Telecom & Mobile Services Compliance in Moldova

The Moldovan market is open to new mobile, MVNO and internet providers under a general authorisation regime set by Law No. 72/2025, which partly transposes the European Electronic Communications Code. The National Agency for Regulation in Communications (ARCOM) is the sector regulator; the National Center for Personal Data Protection supervises the handling of subscriber data.

The biggest change for any operator is the end of anonymous prepaid SIM cards. Law No. 215 of 17 September 2026 introduced mandatory identification of all mobile users, anti-spoofing duties and new fines. The method rules are set in the law, but as of 5 November 2026 ARCOM had not yet adopted the procedure for identifying minors or the minimum services available before identification is complete.

1. Who regulates this sector

The Electronic Communications Law, Legea comunicațiilor electronice nr. 72/2025 [Law No. 72 of 10 April 2025 on electronic communications], designates ARCOM as the authority with regulatory, monitoring and control powers over electronic communications networks and services (art. 7). Its former name, used in older acts, was ANRCETI; the change took effect on 1 January 2026 (ARCOM Board Decision No. 50 of 9 December 2025).

2. Licensing and authorisation

Law No. 72/2025 replaced Law No. 241/2007 on 1 January 2026, except end-user rights, where Law No. 241/2007's chapter remains in force until, and the matching articles of Law No. 72/2025 (including art. 103) apply from, 24 months after publication on 13 May 2025 (art. 127(1), (4)).

General authorisation by notification

Providing public networks or publicly available services, other than number-independent interpersonal services, needs only a free general authorisation obtained by a standardised notification to ARCOM (art. 17). No individual decision is needed: the provider may start once the notification is filed. ARCOM Board Decision No. 3 of 29 January 2026 sets the procedure: a standard form filed online, with an electronic signature, in person or by post; ARCOM confirms entry in the public register, and changes must be notified within 10 working days.

Rights of use for numbers and spectrum

Operators holding their own number ranges need rights of use for numbering resources (art. 92) and, for network operators, radio spectrum (art. 48); licences issued under Law No. 241/2007 stay valid until they expire. A provider of publicly available services (art. 2, point 37) need not own a network, so MVNOs carry the identification duties below. Breaches expose providers to ARCOM measures and fines (arts. 34 and 35).

3. Identity framework (AML rules do not apply)

Telecom operators are not reporting entities under Legea nr. 308/2017 cu privire la prevenirea și combaterea spălării banilor și finanțării terorismului [Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing]: the list in art. 4(1) does not include electronic communications providers. An operator that also runs a payment or e-money business is covered for that activity only (art. 4(1)(i)).

Customer identification in telecom is instead governed by art. 125¹ of Law No. 72/2025, inserted by Law No. 215 of 17 September 2026 on preventing fraud through electronic communications and identifying prepaid mobile users [In force 20 Oct 2026]. It sets an identification duty only, with no risk-based due diligence, beneficial ownership tests or suspicious activity reporting.

Who must identify

Providers of publicly available mobile communications services, for every user, whether on a subscription or a prepaid card (art. 125¹(1)).

When

At the conclusion of a subscription contract or, for prepaid cards, at the latest at activation. The transition dates cover only prepaid numbers; the Ministry of Internal Affairs' explanatory note on the draft law records that operators already identify contract customers.

Legal persons

Moldovan entities: name, IDNO and the representative's identity data. Foreign entities: name, country, foreign registration number, representative's data and a kept copy of the registration document.

Records

Identification data, document copies and the identification process log, kept for the whole period of use plus 12 months after the number stops being used (art. 125¹(5)).

Separately, art. 125 requires retention of traffic and subscriber data (including IDNP, IMSI, SIM serial number and IMEI) for 12 months for telephony and 6 months for internet services.

4. Identity verification and onboarding

Data to collect and documents

For Moldovan identity documents, the operator collects name, personal identification number (IDNP) and document type, series and number, and checks the data and validity (art. 125¹(2)(a)). For foreign documents it also records the expiry date and keeps a copy (art. 125¹(2)(b)).

Permitted methods

The operator chooses one or more of these methods (art. 125¹(3)):

• at its own points of sale, or at those of persons it authorises by contract;
• remotely through electronic identification, a qualified electronic signature or a qualified trust service provider, under Legea nr. 124/2022 privind identificarea electronică și serviciile de încredere [Law No. 124 of 19 May 2022 on electronic identification and trust services];
• remotely through digital means: the identity document presented, facial biometric measurements, image comparison and information the person provides;
• other electronic means of the operator, where the user's data were previously verified for another number by one of the methods above;
• exchange of information with payment service providers that run identification processes and solutions authorised by the National Bank of Moldova.

Technical standards behind each route

Art. 125¹ sets no liveness standard, assurance level or certification for the operator's own biometric check; the Ministry of Internal Affairs' explanatory note on the draft law leaves technical details to secondary acts. The other routes have their own rules:

• Qualified trust service providers, supervised by the Information and Security Service (Law No. 124/2022, art. 35), using the optional remote methods of Government Decision No. 977 of 6 December 2023 must accept only identity cards or passports, use facial matching with liveness detection, accept only cryptographically verifiable documents for fully automated checks, and notify the Service 30 days in advance.
• Payment service providers and other National Bank-supervised entities identifying clients remotely follow the e-KYC Regulation (National Bank Decision No. 281 of 7 November 2024), which limits remote identification to Moldovan citizens (point 13). Art. 125¹ refers to solutions "authorised" by the National Bank, but neither Law No. 308/2017 (art. 5¹(3)) nor the Regulation provides for approving them: the Regulation requires a one-time notice 30 days before use (points 49 and 50) and lets the National Bank make a provider stop using a solution (point 52). Law No. 72/2025 does not say how the condition is met; ARCOM may issue explanatory notes (Law No. 215/2026, art. III(9)).
• State electronic identity services can be suspended at short notice: some MPass options and EVOSign were disabled after an October 2026 cyberattack. Check status on egov.md.

Minors and minimum services

Until identification is complete, a SIM or eSIM may be used only for minimum technical services set by ARCOM (art. 125¹(4)). Law No. 215/2026 (art. III(2)) gave ARCOM three months from 20 October 2026 to approve the procedure for identifying minors and the minimum services rules [ARCOM rules pending].

5. Digital channels: what's different

Bottom line: the identification duty, the data collected and the retention period are the same in a shop and online; what differs online is the set of accepted methods, which adds electronic identification, qualified trust services, facial biometric comparison and payment provider data.

Remote identification and reuse

The operator's own digital method (art. 125¹(3)(3)(b)) is not limited to Moldovan documents, and the law requires no human operator or prior ARCOM approval for it; it sets no technical requirements for the checks, and the operator must log the identification process (art. 125¹(5)).

Number porting and SIM replacement

Under ARCOM's Number Portability Regulation (Board Decision No. 34 of 1 December 2011, last amended 24 June 2022), the recipient operator checks at least the applicant's identity document, the SIM or eSIM, the number and, where applicable, the PUK code; the donor may refuse if identification data do not match or the SIM is reported lost or stolen. ARCOM's Technical and Commercial Conditions for porting (Decision No. 8 of 26 February 2013) add a standard request form, copies of identity documents kept for at least 12 months and, for unregistered prepaid numbers, a photocopy of the SIM card. Neither act provides for filing a porting request remotely; porting takes up to 5 working days. Both were adopted under Law No. 241/2007; Decision No. 34/2011 is still shown as in force in the State Register, repeal of an enabling law is not a ground on which a normative act ceases (Law No. 100/2017, art. 74), and ARCOM has until May 2027 to align its acts (Law No. 72/2025, art. 127(3)). From then, art. 103 requires activation within one working day.

ARCOM's draft Regulation on contractual rights and obligations [Proposed, comments close 9 Nov 2026] would allow SIM or eSIM replacement only at the rightful holder's request and after identifying them, and let operators refuse SIM unblocking when the requester cannot prove identity. It proposes entry into force on 1 December 2026.

6. Data protection and biometrics

Legea nr. 195/2024 privind protecția datelor cu caracter personal [Law No. 195 of 25 July 2024 on personal data protection], modelled on the GDPR, applies from 23 August 2026. Biometric data used to uniquely identify a person are a special category, prohibited unless an art. 9(2) exception applies, such as explicit consent. Art. 125¹ makes facial biometrics one optional method, not a requirement. Art. 115 of Law No. 72/2025 requires security measures that CNPDCP may verify. Breaching the special-category rules can cost up to 2,000,000 lei or 2% of annual turnover, whichever is higher (art. 88(2)).

7. Sector-specific obligations

Deadlines for existing prepaid users

Under Law No. 215/2026, art. III, new prepaid activations need identification from 1 March 2027 [Adopted, applies 1 Mar 2027]; users of prepaid numbers activated since 1 September 2026 must be identified by 1 June 2027, older numbers by 31 August 2027. Unidentified numbers are limited to incoming calls and minimum services until identified.

Caller ID spoofing and SIM boxes

Art. 95¹ requires providers to detect and block calls from abroad that show a Moldovan number with signs of caller ID substitution, under conditions ARCOM sets, and to prohibit fraudulent number use in user contracts. Equipment or routing that generates, transits or terminates spoofed calls, including SIM boxes and GSM gateways, is prohibited.

ARCOM Board Decision No. 29 of 6 August 2026 [In force] obliges Moldtelecom, Orange Moldova and Moldcell to run an interoperator caller ID check through the GSMA Open Gateway Number Verification API: a roaming presence check by 1 October 2026, readiness for further checks by 1 February 2027, and quarterly reports to ARCOM from 1 January 2027. ARCOM's CLI spoofing guide (Decision No. 33/2025, amended by Decision No. 5/2026) notes that operators cannot prevent number substitution in calls made through internet apps.

Blocking of unlicensed gambling sites

On ARCOM's decision, providers must immediately block access from Moldova to gambling sites and apps on the Public Services Agency's list of unauthorised sources, and inform users (Legea nr. 291/2016 cu privire la organizarea și desfășurarea jocurilor de noroc [Law No. 291 of 16 December 2016 on gambling], art. 50¹(3)). ARCOM notified an updated list on 2 November 2026.

8. Risk indicators and red flags

Telecom fraud and identity-abuse indicators (ARCOM, Law No. 72/2025, E-Government Agency)

• Data-only identity claims: personal data linked to about 750,000 IDNPs were extracted in an October 2026 cyberattack on government systems, so knowing a name and IDNP is a weak check on its own.
• Spoofed local numbers: calls from abroad displaying a Moldovan mobile number as caller ID.
• SIM box or GSM gateway use: equipment that generates, transits or terminates calls with a substituted caller ID (art. 95¹(3)).
• "Update your SIM or contract" calls: callers posing as the operator to obtain codes or data.
• Requests for authentication codes or passwords: what fraudsters seek, according to ARCOM.
• Requests to install an app: used to gain access to the victim's device or accounts.
• Identity data mismatch at porting: applicant details that do not match the donor's subscriber.
• Porting of a SIM reported lost or stolen: a ground for the donor to refuse.

9. Enforcement and penalties

ARCOM ascertains and decides contraventions under arts. 246 to 259² of the Contravention Code (Code No. 218/2008, art. 410). Fines are set in conventional units; one unit equals 50 lei (art. 34). Art. 252², added by Law No. 215/2026, sets fines per contravention:

Paragraph (4) applies only once ARCOM's implementation deadlines expire (Law No. 215/2026, art. III(8)). Obstructing ARCOM or refusing it information is a separate contravention (art. 259²; 120 to 240 units for legal entities). In 2025 ARCOM ran 32 inspections in communications and postal services, found non-compliance in 19 and drew up contravention reports under art. 259² in 2 of them (ARCOM control report for 2025). Data protection fines are applied by CNPDCP (Law No. 195/2024, art. 87).

10. Recent changes and what to watch

• 1 March to 31 August 2027[Adopted, phased dates]: prepaid identification at activation, then for existing users by 1 June or 31 August 2027.
• By January 2027[ARCOM rules pending]: ARCOM must approve the minors identification procedure, minimum technical services and anti-spoofing criteria and procedures.
• 9 November 2026[Consultation closes 9 Nov 2026]: ARCOM draft regulations on information and user protection, and on contractual rights and obligations, including identity checks before SIM or eSIM replacement; proposed start 1 December 2026.
• 20 October 2026[In force]: Law No. 215/2026 inserted art. 95¹ (spoofing) and art. 125¹ (identification) into Law No. 72/2025 and added fines in art. 252² of the Contravention Code.
• 23 August 2026[In force]: Law No. 195/2024 on personal data protection replaced Law No. 133/2011, with GDPR-style rules on biometric data.
• 6 August 2026[In force]: ARCOM Board Decision No. 29/2026 requires the three mobile network operators to verify caller ID on incoming international calls through the Number Verification API.
• 1 January 2026[Partly in force]: Law No. 72/2025 replaced Law No. 241/2007, except end-user rights, which switch over in May 2027.

11. What this means for identity verification

• Documents: Moldovan documents with IDNP and validity checks; foreign documents with expiry date and a stored copy.
• Remote methods: the operator may offer several (art. 125¹(3)); state e-ID services can be suspended; a name and IDNP alone do not meet art. 125¹(2), which requires the document data and its validity to be checked.
• Biometrics: special-category data needing explicit consent or another art. 9(2) exception; the law also permits non-biometric methods.
• Evidence: a log of every identification step, kept with data and copies for the life of the number plus 12 months.
• Re-verification: identify the existing prepaid base before 1 June and 31 August 2027, then restrict unidentified numbers as the law requires.
• Porting and SIM replacement: porting already requires an identity document check (Decision No. 34/2011, point 33); ARCOM's draft would require identification before SIM or eSIM replacement.