ROMANIA Law and Practice Contributed by: Alexandru Stanescu, Simina Negulescu, Anca Popan and Mihai-Cristian Huială, Lexters
Blockchain and Intellectual Property Blockchain projects engage the ordinary Romanian rules on copyright, software, databases, trade secrets and trade marks. A token does not, by itself, transfer copyright or other IP rights in the underlying content. Projects involving NFTs, tokenised access rights, soft- ware protocols or data layers should therefore sepa- rate the on-chain asset from the off-chain IP licence or assignment. 1.1.2 Regulatory Sandbox There is no broad domestic regulatory sandbox in Romania dedicated to crypto-assets, CASPs, decen- tralised finance (DeFi) or tokenisation. Innovators instead engage through a combination of national innovation hubs, EU-level sandbox structures and the EU DLT Pilot Regime. The ASF FinTech Hub and the BNR FinTech Innova- tion Hub are useful for regulatory engagement, but do not suspend licensing, conduct, prudential or AML requirements. While the BNR and ASF have considered broader tools similar to sandbox ones, at present no general Romanian crypto-asset sandbox appears to be operational. At EU level, the European Blockchain Regulatory Sandbox has become more relevant, as it has completed three cohorts of block- chain/DLT use cases, in which the ASF participated in the third cohort. The EU sandbox is useful for regula- tory dialogue and legal certainty, but it should not be described as a substitute for Romanian or EU authori- sation. 1.1.3 Regulation of Blockchain Technology Regulatory Approach to Blockchain Technology Romanian law does not regulate blockchain technol- ogy as such. Instead, it regulates: • the activity performed through the technology; • the rights created by the instrument; • the assets held by users; • the financial service provided by an intermediary; or • the data processing carried out by a platform. This is consistent with MiCA’s technology neutral approach, under which the underlying technology is not meant to be regulated in isolation, while crypto-
assets and crypto-asset services are subject to spe- cific requirements. Licensing Triggers and Regulatory Thresholds This distinction is important in practice, because a company using distributed ledger technology for internal records, supply chain traceability, market- ing analytics or proof of existence solutions will not normally need a specific licence only because it uses blockchain. By contrast, the same technology may trigger MiCA, Directive 2014/65/EU on markets in financial instruments (MiFID II), payment services, electronic money, fund, consumer credit or AML rules if it is used to issue transferable crypto-assets, man- age client crypto-assets, provide exchange services, raise financing or process payments. Outsourcing, Governance and Operational Resilience Regulated financial firms must assess blockchain solutions through the ordinary outsourcing, gov- ernance, ICT and operational resilience framework. Where a critical or important function is outsourced to a blockchain infrastructure provider, cloud provider, wallet provider or analytics provider, the firm remains responsible towards the regulator. DORA is especially relevant for banks, payment institutions, electronic money institutions, investment firms and CASPs, as it imposes specific requirements on ICT risk manage- ment, incident reporting, testing and third-party ICT providers. At national level, Emergency Ordinance No 14/2026 implements DORA by designating the BNR and ASF as the competent authorities, establishing a sanctioning regime that includes fines of up to 10% of annual turnover for entities and up to RON23 mil- lion for individuals, and requiring regulated entities to maintain an ICT risk management framework and to report ICT incidents in accordance with the regulation. Data Protection and Blockchain Immutability The General Data Protection Regulation (GDPR) applies irrespective of whether the data is stored on- chain or off-chain, so blockchain immutability can conflict with the rights to erasure, rectification and restriction of processing. A correction entry on-chain may help explain the record, but it does not always amount to erasure or rectification in the GDPR sense. For this reason, the prior assessment of what catego-
530 CHAMBERS.COM
Powered by FlippingBook