ROMANIA Trends and Developments Contributed by: Alexandru Stanescu, Simina Negulescu, Stefan Gheorghe and Ioana Vișan, Lexters
In crypto-card programmes, the cleanest split pairs an EEA-passported EMI with a separately authorised CASP, with the contractual stack – issuer agreement, programme manager terms, wallet T&Cs – drafted in parallel so that no payment operation falls outside an authorised perimeter. An EMI or PSP authorised any- where in the EEA can passport into Romania by noti- fication to BNR, without a separate Romanian licence – but any gap in the EMI’s licensed status directly affects the lawfulness of the card product for Roma- nian users. Until PSD3/PSR consolidates EMT payment obliga- tions into a single framework, crypto-payment models in Romania should maintain a clear structural fallback to an authorised payment service provider (PSP). Operators best positioned to scale across the EU treat the EMI-CASP split as permanent infrastructure. DORA and NIS2 in Romania: Cybersecurity Obligations for CASPs and Payment Institutions Cybersecurity is now part of the licensing infrastruc- ture. Alongside MiCA and the EU Transfer of Funds Regulation (the “Travel Rule”), DORA completes a three-piece compliance perimeter: MiCA determines who may operate, the Travel Rule traces where value moves, and DORA secures the technology that keeps it all running. DORA has applied since 17 January 2025 to CASPs, payment and e-money institutions, and certain ICT third-party providers. Micro-CASPs (turnover of less thanEUR2 million, and fewer than ten staff) are subject to a lighter regime but are not exempt. DeFi front-ends fall in scope where an identifiable operator provides exchange, staking or similar services. Romania implemented DORA through Government Emergency Ordinance No 14/2026, designating the BNR and ASF as the DORA competent authorities for financial entities. Key requirements include a 30-day BNR notification on commencing payment-process- ing operations, the BNR as sole co-ordinator of threat- led penetration testing, and ad-hoc ICT audit powers for both authorities. Romania transposed the NIS2 Directive through GEO No 155/2024, requiring essential and important enti-
ties to self-assess, register within 30 days and follow a structured incident-reporting cascade. In practice, this means a board-approved ICT risk framework with drill-tested wallet recovery, a certified penetration test at least every three years for non-micro CASPs, criticality-rated ICT vendor contracts with audit rights and exit clauses, and threat-intelligence sharing with- in trusted networks. Under DORA, governing body members of CASPs and financial entities are person- ally accountable for ICT risk management failures. Under the lex specialis principle, financial entities sub- ject to DORA apply DORA rather than NIS2, though additional NIS2 obligations may apply where the enti- ty is also designated as essential or important. The right approach is an integrated operational resilience framework aligning incident classification, vendor due diligence, penetration testing and audit trails across DORA, NIS2, MiCA and AML. The framework is still being refined through delegated acts and European Supervisory Authorities (ESAs) technical standards, so DORA compliance should be treated as an ongoing process. RWA Tokenisation and Crowdfunding Structures in Romania: the SPV Model and Regulatory Classification Tokenisation of real-world assets is one of the most commercially relevant blockchain use cases, and it sits alongside both centralised and decentralised crowdfunding models. The starting point for any RWA tokenisation in Romania is not tokenisation as a stan - dalone regulatory category, but the legal classification of the token and the rights attached to it. The same product can be structured so that MiCA and financial instruments legislation either do not apply or clearly do – the distinction lies in the underlying rights, not in the technology. A workable model currently seen in Romania is the tokenised representation of corporate rights. Instead of tokenising an asset directly, the asset is held by a Romanian SPV and investors receive rights connected to shares or other participation rights in that SPV (or in an investor vehicle). The token operates as a digital representation of those corporate or economic rights, while ownership and transfers remain anchored in the corporate documents and shareholder register.
548 CHAMBERS.COM
Powered by FlippingBook