Why substance matters for ONJN
Romanian gambling licences carry a substance bar materially higher than most European regulated regimes. The framework under GEO 77/2009 as amended, supplemented by ONJN Order 226/2024 and the OUG 82/2023 reforms, treats licensees as operational Romanian enterprises, not paper vehicles fronting offshore operations. The regulator's enforcement model assumes that:
- Player-facing operations physically occur in Romania.
- Customer service, AML, and compliance decisions are made by Romanian-resident staff.
- Technical infrastructure is hosted on Romanian territory under Romanian legal jurisdiction.
- Inspections can occur on-site, with regulator staff physically visiting the operator's premises.
Operators that approach the Romanian regime expecting a Curaçao-style paper licence are routinely caught out at the first inspection cycle. Substance failures are the single most common reason for licence suspension under Article 27 of GEO 77/2009 — more common than fit-and-proper issues or financial irregularities.
Territorial server hosting
The Romanian-territory hosting rule is enshrined in Article 15 of GEO 77/2009 as amended by OUG 82/2023. The technical requirements:
- Primary game servers and player-account databases must reside in Romania. Cloud regions outside Romania (AWS Frankfurt, GCP europe-west, Azure West Europe) are not permitted for primary infrastructure.
- Off-site backup infrastructure may sit in other EU member states under strict conditions: regular replication, documented disaster-recovery procedures, no live operational dependency.
- Data sovereignty — Romanian player data must be governed by Romanian law and subject to Romanian regulator access. EU-only hosting satisfies this only with documented Romania-as-primary arrangements.
- SAFE integration — ONJN's real-time gambling-activity monitoring system requires direct connectivity from the operator's primary infrastructure. Operating from non-Romanian hosting compromises the integration.
In practice, operators use Romanian data centres (NX Data, Telekom Romania, Orange Business) or Romanian-domiciled colocation arrangements with international providers. AWS does not operate a Romanian region as of 2026; cloud-native operators typically arrange dedicated colocation with on-premises hardware in Bucharest or Cluj-Napoca.
The compliance officer requirement
Every Romanian Class 1 and Class 2 licensee must register a dedicated compliance officer (responsabil de conformitate) with ONJN. The requirements:
- Romanian residency — habitual residence in Romania, supported by a Romanian residence permit or citizenship. Non-resident compliance officers are not accepted.
- Documented gambling-compliance experience — typically 3+ years in gambling AML, regulatory affairs, or responsible-gambling roles. ONJN evaluates CVs and may interview the proposed officer.
- No conflicting roles — the compliance officer cannot simultaneously hold a board seat or executive role in the same operator, ensuring functional independence.
- Direct reporting to the operator's board — the compliance officer must have a documented escalation channel that bypasses operational management.
- Specific functional responsibilities under ONJN Order 145/2018: oversight of AML, responsible gambling, SAR filings, transaction monitoring, regulator liaison, and inspection coordination.
The compliance officer is the regulator's primary point of contact at the operator. Failures of the compliance function are treated by ONJN as failures of the licensee — operators that "outsource" compliance to a non-Romanian shared-services centre, leaving only a nominal Romanian officer, routinely fail the substance review.
Data archiving and retention
Romanian gambling law imposes data retention obligations that exceed those in most EU jurisdictions:
- Transaction logs (every bet, win, deposit, withdrawal) — retained minimum 5 years under Article 19 of GEO 77/2009 as amended, in a form that supports regulator query and audit.
- Player KYC documentation — retained minimum 5 years post-account-closure under the AMLD6 transposition.
- Communications with players (email, chat, SMS, push) — retained minimum 2 years under consumer-protection rules; longer under AML rules where SAR-relevant.
- Compliance officer activity logs — internal escalations, SAR drafts, regulator correspondence — retained minimum 5 years.
- Responsible-gambling intervention records — self-exclusion entries, deposit-limit triggers, problem-gambling assessments — retained minimum 7 years, the longest of the categories.
The retention infrastructure must be on Romanian territory (per the hosting rule) and regulator-accessible within reasonable notice (typically 5 business days for routine requests, immediate for urgent regulatory needs).
The on-site inspection regime
ONJN conducts both scheduled and unannounced on-site inspections. The cadence:
- Scheduled inspections — typically once per year for active Class 1 operators, with advance notice of 2–4 weeks.
- Unannounced inspections — triggered by player complaints, AML referrals from ONPCSB, SOIIA anomalies, or media reports. Frequency varies but increases sharply after material changes (ownership, products, platform).
- Follow-up inspections — after a finding requires remediation, ONJN conducts a follow-up visit (typically 30–90 days post-finding) to confirm closure.
- Joint inspections — with ONPCSB on AML matters, with ANAF on tax matters, with consumer-protection authorities on advertising/marketing matters.
Inspectors examine:
- Compliance officer presence and competence — the officer must be physically present (or immediately reachable) during the inspection.
- Technical infrastructure — server location, SAFE integration health, transaction-log integrity.
- KYC and AML files — sample audit of player files, particularly high-value or high-risk players.
- Responsible-gambling interventions — sample audit of self-exclusion compliance, deposit-limit enforcement, problem-gambling escalations.
- Player-fund segregation — bank reconciliation confirming segregated funds match recorded liabilities.
- Marketing compliance — review of recent advertising, affiliate contracts, bonus terms.
- Tax compliance — reconciliation of GGR calculations and 27% remittance to ANAF.
Real cases of suspension and revocation
Public records via the ONJN licensees register show multiple licence suspensions and revocations annually. Common patterns:
- Capital-floor breach — operator falls below RON 8.5M during stress periods. Triggers automatic suspension procedure under Article 27.
- Marketing violations — promotion to self-excluded players, inadequate responsible-gambling messaging, or unauthorised celebrity endorsements. Suspensions of 30–90 days are common.
- AML failures — missed SAR filings, inadequate KYC, transaction monitoring failures discovered at inspection. Repeated failures lead to revocation rather than suspension.
- Substance failures — server hosting moved offshore without notification, compliance officer relocated outside Romania, audit-trail integrity compromised. Among the more serious findings.
- Tax-remittance failures — late or incomplete 27% GGR-tax payments to ANAF. ANAF coordinates with ONJN; chronic tax delinquency leads to revocation.
The strategic implication for operators: substance is not a check-the-box exercise. It is the operational baseline of running a Romanian gambling business. Operators who treat it as a regulatory tax to be minimised face an escalating risk of enforcement; operators who invest in genuine Romanian operations find the inspection cycle predictable and manageable.
Frequently asked questions
Can I use AWS Frankfurt for primary infrastructure?
No. Article 15 of GEO 77/2009 requires primary game servers and player-account databases on Romanian territory. AWS Frankfurt sits in Germany. Off-site backup in AWS Frankfurt is permitted under documented disaster-recovery arrangements, but primary infrastructure must be in Romania. Cloud-native operators typically arrange dedicated colocation in Romanian data centres.
Does the compliance officer need to be Romanian-born?
No. The requirement is Romanian residency (habitual residence in Romania supported by a residence permit or citizenship), not Romanian nationality. Non-EU nationals with Romanian residency permits qualify; EU nationals with documented Romanian residence qualify. The substantive requirements are residency, gambling-compliance experience, and functional independence from operational management.
How often does ONJN inspect?
Scheduled inspections run approximately annually for active Class 1 operators, with 2–4 weeks advance notice. Unannounced inspections occur in response to specific triggers (complaints, AML referrals, SAFE anomalies) and have no fixed cadence. Follow-up inspections (within 30–90 days of a finding) confirm remediation. Operators in their first year post-licensing typically see 2 inspections; mature operators see 1.
What triggers a snap inspection?
Player complaints filed via ONJN's public complaint portal, AML referrals from ONPCSB or SOIIA, anomalies detected in SAFE real-time monitoring (unusual betting patterns, transaction spikes, system downtime), media coverage of negative incidents, whistleblower reports from staff or competitors. The most common single trigger is complaint volume from a specific player or group of players.
How long should I keep transaction logs?
Minimum 5 years under Article 19 of GEO 77/2009. Longer for SAR-relevant transactions (until the underlying matter is resolved plus 5 years). Responsible-gambling intervention records are 7 years. Most operators retain everything for 7+ years to simplify the retention matrix and handle the worst case across overlapping rules.
Can I share a compliance officer across multiple Romanian operators?
No. Each licensee must have a dedicated compliance officer with no conflicting roles at competing operators. The functional-independence requirement under ONJN Order 145/2018 explicitly bars shared compliance functions across separately-licensed entities. Compliance officers can serve multiple entities only where those entities are part of the same group and operating under a coordinated compliance programme.
Talk to us
Substance is the operational baseline of a Romanian gambling business — not a tax to be minimised. We help operators design substance programmes that pass inspection on first review: Romanian-territory hosting arrangements, compliance-officer recruitment and onboarding, audit-trail architecture, and inspection-prep playbooks. Book a discovery call.
Related guides
- iGaming licensing under ONJN: the complete 2026 guide — the pillar overview
- ONJN Class 1 (B2C) authorisation in detail — where substance expectations originate
- AML, player segregation, responsible gambling — compliance dimension in detail
- Romania's iGaming tax stack: the 27% revenue tax — tax compliance as part of substance
- Game certification: RNG testing and accredited labs — technical substance dimension