1. The Fintech Landscape
1.1 Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic and ESG (Environmental, Social and Governance) objectives. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?
In the past few years, the Romanian fintech industry has taken its place in the future trend aiming to create a cashless society. Despite this trend, the huge gap between the urban sector and rural sector, which still focuses on providing the traditional payment methods, would have to be reduced.
In the last five years, the Romanian tech market has offered valuable products both for the national and international markets. Highly technological solutions, especially for sectors such as blockchain, crowdfunding, crypto, banking, e-commerce, accounting, lending, payment gateway, energy, real estate, healthcare and insurtech, have been made available.
Notably, the crypto industry has gained momentum by successfully promoting numerous projects developed by Romanian players. Such achievement also proved the strength of the Romanian crypto market, since it was performed under the unfavourable conditions that resulted from the 2022’s crashes of popular actors in the blockchain industry (e.g. Terra Luna and FTX). Also, throughout 2022, non-fungible tokens (NFTs) became increasingly popular in Romania.
Even though the banking, lending and payment gateway sectors are still governed and dominated by traditional banks, it nevertheless turned out that Romanians have generally embraced fintech solutions, as evidenced by the spectacular adoption of Revolut (for various fintech features), MobilPay (for traditional payments) and xPortal (for crypto-to-crypto payments).
The COVID-19 pandemic led to an increase in the usage of online services. Therefore, the healthcare sector implemented ingenious NFT and metaverse solutions for customer care, as well as blockchain-based artificial intelligence projects, and digital hubs were organised for sectors like insurtech. Simultaneously, the population significantly increased its interest in investments in technology, and some specific areas – best illustrated by digital assets management and custody or, more recently, by artificial intelligence – became highly demanded.
Nonetheless, a new wave of users started to use other fintech products; for example, the metaverse, payment applications, decentralised finance (DeFi) projects, peer-to-peer lending protocols, high-tech telecoms, neo-banking and financially infused social media platforms.
With respect to ESG, it must be pointed out that the Bucharest Stock Exchange (BVB) successfully launched its ESG guidelines, with the support of European Bank for Reconstruction and Development, in November 2022. This achievement should aid the Romanian fintech market and also ease some of the Global ESG Monitor’s concerns, in particular that “sustainability reporting was not a high priority in Romania”.
Romania must thrive to keep pace with the European Commission’s Action Plan on Sustainable Finance, adopted in March 2018. Whilst BVB’s compliance was already outlined, there are other optimistic steps that were or, as the case may be, are in course of being put into place in order to ensure the fulfilment of ESG objectives. In that respect, the enhanced adoption of Web 3.0-based blockchain technology in Romania shall aid, among others, the implementation of recommendation 4 of this action plan, namely “Fostering transparency and long-termism”.
With regard to the state of development of the market and the fintech innovation trends, we must also point out that the Romanian market has been noted as being a good choice for foreign companies and investors to develop technological businesses, while its own national fintech unicorns are constantly emerging.
The national market has continued its progression from offering only cost-efficient services to offering cost-efficient services that are also of high quality.
Nevertheless, although the fintech sector is at this time an important contributor to Romania’s GDP, the country still has great potential to grow the industry even further over the entire spectrum of emerging fintech. To that end, relevant actors shall seek to support innovation together with the creation of valuable intellectual property (IP) by means of encouraging local talents to the detriment of outsourcing services.
Meanwhile, the public sector has recently adopted several outstanding solutions provided by artificial intelligence, and it has also steadily pursued the distribution of European Union (EU) and national funds dedicated to research and business in technology.
The financial market continues to stay at a critical point of change due to the disruptive influx of fintech start-ups. The new-borns are “rising stars” that might surpass the old financial players in terms of performance, but they still need time to properly improve (check and doublecheck) funding and security features. In the latter sense, sharp migration to new-born fintech companies, driven by the desire to escape from the control of traditional banks, comes with the risk that it might conversely expose users’ data and funds.
Once Romania’s technology market becomes mature enough, users will be able to seek and make use of more innovative approaches, such as data science and machine learning.
1.2 Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?
There is no restriction or prohibition on fintech business.
In 2022, Romania accommodated maybe hundreds of new blockchain and cryptocurrency projects, such as initial coin offerings (ICOs), initial exchange offerings (IEOs), exchange service providers (online and physical crypto exchanges, automated teller machines (ATMs), over-the-counter (OTC) desks), NFTs, metaverses, marketplaces, chains, supply chain service providers, gaming platforms, cross-chain platforms, crowdfunding platforms, and so on.
However, as innovation has no limits, all fintech companies’ features must be carefully reviewed before going live, because specific regulatory requirements or licences are required, inter alia, for a series of banking-related services, issuing electronic money (e-money) or operating a crowdfunding platform.
As regards cryptocurrencies, there is currently no specific prohibition, contingent on the assessment that a particular token shall be excluded from the category of financial instruments, payment instrument or e-money. In case that it must be regarded as a financial instrument, certain legislative acts adopted at the EU level would become enforceable and, as the case may be, this can entail, for example, prospectus, transparency or market abuse obligations. Furthermore, in this case a set of technological prerequisites are going to be put in place in the future, by means of Regulation (EU) 2022/858 on a pilot regime for market infrastructures based on distributed ledger technology (the DLT Pilot Regime).
The MiCA Regulation (regarding the particular taxonomy of issuing asset-reference tokens and e-money tokens) is expected to come into force in 2023. New service providers must immediately abide by the provisions of this European regulation. A grandfather clause of 18 months is nonetheless laid down through the proposal of the regulation in respect to the issuance of utility tokens and to compliance by existing crypto service providers with all legislation thereby enacted. We must also point out that the MiCA Regulation is also expected to provide a limited set of exemptions.
While there are no current specific legal provisions for holding or issuing regular cryptocurrencies, provisions enacted for matters such as know-your-customer (KYC) checks, anti-money laundering (AML) or property rights infringement remain likewise applicable.
And even though cryptocurrencies are not recognised as legal tender, crypto payments are being increasingly accepted by major retailers using payment gateways, such as the one created by the biggest Romanian payment service provider (PSP), Netopia.
New tax systems, accounting rules and guidelines are currently being developed, so that the government can offer a tailored solution for the digital age.
We may additionally add that the EU plays a particularly important role within the Organisation for Economic Co-operation and Development (OECD)’s worldwide decisional policy. The fiscal policy matters commonly accepted both in Romania and at the OECD level are those regarding the approach to the digitalisation of the economy, the cooperation of the fiscal authorities in the Member States and the promotion of good fiscal governance – both at the EU and worldwide level.
Likewise, the lack of an official position from the EU and OECD makes it difficult to adopt a national regulation. Hence, the national regulator prefers to wait for a preliminary opinion from the EU to avoid implementing rules that may come into conflict with a future EU regulation.
Also, since 2019, we must state that the Romanian Criminal Code has classified digital currencies as “means of payment without cash”. Prohibition is thereby enacted by considering that the purpose of this classification is to sanction crimes, such as theft, robbery and embezzlement, committed in connection with cryptocurrencies.
2. Funding For Fintech
2.1 Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?
In the past few years, fintech and non-fintech Romanian start-ups have had a huge appetite for the non-reimbursement European or governmental funds programmes (SME Instruments, Horizon 2020, Romanian Tech-Nation, Start-up Nation), which were accessible by means of a strong plan, whilst the minimum funds required for these programmes were generally between 10% and 25% of the total funding.
Traditional funding options, such as bank loans, credit lines and payment guarantee letters, are preferred by experienced entrepreneurs, who can use their background to obtain bank’s acceptance for consistent funding. However, these types of funding represent a real obstacle for entrepreneurial businesses, since the banks will remain resistant to taking a high risk for financing businesses without economic history, especially since the rates of interest were also raised by the National Bank of Romania (NBR). Likewise, the NBR’s regulations contain certain restrictions limiting bank financing of new businesses unable to prove a stable historical financial record or to benefit from sufficient warranties.
In 2022, we were surprised to be appointed by several banks to prepare their internal handbooks for analysing and tracing blockchain transactions, with the purpose of avoiding the rejection of payments coming from exchanging cryptocurrencies to fiat.
Private investors in stock capital companies, seed capital funds, non-equity grants, crowdfunding platforms and business angels were the most common funding sources for fintech start-ups that only had an early-stage product, or even just a business plan, at the beginning.
The creation of a competitive and favourable environment for the emergence and development of crowdfunding platforms and the facilitation of cross-border financing was subsequently encouraged by the adoption of Regulation (EU) 2020/1503 on European crowdfunding service providers for business (Crowdfunding Regulation), which came into force on 10 November 2021. Romania has also adopted a law regarding the supplementation of the Crowdfunding Regulation’s provisions, which sets up a distinctive legal regime in that respect.
The Crowdfunding Regulation is driven by the desire to create a more accessible market with a single EU regime, thereby removing diverging national rules with respect to investment-based crowdfunding (in respect to transferable securities) and lending-based crowdfunding (peer-to-peer).
By financing the debt, the company will assume interest and operating costs generated by financing as well as stable cash flow to have the ability to pay, in return for financing equity that has no mandatory or fixed payments.
In addition, debt financing through credit institutions or other creditors, such as suppliers, can be a more convenient alternative for start-ups, since both the interest for bank loans and the hidden cost of financing through a supplier loan are deductible.
The fintech sector has reached a new upstanding development level so that even fintech companies have started to offer services to new-born fintech companies, such as the equity crowdfunding platform Seed Blink and the digital accelerator Human Finance.
In Romania, the last two years have pushed start-ups to innovate, compensating for the impossibility of performing multiple business meetings and emotional live pitches. In 2022, Romanian start-ups raised €111 million in venture capital, which maintains last year’s level and is three times the venture capital raised in 2020.
Although in a still unregulated market, several start-ups have decided to explore the crypto world, issuing tokens and collecting funds through ICOs/IEOs. In Romania, after the significant increase in demand for ICOs reported especially throughout 2021, sophisticated and new funding possibilities are going to be made available to Romanian investors in the Web 3.0 ecosystem.
2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?
Romania’s technology sector has seen an upswing in recent years, with a particular focus on the fintech industry. In keeping with this trend, the Romanian Presidency has prioritised the scaling of the tech industry since 2019, setting forth two significant milestones expected to be achieved within the next five to 10 years. As of 1 January 2023, recent changes have been enacted with respect to tax exemption on salary income in the IT field, which were established through Order nos 21.813/6.421/2.246/4.433/23.12.2022 at the close of the previous year. These changes include new provisions for tax exemption for public sector employees and the creation of a new position: the software product development engineer. This role encompasses a range of activities, including requirements analysis and assessment, design, development, testing and maintenance of software solutions to meet company-specific requirements. Additionally, the order provides further clarification on the necessary documentation for tax exemption in the sector, increasing transparency and predictability regarding the application of these rules. Furthermore, the order introduces new provisions for employees working in Romania on secondment, with income from wages and similar activities related to computer program creation exempt from tax if specific conditions are met.
From a tax perspective, developers are exempt from paying income tax, while fintech companies are subject to a rate of 1% if their previous year’s revenues do not exceed €0.5 million. Companies engaged in research and development (R&D) activities can take advantage of a 50% extra deduction on eligible expenses, as well as accelerated depreciation on equipment and R&D activities. This deduction remains unaffected, even if the objectives of the R&D project are not met. However, to qualify for these incentives, the R&D activities must fall within the categories of applied research or technological development that are relevant to the company’s business, and they must be conducted within Romania or other Member States of the EU or the European Economic Area. Additionally, incentives are granted on a project-by-project basis.
Tax exemptions are available for profits that are reinvested in specific and new technological equipment, whether purchased or manufactured for use. The reinvested profit is exempt from tax, provided that the company uses the technological equipment for more than half of its life for business activities. However, the period of use must not exceed five years, and companies that benefit from this incentive are not allowed to use accelerated depreciation for the aforementioned technological equipment. Overall, these incentives demonstrate the Romanian government’s commitment to fostering growth and innovation in the tech industry.
2.3 In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?
The Romanian IPO market comprises two levels: the principal market, i.e., BVB; and the alternative market, which is designed as a Multilateral Transaction System.
BVB is designed for large players that are structured as joint-stock companies older than three years, have a value of over €1 million and are willing to offer a minimum 25% free-float.
Separately, the Alternative Exchange in Romania (AeRO) is for start-ups and small and medium-sized enterprises (SMEs) that are structured as joint-stock companies, have a value of over €250,000, and are willing to offer 10% free-float or have more than 30 shareholders.
2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?
Most Romanian fintech business founders are reluctant to the idea of an exit strategy and would rather continue developing their product by offering multiple services.
The main Romanian investment platform announced multiple investment projects valued at more than €250 million. Private investments also represent a consistent part of the total investments performed in the last two years.
One of the leading investment funds announced at the end of 2021 its first exit from one of its investments after only two years from the time of acquisition, securing a profit five times higher than the investment.
The increase in the number of private and public investments was highlighted through the television shows in which young entrepreneurs present their companies seeking for investments between €100,000 to €5 million in exchange for less than a half of the total shares.
3. Fintech Regulation
3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.
The national Romanian law does not provide a legislative package particularly dedicated to fintech businesses.
The working legal group in which our team was involved finalised the first bill of the new regulation concerning DLT, and it is expected to enter into force this year.
Nevertheless, fintech businesses’ features may fall under the scope of strictly regulated activities, such as issuing insurance policies, granting loans, holding and facilitating financial transactions, and developing conversion and payment gateways.
In major cases, the relevant supervisory authority’s approval is required, and no exception or derogation concerning the KYC and AML European standards is permitted.
However, the principle of neutrality also intervenes so that the applicable regulations are determined by the performed activity and not by the technology of reference. This means that service providers may not be subject to some regulations since they only offer the tech infrastructure to operators.
At EU level, with further enforceability in Romania, the so-called “Digital Package” was adopted as of 2022. This legislative framework consists of the Digital Services Act (Regulation EU 2022/2065 on a Single Market for Digital Services) vested with a broad scope, the Digital Markets Act (Regulation EU 2022/1925 on contestable and fair markets in the digital sector), which applies mostly to “Big Tech”, and the MiCA Proposal for a Regulation, applicable to non-financial instruments cryptocurrencies, which was referred to in the answer to question 1.2.
3.2 Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?
Romania does not have a specific national regulation for cryptocurrencies. Several provisions are nonetheless laid down through some legislative acts, such as:
the National Tax Code, which states that income from cryptocurrencies gained by a natural person is subject to a 10% tax rate regardless of the form of the profit (fiat/cryptocurrency); and
Law no. 129/2019 for preventing and combatting money laundering and terrorist financing, which imposes the obligation of crypto exchanges (fiat-to-crypto/crypto-to-fiat) and digital wallet providers to obtain technical approval from the Authority for the Digitalisation of Romania.
However, the upcoming regulation developed by the governmental working legal group is drafted in such a manner as to allow every Ministry to supplement the main regulation with additional provisions required in their specific portfolio. For example, if necessary, the Ministry of Finance will assess the necessity to regulate ICOs or the tokenisation of assets.
A highly detailed regulation should be carefully assessed and avoided in order to allow DeFi’s philosophy to reach its full potential. This shall, however, take into account the European legal framework that will be partly adopted by this time.
The EU’s regulatory environment that is expected to take the world of cryptocurrencies and Web 3.0 by storm in the near future shall provide the necessary incentives for activities such as crypto exchanges, crypto ATMs, crypto wallets, ICOs, DeFi applications, play-to-earn, fit-to-earn and so on to flourish and reach new market hights.
3.3 Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox’ options for fintechs in your jurisdiction?
Tech and fintech continue to consolidate their traditional place on the policy-makers’ agenda despite the fact that there are several measures that must be rapidly taken in order to avoid being left behind by the technologies’ evolution.
In general, Romania follows the European trends and guidelines, shaping them to the national legal framework.
Supporting tech companies and digitising the public and private sectors became a main priority for policy-makers, especially in the context created by the COVID-19 pandemic. In the past few years, the Ministry of Transport, Infrastructure and Communication and the Ministry of Research, Innovation and Digitalisation were the key factors and promotors of all tech and digital projects, helping public and private actors to pave the road to the new tech era.
At the end of Q1 2023, the EU DLT Pilot Regime entered into force, which applies to the tokens that represent financial instruments. This legislative act creates a sui generis type of sandbox regulation based on which the EU relevant authorities, including the European Commission, shall draw periodic conclusions for the further amendment of the dedicated legal framework. Furthermore, a proper European Blockchain Sandbox was proposed to commence starting from 2023 by the European Commission.
We must add that Romania was selected by representatives of the governments of the EU Member States as the prospective seat of the new European Cybersecurity Industrial, Technology and Research Competence Centre, which will be located in Bucharest. This decision recognises Romania’s firm commitment to consolidating the European project and the strong expertise the country has in the digital and cybersecurity fields.
3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?
Except for the domestic regulation that applies to Romanian companies, there are no additional legal requirements for fintech businesses based in EU countries.
The Romanian market is an open market for any interested investor. For example, currently, there are 202 foreign entities (EU and non-EU) able to issue e-money and 280 foreign payment institutions, all subject to the obligation of reporting their activity to the NBR. Passporting the EU banking and financial licences in Romania is available via the standard notification procedure.
4. Other Regulatory Regimes / Non-Financial Regulation
4.1 Does your jurisdiction regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?
As in all EU Member States, since 25 May 2018, the main rules concerning processing personal data have been set out by Regulation (EU) 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
Concurrently, national Law no. 190/2018 on implementing measures for Regulation (EU) 379/2016 aims to offer supplementary protection of certain personal data, such as the numeric personal code (CNP), biometric data and medical data.
Privacy by design and by default is a priority for all fintech companies from an early stage of their product. Compliance with the GDPR is mandatory when providing services that process CNP at least for AML/KYC purposes, evaluate user behaviour, process the users’ biometric data required for logging in and, in some cases, confirm payments (as PayByFace does).
Particular challenges are expected (for the entire EU as well) by the purported use of artificial intelligence and blockchain-based complex applications meant to disrupt the way in which data is collected, stored and accessed, with direct connection to the GDPR.
4.2 Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?
The application of the provisions of the GDPR prevails over the provisions of the national laws. Generally, the GDPR is applicable to all data processes concerning EU citizens’ personal data, irrespective of whether the processing is performed in or outside the EU.
However, as the national regulation has horizontal effects, the national privacy Law no. 190/2018 is applicable to data processing performed by foreign organisations that have a subsidiary or an establishment in Romania.
Also, international transfers of data from Romania to organisations located outside the EU have generally been restricted by the GDPR since 25 May 2018 and may only be performed in certain circumstances according to the provisions of Arts 44–46 of the GDPR.
4.3 Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.
The sanctioning regime for failing to comply with the rules concerning processing personal data is set by the GDPR and can lead to fines of up to €20 million or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
Among others, national Law no. 190/2018 on implementing measures for Regulation (EU) 379/2016 has set out the legal framework necessary for the National Supervisory Authority for Processing Personal Data (ANSPD) to apply the sanctions provided by the GDPR, which are considered contraventions under the national regulations.
The national privacy law limits the public authorities’ liability in case of failing to comply with the GDPR to L200,000 (approximately €40,000).
4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?
Romania has transposed the Networking Information Security (NIS) Directive by Law no. 362/2018 on ensuring a high common level of security of computer networks and systems, aligning the national security rules to the European standards. It entails applicability as to three main areas, respectively:
National capabilities, which require EU Member States to have certain cybersecurity means and resources for properly implementing CSIRTs, data protection, IoT and smart infrastructure, cyber threat and risk management, cyber exercises, etc.
Cross-border collaboration, which encourages EU countries to collaborate within a designated CSIRT network, as well as other cooperation groups.
National monitoring of important sectors that forces Member States to conduct cybersecurity monitoring of market operators in critical sectors like finance, energy, transport, healthcare, and the overall digital infrastructure, ex post supervision for important digital service providers, etc.
However, the NIS2 Directive, on which the Council and the European Parliament reached a provisional agreement in May 2022, is expected to replace the first NIS Directive in the near future.
There is also a series of legislative acts that regulates the field of cybersecurity, as it continues to adapt against new type of threats. These enactments are outlined as per the EU’s new Cybersecurity Strategy for the Digital Decade, which forms a key component of Shaping Europe’s Digital Future, the Commission’s Recovery Plan for Europe and of the Security Union Strategy 2020–2025.
The EU DLT Pilot Regime also contains provisions with a cybersecurity implicit component.
Concurrently, Law no. 135/2007 and its complementary Order no. 483/2009 regarding the methodological norms of authorisation of data centres set out the security measures applicable for tech and fintech products that administrate electronic archives.
Also, several sectorial national regulations demand that service providers respect the security standards set out by Standard ISO/ICE 2700:2005 – Information Technology – Security Techniques – Specifications of information security management systems.
Considering each specific activity, fintech products that offer payment services may fall under the obligation to comply with the Payment Card Industry Data Security Standard (PCI DSS)/Payment Card Industry Security Standards Council (PCI SSC).
4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.
Broadly, a fintech company that offers services that fall under the scope of regulated areas, such as banking, insurance, e-money, investments, etc., must obtain authorisation from either the relevant supervisory authority or the NBR.
Fintech companies, such as e-wallets, financial institutions, PSPs and trading (crypto, fiat, forex, regulated assets) exchanges, have statutory obligations to respect the EU and national AML and KYC regulations.
In Romania, Law no. 129/2019 for preventing and combatting money laundering and terrorist financing, the primary law concerning AML, imposes the obligation of cryptoexchanges and digital wallet providers to obtain technical approval from the Authority for the Digitalisation of Romania.
According to the draft of the amendments to Law no. 129/2019, cryptocurrencies will be defined as “virtual currency”, which means “a digital representation of value that is not issued or guaranteed by a central bank or authority, is not necessarily linked to a legally established currency and does not have the legal status of currency or money but is accepted by natural or legal persons as a means of exchange and may be transferred, stored and traded electronically”.
4.6 Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction (for example, AI)
There are no other specific regulations applicable directly to fintech businesses in Romania.
Depending on the type of business, additional national laws and regulations may apply as follows:
- Law no. 93/2009 on non-banking financial institutions (last updated in September 2016).
- Government Emergency Ordinance (GEO) no. 99/2006 on credit institutions (last updated in January 2022).
- Law no. 209/2019 on payment services (last updated in December 2019).
- Law no. 210/2019 on issuance of e-money (last updated in December 2019).
- NBR Regulation no. 4/2005 on foreign currency.
- NBR Regulation no. 3/2018 on monitoring the financial market and payment instruments.
- Law no. 236/2018 on insurance distribution (last updated in August 2020).
- Law no. 365/2002 on e-commerce (last updated in February 2014).
- Regulation no. 17/2022 of the Financial Supervisory Authority, which regulates Fintech Hubs.
- NBR’s specific legislative acts with regard to the prudential supervision of banking services in relation also to the fintech area.
- Law no. 365/2002 on e-commerce (last updated in February 2014).
- Various consumer protection regulations:
- Order no. 505/2014 on informing consumers by entities providing payment services through ATMs.
- Order no. 164/2011 on various information obligations of banks and non-banking financial institutions.
- GEO no. 50/2010 on crediting individuals (last updated in July 2021).
With respect to artificial intelligence, Romania established in 2002 an Institute for Research in Artificial Intelligence. Apart from this, provisions laid down in different legislative acts make implicit or express reference to artificial intelligence, such as Art. 22 of GDPR (within the expression: “a decision based solely on automated processing”).
However, the EU is expected to adopt the so-called “Artificial Intelligence Act”, which is a regulation intended to lay down harmonised rules on this subject and to amend several EU legislative acts in various fields. The impact assessment accompanying thereof outlines that its general objective is “to ensure the proper functioning of the single market by creating the conditions for the development and use of trustworthy artificial intelligence”. While waiting for its enforceability, the Romanian Parliament expressed full support by stating that this proposal for an Artificial Intelligence Act establishes a robust and flexible legal framework.
5. Accessing Talent
5.1 In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction? Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?
The primary labour regulation in Romania is the Labour Code adopted by Law no. 53/2003 – republished version.
There is no specific labour regulation for fintech businesses. However, a fintech business that is only a service provider (such as a software development studio) and not the administrator of the fintech infrastructure can benefit by the tax advantages offered to companies that develop regular IT solutions, as mentioned above in the answer to question 2.2.
The relationship between the employer and the employee is freely negotiated. But in a similar way as in other EU Member States, the labour relationship is subject to the minimum requirements imposed by the Individual Labour Contract (CIM) or Collective Labour Contract (CCL), which set the minimum standards for employees.
The entire Romanian labour law is focused on ensuring employees’ stability and their rights, while affording an effective right of own management to employers. Overall, this legislation succeeds, up to a certain extent, in preventing working diseases, working accidents, discrimination, abuses, overworking and discretionary dismissals.
5.2 What, if any, mandatory employment benefits must be provided to staff?
In Romania, the labour law states that employees are entitled to at least the minimum net wage (approximately €620 with taxes at the time of writing), social security benefits (health and retirement contributions), daily and weekly breaks, minimum 21 days of paid vacation per year, a defined number of days for sick leave, and payment for overtime.
Employees in the IT sector also receive additional incentives, such as extremely well-paid salaries (four or five times the average salary), vouchers, optional insurance, fitness subscriptions, sports funds, discounts to different activities, paid training, flexible or remote working programmes, relaxing/gaming areas in the office, and team building outside the country.
Moreover, several requests, such as covering the costs associated with utilities, rent, logistics equipment or supplies, can be raised by employees to employers in the context of remote work, based on the conditions implemented throughout the Labour Code in response to the COVID-19 pandemic.
5.3 What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?
Since Romania’s accession to the EU in 2007, there have been no restrictions on EU citizens being employed by Romanian companies.
Non-EU residents can be employed under an individual employment contract before obtaining an employment notice or a residence permit for work purposes.
The employment notice is issued by the General Inspectorate for Immigration from the region in which the employer’s office is registered, and must comprise certain documents related to the job’s availability, employee’s criminal records, medical insurance or place of living.
There is no specific regulation regarding employing EU or non-EU citizens in the fintech industry.
As an overarching approach, we may briefly state that Romania offers possibilities for short-term and long-term foreigners both for working and study purposes, as well as for applicants’ family members, but it requires visas for some countries and it generally does not provide the possibility to access better conditions by means of investments (such as golden visas), while legal differences are put in place merely between EU and non-EU citizens.
With regard to other industries, the last years recorded an explosion of foreign unqualified workers from Asia. Nonetheless, the General Inspectorate for Immigration establishes periodical quotas for foreign workers.
6. Technology
6.1 Please briefly describe how innovations and inventions are protected in your jurisdiction.
The Romanian IP legal framework is shaped by three major acts: Law no. 8/1996 on copyright and related rights; Law no. 64/1991 on patents for inventions; and Law no. 84/1998 on trademarks and geographical indications.
Similar to other EU Member States, the Romanian IP regulation provides standards and mechanisms for protecting IP rights regarding innovations and inventions, such as patents, utility models, trademarks, registered graphic models, software programs and other intellectual creations.
Despite its unicity and innovative features, a software program can be protected as an invention only if it serves a hardware system such as the software designed for the mechanical functions of an ATM. Otherwise, a software program is protected under the copyright rules set out by Law no. 8/1996.
6.2 Please briefly describe how ownership of IP operates in your jurisdiction.
Under the Romanian IP legislation, the developer of a software program is recognised as the author from the moment of its execution, but copyright protection is presumed by law in favour of the one who first brought the “creation” to public awareness.
The presumption is not undeniable, therefore any interested person is able to reveal the real owner of the IP rights, even though the software was brought to public awareness by another person.
As a rule, the IP rights of software programs developed by the employees of a software development company belong to the employer. The same rule applies for software programs developed by freelancers under a client’s instructions.
In this industry, it is essential for the employers to include in the employment contracts clauses specifying that the employees give up copyright on programs created during their employment or in the interest of the company; these rights being transmitted to the employer. To avoid any doubt, the same precautions are applicable to the contractual relationship between the client and the software development company in which the instructions and the software features should be detailed.
In general, unless otherwise agreed, co-authors have equal rights to exploit the IP.
The pecuniary rights of a software program last throughout the life of the author, and thereafter are transmitted by inheritance for a period of 70 years.
With respect to inventions, trademarks and designs, their protection is obtained as “provisional protection” from the day on which the registration application was submitted. The provisional protection changes to “definitive protection” if the application is accepted.
6.3 In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?
Generally, the Romanian IP legal framework, as referred to in the answer to question 6.1 above, only offers territorial IP rights.
Romania has signed many international treaties (such as the Patent Cooperation Treaty (PCT), the European Patent Convention (EPC), the Berne Convention and the Paris Convention for the Protection of Industrial Property) in order to guarantee and harmonise with other states the protection of IP rights.
For example, under the provisions of the Berne Convention, contracting parties give reciprocal rights to copyright holders in all 177 signatories states.
In addition to the national and international guarantees, holders of IP rights may directly apply for the European IP rights protection, which also covers the Romanian territory.
An important place is reserved for the WIPO Copyright Treaty (WCT), which under the Berne Convention, grants copyright protection to computer programs, whatever the mode or form of their expression, and compilations of data or other material (databases).
6.4 How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?
In Romania, the holder of the IP rights is entitled, in total or in part, to sell or to license his rights by freely negotiating and concluding written private agreements with the interested parties.
Unless otherwise agreed, the assignment of the rights to use the IP rights does not imply the transfer of the copyright over it.
Only the pecuniary IP rights can be traded by contract, while moral rights cannot be subject to commercial transfer agreements.
In relation to software programs, in particular, it is important to mention that the first sale of a copy on the internal market (by the holder of the IP rights or by another entity having the holder’s consent) removes the possibility of offering an exclusive right of distribution on the internal market.
Depending on the IP rights that are the object of the contract of sale or licence, the national law requires the existence of elements such as the written form of the contract or mentions regarding the duration of the contract, the geographical area considered, the permitted ways of using the rights and their price.
In some cases, the absence of the abovementioned elements may invalidate the contract or may trigger the possibility of the interested party being able to request its termination.