, Law 129/2019 art. 43(7) provides for a warning or a fine of 10,000 to 23,000,000 lei for individuals, and for legal persons a warning or a fine of 10,000 to 23,000,000 lei or up to 10% of total annual turnover based on the latest approved financial statements. Sanctions can also be applied to members of the management body and other responsible individuals (art. 43(3)). Complementary sanctions include suspension of the authorisation for one to six months, withdrawal of a licence, closure of a branch and a public statement naming the firm and the breach (art. 44(1)).

The ASF publishes its sanctioning decisions by year. In December 2025 it fined OTTO BROKER DE ASIGURARE S.R.L. 10,000 lei (Decision no. 1152 of 2 December 2025) for breaches of art. 24(6) and art. 7(3) and (7) of Law 129/2019, read with ASF Regulation 13/2019, and issued a written warning to another broker for an art. 24(6) breach (Decision no. 1155 of 3 December 2025).

10. Recent changes and what to watch

• 10 July 2027: Regulation (EU) 2024/1624 (AML Regulation) [Adopted, applies 10 Jul 2027]. It covers insurers carrying out life or other investment-related business and allows verification with eIDAS electronic identification at assurance level substantial or high (art. 22(6)); expect ASF Regulation 13/2019 to be revised.
• 23 July 2026: ASF draft norm amending Norm 22/2021 on insurance distribution [Proposed, consultation closed 22 Aug 2026]. New distributor categories and more use of electronic communication.
• 21 September 2025: ASF Regulation 3/2025 on international sanctions [In force]. Screening of prospective and existing customers for all ASF-regulated firms.
• 23 May 2025: Law no. 86/2025 amending Law 129/2019 [In force]. Adds a suspicious transaction report when a politically exposed person is a life policy beneficiary and grounds for suspicion exist, and a duty to assess risks before launching new products and technologies (art. 25^1).
• 30 June 2024: compliance deadline under ASF Instruction 4/2023 on remote customer onboarding [In force]. Remote onboarding tools must meet the EBA guidelines.

11. What this means for identity verification

• Scope by product: life, investment-linked and suretyship products need full customer due diligence; non-life products need sanctions screening and the identification required by distribution rules.
• Documents: support Romanian electronic identity cards, including reading the chip to obtain the address, alongside passports and EU identity cards.
• Remote methods: eIDAS electronic identification and trust services carry the lowest remote risk; video identification providers registered in Romania need an ADR endorsement.
• Biometrics: liveness detection and selfie-to-document matching are expected for unassisted remote onboarding, with explicit consent where biometric data feeds automated decisions.
• Two moments of truth: identify at onboarding and re-verify the beneficiary, including politically exposed person status, at payout or assignment.
• Evidence: keep identity evidence and session records for five years after the relationship ends.