Romania: A FinTech Legal Overview

As EU rules now set the pace for fintech development in Romania, this article takes a closer look at the European Digital Identity Framework (eIDAS) 2.0, KYC requirements, the Second Consumer Credit Directive (CCD2), consumer credit, crowdfunding and crowdlending, Markets in Crypto-Assets Regulation (MiCAR) white papers, the path to European Securities and Markets Authority (ESMA) listing and marketing rules, and real-world asset tokenisation (RWA). Romania is and will continue to be an emerging and promising environment for fintech and blockchain, as new platforms enter the market through authorisation or passporting.

eIDAS 2.0 and KYC for Fintechs

Under Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing 2.0, the European Digital Identity (EUDI) Wallet allows users to present verified identification data and electronic attestations of attributes directly to service providers. For fintechs (including embedded finance providers), this implies that customer due diligence and strong customer authentication could be performed without collecting document scans, selfies or video recordings, limiting checks to those attributes needed for AML/KYC purposes.

Following the wallet-implementing acts, member states must make at least one EUDI Wallet available within 24 months, pointing to availability by 2026. Private relying parties that are legally required to use strong user authentication, such as for banking and other financial services, will have to accept the wallet upon the user’s request within 36 months of those acts – ie, by 2027. In practice, 2026 is a preparatory year to achieve wallet acceptance and adapt onboarding for 2027.

CCD2

CCD2 (Directive (EU) 2023/2225 on credit agreements for consumers) must be transposed by member states by 20 November 2025 and will apply from 20 November 2026. Romania has not yet transposed it, but a draft law on consumer credit was published on 23 October 2025. CCD2 covers most consumer credit up to EUR100,000 (credit that is guaranteed by mortgage remains under the mortgage regime) and brings many buy‑now‑pay‑later models into scope, with limited supplier deferral exclusions.

The draft law establishes a series of marketing requirements, meaning advertising must be fair, clear and not misleading, and must include a warning (“Caution! Borrowing money costs money”, or equivalent) with standard cost information when figures are shown.

Consumers receive additional protection measures, including a 14-day withdrawal right, early repayment options with proportionate cost reductions, and the right to thorough, non-discriminatory creditworthiness assessments that exclude social network data and provide a human review of automated decisions. The draft law creates a two-tier compliance system, where small businesses retain basic requirements with 50-day payment terms, and large digital service providers face a stricter set of obligations, such as 14-day payment windows, restrictions on third-party credit offers and the same cost limitation (no interest, only limited late payment charges). The net effect is that deferrals offered by small retailers can remain outside the scope, whereas platform-based or third-party models are generally considered in scope.

Crowdfunding

CCD2 provides that, by 20 November 2025, the European Commission had to assess whether additional protections are needed when platforms facilitate consumer‑to‑consumer loans (crowdlending) without acting as creditors or credit intermediaries. Crowdfunding remains governed by Regulation (EU) 2020/1503 (the European Crowdfunding Service Providers Regulation; ECSPR), which provides for the authorisation and passporting of providers and imposes safeguards such as a key investment information sheet, a knowledge test, a loss-bearing simulation and a four-day reflection period. In Romania, crowdlending is emerging as a financing alternative as platforms obtain or seek ECSP authorisation from the Romanian Authority for Financial Markets (Autoritatea de Supraveghere Financiară; ASF) or rely on passporting from other member states to offer such services locally.

MiCAR White Papers and the Path to ESMA Listing

Based on our experience with this year's MiCAR-compliant listing projects, several best practices have emerged regarding the role, structure and white paper drafting for utility crypto-assets that are offered to EU markets.

Under MiCAR, the crypto-asset white paper is the long-term public reference document for a token. It is published on the ESMA register, and on the websites of the issuer and any relevant crypto-asset service providers (CASPs), and it is the primary point of reference for regulators, trading platforms and investors. As a result, its content must be strictly factual and measured. Statements suggesting or over-promising future returns or very specific price behaviour might not be appropriate, and even moderate over-statements or promotional language can create significant regulatory and civil liability exposure for the issuer, the offeror and the management of the crypto company.

The implementing standards divide the white paper into structured sections (A–J) and require it to be prepared in XHTML with inline XBRL tagging, so that key data are machine-readable (from December 2025 onwards). In practice, these sections cover at least:

• clear identification of the issuer, offeror and any CASP;
• a precise description of the token and the rights it confers;
• an explanation of the project and underlying technology;
• an organised presentation of risk factors;
• detailed information on the offer and any intention to seek admission to trading;
• governance arrangements, conflicts of interest and complaints handling; and
• a standardised sustainability component, including energy consumption and greenhouse gas indicators.

The “journey to listing” therefore consists of narrative drafting and careful documentation and analysis of all required fields, so that the same coherent package can be notified to the home authority, published and subsequently relied upon by crypto exchanges when assessing the token for admission to trading.

Marketing Rules: What MiCAR Actually Requires

MiCAR’s marketing rules are straightforward but quite demanding in practice. All communications relating to a crypto-asset must be fair, clear and not misleading, and fully consistent with the white paper.

In practical terms, this requires the use of:

• the same key facts and risk warnings in both the white paper and the advertising materials and campaigns;
• strict avoidance of any suggestion of guaranteed profit, liquidity or listing;
• alignment of any sustainability-related statements with the indicators disclosed in the white paper; and
• systematic recording of what has been published, when, to whom and in what format.

These requirements ensure that crypto-asset marketing maintains the same standards of accuracy and transparency as the underlying white paper documentation.

RWA and EU Capital Markets

RWA is becoming a significant European use case for blockchain infrastructure and capital markets. Revenue streams, real estate, invoices, intellectual property and fund interests are increasingly being structured as on-chain units. Romanian company and securities law provide solid tools for this architecture. Assets can be held in a special-purpose vehicle (SPV), security over those assets can be created and perfected, and cash flows can be allocated to token-holders through clear contractual arrangements that can be semi- or fully automated through blockchain smart contracts features. Assignments, pledges, subordination and enforcement routes are documented under Romanian law, while the tokens themselves circulate internationally.

Governance can, in addition, be organised through decentralised autonomous organisations (DAOs) or corporate SPVs (eg, joint stock companies) whose decision-making rules are reflected in the constitutional documents of the Romanian entity, so that on-chain voting corresponds to enforceable corporate rights. Tokenised structures can also be combined with licensed crowdfunding models, with the same Romanian SPV acting as issuer in a regulated crowdfunding offer and as the on-chain wrapper for the underlying assets.

Taken together, these features position Romania as a practical and scalable jurisdiction for RWA tokenisation projects targeting EU-wide distribution.