Regulatory Compliance & Investigations
We help regulated businesses build compliance programs that work and defend them when a regulator calls. Our clients are banks, IFNs, payment institutions, energy companies and gambling operators that answer to ONPCSB, BNR, ASF, ANRE, ONJN and ANSPDCP.
Updated 28 October 2026 · General information, not legal advice
What we advise on
AML programs
Risk assessments, policies, KYC procedures and reporting under Law 129/2019.
Whistleblowing
Internal reporting channels and procedures required by Law 361/2022.
Inspections
Preparation for and attendance at regulator inspections, and responses to findings.
Sanctions and appeals
Challenges to administrative sanctions before the regulator and the courts.
Internal investigations
Fact-finding on suspected misconduct, with attention to employee and data protection rules.
- Documented risk assessment. Regulators expect a written, current risk assessment that drives the controls. Generic policies are a common finding.
- Deadlines. Administrative sanctions have short challenge periods. A missed deadline usually ends the defense.
- Data in investigations. Reviewing employee emails and devices must respect GDPR and employment law.
Which Romanian businesses must have an AML program?
The reporting entities listed in Law 129/2019, including credit and financial institutions, gambling operators, real estate agents, notaries, lawyers in certain transactions, accountants and some traders in high-value goods.
Do Romanian companies need a whistleblowing channel?
Yes, for private entities with 50 or more employees, under Law 361/2022. Some regulated entities must have one regardless of size.
Tell us the decision you need to make
Describe the transaction or regulatory issue, the Romanian assets involved and your timetable.
Consultation