Why crypto founders in Romania need MiCAR counsel for CASP licensing

MiCAR authorisation in Romania is not just a filing step. If your business qualifies as a crypto-asset service provider (CASP), the licensing route shapes your entity structure, service scope, token analysis, governance, anti-money laundering (AML) set-up, regulator interactions and your ability to passport services across the EU.

For Romania-based founders and investors, specialist counsel matters early, because the process sits where EU MiCAR rules meet local touchpoints involving the Financial Supervisory Authority (ASF), the National Bank of Romania (BNR) and, potentially, the technical clearance of IT systems. Done well, authorisation becomes a foundation for scaling. Done poorly, it creates delays, scope problems and avoidable regulatory risk. Buju, Stanciu & Asociații advises crypto founders and investors on exactly this path, from perimeter analysis to the licence application.

The transitional window has closed: authorisation is now the only route

MiCAR allowed member states to let existing crypto service providers keep operating under a transitional regime until 1 July 2026 at the latest, or until authorisation was granted, whichever came first (A&O Shearman). That deadline has passed in every member state. Any business providing crypto-asset services to clients in the EU now needs a MiCAR authorisation or must rely on a licence passported from another member state.

Authorisation status is also public. ESMA maintains a register that lists both authorised CASPs and non-compliant entities. Clients, banks, investors and counterparties can check where you stand, so a licence is now also a commercial credential.

What counts as a CASP, and why founders must decide early

Under MiCAR, a CASP is “a legal person or other undertaking that provides one or more crypto-asset services to clients on a professional basis” and is authorised to do so (A&O Shearman). The test is functional: it turns on the services you actually provide, such as custody, trading, exchange, advice or portfolio management of crypto-assets, not on how you brand the product.

Founders often focus first on product and fundraising. The harder question is whether the business model already maps onto regulated services. If that question waits until the application stage, the legal entity, contracts, governance model and internal controls may turn out to have been built around the wrong perimeter.

MiCAR sets uniform EU rules for crypto-assets not covered by existing financial services legislation, built around transparency, disclosure, authorisation and supervision (ESMA). Whether you are a CASP is therefore not a label to add later. It is a strategic classification that should shape the business from day one.

Why authorisation is not a paperwork exercise

The application reflects earlier legal and operational choices. If those choices are inconsistent, the file becomes harder to prepare and defend. Four issues usually decide the outcome:

This is where specialist counsel adds value before any filing starts. Buju, Stanciu & Asociații advises on blockchain projects, cryptocurrencies, digital assets, structuring and MiCA compliance, and also assists start-ups and investors with incorporation, shareholders' agreements, funding rounds and due diligence (www.bsa.ro). That combination matters because a CASP application is often the point where regulatory law and venture execution meet.

Romania-specific regulatory touchpoints

Romania adds local execution questions that make early legal planning more important:

•      ASF is expected to be the primary authority for the crypto sector, authorising and supervising CASPs. For most founders, it will be the central touchpoint.

•      BNR becomes relevant where a project involves credit institutions or the issuance of e-money tokens. Founders should not assume every crypto business follows a single-regulator path.

•      Technical clearance of IT systems by the Authority for the Digitalisation of Romania (ADR) may be required before ASF grants a licence. A legal strategy that ignores this track may not be workable.

Licensing requirements, supervision by ASF and BNR, compliance timelines and sanctions all need to be planned together. Buju, Stanciu & Asociații combines MiCA compliance work with a pragmatic business-law approach, which helps when a founder needs a workable plan for Romanian authorisation rather than abstract regulatory interpretation.

AML readiness, governance and application strategy

AML. For AML purposes, CASPs in Romania are treated like other financial institutions under Law 129/2019: customer due diligence (KYC), transaction monitoring, suspicious activity reporting and a designated AML officer. AML readiness is not only about adopting policies. Onboarding flows, internal reporting, monitoring logic and lines of responsibility must match the services you intend to provide, and they must change if the service scope changes.

Governance. Because MiCAR revolves around authorisation and supervision, the application draws attention to who is responsible for what and how the business is controlled. Weak governance design leads to repeated clarification requests, internal rework and misalignment across legal, product and operations.

Application strategy. A licence scope broader than the business needs creates unnecessary burden; a scope too narrow constrains future plans. Experienced counsel aligns the requested perimeter with the real roadmap.

The upside: EU passporting. Once authorised, a CASP can offer its licensed services throughout the EU, subject to notification through its home-state regulator (A&O Shearman). A Romanian licence can therefore be the basis for cross-border distribution across the single market.

What founders should prepare early

1.      Define the services you actually provide to clients, not just the brand narrative. The CASP analysis and licence scope depend on this mapping.

2.     Review the token model for classification questions, including whether it could qualify as an asset-referenced or e-money token.

3.     Check that the group and entity structure fit a regulated business. Incorporation choices, investment rounds and shareholder arrangements may need to be revisited. Buju, Stanciu & Asociații aligns regulatory readiness with investor readiness, rather than handling them separately.

4.     Build AML and governance readiness in parallel with the legal work: KYC, monitoring, reporting and the AML officer role.

5.     Map the Romanian critical path — ASF, possible BNR involvement and IT clearance — and run the process as a coordinated regulatory project, not a single submission.

Why the choice of counsel matters

A CASP licensing project affects incorporation, financing, governance, operations and go-to-market planning. Investors need confidence that the regulatory path is credible and that licensing risk is managed in a structured way. Specialist MiCAR counsel is therefore not only about interpreting the regulation, but about helping the company make earlier decisions that hold up when authorisation begins — and about capturing the strategic value of the licence, including EU passporting.

Buju, Stanciu & Asociații is well placed for this conversation: a Bucharest business-law firm with dedicated practices in blockchain and digital assets, MiCA compliance, and start-ups and investments. For crypto founders in Romania, that combination is particularly relevant, because CASP licensing sits where digital-asset regulation and company-building meet.

Conclusion

For crypto businesses in Romania, MiCAR authorisation is best approached as a business design project with regulatory consequences, not as paperwork at the end. With the transitional period over, the question is no longer whether to apply, but how well prepared the application is. The right legal support helps founders confirm whether they are a CASP, prepare for ASF and BNR touchpoints, address IT clearance, strengthen AML and governance, and position the licence for EU passporting.

If you are building a crypto business with Romanian operations or investors, test your model early against the MiCAR perimeter and local implementation points. Buju, Stanciu & Asociații can help make the licensing path clearer and more scalable — visit www.bsa.ro.

PROFESSIONAL NOTE

This article is provided by Buju, Stanciu & Asociații for general information purposes only. It does not constitute legal advice and does not create a lawyer–client relationship. Regulatory requirements under MiCAR and Romanian implementing legislation, as well as the practice of the competent authorities (ASF, BNR, ADR), continue to evolve. Any decision regarding the structuring, authorisation or operation of a crypto-asset business should be taken only on the basis of specific legal advice tailored to your circumstances.

About the firm. Buju, Stanciu & Asociații is a Bucharest-based business and criminal law firm, focused on tailored, pragmatic legal solutions. Its practice areas include blockchain and digital assets, MiCA compliance, start-ups and investments, commercial law, intellectual property and artificial intelligence.

Buju, Stanciu & Asociații · Str. Belgrad 10, Sector 1, 011804 Bucharest, Romania · www.bsa.ro