Skip to content
Romania for Business
Email

Crypto License in Romania – MiCA CASP Authorisation

MiCA authorisation · EU passport · AML/CFT · Travel Rule · ASF

Book a Consultation

A crypto license in Europe now means one document: authorisation as a crypto-asset service provider (CASP) under EU Regulation 2023/1114, the Markets in Crypto-Assets Regulation (MiCA). Its rules for service providers have applied in every EU member state since 30 December 2024, and a licence granted in one state is valid across the EU and EEA through the passport. In Romania, the authority expected to grant it is ASF (Autoritatea de Supraveghere Financiară), once the national implementing ordinance is adopted.

Romania for Business Advisory S.R.L. assists crypto businesses, exchanges, wallet providers, token issuers and other virtual asset service providers in obtaining the correct MiCA authorisation. We assess the applicable MiCA service category, prepare the complete application file – including the AML/CFT policy, business plan and fit-and-proper documentation – and manage the submission and correspondence with the competent authority throughout the review period – ASF once it is designated, or another EU authority whose licence is passported to Romania.

Crypto licensing in Romania – status checked on 6 October 2026

Romania has not yet adopted the emergency ordinance that designates its MiCA competent authority; the Ministry of Finance draft reached the Government in April 2026. Until it is adopted, ASF cannot receive or decide CASP applications, as ASF confirmed publicly in July and again in September 2026. The transitional period for firms that operated before MiCA ended on 1 July 2026, so a business that wants to serve Romanian clients today needs a MiCA licence from another member state, passported into Romania. Minimum capital is €50,000, €125,000 or €150,000 depending on the service class, and a regulator must decide within 40 working days of receiving a complete application.

Crypto / CASP licence – Romania

on request
engagement fee

CASP licensing engagement includes:

  • Eligibility and service classification assessment – which MiCA category applies
  • MiCA CASP authorisation (Title V, Art. 59–85) or Article 60 notification – determined at scoping
  • Company structure review – SRL capital, shareholding and management requirements
  • Fit and proper declarations – shareholders, directors and UBO regulatory vetting
  • AML/CFT policy and procedure manual – ONPCSB and MiCA requirement
  • Business plan and financial projections – required for MiCA authorisation
  • Whitepaper review for asset issuers – MiCA Titles II–IV (Art. 4–58)
  • Authorisation application – prepared for ASF once designated, or for another EU competent authority (passporting to Romania)
  • Submission and correspondence with the competent authority throughout the review period
  • Licence condition compliance briefing – ongoing obligations post-award
  • Coordination with our partner lawyer (AML/GDPR), accounting and company establishment teams

Indicative engagement fees

  • MiCA authorisation – Class 1 (limited services, e.g. transfer services, placing, advice) from €12,000
  • MiCA authorisation – Class 2–3 (exchange, custody, brokerage, etc.) from €13,500
  • Asset issuer – crypto-asset white paper review (MiCA; EMTs only by credit / e-money institutions) from €12,500
  • AML/CFT policy package – ONPCSB + MiCA compliant from €3,000
  • Post-authorisation compliance review (annual) from €600
  • Competent authority fees billed at cost
Check your CASP eligibility →

Fees confirmed in writing after eligibility assessment. MiCA is a live and evolving regulatory framework – requirements may change. Competent authority fees are billed at cost separately. Fees may be subject to Romanian VAT.

The transitional period for pre-MiCA crypto providers ended on 1 July 2026

Before MiCA, crypto exchange and custodial wallet providers in Romania were reporting entities under AML Law 129/2019 and registered with ONPCSB. A separate licensing procedure with the Ministry of Finance, written into that law in 2020, was repealed by Government Emergency Ordinance 10/2025. Romania gave registered firms the maximum 18-month transitional period under Article 143(3) MiCA (ESMA list of grandfathering periods), and it ended on 1 July 2026. A pre-MiCA registration does not convert into a licence: every provider now needs MiCA authorisation.

What Is a Crypto-Asset Service Provider (CASP) Under MiCA?

MiCA defines a Crypto-Asset Service Provider (CASP) as any legal entity that provides one or more of the following crypto-asset services on a professional basis to clients in the EU. A business that provides any of these services to Romanian or EU clients must be authorised as a CASP under MiCA – regardless of where the business is incorporated.

Custody & admin of crypto-assets

€125,000
Class 2 – full authorisation required

Operating a crypto trading platform

€150,000
Class 3 – full authorisation required

Exchange: crypto for fiat

€125,000
Class 2 – full authorisation required

Portfolio management

€50,000
Class 1 – MiCA authorisation required

Transfer services

€50,000
Class 1 – MiCA authorisation required

Placing of crypto-assets

€50,000
Class 1 – MiCA authorisation required

 

MiCA also regulates issuers. An issuer of ordinary crypto-assets notifies its white paper to the competent authority at least 20 working days before publication, and the authority does not approve it in advance. Asset-referenced tokens (ARTs) need an issuer authorisation unless the average amount outstanding stays below €5 million or the offer is limited to qualified investors. E-money tokens (EMTs) may be issued only by a credit institution or an e-money institution.

Which MiCA Route Applies: Authorisation or Notification?

Most crypto businesses need CASP authorisation under Article 63 MiCA. A bank, investment firm, e-money institution, UCITS manager, AIFM, central securities depository or market operator already authorised in the EU can instead notify its home regulator at least 40 working days before the first crypto service (Article 60). MiCA has no lighter “registration”: the classes below differ in capital and scope, not in procedure, and the route is settled at scoping, before any document is drafted.

MiCA authorisation – Class 1

Applies to:

  • Crypto-asset service providers performing Class 1 services such as reception and transmission of orders, execution of orders, placing, transfer services, advice or portfolio management
  • Banks, investment firms and e-money institutions do not use this route – they notify under Article 60

Minimum prudential safeguards:

€50,000 for Class 1 services

Timeline:

3–4 months (indicative)

MiCA Authorisation – Class 2 & 3

Required for:

  • Crypto exchanges (crypto-to-crypto or crypto-to-fiat)
  • Custody and administration of crypto-assets
  • Any CASP providing services not covered by the Class 1 route

Minimum prudential safeguards:

€125,000 (Class 2) – €150,000 (Class 3)

Timeline:

6–12 months (indicative)

One Crypto License for Europe: How the MiCA Passport Works

A crypto license in Europe is issued by one national regulator and extended to other EU and EEA states by notification, not by a second application (Article 65 MiCA). The CASP sends its home regulator the list of states, the services and the start date. The regulator forwards this to the host states, ESMA and EBA within 10 working days, and services may start once the CASP receives confirmation, or at the latest on the 15th calendar day after filing. No office is needed in the host state.

Route Open on 6 Oct What it takes
CASP licence from ASF Not yet – ASF is not designated Romanian SRL or SA and a file under Articles 62–68 MiCA, lodged after the implementing ordinance is adopted
Licence from another EU state, passported Yes Registered office and effective management in that state, at least one EU-resident director, notification to the home regulator
Article 60 notification Yes, for banks, investment firms and e-money institutions Notification to the home regulator at least 40 working days before the first crypto service

A Romanian application suits a group that wants its EU base in Romania and can wait for the ordinance. A business that must start serving EU clients in 2026 should not plan around a Romanian filing date that has not been set. Authorised providers can be checked in the interim MiCA register on the ESMA website.

What a Regulator Checks in a CASP Application

ASF supervises Romania’s capital markets, investment firms, insurance and private pensions and is the authority expected to license CASPs once the implementing ordinance is adopted. The checks below come from MiCA itself (Articles 59–68), so they apply whichever EU regulator receives the file.

Requirement Detail
Registered office in Romania To be authorised in Romania, the CASP needs a registered office in Romania (SRL or SA) and must provide at least part of its services there. MiCA also requires its place of effective management in the EU and at least one director resident in the EU (Article 59). A branch of a non-EU company cannot be authorised.
Management body fit and proper All members of the management body (directors) must satisfy the regulator’s fit and proper criteria – professional competence in crypto-asset markets, clean criminal record, no history of regulatory sanctions and sufficient reputation and integrity.
Shareholder fit and proper Shareholders holding a qualifying interest (10% or more of capital or voting rights) must also satisfy fit and proper criteria; the regulator refuses authorisation if they are not suitable.
AML/CFT compliance programme The CASP must have a documented AML/CFT policy and procedure manual compliant with both MiCA and Romanian AML Law 129/2019. An AML compliance officer must be designated. The programme must be operational before the authorisation is granted.
Business plan A detailed business plan must be submitted as part of the full authorisation application – describing the services, target market, revenue model, risk management framework, IT systems, outsourcing arrangements and a three-year financial forecast.
Prudential safeguards At all times the higher of the Annex IV minimum (€50,000, €125,000 or €150,000 by class) or one quarter of the previous year’s fixed overheads; a new firm uses the projected overheads from its application. Proof of the safeguard is part of the application file (Articles 62 and 67).
Governance and internal controls MiCA requires CASPs to have robust governance arrangements – including an internal audit function (or equivalent), a risk management framework, a compliance function and documented policies on conflicts of interest, client asset safeguarding and complaints handling.
Insurance instead of own funds In any class, the safeguard can be own funds, an insurance policy covering the EU states where services are provided, a comparable guarantee, or a combination (Article 67(4)). A policy must run for at least one year, carry at least 90 days’ cancellation notice and be disclosed on the CASP’s website.

MiCA CASP Application Process – Step by Step

The steps follow Articles 62 and 63 MiCA; ASF has not published a Romanian procedure because it has not yet been designated. Romania for Business Advisory S.R.L. manages the complete process from eligibility assessment through to licence award and post-authorisation compliance briefing.

01

Eligibility & service classification

02

Company structure prepared

03

AML/CFT programme drafted

04

Business plan prepared

05

Capital confirmed & evidenced

06

Application submitted

07

Regulator review & queries managed

08

Authorisation granted

Stage What happens
Eligibility assessment We review the planned crypto-asset services against the MiCA service classification framework and confirm whether CASP authorisation or an Article 60 notification applies and which class (1, 2 or 3) the services fall into, with the matching capital and governance requirements.
Company structure preparation We review the company structure – confirming that the Romanian SRL has the correct share capital, registered office and management body composition. If the company has not yet been incorporated, we coordinate the registration process.
AML/CFT programme We prepare an AML/CFT policy and procedure manual compliant with MiCA and Romanian AML Law 129/2019 – including risk assessment, CDD/EDD procedures, PEP and sanctions screening, transaction monitoring and ONPCSB reporting. The compliance officer is designated.
Business plan We prepare the business plan (programme of operations) – services description, target market, governance structure, IT systems overview, outsourcing arrangements, risk management framework and three-year financial projections.
Application submission The regulator acknowledges receipt within 5 working days, checks completeness within 25 working days and decides within 40 working days of a complete file (Article 63). In Romania this step waits until ASF is designated.
Regulator correspondence We manage all queries and information requests during the review period. A request for missing information stops the 40-working-day clock for up to 20 working days, so prompt answers keep the timeline.
Authorisation and conditions When the authorisation is granted, we review the licence conditions with the client – identifying all ongoing obligations (capital maintenance, periodic reporting, AML programme updates, supervisory fees).

AML/CFT Obligations – CASPs as Obliged Entities

Under Romanian AML Law 129/2019 (amended in 2020 for the 5th AML Directive and in 2025 for crypto transfers), crypto-asset service providers are obliged entities – subject to full AML/CFT compliance obligations. These are separate from, and in addition to, MiCA’s own governance requirements.

AML obligation What the CASP must implement
Business-wide AML risk assessment A documented analysis of the money laundering and terrorist financing risks specific to the CASP’s services – by client type, transaction type, geography and delivery channel. Must be updated whenever significant changes occur.
CDD / KYC procedures Full customer due diligence (CDD) on all clients – identity verification (name, address, date of birth, identity document), source of funds assessment and ongoing monitoring. Enhanced due diligence (EDD) for higher-risk clients, PEPs and clients from high-risk jurisdictions. Standard CDD applies to any crypto transaction of €1,000 or more, single or linked (Article 13, added by Law 86/2025).
Transaction monitoring Automated or manual monitoring of client transactions for unusual patterns – large cash-equivalent transactions, rapid movement between wallets, geographic anomalies and patterns inconsistent with the client’s risk profile.
Travel Rule compliance CASPs transferring crypto-assets must comply with the FATF Travel Rule (implemented via EU TFR Regulation 2023/1113) – with additional requirements applying in certain cases involving self-hosted addresses and transfers exceeding €1,000.
ONPCSB reporting Suspicious transaction reports (STRs) must be filed with ONPCSB (the Romanian AML authority) when a CASP suspects that a transaction or funds are related to money laundering or terrorist financing.
AML compliance officer A designated AML compliance officer with sufficient authority and independence. The compliance officer is personally responsible for the CASP’s AML programme and ONPCSB liaison. Breaches are fined as administrative offences, and fines can be imposed on directors personally.

AML breaches are fined – tipping off is a crime

Under Law 129/2019, failing to apply customer due diligence, to report suspicious transactions to ONPCSB or to keep records is an administrative offence (Article 43): the company is fined, and fines can also be imposed on members of the management body and other responsible persons. Telling a client that a report has been or will be filed is a criminal offence (Article 47), as is money laundering itself (Article 49). AML compliance is a pre-condition for CASP authorisation – not an afterthought.

Crypto Taxes in Romania in 2026

Crypto taxes in Romania changed on 1 January 2026: an individual’s gains on crypto-assets are taxed at 16%, up from 10% in 2025 (Fiscal Code Article 116(2)(c), as amended by Laws 141/2025 and 239/2025). The rules below were checked on 6 October 2026.

Who Rule in 2026 Deadline / condition
Resident individual 16% on the net gain: sale price minus purchase price and transaction fees Declarația unică by 25 May of the following year
Small gains Not taxed if each transaction gains less than RON 200 and the year’s total stays within RON 600 Both conditions must be met, otherwise the whole gain is taxed
Romanian company, including a CASP Crypto gains are part of taxable profit at the standard 16% corporate income tax rate Annual corporate income tax return
CASP with EU users Reports users and their crypto transactions to ANAF under DAC8 (Government Emergency Ordinance 71/2025) 2026 transactions reported by 15 March 2027

Personal and business taxes beyond crypto are covered in our overview of taxes in Romania in 2026.

Frequently Asked Questions – Crypto / CASP Licence in Romania

MiCA (Markets in Crypto-Assets Regulation – EU Regulation 2023/1114) is the EU-wide regulatory framework for crypto-asset service providers and crypto-asset issuers. It became fully applicable across all EU member states, including Romania, on 30 December 2024. MiCA replaced previous national VASP registration regimes with a harmonised EU framework. In Romania, the ordinance that would designate ASF (Autoritatea de Supraveghere Financiară) as competent authority had not been adopted by 6 October 2026, so Romanian applications cannot yet be filed.

Any business providing crypto-asset services on a professional basis to clients in the EU must be authorised as a CASP under MiCA – regardless of where the business is incorporated. MiCA crypto-asset services include: custody and administration of crypto-assets, operating a crypto exchange, exchanging crypto for fiat, portfolio management, transfer services, placing of crypto-assets, reception and transmission of orders, and advice on crypto-assets. If your business provides any of these services to EU clients, you need a MiCA authorisation, or an Article 60 notification if you are already an authorised bank, investment firm or e-money institution. The transitional period for pre-MiCA providers ended on 1 July 2026.

No. MiCA has one CASP authorisation with three capital classes: Class 1 (€50,000) for advice, reception, transmission and execution of orders, placing, transfer services and portfolio management; Class 2 (€125,000) adds custody and exchange of crypto-assets for funds or other crypto-assets; Class 3 (€150,000) adds operating a trading platform. Banks, investment firms, e-money institutions and some other regulated entities may instead notify their home regulator at least 40 working days before starting (Article 60 MiCA).

The higher of two amounts: the Annex IV minimum – €50,000 for Class 1, €125,000 for Class 2 (including custody and exchange of crypto-assets for funds or other crypto-assets) and €150,000 for Class 3 trading platforms – or one quarter of the previous year’s fixed overheads. The safeguard can be own funds, an insurance policy, a comparable guarantee or a combination (Article 67), and evidence of it is part of the application file.

Three costs add up. Our engagement fee starts from €12,000 for a Class 1 authorisation and from €13,500 for Class 2–3, with an AML/CFT policy package from €3,000. The prudential safeguard is €50,000, €125,000 or €150,000 by class, or a quarter of fixed overheads if that is higher, and it can be covered partly or fully by insurance. Regulator fees are set by each member state and billed at cost.

Indicative timelines from application submission to decision: Class 1 – approximately 3–4 months; Class 2 and 3 – 6–12 months. Under Article 63 MiCA, the regulator checks completeness within 25 working days and decides within 40 working days of a complete application; each request for missing information suspends that period for up to 20 working days. In Romania the clock cannot start until ASF is designated as competent authority.

No. A registration with ONPCSB only allowed a provider to keep operating during the transitional period, which Romania set at the maximum 18 months and which ended on 1 July 2026 (ESMA list of grandfathering periods under Article 143(3) MiCA). Since then, a pre-MiCA provider without MiCA authorisation may not provide crypto-asset services in the EU and has to apply as a new CASP.

Yes – MiCA provides a passporting mechanism that allows a CASP authorised in one EU member state to provide services in all other EU member states, either on a cross-border basis or through a branch, following a notification to the home state competent authority. Services may start once the home regulator confirms it has forwarded the notification, and at the latest on the 15th calendar day after filing (Article 65). This is one of the key commercial advantages of MiCA – a Romanian CASP authorisation provides an EU-wide service passport.

CASPs in Romania are obliged entities under Romanian AML Law 129/2019 – subject to full AML/CFT obligations including: business-wide AML risk assessment, customer due diligence (CDD/KYC) on any transaction of €1,000 or more and enhanced due diligence (EDD) for higher-risk clients, transaction monitoring, Travel Rule compliance with additional requirements applying in certain cases involving self-hosted addresses and transfers exceeding €1,000, suspicious transaction reporting to ONPCSB, and designation of an AML compliance officer. AML compliance is a pre-condition for MiCA authorisation – not something that can be addressed after the licence is granted.

Yes. Post-authorisation compliance obligations include: periodic reporting to the competent authority, capital maintenance at the required level, AML programme annual updates, ongoing transaction monitoring, ONPCSB reporting, periodic fit-and-proper reassessments when management or ownership changes, and compliance with MiCA’s ongoing client disclosure requirements. Romania for Business Advisory S.R.L. offers post-authorisation compliance support as a separate annual engagement.