IFN Licensing Romania: How to Register a Non-bank Financial Institution and Meet Ongoing Compliance

IFN licensing Romania is the gateway for any lender, fintech, leasing company or credit servicer that wants to operate a regulated non-bank lending business in one of Central and Eastern Europe’s most dynamic credit markets. In 2026, renewed regulatory scrutiny of lending and servicing models, combined with updated public registers and closer attention to outsourcing, data processing and collections, has made an accurate, procedural licensing roadmap more valuable than ever. This guide sets out, step by step, how a non-bank financial institution (Instituție financiară nebancară, or IFN) is authorised and registered with the National Bank of Romania, what capital and governance thresholds apply, and what ongoing compliance obligations follow authorisation.

It is written for founders, specialty lenders and investors assessing Romania market entry, and it flags where engaging local counsel materially reduces risk and delay.

TL;DR, the short version of IFN licensing Romania

An IFN is a non-deposit-taking lending vehicle supervised by the National Bank of Romania (Banca Națională a României, BNR). To operate legally you must incorporate a Romanian entity, meet minimum capital and governance requirements, pass fit-and-proper checks on management, and secure entry in the relevant BNR register. Consumer-facing lenders must also comply with consumer protection rules enforced by the National Authority for Consumer Protection (ANPC), and all IFNs must comply with GDPR under the oversight of the national data protection authority (ANSPDCP). A realistic timeline from a complete dossier to registration is typically several months, subject to the quality of documentation and the outcome of fit-and-proper assessments.

Below you will find the definitions, the regulatory map, a full application checklist, a comparison of IFNs against banks, and the ongoing reporting and compliance duties that define a well-run non-bank financial institution in Romania.

What is an IFN in Romania and who needs authorisation?

A non-bank financial institution (IFN) is an entity that carries on lending and related financial activities on a professional basis without taking deposits or other repayable funds from the public. That single distinction, the prohibition on deposit-taking, is the defining line between an IFN and a credit institution (a bank). Because it does not fund itself with public deposits, an IFN is subject to a proportionate, lending-focused supervisory regime rather than the full prudential architecture applied to banks.

Legal definition of an IFN

In Romanian law an IFN is a company established to grant credit and provide certain financial services, entered in a register maintained by the National Bank of Romania. The authorising and supervisory authority is the BNR, which sets the applicable norms, evaluates registrations and authorisations, and publishes its registers. The primary legislation and secondary legislation governing IFNs are published in the Official Gazette (Monitorul Oficial), which is the definitive source for the exact wording of the applicable rules and any amendments. Founders should verify the current, consolidated text of the applicable normative acts before relying on them.

Activities requiring IFN authorisation

Whether you need IFN authorisation depends on the activities you intend to carry out on a commercial, repeated basis. The activities most commonly associated with IFN status include:

• Consumer and commercial lending. Granting personal loans, instalment credit and other forms of credit.
• Credit intermediation. Acting as an intermediary in arranging credit.
• Leasing (financial leasing). Financing the acquisition and use of assets through leasing structures.
• Factoring. Purchasing and financing receivables.
• Granting guarantees and assuming commitments. Where carried on as a financial activity.

If your business model touches any of these on a professional scale, IFN licensing Romania will be relevant and, in most cases, mandatory. Note that debt collection and credit servicing of non-performing loans may fall under a separate authorisation regime for credit servicers, following the transposition of the EU Directive on credit servicers and credit purchasers (Directive (EU) 2021/2167); the correct classification should be confirmed with counsel. The precise scope of permissible activities is defined in the applicable legislation and confirmed at authorisation, so it is prudent to fix your target activities before drafting the application. Before committing to a route, review the relevant BNR register to confirm how comparable operators are classified.

Regulatory framework and competent authorities

IFN licensing Romania sits at the intersection of several regulatory pillars. Understanding which authority governs which obligation is essential, because a compliant IFN must satisfy all of them simultaneously rather than treating them as sequential.

• National Bank of Romania (BNR). The authority responsible for registering and authorising IFNs, assessing capital and governance, applying fit-and-proper tests to management, maintaining the registers, and conducting ongoing supervision.
• National Authority for Consumer Protection (ANPC). The enforcement body for consumer credit rules, including advertising standards and annual percentage rate (APR) disclosure obligations that apply to lending to individuals.
• National Supervisory Authority for Personal Data Processing (ANSPDCP). The data protection authority overseeing GDPR compliance, which is highly relevant for IFNs given the volume of sensitive credit and identity data they process.
• National Office for Prevention and Control of Money Laundering (ONPCSB). The financial intelligence unit to which reporting entities, including IFNs, submit suspicious-transaction and other AML reports.

Primary laws and regulations

The framework for IFNs is established in national primary legislation and detailed in secondary norms issued by the BNR. All of these are published in the Official Gazette (Monitorul Oficial), which should be consulted for the current, consolidated text. Because Romania is an EU member state, the domestic framework is also informed by European standards, for example, the European Banking Authority (EBA) issues guidelines on outsourcing and anti-money-laundering that shape supervisory expectations and are worth cross-referencing when designing controls. Founders should treat the BNR’s published norms and the Official Gazette as the authoritative starting points, and verify any specific normative act before relying on it.

How the BNR registers work

The BNR maintains registers of non-bank financial institutions. Registration or authorisation follows the successful conclusion of the applicable process, and any material change, such as a change of control, activity scope or management, must be reflected through the appropriate notifications. The registers serve two functions: they are the legal record of registered operators, and they are a public transparency tool that counterparties, investors and consumers can consult to verify that an entity is properly registered. Verifying your intended activities against the register early helps confirm that IFN status is the correct vehicle before you invest in a full application.

Step-by-step IFN authorisation process (application checklist)

The heart of IFN licensing Romania is a structured process before the BNR. The BNR expects a complete, internally consistent dossier that demonstrates a viable business, adequate capital, competent and honest management, and robust controls. The sequence below reflects the practical order in which most applicants proceed.

Pre-application checks

Before drafting anything, confirm three things: that your intended activities require IFN authorisation, that IFN status (rather than a bank licence or an EU passport) is the right vehicle, and that your shareholders and prospective managers can withstand fit-and-proper scrutiny. Early diligence here prevents the most common cause of delay, an application that is fundamentally misaligned with the chosen regulatory category. This is the natural moment to consider whether to engage counsel; see our guidance on When to hire a Banking & Finance lawyer in Romania (2026).

Incorporating the vehicle

An IFN operates through a Romanian legal entity, typically a joint-stock company or limited liability company depending on the intended scale and capital structure. Incorporation includes drafting the articles of association with an object of activity aligned to the planned financial services, appointing initial directors, and establishing a registered office. The corporate structure and the shareholding chain must be transparent, because the BNR assesses the suitability of qualifying shareholders as part of the process.

Preparing the application dossier

The dossier is where most of the effort, and most of the risk of rejection, lies. While the definitive list is set by the BNR, a well-prepared application generally includes:

• Business plan. A detailed plan covering the target market, product set, funding model, financial projections and break-even analysis.
• Articles of association and corporate documents. Constitutional documents and evidence of incorporation.
• Shareholder structure. Full ownership chain, identity of qualifying shareholders and their sources of funds.
• Proof of capital. Evidence that the minimum share capital has been subscribed and paid up.
• Governance and internal policies. Risk management, internal control and internal audit frameworks.
• AML/CFT procedures. Know-your-customer, transaction monitoring and reporting policies.
• Management CVs and fit-and-proper documentation. Evidence of the experience, reputation and integrity of directors and key function holders.
• IT and operational resilience. Description of systems, data security and business continuity arrangements.
• Auditor arrangements. Details of the appointed external auditor.

Every document should tell a consistent story: the business plan’s projections must match the capital raised, the governance framework must match the risk profile, and the management team must be credible for the activities proposed. Inconsistencies between these elements are a frequent trigger for requests for information that extend the timeline.

Capital and governance requirements

The applicant must demonstrate that it holds the minimum share capital applicable to its category of activity and that this capital is genuinely available. Capital requirements are calibrated to the type and scale of lending activity, so the amount depends on whether you are conducting consumer lending, leasing, factoring or a combination. The precise thresholds are set by the applicable BNR norms and should be confirmed against the current regulations. Alongside capital, the BNR examines the adequacy of internal governance, the composition of the management body, the presence of a compliance function, and the separation of risk and control responsibilities.

Fit-and-proper tests for management

Directors and key function holders undergo fit-and-proper assessment. The BNR evaluates professional experience relevant to financial services, personal reputation, absence of disqualifying convictions or regulatory sanctions, and sufficient time commitment to the role. Applicants should assume that management assessment can be a decisive factor: a strong business plan will not compensate for a management team that cannot satisfy the suitability criteria. Prepare detailed, verifiable CVs and be ready to respond to follow-up questions.

Application submission and fees

Once the dossier is complete, it is submitted to the BNR for review. The authority may request additional information or clarification during its assessment, and each such request effectively pauses the clock. Any official fees payable are set by the applicable regulations; applicants should confirm current amounts against the BNR’s published information before submission. Official fees are usually modest relative to the capital requirement and professional costs.

Typical timeline and appeals

From a complete dossier, a realistic timeline to registration is commonly several months, though this varies with the complexity of the structure and the responsiveness of the applicant to information requests. Incomplete submissions and unresolved fit-and-proper questions are the primary causes of delay. If an application is refused, the decision can be challenged through the applicable administrative and judicial channels; relevant jurisprudence on financial services matters can be located through the High Court of Cassation and Justice (Înalta Curte de Casație și Justiție, ÎCCJ). Building a realistic buffer into your launch plan is prudent, because the difference between a smooth IFN licensing Romania process and a protracted one usually comes down to dossier quality.

Minimum prudential and governance requirements

Registration is not a one-off hurdle; it establishes the baseline that the institution must maintain throughout its life. The prudential and governance requirements underpinning IFN licensing Romania continue to apply after registration and are tested during supervision.

Management and fit-and-proper

The suitability of management is an ongoing obligation. Changes to the management body, and the appointment of new directors or key function holders, must satisfy the same fit-and-proper standards applied at the outset and be notified as required. Institutions should maintain up-to-date records evidencing the suitability of each individual, including any subsequent developments that could affect reputation or availability.

Governance, risk management and internal audit

An IFN must operate a governance framework proportionate to its size and risk profile. In practice this means:

• A functioning management body. With clear allocation of responsibilities and adequate oversight of the business.
• A compliance function. Responsible for monitoring adherence to regulatory obligations, including consumer protection and AML rules.
• Risk management. Identification, measurement and control of credit, operational and other material risks.
• Internal audit. Independent review of the effectiveness of controls.
• AML/CFT systems. Ongoing customer due diligence, monitoring and suspicious-activity reporting.

Capital adequacy and solvency must be maintained on a continuous basis, not merely demonstrated at the point of registration. The BNR expects institutions to hold capital commensurate with the scale and risk of their lending, and to be able to evidence this through periodic reporting.

IFN vs Credit Institution, comparison and which vehicle suits your model

Choosing between an IFN and a full credit institution (bank) licence is one of the most consequential decisions in Romania market entry. The table below summarises the core differences to help founders match the vehicle to the business model.

For most fintechs and specialty lenders that intend to originate credit without funding themselves through public deposits, the IFN route is the natural fit: lower capital, a proportionate supervisory burden and a faster path to market. A banking licence becomes relevant only where deposit-taking or direct payment-system access is central to the business. If cross-border activity is contemplated, EU passporting or branch establishment may offer an alternative to a local IFN, and this should be assessed against the commercial plan before committing.

Ongoing compliance after registration

Registration marks the beginning of a continuous compliance relationship with the regulators. A sustainable IFN treats compliance as an operating discipline rather than a launch formality.

Periodic reporting to the BNR

IFNs must submit periodic regulatory returns to the BNR covering financial position, capital, lending activity and risk metrics. Reporting frequency and format are set by the BNR’s norms, and timely, accurate submission is a supervisory expectation in its own right. Late or inaccurate returns attract regulatory attention and can escalate into enforcement. Institutions should build reporting into their systems from day one rather than retrofitting it.

Consumer protection and interest rate disclosure

Where an IFN lends to consumers, ANPC enforces the consumer credit framework, including transparency of contractual terms, advertising standards and the disclosure of the annual percentage rate (APR). Marketing materials, pre-contractual information and loan agreements must all meet these requirements. Because consumer lending is heavily scrutinised, disclosure and advertising compliance should be reviewed by counsel before products go live, and refreshed whenever pricing or terms change.

Audit and accounting

An IFN must maintain proper accounting records and, where required, appoint an external auditor. Annual financial statements and the auditor’s work feed into both statutory reporting and the BNR’s supervisory assessment. Robust accounting discipline is not merely a statutory obligation, it is the evidentiary backbone that demonstrates continued solvency and governance quality to the regulator.

Outsourcing, data processing and collections, practical rules for IFN licensing Romania compliance

Many operational risks in the IFN sector cluster around outsourcing and data. Collections, servicing, IT hosting and analytics are commonly outsourced, and each arrangement raises overlapping obligations under professional secrecy, GDPR and supervisory expectations. This is one of the areas where post-registration compliance most often goes wrong, so it deserves early attention as part of any IFN licensing Romania project.

Key contract clauses

Contracts with servicers, collection agencies and technology providers should address:

• Data protection. Clear controller/processor roles, GDPR-compliant processing terms and security obligations, consistent with ANSPDCP expectations.
• Confidentiality and professional secrecy. Protection of customer information handled by third parties.
• Audit and access rights. The ability of the IFN, and, where relevant, the supervisor, to review the provider’s performance.
• Sub-processing controls. Restrictions on onward delegation, particularly for cross-border and cloud arrangements.
• Service levels and exit. Continuity, termination and data-return provisions to avoid operational disruption.

EU-level guidance from the European Banking Authority on outsourcing informs supervisory expectations and provides a useful benchmark when designing these arrangements, even where the institution is an IFN rather than a bank.

Supervision and notifications

Material outsourcing, especially of core or sensitive functions, may need to be documented and, in some cases, notified. Cross-border outsourcing and the use of cloud processors raise additional questions about data location and access by authorities. An IFN should keep a register of its outsourcing arrangements, assess criticality, and ensure it retains ultimate responsibility and control over outsourced functions. Regulators expect that outsourcing never dilutes the institution’s accountability to customers or supervisors.

Enforcement, sanctions and contingencies

The consequences of non-compliance range from administrative measures to the loss of registration. The BNR can impose supervisory measures and sanctions for prudential and governance failings, and ANPC can act on consumer protection breaches, including advertising and APR disclosure failures. Sanctions may include administrative fines, corrective orders, and, in serious cases, measures affecting the entity’s ability to operate, including removal from the register. Data protection breaches carry separate exposure under GDPR through the ANSPDCP.

Every IFN should maintain a contingency and crisis-management capability: a documented plan for responding to supervisory findings, remediating deficiencies quickly, and communicating with regulators. Where enforcement escalates to litigation, the reasoning in decisions of the courts, including the High Court of Cassation and Justice, provides guidance on how licensing and enforcement disputes are resolved. Proactive remediation is almost always less costly than contesting a sanction after the fact.

Practical timeline, costs and where to get help

A realistic end-to-end plan for IFN licensing Romania runs from incorporation and dossier preparation through submission, regulatory review and registration, commonly several months once a complete dossier is filed, plus preparation time before submission. Cost drivers are the minimum capital requirement (the largest single item), official fees set by the applicable regulations, and professional fees for legal, accounting and advisory support. Professional fees vary with the complexity of the shareholding structure, the activity mix and the amount of bespoke policy drafting required. Engaging experienced counsel early, to test the chosen vehicle, structure the dossier and manage fit-and-proper preparation, typically shortens the timeline and reduces the risk of refusal.

For a view on when specialist support adds the most value, see When to hire a Banking & Finance lawyer in Romania (2026).

Key takeaways and quick checklist

• Confirm your activities require IFN authorisation and that IFN status is the right vehicle.
• Incorporate a Romanian entity with a transparent shareholding chain and an aligned object of activity.
• Meet the minimum capital applicable to your activity category and evidence that it is paid up.
• Build a consistent dossier: business plan, governance, AML/CFT, IT resilience, management CVs and auditor.
• Prepare management for fit-and-proper assessment with verifiable, detailed documentation.
• Plan for several months from a complete dossier to registration, plus preparation time.
• Establish periodic BNR reporting, consumer protection and APR disclosure processes, and audit arrangements before launch.
• Get outsourcing, data processing and collections contracts right under GDPR and professional secrecy rules.
• Maintain capital, governance and compliance continuously, registration is a baseline, not a finish line.

Conclusion and next steps

IFN licensing Romania rewards preparation. The path from concept to a registered non-bank financial institution is well defined, but it turns on the quality of the application dossier, the suitability of management, and a governance and compliance framework that will withstand ongoing supervision. Founders, fintechs and specialty lenders who treat capital, governance, consumer protection and data compliance as integrated design choices, rather than sequential hurdles, move faster and operate more safely. To progress an application, structure a compliant dossier, or review your outsourcing and consumer-lending arrangements, connect with the Global Law Experts network for Romania banking and finance advisory and explore our related guidance on prudential reporting and outsourcing for IFNs.

Sources

1. National Bank of Romania (BNR)
2. Monitorul Oficial (Romanian Official Gazette)
3. National Authority for Consumer Protection (ANPC)
4. National Supervisory Authority for Personal Data Processing (ANSPDCP)
5. European Banking Authority (EBA)
6. High Court of Cassation and Justice (ÎCCJ)
7. Bucharest Bar Association (Baroul București)