Buju, Stanciu și Asociații: Romania CASP Licensing – Key MiCAR Compliance Risks and How to Manage Them

Romania CASP licensing is a live MiCAR issue with an unusual twist. The EU transitional period ended on 1 July 2026, so no crypto-asset service provider (CASP) can serve EU clients without MiCAR authorisation. Yet Romania has still not designated a competent authority, so a Romanian authorisation cannot currently be obtained. Applicants therefore face two parallel tasks: serving the Romanian market lawfully today, and preparing a file that will be ready the day the Romanian Financial Supervisory Authority (ASF) opens its doors.

This guide, prepared by the financial regulation and digital assets team at Buju, Stanciu și Asociații, explains where the real risks sit: Article 63 timing, dossier completeness, governance quality, the Romanian implementation gap, and misplaced assumptions about transition and timing.

At a glance

•             MiCAR applies in full. The CASP regime under Regulation (EU) 2023/1114 has applied since 30 December 2024.

•             The transition is over. The outside date of 1 July 2026 has passed across the EU, with no extensions.

•             Romania has no competent authority yet. The draft emergency ordinance (GEO) that would designate ASF and the National Bank of Romania (BNR) has not been adopted, and the European Commission has opened infringement proceedings.

•             The Romanian market is served by passporting. CASPs authorised in other Member States can operate in Romania after notification.

•             The authorisation file can be built now. Governance, policies and capital can be prepared in advance for filing as soon as ASF is designated.

Which Romanian authority will matter for CASP applicants

Once the implementing GEO is adopted, the authority that matters for most CASPs will be ASF. The Romanian model provides for ASF to be the competent authority for the full catalogue of MiCAR crypto-asset services. BNR’s role is narrower: e-money token (EMT) issuance by credit institutions and electronic money institutions already under its prudential supervision (Chambers Practice Guides).

Romania is also expected to implement MiCAR without gold-plating. The GEO focuses on designating authorities, setting sanctions and exercising national discretions, not on adding substantive requirements. That helps, but “no gold-plating” does not mean “no local process risk”. After the GEO enters into force, ASF and BNR must issue secondary legislation within 30 days, and filing practice, supervisory dialogue and local procedural steps will still matter.

Why the delay was foreseeable

In a Profit.ro TV interview in June 2025, Victor Buju of Buju, Stanciu și Asociații warned that the draft spread responsibilities across too many institutions (ASF, BNR, the Authority for the Digitalisation of Romania, consumer protection and the Ministry of Finance) without a single point of contact. He also flagged the risk of further delays and of operators moving to faster EU jurisdictions. He proposed a one-stop digital desk, a regulatory sandbox and a grace period for good-faith operators. Seventeen months later, those risks have materialised: there is still no authority, and local platforms now serve Romanian clients from other Member States.

What Article 63 MiCAR means in real timeline terms

Article 63 sets a structured legal timeline, but it is not a promise of business readiness:

These deadlines are often read too optimistically. A five-day acknowledgement is not a substantive comfort point. A completeness review does not mean the file is strong. And the 40-day decision period starts only once the application is complete. In practice, rounds of clarification extend the process to several months.

The operational takeaway is to plan backwards from a genuinely complete application, not forwards from the earliest possible filing date.

The main MiCAR compliance risks for CASP applicants in Romania

1. Underestimating dossier completeness. Completeness is a formal gate under Article 63. A long file can still leave basic governance, control or operational points unclear. Volume is not completeness.

2. Relying on transitional or timing assumptions. Many firms treated 1 July 2026 as a guaranteed runway. It was always conditional, and it is now gone. ESMA has confirmed that a pending application does not allow continued activity and that the absence of national legislation does not extend the deadline. Unauthorised providers must stop onboarding new clients and wind down EU services in an orderly way.

3. Weak governance and control documentation. MiCAR required a large body of Level 2 and Level 3 measures, and supervisory expectations keep developing through technical standards and convergence work. A thin governance package looks incomplete and fails to show readiness for supervision. Key areas include management suitability, qualifying shareholders, segregation of client assets, custody liability, complaints handling, conflicts of interest, outsourcing, an orderly wind-down plan and DORA-compliant digital resilience.

4. Treating the Romanian framework as settled. Until the GEO and the ASF and BNR secondary legislation are adopted, local procedural details may still change. The safer approach is to prepare against the EU rulebook while tracking Romanian implementation closely.

5. Overlooking obligations that already apply. Even without a MiCAR authority, CASPs serving Romanian clients are subject to the anti-money laundering law (Law no. 129/2019, as amended by GEO no. 10/2025), the Travel Rule under Regulation (EU) 2023/1113, DORA and DAC8 tax reporting to ANAF.

How to manage those risks in practice

•             Choose the right route to market now. For most firms, the realistic options are authorisation in another Member State followed by passporting into Romania, a partnership with an authorised CASP (where the Romanian entity’s own role is not itself a regulated service), or a documented perimeter analysis showing that the model falls outside MiCAR.

•             Treat completeness as a workstream. The file should tell one consistent story about the business model, services, governance and controls. Disconnected annexes create friction at completeness review.

•             Build governance for supervision, not just for filing. ESMA has worked with national authorities on a convergent approach to CASP authorisations. Expect consistent scrutiny across authorities and draft documents that reflect how the business actually operates.

•             Engage early with ASF once it is designated. Early dialogue on service classification, file structure and supporting materials is advisable, especially for groups that also touch payments or e-money.

•             Avoid shortcuts. Reverse solicitation under Article 61 is narrow and cannot support a business model. Any marketing to EU clients removes the exemption.

Why ESMA convergence and the central register matter

Authorisation is national in procedure but sits within an increasingly standardised EU architecture. ESMA’s convergence work reduces the value of trying to exploit perceived local flexibility.

Visibility matters too. Under Articles 109 and 110 MiCAR, ESMA publishes a central register of authorised CASPs, crypto-asset white papers and non-compliant entities, updated weekly. Authorisation status and compliance history therefore become part of a public EU-level record, which will also count in any future reputational assessment.

How Buju, Stanciu și Asociații can help

Buju, Stanciu și Asociații treats MiCAR as a business-model question, not a form-filling exercise. Our work covers MiCAR opinions for operators in other Member States, perimeter analyses for token issuers, jurisdiction selection with local counsel through our international networks, and preparation of authorisation files. We cover the full risk picture, including regulation, DAC8 tax reporting and directors’ personal liability.

Conclusion

For CASPs targeting Romania, the main MiCAR risk is not simply missing a deadline. It is mistaking the Article 63 timeline, or the absence of a Romanian authority, for breathing room. The real pressure points are completeness, governance quality, the right route to market and close tracking of Romanian implementation.

The practical next step is to secure a lawful route to Romanian clients today and build the ASF application as a readiness project, so it can be filed as soon as the authority is designated. To discuss your project, contact Buju, Stanciu și Asociații at bsa.ro.

This article is for general information only and does not constitute legal advice. The Romanian implementation of MiCAR is still evolving; check the current position before acting.