Travel & Hospitality Compliance in Moldova

Moldova is open to online travel and hospitality businesses. There is no separate regime for booking platforms: tour operators and agencies work under the tourism law whatever the channel, and identity checks on travellers sit with the state (consular officers, the General Inspectorate for Migration and the Border Police) and with carriers at boarding.

The principal authorities are the Ministry of Economic Development and Digitalization for tourism, the National Bank of Moldova for hotel currency exchange, and the Border Police for entry checks and passenger data. The obstacle most often missed is the exchange licence: a hotel that buys foreign cash from guests takes on full customer due diligence, reporting and record-keeping duties.

1. Who regulates this sector

2. Licensing and authorisation

Tour operators and travel agencies. Law No. 352 of 24 November 2006 on the organisation and conduct of tourism activity (last amended by Law No. 154/2026, in force 13 September 2026) defines tour operators (art. 11) and travel agencies (art. 12). Both must notify the National Tourism Office through the electronic Inventory of tourism businesses that they have started trading and then file annual reports, under a regulation to be approved by the tourism ministry (art. 14(1)(o)), and must be run by directors holding a tourism training certificate (art. 14(1)(p)). The Inventory regulation is still being drafted: the ministry opened its preparation on 30 January 2026. The national list of permits (Law No. 160/2011, annex 1, as amended in force 29 September 2026) contains no licence, authorisation or certificate specific to tourism businesses; general permits on that list, such as alcohol or casino licences, still apply.

Accommodation. Accommodation structures follow the classification norms in Government Decision No. 643/2003 and may, but need not, obtain a classification certificate from the Public Services Agency (Law No. 352/2006, art. 18(2)). The ISSPNPC controls the quality of tourism services (Government Decision No. 466/2022, point 9(2)(b)).

Currency exchange. A hotel may buy foreign cash and travellers' cheques from guests only through its own exchange point or machines and under an NBM licence (Law No. 62/2008 on currency regulation, art. 41(2) letter c) and art. 41(6)). The point may sit at reception (art. 46). A hotel may also install self-service exchange machines, but only inside the hotel; each machine is capped at 5,000 lei per operation and must be able to identify the customer as Law No. 308/2017 requires (art. 42¹(2) and (4)). The NBM publishes the list of licensed hotel exchange points.

3. AML, KYC and customer due diligence

Law No. 308/2017 on preventing and combating money laundering and terrorist financing (last amended by Law No. 146/2026, in force 13 August 2026) does not name tour operators, agencies, accommodation providers or carriers among its reporting entities (art. 4(1)). Two categories reach into the sector: currency exchange units, including licensed hotels (art. 4(1)(b), supervised by the NBM), and traders in goods paid at least 200,000 lei in cash (art. 4(1)(m), supervised by the SPCSB).

Do travel services count as goods?

Art. 4(1)(m) and the matching due diligence trigger in art. 5(1)(f) apply to persons who sell goods. The law defines goods as assets of any kind, including instruments attesting a right (art. 3), and the Civil Code defines them as things and patrimonial rights (art. 455). Where the law covers service providers it names them, as with accounting (art. 4(1)(l)) and trust and company services (art. 4(1)(q)). The SPCSB's 2022 risk assessment describes the category as transposing the EU rule on large cash payments for goods, its 2025 assessment identifies the reporters as car dealers, construction companies and jewellers, and the SPCSB's reporting codes (Order No. 20/2023) list it only as persons selling goods for cash. On that reading, cash paid for accommodation, tours or transport does not by itself make a travel business a reporting entity, while a cash sale of goods of 200,000 lei or more does. On the competing reading, prepaid vouchers or tickets attest a right and could count as goods.

[Proposed, consultation closed 2 Nov 2026] A draft law that would replace Law No. 308/2017 on 10 July 2027 drops this category in favour of dealers in listed high-value goods. It would also amend Law No. 34/2024 so that anyone selling goods or providing services, including hotels and tour operators, may accept cash only up to EUR 10,000 per transaction, with State Tax Service fines of 3% to 10% of the excess. Hotels exchanging currency would be classed as financial institutions, all reporting entities would register with the SPCSB, and identity checks would apply to occasional cash transactions from EUR 2,000.

Due diligence at hotel exchange points

Using its power to issue AML rules (Law No. 308/2017, art. 15(2)(a)), the NBM sets a lower trigger for exchange units than the statute's general occasional-transaction tiers in the Regulation on AML and CFT requirements for currency exchange units (Decision No. 201/2018, last amended by Decision No. 20/2024):

Trigger

Cash exchange above 10,000 lei, suspicion of money laundering or terrorist financing, or doubts about earlier data (point 11).

Data collected

Name, birth date and place, citizenship, ID details, address, occupation, source of funds, beneficial owner (point 12).

Enhanced measures

Politically exposed persons, high-risk or sanctioned jurisdictions, repeated amounts near the threshold (point 26).

Reporting and records

Suspicions to the SPCSB within 24 hours; monthly cash of 200,000 lei or more by the 5th (point 31); 5-year retention (point 36).

Reporting entities must tell the State Tax Service within 24 hours of activity suspected of evading international sanctions and hold the transaction until it decides (Law No. 25/2016, art. 6(6)).

Cash carried by travellers

Travellers must declare in writing to customs cash, travellers' cheques, securities and payment instruments worth EUR 10,000 or more per person and journey, on entry or exit (Law No. 62/2008, art. 33(1), as amended by Law No. 124/2025). Taking out more than EUR 10,000 and up to EUR 50,000 also requires proof, such as the customs document recording the cash's entry (art. 29(1)).

4. Identity verification and onboarding

These rules come from Law No. 200/2010 on the regime of foreigners, Law No. 28/2024 on the state border and the National Air Transport Facilitation Programme (Government Decision No. 147/2022, last amended by Decision No. 171/2026). The programme requires Border Police automated border control that checks e-passport chip data and the traveller's biometrics (points 117 and 118). The tourism law and the classification criteria set no duty on hotels to record or report guests' identity documents. A hotel accommodation contract can serve as a digital nomad's proof of housing for provisional residence (Law No. 200/2010, art. 37²(2)(b)).

5. Digital channels: what's different

Bottom line: visa applications and cash declarations can move online, but the identity check at the border and at a hotel exchange desk stays in person; tourism and passenger data rules are channel-neutral.

eVisa: online application, unchanged border check

The MFA's consular directorate grants electronic visas (Law No. 200/2010, art. 20(1¹); Government Decision No. 50/2013, chapter X). The eVisa portal limits online applications to types B and C, at EUR 40 by card, decided within 10 calendar days (extendable to 20). Nationals who need an IGM invitation still need one, and the printed eVisa, passport, supporting documents and medical insurance are checked at the border.

Electronic filings

Since 1 July 2026 travellers can file customs and currency declarations on the Public Customs Portal before reaching the border. Provisional residence applications can be filed electronically with a qualified electronic signature (Law No. 200/2010, art. 32(2³)), issued under Law No. 124/2022. State e-services can be restricted at short notice; egov.md publishes their status.

Passenger data does not depend on the sales channel

Airlines transmit the PNR data they already collect for every passenger and crew member under Law No. 379/2023 (art. 17), so online bookings reach the state through the carrier's record.

[Adopted, effective 1 Jun 2027] Law No. 66/2026 lets residence applications be filed electronically with a qualified signature or another electronic identification means (art. 32(4)).

6. Data protection and biometrics

Law No. 195/2024 on personal data protection, which transposes the EU GDPR, applies since 23 August 2026 (art. 89). Biometric data used to identify a person uniquely are a special category, processed only under an exception such as explicit consent (art. 9), so face-based check-in or selfie matching needs that basis.

Tour operators and agencies must keep clients' names and addresses confidential (Law No. 352/2006, art. 14(1)(k)). Exchange units process data under the data protection law (Law No. 62/2008, art. 41(11)). Carriers delete API data sent to the Border Police and Customs within 24 hours of the passenger's arrival (Law No. 28/2024, art. 52(4)), while the Passenger Information Unit keeps PNR data for 5 years, depersonalised after 6 months (Law No. 379/2023, art. 15).

7. Sector-specific obligations

Information and insurance for travellers

Tour operators and agencies must inform travellers of the programme, consular procedures, rights, insurance and cancellation terms (Law No. 352/2006, art. 14(1)(g)). Travel insurance covering medical assistance is compulsory (art. 21), and tourism businesses must warn of risks and arrange emergency help (art. 22(3)).

Carriers: passenger data and inadmissible passengers

Air carriers send API data (document number and type, citizenship, names, date of birth, route and times) to the Border Police and Customs before border control (Law No. 28/2024, art. 52(1)). They also send PNR data to the Passenger Information Unit of the Border Police 48 to 24 hours before departure, and API data at flight closure (Law No. 379/2023, art. 3 and 17(4)). A carrier must return a passenger refused entry or bear the costs (Law No. 28/2024, art. 51; Law No. 200/2010, art. 7).

Invitations for visitors

Nationals on the Government's list get visas only against an invitation (Law No. 200/2010, art. 27 and 28). Moldovan legal persons may invite up to three foreigners at a time for business (art. 28(2¹)). The IGM issues invitations valid for 90 days, and the inviter signs a declaration to bear the costs of the stay and any removal.

AML training certificates

Since 13 August 2026, Law No. 308/2017 art. 13¹, inserted by Law No. 146/2026, requires the senior manager responsible for AML, the compliance officer and compliance staff of every reporting entity to hold a valid AML training certificate, renewed at least every three years. In this sector that covers NBM-licensed hotel exchange points and traders in goods paid 200,000 lei or more in cash. If a certificate is missing, the entity has up to three months to remedy it.

8. Risk indicators and red flags

The SPCSB's national risk assessment covering 2021 to 2024 (summary published December 2025) rates currency exchange houses at medium-high money laundering and terrorist financing risk, citing cash-intensive occasional customers, structured amounts and weak identification below the 10,000 lei threshold.

Currency exchange and cash typologies in hospitality

• Threshold avoidance: repeated exchanges just below the identification or reporting threshold (NBM Decision No. 201/2018, point 26).
• Frequent large exchanges: a guest often buying or selling large amounts of foreign currency.
• Refining: many small banknotes exchanged for higher denominations.
• Virtual asset proceeds: cash for exchange that comes from virtual asset transactions.
• High-risk residence: guests from jurisdictions with weak AML controls, high corruption, sanctions or terrorism links.
• Politically exposed persons: PEPs, family members and close associates.
• Gambling tours: casino-organised tour packages for visitors from countries where gambling is banned (SPCSB national risk assessment, 2022).
• Sanctions evasion: bookings or payments structured to benefit a sanctioned person (Law No. 25/2016, art. 6(6)).

9. Enforcement and penalties

Exchange licences. The NBM may warn, fine, suspend or withdraw the licence of a hotel or exchange house (Law No. 62/2008, art. 63(3)); after a withdrawal on most grounds, a new application is possible only 12 months after the licence is returned (art. 66(5)). Fines on non-bank exchange units range from 10,000 to 40,000 lei (Law No. 548/1995 on the NBM, art. 75(1) letter c)). For AML breaches, sanctions include public statements, licence withdrawal, management bans and fines of twice the benefit gained where it can be established, or otherwise up to the lei equivalent of EUR 1,000,000 (Law No. 308/2017, art. 35(2)). [Proposed, consultation closed 2 Nov 2026] A draft sanctions law would replace this regime from 10 July 2027; for financial institutions, the class that would include hotels exchanging currency, maximum fines for serious breaches reach EUR 10,000,000 or 10% of turnover.

Data protection. Fines reach 1,000,000 lei or 1% of turnover for controller and processor breaches, and 2,000,000 lei or 2% for breaches of the processing principles, consent rules, data subjects' rights or transfer rules, whichever is higher (Law No. 195/2024, art. 88).

Undeclared cash. On 2 November 2026 customs at Chișinău airport seized USD 16,600 and EUR 12,950 from two departing passengers who had not declared it; the money faces confiscation and the travellers contravention penalties. In July 2026 an undeclared EUR 25,650 was passed to the customs criminal investigation unit.

Tourism and passenger data. Breaches of the PNR law and incomplete API transmissions carry contravention liability (Law No. 379/2023, art. 33; Law No. 28/2024, art. 52(3)).

10. Recent changes and what to watch

• 26 October 2026[Proposed, consultation closed 2 Nov 2026] Draft AML and AML sanctions laws, due to apply from 10 July 2027, would cap cash payments for goods and services at EUR 10,000 and reclassify hotel exchange desks as financial institutions.
• 13 September 2026[In force] Law No. 154/2026 makes the Ministry of Economic Development and Digitalization the tourism ministry in place of the Ministry of Culture.
• 13 August 2026[In force] Law No. 146/2026 adds art. 13¹ to Law No. 308/2017: AML compliance staff at hotel exchange points and cash traders in goods need a training certificate, renewed at least every three years.
• 23 August 2026[In force] Law No. 195/2024 on personal data protection applies, with GDPR-style biometric rules and turnover-based fines.
• 1 July 2026[In force] Electronic customs and currency declarations open on the Public Customs Portal.
• 4 June 2026[Adopted, effective 1 Jun 2027] Law No. 66/2026 on the admission, stay and supervision of foreigners replaces Law No. 200/2010; visitors will need proof of accommodation and medical insurance covering the whole stay (art. 9(1)).
• 16 April 2026[In force] Government Decision No. 171/2026 amends the air transport facilitation programme, assigning automated border control to the Border Police.
• 30 January 2026[Drafting, no adoption date] Drafting begins on the regulation for the Inventory of tourism businesses, which will set how agencies notify and report.

11. What this means for identity verification

• Document checks. Check passport validity (3 months beyond departure), issue date and blank pages before travel; the carrier bears the return cost of an inadmissible passenger.
• Bookings as evidence. Hotel and tour confirmations support entry checks now and become entry evidence from June 2027, so they should carry the traveller's name and stay dates.
• Exchange desks. In-person check of an original photo ID above 10,000 lei, the point 12 data set, beneficial owner and PEP questions, 5-year retention.
• July 2027 drafts. If adopted, identity checks start at EUR 2,000 in occasional cash transactions and cash for any goods or services stops at EUR 10,000.
• Biometrics. Face-based check-in needs an art. 9 basis under Law No. 195/2024, usually explicit consent, with a non-biometric option.
• Re-verification. Repeat exchanges near the threshold, sanctions hits and doubts about earlier data trigger new checks.