How to Obtain Mica CASP Authorisation in Romania Step‑by‑step

With the EU’s Markets in Crypto‑Assets Regulation (MiCA) now fully applicable and Romania’s implementing measures in force, the window for obtaining a MiCA CASP Romania authorisation is both open and urgent. Romania designated the Autoritatea de Supraveghere Financiară (ASF) as the competent authority for non‑bank crypto‑asset service providers through Government Emergency Ordinance (OUG) 10/2025, published in Monitorul Oficial on 13 March 2025. Meanwhile, the MiCA transitional grandfathering period ends on 1 July 2026 creating a hard compliance cliff for legacy providers across the EU.

This guide gives founders, compliance officers and advisers a complete, Romania‑specific roadmap: every application step, required documents, capital thresholds, realistic timelines, fee estimates, and the EU passporting rights that follow authorisation.

At a Glance

• Expected total timeline: 6–12 months (preparation through to ASF decision).
• Initial capital range: EUR 50,000–150,000 depending on CASP services (MiCA Article 67).
• Key application steps: readiness assessment → file assembly → ASF submission → review → authorisation → ESMA notification.
• Passporting: once authorised, notify ESMA and host‑state NCAs to serve clients across the entire EU/EEA.

Quick Facts MiCA CASP Romania

• EU legal basis: Regulation (EU) 2023/1114 (MiCA).
• Romanian implementing measure: OUG 10/2025, Monitorul Oficial nr. 225, 13 March 2025.
• Competent authority (non‑bank CASPs): ASF Autoritatea de Supraveghere Financiară.
• Grandfathering backstop: 1 July 2026 (ESMA guidance).
• Passporting: EU/EEA‑wide via MiCA notification procedure.
• Market advantage: Romania offers competitive incorporation and operational costs relative to several Western European routes.

Who Supervises CASPs in Romania?

Romania follows a dual‑authority model for MiCA supervision. Industry legal guides confirm that competences are allocated as follows:

• ASF (Autoritatea de Supraveghere Financiară): the competent authority for non‑bank CASPs. ASF receives, reviews and decides on CASP authorisation applications and conducts ongoing prudential and conduct supervision.
• BNR (Banca Națională a României): retains supervisory responsibility over credit institutions offering crypto‑asset services and over electronic money token (EMT) issuers where banking licences are involved.

Applicants should verify the latest contact details and submission procedures directly with ASF. The ASF’s published communications on MiCA implementation outline supervisory priorities and registration expectations. Checking the ASF public register for authorised CASPs is advisable before filing, both to confirm the authority is processing applications and to benchmark the competitive landscape.

Step‑by‑Step Application Process for CASP Authorisation in Romania

The following numbered steps map the practical journey from initial feasibility to full MiCA CASP authorisation through ASF. Each step includes document pointers and tips drawn from the MiCA text and Commission‑level delegated and implementing acts. Applicants are advised to download a comprehensive application checklist Preparing your Romanian MiCA CASP application: document checklist & governance matrix to track progress against every requirement.

Step 1 Pre‑Application Readiness Check

Before engaging ASF, assess your organisation’s baseline readiness across governance, AML/CFT, IT security and prudential resources. Key deliverables at this stage include:

• Governance mapping: identify proposed board members, senior managers and qualifying shareholders; confirm fit‑and‑proper status.
• AML/CFT framework: verify compliance with Romania’s AML legislation (Law 129/2019 as amended by OUG 10/2025) and appoint a local AML Reporting Officer.
• DORA self‑assessment: evaluate ICT resilience against the Digital Operational Resilience Act requirements DORA & ICT operational resilience for CASPs provides further guidance.

Step 2 Technical / IT Security Pre‑Clearance

Romania has signalled practical expectations for ICT readiness, including penetration testing and incident‑response simulation. Prepare:

• Independent penetration test report from an accredited provider.
• ICT risk management policy aligned with DORA and any ASF-specific guidance.
• Business continuity and disaster recovery plans.

Step 3 Drafting and Assembling the Application File

The core of any MiCA CASP Romania application is a comprehensive dossier. MiCA Article 62 and associated regulatory technical standards (RTS) require:

• Detailed business plan covering target markets, projected volumes, revenue model and marketing strategy.
• Organisational chart and governance matrix (roles, reporting lines, internal‑control functions).
• Policies: conflicts of interest, complaints handling, outsourcing, custody and safeguarding of client assets.
• AML/CFT programme: customer due diligence procedures, transaction monitoring, suspicious activity reporting protocols.
• Risk assessment: comprehensive risk register covering operational, financial, legal and reputational risks.
• Outsourcing contracts: details of any critical or important functions delegated to third parties.

Step 4 Capital Proof and Prudential Documentation

Provide evidence of initial capital that meets the MiCA thresholds for the specific CASP services sought (see Key Requirements below). Documentation typically includes:

• Audited financial statements or pro‑forma balance sheets.
• Bank confirmation letters or guarantees.
• Professional indemnity insurance certificate (if opting for the insurance alternative under MiCA).

Step 5 Submission to ASF

File the complete application with ASF. Practical submission guidance:

• Language: Romanian is expected for all formal submissions; certain annexes may be submitted in English with certified Romanian translations.
• Format: confirm with ASF whether electronic filing is accepted or whether hard copies must be submitted to ASF headquarters in Bucharest.
• Fees: pay any applicable ASF administration fees at submission (see Timeline & Costs section below).

Step 6 Post‑Submission: Review, Queries and Remediation

ASF will assess the application within the statutory review window (up to 25 working days for completeness plus an additional assessment period). Expect:

• Information requests: ASF may issue supplementary queries respond promptly to avoid timeline extensions.
• Interviews: fit‑and‑proper assessments may include interviews with proposed senior management.
• Communications discipline: avoid public announcements of authorisation status until ASF issues a formal decision.

Step 7 Post‑Authorisation: Ongoing Obligations and Passporting

Once authorised, the CASP must:

• Maintain continuous compliance with prudential, conduct and reporting obligations.
• Submit periodic supervisory reports to ASF and pay any monthly supervisory fees.
• Notify ESMA and host‑state national competent authorities to passport services across the EU/EEA.

Practical tips: pre‑engage with ASF informally before filing, appoint a local compliance officer with Romanian regulatory experience, and prepare dual English–Romanian documentation sets from the outset. Templates for the governance matrix, application checklist and sample business plan structure are available as downloadable resources.

Comparison: Romania vs Other Common MiCA Routes

The table below offers an indicative comparison of Romania against other jurisdictions frequently considered for MiCA CASP authorisation. All figures are market estimates applicants should confirm with the relevant competent authority.

Romania’s combination of competitive operating costs, ASF’s streamlined competence allocation, and EU‑wide passporting rights makes it an attractive option for firms seeking a Romania crypto licence as their EU base.

Key Requirements and Eligibility for a Romanian CASP Authorisation

Capital and Prudential Thresholds

MiCA Article 67 sets minimum own‑funds requirements for CASPs, calibrated by service type:

• EUR 50,000 for providers offering advice on crypto‑assets or portfolio management of crypto‑assets.
• EUR 125,000 for providers operating a trading platform, exchange services, or executing orders on behalf of clients.
• EUR 150,000 for CASPs providing custody and administration of crypto‑assets on behalf of clients.

Applicants must maintain own funds equal to the higher of (a) the minimum amount above or (b) one quarter of the preceding year’s fixed overheads. Romania may adopt additional prudential expectations through ASF secondary rules.

Governance and Fit‑and‑Proper Tests

Board members and senior managers must demonstrate competence, integrity and the absence of criminal convictions relevant to financial services. ASF will assess the collective suitability of the management body, including expertise in crypto‑asset markets, risk management and AML/CFT compliance. A local decision‑making presence is expected.

AML/CFT Registration

OUG 10/2025 introduced amendments to Romania’s AML legislation (Law 129/2019), extending obligations to MiCA‑authorised CASPs. Firms must register with the national AML authority, implement transaction monitoring, conduct enhanced due diligence on high‑risk clients, and file suspicious transaction reports. Further detail is available in Romania AML changes (OUG 10/2025) explained.

ICT Resilience and DORA

CASPs must comply with the Digital Operational Resilience Act (DORA) for ICT risk management, incident reporting, and threat‑led penetration testing. ASF may require evidence of independent penetration testing before authorisation.

Client Asset Segregation and Custody

MiCA mandates strict segregation of client assets from the CASP’s proprietary assets, with detailed custody arrangements, safeguarding policies and insolvency‑remote structures. Banking & custody partners for Romanian CASPs covers the practical steps for securing compliant banking and custody solutions.

Timeline, Costs and Fee Estimates

Realistic Timeline Bands

• Preparation phase: 1–3 months (governance setup, document drafting, IT audit, AML programme build‑out).
• ASF formal review: 4–9 months from submission of a complete application (statutory assessment periods plus any supplementary information cycles).
• Total time to market: 6–12 months from project kick‑off to authorisation decision.

Cost Estimates (EUR)

• Application preparation (legal, compliance, audit advisory): EUR 40,000–120,000.
• Initial capital requirement: EUR 50,000–150,000+ (depending on services see above).
• ASF administrative / registration fees: applicants should confirm the current fee schedule directly with ASF. Market guides report a 0.5 % monthly supervisory fee on operating revenue as a locally introduced measure verify before budgeting.
• Ancillary costs: IT penetration testing (EUR 5,000–20,000), AML technology solutions, audit readiness, bank onboarding fees and certified translation costs.

Total first‑year project budgets for a mid‑complexity CASP authorisation in Romania typically range from EUR 150,000 to EUR 350,000 inclusive of capital, professional fees and operational setup significantly below the cost benchmarks reported in certain Western European jurisdictions.

EU Passporting Implications

One of the most compelling advantages of a MiCA CASP Romania authorisation is the ability to passport services across all 27 EU Member States and the EEA. Under MiCA Articles 65 and 66, an authorised CASP may provide its regulated services in host Member States by submitting a notification to ASF. ASF then communicates the notification to the host‑state competent authority and to ESMA.

The passporting procedure typically follows these steps:

1. The CASP submits a notification to ASF specifying the host Member State(s) and the services to be offered.
2. ASF transmits the notification to the host‑state NCA and ESMA within the prescribed period.
3. The CASP may commence cross‑border services upon completion of the notification timeline.

Practical limits: host‑state authorities retain certain supervisory powers, and CASPs must maintain continuous compliance in both home and host jurisdictions. Language requirements for client‑facing documentation may vary by host state. MiCA vs VASP: transitional rules explains how legacy VASP registrations interact with MiCA passporting entitlements during the transition.

Common Application Pitfalls and Risk Register

Applicants frequently encounter delays or rejections due to recurring weaknesses. The most common pitfalls include:

• Insufficient governance documentation: inadequate fit‑and‑proper evidence or unclear reporting lines.
• Weak AML policies: generic policies not tailored to crypto‑asset risk typologies or Romanian regulatory expectations.
• Incomplete IT security evidence: missing or outdated penetration test reports, lack of DORA alignment.
• Poor outsourcing contracts: critical functions delegated without adequate supervisory controls or exit strategies.
• Client asset segregation gaps: failure to demonstrate insolvency‑remote structures or independent custody arrangements.
• Bank account and custody onboarding delays: failure to secure a compliant banking partner before or during the application process.

Risk mitigation: engage ASF early in pre‑application dialogue, appoint experienced local counsel, conduct internal mock reviews before submission, and build banking relationships well in advance of filing.

Next Steps and How Global Law Experts Helps

Securing a MiCA CASP authorisation in Romania requires coordinated expertise across regulatory law, AML compliance, IT security and corporate governance. Global Law Experts provides end‑to‑end project management for CASP authorisation applications, including:

• Application project management: from initial feasibility assessment through to ASF submission and post‑authorisation compliance setup.
• Document templates: governance matrices, business plan frameworks, AML policy templates and board‑readiness packs tailored to Romania.
• ASF pre‑engagement: guidance on informal pre‑application dialogue with ASF to identify and resolve potential issues before formal filing.
• Local partner network: introductions to compliant banking partners, audit firms, IT security providers and AML technology vendors operating in Romania.
• Passporting advisory: structuring cross‑border notifications for EU/EEA expansion after authorisation.

Sources

• Regulation (EU) 2023/1114 (MiCA) Official text, EUR‑Lex
• ESMA Markets in Crypto‑Assets Regulation (MiCA): Interactive Single Rulebook and Transitional Guidance
• European Commission MiCA Delegated and Implementing Acts
• Monitorul Oficial nr. 225, 13 March 2025 OUG 10/2025 (Romania implementing measures)
• ASF (Autoritatea de Supraveghere Financiară) MiCA Implementation Communications
• Chambers & Partners Romania: Blockchain & Crypto‑Assets Practice Guide (2026)