Self-custodial wallet / non-custodial software in Romania
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Romania without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- No direct AML registration/obligation for non-custodial wallet publishers because law no. 129/2019 defines 'custodian wallet provider' (furnizor de portofele digitale de custodie) as a provider that safeguards private cryptographic keys on behalf of clients — a non-custodial publisher does not fall within this definition (ro.aml.article-4-point-11-defines).
- The AML registration obligation under Article 5, paragraph (1), letter (i) of Law 129/2019 applies only to exchange services and custodian wallet providers, not to software publishers (ro.aml.article-5-paragraph-1-letter).
Key Restrictions
- No specific regulatory restrictions apply to self-custodial wallet software publishing, as the publisher never holds, controls, or accesses user private keys or funds.
- The operator must not stray into custody or exchange activities (e.g., offering hosted wallets, key escrow, or order-matching services), which would trigger VASP/CASP licensing under Law 129/2019.
Key Risks
- Regulatory ambiguity: Romanian law does not explicitly address non-custodial software publishers in the current AML framework (Law 129/2019), creating interpretive risk if enforcement authorities take a broad view of 'custodian wallet provider'.
- As the MiCA regulatory framework is transposed, ASF will become the competent authority for CASPs (ro.aml.regulatory-body-the-financial-supervisory), and the definition of CASP activities may expand; non-custodial wallet software could be caught under broader CASP classifications.
- Tax-compliance risk for users: ANAF actively pursues undeclared crypto income (ro.enforcement.entity-targeted-individuals-or-in), which could create downstream friction for wallet users even if the publisher has no direct obligation.
- Enforcement attention from DIICOT and Romanian Police focuses on organized crypto fraud (ro.licensing.diicot-direcia-de-investigare-a); a wallet publisher perceived as facilitating unlicensed activity could attract scrutiny.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Law No. 129/2019 for the prevention and combating of money laundering and terrorist financing, as well as for amending and supplementing certain normative acts (Legea nr. 129/2019 pentru prevenirea și combaterea spălării banilor și finanțării terorismului, precum și pentru modificarea și completarea unor acte normative).
Article 4, point 11 defines "custodian wallet provider" (furnizor de portofele digitale de custodie).
Article 5, paragraph (1), letter (i) specifies the registration obligation.
Custody and/or administration of virtual assets or instruments enabling control over virtual assets.
Requirement: Providers of exchange services between virtual currencies and fiat currencies, and custodian wallet providers, must register with the ONPCSB.
Regulatory Body: The Financial Supervisory Authority (Autoritatea de Supraveghere Financiară - ASF) will become the primary national competent authority for authorizing and supervising CASPs, including those offering custody services, in Romania.
Entity Targeted: Organized criminal groups composed of multiple individuals (often Romanian citizens operating globally). Violation Type: Organized crime, computer fraud, aggravated fraud, money laundering, setting up illegal financial investment schemes (Ponzi-like schemes using crypto). These groups typically lured victims into fake cryptocurrency investment platforms, promising high returns, only to steal their funds. Penalty Amount: Not a single fine, but the estimated damages/stolen funds often run into tens to hundreds of millions of USD/EUR across various operations. Assets (properties, luxury cars, cryptocurrencies, cash) are seized during investigations. Individuals face lengthy prison sentences upon conviction. Outcome: Multiple individuals arrested, indicted, and facing criminal prosecution. Assets seized. Some cases are ongoing in court; others have led to convictions. These operations often dismantle sophisticated, internationally operating fraud rings.
Entity Targeted: Individuals or, in some cases, businesses found to have undeclared income from cryptocurrency trading or mining. Violation Type: Tax evasion (undeclared income from cryptocurrency transactions). Penalty Amount: Varies significantly depending on the undeclared amounts. It includes back taxes, penalties (e.g., 0.02% per day of delay), and interest. Specific aggregated amounts for "significant" cases against entities are rarely publicized, but for individuals, it can reach hundreds of thousands of RON. Outcome: Tax assessments issued, collection of back taxes, penalties, and interest. Criminal charges for severe cases of tax evasion.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — publishing non-custodial self-custodial wallet software does not trigger VASP/CASP classification under Romanian Law 129/2019 because the definition of 'custodian wallet provider' requires safeguarding client private keys, which the publisher does not do; no AML registration or license is required, but the operator must remain strictly non-custodial and not offer exchange or key-holding services.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?