Why Romania for Your Crypto Licence
Romania gives you a full EU passport at one of the most competitive cost-and-tax profiles in the Union, built on the largest engineering talent pool in Central and Eastern Europe. A Romanian MiCA CASP authorisation lets you serve clients across all 30 EEA member states from a single licence, and the headline 16% corporate rate is simply the rate you pay, not a figure you reach through a refund mechanism. That combination is why we deliver serviced licensing here.
MiCA authorisation turns on demonstrable ICT capability and DORA-grade resilience, not just paperwork; applications fail on weak compliance substance and recycled templates, not on capital adequacy or the complexity of the rules. Romania’s cost advantage is real, but it sits on top of the requirement to staff and document engineering depth that most founders underestimate—which is precisely why we deliver it in-house rather than refer.
Low tax, low locked capital. Romania applies MiCA’s own-funds minimums directly: €50,000 for Class 1, €125,000 for Class 2 and €150,000 for Class 3, with no national overlay stacked on top. Pair that with a 16% corporate rate, among the EU’s lower headline figures, and a 1% microenterprise rate available in year one, and the cost of carrying the structure is genuinely lower than most Western European options.
Engineering depth where MiCA demands it. MiCA authorisation turns on demonstrable ICT capability and DORA-grade resilience, not just paperwork. Romania has the deepest software and engineering workforce in the region, which makes building real, supervisable technical substance affordable rather than aspirational. We staff and document that substance to the standard ASF expects.
Which Business Models Suit Romania
Romania fits operators who want broad EU reach at a low capital and tax outlay, particularly those with engineering operations or a Central and Eastern European focus. Before we file, we confirm your model maps cleanly onto the MiCA service classes and that the jurisdiction genuinely serves your plan.
- Exchanges and brokers seeking EU-wide reach. One Romanian licence passports trading, exchange and execution services across the EEA, so you sell into 30 markets from a single base.
- Custody and wallet providers. Class 2 custody authorisation pairs with the safeguarding and settlement rails a custody business needs under MiCA Article 70.
- Operators with a Romanian engineering footprint. If you are already building development or operations in Romania, real ICT and DORA substance follows the team you already have.
- Cost-conscious EU/EEA founders. MiCA minimums with no national overlay, plus a 16% tax rate, mean less idle capital and a lighter ongoing burden than Estonia or most Western options.
- × Profit-reinvestment plays. If retaining earnings tax-free is the priority, Estonia or Latvia (0% CIT on retained profits) may suit better. We will tell you straight.
- × Institutional brand-weight plays. Where a globally recognised regulator badge matters most, Malta is worth weighing, even at a higher headline tax cost.
- × Tokenised securities or RWA. A MiCA CASP licence does not cover financial instruments. Where your model needs it, we scope the MiFID securities route or EU fund licensing alongside crypto permissions.
What We Do for You
We deliver the licence, we do not hand you a shortlist and step back. From the first scoping call to the day your authorisation publishes, you deal with one accountable firm and our in-country specialists. We file the work and we stand behind it.
- Form your SRL. We incorporate your Romanian private limited company, deposit the required own-funds, appoint the management body, install a resident MLRO, and establish a genuine physical office that satisfies the substance test under MiCA Article 59.
- Build the compliance suite. We draft every policy bespoke to your model and to Romanian law: AML/CFT manual, enterprise-wide risk assessment, sanctions screening, transaction monitoring, Travel Rule implementation, KYC/KYB, the DORA ICT framework, complaints handling, conflicts of interest and wind-down plan. ASF wants policies that name Romanian legislation, not a generic EU manual, so we do not use templates.
- Prepare the people and the proof. We assemble fit-and-proper files for directors, officers and qualifying shareholders, including the source-of-funds and source-of-wealth evidence that decides most applications.
- File and manage the application. We submit the MiCA CASP file to ASF, manage the ADR technical certification of your IT systems, and handle every regulator query and information request through to authorisation. We deal with the regulator directly.
- Arrange banking. We open the two layers a CASP needs: an operational account for day-to-day flows and a credit-institution relationship for client-fund safeguarding under MiCA Article 70. We start this during the application so banking is ready when your licence is.
- Run ongoing compliance. After authorisation we set up reporting to ASF and ONPCSB, the DAC8 and CARF tax-reporting obligations, and the annual cycle, so the licence stays in good standing.
We scope and quote each engagement to your specific model and service classes. Tell us what you are building and we will map your route to approval and price it.
Regulatory Framework
Romania regulates crypto-asset service providers under the EU’s Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, which has been directly applicable since the CASP rules commenced on 30 December 2024 and needs no national transposition. ASF is the competent authority for CASP authorisation and is Romania’s point of contact with the European Securities and Markets Authority (ESMA); the BNR supervises e-money token issuance by credit and e-money institutions, and crypto services provided through banks.
Several national ordinances sit alongside MiCA and are easy to confuse with it. OUG 10/2025 aligned Romanian AML and Travel Rule provisions with the EU framework and repealed the old, never-activated authorisation route under Law 129/2019. OUG 71/2025 transposed DAC8 crypto-asset tax reporting. OUG 14/2026 set the Romanian wrapper for DORA. None of these replaces MiCA, which is the instrument that actually governs your authorisation. We classify your tokens and services against these lines before filing, so you are neither under-licensed nor over-licensed.
Tokenised securities sit outside MiCA
MiCA Article 2(4) excludes crypto-assets that qualify as financial instruments. A tokenised share, bond or fund unit is regulated under MiFID II, the Prospectus Regulation and the EU DLT Pilot Regime (Regulation (EU) 2022/858), supervised in Romania by ASF under the securities regime rather than under MiCA. Where a tokenised fund unit is the target, the route runs through fund licensing, not a CASP application, with crypto custody permissions added only where the model needs them. We scope the correct perimeter before any filing.
Licence Classes and What They Cover
A MiCA CASP authorisation covers any combination of the crypto-asset services defined in MiCA Article 3; you choose the services and ASF authorises those specific ones. Capital scales with the riskiest service in the mix, set across three classes: €50,000 for Class 1, €125,000 for Class 2 and €150,000 for Class 3. Issuing an asset-referenced token is a separate authorisation, and issuing an e-money token is reserved to credit and e-money institutions supervised by BNR, so a CASP authorisation alone permits neither. We confirm the right class for your model before any capital is locked.
| Class | Service | MiCA Reference | What it covers |
|---|---|---|---|
| 1 | Reception and transmission of orders | Art. 3(1)(24) | Receiving client orders and routing them to another CASP or trading platform |
| 1 | Advice on crypto-assets | Art. 3(1)(25) | Personalised recommendations on crypto-asset transactions |
| 1 | Portfolio management | Art. 3(1)(26) | Discretionary management of client crypto-asset portfolios |
| 1 | Execution of orders on behalf of clients | Art. 3(1)(22) | Buying and selling crypto-assets per client instructions |
| 1 | Placing of crypto-assets | Art. 3(1)(23) | Marketing newly issued crypto-assets to investors |
| 1 | Transfer services on behalf of clients | Art. 3(1)(27) | Transferring crypto-assets between addresses for clients |
| 2 | Custody and administration | Art. 3(1)(17) | Safekeeping crypto-assets and private keys for clients |
| 2 | Exchange of crypto-assets for funds | Art. 3(1)(20) | Fiat-to-crypto and crypto-to-fiat conversion |
| 2 | Exchange of crypto-assets for other crypto-assets | Art. 3(1)(21) | Crypto-to-crypto conversion |
| 3 | Operation of a trading platform | Art. 3(1)(18) | Operating an exchange matching buy and sell orders |
Minimum capital is the higher of the class floor or 25% of the preceding year’s fixed overheads, held entirely as Common Equity Tier 1. The overhead test usually becomes the binding figure as a business scales, so most operators of any size hold well above the floor. Some activity sits outside MiCA entirely: genuinely decentralised services with no identifiable operator, services provided only outside the Union, intra-group transfers, crypto accepted directly by a merchant as payment, mining and validation, or a genuinely unique one-off NFT. The carve-outs are narrower than they look, and ESMA treats anyone exerting sufficient control over a service as in scope, so we map your activity to the correct perimeter before filing.
What ASF Requires
A Romanian CASP needs an SRL or SA, own-funds of €50,000–€150,000 by service class, a registered office in Romania, an EU-resident management body, a Romanian-resident MLRO and a bespoke compliance suite, plus prior technical certification of the IT systems by the ADR. Every shareholder holding 10% or more undergoes fit-and-proper assessment. The binding constraints are real substance and documentation quality: applications fail on weak source-of-funds evidence and recycled templates, not on the complexity of the rules. We prepare each of these to the standard that clears.
| Requirement | Detail |
|---|---|
| Entity type | SRL (Societate cu Răspundere Limitată, private limited) or SA (Societate pe Acțiuni, joint-stock) |
| Minimum own-funds (Class 1) | €50,000 |
| Minimum own-funds (Class 2) | €125,000 |
| Minimum own-funds (Class 3) | €150,000 |
| Ongoing own-funds formula | Higher of: permanent minimum per class OR 25% of fixed overheads of the preceding year, held as Common Equity Tier 1 |
| Management body | Effective management in the EU; at least one EU-resident director (MiCA Article 59); fit-and-proper under Article 68 |
| MLRO | Romanian resident required |
| Physical office | Registered office in Romania where part of the services is performed; mailbox companies not accepted |
| IT certification | Prior technical certification of IT systems by the ADR, overlapping with DORA |
| Foreign ownership | 100% foreign ownership permitted |
| Qualifying shareholders | All holders of 10%+ capital/voting rights undergo fit-and-proper assessment with source-of-funds verification |
Substance is the make-or-break, not capital
Capital rarely sinks an application; substance and governance do. MiCA Article 59 requires a registered office in an EEA state where part of the services is actually performed, effective management in the EU, and at least one EU-resident director. ASF looks for real decision-making in Romania, a Romanian-resident MLRO, and compliance and ICT functions genuinely staffed there. Mailbox companies, nominee directors and compliance-as-a-service arrangements with no local presence do not pass. The fit-and-proper test under Article 68 reaches every board member and every shareholder holding 10% or more, on integrity, competence, independence and time commitment. We establish the office, place the resident MLRO and structure the management body so the substance test is met, not finessed.
Fit-and-proper and source of funds
ASF assesses directors, senior managers, qualifying shareholders and key function holders for qualifications, integrity (criminal and regulatory history) and financial soundness. The decisive element is source of funds and source of wealth for owners holding 10% or more. We build these files properly, with the tax returns, bank records and employment history that stand up to scrutiny rather than a certificate of deposit on its own.
AML, the Travel Rule and ICT
The AML framework is Law 129/2019, as amended by OUG 10/2025 and Law 86/2025. CASPs are obliged entities and must run an enterprise-wide risk assessment, full customer due diligence with enhanced measures on unhosted-wallet and non-EU exposure, transaction monitoring, suspicious-transaction reporting to ONPCSB, and five-year record-keeping. The EU Transfer of Funds Regulation has applied since 30 December 2024, so every transfer carries originator and beneficiary information regardless of value. This documentation is the most demanding part of any file, and the part where templates lifted from another jurisdiction most often trigger requests for further information. We build all of it, naming Romanian legislation, into your compliance suite and reporting set-up.
Application Process and Timeline
Expect six to nine months end-to-end, from preparing the entity to a granted authorisation. MiCA sets a statutory clock of 25 working days for the completeness check and 40 working days for the substantive assessment, but the clock stops every time the regulator asks for more information, so a well-prepared file is what keeps the timeline short. We run the whole sequence and keep the regulator’s clock moving.
Stage 1 2–6 weeks
We form your SRL and deposit capital
We incorporate the SRL or SA (see our Romania company formation service), deposit the €50,000–€150,000 own-funds, appoint the EU-resident management body and Romanian-resident MLRO, and establish the physical office.
Stage 2 6–10 weeks
We build the compliance suite
We draft the full bespoke documentation set under MiCA and the related RTS, plus your programme of operations and three-year projections, naming Romanian legislation throughout. This is the work that wins or loses the application, and it cannot be templated.
Stage 3 2–4 weeks (parallel)
We secure ADR certification and open banking
We manage the ADR technical certification of your IT systems and arrange the operational and credit-institution safeguarding accounts MiCA Article 70 demands, in parallel so neither is a bottleneck at authorisation.
Stage 4 1 week
We file with ASF
We submit the complete MiCA CASP application and annexes to ASF and pay the state application fee.
Stage 5 25 working days
We clear the completeness check
We respond to ASF’s completeness review and supply any missing items quickly, so the substantive clock starts without delay.
Stage 6 40 working days
We manage assessment to a decision
We handle every information request through substantive assessment. On authorisation, your licence is entered in the Romanian register and notified to ESMA for the EU-wide register.
Taxation
Tax is genuinely part of Romania’s appeal. The headline corporate rate is 16%, among the EU’s lower figures, and unlike Malta’s 35% headline that drops to roughly 5% only through a refund mechanism, the Romanian 16% is simply the rate you pay. A new company can usually elect the microenterprise regime in its first year, 1% on turnover up to €100,000, but an authorised crypto business outgrows that ceiling fast, so treat it as a year-one benefit rather than a lasting one. We structure your entity to use the reliefs it qualifies for.
| Tax | Rate | Crypto Application |
|---|---|---|
| Corporate income tax | 16% flat | Standard rate on company profits |
| Microenterprise tax | 1% on turnover | For companies up to €100,000 turnover; most CASPs exceed it in year two |
| VAT | 19% standard | Crypto-to-fiat exchange VAT-exempt under the CJEU Hedqvist ruling; custody and platform services follow normal service-supply rules |
| Withholding tax (dividends, interest) | 16% | Reduced to 0% under the EU Parent-Subsidiary and Interest-Royalty Directives where conditions are met; treaty relief otherwise |
| Personal income tax on crypto gains | 16% | Small per-transaction and annual exemptions retained |
One reporting point matters for any operator: Romania has transposed DAC8 (via OUG 71/2025) and the OECD Crypto-Asset Reporting Framework, so a licensed crypto business must register with ANAF, collect tax-residency self-certifications, and file annual transaction reports that are then exchanged across the EU and beyond. The data infrastructure this needs goes well past MiCA’s own disclosures, and most operators underestimate it. Pillar Two global-minimum-tax rules apply only to multinational groups above €750 million in revenue, so a standalone crypto business can usually set them aside. We build the reporting infrastructure as part of the engagement.
Ongoing Compliance and DORA
The authorisation is indefinite, but supervision is active. CASPs file periodic prudential, capital-adequacy and activity reports to ASF, report AML/CFT matters to ONPCSB, and pay an ongoing supervision contribution rather than a renewal fee. ASF can run scheduled and unscheduled inspections covering AML/CFT, client-asset segregation, cybersecurity and governance. Marketing must be fair, clear and not misleading. We set up the reporting calendar and keep your licence in good standing.
DORA and ICT resilience
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to every MiCA CASP and has been directly applicable to Romanian CASPs since 17 January 2025, with OUG 14/2026 setting the Romanian supervisory wrapper and sanctions up to RON 23 million or 10% of annual turnover. DORA sets five pillars: ICT risk management, incident reporting, resilience testing, third-party ICT risk, and information sharing. These are live obligations now, not something that waits for the licence, and they overlap heavily with the ADR’s IT certification requirement. Custody operators must run segregated hot and cold wallet architecture with multi-signature controls and documented key management. We build the DORA framework into your application and operationalise it after.
Banking
Banking is the constraint that turns a Romanian licence into a working business, and it is part of what we deliver. MiCA Article 70 requires client funds to be placed with a credit institution or central bank by the end of the next business day, in a segregated account, so a custodian or exchange needs that rail from the outset. That means two layers: an operational account for day-to-day flows and a credit-institution relationship for safeguarding client fiat.
Domestic Romanian banks remain cautious about crypto-native firms, so the practical operational rail is usually a licensed EU electronic-money institution for day-to-day IBAN and SEPA access, paired with a credit institution for safeguarding. We do not name banks or payment providers as a matter of policy. We open and drive these conversations during the application phase, alongside the filing, so banking lands when your licence does. We hold the institutional relationships directly and put them to work for you.
International Standing and EU Passporting
Romania is a clean jurisdiction to license from. It is a MONEYVAL member, sits on neither the FATF black nor grey list, and is not on the EU’s high-risk third-country list, so a Romanian operator gets standard treatment in correspondent banking and counterparty due diligence. Its most recent mutual evaluation placed it in the moderate-to-substantial range for technical compliance.
The commercial heart of the licence is the passport. A Romanian MiCA CASP authorisation carries full freedom-of-services and freedom-of-establishment rights across all 30 EEA states under MiCA Articles 65 and 66. The home authority (ASF) notifies host authorities in advance, and the host authority cannot prevent passporting, so serving clients EU-wide becomes a matter of notification rather than re-authorisation. Iceland, Liechtenstein and Norway sit inside the passport through the relevant EEA Joint Committee Decision; the United Kingdom, Switzerland and Gibraltar sit outside it and need local authorisation for local clients. We file the passporting notifications for the markets you intend to serve and keep the perimeter clean.
How Romania Compares
Romania competes directly with the EU’s cost-leader cluster, Lithuania, Cyprus and Poland, and with the more established or premium centres in Gibraltar, Malta and Switzerland. Each offers a route to crypto licensing; the differentiators are cost, tax, regulatory maturity and EU passporting. We deliver in several of these, so the table below is also a map of where we can act for you.
| Factor | Romania | Lithuania | Cyprus | Malta | Poland | Switzerland |
|---|---|---|---|---|---|---|
| Licence | MiCA CASP | MiCA CASP | MiCA CASP | MiCA CASP | MiCA CASP | FINMA (non-EU) |
| Regulator | ASF | Bank of Lithuania | CySEC | MFSA | KNF | FINMA |
| Timeline | 6–9 months | 4–8 months | 6–9 months | 9–18 months | Not operational | 9–12 months |
| Min. capital | €50k / €125k / €150k | €50k / €125k / €150k | €50k / €125k / €150k | €50k / €125k / €150k | €50k / €125k / €150k | CHF 100k–300k+ |
| Corporate tax | 16% | 17% | 12.5%–15% | 35% headline | 19% / 9% small | ~12%–21% |
| EU passporting | Yes | Yes | Yes | Yes | No (legislation blocked) | No (non-EU) |
| Tomberg delivers here | Yes | Yes | Yes | Yes | Yes | Yes |
| Best for | Low tax + engineering depth | Fast, cost-effective EU entry | Cost-efficient established regime | Institutional brand weight | Currently no CASP route | Non-EU premium positioning |
The key difference: Romania, Lithuania and Cyprus all apply MiCA’s capital minimums directly, and Romania’s edge is the combination of a 16% flat tax with the deepest engineering pool in the region. Lithuania is the usual choice for the fastest cost-effective entry; Cyprus for a cost-efficient established regime; Malta where institutional brand weight matters; Switzerland for non-EU premium positioning. Poland, after repeated vetoes, still has no MiCA-implementing legislation and no CASP route, so Polish founders are relocating. We deliver crypto licensing in all of these, plus Poland and Gibraltar, so if another jurisdiction fits your model better, we will tell you and file there instead.
Reinvesting profits? Consider Estonia
Estonia’s MiCA CASP authorisation pairs full EU passporting with 0% corporate tax on retained profits, which can suit growth-stage operators better. We deliver it directly.
Frequently Asked Questions
What does Tomberg & Partners actually do for a Romanian CASP licence?
We deliver the whole licence and stand behind it. We form your SRL or SA, deposit the capital, appoint the management body and resident MLRO, build the full bespoke compliance suite, manage the ADR IT certification, file the MiCA CASP application with ASF, and manage every regulator query through to authorisation. We arrange both layers of banking and set up your ongoing reporting. You deal with one accountable firm and our in-country specialists, not a chain of intermediaries. Contact us and we will scope and quote your case.
How much does it cost?
It depends on your service classes, structure and complexity, so we scope each engagement and quote it rather than publish a number. Capital is set by MiCA and locked in your own company: €50,000 for Class 1, €125,000 for Class 2 and €150,000 for Class 3. ASF also charges a state application fee. Tell us what you are building for a quote.
What type of company is required for a Romanian CASP licence?
A Romanian SRL (Societate cu Răspundere Limitată, a private limited company) or SA (joint-stock company) is the vehicle, and we register it before filing. 100% foreign ownership is permitted. Every shareholder holding 10% or more undergoes fit-and-proper assessment, including source-of-funds verification, which we prepare with you. The fit-and-proper test under MiCA Article 68 reaches every board member and qualifying shareholder on integrity, competence, independence and time commitment.
What is the minimum capital for a Romanian CASP?
€50,000, €125,000 or €150,000 by MiCA Annex IV class, or 25% of the preceding year’s fixed overheads, whichever is higher. Class 1 (advice, reception and transmission, execution, placing, portfolio management, transfer) is €50,000; Class 2 (custody, exchange) is €125,000; Class 3 (trading platform) is €150,000. Own funds must be held as Common Equity Tier 1. We confirm the class your model needs before you lock up capital.
How long does it take to obtain authorisation?
Six to nine months end-to-end, from forming the entity to a granted authorisation. MiCA sets a statutory clock of 25 working days for the completeness check and 40 working days for substantive assessment, but the clock stops every time ASF asks for more information, so a well-prepared file keeps the timeline short. We run the schedule and keep the regulator’s clock moving.
Is DORA already binding on Romanian CASPs?
Yes. The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has been directly applicable since 17 January 2025. ICT risk management, incident reporting, resilience testing and third-party ICT risk controls apply now, not after MiCA authorisation. OUG 14/2026 sets the Romanian supervisory wrapper, with sanctions up to RON 23 million or 10% of annual turnover. We build the DORA framework into your application.
What does a Romanian MiCA CASP authorisation let you do?
It carries full freedom-of-services and freedom-of-establishment passporting rights across all 30 EEA states under MiCA Articles 65 and 66. The home authority (ASF) notifies the host authorities in advance, and the host authority cannot prevent passporting. Outside the EEA, each jurisdiction’s own crypto-asset rules apply. We file the passporting notifications for the markets you intend to serve.
Does the licence cover tokenised securities or RWA?
No. MiCA Article 2(4) excludes crypto-assets that qualify as financial instruments. A tokenised security, share, bond or fund unit is regulated under MiFID II, the Prospectus Regulation and the EU DLT Pilot Regime (Regulation (EU) 2022/858), supervised in Romania by ASF rather than under MiCA. Where your model needs it, we scope the securities route and pair it with crypto permissions or EU fund licensing.
Get a Romania crypto licence quote
We form your SRL, build the compliance suite, file with ASF, deal with the regulator directly, obtain the licence and arrange banking. Tell us what you are building and we will map your route to approval and quote it.
Banking & Payments
A company and a licence still need a bank account
Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.
Related Services
- Romania Company Formation: SRL and SA incorporation, delivered directly
- Lithuania CASP Licensing: fast, cost-effective MiCA authorisation
- Cyprus CASP Licensing: a cost-efficient, established route
- Crypto Business Banking: account opening for licensed operators