MiCA CASP License in Romania

Why Choose Romania for Crypto Licensing?

Romania would offer a MiCA CASP route with one of the EU’s lower standard corporate tax rates (16%), a sizeable ICT workforce (about 208,000 employed ICT specialists in 2025, per Eurostat),^[22] EEA-wide passporting once a Romanian authorisation exists, and a moderate substance bar. The single binding constraint is that there is no route to file: as of 24 September 2026 no Romanian competent authority is designated, applications cannot be lodged, and no Romanian CASP is authorised, for the reason set out under Regulatory Framework below. Iceland, Liechtenstein and Norway are covered too: MiCA was incorporated into the EEA Agreement by EEA Joint Committee Decision 41/2025 (in effect since 24 June 2025), and ESMA’s register lists entities with a home state in each of the three.^[24][23]

MiCA Passporting Once Authorised

Once Romania designates a competent authority, a Romanian-authorised CASP could passport its services across the EEA (the 27 EU states plus Iceland, Liechtenstein and Norway) under MiCA Articles 59(7) and 65, without separate national licences.^[1][24] The CASP notifies its home competent authority (ASF under the draft ordinance), which passes the notification within 10 working days to the single points of contact of the host member states, to the European Securities and Markets Authority (ESMA) and to the European Banking Authority; services may start on receipt of that communication or at the latest from the 15th calendar day after the notification.^[1] ESMA’s Interim MiCA Register provides public proof of authorisation. The MiCA passport covers only the services for which the CASP is authorised, out of the 10 crypto-asset services listed in Article 3: custody, exchange, trading platform, execution, advice, portfolio management, transfer, and others. Grandfathered firms that operated under Article 143 did not have passport rights; the passport activates only on full authorisation.

16% Corporate Tax: One of the EU’s Lower Headline Rates

Romania charges 16% on company profits, among the lower standard headline rates in the EU, alongside Bulgaria (10%) and Cyprus (15% from 1 January 2026).^[15] A Romanian CASP could pay the 1% microenterprise tax on revenue up to €100,000 (rate set by OUG 89/2025 from 1 January 2026) only if it meets the Fiscal Code microenterprise conditions and its activity is not in an excluded financial-sector category.^[16] A CASP whose turnover passes €100,000 leaves the regime.

Unlike Malta, whose 35% headline rate falls to ~5% effective only through a complex refund mechanism, Romania’s headline rate is the rate paid.

A Sizeable Engineering Bench

Romania has a sizeable technology labour pool, about 208,000 employed ICT specialists in 2025 against Poland’s 779,000 and Czechia’s 248,000,^[22] concentrated in Bucharest, Cluj-Napoca, Iași, and Timișoara. For crypto operations whose authorisation depends on demonstrable ICT and Digital Operational Resilience Act (DORA) capability, this is a structural advantage: substance is genuinely deliverable, not nominally constructed.

English is widely used in the IT sector, and the time zone (EET, UTC+2) aligns with both London and the Gulf, a relevant detail for institutional client servicing.

Where Romania Sits Among EU MiCA Cost-Leaders

In Jagelski & Partners’ comparison set, Romania sits in the EU MiCA Cost-Leaders peer group with Estonia, Latvia, Czech Republic, Slovakia, Lithuania, and Poland. Among that cluster, Romania’s 16% is the lowest standard corporate rate of the states that tax profit as it is earned, while Estonia and Latvia tax only distributed profit, which can cost less for a company that reinvests; the microenterprise regime can give an eligible early-stage operator a year-one advantage. Unlike the Czech Republic, with 12 entities on ESMA’s interim register (edition of 24 September 2026),^[23] Romania has none, the asymmetry that frames any Q3 2026 incorporation decision.

Regulatory Framework

Romania’s CASP framework rests on Regulation (EU) 2023/1114 (MiCA), directly applicable since the Crypto-Asset Service Provider regime commenced on 30 December 2024. The national implementing OUG, drafted by the Ministry of Public Finance and published for public consultation in May 2025,^[3] was reviewed in first reading by Government on 2 April 2026^[4] but has not been published in Monitorul Oficial as of 24 September 2026.^[5][39]

Proposed Dual-Regulator Structure: ASF and BNR

The Autoritatea de Supraveghere Financiară (ASF) is the lead competent authority the draft OUG would designate for CASPs, Asset-Referenced Token (ART) issuers, and Crypto ATM operators, and would serve as Romania’s single point of contact with ESMA.^[6] Under the draft, the Banca Națională a României (BNR) would keep supervision of E-Money Token (EMT) issuance by credit institutions and authorised E-Money Institutions (EMIs), and of crypto-asset services provided within supervised banks, and would be Romania’s single point of contact with the European Banking Authority (EBA); ASF decisions would be challengeable within 30 days before the Bucharest Court of Appeal.

Supporting institutions surround the two lead authorities. The Oficiul Național de Prevenire și Combatere a Spălării Banilor (ONPCSB) is Romania’s Financial Intelligence Unit and AML supervisor; the Agenția Națională de Administrare Fiscală (ANAF) administers DAC8/CARF reporting; the Autoritatea pentru Digitalizarea României (ADR) would give prior technical approval of CASP IT systems under the unadopted draft ordinance;^[3] the Directoratul Național de Securitate Cibernetică (DNSC) coordinates national cybersecurity under DORA.

The MiCA Layer

Regulation (EU) 2023/1114 (MiCA) entered into force on 29 June 2023. The ART/EMT issuer regime applied from 30 June 2024; the CASP regime from 30 December 2024.^[1] MiCA is directly applicable in Romania without national transposition: the implementing OUG’s role is to designate competent authorities, set procedural rules, and create national administrative offences, not to restate MiCA itself.

ESMA Level 2 and Level 3 measures (RTS, ITS, guidelines, Q&As) continue to be published through 2026; the iXBRL formatting requirement for crypto-asset white papers applied from 23 December 2025.^[7]

National Implementing Legislation

The draft Ordonanță de Urgență privind reglementarea serviciilor de criptoactive (“Draft MiCA OUG”) was published for public consultation by the Ministry of Public Finance on 23 May 2025.^[3] The Government of Romania reviewed the OUG in first reading on 2 April 2026, per the gov.ro press release of that date.^[4] The OUG has not been published in Monitorul Oficial as of 24 September 2026, leaving Romania, like Poland, without national MiCA enabling law in force.^[8]

Bulgaria is sometimes grouped with them and should not be: its Markets in Crypto-Assets Act was published in State Gazette No. 54 of 4 July 2025 and has been in force since 8 July 2025.

Adjacent national ordinances are already in force: OUG 10/2025 (AML/TFR alignment, Monitorul Oficial nr. 225 of 13 March 2025);^[10] OUG 71/2025 (DAC8 transposition);^[11] OUG 14/2026 (DORA implementing regulation).^[12] Industry commentary often conflates OUG 10/2025 with the MiCA implementing OUG: they are different instruments with different scope.

Regulatory History

Before 30 December 2024, Romanian law set up an authorisation regime for virtual-currency and digital-wallet providers under Article 30^1 of Law 129/2019, to be administered by a specialised commission within the Ministry of Finance jointly with the Autoritatea pentru Digitalizarea României (ADR). The implementing Government Decision was never issued, so providers in practice operated only on the strength of an ONPCSB notification, registering as obliged entities under the AML framework without any substantive prudential or conduct supervision. The Ministry of Finance’s joint authorisation procedure remained inactive throughout 2020–2024. OUG 10/2025 then repealed Article 30^1 and replaced the terminology of “virtual-currency provider” with “crypto-asset service provider”, routing AML supervision of CASPs to ASF (or BNR for bank and EMI providers) and extending Travel-Rule and unhosted-wallet obligations under Regulation (EU) 2023/1113.^[10]

As of June 2026, the Înalta Curte de Casație și Justiție has not issued a landmark ruling establishing virtual assets as property; in Decision no. 34/2021 the Court declined to rule on the legal characterisation of cryptocurrencies, and Romanian doctrine has so far treated crypto-asset claims through general civil-law analogies rather than statutory definition.

Romania participates in MONEYVAL, the FATF-style regional body for Europe, and has been a member since the body’s establishment; its most recent mutual evaluation report was adopted on 25 May 2023 and published on 18 July 2023, and after a follow-up report released on 6 July 2026 Romania remains in MONEYVAL’s enhanced follow-up.^[20][35]

Recent Regulatory Developments

• 23 June 2026. ESMA public statement on the end of the transitional period. Unauthorised providers must stop onboarding new EU clients and all marketing and solicitation at once, and limit their services to selling or transferring crypto-assets, reallocating assets or closing positions.^[37]
• 17 April 2026. ESMA statement on the end of MiCA transitional periods. ESMA confirms that after 1 July 2026 any entity providing crypto-asset services to EU clients without a MiCA authorisation (or eligible Article 60 status) is in breach of EU law and must cease offering those services.^[1][14]
• 2 April 2026. Draft MiCA OUG reviewed in first reading by Government. The implementing ordinance designating ASF as competent authority and establishing procedural rules for Romanian CASP authorisation was discussed at the Government meeting of 2 April 2026 in first reading (“primă lectură”); it has not been adopted since.^[4][39]
• March 2026. OUG 14/2026 implements DORA in Romanian law. Designates BNR and ASF as DORA competent authorities for the financial entities they supervise; for crypto-asset service providers, DORA Article 46(d) gives that role to the MiCA competent authority, which Romania has not yet designated.^[12]
• 24 December 2025. OUG 89/2025 sets a single microenterprise tax rate. 1% from 1 January 2026, within the €100,000 revenue ceiling that applies for 2026.^[16]
• 10 December 2025. OUG 71/2025 implements DAC8 reporting. A reporting crypto-asset service provider whose reporting nexus is Romania files its 2026 data with ANAF by 15 March 2027.^[11][38]
• 4 December 2025. ESMA statement on MiCA transitional measures. Asks NCAs to treat “last minute” applications for authorisation “with considerable caution”.^[13]
• 26 May 2025. Law 86/2025 amends Law 129/2019 (AML). Tightens AML obligations and beneficial-ownership reporting, ahead of the EU AMLR.^[32]
• 13 March 2025. OUG 10/2025 aligns Romanian AML with the EU Travel Rule. Repeals Article 30^1 of Law 129/2019; gives ASF anti-money-laundering supervision of the MiCA Article 60 crypto-asset services of the central securities depositories, investment firms, market operators and fund managers it supervises, and makes BNR and ASF the Travel Rule supervisors for the entities each supervises.^[10]

Regulatory Overlap

Three regimes intersect with the Romanian MiCA CASP framework. DORA (Regulation (EU) 2022/2554) is directly applicable from 17 January 2025 and imposes ICT risk management, incident reporting, resilience testing, and third-party ICT risk obligations on every CASP authorised under MiCA, though not on a provider operating only on transitional status;^[2][7] OUG 14/2026 sets the Romanian supervisory wrapper. The EU Transfer of Funds Regulation (Regulation (EU) 2023/1113) is directly applicable from 30 December 2024 and imposes Travel Rule obligations on every CASP-originated crypto-asset transfer regardless of value; ONPCSB has issued a national implementing guideline.^[9] The EU AMLR (Regulation (EU) 2024/1624) applies from 10 July 2027 and will replace much of the current AML directive-based architecture with a single rulebook; the EU Anti-Money Laundering Authority (AMLA) expects its first direct-supervision cycle in 2028, starting six months after publication of the selected list under Article 13(4).

Tokenised Securities and RWA

MiCA Article 2(4) excludes crypto-assets that qualify as financial instruments, so a Romanian MiCA CASP authorisation does not cover tokenised securities or real-world-asset tokens that are securities. A tokenised security, a tokenised share, bond or fund unit, is regulated under MiFID II, the Prospectus Regulation, and the EU DLT Pilot Regime (Regulation (EU) 2022/858), supervised in Romania by the Autoritatea de Supraveghere Financiară (ASF) under the securities regime rather than under MiCA.

ESMA’s Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments set that boundary.^[7] Where a tokenised fund unit is the target, the structuring route runs through fund licensing rather than a CASP application, paired with crypto custody permissions only where the operating model needs them.

Regulatory Transition: ONPCSB-Notification Regime to MiCA CASP Authorisation

Romania has notified the maximum 18-month transitional period under MiCA Article 143(3), with a hard cut-off of 1 July 2026.^[36] Providers that operated under the pre-30 December 2024 ONPCSB-notification regime could continue operations during the transitional window but could not use the MiCA passport; to keep serving clients beyond the cut-off date they needed a MiCA CASP authorisation (with no Romanian route open, one obtained in another member state and passported into Romania) or, as an eligible financial entity, an Article 60 notification.^[1]

The Old Regime: ONPCSB Notification Under Law 129/2019

The pre-30 December 2024 framework is set out under Regulatory Framework above: providers operated on the strength of an ONPCSB notification only, until OUG 10/2025 repealed Article 30^1 of Law 129/2019 and reclassified them as crypto-asset service providers.^[10] ONPCSB retains its role as Romania’s FIU; it received notifications but never granted authorisations.

The New Regime: MiCA CASP Authorisation (ASF Proposed)

From 30 December 2024, MiCA’s CASP authorisation regime applied directly. In Romania, the draft ordinance would designate the Autoritatea de Supraveghere Financiară (ASF) as lead competent authority for CASP authorisation, ART issuer authorisation, and Crypto ATM supervision, with the Banca Națională a României supervising EMT issuance and bank-channel crypto services.^[6] Until that ordinance and ASF’s secondary regulation are both in force, no Romanian authority holds the competence to grant a MiCA CASP authorisation.^[4]

ESMA’s interim register (edition of 24 September 2026) lists no entity with Romania as its home state. It lists 357 entities across the EEA, including financial entities that notified under Article 60, with Germany (95), France and the Netherlands the largest home states.^[23]

Transitional Provisions and Grandfathering

Article 143(3) of MiCA permits member states to grant providers active before 30 December 2024 a transitional period of up to 18 months during which they may continue providing crypto-asset services under national law.^[1] Romania has notified ESMA of the maximum 18-month transitional period, which ended on 1 July 2026.^[36] The draft national OUG also foresaw a domestic “fast-track” procedure under Article 143(6) (file within 30 days of the OUG’s entry into force; complete authorisation by 30 November 2025), but the legislative delay has overtaken that design, and the binding deadline was the EU-level 1 July 2026 cut-off.

What stayed the same during transition: pre-existing providers continued to operate under the legacy ONPCSB-notification regime plus the amended Law 129/2019 (as updated by OUG 10/2025 for Travel Rule compliance). What changed: no MiCA passport, no use of the title “CASP” under MiCA Article 3(1)(15), and full Travel Rule obligations from 30 December 2024. DORA did not reach a transitional provider on that basis; it applies once a CASP is authorised under MiCA.^[7]

Conversion Mechanism (Article 143(6))

The draft Romanian OUG provided a simplified procedure under MiCA Article 143(6) for legacy providers: a reduced application file recognising prior ONPCSB registration, an ASF compatibility assessment, and a decision within the standard Article 63 windows. Article 143(6) permits such a procedure only for applications submitted between 30 December 2024 and 1 July 2026. No Romanian authority could receive an application in that window, so the route has closed. Even where a member state used it, the authority had to confirm that MiCA’s authorisation and operating requirements were met before granting authorisation.^[1]

“Simplified” would have meant procedurally streamlined recognition of corporate documents and beneficial-ownership information already held by ONPCSB; it would not have reduced the substantive workload of building a MiCA-grade compliance programme.

Key Deadlines

Practical Implications

For three operator profiles, the implications diverge sharply. Grandfathered Romanian providers (active ONPCSB notification pre-30 December 2024) lost their legal basis on 1 July 2026, when the Article 143(3) transitional period ended with no Romanian route to authorisation open: they must now wind down EU services or re-authorise in another member state and passport back into Romania (an eligible financial entity could instead notify under Article 60).^[1] Greenfield operators with no Romanian footprint cannot obtain a Romanian authorisation as of September 2026: ASF cannot grant one until the OUG is in force, and the simplified Article 143(6) procedure, open only to applications filed by 1 July 2026, closed without a Romanian authority to apply it; their route to Romanian clients is an authorisation in another member state and a passport, as for the third profile.^[1] Existing CASPs authorised in another EU member state can passport into Romania under MiCA Article 65 without separate Romanian authorisation; the home authority passes the notification to the host single point of contact, which Romania has not yet designated (ASF under the draft ordinance).

For now, the OUG delay means Romania cannot be the home jurisdiction of choice for new entrants targeting MiCA authorisation in H2 2026; that choice falls to Czech Republic, Lithuania, Malta, or Cyprus, and Romania cannot be dated at all until the ordinance is adopted.

License Types and Activities Covered

A MiCA CASP authorisation covers any combination of the 10 crypto-asset services defined in Article 3(1)(16) of Regulation (EU) 2023/1114. Applicants select the services they intend to provide, and the competent authority, which the unadopted draft ordinance would make ASF, authorises those specific services. Asset-Referenced Token (ART) issuance is a separate authorisation from the same authority; E-Money Token (EMT) issuance is reserved to authorised credit institutions and Electronic Money Institutions (EMIs) supervised by BNR.

Covered Activities

The 10 MiCA-regulated crypto-asset services, each mapped to MiCA Article 3(1)(16) and its capital class:

For MiCA CASPs, the amounts shown are Annex IV class floors. Prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement. MiCA Article 67(1)–(4).

• Custody and administration of crypto-assets on behalf of clients (Article 3(1)(16)(a)). The CASP holds private keys or controls access to clients’ crypto-assets. Applies to crypto exchanges, custodians, and wallet providers offering safekeeping services. Annex IV class floor: €125,000 (Class 2).
• Operation of a trading platform for crypto-assets (Article 3(1)(16)(b)). The CASP runs a multilateral system that brings together third-party buying and selling interests. Applies to centralised exchanges and order-book platforms. Annex IV class floor: €150,000 (Class 3).
• Exchange of crypto-assets for funds (Article 3(1)(16)(c)). The CASP buys and sells crypto-assets against fiat using own capital. Applies to brokers, OTC desks, and exchange-for-fiat services. Annex IV class floor: €125,000 (Class 2).
• Exchange of crypto-assets for other crypto-assets (Article 3(1)(16)(d)). The CASP buys and sells crypto-assets against other crypto-assets using own capital. Same Class 2 capital floor.
• Execution of orders for crypto-assets on behalf of clients (Article 3(1)(16)(e)). The CASP concludes agreements on behalf of clients to buy, sell or subscribe for crypto-assets. Applies to execution brokers; receiving an order and passing it to another party for execution is the separate reception-and-transmission service. Annex IV class floor: €50,000 (Class 1).
• Placing of crypto-assets (Article 3(1)(16)(f)). The CASP markets newly issued crypto-assets to identified buyers. Applies to placement agents and underwriters. Annex IV class floor: €50,000 (Class 1).
• Reception and transmission of orders for crypto-assets on behalf of clients (Article 3(1)(16)(g)). The CASP receives orders and transmits them to another CASP for execution. Applies to introducing brokers. Annex IV class floor: €50,000 (Class 1).
• Providing advice on crypto-assets (Article 3(1)(16)(h)). The CASP gives personalised recommendations. Applies to advisers. Annex IV class floor: €50,000 (Class 1).
• Providing portfolio management of crypto-assets (Article 3(1)(16)(i)). The CASP manages portfolios on a discretionary basis. Applies to crypto asset managers. Annex IV class floor: €50,000 (Class 1).
• Providing transfer services for crypto-assets on behalf of clients (Article 3(1)(16)(j)). The CASP transfers crypto-assets between addresses or accounts on the client’s behalf. Applies to payment-style crypto transfer operators. Annex IV class floor: €50,000 (Class 1).

What Does Not Require Registration

• Fully decentralised services with no identifiable provider. MiCA’s exclusion under Recital 22 covers crypto-asset services rendered “in a fully decentralised manner without any intermediary”. The boundary is contested; ESMA’s position is that any human or legal entity exerting “sufficient control or influence” is in scope as a CASP.^[7]
• Not an exemption: serving only clients outside the Union. MiCA applies to crypto-asset services provided in the Union (Article 2(1)); Article 61 concerns third-country firms serving EU clients at the client’s own exclusive initiative.
• Crypto-asset transfers within a single corporate group between parent and subsidiary, where no external client is involved.
• Crypto-assets used solely as a means of payment for goods or services by the merchant directly accepting them, without further service provision.
• Mining and validation activities that do not involve client-facing service provision.
• Non-fungible crypto-assets that are genuinely unique and non-fungible (Article 2(3)), but the boundary is narrow; series of NFTs sharing characteristics may fall in scope.

ART and EMT Issuance: Separate Authorisations

Asset-Referenced Token (ART) issuance is a separate authorisation under MiCA Title III, granted by the competent authority, which in Romania the unadopted draft ordinance would make ASF.^[1][3] An ART is a crypto-asset that aims to maintain stable value by referencing another value or right, or a combination thereof (other than a single official currency). Minimum capital: the greater of €350,000, 2% of average reserves, or one quarter of fixed overheads, with uplifts for tokens classified as “significant” under EBA Regulatory Technical Standards.

E-Money Token (EMT) issuance under MiCA Title IV is reserved to authorised credit institutions and EMIs, supervised in Romania by BNR. A CASP authorisation alone does not permit ART or EMT issuance; an issuer is also subject to MiCA white-paper publication and ongoing reserve, redemption, and disclosure obligations.

DAO, DeFi, and NFT Treatment

ESMA’s Q&A series and the European Commission’s interpretative communications have steadily narrowed the boundaries of MiCA’s “fully decentralised” carve-out. As of June 2026, any DeFi protocol with identifiable governance, treasury control, or token-issuance control faces a credible argument that the protocol operator is in CASP scope.^[7]

A DAO structured as a Romanian foundation or association does not avoid the analysis: ESMA’s position is that ultimate beneficial ownership and substantive control remain the test, regardless of the legal form.

NFTs that are genuinely unique (a single 1/1 artwork) fall outside scope under Article 2(3); NFT collections sharing characteristics may fall in scope as crypto-assets, with the issuer subject to white-paper publication. The mistake to avoid is assuming the DAO or NFT structure protects against CASP authorisation requirements when the underlying activity is identifiable as a crypto-asset service.

Romania-Specific Crypto ATM Regime

The draft Romanian OUG introduces a dedicated regime for Crypto ATM operators with substance beyond the MiCA baseline.^[3] Specific provisions: prior ICI București approval for ATM hardware; prior ADR technical certification of the operator’s IT systems; location restrictions prohibiting deployment in unsupervised public premises; real-time data-access mechanisms enabling ASF to inspect transaction flows.

As of 24 September 2026, the precise ICI București and ADR dual-approval procedure remains to be fixed by ASF’s secondary regulation, which cannot be issued until the national OUG is published in Monitorul Oficial.

Crypto ATM operators are CASPs for MiCA purposes (typically Class 2, providing exchange of crypto-assets for funds), and so face the standard MiCA capital, governance, AML, and DORA obligations on top of the Romania-specific operational rules the draft ordinance would add.^[1]

Requirements

A Romanian MiCA CASP applicant must satisfy MiCA Article 59 substance requirements, demonstrate fit-and-proper governance, meet the Annex IV capital floor (the higher of the class-specific minimum or 25% of preceding-year fixed overheads), and operate a documented AML, Travel Rule, and DORA-aligned ICT framework. The one Romania-specific addition proposed is prior ADR technical certification, a requirement of the unadopted draft ordinance. The 0.5% monthly ASF supervisory levy is a provision of the unadopted draft ordinance, so it is a budgeting risk rather than an applicant requirement.

Requirements Table

Fit-and-Proper Assessment

MiCA Article 68(1) requires all members of the management body to be “of sufficiently good repute”, to possess “appropriate knowledge, skills and experience” and to commit sufficient time to their duties; Article 68(2) requires shareholders or members with qualifying holdings (10%+ direct or indirect) to be of sufficiently good repute. Once designated, ASF would assess each management-body member against the three dimensions of the joint EBA and ESMA suitability guidelines: integrity (no relevant criminal convictions, no relevant administrative sanctions, no past licence revocations), competence (demonstrable crypto/fintech experience appropriate to the role, including an understanding of the CASP’s conflicts of interest), and time commitment (sufficient time devoted to the role, with attention to non-executive directorships held elsewhere).^[29] The mistake to avoid is treating fit-and-proper as a documentary exercise: a designated ASF, following the ESMA peer review of July 2025, would look for substantive governance, not nominee names appended for completeness.^[18]

Local Presence and Substance

MiCA Article 59(2) sets the substance bar: a registered office in the member state where at least part of the services are provided (Romania, for a Romanian authorisation), place of effective management in the Union, and at least one director resident in the Union.^[1] Expected supervisory practice, not a written Romanian rule, builds on this: a Romanian-registered SRL or SA; a Romanian-resident MLRO; documented decision-making in Romania (board meetings, committee minutes, evidenced approval flows); operational staff (the ICT, AML, and compliance functions) substantively present in Romania even where some development can sit elsewhere in the EU.

ESMA’s July 2025 peer review of an MFSA CASP authorisation is now the working benchmark: mailbox companies, nominee directors, and “compliance-as-a-service” structures without identifiable Romanian presence would not clear the substance test.^[18] Plan to overstaff Romania for the first 12 months and consolidate later, not the reverse.

AML/CFT and Travel Rule

Romania’s AML framework is Law 129/2019, as amended most recently by Law 86/2025 (in force 26 May 2025) and OUG 10/2025 (13 March 2025).^[10] CASPs are obliged entities under Article 5 and must operate:

• an enterprise-wide ML/TF risk assessment;
• customer-level risk assessment and ongoing review;
• full Customer Due Diligence (CDD) with enhanced measures on transfers to or from unhosted wallets and on non-EU correspondent CASPs;
• transaction monitoring;
• Suspicious Transaction Report (STR) filings to ONPCSB;
• €10,000-equivalent cash-threshold reporting;
• 5-year record retention.

The EU Transfer of Funds Regulation (Regulation (EU) 2023/1113) is directly applicable from 30 December 2024: every CASP-originated transfer carries payer and payee information regardless of value, and ONPCSB has issued a national implementing guideline.^[9] For entities supervised by ASF, fines on legal persons under Article 43(7) of Law 129/2019 reach RON 23 million or 10% of total annual turnover.

Application Process

Once a competent authority is designated (ASF under the draft ordinance), its CASP authorisation procedure will follow MiCA Article 63: completeness checked within 25 working days of receipt and a decision within 40 working days of receipt of the complete file; a written information request made by working day 20 suspends that period for up to 20 working days, and later requests do not.^[1] These statutory clocks do not establish an end-to-end Romanian launch timeline; national filing arrangements and any separate technical requirements must first be confirmed.

Application language: Under the draft ordinance, Romanian would be the default. Supporting documents (audited financials, group policies, vendor agreements) could be submitted in English with certified Romanian translation where ASF requests it. The cover application form, Romanian-law legal opinions, and Romanian-law contracts would have to be in Romanian.

Pre-application engagement: there is none, and there is currently nobody to engage. ASF said in early July 2026, as reported in the press, that it is not designated as the competent authority under Regulation (EU) 2023/1114 and that authorisation procedures can start only after a designation under its Article 93.^[40] Other ESMA-coordinated national authorities run informal pre-application meetings; whether ASF will do the same is a question for the ordinance that has not been adopted.

The independent specialist introduced by Jagelski & Partners drafts Romania-specific AML/CFT policies, the enterprise-wide ML/TF risk assessment, the Travel Rule procedure under OUG 10/2025 and Regulation (EU) 2023/1113, and the DORA framework aligned with OUG 14/2026 within its own engagement with the client. The compliance documentation would be the most time-intensive component of a Romanian MiCA CASP application: an estimated 8 to 12 weeks of specialist work that cannot be shortcut with templates from other jurisdictions. Talk to us about the engagement structure →

Required Documents

The Article 62 dossier, which ASF would receive under the draft ordinance, comprises five document categories: corporate, personal, compliance, business plan, and technology. The compliance documentation would carry the most weight, because Romanian-specific content cannot be copied from templates written for other jurisdictions. ASF would expect bespoke policies that reference Romanian legislation by name, not generic frameworks lifted from other EU jurisdictions.

Corporate Documents

• Certificate of incorporation and CUI (unique tax registration code) from ONRC
• Articles of association and any shareholder agreements
• Constitutive act (Romanian-language)
• ANAF tax certificate confirming no overdue obligations
• Beneficial-ownership declaration (filed with ONRC under the AML framework)
• Resolution of the share-capital deposit at the Romanian bank
• Office lease or proof of use for the Romanian registered office
• Certificate of no unreversed criminal record for the legal person (cazier judiciar)

Personal Documents (All Directors, Key Function Holders, Qualifying Shareholders)

• Identity document (passport for non-Romanian residents)
• Curriculum vitae detailing crypto/fintech experience
• Certificate of no unreversed criminal record (cazier judiciar) from Romania and from each country of residence over the past 10 years
• Professional references (two minimum)
• Financial-standing declaration covering personal and entity-level solvency
• Conflicts-of-interest declaration listing all current directorships and qualifying holdings
• For shareholders ≥10%: source-of-funds and source-of-wealth evidence
• For non-EU directors: independent fit-and-proper certification from the home jurisdiction’s regulator if applicable

Compliance Documentation

The compliance documentation would be the most demanding component of a Romanian MiCA CASP application. The independent specialist introduced by Jagelski & Partners drafts each of these documents within its own engagement with the client: bespoke and Romania-specific, referencing Law 129/2019 (as amended by Law 86/2025 and OUG 10/2025), Regulation (EU) 2023/1113, and any ASF guidance once ASF is designated. Each document must reflect the applicant’s specific business model, risk profile, and operational structure.

Business Plan and Financial Projections

The Article 62 business plan covers a minimum three-year horizon and must include: a description of the planned activities and service mix (mapped to MiCA Article 3 service categories), the target market and client segmentation, the pricing model and revenue projections, the cost structure, the headcount plan, the technology spend, and the prudential resources projection.

Once designated, ASF would use the projection to assess whether the 25% fixed-overhead test bites in years 2 and 3 (it does once annual fixed overheads exceed four times the class minimum) and whether the proposed prudential safeguards remain adequate. Sensitivity analysis on adverse scenarios (50% revenue shortfall, regulatory penalty, security incident, market downturn) is expected, not optional.

Technology and Operational Documentation

The technology documentation operates at the intersection of MiCA and DORA; the draft ordinance would add ADR technical approval. Required elements: IT systems architecture diagram; cybersecurity policy aligned with DORA Articles 5–14; wallet and key-management procedures (HSM specifications, cold-storage governance, transaction-signing workflow); business continuity and disaster recovery plans with documented testing; third-party ICT risk register; penetration-testing programme. The documentation must reference DORA’s specific RTS on ICT risk management and the ESMA Supervisory Briefing on CASP authorisations.^[2][7]

If the draft ordinance is adopted, ADR technical approval would become the Romanian-specific layer on top of this DORA-aligned package.

Costs and Pricing

Romanian Year-1 cost divides into two figures that behave differently. As of September 2026, the statutory part, what the state and the regulator charge, is almost nil: trade-register operations carry no fee under Article 44 of Law 265/2022, the Official Gazette publication of the incorporation extract is charged at the Gazette tariff (RON 152 per manuscript page in 2026),^[26][25][27] and no ASF authorisation fee and no ADR certification fee has been set, because the implementing ordinance that would create them has not been adopted. Estimated notarial and ancillary formation expenses add about €100 to €300. The build part, the work of preparing and filing the application and standing up the compliance function, runs €96,000 to €208,000 depending on service category (Class 1 services at the lower end, Class 3 trading-platform operations at the upper end) and is quoted per case. Neither figure includes funding the separate Article 67 prudential safeguards. Ongoing build cost from year two runs €66,000 to €125,000, before the proposed 0.5% monthly ASF supervisory levy, which has no enacted basis.

Government / ASF Fees

Statutory Cost: State and Regulator Charges

Nothing else is chargeable yet. The ASF authorisation fee is a fixed RON amount that ASF secondary regulation has not set, the ADR technical-certification fee schedule is unpublished, and the 0.5% monthly supervisory levy exists only in the unadopted draft ordinance. Each of those will be added to the statutory figure once the ordinance and the fee schedules are in force, and none of them can honestly be quoted as of September 2026.

Typical Build, Quoted Per Case

The compliance documentation row is at least as large as any other Year 1 line (€30,000–€60,000) because Romanian-specific AML, Travel Rule, and DORA-aligned ICT programmes cannot be templated from other EU jurisdictions: ASF would compare the file against the named Romanian legislation, and generic EU language would invite requests for information. The 0.5% monthly supervisory levy proposed in the draft ordinance would be unusual among EU MiCA jurisdictions in being revenue-linked rather than fixed. It is not in force, so it belongs in a Romanian plan as a modelled downside of 0.5% a month on authorised-activity revenue, payable independent of profitability, rather than as a committed cost line.

Timeline

No reliable end-to-end Romanian CASP authorisation timeline is established. The ESMA authority list dated 17 February 2026, re-read on 1 October 2026, still marks Romania “TBA”; that dated list is not a complete account of subsequent Romanian legislation. The MiCA Article 63 clocks (completeness within 25 working days; decision within 40 working days of receipt of the complete file, with one suspension of up to 20 working days) are separate procedural limits, not a guaranteed total launch period.^[1]

A launch schedule requires confirmation of the competent authority, the national framework and the actual filing channel; adding a fixed number of months to an unknown adoption date does not produce a reliable forecast. ESMA’s statement of 4 December 2025 asked NCAs to treat “last minute” applications for authorisation “with considerable caution” before the EU transitional period ended on 1 July 2026,^[13] and in Romania no competent authority was designated to receive such a file before the cut-off at all. Build banking, capital, and substance in advance of OUG adoption, not after.

Taxation

Romania is a competitive-tax jurisdiction: 16% corporate income tax on profits, 1% microenterprise tax on turnover up to €100,000 (only where the Fiscal Code conditions are met), 21% standard VAT from 1 August 2025 with crypto-fiat exchange exempt under CJEU Hedqvist (C-264/14), and 16% withholding tax on dividends and interest to non-residents from 1 January 2026 (with EU directive and double-tax-treaty relief).

Microenterprise Regime: Conditions and What Replaces It

OUG 89/2025 (Monitorul Oficial nr. 1203 of 24 December 2025) tightened the microenterprise regime from 1 January 2026: a single 1% rate on turnover up to €100,000, with the prior 3% rate eliminated.^[16] The regime is available only while turnover stays within €100,000 and the Fiscal Code conditions are met; above that ceiling the standard 16% corporate income tax applies. The 16% rate is still among the lower standard headline rates across EU MiCA jurisdictions, and unlike Malta’s 35% headline rate with a refund mechanism, the Romanian 16% is the rate paid.

DAC8 / CARF Reporting

OUG 71/2025 (Monitorul Oficial nr. 1146 of 10 December 2025) transposes Directive (EU) 2023/2226 (DAC8) into the Fiscal Procedure Code and implements the OECD’s Crypto-Asset Reporting Framework (CARF).^[11] From 1 January 2026, a reporting crypto-asset service provider must: (a) collect customer tax-residency self-certifications under the due-diligence rules; (b) keep records of reportable crypto-asset transactions (exchanges, transfers, and reportable retail payment transactions); (c) file an annual report by 15 March of the following year, so 2026 transactions are due by 15 March 2027. A CASP authorised under MiCA reports in the member state that authorised it, so a Romanian-authorised CASP would report to ANAF while a CASP passporting into Romania reports at home; a crypto-asset operator not authorised under MiCA registers with ANAF where Romania is its member state of registration.^[38]

ANAF then exchanges the data with EU tax authorities under DAC8 and with CARF jurisdictions outside the EU under the OECD Multilateral Competent Authority Agreement. ANAF’s guidance gives fines of RON 50,000 to RON 150,000 for failing to file the annual report and for erroneous or incomplete reporting.^[38] Plan for the operational lift: DAC8/CARF reporting requires data infrastructure that goes beyond MiCA’s prudential disclosures.

Pillar Two (Global Minimum Tax)

Romania has transposed the EU Pillar Two Directive (Council Directive (EU) 2022/2523) into national law and applies a 15% effective minimum tax to multinational and large-scale domestic groups with consolidated revenue of €750 million or more in at least two of the four preceding fiscal years.^[30] A Romanian CASP is in scope only as a member of such a group.

Where applicable, a low-taxed Romanian CASP in such a group is topped up to 15% in Romania under the Domestic Minimum Top-Up Tax (DMTT), whatever the location of the ultimate parent, while the Income Inclusion Rule (IIR) applies at the level of a parent entity. Standalone operators below the threshold can disregard Pillar Two for planning purposes.

ANAF Crypto Enforcement

ANAF has prosecuted crypto-tax under-reporting since 2022. Romania Insider (June 2022), citing ANAF via Economica.net, reported that out of audits totalling €131 million of crypto income across 63 individuals, €48.67 million was either unreported or under-reported, generating supplementary taxes of €2.1 million on the under-reporters.^[17] DAC8/CARF reporting from 2026 will substantially extend ANAF’s enforcement reach: the data sharing under DAC8 closes the cross-border information asymmetry that previously protected unreported activity.

For a CASP reporting in Romania, the compliance burden is operational, not strategic: the CASP files for its customers; the customers’ own under-reporting is then a personal-tax matter ANAF can pursue.

Ongoing Compliance & Post-Registration

A Romanian MiCA CASP authorisation is indefinite: there is no fixed renewal period under MiCA. Ongoing compliance would instead operate through annual reporting to the designated authority, periodic inspections, DORA-mandated incident reporting, and annual DAC8/CARF reporting to ANAF. The draft ordinance would add a 0.5% monthly supervisory levy; as of September 2026, nothing in force imposes it.

Annual Reporting Obligations

Once ASF is designated, Romanian CASPs should expect an annual filing package along the following lines, though ASF has yet to set its content: audited financial statements (Romanian audit standards), the compliance officer’s annual report, the MLRO’s annual AML report, the DORA incident summary, the prudential resources confirmation against the Annex IV class minimum and the 25% fixed-overhead test, and any updates to the Article 62 file (governance changes, qualifying-holding changes, service-mix amendments, outsourcing changes). ASF may also ask for an annual MiCA Article 70 client-asset confirmation backed by an auditor’s segregation report.

Annual filings would follow the Romanian financial-year cycle (calendar year for most entities), with the audited annual financial statements filed with ANAF by 31 May of the following year (or the next working day) for a calendar-year company;^[31] the deadline for filings with ASF would be set once it is designated. DAC8/CARF returns are filed separately with ANAF by 15 March of the following year.

Supervision Fees and Recurring Costs

The proposed Romanian framework replaces fixed renewal fees with a 0.5% monthly supervisory levy on authorised-activity revenue, payable to ASF by the 15th of the following month under the draft OUG. Under the draft, non-payment would be a ground for withdrawing the authorisation. Other recurring costs: office and registered-address (€8,000–€15,000 per year for a Bucharest office adequate for a small CASP), accounting and Romanian tax advisory (€10,000–€20,000), annual audit (€10,000–€25,000), MLRO and compliance officer (€40,000–€70,000 fully loaded), ICT and DORA-related infrastructure maintenance (€10,000–€20,000). Those items sum to €78,000–€150,000 a year: the MLRO, compliance officer and ICT lines are already in the ongoing build table, and office, accounting and audit (€28,000–€60,000) sit outside it, all before the proposed supervisory levy.

Regulatory Inspections

Once designated, ASF would conduct both scheduled and unscheduled inspections of authorised CASPs. No inspection cycle for CASPs has been published; frequency would follow the supervisor’s risk assessment, and custody-intensive or trading-platform CASPs and those exposed to ART/EMT issuers should expect closer attention. Inspection themes would reflect ESMA’s supervisory priorities, which for 2026 centre on cyber risk and digital resilience, so DORA implementation maturity is a likely focus;^[28] AML and Travel Rule effectiveness, the fitness and propriety of senior management, and client-asset segregation are standing supervisory themes for CASPs.

An inspection can combine an on-site walkthrough of operations, documentation review, interviews with key function holders and a findings letter with remediation deadlines set by severity; incident reports (DORA major incidents, STR pattern changes, client complaints to ANPC) can trigger narrower unscheduled inspections.

Enforcement and Sanctions

MiCA Article 111 requires member states to empower competent authorities to impose maximum fines on a legal person of at least €5 million or 5% of total annual turnover for breaches of the crypto-asset service provider rules (at least €700,000 for a natural person); Romania has set no national ceiling, because the implementing ordinance is unadopted;^[1] breaches of Law 129/2019 (AML) by an ASF-supervised entity carry fines of up to RON 23 million or 10% of total annual turnover under Article 43(7).^[10] Under MiCA, a competent authority’s powers range from supervisory measures and fines to temporary restriction of activities and withdrawal of authorisation (Articles 64 and 94).^[1]

ESMA’s July 2025 peer review highlighted that NCAs must be willing to revoke or refuse authorisations for substantive failure; a designated ASF would be expected to apply this standard from its first cohort onwards.^[18] The unadopted draft ordinance of 23 May 2025 would also make providing authorisation-requiring services without authorisation a criminal offence (three months to one year’s imprisonment or a fine, art. XIX(1)(d) and (3)); no Romanian implementing law is in force.^[3]

ICT Risk Management & Operational Resilience

The Digital Operational Resilience Act (Regulation (EU) 2022/2554, “DORA”) has applied since 17 January 2025 and binds a CASP once it is authorised under MiCA; according to ESMA, a provider operating only on transitional status is not subject to it on that basis.^[2][7] OUG 14/2026 establishes the Romanian DORA supervisory wrapper. It designates BNR and ASF as DORA competent authorities for the financial entities they supervise; for CASPs, DORA Article 46(d) assigns that role to the MiCA competent authority, which Romania has not yet designated.^[12]

Required DORA Elements

ICT Risk Management Framework (Articles 5–14). Documented governance arrangements with board accountability; identification and classification of ICT-supported business functions; ICT risk-tolerance statements linked to the Risk Appetite Statement; continuous monitoring; protection and prevention controls (access management, encryption, network segmentation, vulnerability management); detection capabilities (security monitoring, threat intelligence); response and recovery plans tested annually. ASF would expect a board-approved ICT strategy and a chief ICT officer or equivalent role with direct board reporting.

ICT-Related Incident Management and Reporting (Articles 17–23). Documented incident-classification taxonomy; internal escalation rules; reporting of major incidents to the competent authority (for a CASP, the authority designated under MiCA; ASF under the draft ordinance) within statutory timeframes (initial notification as early as possible, within four hours of classification as major and normally no later than 24 hours after awareness (if classification occurs after that 24-hour window, within four hours of classification), subject to the timing rules in Article 5 of Delegated Regulation (EU) 2025/301; intermediate report within 72 hours; final report within 1 month); incident root-cause analysis; lessons-learned procedures.^[33] Major incidents are also notifiable to clients where they may affect client crypto-assets.

Digital Operational Resilience Testing (Articles 24–27). Annual basic testing programme (vulnerability assessments, penetration testing, network security assessments, scenario-based testing); Threat-Led Penetration Testing (TLPT) every three years for significant entities (CASPs identified by the competent authority under DORA Article 26 and Commission Delegated Regulation (EU) 2025/1190). DORA RTS on TLPT follow the TIBER-EU framework. Test results are reported to the competent authority and inform the risk-management framework.

Third-Party ICT Risk Management (Articles 28–44). Register of Information listing every ICT third-party arrangement with contractual safeguards meeting DORA Article 30 (exit strategies, data-handling obligations, sub-outsourcing restrictions, on-site audit rights, termination triggers, performance metrics). Annual reporting of the Register of Information to the competent authority. The European Supervisory Authorities (EBA, EIOPA, and ESMA), through their Joint Committee, designate critical ICT third-party providers (CTPPs) that fall under direct EU-level oversight; CASPs must accommodate this in contractual arrangements with their CTPPs.

Wallet Management and Custody-Specific ICT Procedures. For Class 2/3 CASPs (custody and trading platform), the ICT framework documents hot/warm/cold wallet segregation thresholds, HSM specifications (FIPS 140-2 Level 3 or equivalent baseline), key-generation and key-rotation procedures, multi-signature schemes, transaction-signing workflow with separation of duties, insurance arrangements covering custodial-key compromise. ASF would expect custody architecture to be demonstrably tested, not theoretical.

Information Sharing. DORA Article 45 permits CASPs to participate in voluntary cyber-threat-intelligence sharing arrangements. ESMA encourages participation; a designated ASF would be likely to align.

Banking

Banking access for crypto operators in Romania is functional but narrow. Domestic Romanian tier-1 commercial banks remain risk-averse to crypto-native operations; the Banca Națională a României has issued repeated public warnings on crypto risks, and, in practice, operating-account onboarding for crypto-native firms has been rare, even for providers on transitional status. EU-licensed e-money institutions specialised in crypto are the default rail for IBAN and SEPA Instant; pan-European banks with regulated digital-asset arms serve client-fiat safeguarding under MiCA Article 70.

Banking Landscape (Archetype-Level, No Named Institutions)

Domestic Romanian tier-1 commercial banks (retail and SME profile). Risk-averse to crypto-native operations. The Banca Națională a României has issued repeated public warnings on crypto-related risks since 2018,^[19] and most major Romanian commercial banks decline to onboard crypto-native firms or route applications to specialised compliance subsidiaries with extended onboarding cycles. For non-crypto operating expenses (payroll, office, vendors), domestic banks remain viable; for client crypto-asset flows, they typically are not.

EU-licensed e-money institutions specialising in crypto (multi-jurisdiction fintech profile). The default rail for crypto operators in Romania today, and the likely rail for Romanian CASPs once authorisation is available. Provide IBAN issuance, SEPA Instant access, and crypto on/off-ramp connectivity; client funds of a CASP that is not itself an EMI, payment institution or credit institution must be placed with a credit institution or a central bank under MiCA Article 70(3).^[1] Onboarding cycles run 6–12 weeks against a full MiCA Article 62 dossier; the Article 143(3) transitional status that could stand in for it ended on 1 July 2026. Pricing is materially higher than tier-1 bank pricing but the access is reliable for compliant operators.

Pan-European banks with regulated digital-asset arms (DE / FR / NL incorporated, institutional client profile). Used for MiCA Article 70-compliant client-fiat safeguarding, the next-business-day placement requirement for client funds with an EU credit institution or central bank. Also used for institutional treasury services, larger-ticket FX, and counterparty banking on the institutional side. Onboarding cycles run 8–16 weeks with substantial diligence on AML and ICT/DORA readiness.

Specialist treasury and settlement rails (EU and UK incorporated, professional client profile). Used for OTC settlement, stablecoin redemption, inter-CASP correspondent activity, and institutional FX. Not a general operating-account substitute but essential infrastructure for any CASP running material flows.

Once a Romanian authorisation route exists, banking has to be sequenced early enough that an authorised entity has working rails on day one. Once applications to a designated authority are possible, begin banking applications 60–90 days before the expected authorisation grant and present evidence of the substantive assessment’s progress.

Jagelski & Partners’ banking partner network includes 90+ institutions across EU EMIs, pan-European banks with digital-asset arms, and specialist treasury providers. A licence without banking access is a certificate on the wall: learn about our Banking service →.

FATF Status & International Standing

Romania is a member of MONEYVAL, the Council of Europe’s Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism, an FATF-style regional body, and is on neither FATF list published after the June 2026 plenary.^[34] Its most recent MONEYVAL mutual evaluation dates from 2023; after the follow-up report released on 6 July 2026, Romania is rated compliant or largely compliant with 27 of the 40 FATF Recommendations and partially compliant with 13, none non-compliant, and it remains in MONEYVAL’s enhanced follow-up.^[20][35]

As an EU member state, Romania falls outside the EU list of high-risk third countries, which covers only non-EU jurisdictions (Commission Delegated Regulation (EU) 2016/1675, as amended): operators receive standard EU treatment in correspondent banking and counterparty due diligence.

MiCA Passporting and EU Market Access

Once a Romanian competent authority is designated, a Romanian MiCA CASP authorisation will grant full freedom-of-services and freedom-of-establishment passporting rights across the EEA under MiCA Articles 59(7) and 65.^[1][24] The CASP notifies its home authority (ASF, once designated), which passes the notification within 10 working days to the host member states’ single points of contact, ESMA and the European Banking Authority; services may start on receipt of that communication or at the latest from the 15th calendar day after the notification.^[1] The authorisation is recorded on ESMA’s Interim MiCA Register.

There is no separate Romanian licence applicable to cross-border CASP activities: once authorised in Romania, EU-wide service is operationally a matter of notification, not re-authorisation. Grandfathered firms operating under Article 143(3) transitional measures do not have passporting rights.^[7] ESMA’s interim register (edition of 24 September 2026) lists 357 entities across the EEA, including financial entities that notified under Article 60, with Germany (95), France and the Netherlands the largest home states; none has Romania as its home state.^[23]

Advantages and Limitations

Romania offers a structurally attractive cost-talent-EU combination, among the EU’s lower corporate tax rates, a sizeable ICT workforce, MiCA passporting once authorised, and a moderate substance bar, but the binding 2026 constraint is the unfinished national MiCA implementing legislation.^[1] The cost advantages are real; the timing risk is binding for any operator who must hold authorisation in H2 2026.

• ✓ MiCA passporting once authorised. Freedom of services and establishment across the EEA under Articles 59(7) and 65, available only after a Romanian authorisation exists.^[1][24]
• ✓ 16% corporate tax, among the EU’s lower headline rates. Microenterprise option (1% up to €100,000 turnover) for an operator that meets the Fiscal Code conditions.
• ✓ A sizeable engineering bench. About 208,000 employed ICT specialists in 2025 (Eurostat), EU-rate-affordable for ICT and DORA roles; English-proficient.
• ✓ Moderate substance bar. A Romanian registered office, effective management in the EU and one EU-resident director satisfy Article 59(2); a Romanian-resident MLRO is expected in practice, and MiCA sets no headcount minimum.
• ✓ No FATF grey-listing, no EU AML high-risk listing. Standard treatment in correspondent banking and counterparty due diligence.
• × National MiCA implementing legislation not yet in force. ASF cannot grant authorisations until the OUG is published in Monitorul Oficial and ASF issues its secondary regulation. Mitigation: the transitional regime ended on 1 July 2026, so an operator that needs an authorisation now obtains it in a member state with an operational regime, such as Czech Republic, Lithuania, Malta, or Cyprus, and passports into Romania.
• × Zero authorised CASPs as of 24 September 2026. No published Romanian precedent; first applicants bear the calibration cost of ASF’s interpretation. Mitigation: No ASF engagement channel exists, so build the Article 62 file against ESMA’s CASP authorisation supervisory briefing and analogous decisions from Estonia, Malta, and Czech Republic to anchor file structure.
• × A proposed 0.5% monthly supervisory levy on authorised-activity revenue. It sits in the unadopted draft ordinance of 23 May 2025, not in any instrument in force, and would charge 0.5% a month on authorised-activity revenue, payable regardless of profitability. Mitigation: model it as a revenue-linked operating cost in any Romanian plan while treating the rate itself as unsettled until the ordinance is adopted.
• × Banking-friction for crypto-native operations. Domestic Romanian tier-1 banks decline most crypto-native onboarding; EU-licensed EMIs are the default rail at materially higher pricing. Mitigation: once applications to a designated authority are possible, sequence banking applications 60–90 days before the expected authorisation grant; plan dual rails (operating + client-fiat safeguarding) from day one.

How Romania Compares

In our comparison set, Romania sits in the EU MiCA Cost-Leaders peer group. Three direct comparators frame the choice: Czech Republic (already authorising; 21% corporate tax; 9–18 month timeline), Slovakia (regional cost peer; 10%/21%/24% corporate tax set by revenue; six CASPs authorised), and Latvia (Baltic cost peer; 0% retained-earnings tax). Malta provides the cross-tier reference as the EU MiCA upgrade path for institutional optics, at substantially higher headline cost.

Compare every crypto jurisdiction side by side →

Czech Republic is the closest direct alternative on capital regime and passport scope, and unlike Romania it is already issuing authorisations. It is not the cheaper one: its Year-1 band in the peer table above runs about two and a half to three times Romania’s, and its operating authorisation route has an observable timeline; Romania’s does not yet have a validated end-to-end range. The 5-percentage-point tax differential (Romania 16% vs Czech 21%) is a recurring operational saving; the absence of any Romanian filing route is the decisive difference.

For founders with no Romanian footprint and pressure to hold an authorisation, Czech Republic out-executes Romania as of September 2026 because Romania cannot be filed at all.

Latvia’s headline 0% retained-earnings tax is structurally attractive for high-growth operators that intend to retain rather than distribute profits, but Latvia charges 20% on distributed profits (25% of the net amount paid out), more than Romania’s 16% profit tax, although Romania then taxes dividends at a further 16%.

Slovakia is the nearer regional cost peer, but the two do not track closely today: Slovakia has a designated authority and six NBS-authorised CASPs on the ESMA register of 24 September 2026, while no Romanian application can be filed.^[23] Malta is the institutional choice: Maltese authorisation carries different brand weight in client conversations than any Cost-Leader jurisdiction, at a materially higher cost.

When Romania Is the Right Choice

Choose Romania if:

• The 16% corporate tax is a material factor in your unit economics, not a nice-to-have
• You can accept an unestablished authorisation date while the competent authority, national framework and filing arrangements are confirmed
• You already have or intend to build Romanian engineering operations (DORA staffing economics tip in your favour)

Consider alternatives if:

• You must hold an authorisation on a nameable date: pick Czech Republic, which is open and issuing, or Cyprus / Malta for greater certainty of process
• Your client base or distribution channels are concentrated in a different EU member state: passport from where your operations live
• Institutional brand-weight in client conversations is critical: Malta carries different optics than any Cost-Leader jurisdiction
• 0% retained-earnings taxation is structurally important: consider Latvia or Estonia

Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.

Common Mistakes in Romania Applications

Romanian MiCA CASP applications would fail or stall for the same reasons MiCA applications fail elsewhere: substance gaps, AML weakness, ICT under-resourcing, governance shortcuts. Romania adds two jurisdiction-specific pitfalls: treating OUG 10/2025 as the MiCA implementing ordinance (it is not, it is the AML/TFR alignment), and underestimating the time to OUG adoption when budgeting authorisation timelines.

• Treating OUG 10/2025 as the MiCA implementing ordinance. OUG 10/2025 (Monitorul Oficial nr. 225 of 13 March 2025) aligns Romanian AML and Travel Rule provisions with the EU framework. It does not designate ASF as competent authority for MiCA CASP authorisation, nor does it empower ASF to grant such authorisations. The MiCA implementing OUG is a separate instrument, drafted by the Ministry of Public Finance in May 2025 and reviewed in first reading by Government on 2 April 2026, but not yet in Monitorul Oficial.^[4] Filing a “MiCA application” with ASF before the implementing OUG is in force is wasted effort.
• Budgeting against an unsupported Romanian grant date. Confirm the competent authority, national framework and filing arrangements before setting a launch schedule. MiCA’s procedural clocks do not validate a fixed end-to-end forecast.
• Generic AML and Travel Rule templates lifted from other EU jurisdictions. ASF would compare the file against Law 129/2019 (as amended by Law 86/2025 and OUG 10/2025) by name.^[32] Generic EU AML language would invite requests for information during substantive assessment. The mistake to avoid is an “EU MiCA AML manual”: a designated regulator would want a Romanian AML manual that complies with MiCA, not the other way round.
• Nominee directors and mailbox substance. ESMA’s July 2025 peer review of an MFSA CASP authorisation is now the working benchmark across all NCAs.^[18] Nominee directors with no operational role, “compliance-as-a-service” arrangements without identifiable Romanian presence, and headcount thresholds met only on paper would not clear a designated ASF’s substance test. Plan to overstaff Romania for the first 12 months and consolidate later.
• Under-resourcing the ICT and DORA programme. The draft Romanian OUG conditions authorisation on prior ADR technical certification, which substantively overlaps with DORA Articles 5–14 (ICT risk management). Applicants who treat ICT as an afterthought, incident reporting outsourced, third-party ICT risk register absent, penetration testing untested, would fail a designated ASF’s substantive assessment on the ICT pillar regardless of how strong the rest of the file is.
• Filing close to the 1 July 2026 transitional cut-off without grandfathered status. ESMA’s statement of 4 December 2025 asked NCAs to treat “last minute” applications for authorisation “with considerable caution”.^[13] Operators who relied on the Article 143(3) transitional regime could not count on a late Romanian filing either: with no competent authority designated, no Romanian authority could receive the file before the 1 July 2026 cut-off.

Frequently Asked Questions

References