Law · Romania
E-Signature, KYC and AML Rules for SMEs in Romania
Romanian SMEs onboarding a new client sit under two separate rulebooks: EU-wide electronic signature law, and Romania's own anti-money-laundering act for obliged professions. This guide covers what makes an electronic signature valid, who has AML duties, what customer due diligence looks like in practice, and the GDPR points that come up when a client hands over an ID copy.
- eIDAS applies directly, and Legea 214/2024 sets the national detail
- Legea 129/2019 lists who has AML duties in Romania
- ONPCSB is the authority that receives suspicious-activity reports
Is an electronic signature valid on a contract in Romania
Yes, for most private-law documents. The eIDAS Regulation, (EU) 910/2014, applies directly in Romania as an EU regulation, so an electronic signature cannot be denied legal effect solely for being electronic, and a qualified electronic signature carries the same legal weight as a handwritten one. Romania's own Legea 214/2024, in force since October 2024, replaced the older Legea 455/2001 and sets out the national detail: it governs trust service providers and timestamps and, importantly, requires the signatory's express consent before an electronic signature is used on their behalf. Using someone's electronic signature without their knowledge and consent is a misdemeanour under the new law, with a real fine attached, which makes documented consent worth taking seriously.
Do most engagement letters and contracts need a qualified signature
No. An advanced electronic signature, sealed and evidenced, already carries full legal effect and admissibility for a standard commercial contract, an engagement letter or a service agreement between a Romanian business and its client. The documents Romanian practice typically reserves for a qualified signature, or a notarial act altogether, are the ones already requiring a notary under Romanian civil law: certain real-estate transfers, company formation acts filed with the trade registry, and specific formal deeds. Outside that narrower set, private commercial paperwork does not need a certified signing device or a qualified certificate to be enforceable.
Which Romanian professions have AML duties
Legea 129/2019, which transposes the EU's anti-money-laundering directive into Romanian law, applies to credit and financial institutions and to a defined list of other professions: accountants, auditors and tax consultants; notaries and lawyers, for financial or real-estate transactions; company formation and trust service providers; real-estate agents; and dealers in high-value goods paid in cash above a set threshold. If your firm sits in one of those categories, client due diligence is a legal duty attached to onboarding, not an optional extra you add if you feel like it.
What does customer due diligence look like in practice
In practice it means four things happen before or during onboarding: identifying the client with a document, verifying that document is genuine, identifying the beneficial owner if the client is a company, and forming a basic view of why the client is engaging your firm. Higher-risk clients get a closer look, sometimes including sanctions or politically-exposed-person screening. None of this needs to slow onboarding down if it is built into the same intake as the rest of the paperwork, rather than treated as a separate compliance step done afterward on paper.
Who does a suspicious case actually get reported to
The Oficiul Național de Prevenire și Combatere a Spălării Banilor, ONPCSB, is Romania's financial intelligence unit and the body that receives suspicious-transaction reports under Legea 129/2019. An obliged entity that identifies something that looks like money laundering has a legal duty to report it to ONPCSB rather than deciding privately to quietly end the relationship and say nothing. Recent amendments, including a 2025 emergency ordinance, have extended the law's reach to newer categories such as cryptocurrency service providers, which is a sign the framework keeps being updated rather than staying static.
What about GDPR when a client hands over a CNP or ID copy
A Romanian ID includes the CNP, the personal numeric code, which is treated as sensitive under Romanian data-protection practice because it can identify someone across many different systems at once. Collecting a copy is generally justified by a legal obligation, where AML rules require it, or by the contract itself, but the copy should be kept only as long as the record-keeping duty actually requires, not indefinitely by default. A copy sitting in an email inbox or a shared drive with no access control or deletion plan is a more common problem in practice than the collection itself.
How this looks as one onboarding flow
In one flow, a new client opens a single link, fills the client-acceptance questionnaire and beneficial-owner declaration, uploads an ID, verifies identity if the firm requires it, reads the GDPR notice, and signs the engagement letter, sealed with an advanced electronic signature and an evidence page recording their consent. The AML screening and risk score run in the background at the point the firm chooses. For an accounting or law practice with AML duties, this is the Practice plan at €149 a month, which adds hosted identity checks; sanctions and registry screening run on your own provider key at every tier, including Solo at €29 a month.
In Braigest
Client acceptance, KYC and the signed engagement letter, one link
For a Romanian accounting or law practice with AML duties, Practice at €149 a month adds hosted identity checks; sanctions screening runs on your own Dilisense key at every tier, including Solo at €29 a month.
Frequently asked questions
Is an electronic signature legally valid in Romania?
Yes, for most private-law documents. The eIDAS Regulation applies directly, and Legea 214/2024 sets out the national detail, including a requirement for the signatory's express consent before signing anything on their behalf.
Which Romanian professions must run AML checks on new clients?
Legea 129/2019 covers accountants, auditors, tax consultants, notaries and lawyers for certain transactions, company and trust formation providers, real-estate agents and dealers in high-value goods, alongside credit and financial institutions themselves.
Where does a suspicious transaction get reported in Romania?
To ONPCSB, the national office for preventing and combating money laundering, which is Romania's financial intelligence unit under Legea 129/2019, rather than to the police, a prosecutor or a court directly.
Can a Romanian accounting firm collect an ID copy under GDPR?
Yes, generally justified by the legal obligation to run due diligence, provided the copy is retained only as long as record-keeping rules require and is kept securely, not in a personal inbox.
Explore more of the platform
Ready to fix your onboarding?
See the whole flow in a 30-minute call, or explore the full Braigest platform.