Building on our recently published chapter in the Chambers and Partners Blockchain Guide 2025
This briefing launches our Blockchain Insight Series, which builds on the material we contributed to the newly released Chambers and Partners Blockchain Guide 2025. In this article we cover topics related to AML/CFT, such as crypto-asset service providers’ obligations, reporting obligations, as well as practical examples of suspicious transactions under ONPCSB guidelines an best practices for detecting them.
AML/CFT Framework
Recent amendments to Romania’s AML legislation made by GEO 10/2025, in line with the EU’s TFR, have designated the Financial Supervisory Authority (ASF) as the national competent authority for overseeing CASPs, including crypto exchanges. The ASF is empowered to request compliance information, conduct off‑site and on‑site inspections, order audits by an exchange’s auditors, make independent regulatory compliance decisions, and issue remedial actions or sanctions for non‑compliance. The National Bank of Romania (BNR), meanwhile, retains supervisory responsibility for credit institutions and electronic money institutions providing crypto‑asset services.
Crypto-Asset Service Providers’ Obligations
Providers must identify and manage risks associated with transfers involving unhosted addresses (private wallets not controlled by regulated entities) by:
- implementing internal risk assessment and management procedures;
- verifying customer identities during transfers involving unhosted addresses;
- obtaining additional information about crypto transfers, such as source of funds or destination addresses; and
- conducting enhanced and ongoing monitoring for high-risk transactions.
For international correspondent relationships (especially outside the EU), additional due diligence is required, including:
- confirming the authorisation status of partner entities;
- making sure that partner entities verify customer identities consistently; and
- documenting and maintaining comprehensive information on these correspondent relationships.
CASPs authorised in other EU member states must:
- appoint a local and unique Romanian contact for compliance and regulatory communication;
- notify ASF or BNR within five days of beginning local operations; and
- provide supervisory authorities with requested documents promptly.
Reporting Obligations Under AML Law
Suspicious transactions reporting
CASPs must file a Suspicious Transaction Report (STR) whenever they know or have reasonable grounds to believe that:
- funds stem from criminal activity or relate to terrorist financing; or
- information held by the provider could help enforce AML/CFT rules.
In addition, the ONPCSB may designate certain transaction types in advance as automatically suspicious. When notified, CASPs must treat every such transaction as suspicious and file an STR without delay.
Identifying suspicious transaction indicators
Ongoing transaction monitoring, thorough KYC procedures, and analysis against the customer’s established profile form the basis for identifying suspicious transactions. Each transaction’s circumstances should then be assessed against the red‑flag indicators set out in the AML Law and its implementing regulations, such as the following:
- The volume or value of assets a client trades compared to their normal profile – transactions that are unusually large can raise a red flag, which is similar to breaking a large sum into multiple smaller trades (smurfing).
- The pattern and length of a client’s relationship: a large transaction made immediately after account opening, particularly if it does not match the client’s profile, can raise concerns. Equally, sporadic high‑value transactions separated by long periods of inactivity may signal risk. Another scenario warranting analysis is when a client carries out a substantial one‑off trade followed by the immediate closure of their account on the platform.
- Classification of clients by risk level – the following aspects may contribute to classifying a client as low risk:
- publicly traded companies;
- state-owned institutions or companies; and
- clients based in jurisdictions with strong AML/CFT systems, such as EU member states or countries assessed by credible bodies (eg, FATF mutual evaluations) as effectively enforcing AML and CFT standards.
- The company’s shareholding structure is unusual or excessively complex in relation to the nature of its activity.
- Transactions or business relationships involving persons holding a public office, or clients whose beneficial owners are persons holding a public office, including during a period of at least 12 months following the loss of the public office, etc.
Examples of suspicious transactions under ONPCSB guidelines
Unlicensed or non‑compliant crypto‑asset trading venues often lack basic identity checks, allowing anonymous accounts and addresses to be created. Criminals take advantage of these gaps to move illicit crypto‑assets through licensed platforms and convert them into fiat currency. The indicators of suspicion include:
- the platform used for transactions is unlicensed and does not comply with anti-money laundering policies and procedures; and
- the individual opens an anonymous account on the platform without providing detailed information or undergoing proper verification.
Also, NFTs can be used to launder money in several ways:
- by minting and trading fake NFTs;
- by buying genuine NFTs with illicit funds;
- by moving value through NFT transfers; or
- by linking NFTs to digital art to disguise the source of money.
These tactics create a veneer of legitimate activity while hiding the true origin of the funds. The indicators of suspicion include:
- creating NFTs using anonymous addresses;
- executing NFT transactions at extremely high prices; and
- trading NFTs in countries with weak compliance and regulatory standards.
Best-practice for detecting suspicious transactions
Based on Romania’s AML law and the ONPCSB’s guidelines, the authors have identified the following best practices for CASPs and issuers operating in Romania.
Reporting entities must be proactive in identifying transactions and behaviours that raise suspicion. This involves continuously monitoring clients’ activity and commercial relationships (with the reporting entity), conducting transaction reviews, and flagging unusual trading patterns or other red flags that could signal illicit conduct.
It is recommended to regularly train a dedicated team to be familiar with the various types of schemes of money laundering and terrorist financing. Also, CASPs are encouraged to constantly adapt to the latest and most advanced technologies for transaction monitoring and KYC implementation. For example, ONPCSB specifically recommends the use of blockchain transaction analysis software, as well as analytical and AI algorithms.
It is also advisable to regularly consult public lists of national and international sanctions against specific entities, especially when those sanctions involve freezing assets and prohibition of transactions. For example, CASPs could refer to the United Nations sanctions list, the international sanctions list published by the ONPCSB, the Financial Act Task Force Blacklist, etc.
The EU’s New AML Framework
For the first time, AML obligations will be set out in an EU regulation (AMLR), which means they will apply directly in all member states (including Romania) without any national transposition. The AMLR broadens the scope of “obliged entities” subject to AML rules to cover emerging sectors. All types of CASPs are now included, placing them on equal level with traditional financial institutions for AML purposes.
The AMLR was adopted in 2024, but its requirements take effect in stages. Most obligations apply from 10 July 2027, giving market participants time to prepare. There is a limited extension for a few newly covered sectors (such as certain professional football clubs and agents), which need to comply by 10 July 2029, by which point the regulation will be fully in force for all. In practical terms, by 2027 Romania’s current AML legislation will be superseded by the AMLR’s uniform framework.
For more information on AML/CFT compliance, please contact the Lexters team through the Contact Section.
This note is for general information only and does not constitute legal advice.
