Monetising Payments: M&A in Romania’s Payments Sector

The Romanian payments market has emerged as one of the most compelling - and still largely untapped - arenas for M&A activity in Central and Eastern Europe. Having advised on one of the early landmark M&A transactions in this space - the acquisition of GeCAD ePayment by MIH Allegro (part of the Naspers group) in 2010 - our firm has had a front-row seat to the evolution of the sector. This article offers a practitioner’s perspective on the market, its regulatory architecture, the transactions that have shaped it, and the key legal considerations that any prospective buyer or seller should bear in mind.

 

1. Overview of the Romanian Payments Market

The Romanian payments ecosystem, like its more developed Western European counterparts, is composed of several distinct but increasingly interconnected layers. Understanding where a target business sits within this architecture is essential to any M&A thesis.

Processing and infrastructure. At the foundation of the ecosystem sit the card processing and interbank settlement networks. SIBS, the Portuguese payments processor is a leading operator of the core card-processing infrastructure in Romania following its acquisition of Wirecard’s Romanian operations in 2020. Transfond, the national interbank clearing house, remains under collective bank ownership and operates critical interbank infrastructure.

Payment service providers and gateways. The PSP and gateway layer has been the most active segment for M&A. This layer comprises the companies that connect online and in-store merchants to the banking and card networks, providing payment acceptance, fraud screening, and settlement services. The principal players include PayU (which evolved from the GeCAD ePayment platform following the 2010 acquisition by Naspers, later Prosus) and Netopia, which secured a majority investment from Innova Capital in 2023. Other locally incorporated PSPs that represent potential acquisition targets include EuPlătesc and PlățiOnline (C Solution).

E-money institutions and digital wallets. A growing cohort of e-money institutions and digital wallet providers operates in or into Romania, many of them under EU passporting arrangements rather than a direct Romanian licence. International platforms such as Revolut, PayPal, and Stripe all serve Romanian consumers and merchants, typically operating into Romania under EU passporting arrangements from other Member States. These players exert significant competitive pressure on locally licensed incumbents but also expand the overall addressable market.

Retail and cash payment networks. The retail payments layer encompasses physical point-of-sale and bill-payment kiosk networks. PayPoint Romania, acquired by Innova Capital from PayPoint plc in 2020–2021 for approximately €55 million, operates an extensive network of retail payment terminals. SelfPay, which operates a substantial self-service kiosk network, remains another notable player in this segment.

Emerging fintech and bolt-on capabilities. A number of smaller, technology-led businesses are developing capabilities that could be attractive bolt-on acquisitions for larger payments groups. These include Finqware (open banking connectivity), Macropay (cross-border processing), PayByFace (biometric payment authentication), and Symphopay (middleware and POS integration), which has received venture capital funding from Early Game Ventures.

Market dynamics. The Romanian market remains comparatively fragmented across its various layers - processing, PSP, retail, and clearing functions are held by distinct operators, in contrast to the more consolidated markets of Western Europe. Industry observers have compared Romania’s current position to the pre-consolidation phase experienced in Poland and Italy before the emergence of pan-European champions such as Nexi. Future M&A activity is expected to focus on three themes: (i) PSP consolidation, bringing together smaller gateway providers to achieve scale; (ii) cross-layer integration, combining processing, gateway, and retail capabilities into vertically integrated platforms; and (iii) consolidation by pan-European strategic acquirers - SIBS, PayU (Prosus), Nexi Group, Worldline, and international platforms such as Global Payments, Stripe or PayPal.

 

2. Licensing Requirements

Any prospective acquirer of a Romanian payments business must understand the regulatory and licensing framework at the outset of a transaction, as the classification of the target’s activities will have a direct bearing on deal structure, conditionality, and post-closing obligations.

Infrastructure and technology providers. Not all participants in the payments value chain require a specific payments licence. Companies that provide purely technical infrastructure - payment middleware, point-of-sale terminal software, or data analytics platforms - may fall outside the scope of the Romanian payments licensing regime altogether provided they do not themselves hold customer funds nor initiate payment. Account information services are also deemed as payment services and providers performing this type of services only are nonetheless subject to registration and supervision regime. Symphopay, for example, operates in the middleware and POS integration space, and companies in this category are able to operate under general business authorisations rather than a dedicated payments licence.

Payment institutions and e-money institutions. Companies that provide payment services as defined under Romanian law - which transposes the EU’s Payment Services Directive (PSD2) through Law no. 209/2019 on payment services - must be authorised as payment institutions by the National Bank of Romania (Banca Națională a României, or NBR). Similarly, entities that issue electronic money must obtain an e-money institution licence from the NBR under Law no. 210/2019 on the activity of issuing electronic money. The licensing process entails a rigorous assessment of the applicant’s organisational structure, governance, capital adequacy, anti-money laundering controls, and the fitness and propriety of its management. Where the target already holds a licence, the transaction documentation must address the regulatory implications of a change of control from the outset, including the requirement to notify the NBR in advance of any acquisition that crosses the qualifying holdings thresholds prescribed by law.

EU passporting. Under the EU single market framework, payment institutions and e-money institutions authorised in another EU or EEA Member State may provide their services in Romania on a cross-border basis or through the establishment of a branch, without obtaining a separate Romanian licence. This is the mechanism through which many international players - Revolut, Stripe, and others - serve the Romanian market. For M&A purposes, the distinction between a locally licensed entity and a passported operator is significant: the former may trigger NBR change-of-control notification and approval requirements, whilst the latter’s regulatory relationship will primarily be with its home-state regulator.

Practical implications for transactions. Where the target holds, or intends to apply for, a payment services or e-money licence, the transaction timeline and documentation must account for the NBR’s supervisory role. Acquisitions or disposals of a qualified holding (typically at least 10%) or changes of the qualified holding so that the proportion of the voting rights or of the share capital falls below certain thresholds prescribed by law (typically 20%, 30% or 50%), must be notified to the NBR in advance. The regulator may object to an acquisition if it considers the proposed acquirer unsuitable on grounds of reputation, financial soundness, or the risk that the institution’s prudential requirements will no longer be met. These considerations directly influence the drafting of conditions precedent and regulatory covenants in the transaction documentation.

 

3. M&A Transactions in the Romanian Payments Sector

Since the foundational GeCAD ePayment deal in 2010, the sector has seen a series of transactions, predominantly driven by private equity investors and pan-European strategic acquirers.

GeCAD ePayment / MIH Allegro (2010). MIH Allegro BV, a subsidiary of the South African media and technology group Naspers, acquired an 83% stake in GeCAD ePayment International S.R.L. in 2010. GeCAD ePayment operated an electronic payment platform facilitating online payments for Romanian e-commerce merchants. The transaction was notable for its structural complexity: it involved a pre-closing spin-off of the company’s software distribution business (the Avangate Platform). The sellers were Mr. Radu Georgescu (who controlled the company through  Orbitview Limited) and Orbitview itself. Subsequently, MIH Allegro BV also acquired the remaining stake. The platform later became PayU Romania, one of the country’s leading payment service providers.

Romcard / Provus Group (2010–2016). The card-processing backbone of the Romanian market underwent a multi-stage consolidation. In 2010, Romcard - until then owned by a consortium of Romanian banks, including BCR, BRD, Raiffeisen Bank, and UniCredit Țiriac Bank - was acquired by Provus Services Provider, a vehicle backed by the Turkish private equity investor Turkven. In January 2011, Innova Capital acquired approximately 96% of Provus and its subsidiary Romcard in a secondary buyout, and added Supercard Solutions & Services to the group in 2013. In 2016, the Provus Group (including Romcard and Supercard) was sold to Wirecard for a reported consideration of approximately EUR32 million. This transaction transferred core processing infrastructure to a major European acquirer and represented the first significant exit by a private equity investor to a strategic acquirer in the Romanian payments space.

Wirecard Romanian operations / SIBS (2020). Following Wirecard’s insolvency in 2020, its Romanian processing operations were acquired by SIBS, the Portuguese interbank payments group, in a hotly-contested auction resulting in a transaction reported to exceed EUR50 million.

The insolvency context created both urgency and complexity, but it did not seem to have a dampening effect on valuation, as the sector was regarded as highly attractive at the time - the auction reportedly drew interest from several investors - and Wirecard’s Romanian business was not exposed to the issues that caused its German parent’s insolvency. The transaction established SIBS as the leading card-processing infrastructure operator in Romania.

PayPoint Romania / Innova Capital (2020–2021). PayPoint plc, the UK-listed payments and retail services group, divested its Romanian subsidiary to Innova Capital in a transaction valued at approximately EUR55 million equivalent. Innova thus became a “repeat offender”, re-entering the Romanian payments sector it had left just a few years before. While Innova Capital is a generalist PE fund, its focus on payments demonstrates very well how sector expertise is relevant to producing good investment returns. This transaction gave Innova Capital control of one of Romania’s largest retail payment terminal networks and positioned the business as a future exit candidate, either to a strategic acquirer seeking cross-layer integration or through a secondary buyout.

Netopia / Innova Capital (2023). Innova Capital continued to execute on its buy and build model, by acquiring a majority stake in Netopia Group, one of Romania’s leading PSP and payment gateway operators. The transaction further consolidated Innova Capital’s position as the most active private equity investor in the Romanian payments sector and is expected to serve as a platform for further consolidation.

Twispay / Elrond Network (2021–2022). In a transaction at the intersection of payments and blockchain, Elrond Network (now MultiversX) acquired Capital Financial Services S.A., the e-money institution operating under the Twispay brand and, at the time, one of only two NBR-licensed e-money institutions. Announced in October 2021 and closed in March 2022 following NBR approval, the deal illustrated both the strategic value of a Romanian e-money licence - including its EEA passporting rights - and the central role of the NBR’s change-of-control approval in the execution of transactions in this sector.

The trajectory of these transactions reveals a market that has moved through its initial phase of individual asset sales and is now entering a period of strategic consolidation, with private equity and pan-European strategic buyers as the primary drivers. Major international players that have shown interest in the market but have yet to “pull the trigger” on an acquisition, such as Global Payments, may yet come to the table in search of a favourable entry point.

 

4. Key Legal Considerations for Buyers and Sellers

Drawing on our experience, we set out below the principal legal considerations that any prospective buyer or seller should address.

Regulatory approvals

Where the target holds a payment services or e-money licence issued by the NBR, acquisitions or disposals of a qualified holding or changes of the qualified holding so that the proportion of the voting rights or of the share capital falls below certain thresholds prescribed by law, must be notified to the NBR in advance. The NBR has the power to oppose an acquisition, and the timeline for regulatory review must be factored into the deal timetable. Transaction documentation in this sector typically includes detailed regulatory conditions precedent and cooperation obligations between the parties during the approval process. In addition, management board members of licensed entities must meet fitness and propriety requirements under the legislation, and any proposed changes to the management board in connection with a transaction must be coordinated with the NBR.

Licence transferability and continuity of regulated activities

A payments licence is not an asset that can be transferred separately from the licensed entity. Buyers must ensure that the target entity’s licence remains valid and unencumbered throughout the transaction process and that no act or omission by the sellers during the interim period jeopardises the licence. Share purchase agreements in this sector typically impose extensive obligations on the sellers to procure that the company maintains all authorisations required to carry on its business between signing and closing. Shareholders’ agreements may also address the company’s future licensing strategy, including detailed provisions governing the parties’ cooperation with the NBR and the decision-making process for meeting regulatory requirements.

Representations, warranties, and indemnities

Warranty and indemnity packages in payments M&A transactions require careful tailoring beyond the standard provisions found in general corporate acquisitions. Sellers will typically be asked to warrant compliance with all applicable payments legislation and regulatory requirements, the absence of any regulatory proceedings or sanctions, and the continued validity of any licences. A carefully calibrated disclosure mechanism, typically comprising a disclosure letter at signing and a supplemental disclosure letter at closing, allows sellers to qualify their warranties.

Technology and IP ownership

Payment businesses are, at their core, technology businesses - and intellectual property ownership is frequently the most complex area of due diligence and deal structuring. Where a target’s technology platform has been developed in conjunction with other business lines or shared with affiliates, the transaction will typically require a detailed allocation of software, databases, documentation, and other IP assets - often governed by a bespoke intellectual property agreement executed at closing. A particular risk that arises repeatedly in this sector relates to the IP assignment provisions in contracts with freelance developers and contractors: under Romanian copyright law, an assignment of IP rights must specifically identify the assigned rights, the permitted means of use of such rights, the term and territory of the assignment and the consideration. Where these requirements have not been strictly observed - which is common in businesses that have grown rapidly and developed their platforms iteratively using a mix of in-house and external developers - the company’s ownership of certain platform components may be open to challenge.

Non-compete and restrictive covenants

Given the relationship-driven nature of payments businesses - where merchant relationships, bank partnerships, and technical integrations represent significant value - non-compete and non-solicitation covenants are a critical feature of transaction documentation. In our experience, sellers (and, where relevant, founder-managers) are typically subject to non-compete restrictions of two to three years, covering not merely the Romanian market but also the broader CEE region in which the target’s platform may operate. Non-solicitation restrictions on customers and key employees complement the territorial non-compete.

Earn-out structures and valuation challenges

Valuing a payments business presents distinct challenges. Revenue streams are often transaction-based, with significant variability linked to merchant volumes, seasonal patterns, and the mix of payment methods accepted. Where the parties cannot agree on a fixed valuation at signing, earn-out or option-based mechanisms are common. Such structure may for example involve granting the buyer a call option and the minority shareholder a put option over the residual stake, both exercisable after a lock-up period and priced by reference to a formula linked to the company’s actual financial performance (such as gross margin) relative to an agreed business plan. This approach allows the parties to bridge a valuation gap at signing whilst aligning incentives around near-term growth. The definition of the relevant financial metric must be carefully specified (for example, by reference to IFRS principles, with express treatment of items such as capitalised development costs and aged receivables), and an independent expert determination mechanism should be included to resolve any disputes as to the calculation.

Data protection and PCI-DSS compliance

Payment businesses process large volumes of sensitive personal and financial data. Compliance with the General Data Protection Regulation (GDPR), supplemented by Romanian implementing legislation (Law no. 190/2018), is a baseline expectation - but the payments sector also imposes specific data-security obligations. Acquirers should conduct detailed due diligence on the target’s compliance with PCI-DSS (Payment Card Industry Data Security Standard), which governs the handling of cardholder data. Any data breaches, non-compliance, or remediation obligations can have a material impact and should be addressed through specific warranties and indemnities.

DORA and cybersecurity

The EU’s Digital Operational Resilience Act (DORA), which has fully applied since 17 January 2025, imposes new and detailed requirements on payment institutions and other financial entities regarding ICT risk management, incident reporting, digital operational resilience testing, and the management of ICT third-party service providers. For any acquirer, DORA compliance must now form a key part of regulatory due diligence, with particular attention to the target’s ICT risk management framework, its contractual arrangements with ICT third party service providers, including those supporting critical or important functions, and its incident response capabilities. The cost of achieving and maintaining DORA compliance may also be relevant to valuation.

Deal conditionality

Transactions in the payments sector are rarely simple enough to permit simultaneous signing and completion. Beyond the NBR notification requirements applicable to licensed entities (discussed above), acquirers should expect two further categories of regulatory clearance to feature as conditions precedent in most transactions of certain significance.

First, Romania’s foreign direct investment (FDI) screening regime - established under Government Emergency Ordinance No. 46/2022, as subsequently amended - subjects acquisitions of Romanian companies and assets in certain strategic sectors to prior review and approval by the Commission for the Examination of Foreign Direct Investments (CEFID) typically if the value of the investment exceeds EUR 5 million. The payments and fintech sector falls within the scope of this regime, particularly where the target’s activities relate to critical infrastructure, data processing, or financial services. Non-EU/EEA and EU/EEA acquirers are subject to mandatory screening depending on the nature of the target’s business. The CEFID review process typically takes 45 days from the date of a complete filing, extendable by a further 45 days in complex cases, and clearance must be obtained before completion. Failure to notify, or completion without clearance, can result in the transaction being declared void.

Second, merger control clearance from the Romanian Competition Council may be required where the parties’ turnover exceeds the applicable thresholds. In cases involving companies operating in multiple jurisdictions, the transaction may be notifiable at EU level to the European Commission (under the EU Merger Regulation) or in other jurisdictions where the parties have significant operations (though "exotic" jurisdictions in which turnover is only indirectly derived should not be ignored).

Payments businesses that operate across multiple CEE markets - as many do - frequently trigger multi-jurisdictional filing requirements, which must be coordinated carefully to avoid timing mismatches between closing conditions.

Pre-closing business conduct and interim management

The period between signing and closing is critical in payments M&A transactions, given the technology-intensive and relationship-driven nature of the business. Transaction documentation should include detailed interim operating covenants to ensure the target continues to operate in the ordinary course, maintains its regulatory authorisations, preserves its contractual relationships (including with banks and card schemes), and does not enter into material commitments that could affect its value or output. Where the transaction involves a concurrent restructuring - such as a spin-off of non-core business lines or a corporate transformation - these provisions become particularly extensive, often requiring the buyer’s prior approval of any filings with competent authorities and detailed cooperation mechanisms between the parties subject to competition rules on gun jumping and exchange of commercially sensitive information.

 

Conclusion

The Romanian payments market stands at an inflection point. A combination of structural fragmentation, growing digital adoption, and the expanding presence of pan-European strategic buyers creates a compelling environment for M&A activity. For participants considering transactions in this space, the interplay between regulatory requirements, technology ownership, and the distinctive economics of payments businesses demands specialist legal advice that is grounded in sector knowledge and practical deal experience.