Custodial wallet / SaaS in Romania

Law No. 129/2019 for the prevention and combating of money laundering and terrorist financing, as well as for amending and supplementing certain normative acts (Legea nr. 129/2019 pentru prevenirea și combaterea spălării banilor și finanțării terorismului, precum și pentru modificarea și completarea unor acte normative).

This law transposed Directive (EU) 2018/843 (the 5th AML Directive) into Romanian national law, expanding the scope of obliged entities to include VASPs.

Custody and/or administration of virtual assets or instruments enabling control over virtual assets.

Custodial License Requirements (Registration):

Regulatory Body: The National Office for Prevention and Control of Money Laundering (Oficiul Național de Prevenire și Combatere a Spălării Banilor - ONPCSB) is the authority responsible for registering and supervising VASPs.

Requirement: Providers of exchange services between virtual currencies and fiat currencies, and custodian wallet providers, must register with the ONPCSB.

Registration Process: Applicants must provide information about their identity, legal form, operational details, internal AML/CFT procedures, risk assessment, and demonstrate that management and beneficial owners are fit and proper.

Article 4, point 11 defines "custodian wallet provider" (furnizor de portofele digitale de custodie).

Article 5, paragraph (1), letter (i) specifies the registration obligation.

Segregation of Client Assets Rules:

Under current AML law (Law 129/2019), there are no explicit technical mandates for the segregation of client crypto assets from the firm's own assets.

However, general AML principles and good governance practices implicitly require firms to maintain clear accounting and operational distinctions between client funds/assets and company assets to prevent commingling and facilitate robust record-keeping, which is essential for AML compliance.

There are no specific mandates for insurance or bonding requirements for crypto custodians under current Romanian AML legislation.

Cold Storage Mandates:

Current Romanian law does not impose specific requirements regarding the use of cold storage for digital assets. Operational security measures, including hot/cold storage strategies, fall under the VASP's internal risk management framework, which is assessed during the registration process to ensure robust AML/CFT controls.

Qualified Custodian Definitions:

Law 129/2019 defines a "custodian wallet provider" as a natural or legal person that provides services to safeguard private cryptographic keys on behalf of its clients, to hold, store and transfer virtual currencies. This is the de facto "qualified custodian" definition in the current framework, meaning an entity legally permitted to provide custody services after registration with the ONPCSB. The law does not impose additional "qualification" criteria beyond the AML registration.

Custodial License Requirements (Authorization):

Regulatory Body: The Financial Supervisory Authority (Autoritatea de Supraveghere Financiară - ASF) will become the primary national competent authority for authorizing and supervising CASPs, including those offering custody services, in Romania.

Focus on AML/CFT Registration: The primary regulatory requirement for VASPs in Romania is registration with ANAF for anti-money laundering and combating the financing of terrorism (AML/CFT) purposes, transposing EU directives. Breaches here might lead to administrative actions from ANAF or criminal investigations by DIICOT if money laundering is suspected.

BNR's Role: The National Bank of Romania primarily issues warnings regarding the risks of cryptocurrencies and does not directly license or supervise crypto exchanges in the same way it does banks.

ASF's Role: The Financial Supervisory Authority (ASF) regulates capital markets, insurance, and private pensions. Cryptocurrencies are generally not classified as financial instruments under their purview unless they meet specific criteria, which is rare for widely traded cryptos.

Regulator/Enforcement Agency: ANAF (Agenția Națională de Administrare Fiscală - National Agency for Fiscal Administration)

Entity Targeted: Organized criminal groups composed of multiple individuals (often Romanian citizens operating globally). Violation Type: Organized crime, computer fraud, aggravated fraud, money laundering, setting up illegal financial investment schemes (Ponzi-like schemes using crypto). These groups typically lured victims into fake cryptocurrency investment platforms, promising high returns, only to steal their funds. Penalty Amount: Not a single fine, but the estimated damages/stolen funds often run into tens to hundreds of millions of USD/EUR across various operations. Assets (properties, luxury cars, cryptocurrencies, cash) are seized during investigations. Individuals face lengthy prison sentences upon conviction. Outcome: Multiple individuals arrested, indicted, and facing criminal prosecution. Assets seized. Some cases are ongoing in court; others have led to convictions. These operations often dismantle sophisticated, internationally operating fraud rings.

Entity Targeted: Individuals or, in some cases, businesses found to have undeclared income from cryptocurrency trading or mining. Violation Type: Tax evasion (undeclared income from cryptocurrency transactions). Penalty Amount: Varies significantly depending on the undeclared amounts. It includes back taxes, penalties (e.g., 0.02% per day of delay), and interest. Specific aggregated amounts for "significant" cases against entities are rarely publicized, but for individuals, it can reach hundreds of thousands of RON. Outcome: Tax assessments issued, collection of back taxes, penalties, and interest. Criminal charges for severe cases of tax evasion.