Romania

Art. 9 of Law 361/2022 requires public bodies of any size, and private entities with at least 50 employees, to set up an internal reporting channel (Art. 36 gave private entities with 50 to 249 employees until 17 December 2023). Art. 10 requires acknowledgement within 7 calendar days and feedback within 3 months of acknowledgement. Failure to set up a channel is a contravention under Art. 28(2)(c), fined RON 3,000 to 30,000.

Art. 24(1) of Law 129/2019 requires reporting entities to set internal policies, rules, control mechanisms and risk-management procedures covering at least customer due diligence, reporting and record-keeping, internal control, staff protection, and staff training and evaluation. Art. 23(1) requires them to designate responsible persons and notify the Office of their names; Art. 23(2) requires credit and financial institutions to designate a compliance officer at management level.

Art. 11 of Law 129/2019 sets standard due diligence: identifying and verifying the customer and beneficial owner, assessing the purpose of the relationship and ongoing monitoring. Art. 16 allows simplified measures for low-risk customers; Art. 17 requires enhanced measures in higher-risk cases such as politically exposed persons, correspondent relationships and high-risk countries.

Art. 6(1) requires reporting entities to report to the Office when they know, suspect or have reasonable grounds to suspect criminal origin of funds or terrorist financing. Art. 8(1) says the report goes immediately and before any related transaction; under Art. 8(3) the transaction is not carried out until 24 hours after the report is registered. Art. 9(1) lets a transaction proceed unreported if abstaining is impossible or would hinder tracing, with the report due within 24 hours afterwards.