Performance Securities in Romanian IT Contracts 2026: Escrow, Guarantees, Bonds & Milestones

Last updated: September 2026

Performance securities romania decisions are no longer a back-office formality, in 2026 they sit at the intersection of commercial risk, cross-border enforcement and a hardened EU regulatory environment. This guide takes a position: it tells you which instrument to require or accept, and why, rather than hedging behind “it depends”. Whether you are protecting source code continuity, funding rapid remediation on supplier default, or aligning payment to delivery, the right instrument is knowable in advance. Below you will find a side-by-side comparison, a clause-level drafting checklist, and clear playbooks per persona so you can commit to a design and defend it in negotiation.

This is general information, not legal advice. Statutory references should be checked against the consolidated texts before drafting.

Executive summary & decision framework for performance securities romania

Most IT contracting disputes over security instruments come down to one question: how fast can the beneficiary access value, and how much friction stands in the way? That single axis, speed versus procedural dependency, separates the four instruments cleanly.

• Choose a demand bank guarantee when you need immediate liquidity on breach and the supplier can secure a banking line. It is generally the fastest, most enforceable option in Romania when drafted as an independent, irrevocable first-demand instrument.
• Choose escrow when your primary exposure is business continuity and intellectual property, source code, keys, build environments, rather than cash recovery. It protects the thing you cannot replace quickly.
• Choose a performance bond when a bank guarantee is commercially unavailable and an insurer-backed surety is acceptable. Expect underwriting scrutiny and potentially slower payouts.
• Choose milestone payments and retention when technical acceptance can be staged objectively and you want to avoid third-party fees. Risk stays inside the contract, so acceptance drafting must be airtight.

The recommendation for most critical digital services procurements is a layered design: milestone payments for cash discipline during delivery, plus a demand bank guarantee for post-go-live performance, plus source-code escrow for continuity. For routine SaaS subscriptions, milestone or retention logic alone is usually proportionate. The rest of this article shows how to implement each of these choices under Romanian law.

2026 regulatory & market context: DORA, NIS2 and procurement

What changed recently

Two EU instruments have reshaped how buyers of digital services think about supplier resilience. The Digital Operational Resilience Act (Regulation (EU) 2022/2554, “DORA”), which has applied since 17 January 2025, imposes operational resilience obligations on financial entities and their ICT third-party providers, pushing continuity and exit arrangements into contract terms. The NIS2 Directive (Directive (EU) 2022/2555) broadens cybersecurity obligations across a wider set of essential and important entities, with supply-chain security expectations that flow through to procurement. NIS2 is implemented in Romania through national transposing legislation, which should be checked in its current consolidated form.

The practical effect is that procurement teams now scrutinise not only whether a supplier will pay damages on default, but whether the buyer can keep operating if the supplier fails. That reorients the conversation about performance securities romania away from pure payment recovery and towards continuity.

Why this matters for contract securities

Under a DORA or NIS2 lens, a cash-only guarantee is insufficient for a critical service, money does not restore an outage. Buyers of regulated digital services should therefore pair a demand guarantee (to fund remediation and mitigation) with an escrow arrangement (to secure the code, data and know-how needed to continue operating or migrate). Milestone and retention structures further reduce the exposure window by tying payment to demonstrable resilience testing. In short, the regulatory shift favours combinations of instruments, chosen for their function, not a single default clause copied across every deal.

Overview of security instruments: what they are

Escrow (source code and assets)

Escrow places critical assets, most often source code, build scripts, documentation and encryption keys, with an independent agent who releases them to the beneficiary only on defined trigger events (typically vendor insolvency, abandonment of maintenance, or material breach). In IT contracts it is the instrument of choice for continuity and IP protection, particularly for SaaS platforms and bespoke development where the buyer cannot self-support the software without the deposited materials.

Bank guarantees (demand / standby)

A bank guarantee is an undertaking by a bank to pay the beneficiary a sum on presentation of a compliant demand. When drafted as an independent, irrevocable first-demand guarantee, the bank pays against the demand documents without adjudicating the underlying contractual dispute. It is used for payment security, performance security and in public procurement bids. Its defining advantage is speed and its relative insulation from the merits of the commercial disagreement.

Performance bonds (insurance-backed surety)

A performance bond is a surety, usually issued by an insurer or specialist underwriter, promising to make good the beneficiary’s loss if the principal fails to perform. Bonds can substitute for bank guarantees where banking capacity is constrained. They tend to be treated more like accessory obligations, meaning the surety may investigate the claim before paying, which can introduce delay compared with a demand guarantee.

Milestone payments and retention

Milestone payments release funds only as defined deliverables are accepted; retention withholds a percentage of each payment until final acceptance or the end of a warranty period. These are not third-party instruments at all, they are contractual mechanics that shift risk by aligning cash flow to performance. They cost nothing in bank or insurer fees, but their entire strength rests on the precision of the acceptance and testing criteria.

Comparison table: side-by-side evaluation of performance securities romania

Table caption: Comparative evaluation of escrow, bank guarantees, performance bonds and milestone payments for Romanian IT contracts.

Read across the “speed” and “enforceability” columns and the hierarchy is plain. A demand bank guarantee gives the buyer the fastest, cleanest route to cash because the bank pays against documents rather than adjudicating the dispute. That autonomy is precisely why banks price it and why suppliers must post collateral, you buy speed and certainty.

Escrow scores lower on speed because release depends on triggers and the agent’s process, but it protects something a guarantee never can: the ability to keep the service running. Bonds occupy an awkward middle ground, cheaper access to capacity for suppliers who cannot obtain a guarantee, but with insurer investigation that can erode the very speed a buyer wants. Milestone payments are the lowest-cost mechanism and shift risk back inside the four corners of the contract, which is exactly why acceptance drafting decides whether they work.

On a quick 1–5 scoring (5 best for the beneficiary): the demand bank guarantee leads on enforceability (5) and speed (5) but carries moderate cost and complexity (3); escrow scores high on continuity value and cross-border suitability (4) but medium on speed (3); bonds sit at 3 on enforceability and 2–3 on speed; milestone payments score 5 on cost but 2 on speed. For cross-border deals, prioritise instruments with clear bank-based payment mechanics or an escrow agent with a local presence.

Enforceability & enforcement process in Romania

Enforceability of bank guarantees and bonds

The commercial strength of a Romanian bank guarantee flows from its autonomy. An independent, irrevocable first-demand guarantee obliges the bank to pay on presentation of a conforming demand, separate from the underlying contract, the bank is not adjudicating whether the supplier actually breached. General contract principles and the treatment of independent versus accessory obligations under the Romanian Civil Code underpin this distinction (autonomous guarantees are recognised under the Civil Code). Draft the instrument as accessory (dependent on proving default) and you forfeit the speed that makes it valuable.

Performance bonds behave differently. Where the surety’s obligation is framed as accessory to the principal’s performance, the surety may require evidence of default and conduct its own investigation before paying. That is enforceable, but it introduces a fact-finding step the beneficiary cannot control. If speed matters, insist on demand-style call conditions in the bond wording rather than proof-of-loss mechanics.

Enforcing escrow (release triggers and injunction risk)

Escrow is a matter of contract. Where the release conditions are objectively satisfied and the escrow agent follows its written instructions, release can proceed without court involvement. The risk arises when the vendor disputes the trigger, for example, denying that a “material breach” has occurred, and seeks provisional court measures to freeze the release. The Civil Code governs how the trigger language is interpreted; the practical defence is drafting triggers that are objective and evidenced (an insolvency filing, a formal maintenance notice unremedied within a stated period) rather than subjective judgments that invite litigation.

Court enforcement and provisional measures

Where recovery ultimately requires the courts, enforcement of monetary claims, including attachment and seizure of assets, follows the procedures in the Romanian Civil Procedure Code. Provisional measures can secure assets pending a decision, which matters when a supplier is failing and asset flight is a risk. For instruments issued abroad, the beneficiary must also consider recognition and enforcement of foreign judgments and instruments, which may add procedural steps and time (within the EU, this is streamlined by the applicable EU regulations). The lesson is design-led: the more you rely on a bank paying against documents, and the less you rely on Romanian court enforcement of a foreign instrument, the faster and more certain your recovery.

Commercial & drafting checklist: clause-level traps

The difference between a security that works and one that fails in a dispute is almost always in the drafting. The snippets below are illustrative only, bespoke drafting is required.

Bank guarantee clause checklist

• Independence. State expressly that the guarantee is independent of the underlying contract and payable on first written demand.
• Irrevocability. Confirm the guarantee is irrevocable for its stated term.
• Demand language. Define exactly what a compliant demand contains, beneficiary statement, amount, and a short assertion of default, to avoid the bank rejecting on technicalities.
• Governing law and jurisdiction. Align these with the underlying contract to prevent a mismatch that stalls enforcement.
• Expiration and reduction. Close the gap between guarantee expiry and the last date the buyer might need to call; provide for automatic extension or extend-or-pay language.
• Issuing bank. Require a bank with Romanian presence or established correspondent lines.

Illustrative demand wording: “The Bank irrevocably undertakes to pay the Beneficiary, on first written demand and without proof or conditions other than this demand, any sum up to [amount] within [X] business days of receipt.”

Performance bond wording

• Issuer standing. Name the insurer or underwriter and confirm its capacity to write bonds enforceable in Romania.
• Beneficiary identity. Ensure the beneficiary is precisely the contracting buyer entity, including successors.
• Call conditions. Draft call conditions that minimise investigation, ideally demand-style rather than proof-of-loss.
• Amount and duration. Match the bond amount to realistic remediation cost, not just contract value, and cover the warranty tail.

Escrow operational checklist

• Deposit scope. Specify exactly what is deposited, current source code, build instructions, dependencies, credentials, and require periodic updates.
• Release triggers. Use objective, evidenced events (insolvency, unremedied maintenance failure, abandonment) with defined cure periods.
• Verification. Include a verification right so the buyer can confirm the deposited materials actually build and run.
• Dispute resolution. State how a contested release is handled and the agent’s obligations pending resolution.
• Technical handover. Provide for reasonable transition support so the buyer can operate the released materials, access without handover is of limited value.

Illustrative release condition: “The Agent shall release the Deposit to the Beneficiary within [X] business days of receiving evidence that [defined trigger event] has occurred and remains unremedied for [Y] days after notice.”

Milestone payment and retention drafting

• Acceptance criteria. Define measurable, testable criteria for each milestone, not “to the buyer’s satisfaction”.
• Test scripts. Attach or reference the test scripts and pass/fail thresholds used to determine acceptance.
• Remedies. State the consequences of non-acceptance, cure period, partial payment, or termination, clearly.
• Retention amount and release. Set retention high enough to matter but not so high it drives up price, and define the release date precisely.

Illustrative acceptance clause: “A Milestone is accepted only when the Deliverable passes all tests in Schedule [X] without Severity 1 or 2 defects; payment is due within [Z] days of written acceptance.”

The non-negotiable points across all four: objective triggers, aligned governing law, closed expiration gaps, and a verification or acceptance mechanism that a third party could apply without reading either party’s mind.

Cost, timing and suitability by deal type

SaaS (subscription vs usage)

For standard SaaS subscriptions, a full bank guarantee is usually disproportionate. Milestone or retention logic tied to onboarding and service-level performance is proportionate, with source-code or continuity escrow reserved for platforms the buyer genuinely cannot replace quickly. Where the SaaS supports a regulated critical function, add a modest demand guarantee to fund remediation. Recommended instrument: escrow plus retention; add a demand guarantee for critical SaaS.

Outsourcing (operations and maintenance)

Long-running O&M contracts expose the buyer to continuity risk over years. Here a demand bank guarantee for performance, sized to remediation and transition cost, is the anchor instrument, supported by escrow of run-books and configurations. Recommended instrument: demand guarantee plus operational escrow.

Custom development (deliverables and milestones)

Development projects are the natural home for milestone payments and retention because the work is inherently staged and testable. Layer source-code escrow so that a vendor failure mid-project does not strand the buyer without the work in progress. Recommended instrument: milestone payments plus retention plus development escrow.

Public procurement (ANAP rules)

Public buyers operate within the public procurement framework whose policy and monitoring functions in Romania are handled by the National Agency for Public Procurement (ANAP), with the electronic procurement system (SEAP/SICAP) used for tenders. Whether a bank guarantee, cash deposit or other permitted form of security is acceptable, and the mechanics of calling it, are governed by the applicable procurement legislation and the specific tender documentation. Buyers should confirm the permitted forms of security and their call conditions under the current rules before finalising tender documents. Recommended instrument: bank guarantee where permitted, subject to the applicable procurement rules and the tender terms.

Cross-border & bank choice considerations

Foreign bank guarantees vs local banks

A foreign bank guarantee can be relied upon in Romania, but calling it is smoother when the issuing bank has a local branch or established correspondent banking relationship. A guarantee callable only through a chain of foreign intermediaries introduces delay at precisely the moment speed matters. Prefer a bank with Romanian presence, or require the foreign bank to route its undertaking through a local confirming bank.

Choice of law and jurisdiction

Align the governing law and jurisdiction of the security instrument with the underlying contract wherever possible. A guarantee governed by one law while the main contract is governed by another creates interpretive gaps that a defaulting counterparty may exploit. Clarity here is worth more than any single favourable clause.

Recognition of foreign enforcement

Where recovery depends on enforcing a foreign judgment or instrument in Romania, factor in the recognition and enforcement steps. For judgments from other EU Member States these are largely streamlined by EU law; for non-EU judgments and instruments, the recognition procedures under the Civil Procedure Code apply and add time and cost. The strategic response is to minimise reliance on them: structure recovery around a bank that pays against documents, or an escrow agent with a Romanian footprint, rather than around litigation you must import.

Practical bank selection tips: check the issuing bank’s credit rating, confirm its physical or correspondent presence in Romania, and verify it will issue in the required form (independent, irrevocable, first-demand) before you rely on it in a bid or contract.

Conclusion: recommended playbooks & sample clauses

The decision on performance securities romania is ultimately a design choice, and it should be made deliberately rather than inherited from a template. The clearest recommendations, by persona:

• Buyer, high-risk critical service. Layer instruments: milestone payments during delivery, a demand bank guarantee sized to remediation cost for post-go-live performance, and source-code escrow with verification rights for continuity. This is the design DORA and NIS2 pressures reward.
• Vendor, SaaS subscription. Resist a full performance guarantee as disproportionate. Offer continuity escrow with tightly defined triggers and reasonable retention, keeping call conditions objective so you are not exposed to subjective drawdowns.
• Outsourcing RFP. Anchor on a demand bank guarantee where the procurement rules permit, supported by operational escrow, and set acceptance and call conditions in the tender so bidders price them accurately.

Across every playbook, the same disciplines apply: objective triggers, aligned governing law, closed expiration gaps, and verification or acceptance mechanics a third party could apply. Get those right and your chosen instrument will perform when you need it. Treated as a copy-paste afterthought, even the strongest instrument on paper can fail in practice, which is why performance securities romania deserve deliberate, function-led drafting on every deal.

Sources

1. Romanian Civil Code and Civil Procedure Code (official consolidated texts)
2. National Bank of Romania (BNR), regulations and guidance
3. National Agency for Public Procurement (ANAP)
4. EUR-Lex, Regulation (EU) 2022/2554 (DORA)
5. EUR-Lex, Directive (EU) 2022/2555 (NIS2)
6. Uniunea Națională a Barourilor din România (UNBR)