Romania EMI & payment institution licence: BNR authorisation

Which regulator supervises what

Romania splits financial-services supervision across three authorities, and founders routinely approach the wrong one. Before anything else, establish which regulator owns your activity, because the statute, the capital floor, the dossier and the timeline all follow from that answer.

BNR — the Banca Naţională a României — authorises and supervises credit institutions, payment institutions and electronic money institutions. The whole payments and e-money perimeter sits here.
ASF — the Autoritatea de Supraveghere Financiară — supervises capital markets, insurance and private pensions. Investment firms (societăţi de servicii de investiţii financiare, or SSIF), fund managers, market operators and prospectus approval fall to ASF.
ONJN — the Oficiul Naţional pentru Jocuri de Noroc — supervises gambling. Not a financial regulator, but relevant: a payment processor serving Romanian-licensed gambling operators needs an ONJN Class authorisation on top of whatever BNR permission it holds. See our Class 2 supplier guide.
ONPCSB — the financial intelligence unit — is not a licensing authority but sits behind every application, since Law 129/2019 governs the AML programme BNR and ASF will read.

A single group can end up holding permissions from two or three of these — a payments business that also runs an exchange and processes gambling deposits touches all three perimeters, each with its own capital, governance and reporting stack. Structure the group before you file anything; our regulatory licensing service starts with exactly that mapping, and the ONJN pillar guide covers the gambling side in full.

Payment institution or electronic money institution, and what "AEMI" means here

The two BNR authorisations most founders are actually asking about are the payment institution (instituţie de plată) and the electronic money institution (instituţie emitentă de monedă electronică). They are separate instruments under separate statutes.

Law 209/2019 on payment services transposes PSD2 and governs payment institutions. It covers execution of payment transactions, money remittance, acquiring, issuing payment instruments, payment initiation services and account information services.
Law 210/2019 on the issuance of electronic money transposes EMD2 and governs electronic money institutions. An EMI may issue and redeem electronic money — stored value held against received funds — and may also provide payment services.

The practical test is whether you hold a stored-value balance the customer can spend, or whether you merely move money from A to B. An IBAN-addressable wallet with a persistent balance is e-money issuance. A card acquiring flow or a payout is a payment service. The answer determines a difference of €, in minimum capital and a materially heavier dossier.

If your customer holds a spendable balance with you, you are issuing electronic money, whatever your product page calls it.

A note on terminology, because the search phrasing travels. AEMI and SEMI — "authorised" and "small" electronic money institution — are UK Financial Conduct Authority categories. They do not exist in Romanian law. Romania has one EMI authorisation under Law /, granted by BNR. EMD2 permits Member States to operate an optional exemption for issuers whose average outstanding electronic money stays below a national ceiling of no more than €,EMD2,EMD2, but confirm the availability and terms of any such route with BNR directly rather than assuming the UK small-EMI model has a Romanian equivalent. Plan on the full authorisation.

Capital requirements by authorisation type

Initial capital is the first hard gate and the one most commonly underestimated. It must be paid in and verifiable at the date of authorisation, not pledged or phased.

Electronic money institution — €,Law 210/2019 equivalent in lei. Set by Law 210/2019 as the initial capital an EMI must hold at authorisation. This is the EU baseline under EMD2; Romania has not gold-plated it, but it has not discounted it either.
Payment institution — €,Law 209/2019 to €,Law 209/2019, graduated by service type under Article of Law 209/2019. The lowest tier applies to money remittance only; the middle tier to payment initiation services; the top tier to the broader set of payment services including account servicing, execution of transactions and acquiring.
Account information service providers are registered rather than authorised and are not subject to an initial capital requirement, but must hold professional indemnity insurance or a comparable guarantee.
Investment firm (SSIF) — €,Regulation (EU) 2019/2033, €,Regulation (EU) 2019/2033 or €,Regulation (EU) 2019/2033 under Article of Regulation (EU) 2019/2033, depending on which MiFID II Annex I services the firm is permitted to perform and whether it may hold client money or deal on own account.

Initial capital is a floor, not a budget. Both statutes impose ongoing own funds requirements calculated by methods BNR prescribes, and BNR approves the calculation method as part of the authorisation. An applicant capitalised at exactly the statutory minimum with no headroom for the first two years of operating losses reads as underfunded, and BNR will say so.

Separately, an EMI or payment institution must safeguard client funds — segregation in a dedicated account at a credit institution, or coverage by an insurance policy or comparable guarantee. Safeguarding is examined in detail and is a common source of remediation rounds. Our guide to Romanian bank accounts for non-residents covers the constraints on opening the underlying accounts.

The fit-and-proper test

BNR assesses two populations: the persons who will manage the payment services activity, and the persons holding qualifying participations in the applicant. Both are examined on substance, not on paperwork.

Management

Directors responsible for the regulated activity must demonstrate relevant sectoral experience, not general commercial competence. A career in software or e-commerce does not qualify someone to run a regulated payments book; BNR looks for prior experience inside an authorised institution, evidenced by role, duration and scope. Each responsible person is individually approved as a condition of the authorisation, and a rejected nominee stalls the whole file.

Shareholders and beneficial owners

Holders of qualifying participations are confirmed separately. The review runs the full ownership chain to natural persons and does not stop at the first opaque layer. Nominee arrangements, bearer structures and unexplained intermediate holdings in low-transparency jurisdictions are the most reliable way to have an application fail. Source of funds for the capital contribution must be documented and traceable.

Reputation

Criminal record extracts, sanction history in every jurisdiction where a person has held a licensed role, and adverse media are all in scope. Disclose adverse history proactively. A ten-year-old regulatory fine volunteered with context is survivable; the same fine discovered after you omitted it is usually fatal, because it recharacterises the file as one where the applicant cannot be relied on to report.

The application dossier and what BNR scrutinises

BNR Regulation 4/2019 sets out the documentation for payment institutions and account information service providers; BNR Regulation 5/2019 does the same for electronic money institutions. The enumerated dossier runs to roughly twenty heads of document. The weight, however, is concentrated in a handful:

The activity plan and business plan — transaction volumes, revenue, cost base and capital adequacy across at least three years, with assumptions stated. BNR reads these as a solvency document, not a pitch deck.
Governance and internal control framework — organisational structure, reporting lines, risk management, internal audit. Roles must map to named, approved individuals.
Safeguarding of user funds — segregation mechanics, the accounts used, reconciliation frequency, and what happens on insolvency.
AML/CFT programme under Law 129/2019 — customer due diligence, risk assessment methodology, transaction monitoring, sanctions screening, the designated compliance officer, and reporting to ONPCSB.
Security and operational resilience — security policy, incident management, controls over access to sensitive payment data, business continuity.
Professional indemnity insurance for firms providing payment initiation or account information services.

Two structural points. First, the dossier must be internally consistent: the transaction volumes in the business plan must reconcile to the risk assessment in the AML programme and to the capacity assumptions in the resilience documentation. Reviewers cross-read. Second, outsourcing is scrutinised. A file that pushes core processing, compliance and customer support to related parties abroad, leaving a Romanian entity with two staff and a registered address, will be treated as a shell.

The corporate vehicle is ordinarily a Romanian SRL or SA registered at the Trade Register — see our SRL formation guide. Formation takes days; the authorisation is the project.

Timelines, and why applications fail

Law 209/2019 gives BNR three months to grant or refuse, running from receipt of an application that satisfies the completeness requirement. Where the application is incomplete, BNR notifies the applicant of what is missing and the applicant has up to three months to supply it, with the three-month assessment clock starting only on receipt of the outstanding items or on expiry of that window.

Read that structure carefully, because it is where expectations break. The statutory three months is not three months from the day you file. It runs from the day BNR accepts your file as complete, and the completeness gate is where most applicants spend the bulk of the calendar. A realistic end-to-end expectation for a well-prepared payment institution or EMI application is nine to eighteen months, covering formation, capitalisation, recruitment of approvable senior staff, dossier preparation and one to three rounds of information requests.

The three-month statutory clock begins only when the regulator accepts the file as complete, and that acceptance is the hard part.

The failure modes are consistent:

Filing early to "start the clock". Incomplete files do not start the clock and do damage the regulator's read of the applicant's competence.
Unapprovable management. Nominees with no authorised-institution experience, or a single director expected to cover management, risk and compliance.
Opaque ownership. Chains that cannot be traced to natural persons, or capital whose source cannot be evidenced.
Insufficient substance. A Romanian address, a lawyer's phone number, and every operational function performed abroad.
Template compliance documentation. AML programmes and risk assessments that are visibly generic and do not reflect the applicant's actual products, corridors or customer base.
Undercapitalisation. Capital at the statutory floor with a business plan that shows losses exceeding it in year one.

This is a demanding process with a meaningful failure rate. It rewards applicants who over-prepare and punishes those who treat authorisation as an administrative filing. BNR's public registers of payment institutions and electronic money institutions are short — the e-money register has recently listed only a handful of authorised entities. That is a fair proxy for how selective the process is.

EEA passporting: what a Romanian authorisation buys you

The commercial case for Romanian authorisation is not the Romanian market. It is the single-market passport. A payment institution or EMI authorised by BNR may provide its authorised services across the European Economic Area, either through freedom of services or by establishing a branch or appointing agents in a host Member State.

The mechanics: you notify BNR of the intended host state and services, BNR transmits the notification to the host competent authority, and after the prescribed period the passport takes effect. Passported entities appear in the EBA register of payment institutions, which is where prospective counterparties will check you.

What the passport does not do is exempt you from host-state conduct rules, local AML expectations, or the reality that banks and card schemes in a host market assess you on your own merits. Home-state authorisation is a licence, not a distribution channel. Applicants who model Romanian authorisation as a cheap route into a larger Western European market usually find that acquiring banking, scheme sponsorship and correspondent relationships is a second project of comparable difficulty.

Romania's genuine advantages are cost base, a deep pool of technical and English-speaking operational staff, EU membership, and the corporate tax regime covered below. They are real. They are not a shortcut through the authorisation itself.

MiCA, crypto-asset service providers, and Romania's missing law

Crypto authorisation in the EU runs through Regulation (EU) 2023/1114, known as MiCA, which has applied to crypto-asset service providers since December . A CASP authorisation from any Member State passports across the EEA. Minimum own funds are set by Article and Annex IV: €,Regulation (EU) 2023/1114 for advisory and order-reception classes, €,Regulation (EU) 2023/1114 where custody or exchange services are provided, and €,Regulation (EU) 2023/1114 for operating a trading platform. Article gives the competent authority working days to assess completeness and working days from a complete application to decide, though in practice most files run considerably longer.

Here is the position founders searching for a "Romania crypto licence" need, and it is unwelcome. As at July , Romania has no designated competent authority for MiCA. ASF has stated publicly that it is not currently designated as competent authority for Regulation /, and that applications can be submitted and determined only once national implementing legislation enters into force. A draft implementing ordinance reached first reading in Government in April but was not adopted, and the European Commission has opened infringement proceedings against Romania for failure to adopt the national framework.

Romania cannot currently issue a MiCA CASP authorisation, because it has not yet designated the authority that would issue one.

The consequences are concrete. The MiCA transitional regime — under which entities registered with ONPCSB before December could continue operating under national rules — expired on July . From that date a crypto-asset service provider without MiCA authorisation cannot lawfully serve EU clients, so Romanian-registered legacy providers are unable to obtain in their own jurisdiction the authorisation they now require.

If your objective is a CASP authorisation on a defined timetable, Romania is not currently the jurisdiction to file in, and any adviser telling you otherwise is either not current or not candid. Check the ESMA MiCA pages for the authorities accepting applications; we will update this guide when the Romanian framework is enacted. Note separately that OUG 10/2025 did bring crypto-asset service providers within the Law / AML perimeter from March , so Romanian AML obligations apply irrespective of the authorisation gap.

The ASF side: investment firms, forex brokers and prospectuses

Where the activity is investment services rather than payments, competence shifts to ASF. The governing statute is Law 126/2018 on markets in financial instruments, which transposes MiFID II.

SSIF authorisation — an investment firm authorised by ASF may perform the MiFID II Annex I services specified in its authorisation: reception and transmission of orders, execution on behalf of clients, dealing on own account, portfolio management, investment advice, underwriting and placing, and operation of an MTF or OTF. Capital follows Article of Regulation (EU) 2019/2033 as set out above.
Retail forex and CFD brokers are investment firms. There is no separate, lighter "forex licence" in Romania. A CFD business deals on own account or executes client orders, placing it squarely in the SSIF perimeter with the corresponding capital tier and ESMA product-intervention rules on leverage, negative balance protection and marketing.
Prospectus approval sits with ASF under Regulation (EU) 2017/1129. A Romanian issuer admitting securities to trading or making a public offer files with ASF, and an ASF-approved prospectus is passportable across the EEA.

ASF authorisation is at least as demanding as the BNR routes on governance and fit-and-proper, and adds conduct-of-business, best-execution, client-asset and product-governance obligations that must be evidenced as operational before authorisation, not promised. Plan on a year or more.

The tax position of a licensed entity

One point matters more than any other for anyone modelling a Romanian regulated entity, and it is routinely missed until after formation. The microenterprise regime is not available to you. Under Article of Law 227/2015 — the Codul Fiscal — the microenterprise turnover-tax regime is statutorily excluded for entities carrying on banking activity, insurance and reinsurance, capital-markets activity including intermediation, lending, and gambling. A payment institution, an electronic money institution, an SSIF or a licensed gambling supplier cannot elect into it, regardless of turnover. Our microenterprise guide sets out the exclusions in full.

So the tax stack for a licensed Romanian entity is the standard one:

Corporate income tax at % on taxable profit under Title II of the Codul Fiscal, administered by ANAF.
Dividend withholding tax at % on distributions from January , following Law 141/2025. The previous % rate applies only to distributions made on interim statements drawn up during .
Treaty relief and the Parent-Subsidiary Directive remain available on outbound distributions where the conditions and substance are satisfied.
VAT — most payment and e-money services are exempt financial services, which restricts input VAT recovery. Model this; it is a real cost line for a payments business with material Romanian operating spend.

The burden on distributed profit is therefore well above what founders anticipate if they arrived expecting the % microenterprise headline. Regulated activity is taxed as ordinary corporate activity, and the exclusion is statutory rather than discretionary.

Frequently asked questions

What is the difference between an EMI licence and a payment institution licence in Romania?

An electronic money institution, authorised under Law /, may issue and redeem electronic money — a stored balance the customer can spend — and may also provide payment services. A payment institution, authorised under Law /, may only execute payment services and may not issue e-money. The distinction drives capital: €, for an EMI against €, to €, for a payment institution.

Is there a small or exempted EMI route in Romania, like the UK SEMI?

AEMI and SEMI are UK Financial Conduct Authority categories and do not exist in Romanian law. Romania has a single EMI authorisation under Law / with a €, initial capital requirement. EMD allows Member States to operate an optional exemption below a ceiling of €,, in average outstanding e-money, but confirm availability and terms with BNR directly rather than assuming a Romanian equivalent of the UK regime exists.

How long does BNR authorisation actually take?

Law / gives BNR three months to decide, but that clock starts only when the application is accepted as complete, and the applicant has a further three-month window to supply missing items. A realistic end-to-end expectation for a well-prepared file is nine to eighteen months from first engagement to authorisation, covering formation, capitalisation, recruitment of approvable management, dossier preparation and information-request rounds.

Can I get a MiCA crypto licence in Romania in ?

Not at present. As at July Romania has not designated a competent authority for Regulation (EU) /, and ASF has stated it is not currently designated and cannot accept CASP applications pending national implementing legislation. The European Commission has opened infringement proceedings. The transitional regime expired on July . If you need a CASP authorisation on a timetable, file in a Member State that is accepting applications.

Does a Romanian licence let me operate across the EU?

Yes. A BNR-authorised payment institution or electronic money institution may passport its authorised services across the EEA under freedom of services or by establishing a branch or agents, following notification through BNR to the host authority. Passporting does not displace host-state conduct rules, and it does not deliver banking, scheme sponsorship or correspondent relationships in the host market, which remain separate commercial projects.

Can a licensed payments company use the % microenterprise regime?

No. Article of Law / excludes banking, insurance and reinsurance, capital-markets activity, lending and gambling from the microenterprise regime as a matter of statute, irrespective of turnover. A payment institution, EMI or investment firm pays corporate income tax at % on profit, with dividend withholding tax at % on distributions from January under Law /.

Talk to us

Romanian financial-services authorisation is a nine-to-eighteen-month project with a real failure rate, and the first useful question is whether Romania is the right jurisdiction for your permission at all. We assess which perimeter your activity falls into — BNR payments or e-money, ASF investment services, or ONJN gambling supply — scope the capital, governance and substance you will need, and tell you plainly if the answer is that you should file elsewhere. Our regulatory licensing service sets out how we work, pricing is published, and you can book a 30-minute call.

Related guides

Romanian SRL formation: the complete 2026 guide — the corporate vehicle behind every licence application
The 1% microenterprise regime in 2026 — why Article shuts regulated entities out of it
EUR bank accounts in Romania for non-residents — safeguarding accounts and the practical banking constraint
ONJN Class 2 (B2B) supplier authorisation — required for payment processors serving Romanian gambling operators
iGaming licensing under ONJN: the complete 2026 guide — the adjacent gambling perimeter in full

Romanian EMI and payment institution licensing: what BNR authorisation takes