Romania AML Supervision and Cross Border Groups

It’s an overview of Romania’s AML super­vision and oblig­a­tions for cross-border groups, clari­fying regulatory scope, reporting duties, and super­visory coordi­nation to ensure compliance and effective oversight.

The Romanian Regulatory Framework and Legislative Alignment

Implementation of the 5th and 6th EU Anti-Money Laundering Directives

Romania has trans­posed the 5th and 6th AML Direc­tives into national law, expanding oblig­a­tions for crypto-asset providers, strength­ening beneficial ownership trans­parency, enhancing risk-based due diligence, and increasing penalties for serious money laundering offenses.

The Mandate of the National Office for Prevention and Control of Money Laundering (ONPCSB)

ONPCSB serves as Romania’s Financial Intel­li­gence Unit, receiving and analyzing suspi­cious trans­action reports, coordi­nating with law enforcement and EU partners, and issuing guidance to super­vised entities to strengthen preventive controls.

Statutory respon­si­bil­ities include analyzing STRs, conducting on-site and off-site assess­ments of compliance among desig­nated insti­tu­tions, coordi­nating national AML/CFT strategy, sharing intel­li­gence with domestic and inter­na­tional counter­parts, and proposing legislative or regulatory changes while cooper­ating closely with the NBR and ASF.

Sector-Specific Oversight by the National Bank of Romania (NBR) and the ASF

NBR super­vises banks and payment insti­tu­tions for AML compliance, integrating AML checks into prudential exams and coordi­nating cross-border super­vision with home and host author­ities.

National Bank of Romania embeds AML/CFT into consol­i­dated and on-site super­vision, performs thematic inspec­tions and can enforce remedial measures; the Financial Super­visory Authority regulates insurers, capital markets and pension schemes, issues sector-specific AML rules, and engages in joint actions with ONPCSB and foreign super­visors on cross-border group oversight.

Supervisory Methodologies for Credit and Financial Institutions

The Transition to a Risk-Based Approach (RBA) in Inspections

Romanian super­visors have shifted inspection focus from checklist compliance to risk priori­ti­sation, concen­trating resources on higher-risk activ­ities, customers and controls, and tailoring scope, sampling and follow-up measures to insti­tu­tional risk profiles and cross-border exposures.

Off-site Monitoring and Electronic Reporting Requirements

Super­visors require regular electronic reporting, standardized templates and automated alerts to support off-site trend analysis, anomaly detection and prompt escalation of suspi­cious patterns across domestic entities and foreign branches.

Electronic systems integrate super­visory dashboards, automated risk scoring and interbank data feeds, allowing cross-border consol­i­dation, peer bench­marking and targeted inquiries; mandatory formats and secure portals reduce reporting delays while enabling super­visors to escalate onsite inspec­tions where off-site indicators show elevated risk.

Governance Requirements for Cross-Border Groups

Implementation of Group-Wide AML/CFT Policies and Procedures

Groups must adopt standardized AML/CFT policies that set minimum controls, risk assess­ments, and reporting templates across juris­dic­tions, with documented escalation routes to the group level and periodic testing to ensure consistent appli­cation in Romania and abroad.

Appointment of Group Compliance Officers and Local Reporting Lines

Appointing a group compliance officer ensures centralized oversight while desig­nated local officers maintain country-specific reporting lines to Romanian management and the group head, preserving clear account­ability for suspi­cious activity reporting and regulatory engagement.

Senior compliance officers should have direct board access, full visibility of local trans­action monitoring and audit outputs, and authority to require remedi­ation in Romanian entities; they must set reporting cadences, validate country risk assess­ments, coordinate cross-border inves­ti­ga­tions, address data protection limits on infor­mation sharing, and ensure local officers receive mandated training and resources to meet both group and Romanian super­visory expec­ta­tions.

Harmonizing Romanian Requirements with International Group Standards

Harmo­nizing policies requires mapping Romanian legal oblig­a­tions to group standards, resolving conflicts through formal escalation, and documenting devia­tions with super­visory notifi­cation to ensure both compliance with local rules and consistent group risk management.

Practical harmo­nization involves a formal gap analysis of Romanian legis­lation, BNR and FIU guidance against group rules, followed by documented justi­fi­ca­tions for any diver­gence and legal opinions where needed; proactive engagement with Romanian super­visors, regular testing, and consol­i­dated reporting help manage enforcement risk and demon­strate that group-wide controls respect mandatory national provi­sions.

Information Sharing and Data Privacy in Multinational Entities

Legal Framework for Internal Information Exchange Between Subsidiaries

Romanian AML law and EBA guidance permit inter-subsidiary data sharing for prevention and detection of money laundering, provided transfers rest on documented legal bases, defined purposes, internal protocols, DPIAs and strict access controls, while aligning with FIU reporting oblig­a­tions and super­visory expec­ta­tions.

Navigating GDPR Constraints Within Cross-Border AML Investigations

Compliance must rest on appro­priate legal bases under GDPR, justify processing of personal and special-category data under Articles 6 and 9, apply minimization and retention limits, and rely on transfer mecha­nisms or deroga­tions for cross-border exchanges while documenting decisions and maintaining strict access controls.

Practical steps include conducting a DPIA focused on cross-border AML processing, appointing or consulting the group DPO, imple­menting pseudo­nymi­sation and strict role-based access, and documenting legal bases and retention schedules; transfers outside the EEA should use SCCs, adequacy findings or narrow deroga­tions, with prior consul­tation of ANSPDCP and coordi­nation with the FIU when reporting duties intersect with data protection oblig­a­tions.

Cooperation with European and International Supervisory Bodies

Collaboration with the European Banking Authority (EBA) and AMLA

Romanian super­visors align with the EBA and AMLA on guide­lines, joint risk assess­ments, and super­visory conver­gence, contributing to EU-wide policy, partic­i­pating in peer reviews and technical working groups to harmonize AML practices and enforcement across cross-border banking groups.

Mutual Legal Assistance and FIU-to-FIU Information Exchange Protocols

Bilateral MLATs and EU judicial cooper­ation channels enable timely evidence-sharing, while Romania’s FIU exchanges intel­li­gence with foreign counter­parts via secure protocols and the Egmont network to support prose­cu­tions and asset recovery, respecting confi­den­tiality and data-protection rules.

Infor­mation exchanges proceed through formal MLAT requests for eviden­tiary material and direct FIU-to-FIU case queries using encrypted channels, standardized templates and agreed timelines to speed cross-border inves­ti­ga­tions; judicial author­ities and Eurojust coordinate complex probes, and strict confi­den­tiality, propor­tion­ality and EU data-protection standards govern disclo­sures and any freezing or tracing measures.

Compliance Challenges and Enforcement Trends

Beneficial Ownership Transparency and the Central Register Challenges

Confusion over data quality in the central register hampers effective beneficial ownership checks, creating gaps for cross-border groups and compli­cating compliance reporting for Romanian obliged entities.

Sanctions Screening and PEP Due Diligence in a Globalized Economy

Cross-border payment flows increase false negatives and false positives in sanctions screening, while PEP due diligence requires real-time intel­li­gence and coordi­nated risk scoring across juris­dic­tions.

Systems for sanctions screening and PEP identi­fi­cation frequently struggle with incon­sistent data feeds and name varia­tions, producing alert volumes that overwhelm compliance teams. Coordi­nation failures across group entities raise questions about screening thresholds and respon­si­bility allocation, prompting Romanian super­visors to expect stricter controls, clear escalation paths, and detailed audit trails.

Analysis of Recent Fines and Administrative Sanctions in the Romanian Market

Recent fines highlight short­comings in trans­action monitoring, client due diligence, and failure to report suspi­cious trans­ac­tions, signaling inten­sified Romanian enforcement against cross-border non-compliance.

Author­ities have issued several multi-million lei fines and admin­is­trative measures against banks and payment service providers for weak AML controls, poor beneficial ownership checks, and late suspi­cious activity reports. Sanctions often combine monetary penalties with mandatory remedi­ation plans, independent audits, and tighter reporting oblig­a­tions that force groups to centralize oversight. Super­visors increas­ingly hold head offices accountable and demand documented policies, technical controls, and periodic testing.

Summing up

Taking this into account, Romanian AML super­vision requires coordi­nated oversight, clear allocation of respon­si­bil­ities and effective infor­mation-sharing across cross-border groups to ensure compliance with EU direc­tives and reduce laundering risks through consistent enforcement and harmonised internal controls.

FAQ

Q: Which Romanian authorities supervise anti-money laundering (AML) and how do their responsibilities differ?

A: Oficiul Național de Prevenire și Combatere a Spălării Banilor (ONPCSB) functions as Romania’s Financial Intel­li­gence Unit (FIU) and the national AML/CFT coordi­nator; ONPCSB receives suspi­cious trans­action reports, conducts financial analyses, and coordi­nates inter-agency AML policies. Banca Națională a României (NBR) super­vises credit insti­tu­tions and certain payment entities for compliance with AML oblig­a­tions, carrying out onsite inspec­tions and imposing prudential and corrective measures where AML controls are weak. Autori­tatea de Supraveghere Finan­ciară (ASF) covers insurance, capital markets and private pension admin­is­trators for AML compliance within those markets. Ministry of Finance and other desig­nated national super­visors or profes­sional bodies retain super­visory or disci­plinary roles for specific obliged entities such as certain non-financial profes­sions; those bodies cooperate with ONPCSB and the prudential super­visors on enforcement and infor­mation exchange.

Q: How are cross-border banking groups with Romanian operations supervised for AML at group level?

A: EU and national frame­works require group-level AML/CFT programs that apply across all entities in a cross-border group, including coherent policies for customer due diligence, trans­action monitoring, and beneficial ownership controls. Parent-company and host-country super­visors coordinate consol­i­dated risk assess­ments and super­visory activ­ities; NBR and ONPCSB partic­ipate in coordi­nation for groups operating in Romania. European Anti-Money Laundering Authority (AMLA) now has a mandate to directly supervise certain high-risk cross-border entities and to coordinate complex cross-border cases, which creates an additional layer of oversight for groups desig­nated as signif­icant under EU rules. Internal audit, an independent group AML compliance function, and documented escalation channels to group senior management and local MLROs are expected under super­visory guidance.

Q: What differences apply to AML obligations for a Romanian branch versus a Romanian subsidiary of a foreign group?

A: A Romanian branch is not a separate legal entity and usually follows the parent firm’s policies, but Romanian law requires the branch to comply fully with national AML/CFT rules, register local beneficial ownership where applicable, and report suspi­cious trans­ac­tions to ONPCSB. A Romanian subsidiary is a locally incor­po­rated entity subject to Romania’s company law and bank or market licensing require­ments, and must implement its own local AML controls consistent with group policies while remaining subject to consol­i­dated super­vision. Super­visors treat branches and subsidiaries differ­ently for prudential require­ments, licensing, and some reporting oblig­a­tions, and both must maintain a desig­nated local MLRO or compliance officer respon­sible for filings and liaison with ONPCSB.

Q: How should cross-border groups handle suspicious transaction reporting and information sharing involving Romanian operations?

A: Suspi­cious trans­action reports origi­nating in Romania must be filed to ONPCSB in accor­dance with national law and ONPCSB guidance. Cross-border groups should have documented proce­dures for timely internal escalation to the group’s compliance function and for external reporting to the appro­priate FIUs in each juris­diction when required. ONPCSB exchanges opera­tional infor­mation with other EU FIUs via the EU FIU.net platform and cooperates with AMLA, EBA and law enforcement agencies under estab­lished channels for complex cross-border inves­ti­ga­tions. Data protection rules apply; lawful bases and secure channels must be used when sharing personal data across borders to support STR analysis and super­visory requests.

Q: What enforcement tools and penalties can Romanian supervisors apply to cross-border groups that breach AML requirements?

A: ONPCSB can issue admin­is­trative sanctions, require remedial action plans, and refer matters to criminal author­ities when STR analysis indicates criminal activity. NBR and ASF hold prudential enforcement powers that include fines, restric­tions on business activ­ities, appointment of provi­sional admin­is­trators, and in extreme cases withdrawal of licenses for entities under their remit. Super­visors may also require enhanced monitoring, independent reviews, and replacement or strength­ening of compliance personnel. Cross-border coordi­nation enables home and host super­visors to apply measures consis­tently across group entities and to exchange infor­mation necessary for propor­tional sanctions.