Changing shareholders in Romania 2026 legal guide showing business professionals, financial risks, and share transfer process illustration

Changing Shareholders in a Romanian Company: The 2026 Legal Guide

Changing Shareholders in a Romanian Company: The 2026 Legal Guide

TL;DR: Changing shareholders in a Romanian SRL requires a share transfer agreement, a shareholders’ resolution, an updated Articles of Association, and a Trade Register filing within 15 days. Since December 2025, Law 239/2025 adds a mandatory 15-day ANAF notification for any controlling stake transfer. From 1 January 2026, capital gains tax on direct share sales rises from 10% to 16%. Incomplete documents or missed deadlines can derail funding rounds and trigger significant penalties.

Romanian lawyers discussing corporate shareholder structure in a modern office

Strategic legal consultation for complex shareholder changes in Romanian SRLs.


📹 Video Guide: Changing Shareholders in Romania

Watch this comprehensive video guide covering the essentials of shareholder changes, share transfer procedures, and key legal considerations for Romanian companies in 2026.


Need Professional Help?

At Atrium Romanian Lawyers, we handle the entire shareholder change process — from drafting documents to Trade Register submission. We advise local clients and international investors on corporate governance, share transfers, and regulatory compliance.


What Does Changing Shareholders in a Romanian Company Actually Mean?

Earlier this year, one of our long-standing corporate clients came very close to losing an important investment deal. Not because of a financial problem or a contract dispute. Because one outdated name in a shareholder register stood between the company and a signed term sheet.

Changing shareholders in a Romanian SRL (societate cu răspundere limitată, or limited liability company) means transferring părți sociale (social parts, the Romanian term for ownership stakes) from one person or entity to another. This can happen through a sale, a gift, an inheritance, or a new capital subscription. The legal result is a change in the company’s ownership structure, which must be registered with the National Trade Register Office (ONRC).

AspectSRL (Limited Liability)SA (Joint-Stock)
Ownership UnitsPărți sociale (social parts)Acțiuni (shares)
Transfer MethodWritten agreement + ONRC filingFree market trading or private sale
Approval RequiredYes — shareholders’ resolutionGenerally no (unless restricted)
AoA UpdateMandatory for every transferNot required for each trade
RegistrationMust be filed within 15 daysRecorded in shareholder register

Unlike a joint-stock company (SA), where shares trade freely on the market, SRL social parts carry legal restrictions. They represent not just economic value but also voting rights, profit entitlements, and governance influence. A transfer isn’t complete until it’s properly documented and registered. Until that happens, it doesn’t exist as far as third parties are concerned.

This is also why updating the company’s Articles of Association is a mandatory step in every transfer, not an optional formality. If you’re setting up an SRL in Romania, understanding share transfer rules from day one will save you real trouble later.

Romanian shareholders and lawyers discussing corporate structure in a modern office

A comprehensive shareholder meeting ensures alignment before any official transfer filing.


When Is Shareholder Approval Needed for a Transfer?

Under Romanian corporate law, transfers between existing shareholders don’t require separate approval unless the Articles of Association say otherwise. Transfers to outside third parties are a different matter.

Shareholder Approval Rules for Share Transfers Who Is the Buyer? Existing Shareholder No approval needed (unless AoA says otherwise) Third Party (New Investor) 75% approval default (Law 31/1990) AoA Can Override (Law 223/2020) Set any threshold: 51% to 100% — overrides statutory default

Law 31/1990 on companies sets a default threshold requiring approval from shareholders holding at least three-quarters of the share capital. This default only applies when the AoA is silent on the matter.

Since Law 223/2020, shareholders have total freedom to set that approval threshold at any level they choose, directly in the Articles of Association. A company can require a simple majority of 51%, a unanimous 100%, or anything in between.

Law 223/2020 also abolished the old mandatory 30-day creditor opposition window that used to apply after publication in the Official Gazette. Before 2020, third-party transfers routinely took six to eight weeks because of that waiting period. Today, once the shareholders pass the resolution, the parties proceed directly to signing the transfer agreement and filing with ONRC.

This directly affects minority shareholder rights. A lower approval threshold in the AoA makes it easier for a majority to approve a third-party transfer over a minority’s objection. If you’re a minority shareholder, review your AoA carefully before any new investor enters the picture.


A legal professional signing and stamping a share transfer agreement in Romania

Every social part transfer must be documented by an attested or notarized agreement.

Step-by-Step: How to Change Shareholders in a Romanian Company

The process has six core steps. They must be completed in sequence, and each one demands accurate documentation.

6-Step Share Transfer Process
STEP 1 Draft Share Transfer Agreement Must be attested by a lawyer or notarized
STEP 2 Shareholders’ Resolution 75% approval for third parties (or AoA threshold)
STEP 3 Update Articles of Association Reflect new shareholder composition
STEP 4 File with ONRC (within 15 days) ⚠ Incomplete filings are rejected entirely
STEP 5 Update Beneficial Owner (UBO) Separate obligation with separate sanctions
STEP 6 Notify ANAF (controlling stakes) Law 239/2025 — within 15 days of transfer.
ONRC Filing Checklist
✓ Transfer agreement (lawyer-attested)
✓ Shareholders’ resolution (signed minutes)
✓ Updated Articles of Association
✓ ID documents + registration fee proof
⚠ 15-Day Deadline from Shareholders’ Resolution Missing this deadline means the transfer isn’t effective against third parties

Case Study: When Andrei came to us with a folder of incomplete online templates, steps 2, 3, and 4 all contained errors. The shareholders’ minutes used language that contradicted the AoA. The AoA itself hadn’t been updated since incorporation. The inactive shareholder had relocated abroad and was completely unreachable.

We restructured the entire dossier. We issued formal notifications to the shareholder’s last known address, documented every communication attempt to demonstrate due diligence, redrafted the shareholders’ resolution and updated AoA, and submitted a complete and consistent filing. The Trade Register approved the updated shareholding structure within three weeks. The investor transferred funds shortly after, and the company moved forward with its development plans.


What Changed in 2025 and 2026? New Rules You Must Know

Law 239/2025, published in Romania’s Official Gazette on 15 December 2025 and in force from 18 December 2025, introduced two new obligations for controlling stake transfers in Romanian SRLs: a mandatory ANAF notification and, where applicable, a debt guarantee requirement before the Trade Register will accept the filing.

Law 239/2025 — New Obligations for Controlling Stake Transfers 1. ANAF Notification (Mandatory) Transferor, transferee, or company must notify ANAF within 15 days of the transfer date Include: share purchase agreement + updated Articles of Association 2. Debt Guarantee (If Tax Debts Exist) Company or transferee must guarantee full amount of outstanding tax liabilities Options: cash deposit | bank letter of guarantee | insurance policy — enforced after 60 days 3. New Minimum Share Capital Rules New SRLs: minimum RON 500 | Turnover above RON 400,000: minimum RON 5,000 Existing companies above threshold: comply by end of 2027 | Non-compliance → dissolution risk

These changes add meaningful complexity to M&A transactions and investor onboarding timelines. When planning any controlling stake transfer, you need to factor in the time required to obtain tax clearance documentation, not just the drafting and signing process.


What Are the Tax Consequences of a Share Transfer in Romania?

For individual shareholders selling their stake in a Romanian SRL, the taxable gain is calculated as the difference between the sale price and the original acquisition cost of the social parts. Under the Romanian Fiscal Code (Law 227/2015), this gain is classified as capital income.

ScenarioTax Rate (2026)Notes
Individual — Direct Sale16% (was 10%)Most SRL social part sales; no broker involved
Individual — Via Broker (held >365 days)3%Through a licensed financial intermediary
Individual — Via Broker (held <365 days)6%Through a licensed financial intermediary
Corporate Seller16% CITGain included in ordinary profits
Corporate — Participation Exemption0%≥10% stake held ≥1 year uninterrupted

Important: Since 1 January 2026, gains from share transfers not performed through a licensed financial intermediary are taxed at 16%, up from the previous 10%. This covers the vast majority of direct SRL social part sales. Individual sellers must declare capital gains through the annual declarație unică, due by 25 May. This is separate from the ANAF notification requirement under Law 239/2025 — both can apply to the same transaction.

Getting the tax side of a share transfer right starts at the structuring stage, before documents are signed. This is one of the areas where the corporate law services side of legal work and the tax side must move together.


Reservation Agreements vs. Pre-Contracts: Understanding Shareholder Approval Thresholds

Approval ThresholdLegal BasisWhen It Applies
75% of share capitalLaw 31/1990 (default)Third-party transfers when AoA is silent
Custom threshold (51%–100%)Law 223/2020When AoA expressly sets a different threshold
No approval neededLaw 31/1990Transfers between existing shareholders (unless AoA requires it)
Unanimous (100%)AoA provisionWhen founders want maximum control over new entries

Common Mistakes That Delay or Block a Share Transfer

6 Common Mistakes That Block Share Transfers
❌ Generic Online Templates Inconsistent with your AoA → filing rejected;
❌ Outdated Articles of Association Old names, wrong capital figures → whole filing fails;
❌ Missing 15-Day ONRC Deadline Transfer not effective against third parties;
❌ Unchecked Tax Debts ONRC blocks registration without ANAF clearance;
❌ Forgotten UBO Declaration Separate obligation with separate penalties;
❌ Missing Foreign Shareholder Docs Missing apostille or translation → delayed filing.
 
✅ Solution: Professional Legal Review From the Start
 
The cost of fixing a rejected filing is always higher than getting it right the first time.

Do You Actually Need a Lawyer to Change Shareholders in Romania?

For most transfers, Romanian law already provides the answer: yes, at minimum, for document attestation. The share transfer agreement for SRL social parts must be attested by a Romanian lawyer or authenticated by a notary. You can’t skip this step regardless of how simple the transaction seems.

Beyond that legal minimum, the honest answer is: it depends on the complexity of your situation. A straightforward sale between two existing shareholders in a clean, debt-free company with a simple AoA is manageable with proper legal support on the documents. A transfer involving a third party, a new investor, a foreign national, an unreachable shareholder, or a company with outstanding tax obligations is an entirely different matter.

It’s also worth considering whether a shareholder agreement in Romania makes sense alongside the transfer. A well-drafted SHA addresses governance, exit rights, and dispute resolution mechanisms in ways the AoA alone doesn’t cover.


The Bottom Line

Changing shareholders in a Romanian company is more than an administrative step. It changes voting rights, tax obligations, and legal relationships simultaneously.

First: Follow the correct sequence from agreement to resolution to AoA update to ONRC filing, within 15 days. Any gap in the chain creates legal exposure.

Second: Know the new rules. Law 239/2025 added ANAF notification obligations and debt guarantees for controlling stake transfers, and capital gains tax on direct share sales now stands at 16%. These rules are in force now, not coming.

Third: Build the documentation correctly the first time. The cost of fixing a rejected ONRC filing or a blocked registration is always higher than the cost of professional legal support at the outset.


Related Guides & Resources

Expand your understanding of corporate and company law in Romania with these complementary guides:


FAQ – Changing Shareholders in a Romanian Company

Q: How long does it take to change shareholders in a Romanian company?

A: Once the documents are correctly prepared, ONRC typically processes a share transfer registration within 3 to 7 business days.

The 15-day filing deadline runs from the date of the shareholders’ resolution.

For controlling stake transfers requiring ANAF clearance under Law 239/2025, build in additional time for the tax certificate or guarantee approval.

Q: Does a share transfer in an SRL need to go through a notary?

A: Not necessarily. The transfer agreement can be attested by a licensed Romanian lawyer rather than notarized.

Both formats are accepted by ONRC.

Notarization is required when the transfer is structured as a gift (donation) or when the parties choose it for added evidentiary certainty.

Q: What happens if a shareholder is unreachable or refuses to cooperate?

A: The correct legal approach is to issue formal notifications to their last known address, document all communication attempts, and proceed under the legally permitted procedure set out in Law 31/1990.

Thorough documentation of every notification step is what allows the Trade Register to approve the transfer.

Q: Do I need to update the beneficial owner register after a share transfer?

A: Yes, if the transfer changes who the ultimate beneficial owner is.

Romanian anti-money laundering legislation requires companies to maintain an accurate UBO declaration with the Trade Register.

This is a separate obligation from the share transfer filing itself, and failing to comply carries independent sanctions.

Q: Can a non-resident foreigner be a shareholder in a Romanian SRL?

A: Yes. Romanian law places no nationality restrictions on SRL shareholders.

Both non-resident individuals and foreign companies can hold social parts.

However, foreign shareholders must provide authenticated and translated identity documents.

Missing or improperly apostilled documents are one of the most frequent sources of delay in cross-border share transfers.


Disclaimer: This article is for general information only and does not constitute legal advice. Please consult with a qualified Romanian corporate lawyer to verify current laws and regulations before initiating any shareholder change. Laws and procedures are subject to change, and individual circumstances may vary.

Romanian business professional reviewing GDPR compliance checklist on laptop in Bucharest office

GDPR Compliance Checklist for Romanian Companies 2025

GDPR Compliance Checklist for Romanian Companies

What crucial step could protect your business from devastating fines while building customer trust?

Many organizations underestimate how Europe’s strict data protection laws apply to their operations.

While GDPR penalties can reach €20 million or 4% of global revenue, Romanian enforcement authorities have imposed fines ranging from €3,000 to €130,000 for violations, demonstrating that penalties scale with the severity of breaches and organizational size.

GDPR compliance checklist for Romanian companies

Romania’s evolving digital economy demands proactive measures to align with rigorous privacy standards.

Legal experts emphasize that proper adherence involves more than basic policy updates—it requires systematic data governance.

Companies must address consent protocols, breach response plans, and cross-border data flows to avoid regulatory scrutiny.

Specialized legal guidance helps businesses transform compliance into strategic advantages.

Firms adopting privacy-first approaches often see improved client relationships and operational resilience.

Those delaying action risk not only financial consequences but also long-term reputational damage in competitive markets.

For tailored strategies meeting international standards, contact our data protection lawyers in Bucharest.

Our team of legal professionals provide actionable frameworks to navigate complex requirements while prioritizing business growth.

Key Takeaways

  • Data protection laws apply regardless of a company’s physical location if EU resident information is processed,
  • Penalties can reach €20 million or 4% of global revenue, emphasizing the need for preventive measures,
  • Building customer trust through transparent data practices creates market differentiation,
  • Legal experts offer customized solutions to align business operations with regulatory demands,
  • Compliance involves continuous monitoring, not just one-time adjustments.

Understanding GDPR and Its Impact on Romanian Businesses

How can organizations in Romania turn regulatory demands into strategic opportunities?

The General Data Protection Regulation (GDPR) reshapes how businesses manage information, particularly for entities handling EU residents’ data.

Its extraterritorial scope means even non-EU-based firms must adhere to strict standards when processing personal details of European citizens.

Core Regulatory Foundations

The regulation establishes six foundational principles for data handling, plus an overarching accountability principle.

These mandate that organizations:

  • Process information lawfully and transparently,
  • Collect only necessary data for specific purposes,
  • Maintain accuracy and limit storage durations.

Such requirements demand technical safeguards like encryption and operational protocols for accountability.

Privacy-by-design methodologies ensure protections are embedded in all systems.

Strategic Advantages for Local Entities

Adhering to these standards transforms obligations into opportunities.

Firms prioritizing data protection report:

  • Enhanced client confidence through transparent practices,
  • Reduced breach-related costs and operational disruptions,
  • Differentiation in markets where privacy concerns influence decisions.

For tailored strategies aligning Romanian operations with these regulations, consult our team of Romanian Lawyers.

Proactive adaptation not only mitigates risks but positions businesses as trustworthy data stewards.

Exploring Key GDPR Roles and Terminology

Who holds ultimate accountability in data governance frameworks?

Clarifying responsibilities under privacy regulations helps organizations establish clear operational boundaries.

Three critical roles form the foundation of proper data management practices.

data protection officer

Data Controllers, Processors, and Data Subjects

Data controllers determine why and how personal information is handled.

They bear legal responsibility for compliance across all processing activities.

Third-party processors execute tasks under controller directives but must independently meet security standards.

Individuals whose data is collected, known as data subjects, retain rights to access or delete their information.

Organizations must implement systems to honor these requests efficiently.

The Essential Role of the Data Protection Officer (DPO)

A data protection officer oversees compliance strategies and acts as the regulatory liaison.

This role is mandatory for entities processing sensitive data or conducting large-scale monitoring.

Under Romanian Law 190/2018, organizations processing national identification numbers (CNP) based on legitimate interest must also appoint a DPO, even if they don’t meet the standard GDPR thresholds.

This additional requirement reflects Romania’s enhanced protection for sensitive national identifiers.

Romanian businesses uncertain about role allocations should consult office@theromanianlawyers.com.

Proper classification prevents overlapping liabilities and ensures alignment with cross-border standards.

Conducting a Comprehensive Data Audit and Mapping

Organizations handling personal information must first establish clarity in their data ecosystems.

A systematic audit reveals how data flows through operations, exposing vulnerabilities while ensuring alignment with legal obligations.

This foundational step transforms raw information into actionable insights for risk management.

data audit and mapping

Identifying What Personal Data You Collect

Begin by cataloging every category of personal data your organization processes.

Common examples include:

  • Contact details (names, email addresses).
  • Digital identifiers (IP addresses, device information).
  • Sensitive records (financial data, health information).

Document each data point’s purpose, collection method, and retention timeline.

Assess whether processing activities rely on valid legal grounds like contractual necessity or explicit consent.

Storage locations demand equal scrutiny—identify physical servers, cloud platforms, and third-party repositories holding sensitive materials.

Access controls form another critical audit component.

Map which employees or systems interact with personal data and verify authorization protocols.

This process highlights potential exposure points while streamlining responses to information requests.

Romanian entities seeking structured frameworks for these assessments may contact our data protection legal specialists.

Expert guidance ensures audits meet regulatory expectations while supporting operational efficiency.

GDPR Compliance Checklist for Romanian Companies

Businesses handling EU data face operational complexity when aligning processes with privacy standards.

Structured frameworks simplify adherence while minimizing risks of non-conformance.

Effective strategies combine procedural clarity with technological safeguards to meet evolving requirements.

data protection checklist steps

Actionable Protocols for Information Security

Organizations should prioritize these critical measures:

Action ItemResponsible PartyDeadline
Complete data flow mappingIT & Legal Teams30 Days
Implement encryption protocolsSecurity Department45 Days
Update third-party contractsCompliance Officer60 Days

Consent Management Best Practices

Valid authorization requires unticked checkboxes and separate permissions for distinct processing purposes.

Confirmation emails enhance verification, while centralized logging systems track user agreements with timestamps and purpose details.

Organizations must honor withdrawal requests without undue delay and provide confirmation within one month, as required by GDPR Article 12(3).

Automated systems should flag outdated records immediately upon withdrawal, ensuring ongoing alignment with transparency obligations and ceasing processing activities promptly.

Regular audits verify adherence to storage limitation principles and access controls.

Local enterprises seeking customized frameworks may contact office@theromanianlawyers.com.

Specialized guidance helps establish resilient processes that satisfy regulatory expectations while supporting operational scalability.

Ensuring Website Security and Transparent Privacy Policies

How do modern businesses balance robust security with user transparency?

Websites storing personal information require layered defenses against cyber threats.

Organizations must adopt technical safeguards while clearly communicating data handling practices to users.

website security and privacy policies

Implementing SSL, Strong Passwords, and Anti-Virus Measures

HTTPS encryption via SSL certificates forms the first line of defense.

Multi-factor authentication and complex passwords prevent unauthorized account access.

Regular vulnerability scans and firewall updates address emerging threats.

Advanced protections include:

  • Content Delivery Networks (CDNs) to mitigate DDoS attacks,
  • Intrusion detection systems monitoring server activity,
  • Automated backups stored in geographically separate locations.

Designing Clear and Accessible Privacy Notices

Privacy policies must explain data collection purposes in plain language.

Every page should feature a visible link to these documents. Essential disclosures include:

  • Types of information gathered (contact details, device data)
  • Legal basis for processing activities
  • Third-party data sharing arrangements

Entities developing their online platforms should consult office@theromanianlawyers.com for policy reviews.

Proper alignment with privacy standards builds credibility while reducing legal exposure.

Managing Third-Party Vendors and International Data Transfers

How can businesses ensure their partners meet strict data protection standards?

Organizations relying on external vendors must verify their adherence to privacy regulations.

This requires thorough evaluations and contractual safeguards to maintain accountability across supply chains.

Evaluating Vendor Requirements and Contracts

Entities handling personal information must catalog all service providers processing data.

This includes cloud platforms, payment systems, and marketing tools.

Assessments should examine vendors’ security certifications, breach response plans, and documentation of regulatory alignment.

Legally binding agreements define responsibilities between controllers and processors.

These contracts specify permitted activities, retention timelines, and security protocols.

Subcontractor arrangements require explicit approval to maintain oversight.

RequirementActionMechanism
Vendor AccountabilityReview security auditsAnnual assessments
Data TransfersImplement SCCsContractual clauses
Risk MitigationConduct impact analysesTransfer evaluations

Cross-border data flows demand additional precautions.

Companies must confirm whether recipient countries have EU adequacy status.

For other regions, standardized contractual clauses or binding corporate rules become mandatory safeguards.

Romanian enterprises navigating these complexities should seek specialized Romanian Lawyer.

Proactive vendor management frameworks prevent regulatory violations while fostering trust with European partners.

Contact office@theromanianlawyers.com for tailored strategies addressing cross-border operational challenges.

Preparing for Data Breaches and Facilitating Data Subject Rights

What separates resilient organizations from vulnerable ones when cyber threats strike?

Proactive preparation for security incidents and efficient handling of individual rights form the backbone of modern data governance.

Organizations must balance rapid response capabilities with systematic processes to address user inquiries.

Developing a Robust Breach Response Plan

Effective incident management requires predefined protocols.

Immediate detection mechanisms trigger containment procedures within one hour of identifying unauthorized data access.

Forensic teams analyze breach scope while legal advisors determine notification obligations to authorities within 72 hours.

Regular simulation exercises test communication channels between IT, legal, and PR departments.

Documentation templates for breach reports ensure regulatory requirements are met without delays.

Continuous monitoring systems flag unusual activity patterns to prevent escalation.

Streamlining Data Subject Access Requests

Individuals increasingly exercise their right to review or delete personal information.

Centralized portals allow users to submit requests through secure authentication methods.

Automated workflows verify identities and route inquiries to appropriate teams within 24 hours.

Response templates maintain consistency while adhering to legal timelines.

Secure delivery channels protect sensitive information during transmission.

Audit trails demonstrate compliance with access rights obligations during regulatory inspections.

Entities requiring customized frameworks for incident management or user rights processes should contact office@theromanianlawyers.com.

Structured approaches transform regulatory demands into operational strengths while maintaining stakeholder trust.

FAQ

When must Romanian businesses appoint a data protection officer?

Organizations must designate a data protection officer if they systematically monitor individuals on a large scale or process sensitive categories like health records.

Public authorities in Romania also require this role regardless of data volume.

How long can companies retain customer information under EU regulations?

Storage periods must align with the original purpose for collection.

For example, transaction records may be kept for tax compliance periods specified by ANAF (Romania’s tax authority), while marketing contact lists require periodic reviews for relevance.

What technical safeguards are mandatory for website security?

Essential measures include SSL encryption, multi-factor authentication, regular penetration testing, and documented patch management processes.

Organizations should implement security measures proportionate to the risk level of data processing, following GDPR Article 32 requirements for appropriate technical and organizational measures.

Are international cloud providers like AWS or Microsoft Azure GDPR-compliant for Romanian data?

Providers operating under EU-approved mechanisms like Standard Contractual Clauses (SCCs) or binding corporate rules generally meet requirements.

However, companies must verify current certifications and update Data Processing Agreements (DPAs) annually.

What penalties apply for violating data subject rights in Romania?

The National Supervisory Authority for Personal Data Processing (ANSPDCP) can impose fines up to €20 million or 4% of global turnover.

Recent enforcement actions targeted improper consent practices and delayed breach notifications.

How should organizations handle data access requests from employees?

Businesses must respond within 30 days, providing free electronic copies of records.

Implement automated DSAR workflows in platforms like Microsoft 365 or specialized tools such as OneTrust to track and fulfill requests efficiently.