Anti-Money Laundering Compliance in Romania in 2026–2027: Law 129/2019, AML Obligations and the New EU Rules

Legal and regulatory compliance guide for gambling operators, B2B suppliers and investors. Szilaghi Consulting, updated 11 October 2026, with a 2027 regulatory outlook.

Romania’s anti-money laundering and counter-terrorist financing (AML/CFT) framework is entering a significant period of regulatory change. Law No. 129/2019 remains the principal Romanian AML legislation in 2026, while the European Union’s new AML package introduces additional requirements, with a major implementation milestone on 10 July 2027.

For gambling operators, the principal obligations include:

• Know Your Customer (KYC) and Customer Due Diligence (CDD): identifying and verifying customers and, where relevant, beneficial owners.
• Risk assessment: evaluating exposure associated with customers, gambling products, payment methods, transactions and jurisdictions.
• Transaction monitoring: identifying unusual activity and reporting suspicious transactions to Romania’s Financial Intelligence Unit (ONPCSB).
• The €2,000 gambling-related CDD threshold: applying relevant checks when specified gambling transactions reach this amount, without treating the threshold as a general exemption from earlier verification.
• Cash transaction reporting: reporting qualifying cash transactions of at least €10,000 in accordance with Romanian law and ONJN instructions.
• Internal compliance controls: maintaining effective procedures, staff training, record-keeping and management oversight.

From 10 July 2027, Regulation (EU) 2024/1624 will introduce a more harmonized European AML framework, including explicit provisions concerning linked gambling transactions.

For gambling businesses, AML compliance is no longer simply a documentation requirement. It must be integrated into the operating platform, payment infrastructure, corporate governance and risk management processes.

This article examines the Romanian framework applicable in 2026, the forthcoming EU rules and the practical steps operators should take to prepare for 2027.

1. From the transposition of EU directives in 2019 to Romania’s AML framework in 2026

In July 2019, Romania adopted Law No. 129/2019 on preventing and combating money laundering and terrorist financing.

The legislation represented an important step in implementing Directive (EU) 2015/849, as amended by Directive (EU) 2018/843, and strengthening the country’s financial crime prevention framework.

It established AML obligations for a broad range of businesses and professionals, including credit institutions, financial institutions, certain professional service providers and gambling service providers.

Between 2019 and 2026, both Romanian and European legislation continued to evolve.

For the gambling industry, a significant development was ONJN Order No. 370/2021, which approved sector-specific AML instructions that entered into force in January 2022. We covered them in detail when ONJN issued its AML instructions for gambling companies.

These instructions introduced more detailed expectations concerning risk assessment, customer monitoring, suspicious activity detection and internal procedures.

At European level, the adoption of a new AML legislative package in 2024 marked another major development. The objective is to reduce differences between Member States’ regulatory requirements and establish a more consistent system of financial crime prevention and supervision.

AML regulatory timeline

An important distinction must be maintained: Romanian Law No. 129/2019 has not been entirely replaced in 2026. Regulated entities must continue complying with current national legislation while preparing for the EU requirements scheduled to apply from 2027.

2. Which businesses have AML obligations in Romania?

Article 5 of Law No. 129/2019 identifies the categories of reporting entities subject to Romanian AML requirements. These include credit institutions, financial institutions, gambling service providers and other businesses or professionals expressly specified by law.

For the iGaming industry, classification as a reporting entity has significant consequences. Operators must implement AML/CFT measures proportionate to the risks associated with their activities.

In Romania, two authorities play particularly important roles.

ONPCSB — Romania’s Financial Intelligence Unit

The National Office for Prevention and Control of Money Laundering (ONPCSB) operates as Romania’s Financial Intelligence Unit. It receives and analyzes suspicious transaction reports and other information required under the AML framework.

Its functions include processing relevant financial intelligence and fulfilling the duties established by Romanian legislation.

ONJN — sectoral gambling regulator

The National Gambling Office (ONJN) is responsible for gambling regulation and exercises sectoral AML supervisory responsibilities within its legal competence.

Through Order No. 370/2021, ONJN established detailed instructions concerning AML risk assessments, customer monitoring, internal policies and the identification of suspicious activity.

ONPCSB and ONJN perform different but complementary functions. An operator’s ONJN gambling license does not, by itself, establish that its AML policies or operational systems satisfy all applicable legal requirements. Our Romania Class I (B2C) license guide shows where the AML program sits in the license file.

What about Class II B2B suppliers?

A supplier holding an ONJN Class II license should not automatically be treated as having identical player-identification obligations to a B2C gambling operator.

The applicable requirements depend on the supplier’s actual activities and legal classification. For example, a company providing regulated payment services may also be subject to financial sector AML legislation, while a software supplier may have different licensing, contractual and compliance obligations.

The correct approach is to assess each business activity separately rather than assume that all Class II suppliers have the same AML responsibilities. The Romania Class II (B2B) license page sets out the AML/KYB documents ONJN expects from suppliers, and our article on Class II reporting obligations under Law 141/2025 covers the ongoing reporting side.

3. KYC and customer due diligence obligations for gambling operators

Know Your Customer (KYC) and Customer Due Diligence (CDD) are fundamental components of AML compliance. They are intended to establish the identity of customers, verify relevant information, understand business relationships and monitor transactions.

Article 11 of Law No. 129/2019 establishes the main elements of customer due diligence, while Article 13 specifies circumstances in which standard measures must be applied.

For gambling operators, these requirements need to be reflected in operational processes and the technology used to manage customer accounts. In online gambling, verification procedures may involve identity documents, electronic verification solutions, transaction information and ongoing account monitoring.

Important AML thresholds in 2026

Does the €2,000 threshold mean KYC can be delayed?

No. This is one of the most important distinctions for online gambling operators.

The €2,000 rule concerns particular gambling transactions. It is not a blanket exemption from identifying customers when a business relationship is established.

Under Article 14 of ONJN’s sector-specific instructions, gambling service providers must apply customer due diligence before initiating a business relationship. As a result, online onboarding systems should not automatically defer all identity verification until a player reaches a €2,000 transaction threshold.

Verification requirements must be assessed according to the relationship, relevant transactions, risks and applicable gambling rules. The same onboarding flow also has to check the national self-exclusion register; our article on self-exclusion breaches and ONJN enforcement explains the risk.

A properly configured onboarding process should identify when CDD is required, what information must be collected and which activities must be restricted until the necessary checks are completed.

4. Beneficial ownership and corporate structure verification

Anti-money laundering requirements do not concern only individual gambling customers. Beneficial ownership identification is particularly relevant when dealing with corporate clients, complex ownership structures and certain commercial relationships.

A beneficial owner is generally the natural person who ultimately owns or controls a legal entity, determined according to the legal criteria applicable to that entity. Identifying the beneficial owner may require examination of shareholding structures, indirect ownership, control rights and corporate documentation.

For iGaming investors, these checks are relevant both during licensing applications and when establishing banking and payment-processing relationships. A complex corporate structure is not automatically unlawful. However, regulated entities must be able to explain and document relevant ownership and control arrangements, which is why we build the ownership file into gambling company formation from the start.

Politically exposed persons and higher-risk jurisdictions

Enhanced due diligence may be necessary when dealing with politically exposed persons (PEPs), relevant family members or close associates, higher-risk jurisdictions and other circumstances identified through a risk assessment.

Additional measures may include further inquiries regarding the source of funds or wealth, management approval and closer transaction monitoring. These measures should be applied consistently, proportionately and with an appropriate audit trail.

5. Transaction monitoring: identifying suspicious activity

An effective AML program does not end once a customer’s identity has been verified. Operators must monitor business relationships and transactions on an ongoing basis.

ONJN’s sectoral AML instructions identify gambling-specific risks that should inform monitoring procedures. Potential warning signs may include:

• Deposits followed by withdrawals with little or no corresponding gambling activity.
• Transaction patterns inconsistent with a customer’s known profile.
• Unclear, contradictory or implausible explanations regarding the source of funds.
• The use of false, stolen or unreliable identity documentation.
• The possible use of third parties or intermediaries to conduct transactions.
• Fragmented or otherwise unusual transactions.
• Payment activity that differs materially from established customer behavior.

These indicators should be assessed in context. The existence of a risk indicator does not automatically prove money laundering or criminal conduct. It may, however, require further examination, additional information or escalation to the responsible compliance personnel.

For online gambling businesses, effective monitoring often requires connecting information from the gambling platform, customer account system, payment infrastructure and compliance tools.

An operational monitoring framework should establish how alerts are generated, reviewed and documented. It should also make it possible to reconstruct the reasoning behind important compliance decisions.

6. Suspicious transaction reporting to ONPCSB

Law No. 129/2019 establishes obligations to report suspicious transactions in the circumstances set out in Article 6.

Reporting does not depend on a criminal conviction or definitive proof that funds originate from illegal activity. The relevant question is whether the reporting entity knows, suspects or has reasonable grounds to suspect circumstances covered by the legislation.

Two reporting mechanisms that must not be confused

Suspicious Transaction Reports (STRs). These are based on relevant suspicions and are not dependent on reaching a minimum transaction value. A suspicious transaction may therefore require reporting even when the amount involved is relatively small.

Threshold-based cash transaction reports. Article 7 of Law No. 129/2019 establishes reporting requirements for qualifying cash transactions involving amounts of at least €10,000. ONJN’s sector-specific instructions also address relevant fragmented cash transactions conducted within the same day. Article 24 of those instructions provides for reporting within a maximum of three working days in the circumstances specified there.

Where transactions are conducted through a credit or financial institution, the entity responsible for reporting must be determined according to the applicable legal rules.

Confidentiality and internal escalation

Employees handling transaction monitoring and suspicious activity must understand the confidentiality requirements applicable to reports.

Policies should identify who reviews alerts, who makes reporting decisions and how relevant transactions are handled. Special care must be taken to comply with legal restrictions on disclosing suspicious reporting activity to customers or third parties.

Suspicious transaction reporting should be a controlled and documented process rather than an informal decision made by individual operational employees.

7. Internal AML policies, governance and record-keeping

AML compliance requires an effective system of internal accountability.

Law No. 129/2019 establishes obligations concerning designated personnel, internal policies, risk management, controls and training. ONJN’s instructions supplement those requirements for gambling service providers.

An AML program should define procedures for customer identification, risk assessment, transaction monitoring, escalation, reporting and record-keeping. Management responsibilities must also be clearly established.

The five-year record retention rule

Article 21 of Law No. 129/2019 generally requires relevant CDD records and transaction documentation to be retained for five years following the termination of the business relationship or the relevant occasional transaction.

In legally specified circumstances, competent authorities may require an extension of the retention period, subject to statutory limits. ONJN’s sectoral rules include additional provisions concerning the retention and management of gambling-related records.

At the end of the applicable period, personal data must be handled in accordance with legal deletion and retention requirements.

AML compliance and GDPR

AML record-keeping obligations must be coordinated with the General Data Protection Regulation (GDPR). Personal information collected for AML compliance should not automatically be used for unrelated purposes, including marketing activities, where such processing would be incompatible with applicable law.

For online gambling operators, coordination between legal, compliance, IT and marketing teams is therefore particularly important. Our earlier article on how GDPR changed the online gaming industry covers the data protection side.

AML data is collected for a regulated purpose. Its availability within a company’s systems does not automatically authorize unrestricted reuse.

8. What changes under Regulation (EU) 2024/1624 from July 2027?

Regulation (EU) 2024/1624, commonly referred to as the Anti-Money Laundering Regulation or AMLR, introduces a more harmonized European compliance framework.

Unlike a directive, an EU regulation is directly applicable in Member States in accordance with its provisions and implementation timetable.

AMLR addresses customer due diligence, beneficial ownership, risk assessments, internal policies, monitoring and other essential AML obligations. Its general application date is 10 July 2027, subject to specific exceptions.

The €2,000 gambling transaction rule under AMLR

Article 19(5) of Regulation (EU) 2024/1624 establishes a gambling-specific customer due diligence requirement. It applies when gambling service providers handle the collection of winnings, the wagering of stakes or both, involving transactions of at least €2,000, whether through a single transaction or linked transactions.

This distinction is operationally significant. Providers must be able to identify transactions connected to the same customer and determine when the relevant threshold has been reached.

The regulation’s recitals also recognize the need for systems that can attribute and monitor transactions before customer identity verification is completed, in circumstances where the specific threshold-based rule is relevant.

This does not override other circumstances requiring earlier customer due diligence, including the establishment of a business relationship.

The new EU AML framework

The new regulation increases the importance of effective transaction attribution, linked-transaction monitoring and consistent CDD procedures.

For gambling operators, these requirements may affect account management systems, transaction processing, compliance software and relationships with third-party technology providers. Businesses should therefore begin reviewing their technical and operational readiness before the new framework becomes applicable.

9. What is AMLA and how will it affect gambling operators?

Regulation (EU) 2024/1620 established the European Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA). The authority is based in Frankfurt, Germany.

Its role includes promoting consistent supervision, supporting cooperation between national Financial Intelligence Units and contributing to the development of harmonized AML rules.

The EU has scheduled the first selection of entities for direct AMLA supervision during 2027. Direct supervision of selected high-risk financial institutions is expected to begin in 2028.

Will AMLA replace ONJN in 2027?

No. AMLA’s establishment does not mean that ONJN will automatically cease supervising AML compliance within the Romanian gambling sector.

AMLA’s direct supervisory arrangements primarily concern selected financial institutions, while national sectoral authorities continue to perform their responsibilities under the applicable framework.

For gambling operators, AMLA is particularly relevant because of its role in regulatory harmonization, technical standards and supervisory convergence. These developments may influence the expectations of national regulators and the operation of AML systems over time.

10. How should gambling operators prepare for 2027?

Preparing for the new EU framework should be treated as an operational compliance project. The starting point is a gap assessment comparing existing policies, systems and controls with the forthcoming requirements.

Recommended 2027 readiness priorities

The objective should be to demonstrate operational compliance rather than simply produce revised policy documents.

For example, a monitoring system should provide evidence showing why an alert was generated, which employee assessed it, what information was considered and how the final decision was reached. This level of traceability can support both internal audit and supervisory examinations.

Technology and automation

Technology may support transaction monitoring, anomaly detection, data reconciliation, record retention and regulatory reporting. However, automated compliance systems require appropriate governance, validation, human oversight and protection of personal data.

Automation does not transfer legal responsibility away from the reporting entity.

11. The risks of non-compliance

Failures to comply with AML obligations may result in administrative sanctions, remedial measures and other consequences depending on the nature and seriousness of the breach.

For gambling operators, the commercial impact may extend beyond a financial penalty. Deficiencies in customer verification, transaction monitoring or internal governance can affect relationships with banks, payment processors, technology suppliers and licensing authorities. The €1.5 million (£1.3 million) settlement with White Hat Gaming is one example of what regulators impose when controls fail.

A company may have detailed written policies yet still maintain an ineffective compliance program if those policies are not implemented correctly. For this reason, regulatory readiness should focus on whether the control framework operates effectively in practice.

Sustainable AML compliance requires clear accountability, reliable information and operational controls working together.

Conclusion: AML compliance becomes a strategic priority for 2027

Romania’s AML legislation has evolved substantially since the adoption of Law No. 129/2019. The national framework and ONJN’s sector-specific instructions remain essential for gambling operators in 2026.

From 10 July 2027, Regulation (EU) 2024/1624 will introduce a more uniform European framework, while AMLA will continue developing the institutional architecture for coordinated supervision.

For gambling operators, technology suppliers and investors, adapting to these changes should not be treated solely as a legal documentation exercise. Policies must be connected to customer onboarding, payment processing, transaction monitoring, risk management, regulatory reporting and data protection.

Businesses that begin preparing during 2026 will be better positioned to manage the transition to the new EU AML framework in 2027.

Support with AML compliance

Szilaghi Consulting provides advisory services covering gambling licensing, regulatory compliance and business structuring. We assist gambling operators, B2B suppliers and investors in understanding their regulatory obligations and aligning compliance requirements with operational models.

Our services may include reviewing existing AML frameworks, assessing obligations under Romanian Law No. 129/2019, supporting the preparation of KYC/CDD policies, evaluating reporting procedures and planning for the new EU rules.

For businesses preparing a gambling license application, market expansion or operational restructuring in 2027, AML compliance should form part of the project from its earliest stages. Our guide to starting an online casino in 2027 compares licensing costs across 23 jurisdictions, and the free Romania Gambling Market Report 2026 puts AML in the context of the full Romanian market-entry process.

Learn more about our gambling consulting services and compliance and GDPR services, or contact Szilaghi Consulting to discuss your compliance requirements.

This article provides general regulatory information and does not constitute individual legal, tax or compliance advice. The application of AML requirements depends on the entity’s activities, legal classification, customer relationships and risk profile. The EU framework and any implementing technical standards should be reviewed again before the 2027 application date. Last legislative review: 11 October 2026. Regulatory outlook: 2026–2027.