Travel & Hospitality Compliance in Romania

The Romanian travel market is open to domestic and EU operators, and online sales are allowed. Accommodation, agencies and tour operators are regulated by the Ministry of Economy, Digitalisation, Entrepreneurship and Tourism. Border control and the handling of foreign travellers sit with the Romanian Border Police and the General Inspectorate for Immigration. Romania has applied the Schengen rules in full since 1 January 2025.

For digital-first businesses, the biggest obstacle is the paper-based guest register. Romania's norms on tourist records date from 2001, were republished in 2008 and still require a numbered paper form signed in front of reception. A 2024 ordinance gives the government a mandate to replace them, but the replacement had not been adopted as of October 2026.

1. Who regulates this sector

Arrival and departure forms go to the local police, and police officers share enforcement of the guest-record rules with the tourism ministry. Licensing is national.

2. Licensing and authorisation

Article 28 of Government Ordinance no. 58/1998 on the organisation and conduct of tourism activity (as amended by Government Emergency Ordinance no. 150 of 18 December 2024, Official Gazette no. 1290 of 19 December 2024) lets only operators authorised by the central tourism authority offer, market or sell tourist services and packages in Romania. Those operators must hold a tourism licence (licență de turism) or a classification certificate (certificat de clasificare), as applicable. The ministry's Authorisation and Monitoring Directorate issues provisional operating authorisations and classification certificates for accommodation. The certificate awards stars or daisies according to comfort and service. Authorised establishments are listed in the ministry's SITUR register.

Emergency Ordinance 150/2024 has applied since its publication. Its approval law (Senate file L3/2025) was returned by the President for re-examination in July 2026. The Senate adopted it again on 14 September 2026, and it was awaiting a vote in the Chamber of Deputies as of October 2026 [Approval law, not enacted]. Parliament can still amend the ordinance through that law.

Package organisers

Government Ordinance no. 2/2018 on package travel and linked travel arrangements transposes Directive (EU) 2015/2302. An organising agency obtains a tourism licence only after proving insolvency protection, which covers refunds and, where transport is included, repatriation (arts. 18 and 20(1)). A limited liability company holding the licence needs share capital of at least 25,000 lei (art. 20(2)). The same protection applies to traders who facilitate linked travel arrangements (art. 22).

Currency exchange at hotels

Government Decision no. 1.096 of 31 August 2022 (Official Gazette no. 874 of 6 September 2022) sets the authorisation procedure for exchange houses and for "entities that administer tourist accommodation establishments" that buy foreign currency from individuals and cash travellers' cheques. The Ministry of Finance grants the authorisation through its Currency Exchange Authorisation Commission (art. 1(4)).

3. AML, KYC and customer due diligence

Law no. 129/2019 on preventing and combating money laundering and terrorist financing (consolidated text on the Legislative Portal) does not list travel agencies, tour operators or hotels as reporting entities. The catch-all in art. 5(1)(i) covers professionals who sell goods and make cash transactions of at least the lei equivalent of EUR 10,000. Its wording has referred to goods only since Emergency Ordinance 111/2020, so services such as accommodation and travel packages fall outside it.

The exception: since 15 July 2020, art. 2(g)(1) of Law 129/2019 defines as a financial institution any entity that administers tourist accommodation and buys foreign currency from individuals. That makes a hotel with an exchange desk a reporting entity under art. 5(1)(b) for that activity.

For an accommodation operator in scope, the obligations are those of Law 129/2019:

Customer identification

Under art. 13 of Government Decision 1.096/2022, every currency purchase or sale for an individual requires a valid identity document, or a valid document that allows entry or stay in Romania. No threshold applies.

Standard due diligence

Required for occasional transactions of at least the lei equivalent of EUR 15,000, single or linked, and whenever money laundering or terrorist financing is suspected (Law 129/2019, art. 13(1)).

Cash reporting

Cash transactions of at least the lei equivalent of EUR 10,000, including linked operations, are reported to ONPCSB (art. 7(1)).

Suspicion and screening

Suspicious transactions are reported to ONPCSB. ONPCSB's 2025 guide for exchange houses also lists politically exposed person checks, sanctions screening and source-of-funds questions as expected controls.

Sanctions apply to everyone in the sector, whether or not it is AML-obliged. Under art. 3(1) of Government Emergency Ordinance no. 202/2008 on the implementation of international sanctions, UN and EU sanctions acts bind every natural or legal person in Romania. An agency or hotel must not make funds or services available to designated persons.

4. Identity verification and onboarding

The core identity rule for accommodation is in the Norms on access, records and protection of tourists in tourist accommodation, approved by Government Decision no. 237/2001 and republished in Official Gazette no. 649 of 12 September 2008. Article 2 of the Norms requires:

• Registration of every guest on arrival in the operational records, plus a numbered "arrival and departure form" (fișa de anunțare a sosirii și plecării). Tourist and agritourism guesthouses keep a building register instead.
• Accepted documents. Romanian citizens: identity card or passport, seaman's book or flight licence. Foreign citizens: passport, identity card, temporary identity document, local border traffic permit, seaman's book or flight licence.
• No document, no room. Accommodating anyone without an identity document is prohibited (art. 2(5)).
• Document check by a person. The guest completes and signs the form. The receptionist compares it with the identity document, signs it and hands the document straight back (art. 2(6)). The receptionist is responsible for the form being correct.
• Form contents. Name, date and place of birth, nationality, domicile, dates of arrival and departure, purpose of travel, and the series and number of the identity document.
• Minors. Children under 14 may stay only with a parent or legal representative, or on organised trips accompanied by teachers, coaches or guides (art. 4).

Foreign guests trigger a second duty. Under art. 12(2) of Government Emergency Ordinance no. 194/2002 on the regime of foreigners in Romania, a hotel or other tourist accommodation registers a foreigner and passes the data to the local police within 24 hours. Article 12(4) lets this be done through IGI's online application. IGI states that EU, EEA and Swiss citizens are not subject to the online procedure. At EU level, art. 45 of the Convention implementing the Schengen Agreement requires accommodation managers to have foreign guests personally complete and sign registration forms and prove their identity with a valid document.

Exchange desks follow the stricter currency rule: an identity document for every transaction, as described in section 3. No Romanian travel rule sets a biometric, liveness or identity assurance level requirement for guests.

5. Digital channels: what's different

Bottom line: online booking changes the sale but not check-in. Romania's guest-record norms require a signed paper form and a document check at reception for every guest, however the stay was booked. The digital differences sit around it: foreign-guest reporting, visa applications, airline data capture and short-term rental platforms.

Pre-arrival capture does not replace the form

Article 2(4) of the Norms requires each tourist to complete the form "at the moment of arrival" on the basis of the identity document, and art. 2(6) requires the receptionist to check and sign it. Pre-arrival data capture can speed up the desk but does not replace either step. The Government's explanatory note to Emergency Ordinance 150/2024 calls these provisions outdated, citing the duplicate carbonless forms printed by the Official Gazette's publisher. The ordinance gives the government a mandate to adopt new norms in line with the GDPR.

Visas and travel authorisations

The Ministry of Foreign Affairs e-visa portal takes the application file online. The applicant must still attend the diplomatic mission in person with original documents. Data is processed under OUG 194/2002 and Law 271/2010 on the national visa information system. ETIAS will be an online-only travel authorisation for visa-exempt visitors (EUR 20, valid three years) [Adopted, start date not yet set].

Airlines and online check-in

Regulation (EU) 2025/12 on advance passenger information requires carriers flying into the EU to read the machine-readable zone of travel documents automatically, including during online check-in (art. 5(2)). Manual entry is allowed only by exception or during a transitional period (art. 5(4)). The regulation applies from a date linked to the start of the EU router's operations, when it repeals Directive 2004/82/EC (art. 40) [Adopted, application date pending].

6. Data protection and biometrics

The GDPR (Regulation (EU) 2016/679) applies directly and is enforced by ANSPDCP. Law no. 190 of 18 July 2018 on measures implementing the GDPR adds two rules that affect travel onboarding:

• National identification numbers. Collecting a document that shows a national identification number (such as the Romanian personal numeric code) is allowed on any GDPR art. 6(1) basis. Where the basis is legitimate interest, art. 4(2) requires data-minimisation and security measures, a data protection officer, set retention periods and regular staff training. Guest forms and currency-exchange identification rest on legal obligations, but copying documents beyond those duties has no such basis.
• Biometrics. Under art. 3(1), processing biometric data for automated decision-making or profiling requires the person's explicit consent or an express legal provision. No Romanian travel rule provides one, so face-matching check-in would rely on consent.

Retention is fixed for guest forms: originals go to the police daily and copies are archived for five years (Norms, art. 2(9)-(10)). The Norms also prohibit staff from disclosing information about a guest's stay without consent, except to police officers checking the legality of the stay (art. 5(1)). ANSPDCP has fined travel businesses over guest data. In April 2025 it fined an accommodation provider 9,954 lei for emailing a guest's identity card details to a third party. The same month it fined a travel agency 24,886 lei and 4,977.20 lei for publishing customers' booking details on social media and failing to notify the breach.

7. Sector-specific obligations

Passenger Name Record data

Law no. 284/2018 (Official Gazette no. 1013 of 29 November 2018) requires air carriers to send Passenger Name Record (PNR) data for extra-EU and intra-EU flights to the Passenger Information Unit within the Border Police. Data is pushed 48 to 24 hours before departure and updated after flight closure (arts. 13, 15 and 16). The PNR includes the travel agency that made the booking and any advance passenger information collected (art. 14). The Border Police states that PNR data is kept for five years and masked after six months.

Entry/Exit System and Schengen

Romania has been in Schengen without internal air and sea border checks since 31 March 2024 (Council Decision (EU) 2024/210). Internal land border checks were lifted on 1 January 2025 (Council Decision (EU) 2024/3212). The Entry/Exit System (EES) started on 12 October 2025 (Implementing Decision (EU) 2025/1544). It reached every Romanian external border crossing point on 2 March 2026 and became fully operational EU-wide on 10 April 2026, according to the Border Police. EES records third-country short-stay visitors' face image and four fingerprints, with fingerprints exempted for children under 12, and replaces passport stamping. Carriers must check that passengers subject to EES meet entry conditions before boarding.

Short-term rental platforms

Regulation (EU) 2024/1028 has applied since 20 May 2026 (art. 19). Where a Member State runs a registration procedure, hosts declare their identity, including a national identification number for individuals (art. 5). Platforms must make sure a registration number is provided and displayed before a listing goes live, and make reasonable efforts to check host declarations at random (art. 7). They also send activity data monthly to the national single digital entry point (art. 9).

8. Risk indicators and red flags

Identity and money-laundering indicators in travel

• Forged or counterfeit documents: Romanian, Polish and Italian identity documents are the most often falsified (Border Police, October 2025).
• Impostor use: genuine documents belonging to someone else, or passports in other identities used by people subject to arrest warrants or entry bans.
• Double check-in: two tickets bought so that a traveller can reach a Schengen flight from the transit zone on false papers.
• Fraudulently issued Romanian ID cards: cards issued on falsified citizenship certificates and fictitious domiciles (Border Police case, July 2025).
• Structuring at the exchange desk: repeated daily exchanges just under reporting thresholds with no stated purpose (ONPCSB, 2025).
• Smurfing: apparently unrelated people making near-identical exchanges in quick succession.
• Sanctions exposure: customers presenting identity documents from sanctioned jurisdictions.

9. Enforcement and penalties

Penalties are administrative fines (contravenții) per offence.

Fines under HG 237/2001 are imposed by tourism ministry inspectors and by police officers. For repeated breaches, the ministry may withdraw the establishment's classification certificate or its manager's tourism qualification certificate (art. 4). Data protection fines follow the GDPR tiers (see section 6).

10. Recent changes and what to watch

• 14 September 2026: the Senate re-adopted the law approving Emergency Ordinance 150/2024 after the President asked for re-examination [Approval law, not enacted]. The ordinance applies meanwhile; watch the Chamber of Deputies vote for amendments to licensing and guest-record mandates.
• 20 May 2026: Regulation (EU) 2024/1028 on short-term rental data began to apply [In force]. Platforms need registration-number checks and monthly reporting where a registration procedure exists.
• 10 April 2026: the Entry/Exit System became fully operational EU-wide, after reaching every Romanian crossing point on 2 March 2026 [In force]. Third-country visitors give biometrics at first entry.
• March 2025: the tourism ministry published a draft government decision amending HG 237/2001 on tourist access and records [Draft, not adopted]. It is the likely route to electronic guest registration.
• 28 January 2025: Regulation (EU) 2025/12 on advance passenger information entered into force [Adopted, application date pending]. Carriers will have to capture document data automatically, including at online check-in.
• ETIAS: the European travel authorisation for visa-exempt visitors will apply from a date the Commission sets [Adopted, start date not yet set]. Booking flows for visa-exempt markets will need to prompt travellers to apply.

11. What this means for identity verification

• Documents. Accept the documents listed in the Norms: national identity cards and passports for EU citizens, and passports or permits for others. A guest without a valid document cannot be accommodated.
• Remote methods. Digital capture, NFC reading or selfie checks at booking help with fraud screening and speed. In Romania they do not replace the signed form and the receptionist's check against the original document.
• Foreign guests. Build a 24-hour reporting step for third-country nationals. IGI's online application is a lawful channel for it.
• Biometrics. Face matching at check-in needs explicit consent under Law 190/2018, art. 3, and a GDPR art. 9 basis. Keep it optional, with a manual route.
• Retention. Keep form copies for five years and nothing more than the duty requires. Copying identity cards beyond the form data needs its own basis and safeguards.
• Exchange desks. Identify every currency customer, and screen against sanctions and politically exposed person lists in line with Law 129/2019.