White‑collar Investigations in Romania (2026): Types of Probes, How They Differ and What Executives Must Do

White-collar investigations Romania has become one of the most pressing concerns for boards, general counsel and senior executives heading into 2026, as prosecutorial reorganisations and heightened EU enforcement expectations reshape how corporate misconduct is detected, investigated and prosecuted. Unlike a decade ago, when a single anticorruption headline dominated the landscape, today’s executive faces a fragmented map of investigative bodies, each with its own remit, powers and tactical playbook. The stakes are personal as well as corporate: preventive arrest, asset seizure, reputational collapse and cross‑border freezing orders can all arrive within hours of a probe opening.

This guide takes a clear position on who investigates what, how those probes differ, and, critically, what you must decide in the first 72 hours and across the lifecycle of a case.

For readers weighing whether they already need counsel on retainer, the companion Criminal Lawyer Romania, When to Hire (checklist) pairs directly with this pillar and sets out the hiring triggers referenced throughout.

Quick overview: what counts as “white‑collar” in Romania and why it matters in 2026

In the Romanian context, “white‑collar” is not a statutory category but a working label for financially motivated, non‑violent offences committed in a business setting. The core clusters are corruption and bribery, commercial and investment fraud, money laundering, market abuse, and regulatory or administrative offences that can escalate into criminal cases. Overlaying these are internal (corporate) investigations, the fact‑finding a company runs itself, which sit in a very different legal posture from a state‑led criminal probe.

What makes 2026 distinctive is institutional flux. The Ministry of Justice (just. ro) has continued to publish reforms affecting how prosecutorial structures handle sensitive cases, and any change to investigator remit is recorded in the official legislation portal (legislatie. just. ro). Where a formal reorganisation act exists, executives should treat it as binding; where change is only announced, treat it as a reported reorganisation and confirm the current position before relying on it. The practical effect of this flux is uncertainty over which body will front a given case, which is precisely why understanding remit is now a survival skill, not a legal nicety.

Corruption, large‑scale fraud and money laundering remain the highest‑profile white‑collar offences in Romania, and they are also the categories most likely to trigger cross‑border cooperation.

Who investigates: remit and powers in white‑collar investigations Romania (comparison)

The single most important thing an executive can establish in the opening hours of a case is which authority is driving it. The lead body determines the applicable powers, the likely tempo, the appetite for cooperation, and whether European coordination is in play. The table below is the centrepiece of this guide. Use it to orient yourself fast, then read the procedural notes that follow.

Procedural notes: who can open a case, search, seize and intercept

Under Romanian criminal procedure, the prosecutor leads the pre‑trial phase and the judicial police act under that supervision. Key coercive measures, searches of premises, interception of communications and preventive (freezing) seizure of assets, generally require judicial authorisation, and the exact competence and thresholds are set out in the Criminal Procedure Code available through the official legislation portal (legislatie.just.ro). Preventive measures affecting individuals, including proposals for arrest, sit at the most serious end of the scale and are decided by a judge of rights and liberties. For executives, the operational takeaway is simple: when officers arrive, the authorising judicial documents define the lawful scope of what can be searched and seized, and that scope is your first line of defence.

DIICOT vs DNA: the remit distinction that matters most

The DIICOT vs DNA question is the one executives ask most, and the answer is decisive for strategy. DNA is the specialised anticorruption directorate: bribery, corruption and certain abuse-of-office offences are its home turf, with a strong focus on individual culpability and documentary proof of illicit payments. DIICOT owns organised and serious economic crime, sprawling frauds, cyber‑enabled schemes and complex laundering typologies, frequently multi‑defendant and cross‑border. If your matter is fundamentally about a payment made to obtain an advantage, think DNA. If it is about an organised scheme, scale, or a criminal network, think DIICOT. Getting this classification right early shapes everything from which cooperation framework applies to how aggressively you should anticipate coordinated raids.

Typical investigative paths by offence: fraud, bribery, AML and regulatory

Different offences travel through the system along different routes. Recognising the likely path lets you predict the next move and prepare the right defence posture. The examples below reflect common patterns across banking, finance, IT and construction.

Bribery and anticorruption, a bribery probe Romania executives should expect DNA to lead

A bribery probe Romania typically originates from a complaint, a denunciation, or a referral, and is led by DNA where the conduct falls within its anticorruption remit (pna.ro). In construction and public‑contract settings, the classic fact pattern involves payments or benefits linked to tender outcomes; in banking and finance, it can involve improper influence over lending or licensing decisions. DNA investigations tend to be document‑ and communications‑heavy, which is why immediate preservation of email, messaging and payment records is essential. Self‑reporting and cooperation can matter here, but only where the company can demonstrate genuine, timely remediation.

Fraud and large commercial fraud, DIICOT and economic crime structures

Large commercial fraud, investment schemes, procurement fraud, VAT carousels, frequently falls to DIICOT (diicot.ro) or to general prosecutors supported by the police economic crime structures. In the IT sector, cyber‑enabled fraud and misappropriation cases are common, and these often involve multiple jurisdictions and cloud‑hosted evidence. Expect coordinated, multi‑site action and a strong emphasis on tracing the flow of funds.

Money laundering investigation Romania, ONPCSB plus prosecutors

A money laundering investigation Romania often begins upstream, when a regulated entity files a suspicious transaction report with the FIU (onpcsb.ro). The FIU analyses the report and, where warranted, refers it to prosecutors, meaning an STR can be an early visible signal that a criminal path may open. In banking and finance, this is the moment for in‑house teams to review exposure, not to assume the matter will resolve quietly. Laundering charges also travel well across borders and can draw EU cooperation.

Regulatory and administrative inspections, how admin cases become criminal

Regulatory inspections by sector supervisors such as ASF (asfromania.ro) or a fiscal audit by ANAF can begin as administrative processes and then convert into criminal referrals when inspectors identify suspected offences. This is one of the most under‑appreciated risks in corporate investigations Romania: executives relax during an “administrative” inquiry and make disclosures that later feed a criminal file. Treat any regulator or tax inquiry as a potential precursor to a criminal probe and manage disclosures accordingly.

Immediate executive actions: the 0–72 hour checklist

The first 72 hours determine the trajectory of a case. Decisions made, or missed, in this window are difficult to reverse. Take a clear position: move fast, control communications, and preserve evidence lawfully. Here is the sequence.

• Secure specialist counsel immediately. Engage white‑collar defence counsel before anyone speaks to investigators. If in doubt about triggers, use the Criminal Lawyer Romania, When to Hire (checklist).
• Appoint a single internal response lead. One accountable person (usually the GC) coordinates counsel, IT, communications and the board to avoid conflicting actions.
• Issue a legal hold and preserve evidence. Suspend routine deletion and preserve email, messaging, accounting and access logs. Sample wording: “Effective immediately, all employees must preserve and must not delete, alter or move any documents, emails, messages or electronic data relating to [matter]. Automatic deletion is suspended until further notice.”
• Restrict and script internal communications. Instruct staff not to discuss the matter internally or externally. Sample containment script: “We are aware of an inquiry and are cooperating appropriately with counsel. Please do not discuss this matter and refer any questions to [response lead].”
• Notify the board and calibrate disclosure obligations. Brief the board on facts known, risks and immediate steps; assess any listing, regulatory or lender notification duties.
• Prepare a crisis communications position. Draft holding lines with counsel; avoid public statements that could be treated as admissions or that prejudice the defence.
• Serve preservation notices on cloud and third‑party providers. Where data sits with providers, issue voluntary preservation notices to prevent routine deletion pending lawful production.

Dawn raid response: a stepwise plan

A dawn raid response must be rehearsed, not improvised. When investigators arrive:

1. Call counsel immediately and ask investigators to await their arrival where lawful.
2. Ask to see and record the authorising judicial documents and note the stated scope.
3. Assign an employee to accompany each officer, taking a contemporaneous log of what is examined and seized.
4. Do not obstruct, conceal or delete anything, obstruction dramatically worsens exposure.
5. Keep an inventory of every item and device seized and request copies of seizure records.
6. Instruct staff to remain calm, be polite, and answer only identity questions; substantive questions await counsel.
7. Segregate and flag potentially privileged materials to counsel rather than volunteering them.

Mid‑investigation decisions: cooperation, self‑reporting and settlement, an executive defence strategy

Once the immediate crisis is contained, the central strategic choice emerges: fight, cooperate, or self‑report. This is where a coherent executive defence strategy earns its keep. Romanian prosecutors act independently, and the availability of negotiated or mitigated outcomes depends on the offence, the evidence and the credibility of the company’s remediation. Below is a decision framework, take the position that fits your facts rather than hedging.

Decision framework: which posture to choose

• Choose immediate aggressive containment when there is evidence of an imminent search or dawn raid, when executives are named in a warrant or summons, or when cross‑border asset freezing is imminent. Priority: counsel on site, communications restricted, evidence preserved lawfully.
• Choose early cooperation or voluntary disclosure when the company can demonstrate timely internal remediation, limited or low‑level culpability, and clear mitigation, and where the prosecuting authority has an established framework for cooperation. Priority: build a credible, documented remediation narrative before approaching prosecutors.
• Choose defensive litigation first when the evidence against you is weak, the investigating authority’s competence is questionable, and privilege can be maintained, or where disclosure would create broader third‑party civil exposure. Priority: challenge scope and competence, and resist premature disclosure.

In practice the sequence is: implement immediate steps, assess remit (using the comparison table above), choose your posture, then implement protections. The posture is not permanent, it should be revisited as evidence and prosecutorial signals develop.

Weighing voluntary disclosure against waiting

Voluntary disclosure can generate mitigation and demonstrate good faith, but it also hands prosecutors a roadmap and can trigger obligations that are hard to walk back. Waiting preserves optionality but risks the appearance of concealment if the conduct later surfaces. The deciding factors are the strength of the evidence prosecutors already hold, the quality of your remediation, the level of culpability, and whether an established cooperation framework offers a realistic benefit. Where the company has already remediated and culpability is contained, disclosure usually pays. Where the evidence is thin and remediation incomplete, waiting while you build the record is often the stronger play.

Managing privileged materials and the limits of internal investigation privilege

Executives frequently overestimate how much protection an internal investigation report attracts. In Romania, lawyer professional secrecy exists under the Law on the organisation and exercise of the lawyer’s profession and the profession’s statute, the Bucharest Bar Association applies the ethical framework (baroul-bucuresti.ro), but the scope of protection for internal investigation work product is narrower than executives assume, and its limits should be confirmed with counsel before any report is created. Structure internal investigations through counsel from the outset, label materials carefully, and assume that documents generated without legal structuring may not be protected. When in doubt, treat sensitive analysis as potentially disclosable and manage it accordingly.

Handling resignations, auditors and board disclosures

Mid‑investigation personnel decisions carry legal weight. Executive resignations can be read as evidence of culpability or, conversely, as governance in action, sequence and document them carefully with counsel. External auditors may need to be involved where financial statements are affected, but disclosures to auditors are rarely privileged, so calibrate them. Board disclosures should be accurate, contemporaneous and minuted, because the board’s response itself becomes part of the corporate mitigation narrative.

Asset risk and protective measures

Asset seizure risk is one of the most immediate and damaging consequences of a white‑collar probe. Romanian prosecutors can apply preventive (freezing) seizure over company and, in appropriate cases, personal assets to secure eventual confiscation or damages, subject to the thresholds and procedures in the Criminal Procedure Code (legislatie.just.ro). Interim measures can be imposed early in a case, and civil claimants may pursue parallel recovery. Once a probe is underway, the scope for pre‑emptively rearranging personal assets is limited and attempts to do so can themselves become evidence of concealment.

The realistic protective steps are legal, not evasive: understand exactly what has been seized and on what authority; challenge seizure orders where the legal basis, scope or proportionality is defective; and ensure that legitimate operating assets are distinguished from assets alleged to be tainted, so that the business can continue functioning. Asset tracing works in both directions, prosecutors trace the proceeds, and a well‑prepared defence traces the lawful origin of the assets in question. Move early with counsel to contest overbroad freezing before it hardens.

Cross‑border coordination and evidence preservation

Modern white‑collar investigations Romania rarely stay within one border. Evidence sits in overseas data centres, counterparties are foreign, and funds move through multiple jurisdictions. Cross‑border cooperation runs through mutual legal assistance channels and, within the EU, through instruments such as the European Investigation Order and, where the EU’s financial interests are engaged, the EPPO (eppo.europa.eu). EPPO involvement can streamline cross‑border evidence gathering and coordination between participating member states, which means cases touching EU funds can move faster than purely domestic ones.

For executives, the practical priorities are timing and preservation. Data can be deleted on routine retention cycles before a formal request is ever served, so issue voluntary preservation notices to cloud and third‑party providers early. Sample wording: “We request that you preserve, and refrain from deleting or altering, all data and records associated with [account/identifiers] pending a formal legal request. Please confirm the preservation and the retention period applied.” Common pitfalls include assuming a domestic legal hold reaches foreign‑hosted data, underestimating the time formal requests take, and failing to coordinate preservation across group entities. The detailed mechanics are covered in the companion pillar on cross‑border evidence and mutual legal assistance.

Practical templates and checklists

To operationalise the guidance above, use the practitioner templates that accompany this pillar: a 72‑hour executive response checklist, a sample data preservation notice, a dawn‑raid one‑page quick card, and a board memo template. To request the downloadable 72‑hour checklist or a tailored defence briefing, contact Global Law Experts. For related tactical guidance, see the cluster articles on dawn raids, cross‑border evidence, protecting executives’ personal assets, and negotiating cooperation.

Conclusion and next steps

White-collar investigations Romania in 2026 demand that executives and boards act on facts, not instinct: identify the lead authority, understand its powers, lock down the first 72 hours, and choose a defence posture that matches the evidence. The bodies differ sharply, DNA on corruption, DIICOT on organised economic crime, the FIU as an early‑warning channel for laundering, and regulators whose administrative inquiries can convert into criminal files, and that difference should drive every decision you make. Take a clear position early, preserve evidence lawfully, protect against overbroad asset seizure, and revisit your posture as the case develops.

If you are facing an allegation or an imminent probe, contact Global Law Experts to request a defence briefing, and pair this guide with the Criminal Lawyer Romania, When to Hire (checklist) to confirm whether it is time to bring counsel on board.

Sources

1. Direcția Națională Anticorupție (DNA)
2. Direcția de Investigare a Infracțiunilor de Criminalitate Organizată și Terorism (DIICOT)
3. Oficiul Național de Prevenire și Combatere a Spălării Banilor (ONPCSB)
4. Ministerul Justiției (Ministry of Justice, Romania)
5. Legislație (Romanian official legislation portal)
6. European Public Prosecutor’s Office (EPPO)
7. Autoritatea de Supraveghere Financiară (ASF)
8. Baroul București (Bucharest Bar Association)