MiCAR Lawyer Romania: CASP Licensing with Buju, Stanciu și Asociații
If you are a crypto founder preparing to scale across the EU, Romania can look attractive on paper but complicated in practice.
Picture a typical scenario: a startup wants a Romanian law firm for MiCAR crypto CASP authorisation with ASF and BNR, needs an English-language token legal opinion, must review a white paper for MiCAR compliance, and cannot afford delays caused by vague advice or generic fintech memos.
That is where Buju, Stanciu și Asociații becomes valuable. The firm combines business-law execution, startup-focused legal strategy, and dedicated blockchain capability, with support on AML/KYC, crypto transactions, crowdfunding, token sales, and startup investment structuring through our practice areas on blockchain and digital assets and start-up and investment. With MiCAR implementation in Romania now operational, founders need counsel that can translate EU rules into an authorisation file regulators can actually process.
1 Jul 2026
hard EU end of the MiCAR transitional regime (Art. 143)
3–4 mo
ASF review from a complete file - among the faster EU routes
ASF·BNR·ADR
Romania's three-authority CASP model under GEO 10/2025
€25K+
minimum capital, low end of the EU range (basic CASP class)
Romania's MiCAR CASP authorisation pathway
MiCAR is directly applicable, but local implementation still determines the practical filing route, the authority split, and procedural expectations. At EU level, ESMA's MiCA page confirms a uniform authorisation framework for crypto-asset service providers and a central CASP register. ESMA also notes the transitional regime under Article 143 has a hard EU-wide end date of 1 July 2026, after which providers without authorisation are operating unlawfully.
For Romania, the relevant national legal basis is Government Emergency Ordinance no. 10/2025 (GEO 10/2025), in force from 13 March 2025, which transposes MiCA and establishes a dual-authority model with a Romania-specific technical gate:
- ASF (Autoritatea de Supraveghere Financiară) - primary authority for CASPs: authorises and supervises exchanges, brokers, crypto-ATM operators, and ART issuers;
- BNR (Banca Națională a României) - exclusive competence over EMT issuers and crypto activities by credit institutions;
- ADR (Autoritatea pentru Digitalizarea României) - mandatory technical/cybersecurity clearance of the applicant's IT systems before the ASF file can proceed; a step not found in every Member State.
Industry sources tracking the Romanian rollout report an ASF review period in the order of 3 to 4 months from a complete file, positioning Romania among the faster EU jurisdictions - though actual times depend on file quality, ASF's evolving capacity, and the volume of applications converging on the 1 July 2026 deadline. ASF has also begun issuing sanctioning decisions against digital-asset entities for reporting failures, signalling that tolerance for incomplete or late filings is narrowing.
The licensing project is no longer just about reading Regulation (EU) 2023/1114 - it is about assembling a Romania-ready file, which typically needs:
- a precise service-perimeter analysis under MiCAR Title V;
- governance and fit-and-proper mapping for management and qualifying shareholders;
- prudential capital planning tied to the relevant CASP class;
- AML/KYC and sanctions controls aligned with Romanian supervisory expectations;
- ICT, outsourcing, custody, complaints-handling, and business-continuity documentation;
- the mandatory ADR technical/cybersecurity clearance;
- and, where relevant, a separate legal analysis for tokens, white papers, and EMT/payment-services overlap.
Romania vs Malta vs Lithuania: a side-by-side comparison
Founders frequently ask whether Romania, Malta, or Lithuania is the better base for a CASP licence and token issuance. There is no universal answer - each jurisdiction trades off speed, regulator posture, cost, and local add-ons differently. The comparison reflects publicly reported market practice as of mid-2026; treat the ranges as indicative, not contractual.
Dimension | Romania (ASF / BNR) | Malta (MFSA) | Lithuania (Bank of Lithuania) |
|---|---|---|---|
Regulator posture | Newly operational under GEO 10/2025; BNR handles EMT/credit-institution overlap; ADR adds a mandatory technical clearance. Posture still forming - fewer precedents, but reportedly leaner so far. | Established supervisory infrastructure from the pre-MiCA VFA Act (2018); emphasis on governance and long-term sustainability; assesses overall risk profile. | Widely described as one of the fastest EU NCAs, with a long EMI/PI track record and a published applicant guide. English-friendly and process-oriented. |
Typical duration | Approx. 3–4 months from a complete file - a young regime with limited track record at volume. | Approx. 6–9 months, longer for complex profiles. | Approx. 6 months for a clean file; sometimes cited as the EU's fastest for high-quality applications. |
Process steps | Corporate readiness → ADR clearance → ASF file → completeness check → substantive review → authorisation; BNR runs in parallel if EMT/credit-institution activity is involved. | VFA-to-MiCA conversion (where applicable) or fresh file → MFSA completeness check → fit-and-proper/governance deep-dive → authorisation. | Fresh file or VASP-to-CASP conversion (window closed 1 Jan 2026) → completeness check → substantive review → authorisation. |
Local add-ons | Mandatory ADR clearance; dual ASF/BNR competence requires careful scoping; Romanian-language disclosures and a locally domiciled representative generally expected for foreign applicants. | Strong substance expectations (local directors, MLRO); Malta's 5% effective corporate tax via shareholder refund is a recurring commercial driver. | High Travel Rule and AML/CTF substance; common base for EMI/PI groups layering on CASP authorisation. |
Minimum capital | EUR 25,000–150,000 by class - low end of the EU spectrum for basic classes. | EUR 50,000–150,000 by class - at the MiCAR Title V floor. | EUR 50,000–150,000 by class - at the MiCAR Title V floor. |
Pros | Potentially faster review; lower entry capital for basic classes; growing advisory ecosystem; full EU passporting once granted. | Mature supervisory culture; predictable expectations; attractive tax structuring; recognised Tier 1 for institutions. | Fast, well-documented process; strong fit for EMI/PI groups; English-friendly; large population of authorised CASPs to benchmark. |
Cons | New regime - less precedent, evolving guidance, possible capacity constraints near the deadline; dual ASF/BNR scoping adds complexity for EMT-adjacent models. | Higher substance and cost bar; less suited to early-stage teams; longer timeline. | Transitional window already closed (1 Jan 2026); high AML/Travel Rule substance expectations. |
Token issuance fit | Classification done under the same ASF/BNR split; white paper review follows MiCAR Title II/III, EU-harmonised. | Benefits from MFSA's longer memory on asset-referenced structures from the VFA era. | Benefits from high processing volume and an established practitioner ecosystem; white paper substance identical across the EU. |
↔ On small screens, tables scroll sideways.
Bottom line: white paper content and token classification rules are EU-harmonised under MiCAR Title II/III regardless of where you apply, so jurisdiction choice mainly affects process speed, regulator posture, capital/substance expectations, and local procedural add-ons - not the substantive token analysis. A CASP licence from any of the three passports across the EEA on the same terms.
Token classification, white paper review & ASF/BNR readiness
Before filing, many founders make a costly mistake: they assume authorisation comes first and token analysis later. In reality, token classification often drives the entire regulatory map. Under MiCAR, a crypto-asset may fall outside MiCAR if it is actually a financial instrument, deposit, fund unit, or another excluded instrument. ESMA published final guidelines on qualifying crypto-assets as financial instruments, while the EBA's MiCA section confirms national authorities may request EBA opinions on classification, especially around ARTs and EMTs.
For a founder's use case, a Romanian firm should deliver three connected workstreams in English:
- a token legal opinion for classification;
- a MiCAR white paper review, including formatting and disclosure implications;
- a CASP authorisation strategy that matches the token and business model.
ESMA's white paper formatting requirements, including XBRL, entered into application in December 2024, with a published MiCA White Paper Taxonomy. White paper review is therefore no longer only a legal exercise - it is also a formatting and data-standards exercise. A Romanian MiCAR adviser who cannot bridge both may leave the project exposed.
Quantified authorisation roadmap: phases, durations, gating items
The roadmap sets realistic expectations for an ASF/BNR CASP file. Treat the 3–9 month total range as the practical band for a well-prepared application; the low end assumes a clean file and no combined EMT/payments scope, the high end accounts for ADR delays, completeness-check iterations, or a more complex perimeter.
Phase | Duration | Key activities | Gating items |
|---|---|---|---|
0. Readiness & scoping | 2–4 weeks | Service-perimeter analysis (Title V); role mapping; preliminary token classification; choice of CASP class | Confirmed activity perimeter; preliminary view on whether BNR (EMT) scope is triggered |
1. Governance & corporate build-out | 4–8 weeks (parallel with Phase 2) | Fit-and-proper docs; AML/CTF programme + MLRO; capital planning; outsourcing register; ICT framework; custody controls; complaints handling; BCP | Complete governance pack; capital actually available/segregated, not just budgeted |
2. ADR technical/cyber clearance | 4–8 weeks | Submission of IT and cybersecurity documentation to ADR for the Romania-specific clearance | ADR clearance obtained - a hard gate; ASF will not progress a file without it |
3. Token & white paper (if applicable) | 4–6 weeks (overlaps 1–2) | Token legal opinion; MiCAR white paper drafting/review, including XBRL per the Taxonomy | Finalised classification; white paper consistent with the disclosed model and CASP file |
4. ASF (and BNR) filing | 1–2 weeks | Compilation of the full file (governance, AML/CTF, capital, ICT, custody, complaints, ADR clearance, token/white paper) | File internally reviewed for completeness - incomplete files restart the clock |
5. Completeness & substantive review | 8–16 weeks (≈3–4 months from a complete file) | ASF (and BNR) review; responses to queries; possible interviews with management/MLRO | Regulator confirms completeness; no material open queries remain |
6. Authorisation & passporting | 1–4 weeks | Authorisation; registration in the ESMA central CASP register; passporting notifications if expanding | Authorisation granted; entry visible in ESMA's register |
Total practical range: ≈3–9 months, with ADR clearance and the quality of the governance/AML pack the two most common sources of delay. Given the EU-wide deadline of 1 July 2026, founders targeting authorisation by that date should file a complete application well before the final quarter, as regulator capacity is likely to tighten.
Documents pack: MiCAR Title V + Romanian implementation checklist
The list maps the core documentation a CASP applicant should assemble, aligned to MiCAR Title V and the Romanian layer under GEO 10/2025. It is a working checklist, not a substitute for the statutory list - always confirm the current ASF application form and referenced technical standards.
A. Corporate & governance
- Constitutional documents and proof of registered office in Romania;
- Programme of operations (scope of crypto-asset services);
- Governance: management body composition, fit-and-proper assessments, qualifying-shareholder mapping;
- Internal control framework and three-lines-of-defence description; conflicts-of-interest policy.
B. Prudential & capital
- Minimum capital evidence tied to the CASP class; own-funds calculation methodology; insurance arrangements where applicable.
C. AML/CTF
- AML/CTF programme and risk assessment; MLRO appointment and fit-and-proper file;
- Sanctions screening and Travel Rule evidence (procured and tested, not merely planned); CDD and ongoing monitoring procedures.
D. ICT risk & outsourcing
- ICT risk framework (DORA-aligned where relevant); outsourcing register; business continuity/disaster recovery;
- Cybersecurity documentation for the ADR technical clearance (Romania-specific gate).
E. Custody & client-asset protection
- Custody/safekeeping policy for client crypto-assets and funds; segregation and reconciliation procedures; incident-response procedure.
F. Complaints & client protection
- Complaints-handling procedure; client disclosure templates (pre-contractual info, risk warnings); marketing policy aligned with MiCAR.
G. Token-specific (where the applicant also issues/advises)
- Token legal opinion / classification memo; MiCAR-compliant white paper with XBRL per the Taxonomy; ART/EMT overlap analysis where BNR scope may be triggered.
H. Romania-specific items
- ADR clearance confirmation; authorised representative domiciled in Romania; Romanian-language website disclosures where required; tax/VAT positioning memo for crypto transactions and token sales.
Expect ASF (and BNR where EMT/credit-institution scope applies) to test internal consistency across documents - that the programme of operations, AML risk assessment, and custody policy describe the same activity perimeter. Inconsistencies are one of the most common causes of completeness-check delays.
Choosing the right MiCAR lawyer in Romania
Not every fintech-capable firm is equally suited to a founder-led CASP authorisation. The right question is not “Who has the biggest profile?” but “Who can take my exchange, custody, transfer, or advisory model from concept to filing, in English, with clear ownership of token classification and the Romanian regulator interface?” Here is how BSA compares with the named competitors.
Versus Țuca Zbârcea & Asociații
A major full-service firm with broad bench strength and strong disputes visibility - attractive scale for large institutional projects. For a crypto startup, BSA offers a more focused, entrepreneurial approach, better suited to iterative product-regulatory mapping and startup-sensitive turnaround.
Versus Mușat & Asociații
Visible blockchain and digital-assets capability, with crypto-exposed lawyers. BSA is positioned for founders who want crypto counsel integrated with startup formation, fundraising, shareholder arrangements, contracts, and tax-sensitive structuring - rather than a traditional large-firm workflow.
Versus NNDKP
A respected top-tier firm with deep regulatory and transactional strength for highly complex mandates. From a startup buyer's perspective, BSA can be the more efficient choice where the brief needs hands-on access, practical drafting, and a leaner relationship model for an early-stage crypto business.
Versus BMA Legal
Has published on MiCAR implementation and markets crypto-law services, with general-level analysis. BSA differentiates by pairing blockchain knowledge with a startup and investment practice relevant to governance, investor, contract, and launch-sequencing questions - not only “what does MiCAR say.”
Versus Pavel, Mărgărit & Associates
Public-facing crypto content, but a more generalist market profile. For founders specifically seeking MiCA/CASP authorisations and token legal opinions, BSA presents a stronger fit through a clearer dedicated positioning on blockchain, crypto, startup investment, and adjacent digital regulation.
Expert insights
Three regulatory signals should guide any Romanian CASP strategy in 2026.
- The EU register is live and supervisory convergence is real. ESMA's MiCA register includes authorised CASPs, white papers, and non-compliant entities, with regular updates - your authorisation will sit in a visible EU-wide supervisory ecosystem, not just a local file;
- Romania's pathway is converging on ASF for CASPs and BNR for EMT-linked banking activity, under a young regime. GEO 10/2025 entered force on 13 March 2025, and ASF is already issuing sanctions - implementation should be tracked continuously, including the ADR clearance step;
- EMT activity can create parallel payments issues. The EBA's opinions on PSD2-MiCAR interplay make clear that CASPs dealing with EMT-related payment services cannot rely on MiCAR alone - stablecoin-funded cards, payment flows, or custodial EMT wallets may need BNR and PSD2/EMT analysis.
MiCAR's transitional regime ends 1 July 2026. After that, no licence = unlawful operation.
ADR clearance. ASF/BNR scoping. Token classification before filing. A complete Romanian CASP file takes ≈3–9 months - start before regulator capacity tightens near the deadline.
How Buju, Stanciu și Asociații addresses this
BSA approaches MiCAR CASP licensing as a multi-layered execution project, not a standalone memo. The support is especially suited for founders who need:
- Romanian counsel in English for investor and board communication;
- a practical, phased roadmap for CASP authorisation with ASF and, where relevant, BNR - including the ADR technical clearance gate;
- a token classification legal opinion before launch or fundraising;
- white paper review for MiCAR disclosure consistency and regulator-facing logic;
- AML/KYC, commercial, tax, corporate, and startup-document alignment around the regulated product;
- a jurisdiction comparison (Romania vs Malta vs Lithuania) where the founder is still deciding where to base the licence.
What differentiates BSA is the ability to connect Romanian business law with crypto launch sequencing: what to classify first, what to disclose, what to file, what to contract around, and what to keep out of scope until the authorisation perimeter is settled.
Frequently asked questions
Do I need a MiCAR lawyer in Romania before applying for a CASP licence?
Yes. In practice, obtain Romanian legal advice before filing, because the authorisation strategy depends on service perimeter, token classification, AML design, governance, and whether ASF or BNR becomes relevant - plus the mandatory ADR technical clearance.
What does a token legal opinion usually cover?
It analyses whether the token falls under MiCAR, MiFID II, EMT/ART rules, payments law, or another regime, and explains the consequences for white papers, marketing, exchange listing, and licensing.
How long does CASP authorisation take in Romania vs Malta or Lithuania?
Current market reporting suggests roughly 3–4 months from a complete file in Romania, versus roughly 6 months in Lithuania and 6–9 months in Malta for typical files - though Romania's regime is newer, so treat all figures as indicative pending more authorisations.
How can Buju, Stanciu și Asociații help with CASP licensing in Romania?
BSA can support the project end-to-end: regulatory mapping, token classification, white paper review, corporate and investment structuring, AML/KYC documentation, and preparation for the Romanian CASP authorisation pathway with ASF and, where relevant, BNR.
What's next?
If you are building a crypto startup for the EU market and need a MiCAR lawyer in Romania for CASP licensing, token classification, white paper review, or a jurisdiction comparison against Malta and Lithuania, this is the right moment to move from research to execution.
Start by reviewing our blockchain and digital assets and start-up and investment capabilities, then contact Buju, Stanciu și Asociații to scope your Romanian authorisation pathway in English. The earlier the file is structured correctly, the faster your route to a compliant Romanian and EU launch.
Methodological note: timelines, capital ranges, and process descriptions for Romania, Malta, and Lithuania reflect publicly reported market practice as of mid-2026 and are indicative, not official guidance. ASF's regime under GEO 10/2025 is still young; confirm current requirements directly with ASF, BNR, ADR, MFSA, or the Bank of Lithuania before relying on any specific figure.