On 7 January 2022 ONJN published its money-laundering prevention instructions for the gambling sector. ONJN Order 370/2021, in Monitorul Oficial Part I no. 21/2022, requires every gambling provider licensed in Romania to build its own risk-based policies under Law 129/2019, name designated AML officers, train staff and report suspicious transactions to ONPCSB, Romania’s financial intelligence unit. The instructions apply to Romanian companies, Romanian branches of foreign companies and foreign entities operating under an ONJN license.
The instructions start from risk. Each provider must identify and manage the money-laundering and terrorist-financing risks of its customers, products and transaction types. ONJN listed the typical risks for each vertical.
Sports betting
- Employee complicity.
- Customer anonymity, especially at self-service betting terminals, which lets large sums of criminal origin enter as stakes.
- No know-your-customer policy.
- Betting through intermediaries who place stakes for others.
Casinos, poker clubs and poker festivals
- Illegal lending (usury) on the premises.
- Hidden beneficial owners.
- High rollers splitting large amounts into many small stakes to avoid attention.
- Large, repeated losses to the same players in games not played against the house, a classic route for transferring value.
- Currency exchange and other financial services on site.
- Players resident abroad, particularly outside the EU/EEA or in FATF high-risk or monitored jurisdictions.
Slot machines
- Employee complicity.
- Self-service terminals.
- Fictitious jackpots or cash bonus payouts used to give cash a clean origin.
Remote gambling
- Organized groups exploiting casino, betting, slot, poker or bingo products.
- No physical presence of the player.
- False or stolen identity documents.
- E-wallet funding.
- Deposits withdrawn with little play, so that cash appears in a bank account as gambling winnings.
Governance, training and audit
Each provider must designate one or more persons responsible for AML/CFT, communicate its procedures to staff on hiring and at least once a year, and keep records. Providers that exceed at least two of three size thresholds (total assets of RON 16 million, net turnover of RON 32 million, an average of 50 employees) must also commission an independent audit of how their AML policies work in practice at least every two years. The wider framework is described in our post on the EU AML directive in Romanian law.
Report suspicious transactions to ONPCSB
A provider reports to the National Office for Prevention and Control of Money Laundering (ONPCSB) when it:
- suspects money laundering or terrorist financing;
- suspects that funds come from crime, or that the customer is not the real beneficiary or cannot be identified;
- finds a business relationship or occasional transaction with a person under ONPCSB attention suspicious.
Separately, Law 129/2019 requires reports of cash transactions of €10,000 or more, including linked operations split into smaller amounts.
What applies now (2026)
Order 370/2021 remains the gambling sector’s AML instruction, and Law 129/2019 remains the governing law. Four things have changed around it.
ONJN uses its data. Since early 2026 ONJN has direct access to operators’ servers and their required reports. In February 2026 it announced audits into suspected manipulation of the GGR base, including large winnings clustered on the same day in near-identical amounts, and said confirmed cases would be referred to criminal investigators and to ONPCSB. AML controls and tax reporting now draw on the same data, so a weak AML file is also a tax risk.
Suppliers are in scope. Since Law 141/2025, Class 2 software, platform and payment suppliers must block players reaching unlicensed operators and report monthly to ONJN. Due diligence on business partners is now a licensing question as well as an AML one. Our Class 2 (B2B) license page sets out the supplier duties.
Unlicensed activity is blacklisted faster. Unlicensed sites and platforms are blocked through ISPs and removed from major platforms, as we describe in how sites get blacklisted.
The EU single rulebook is coming. Regulation (EU) 2024/1624 applies from 10 July 2027. Gambling providers remain obliged entities, and the regulation will set customer due diligence, beneficial-ownership and reporting rules directly. Licensees should review their risk assessment and policies against it during 2026–2027.
A short 2026 checklist
- An enterprise-wide risk assessment updated in the last 12 months, covering each vertical you run.
- A named AML officer with real authority and a deputy.
- Customer due diligence rules that trigger on deposits, stakes and winnings, with enhanced checks for high-risk countries and politically exposed persons.
- Monitoring that flags clustered large winnings, rapid deposit-withdrawal cycles and shared payment instruments.
- Staff training records for every hire and every year.
- A written route and timetable for reports to ONPCSB.
If you need an AML manual, risk assessment or officer arrangement that ONJN will accept, see our compliance services or the Romania licensing guide.
