How Mutual Legal Assistance (MLA) Works in Romania (2026): Cross‑border Evidence, Asset Freezes & What Companies Must Do

Mutual legal assistance Romania procedures are now a front-line compliance concern for any company with operations, counterparties, or banking relationships touching the Romanian jurisdiction. As EU cross-border enforcement tools tightened through 2024 to 2026, faster European Investigation Orders, more aggressive asset-freezing protocols, and heightened scrutiny of data transfers, the window between being served with a foreign request and needing to act correctly has shortened dramatically. This guide explains, in operational terms, how mutual legal assistance Romania mechanisms function: who the executing authorities are, what documents you must prepare, the realistic timelines, the costs, and the exact steps to take in the first 48 hours when a foreign evidence request or asset freeze lands.

It is written for in-house counsel, CFOs, compliance officers, company directors, and the external counsel who advise them.

Quick take: your first 48 hours

Mutual legal assistance (MLA) is the formal process by which one country’s authorities ask another country’s authorities to gather evidence, take testimony, serve documents, trace proceeds, or freeze and confiscate assets for use in a criminal investigation or prosecution. When Romania receives such a request, whether as a European Investigation Order (EIO) from an EU member state, a traditional MLA request, or a letter rogatory from a third state, Romanian authorities execute it under Romanian procedural law. For a company, the request rarely arrives through diplomatic channels; it usually appears as a prosecutor’s order, a bank notification that an account has been blocked, or a demand for records.

What you do in the first hours determines whether you preserve your rights or forfeit them.

First 48-hour checklist (do these six things)

1. Identify the request type and issuing authority. Is it an EIO, a classic MLA request, a letter rogatory, or a domestic Romanian prosecutor’s order executing a foreign request?
2. Preserve everything. Suspend any routine data deletion, freeze relevant records, and document a chain of custody before anything is produced or altered.
3. Appoint a single point of contact (SPOC). One named in-house lead plus external Romanian counsel, no parallel, uncoordinated responses.
4. Treat any freezing order as binding, not advisory. Do not move, release, or set off funds subject to a freeze.
5. Quarantine privileged and personal data. Isolate legally privileged material and personal data pending a lawful disclosure analysis.
6. Engage Romanian counsel immediately. Confirm deadlines, jurisdiction, and whether grounds exist to challenge or narrow the request.

1. Overview: how MLA and cross-border criminal cooperation work in Romania

Romania operates within two overlapping frameworks. For requests originating in other EU member states, the dominant instrument is the European Investigation Order under Directive 2014/41/EU, which replaced much of traditional MLA between participating EU states with a system of mutual recognition. For requests from non-EU states, and for matters falling outside the EIO regime, the European Convention on Mutual Assistance in Criminal Matters (1959) and bilateral treaties provide the legal basis. Asset freezing and confiscation are shaped by Directive 2014/42/EU and, for cross-border recognition, by the EU Mutual Recognition of Freezing and Confiscation Orders Regulation, implemented into and applied alongside Romanian law.

Legal basis

The practical hierarchy for incoming requests is: (1) EIO Directive for EU members; (2) Council of Europe conventions and bilateral treaties for third states; (3) Romania’s domestic law on international judicial cooperation in criminal matters (Law No. 302/2004, as republished and amended), published through the Monitorul Oficial. The Romanian Code of Criminal Procedure (Law No. 135/2010, as amended) supplies the execution mechanics, searches, seizures, interviews, and provisional measures over property.

Key authorities

• Central authority. The Romanian Ministry of Justice acts as central authority for international judicial cooperation and, for many requests, receives and transmits requests, while in certain matters requests pass through the Prosecutor’s Office or directly between judicial authorities.
• Prosecutors. The Public Prosecutor’s Office attached to the High Court of Cassation and Justice (Parchetul de pe lângă Înalta Curte de Casaţie şi Justiţie) and specialised bodies such as the National Anticorruption Directorate (DNA) and the Directorate for Investigating Organised Crime and Terrorism (DIICOT) execute many requests, particularly in corruption and economic crime.
• Courts. Romanian courts authorise and supervise intrusive measures and hear challenges.
• Eurojust. For complex multi-state matters, Eurojust coordinates cooperation and helps resolve conflicts between competing requests.

2. Eligibility: when Romania will execute a foreign request

Not every foreign request is executed automatically. Romania assesses eligibility against the applicable instrument and its own constitutional and procedural limits. Under the EIO regime, the principle of mutual recognition narrows the available grounds for refusal substantially; under traditional MLA, the executing authority retains broader discretion. Understanding where your matter sits is the single most important early judgment, because it determines both the speed of execution and the arguments available to resist or narrow it.

Grounds for refusal and mandatory exclusions

Typical grounds for refusal include conflict with fundamental rights, public policy and sovereignty concerns, the political-offence exception, double jeopardy (ne bis in idem), and, in some categories, absence of dual criminality. The Council of Europe MLA Convention expressly permits refusal where execution would prejudice the sovereignty, security, or essential public interest of the requested state. Under the EIO Directive the grounds are more limited and must be interpreted restrictively, but they still exist, including proportionality and fundamental-rights safeguards.

Data protection and GDPR requests

Where a request seeks personal data, the disclosure must have a lawful basis and respect proportionality. Companies should not treat a foreign request as a blanket authorisation to export personal data. The correct approach is to confirm that the Romanian executing authority’s order provides the legal pathway for transfer, to limit production to what is strictly within scope, and to document the lawfulness of each disclosure. Over-production is a frequent and avoidable error.

When companies must notify and escalate internally

Internal escalation should be automatic. The moment a request, subpoena, bank block, or prosecutor’s order is received, it must reach the SPOC, the general counsel or head of legal, the CFO where assets are implicated, and the data protection function where personal data is involved. A documented escalation protocol prevents the single most damaging failure in mutual legal assistance Romania matters: a local manager responding informally before counsel has assessed the request.

3. Step-by-step: responding to an incoming request or executing an outgoing one

The following sequence is the operational core of any mutual legal assistance Romania response. Each step names the primary actor and the realistic time expectation. Treat the steps as parallel where possible, preservation cannot wait for document assembly to finish.

1. Step 1, Identify the request type and authority. Who: in-house counsel + external counsel. Determine whether you face an EIO, a classic MLA request, a letter rogatory, or a Romanian prosecutor’s order executing a foreign request. Record the issuing state, the issuing authority, the legal basis cited, the scope, and any stated deadline. Capture the file/reference number. This classification drives every later decision.
2. Step 2, Immediate preservation and asset-hold measures. Who: CFO + head of compliance + bank compliance. Suspend automated deletion of relevant data, ring-fence records, and, where a freeze is in play, confirm with the bank exactly which accounts and amounts are blocked. A short internal notice to the treasury and banking relationship team ensures no transaction is executed against frozen funds. Document the time and content of every preservation action.
3. Step 3, Assemble documents and appoint a SPOC. Who: in-house counsel / external counsel. Designate one point of contact who holds the authoritative version of the file, and begin assembling the required documents (see the table below). All external communication about the request routes through the SPOC to avoid inconsistent statements.
4. Step 4, Confirm jurisdiction and check for conflicting orders. Who: external counsel. Verify the request is validly addressed to Romania and that no parallel or conflicting order exists in another jurisdiction. Where competing requests arise, Eurojust coordination may be needed. Conflicting obligations, for example a foreign disclosure demand that would breach Romanian or EU law, must be surfaced immediately.
5. Step 5, Draft the response and coordinate with the executing authority. Who: external counsel / prosecutor contact. Depending on posture, the response may confirm compliance, request an extension, seek clarification of scope, or state grounds for partial or full refusal. Sample framings include: “The company confirms receipt and will produce responsive materials within the stated period, subject to a privilege review and lawful data-transfer analysis”; or “The company respectfully requests an extension of [X] days to complete a proportionate and lawful search”; or “The company raises the following ground for objection in respect of items [X], namely [legal basis].” All template wording is for guidance only, seek local counsel before use.
6. Step 6, If an asset freeze is in force: comply, then seek relief. Who: legal + CFO. Comply with the freezing order first; litigate second. A freezing order issued by a Romanian prosecutor or court is binding. Where the freeze is overbroad, mistaken, or causes disproportionate harm, file promptly for its variation or lifting within the statutory challenge window. Treating a freeze as negotiable is a serious error.
7. Step 7, Handle evidence surrender. Who: legal + IT + compliance. For electronic evidence, use forensically sound export methods, preserve metadata, apply agreed redactions, and maintain a documented chain of custody. For witness interviews, confirm the procedural format and whether counsel may attend. For physical documents, log every item transferred.
8. Step 8, Manage use of evidence and retention. Who: external counsel. Clarify how surrendered evidence may be used in later domestic proceedings, assert privilege where applicable, and set a defensible retention position for the materials produced and the records of the production itself.
9. Step 9, Appeal and remedies. Who: external counsel / domestic courts. Where grounds exist to challenge the execution, the measure, or the freeze, file within the statutory period. Missing the challenge window usually forecloses relief entirely.
10. Step 10, Post-execution compliance and recordkeeping. Who: compliance + legal. Close out the matter with a complete file: what was requested, what was produced, what was withheld and why, the legal bases relied on, and the chain-of-custody records. This file is your protection in any later dispute or audit.

Step / Who / Duration timeline (mutual legal assistance Romania)

4. Required documents

Assembling the right documents early prevents missed deadlines and weak objections. The table below lists the core documents, who provides each, and why it matters. Keep a master copy of everything the company retains, and never surrender an original without a documented copy.

5. Timeline and deadlines in mutual legal assistance Romania matters

Deadlines differ sharply between instruments, and this is where many companies lose ground. Under Directive 2014/41/EU, the executing authority must, as a rule, take the decision to recognise and execute an EIO and carry out the investigative measure within defined short periods, the Directive sets tight recognition and execution timeframes, with extensions available where justified. Traditional MLA under the Council of Europe framework and bilateral treaties typically moves more slowly, often over months, because it travels through central authorities rather than direct judicial channels.

Urgent provisional measures, most importantly asset freezes, operate on a different clock entirely. A Romanian prosecutor or court can order a freeze on an urgent basis to prevent dissipation of assets while the substantive request is processed. For your company this means two parallel timelines run at once: a fast preservation and freeze track, and a slower execution and litigation track. Plan for both. The challenge window to contest a measure is short and is unforgiving once it closes. Reconfirm every deadline with Romanian counsel against the specific order you have received, because the controlling period depends on the instrument and the type of measure.

6. Costs and fees

Many execution costs fall on the company rather than the requesting state, though the allocation of state-level costs varies by instrument. The figures below are indicative ranges to support budgeting only; actual costs depend on data volume, complexity, urgency, and counsel seniority, and should be confirmed with your providers.

7. What changes in 2026

The 2024–2026 period has reinforced the direction of travel across EU cross-border enforcement: faster cooperation, broader asset recovery, and closer scrutiny of data flows. For companies, the practical effect is less time to react and a higher expectation of readiness.

Faster timelines and administrative cooperation

Mutual recognition under the EIO framework continues to compress execution periods and to reduce the discretion available to resist well-formed EU requests. The practical effect is fewer opportunities to run out the clock and a greater premium on having preservation and response protocols already in place before a request arrives.

Increased judicial scrutiny on data protection and secrecy

Alongside faster execution, there is closer judicial attention to proportionality and to the lawfulness of personal-data transfers. Under Directive 2014/42/EU and the EU rules on mutual recognition of freezing and confiscation orders, freezing and confiscation standards push companies to respond quickly to provisional measures while still documenting a lawful basis for any disclosure. Banking secrecy no longer operates as a blanket shield where a valid cooperation instrument applies, but data-protection obligations remain live and must be respected item by item.

Practical implications for companies

The clearest early indication is that preservation obligations now effectively begin the moment a credible request or freeze is known, not when a response is formally due. Companies that wait to preserve, translate, or escalate are the ones that miss deadlines and forfeit challenge rights. Treat mutual legal assistance Romania readiness as a standing compliance capability, not an ad hoc project.

8. Common pitfalls

• Failing to preserve data immediately. Start a litigation hold the moment a request is known; suspend automated deletion before anything is lost.
• Delayed or missing translation. Commission certified Romanian translation at once, translation delay is a common cause of missed deadlines.
• No SPOC or weak internal escalation. Route everything through one named contact and a documented escalation protocol.
• Treating a freeze as advisory. A court- or prosecutor-ordered freeze is binding; comply first and seek relief through the proper channel.
• Producing privileged material without review. Quarantine and review for privilege before any disclosure; once produced, protection may be lost.
• Ignoring GDPR process on data transfer. Confirm the lawful basis and limit production to what is in scope; do not over-disclose personal data.
• No written chain of custody. Document every export, transfer, and redaction; gaps undermine both the evidence and your position.
• Missing the window for relief. Challenge periods are short; diarise and act within the statutory deadline or lose the remedy.

Comparison: MLA vs EIO vs rogatory letters vs Hague Evidence

The Hague Evidence Convention (1970) is included for completeness: it governs evidence in civil and commercial matters and is not an instrument for criminal asset freezes. For criminal cooperation inside the EU, the EIO is almost always the controlling route for evidence, while freezing and confiscation orders follow the EU mutual-recognition framework.

Next steps

Mutual legal assistance Romania matters reward preparation and punish delay. If your company has been served with a foreign evidence request, an EIO, or an asset freeze, or wants to be ready before one arrives, build your preservation, escalation, and response protocol now, and line up Romanian counsel in advance. Explore our Criminal practice, Romania page and use the GLE lawyer directory, Romania: Criminal counsel to find an experienced cross-border adviser.

This guide is for general information only and is not legal advice. Sample wording is provided for guidance only, seek local counsel before use. Last updated 2026-10-08.

Sources

1. Romanian Ministry of Justice
2. EUR-Lex, Directive 2014/41/EU (European Investigation Order)
3. EUR-Lex, Directive 2014/42/EU (Freezing and Confiscation)
4. Council of Europe, European Convention on Mutual Assistance in Criminal Matters (1959)
5. Eurojust
6. Baroul Bucureşti (Bucharest Bar Association)
7. National Anticorruption Directorate (DNA)
8. Monitorul Oficial (Romanian Official Gazette)
9. Hague Conference on Private International Law, 1970 Evidence Convention