Crypto ATM / kiosk operator in Romania

Law No. 129/2019 for the prevention and combating of money laundering and terrorist financing, as well as for amending and supplementing certain normative acts (Legea nr. 129/2019 pentru prevenirea și combaterea spălării banilor și finanțării terorismului, precum și pentru modificarea și completarea unor acte normative).

This law transposed Directive (EU) 2018/843 (the 5th AML Directive) into Romanian national law, expanding the scope of obliged entities to include VASPs.

Exchange between virtual assets and fiat currencies.

Regulatory Body: The National Office for Prevention and Control of Money Laundering (Oficiul Național de Prevenire și Combatere a Spălării Banilor - ONPCSB) is the authority responsible for registering and supervising VASPs.

Requirement: Providers of exchange services between virtual currencies and fiat currencies, and custodian wallet providers, must register with the ONPCSB.

Registration Process: Applicants must provide information about their identity, legal form, operational details, internal AML/CFT procedures, risk assessment, and demonstrate that management and beneficial owners are fit and proper.

Segregation of Client Assets Rules:

Under current AML law (Law 129/2019), there are no explicit technical mandates for the segregation of client crypto assets from the firm's own assets.

However, general AML principles and good governance practices implicitly require firms to maintain clear accounting and operational distinctions between client funds/assets and company assets to prevent commingling and facilitate robust record-keeping, which is essential for AML compliance.

There are no specific mandates for insurance or bonding requirements for crypto custodians under current Romanian AML legislation.

Cold Storage Mandates:

Current Romanian law does not impose specific requirements regarding the use of cold storage for digital assets. Operational security measures, including hot/cold storage strategies, fall under the VASP's internal risk management framework, which is assessed during the registration process to ensure robust AML/CFT controls.

Focus on AML/CFT Registration: The primary regulatory requirement for VASPs in Romania is registration with ANAF for anti-money laundering and combating the financing of terrorism (AML/CFT) purposes, transposing EU directives. Breaches here might lead to administrative actions from ANAF or criminal investigations by DIICOT if money laundering is suspected.

DIICOT (Direcția de Investigare a Infracțiunilor de Criminalitate Organizată și Terorism - Directorate for Investigating Organized Crime and Terrorism)

Romanian Police (Poliția Română)

Regulator/Enforcement Agency: ANAF (Agenția Națională de Administrare Fiscală - National Agency for Fiscal Administration)

BNR's Role: The National Bank of Romania primarily issues warnings regarding the risks of cryptocurrencies and does not directly license or supervise crypto exchanges in the same way it does banks.

ASF's Role: The Financial Supervisory Authority (ASF) regulates capital markets, insurance, and private pensions. Cryptocurrencies are generally not classified as financial instruments under their purview unless they meet specific criteria, which is rare for widely traded cryptos.

Entity Targeted: Organized criminal groups composed of multiple individuals (often Romanian citizens operating globally). Violation Type: Organized crime, computer fraud, aggravated fraud, money laundering, setting up illegal financial investment schemes (Ponzi-like schemes using crypto). These groups typically lured victims into fake cryptocurrency investment platforms, promising high returns, only to steal their funds. Penalty Amount: Not a single fine, but the estimated damages/stolen funds often run into tens to hundreds of millions of USD/EUR across various operations. Assets (properties, luxury cars, cryptocurrencies, cash) are seized during investigations. Individuals face lengthy prison sentences upon conviction. Outcome: Multiple individuals arrested, indicted, and facing criminal prosecution. Assets seized. Some cases are ongoing in court; others have led to convictions. These operations often dismantle sophisticated, internationally operating fraud rings.

Entity Targeted: Individuals or, in some cases, businesses found to have undeclared income from cryptocurrency trading or mining. Violation Type: Tax evasion (undeclared income from cryptocurrency transactions). Penalty Amount: Varies significantly depending on the undeclared amounts. It includes back taxes, penalties (e.g., 0.02% per day of delay), and interest. Specific aggregated amounts for "significant" cases against entities are rarely publicized, but for individuals, it can reach hundreds of thousands of RON. Outcome: Tax assessments issued, collection of back taxes, penalties, and interest. Criminal charges for severe cases of tax evasion.

Legal Basis: Law no. 129/2019 for the prevention and combatting of money laundering and terrorism financing, as subsequently amended and supplemented (transposing AML V).

Outcome: Multiple individuals arrested, indicted, and facing criminal prosecution. Assets seized. Some cases are ongoing in court; others have led to convictions. These operations often dismantle sophisticated, internationally operating fraud rings.

Outcome: Tax assessments issued, collection of back taxes, penalties, and interest. Criminal charges for severe cases of tax evasion.