Romania

Authored by: Noemi Cădariu, Managing Associate & Roman Bradu, Managing Partner What they are, how they operate, what their extraterritoriality means, and why a single dollar can bring a European transaction under United States jurisdiction For a lawyer or a compliance officer trained in European logic, US sanctions appear, at first sight, to defy territorial common sense, crossing borders without a visa or right of residence. Union law traditionally thinks in terms of territory and nationality: you answer for what you do on your own territory or for what your nationals do, yet the Office of Foreign Assets Control (OFAC), the US Treasury agency that administers economic sanctions, thinks differently. For OFAC, the question is not where the company is located or what nationality it holds, but whether a transaction touches, however faintly, United States jurisdiction. This shift of emphasis, from nationality to nexus, explains why a Romanian company may be exposed to US risk without any US partner sitting at the table: it is enough for the payment to settle in dollars through a US correspondent bank, for the product sold to contain technology of US origin, or for a name appearing on an OFAC list to surface in the counterparty’s ownership chain. We thus run, in turn, through the architecture of this regime: what OFAC is and on what it rests, what types of sanctions exist, how the lists and blocking work, what the 50% rule means, who is obliged to comply, what a US nexus is, how extraterritoriality manifests itself through secondary sanctions, how that which is otherwise prohibited comes to be authorised, and what all of this means for a European undertaking caught between two regimes. What OFAC is and on what it rests The Treasury Department has a long history in the management of sanctions. As far back as the period before the War of 1812, the Secretary of the Treasury, Gallatin, administered the sanctions imposed against Great Britain for the harassment of American sailors. During the Civil War, Congress passed a statute that prohibited transactions with the Confederacy, provided for the forfeiture of goods involved in such transactions, and established a licensing regime under rules and regulations administered by the Treasury. OFAC is the successor of the Office of Foreign Funds Control (“FFC”), which was established at the beginning of the Second World War, following the German invasion of Norway in 1940. The FFC programme was administered by the Secretary of the Treasury throughout the war. The FFC’s initial purpose was to prevent the Nazis’ use of the occupied countries’ holdings of currency and securities and to prevent the forced repatriation of funds belonging to the citizens of those countries. These control measures were later extended to protect the assets of other invaded countries. After the United States formally entered the Second World War, the FFC played an important role in the economic war against the Axis Powers, by blocking enemy assets and prohibiting foreign trade as well as financial transactions. OFAC was formally created in December 1950, after China’s entry into the Korean War, when President Truman declared a national emergency and blocked all Chinese and North Korean assets within United States jurisdiction. Its declared mission is to advance the foreign-policy and national-security objectives of the United States through economic instruments, without recourse to military force. The legal basis of the sanctions is, in the overwhelming majority of cases, the International Emergency Economic Powers Act (IEEPA) of 1977, supplemented by the Trading with the Enemy Act (TWEA) of 1917 for a few historical programmes (notably, Cuba) and by the National Emergencies Act. The mechanism is recurrent: the President declares a national emergency with respect to an external threat, issues an executive order (Executive Order) defining the prohibitions and the categories of targets, and OFAC implements the order through detailed regulations, codified at 31 C.F.R. (Code of Federal Regulations), Chapter V. To these is added, for certain programmes, specific legislation adopted by Congress (for example CAATSA, Countering America's Adversaries Through Sanctions Act, for Russia, Iran and North Korea), which may impose mandatory sanctions and may extend them beyond the executive’s margin of appreciation. It should be borne in mind that a sanctions programme is not a homogeneous statute, but a body of regulations, executive orders, designations, derogations and guidance that are read together. This fragmentation is the source of many compliance errors: what is permitted under one programme is not, by analogy, permitted under another, a feature that gives rise to confusion, to fragmentary permissions and derogations, and to ambiguity in the risk of exposure to secondary sanctions. Types of sanctions: from embargo to lists OFAC sanctions fall, according to their scope, into two broad categories. Comprehensive sanctions amount to a near-total embargo: in practice all transactions with the targeted jurisdiction are prohibited, save those that are authorised. This category currently includes Cuba, Iran and North Korea, as well as the Crimea, Donetsk and Luhansk regions of Ukraine, treated as embargoed territories. The second category is that of targeted and sectoral sanctions: here trade with an entire jurisdiction is not prohibited, only transactions with certain persons, entities or sectors. Russia is the most telling example: although it is not under a comprehensive embargo, the web of targeted and sectoral measures imposed after 2014, and massively after 2022 (energy, finance, defence), is so dense that, in practice, numerous transactions become impossible. The same logic captures Belarus, Venezuela, Myanmar and dozens of other programmes. Cutting across this division lies the distinction between primary and secondary sanctions. Primary sanctions are addressed to US persons and to transactions with a US connection, whereas secondary sanctions are addressed to non-US persons and constitute the principal vehicle of extraterritoriality and the principal stressor for companies within the European jurisdiction The OFAC list and the concept of blocking The central instrument is the SDN List (Specially Designated Nationals and Blocked Persons). Inclusion on this list triggers “blocking”: the property and interests in property of the targeted person located within US jurisdiction are frozen, and US persons are, in principle, prohibited from any dealing with the listed person. Blocking is not confiscation; it is an immobilisation. The assets remain those of their holder, but they cannot be transferred, withdrawn, used or managed without OFAC authorisation. Where a US person holds control over blocked property or receives a payment instruction involving a blocked person, it is obliged to block the transaction and to report it to OFAC. In addition to the SDN List, OFAC maintains a series of non-SDN lists, with generally less severe consequences: the SSI List (targeting sectors of the Russian economy), the FSE List (of those who evade sanctions), the NS-MBS List (menu-based sanctions), the NS-CMIC List (the Chinese military-industrial complex) and the CAPTA List (foreign financial institutions restricted at the level of correspondent accounts). These lists are updated several times a week, which turns screening into a continuous operation rather than a one-off check. The 50% rule: the trap of indirect ownership The most subtle and, at the same time, the most costly area of risk is the 50% rule. According to OFAC guidance, any entity owned 50% or more, directly or indirectly, individually or in the aggregate, by one or more blocked persons is itself considered blocked, even if its name appears on no list. The practical consequence is significant: a company may be “blocked” without appearing anywhere, and the partner dealing with it breaches the sanctions without having had any warning signal on the public lists. The rule operates through aggregation and through propagation. Aggregation means that the holdings of several blocked persons are added together: if blocked person X holds 25% and blocked person Y holds another 25% of the same entity, the entity is blocked, and the holdings are cumulated even if the persons come from different sanctions programmes. Propagation means that, once an intermediary entity itself becomes blocked (because it is owned 50% or more by blocked persons), it is treated as a blocked person in the calculation of holdings at the lower levels, so that blocked status passes in a cascade along the ownership chain. Two nuances are essential: The rule targets ownership, not control; that is, an entity that is controlled but not owned 50% or more is not automatically blocked. OFAC may, however, designate it separately or warn against transactions with entities in which blocked persons hold significant influence below the 50% threshold. Because these entities do not appear on the lists, the only real defence is due diligence on beneficial owners, the identification of holders with relevant interests, and the reporting of ownership status against the 50% threshold. This has been a cause of intensified compliance controls within KYC procedures and for the determination of the UBO, in light of the risk of secondary sanctions.Who must comply: the “U.S. person” and the extension to non-US persons The core of the compliance obligation is the US person (U.S. person). The category is broader than it seems, since it comprises (i) all US citizens and permanent residents, wherever they may be in the world, (ii) all natural and legal persons located within the territory of the United States, as well as (iii) all entities organised under US law, including their foreign branches. The exact definitions of the terms “U.S. person” and “person subject to US jurisdiction” are found in the regulations of each programme. For certain programmes, the scope extends still further: foreign branches or subsidiaries owned or controlled by US persons must, in turn, comply (this is the case, for example, of the programmes concerning Russia, Iran and North Korea). Thus, a European subsidiary of a US group may be caught within the US obligations, even though it is registered and operates exclusively within the European Union. The turning point for the non-US business environment is, however, another: non-US persons are not entirely outside the regime; they are prohibited (i) from causing, or conspiring to cause, a US person to breach the sanctions, (ii) they are prohibited from conduct that evades the sanctions, and, under certain programmes, (iv) the re-export of goods, technology or services of US origin obliges them to comply with the sanctions even if no US person is involved in the operation. To all of this is added the prohibition on “facilitation” or intermediation: a US person may not indirectly support a transaction that it could not carry out directly, for example by using a foreign company to deal with a sanctioned party while itself supplying the necessary means. US nexus: how US law reaches an apparently foreign transaction “US nexus” is the very premise of the entire system: the link, however thin, that brings a transaction under US jurisdiction and activates the primary sanctions even where the parties appear to have nothing American about them. This nexus may be created through a series of elements, satisfied separately or cumulatively. The involvement of a US person in the chain of the transaction, whether as a party or as an intermediary, adviser or service provider; The US origin of the goods: merchandise, components, software or technology of US provenance triggers US rules even after re-export; Currency is the most insidious element that draws in a US nexus: a payment denominated in dollars settles almost inevitably through a US correspondent bank, which causes a transfer between two non-US parties to “touch” the US financial system at the moment of clearing; Any use of US financial infrastructure and any conduct carried out on the territory of the United States. Thus, we encounter the dollar trap: a Romanian company that receives or pays in dollars in an otherwise purely European operation may unintentionally create a US connection sufficient for OFAC to assert its jurisdiction. For the compliance function, the first question in a risk analysis is not “do we have a US partner?”, but rather “where and through what does the value pass, in what currency, through which banks, and with what goods, resources or funds?”. Extraterritoriality: secondary sanctions, facilitation and the “causing” of a breach If primary sanctions require a US nexus, secondary sanctions are the instrument through which the United States reaches non-US persons even in the absence of such a link. The mechanism does not, as a rule, consist of a direct fine, but of an imposed choice: the non-US person who carries out a given activity with an already sanctioned party risks either being designated on the SDN List itself, or being cut off from correspondent accounts and from dollar clearing (through the CAPTA List, the Correspondent Account or Payable-Through Account Sanctions List). For a bank or a company that depends on dollar funding and settlement, the second option becomes a matter that jeopardises its very existence. The triggering criterion is, in many programmes, a significant transaction, assessed on a multifactorial basis (size, frequency, nature, the extent to which it facilitates the sanctioned activity), without a fixed monetary threshold. For example, CAATSA authorises sanctions against any person, whether US or not, who knowingly conducts a significant transaction with Russia’s defence or intelligence sector. At the level of US persons, the same extension manifests itself through the prohibition on facilitating a breach, under which OFAC sanctions conduct that causes another party to breach a programme. It is only here that the true exposure of European companies arises. They are not caught because they have done business in the United States, but because of the place through which the dollar circulates, because of the origin of a piece of equipment, or because of who is hidden, through the 50% rule, behind an apparently neutral counterparty. The lever that sustains this whole edifice is not, ultimately, the law, but the centrality of the dollar in international trade and finance: so long as access to dollar clearing remains indispensable, the threat of being deprived of that access has the force of a real sanction. Licences: how that which has been prohibited becomes lawful again A frequently misunderstood notion is that an OFAC licence lifts or removes a sanction. In reality, a licence does not repeal the prohibition; it opens a narrow and strictly delimited exception within an otherwise prohibited perimeter. Licences come as a temporary waiver, intended to mitigate the significant impact of the sanctions, so as not to create major bottlenecks in various markets (such as, for example, the energy sector) and not to paralyse pre-existing commercial relationships. There are two categories of licence, delimited by their scope, the persons or transactions covered, and their duration. The general licence (General License) is a normative and public authorisation, self-executing as a matter of law, which permits a predefined category of transactions or covers a category of persons without the need for an individual application: if the operation falls squarely within its conditions, you may act without prior approval. In this sense, a general licence, having a more abstract field of application, ordinarily authorises recurring categories of operations, for example humanitarian activities, administrative or fiscal transactions, and, most frequently, wind-down and maintenance. This last example is the most commonly encountered authorisation, since it marks the transitional period between an entity’s normal operation and its designation on the sanctions list. The wind-down period is authorised under general licences as a period of commercial adjustment, in which commercial relationships begun before the designation may be brought to a close under normal conditions, so as to avoid major bottlenecks in the affected markets, to allow suppliers to be paid, or to allow the obligations assumed by the designated entity to be performed. The specific licence (Specific License) is, by contrast, an individual document, issued by OFAC on a case-by-case basis, following a detailed application submitted through the licensing portal, in which the applicant justifies the transaction and identifies all the parties, including the beneficial owners. The specific licence applies only to the applicant or to the persons indicated in the licence; it is not public in character. The comparison between the two types of licence may be analysed from the perspective of the difference between a normative and an individual administrative act. A specific licence cannot be issued for persons or transactions/operations that fall within the scope of an already existing general licence. An important rule for the interpretation of licences must be noted, namely that licences do not transfer from one programme to another, each programme being capable of being regarded as an entire, distinct legal system. While the explanations OFAC provides under the heading Frequently Asked Questions are generally applicable to all programmes, they present elements or indications that cannot be carried over by analogy from one programme to another, unless the licence specifies as much. The compliance programme Compliance with US sanctions operates, on the civil side, on a standard of strict liability: intent is irrelevant for establishing the breach. In other words, you need not have intended to breach the sanctions in order to breach them; a good-faith error remains a breach. This standard explains why even a technical mistake can attract direct or secondary sanctions. OFAC does not impose a single compliance model, but it has published a reference framework which, although formally optional, is in practice the benchmark by which the seriousness of a company is assessed in the event of an incident. Among the essential elements of an effective international-sanctions compliance programme are (i) management commitment, which secures resources and authority for the compliance function; risk assessment, tailored to clients, products, geographies and channels, (ii) internal controls, including policies, procedures and screening against the lists of designated persons and entities, (iii) testing and auditing, to detect and correct deficiencies, and (iv) training of the relevant personnel. These components translate operationally into screening against the SDN List and the consolidated lists, the analysis of beneficial owners and application of the 50% rule, knowledge of the clientele, record-keeping, and the reporting of blocked and rejected transactions. The scope of the programme is calibrated to the risk profile: a small company does not need the same infrastructure as a global financial institution. Procedurally, OFAC has at its disposal a spectrum of responses, from the mildest to the most severe: closing the matter with no action, a cautionary letter, a finding of violation without a monetary penalty, a civil penalty, or referral to the Department of Justice for criminal prosecution. Where it intends to impose a penalty, OFAC first issues a pre-penalty notice, to which the alleged violator has the right to respond in writing, and the vast majority of cases are resolved through negotiated settlements rather than litigation. This procedural architecture is precisely what makes early cooperation and voluntary self-disclosure instruments for reducing exposure, rather than mere gestures of goodwill. OFAC in relation to UN, EU and UK sanctions For a European compliance function, OFAC rarely operates alone. A cross-border transaction must often be screened simultaneously against several regimes, convergent in purpose but distinct in reach. UN sanctions are established by Security Council resolutions and are binding on member States, but they tend to be the narrowest, focused on specific persons and on multilaterally negotiated embargoes. European Union sanctions are adopted within the framework of the common foreign and security policy and implemented through directly applicable regulations, which bind Union nationals and companies and conduct carried out on its territory, preferring, as a rule, targeted and sectoral measures to total country embargoes. Following Brexit, the United Kingdom administers an autonomous regime through OFSI, within HM Treasury. Of all of these, the US regime administered by OFAC has the broadest extraterritorial projection, precisely because of the centrality of the dollar. A number of practical consequences must be taken into account. First, a person or an entity may be listed under one regime and absent from another, so that a “clean” result on the European screening does not guarantee a clean one at OFAC, and vice versa. Next, the thresholds, the definitions of ownership and of control, and the catalogue of prohibited conduct differ from one regime to another: the Union uses, for example, its own ownership-and-control test, the application of which is not identical to OFAC’s 50% rule. Finally, licences and derogations are granted by different authorities and do not transfer between regimes. The result is that simultaneous compliance with several regimes is not the sum of separate checks, but an exercise in reconciling obligations that overlap and, more often than not, contradict one another. For a Union company, the picture is not complete without the EU “Blocking Statute”. Regulation (EC) No 2271/96, reactivated and updated in 2018 following the United States’ withdrawal from the nuclear agreement with Iran, prohibits European operators from complying, directly or indirectly, with certain US extraterritorial measures listed in its annex, which currently target the sanctions concerning Cuba and Iran, the rationale being that the Union does not recognise the extraterritorial application of laws adopted by third States. This contradiction creates a system in which you lose if you comply, but you also lose if you do not comply, since to observe the US sanctions may mean breaching Union law, while to observe the Union’s Blocking Statute may mean exposure to the US sanctions. There is, however, an authorisation/derogation mechanism through which the Commission may permit, in justified cases, compliance with the US measures where non-compliance would seriously harm the interests of the operator or of the Union. In practice, for a Romanian company, managing this conflict means less an abstract choice and more a documentary discipline: commercial decisions motivated by reasons of their own, not mechanically attributable to the US sanctions, and a conflict-of-laws analysis carried out in good time, not under the pressure of an incident. The making of the Romanian precedent: OFAC sanctions and a critical infrastructure in Romania Historically, Romania has not been a jurisdiction at the centre of international sanctions regimes, unlike States situated in conflict zones, States targeted by sectoral embargoes, or economies directly exposed to broad restrictive measures. Romania has been more of a friend to the jurisdictions that imposed sanctions, over time merely applying the sanctions adopted at European Union level or, indirectly, sanctions relevant to international commercial partners. This geopolitically favourable positioning created the conditions for the domestic regulatory framework, until the end of last year, to be oriented towards the formal implementation of international sanctions with direct applicability (such as those of the European Union), rather than towards the effective administration of major economic effects capable of causing serious bottlenecks in the Romanian markets or in strategic sectors. In other words, Romania, until recently, had not faced a situation in which a sanctioning measure adopted outside its legal system directly affected the functioning of Romanian companies, paralysed the activity of private or State legal actors, or affected the monetary flow and the economic stability of Romanian citizens. This context changed in October 2025, with the measures adopted by OFAC against actors with a significant indirect presence in the ownership chain in Romania. The OFAC sanctions shook the entire Romanian business community, since the legal framework on international sanctions did not provide for the measures the State could take to alleviate the effects of unilateral sanctions that lack direct applicability in Romania (since US jurisdiction does not benefit from the direct applicability of the European Union, but would have had to be enacted through another normative act conferring on it domestic legal force). This event laid bare the gaps in the national legislative framework, the awkwardness of all the specialists when no doctrinal treatise can answer your questions, because you find yourself on the front line of a previously unencountered legal problem, namely the capacity to mobilise in order to manage the concrete effects of the sanctions on the national economy, on job security and on energy security, for Romanian citizens and Romanian companies operating on the territory of Romania. To see how all these mechanisms fall into place in a concrete case, no example is more telling than the first in which OFAC sanctions reached, on a large scale, a critical infrastructure in Romania. At the end of 2025, OFAC designated on the SDN List, under Executive Order 14024 and for activity in the energy sector, two of the largest oil producers, together with more than thirty subsidiaries. By the mere application of the 50% rule, the blocking automatically extended to all entities owned, directly or indirectly, 50% or more by these companies, even though their names appeared on no list. Here lies the specificity of the precedent: not a direct designation of a Romanian entity, but the cascade effect of the parent company’s designation upon a critical energy-infrastructure operator, registered in Romania and owned by the designated group. The operator runs a refinery with a capacity of approximately 2.4 million tonnes per year, a network of around 300 fuel stations, representing a share of approximately 30% of the domestic market, and an 87% participation in an offshore concession in the Black Sea, in which the co-holder is a Romanian State operator with a 12% share. The stake was therefore not abstract: the indirect designation touched simultaneously the security of fuel supply, domestic fuel production, thousands of jobs and a strategic gas resource, which is why the impediment is a matter of energy security, not merely of commercial compliance. Precisely because the blocking struck consumers and assets with no direct connection to the financing of an armed conflict, OFAC put in place all the permissions necessary to minimise the impact on the European markets. The response took the form of a series of general licences, issued and extended step by step, which exemplify the logic explained above: the licence does not lift the sanction, but opens temporary windows, with clearly defined deadlines renewed periodically. The chronology, essential for anyone following the matter, is as follows: 22 October 2025: together with the designation, OFAC issued GL 124A (a specific framework for the Caspian Pipeline Consortium and Tengizchevroil projects), GL 126 (the orderly wind-down of transactions with the two companies and with the entities owned 50% or more, until 21 November 2025), GL 127 (operations concerning debt, equity and derivative instruments, until 21 November 2025) and GL 128 (fuel stations, until 21 November 2025); 14 November 2025: GL 131 authorised the negotiation and conclusion of conditional contracts for the sale of the Austrian holding through which the group holds its international assets, as well as of the entities owned by it 50% or more, plus the maintenance and orderly wind-down of those entities, until 13 December 2025; 4 December 2025: OFAC separately designated the Austrian holding and the entities owned by it and issued GL 128B, dedicated exclusively to fuel stations (maintenance, operation, wind-down), with a deadline of 29 April 2026; 10 December 2025: GL 131A replaced GL 131, extending the authorisation until 17 January 2026; January to May 2026: GL 131B, 131C, 131D and 131E successively extended the window, and GL 128C extended the authorisation for fuel stations until 29 October 2026; 28 May 2026: GL 131F again extended the authorisation for negotiations, wind-down and maintenance, until 28 June 2026. The defining feature of the entire series is, however, what the licences do not authorise. None of the iterations of GL 131 permits the actual sale, transfer or disposal of any asset: they authorise only the negotiation and conclusion of conditional contracts, the performance of which remains suspended pending a separate OFAC authorisation. Moreover, OFAC announced that any approved sale would have to sever entirely the holding’s links with the parent company and to block, in an account subject to US jurisdiction, the sums owed to the latter until the sanctions are lifted. For a critical-infrastructure operator in Romania, the practical consequence is a prolonged state of transition: it may operate and may be negotiated over, but it cannot actually be sold without a second approval, and the flow of value towards the seller remains, by design, blocked. Domestically, the situation generated a commensurate administrative precedent. Because the existing legislative framework covered exclusively the case of internationally recognised sanctions with direct applicability on Romanian territory, such as European Union sanctions, the Romanian State resorted to an emergency ordinance (OUG 66/2025 supplementing Government Emergency Ordinance no. 202/2008 on the implementation of international sanctions), which created an extended supervision regime, applicable to any company affected by unilateral international sanctions that lack direct applicability in Romania (OFAC sanctions): management remains in office, but a State-appointed supervisor oversees operations liable to fall within the scope of the sanctions, in order to reconcile compliance with the US regime with continuity of supply. Thus, we encounter the very best example of the theoretical mechanism described earlier: a Romanian entity comes under sanctions not for anything it has done, but, through the 50% rule and the designation of the parent company, the blocking takes effect even though the entity appears on no list, and the return to normality does not run through a lifting of the sanction, but through a string of general licences with short deadlines. It is, at the same time, a reminder that in sanctions matters time is measured in weeks: each thirty-day extension represents, for those involved, the difference between energy security and a potential crisis.   In summary, a company exposed to cross-border trade, investment or financial services may use the following benchmarks as a starting point: Screening all the parties, including intermediaries and banks, against the SDN List and OFAC’s consolidated lists, as a continuous, not a one-off, operation; Analysing the beneficial owners and applying the 50% rule to aggregate and indirect ownership, in light of the fact that the targeted entity may appear on no list; Identifying the US connection (US nexus) of each transaction: currency (in particular the dollar and clearing through correspondent banks), US origin of the goods or technology, the involvement of a US person; Assessing the exposure to secondary sanctions where the counterparty or the sector is targeted, especially where it depends on dollar funding or settlement; While the existence of general licences can be verified in public databases, the existence of a specific licence is private, enforceable by the party in whose favour it was issued, and the burden of proof falls on the beneficiary of the licence, through the actual document, the correspondence with OFAC and so forth; Verifying a potential conflict with the European Union’s Blocking Statute; Building and maintaining a risk-calibrated compliance programme, with the four components recognised by OFAC. The OFAC regime is not, in essence, a list of prohibited countries, but a method of projecting jurisdiction through connection, physical or virtual. For a European company, the risk comes not so much from the intention to do business with a sanctioned country, as from the invisible route of a payment, from the origin of a piece of equipment, or from a name hidden in the ownership architecture of a partner. To understand US sanctions therefore means less the memorising of lists and more learning to read a transaction: to see where exactly it touches, however discreetly, United States jurisdiction.

Authored by Roman Bradu, Managing Partner and Noemi Cădariu, Managing Associate Contextual Introduction The current energy crisis originated among the consequences of the COVID-19 pandemic in late 2021, when most European countries simultaneously faced both a shortage of resources (fuel, crude oil, natural gas, and electricity) and an unexpected surge in their prices. Naturally, although the crisis was driven by a number of economic factors, the main factors were (i) the rapidpost-COVID-19 economy, which outpaced the energy supply capacity of major market suppliers, as well as (ii) the severing of the European Union’s relations with Russia, as a direct consequence of the political context created by the armed conflict between Russia and Ukraine—depriving the EEA of one of its largest energy suppliers up to that point.   In this context, energy prices rose dramatically in a relatively short period of time, with crude oil reaching an all-time high (ATH) for the first time since 2008. Europe found itself in an extremely vulnerable position, given that our primary source of gas supply was Russia, resulting in economic growth that fell far short of projections due to the inability of both individuals and businesses to bear the costs of energy inflation.   Since all Member States have been negatively affected by the current energy crisis, the European Union has faced pressure from both individuals and, in particular, from SMEs to provide solutions to energy inflation, in the form of state aid to cover these costs without directly leading to the impoverishment of the population, the bankruptcy of companies, and, consequently, the slowdown or collapse of the economies of Member States.   The EU has taken the view that the response to the energy crisis must be unified and well-coordinated at the Member State level, within a pre-established framework, since uncoordinated and unaligned national measures could create the conditions for destabilizing the internal energy market, jeopardizing security of supply, and thereby leading to additional inflation in the Member States most severely affected by the crisis.   Consequently, it was deemed appropriate to take exceptional, temporary measures by introducing a solidarity levy on EU companies and permanent establishments operating in the crude oil, natural gas, coal, and refining sectors, in an effort to mitigate the direct economic effects of rising energy prices on public budgets, end consumers, and companies within the Union.       Trends in European Legislation The Legal Framework Established by the European Union The solidarity contribution was conceived as an appropriate means of addressing windfall profits in the event of unforeseen circumstances[1] . Thus, it was considered that the profits earned by Union companies and permanent establishments operating in the crude oil, natural gas, coal, and refining sectors could not have been achieved under normal conditions had the unforeseeable events in the energy markets not occurred. Furthermore, the main causes that led to the disruption of the energy markets (i.e., the COVID-19 pandemic and the armed conflict in Russia and Ukraine) are also considered to be unforeseeable and extraordinary events.   Thus, without substantially changing their cost structure or increasing their investments, companies in Member States, as well as their permanent establishments that generate at least 75% of their revenue from activities in the crude oil, natural gas, coal, and refining sectors have seen an increase in profits due to the sudden and unforeseeable circumstances of the armed conflict between Russia and Ukraine, the reduction in energy supplies, and the increase in demand resulting from extremely high temperatures.   Consequently, the introduction of this solidarity contribution is viewed as a joint, coordinated, and contextually necessary measure that enables the generation of additional revenue at the national level, with the aim of providing financial support to households and businesses severely affected by rising energy prices, under fair competitive conditions throughout the Union. The contribution is intended to serve as a redistributive measure to ensure that companies falling within its scope (companies that have earned windfall profits as a result of unforeseen circumstances) contribute proportionally to addressing the energy crisis in the internal market.   The basis for calculating the solidarity contribution is the taxable profits of companies and permanent establishments that are tax residents in the EU, in the crude oil, natural gas, coal, and refining sectors, as defined in bilateral treaties or in the national tax laws of Member States for the fiscal year beginning on January 1, 2022, and/or January 1, 2023, or after those dates, and for their entire respective duration. The fiscal year is determined by reference to the rules in force under the national laws of the Member States.   According to the regulation, only profits earned in 2022 and/or 2023 that exceed a 20% increase in average taxable profits generated over the four fiscal years beginning on or after January 1, 2018, will be subject to the solidarity contribution. The rationale behind this provision is to ensure that a portion of the profit margin— namely that which is not attributable to unforeseeable developments caused by the aforementioned un d circumstances, can be used by EU companies and their permanent establishments for future investments or to ensure their financial stability during the current energy crisis, including for energy-intensive industries.   The Union recommends that the solidarity contribution be used for: financial support measures for end-use energy consumers, and in particular vulnerable households, to mitigate the effects of high energy prices; financial support measures to help reduce energy consumption; financial support measures to assist businesses in energy-intensive industries; and financial support measures to develop the Union’s energy autonomy. Member States should also be allowed to allocate a portion of the proceeds from the temporary solidarity contribution to joint financing. Accordingly, Regulation No. 2022/1854 of October 6, 2022, on an emergency measure to address high energy prices was adopted, in which, among the definitions provided, we note: 15. “Union company” means a company established in a Member State which, in accordance with the tax legislation of that Member State, is considered to be resident in that Member State for tax purposes and, under a double taxation agreement concluded with a third country, is not considered to be resident for tax purposes outside the Union;   16. “permanent establishment” means any fixed place of business situated in a Member State through which the business of a company established in another State is wholly or partly carried on, to the extent that the profits of the fixed place of business are taxable in the Member State in which it is situated;   17. “Union companies and permanent establishments engaged in the crude oil, natural gas, coal, and refining sectors” means Union companies or permanent establishments that derive at least 75 % of their turnover from economic activities in the fields of extraction, mining, crude oil refining, or the manufacture of coke products, as referred to in Regulation (EC) No 1893/2006 of the European Parliament and of the Council ( 10); 18. “excess profits” means taxable profits, as determined under national tax rules for the fiscal years 2022 and/or 2023 and throughout their duration, derived from activities of Union companies and permanent establishments operating in the crude oil, natural gas, coal, and refining sectors that exceed by more than 20 % the average taxable profits from the four fiscal years beginning on or after January 1, 2018;   19. “solidarity contribution” means a temporary measure designed to address excess profits of Union companies and permanent establishments operating in the crude oil, natural gas, coal, and refining sectors, in order to mitigate exceptional price developments in energy markets for the benefit of Member States, consumers, and companies;   The solidarity contribution is addressed in Chapter III of the Regulation—Measures Concerning the Crude Oil, Natural Gas, Coal, and Refining Sectors—which sets forth in Articles 14–18: (i) the purpose of the contribution, namely the support provided to end-use energy consumers through the contribution, (ii) the basis for calculating the temporary solidarity contribution, (iii) the rate for calculating the temporary solidarity contribution, (iv) the manner of allocation and use of the proceeds from the solidarity contribution, as well as (v) the explicit provision regarding the exceptional and temporary nature of the solidarity contribution. We consider it relevant to note the following provisions: Art. 15 – Basis for Calculating the Temporary Solidarity Contribution The temporary solidarity contribution for companies in the Union and permanent establishments conducting activities in the crude oil, natural gas, coal, and refining sectors—including those that are part of a consolidated group solely for tax purposes—is calculated based on taxable profits, as determined under national tax rules, in the 2022 fiscal year and/or the 2023 fiscal year and throughout the duration of those years, that exceed by more than 20% the average of taxable profits, as determined under national tax rules, for the four fiscal years beginning on January 1, 2018, or occurring after that date. If the average taxable profit for those four fiscal years is negative, for the purposes of calculating the temporary solidarity contribution, the average taxable profit shall be deemed to be zero.   Art. 16 – Rate for Calculating the Temporary Solidarity Contribution Rate for Calculating the Temporary Solidarity Contribution (1) The rate applicable for calculating the temporary solidarity contribution shall be at least 33% of the base referred to in Article 15. (2) The temporary solidarity contribution shall apply in addition to the ordinary taxes and duties applicable under the domestic law of a Member State.   Trends in the Application of Regulation No. 2022/1854 in Member States Member States have been given the freedom to establish their solidarity contribution in accordance with current needs and in line with national legislation, in order to address the domestic consequences of the energy crisis.   Although most Member States have opted for a rate for calculating the contribution that is close to the minimum set by the Regulation (including Germany, Austria, the Netherlands, Portugal, Bulgaria, Croatia, Cyprus, and others), some Member States have implemented stricter conditions for applying the solidarity levy, either with regard to the rate used to calculate the contribution or with regard to the entities to which the levy may be applied (by expanding the sectors or business activities of the targeted companies).   One such example is Hungary, which has expanded the scope of the levy to include banks, telecommunications, and airlines—in addition to the energy sector. Another example of the expansion of the solidarity levy’s scope is Belgium, which also includes companies that derive revenue from the sale of finished products, specifically fuel, to the end consumer.   Romania is one of the countries whose measures are considered strict, applying a 60% rate for calculating the contribution. Furthermore, unlike the provisions of the Regulation, Romania extends the scope of taxpayers to include persons affiliated with the main described in Article 15 of the Regulation, as well as the affiliates of these affiliated persons, under certain conditions set forth in national legislation.   Member States: Not Exactly a Warm Welcome Undoubtedly, we believe that no one would have expected such a levy to be welcomed with open arms, especially by the taxpayers to whom it applies. The introduction of the solidarity levy on windfall profits earned by companies in the EU’s energy sector has drawn both the condemnation of all affected companies and a series of civil lawsuits filed against it.   The American giant Exxon Mobil kicked off the wave of resistance against the imposition of the solidarity levy in the fossil fuel sector by filing a lawsuit against the European Commission to block the application of the levy introduced by Regulation No. 2022/1854. Exxon enjoys the tacit support of Shell, Chevron, Total Energies, and BP.   The lawsuit, filed through its subsidiaries in Germany and the Netherlands, challenges the European Commission’s authority and jurisdiction to regulate and introduce such a levy, with Exxon arguing that this prerogative rests exclusively with member states. Exxon argues, among other things, that such a levy undermines investor confidence in a predictable business environment, thereby discouraging future investment. Specifically, in the medium to long term, imposing this levy could set the stage for further price increases, as it would require even greater imports of energy and fuels.   MOL and its Slovak subsidiary Slovnaft are pursuing a lawsuit against the Slovak government over the application of the solidarity levy, as the company suspects that the manner in which it was adopted is intended to impose an excessive tax on the company, which is owned by Hungarian shareholders[2] . Initially, the levy rate had been set at 70%, but it was lowered to 55% as a result of pressure from Slovnaft. Furthermore, under the original terms, the levy was to be paid through 2025, but was reduced—thanks to Slovnaft—for only one year.   MOL considers it appropriate to file such a claim with the arbitration court in Washington, following the example set by Exxon Mobil.   In a similar vein, at the end of February, the Spanish oil and gas company Repsol announced its intention to challenge the solidarity contribution imposed by the Spanish government, arguing that it is inconsistent with both domestic law—specifically violating the Spanish Constitution—and EU law. Iberdrola, Spain’s largest energy company, has also joined this effort.   In response, Spanish Finance Minister María Jesús Montero stated that the government is simply promoting “tax justice,” noting that it is only natural for those with the highest incomes to make an “effort” for the good of society.   To date, the courts of member states have not sided with companies in the energy sector, with most lawsuits and appeals having been dismissed or suspended. Among other things, the European Commission maintains that the measures are fully in line with EU law.   National Legal Framework Emergency Ordinance No. 186/2022 EU Regulation No. 2022/1854 required the adoption of the specified measures by December 31, 2022, and consequently, Emergency Ordinance No. 186/2022 was adopted regarding certain measures to implement EU Council Regulation No. 2022/1854 of October 6, 2022, on an emergency intervention to address the issue of high energy prices.   The main purpose of the ordinance is the national implementation of EU Regulation No. 2022/1854, and thus the introduction of a solidarity contribution/tax for companies in the European Union and permanent establishments operating in the crude oil, natural gas, coal, and refining sectors; this contribution is temporary and exceptional in nature.   The ordinance applies to the following entities for the purpose of paying the contribution: Commercial companies engaged in activities under the following CAEN codes: 0610 – “Extraction of crude oil,” 0620 – “Extraction of natural gas,” 0510 – “Extraction of coal,” 1910 – “Manufacture of coke products,” and 1920 – “Manufacture of petroleum refining products” and for which these activities account for 75% or more of their total revenue Entities subject to corporate income tax and microenterprise income tax that are affiliated with the taxpayers referred to in the preceding paragraph, when they derive at least 50% of their 2022 or 2023 revenue, respectively, from transactions with affiliated entities Entities subject to corporate income tax and microenterprise income tax that are affiliated with the entities referred to in point 2, when they generate at least 50% of their 2022 or 2023 revenue, respectively, from transactions with affiliated entities   According to the provisions of the Tax Code, the following legal entities are considered affiliated entities: A legal entity is affiliated with another legal entity if the former holds, directly or indirectly—including holdings of affiliated entities—at least 25% of the value or number of equity interests or voting rights in the other legal entity, or if it effectively controls that legal entity or a legal entity is affiliated with another legal entity if a person holds, directly or indirectly—including through holdings of its affiliates—at least 25% of the value or number of equity interests or voting rights in both the first and second legal entities, or if that person effectively controls them   Excess profit is the profit that exceeds by more than 20% the average of taxable profits, as determined under national tax rules, for the four fiscal years beginning on January 1, 2018, or occurring after that date.   The amount of the solidarity contribution provided for by national provisions shall be 60%, calculated in accordance with the guidelines set forth in Article 2 of the Ordinance   The contribution is calculated, reported, and paid annually by June 25 of the following year or by the 25th of the sixth month following the end of the modified fiscal year or different financial year.   Amounts representing the solidarity contribution shall be paid into a separate, readily available account in lei, opened at the State Treasury offices within the competent central tax authorities, identified by the taxpayer’s tax identification number.   Subsequent Legislative Process After a somewhat difficult legislative process—involving several reexaminations—Law No. 119/2023 was finally adopted to approve Government Emergency Ordinance No. 186/2022 on certain measures to implement Council Regulation (EU) 2022/1,854 of the Council of October 6, 2022, on an emergency response to address high energy prices.   In addition to approving the Emergency Ordinance, the Law expands the scope of application of the solidarity tax by including additional categories of taxpayers, under certain conditions, as well as a different calculation method for the newly included taxpayers.   Thus, the scope of application is extended to entities subject to corporate income tax or micro-enterprise income tax that (i) carry out activities in the sectors specified by EU Regulation 2022/1854 and (ii) engage in both crude oil extraction and refining activities. For this category of taxpayers, it is no longer necessary to meet the conditions regarding the proportion of the activity in total revenue, as this is an exceptional category of taxpayers.   The contribution owed by the newly included taxpayers is calculated separately, with a fixed amount of 350 lei per metric ton of crude oil processed in refining operations.   Furthermore, the Law introduces another exception to the calculation of the contribution, concerning taxpayers who did not generate production from the fields specified in Article 1(1) of the Ordinance—for reference, the taxpayers described in the first subparagraph of paragraph 6—during the 2018–2021 period, taxpayers who will be exempt from paying the solidarity tax.   Red flags—are they truly present or merely fictitious?   Observing the national legislative process for implementing the exceptional solidarity contribution tax, it has exhibited extreme tendencies at every stage of implementation, manifested by (i) the high rate used to calculate the contribution, (ii) the two-year period of applicability of the contribution, (iii) the ambiguous definition of the group of taxpayers subject to the solidarity tax, as well as (iv) constant political pressure to expand the group of taxpayers required to pay the solidarity tax.   Since this is an exceptional levy—and therefore inherently temporary—and given the conditions under which it is implemented compared to other Member States, we can objectively consider Romania’s approach to be excessive, placing a burdensome financial burden on companies operating in the energy sector.   In the context of the energy crisis, mitigating the imbalance between supply and demand should have been aimed exclusively at assisting the disadvantaged population genuinely affected by rising energy prices—assistance that should have been immediate and effective—especially during the winter of 2022–2023, when the danger was imminent.   Following the European trend that has leaned toward rejecting the legitimacy of the solidarity tax that was introduced—in the absence of European case law (to date), as well as in the absence of methodological guidelines for establishing the framework for implementing the solidarity tax in national legislation— the official interpretation by the tax authorities will also take shape as the first payment deadline approaches at the end of June. [1] Explanatory Memorandum to EU Regulation No. 2022/1854 of October 6, 2022, on an emergency measure to address high energy prices [2] The suspicion stems from statements made by former Finance Minister Igor Matovič, who described this levy as a measure through which Slovakia would be able to extract more money from Hungarian property owners.

Authored by Noemi Cădariu, Managing Associate Sure, ChatGPT writes our emails, drafts our LinkedIn posts, translates documents, and generates content that substantially reduces the time spent on a single task. The widespread adoption and normalization of artificial intelligence in our daily lives—both at work and at home—creates even more room for error, as we place blind trust in content generated without citing sources, in a format that’s easy to take “as is,” instantly translated into any language, created by software capable of sensing or reading its audience (in the term “sentient,” which is difficult to translate). Furthermore, we wish to highlight the ease with which the end user of a piece of material, document, result, or response can be misled—how do we distinguish between an AI-generated response and one provided by a competent person who knows their field? How do we distinguish between an author’s manuscript and a text generated by AI that has learned their writing style? How do we distinguish a lawyer’s legal opinion from one written by AI with access to legislation? After all, both come with a disclaimer. How do we manage, at the end of the day, to actually recognize the human factor? We are aware of the obvious downside to the daily benefits that artificial intelligence brings in automating and streamlining tasks: the laziness of the human mind, both from an active perspective—by shifting active components of a project onto the AI —as well as from a passive perspective—by easily and quickly obtaining information perceived as truth but never verified. But what are we doing about the neglected phenomenon of deepfakes? We smile when artificial intelligence generates content favorable to us, losing sight of the fact that there are always two sides to every coin, and that AI content—being in constant development—can at any time generate content that is completely unfavorable to humans (individually or as a group). What, exactly, is the deepfake phenomenon? A deepfake is an advanced form of digital manipulation of media content, involving the use of machine learning (i.e., artificial intelligence) and image generation technologies to create fake audio, photo, or video material that appears authentic and credible. The term “deepfake” combines the concepts of “deep learning” and “fake,” reflecting the very complexity of its sophisticated nature. The process of creating deepfake visual content involves a deep learning algorithm (deep AI) trained on a significant amount of data (photos, video, or audio recordings) related to the target person of the desired content. The algorithm is trained to learn the target person’s facial and vocal characteristics in order to recreate and manipulate any kind of media content—ultimately with the goal of making that person appear to be in a certain place, saying certain words, or performing certain activities that, of course, did not actually happen and do not reflect reality. There are various techniques used in the process of creating deepfakes, among which we note the generation of images using generative adversarial networks—that is, a pair of neural networks with diametrically opposed objectives, one tasked with generating fake content and the other with detecting fakes. This system thus creates an iterative process through which the quality of the fakes improves via simultaneous positive and negative reinforcement. Although it may seem like a form of creative entertainment when its purpose is harmless, the deepfake phenomenon is overshadowed by a dark cloud of malicious intent, ranging from political manipulation and propaganda to pornographic content (with an alarming percentage of child pornography). According to an analysis by Deeptrace Labs, over 96% of the deepfake content identified online in 2019 was non-consensual pornographic content—where the victims include both public figures and ordinary people, both adults and minors, predominantly women, thereby exacerbating the phenomenon of revenge porn. In the political sphere, the dissemination of visual and audio deepfake content is capable of creating hysteria, inciting violence, and spreading propaganda more easily than through any other communication channel, particularly on social media platforms—especially given that the tendency to verify the sources of content consumed on these platforms is steadily declining. For example, deepfake images and videos were widely circulated during two highly publicized armed conflicts of our time, namely the Russia-Ukraine and Israel-Hamas conflicts, generating false political statements attributed to the leaders of these countries (including (i) Volodymyr Zelensky’s deepfake speech in which he ordered Ukrainians to surrender to the Russian army[1] , (ii) deepfake content about victims of the Israel-Hamas conflict[2] , (iii) Iranian hackers disrupting broadcasts in the UAE with deepfake news[3] , and (iv) the deepfake interview with President Vladimir Putin[4] ). Although efforts are currently underway to improve countermeasures against the negative effects of deepfake content—through the development of technologies to detect this type of content and by attempting to educate the general public in the critical evaluation of falsified media content—such a result is unrealistic at this time. Given the way information is consumed—particularly the speed at which we actually consume the content we scroll through every day— on social media platforms designed to deliver dopamine through short, concentrated, and fast-paced content—discerning and filtering the information we consume becomes a utopian concept, especially for Gen Z and subsequent generations, who have not been instilled with the principle of “check first, then believe.” Furthermore, with the delayed identification of deepfake content, this type of content has enough time to linger online, spreading false and misleading information, inciting violence, hatred, and racial segregation, as well as destroying the reputations of women who are victims of the wave of deepfake porn. By the time such an image or recording is identified as machine-generated, the damage has already been done, reputations have been tarnished, and the public has been influenced. The European Approach to the Deepfake Phenomenon and National Regulation The European stance At the end of 2022, the European Commission proposed a new directive to combat violence and domestic violence against women in various forms. Currently, the European Council and the European Parliament support the proposal to criminalize, among other things, the non-consensual distribution of AI-generated pornographic content, with the aim of curbing the phenomenon of revenge porn. The EU’s response comes in the wake of the most recent deepfake porn scandal, in which Taylor Swift herself was the victim earlier this year, with the video garnering over 45 million views online. Since early February, the European Union has proposed criminalizing the distribution of such content within the EU (including revenge porn and online harassment)—a measure expected to take effect in mid-2027. European Commission Vice President Věra Jourová told Politico[5] that “the latest repugnant way to humiliate women involves distributing intimate images generated by artificial intelligence in less than a few minutes. Such images can cause serious harm, not just to pop stars, but to any woman who will then be forced to prove at work or at home that those images are the result of deepfakes.” At the EU level, the European Parliament approved on Wednesday, March 13, 2024, the regulation on artificial intelligence, the EU AI Act, considered to be the world’s first official regulation of artificial intelligence. The European Parliament’s priority is to ensure that AI systems used in the EU are safe, transparent, traceable, non-discriminatory, and environmentally friendly. In particular, the aim is for these systems to be supervised by humans—rather than through automated processes themselves—to prevent harmful outcomes resulting from their use. Within the scope of these regulations and future sanctions, the phenomenon of deepfakes is also addressed as a component of generative artificial intelligence systems. We emphasize that the adoption of such a regulation represents a global first, positioning the EU as a leader in establishing a legal framework for artificial intelligence systems, a regulation that will certainly serve as a source of inspiration for non-member countries, particularly the U.S.—where the phenomenon is far more widespread than within the EU. Final approval will be granted by the Council of the European Union—expected by the end of 2024—and the regulation will enter into force 20 days after its publication in the Official Journal, while the prohibitions and restrictions will take effect 6 months from that date. The application of certain restrictions and bans may be deferred for up to 12 months after the directive enters into force; however, all other obligations set forth in this directive will be enforced, without exception, no later than 36 months after its entry into force, i.e., by the end of 2027 (under current conditions). The Act regulates different risk categories regarding various artificial intelligence systems, ranging from unacceptable risk—considered a threat to people and therefore prohibited (i.e., the biometric identification and classification of individuals)—to high risk—which has a negative impact on people’s safety and fundamental rights and must be assessed before being placed on the market (i.e., software for managing migration, asylum, and border control; software that assists in the interpretation and application of the law), and limited risk—a category that includes general and generative artificial intelligence (i.e., ChatGPT; systems that generate and manipulate images, audio, and video content, such as deepfakes)[6] . However, it is important to note that these rules and classifications were created and drafted three years ago, at a time when applications such as ChatGPT and OpenAI did not have the popularity and prevalence they have today—nor did they possess such learning capabilities and such an extensive database. Given their prevalence, ease of access, and the potential factual and legal implications of this type of output, the classification of generative content systems as “low-risk” may be “upgraded” to a higher risk level over time. National Legislative Framework At the national level, however, as early as April 2023, Bill No. 471/2023 on the responsible use of technology in the context of the deepfake phenomenon was introduced; it is still under review—sent for further report to two committees, with a deadline of March 1, 2024, a deadline that has already passed. In the explanatory memorandum, the Romanian legislature takes into account the rapid development of technology, artificial intelligence, and techniques for creating artificial virtual reality, as well as the impressive advances in machine learning tools, deeming it necessary to intervene to limit the malicious effects of the false content generated by these tools. The legislature also points out that experts in the field consider deepfakes to be far more dangerous and to have a much greater impact than the fake news disseminated in the media to which we are already accustomed, since deepfakes can generate both visual and audio content intrinsically linked to the victim being impersonated. We therefore welcome the initiative of Representative Eugen Bejinariu and Senator Robert-Marius Cazanciuc, as the sponsors of this bill, and concur with the view expressed regarding the deepfake phenomenon—namely, that the creation and distribution of such materials (referred to as “severe fakes”) constitute—each, in its own material form—a deliberate act, carried out with discernment and direct intent, aimed at harming the victim’s image, reputation, or dignity through the dissemination of misleading and falsified materials that create the appearance of originating directly from the victim or place the victim in scenarios that do not reflect factual, objective reality. We include, by way of example, the use of deepfake technology to portray the President of Romania in a derogatory video, the accuracy of which comes close to mimicking a real video and speech[7] . We can easily dismiss such content when we assume it is fake and when its very title makes it clear that it was generated by AI software; however, without these assumptions and given the continuous development and refinement of such software, how much longer will we truly be able to distinguish it? In the form adopted by the Senate, the law provides four articles, including the definition of its scope of application, the definition of the deepfake phenomenon, the conditions under which AI-generated material must disclose its nature, and who is responsible for verifying compliance with these legal requirements. The law defines the “deepfake” phenomenon as “any falsified image, audio, and/or video content created, as a rule, using artificial intelligence, virtual reality, augmented reality, or other means, such that it creates the appearance that a person has said or done things to which they have not given their consent, and which in reality were not said or done by that person.” The distribution and broadcast of such deepfake materials in the media are prohibited unless they are accompanied by a warning displayed on at least 10% of the screen area and throughout the entire duration of the broadcast of the visual content, or by an audio message at the beginning and end of the audio content: “This material contains fictional scenes.”   Undermining the credibility of previously indisputable evidence What disservice are we truly doing to ourselves by perfecting generative artificial intelligence systems? In terms of evidence, at least until now, imagery (photos or videos) as well as audio and audio-video recordings have been—in both criminal and civil trials—indisputable evidence, evidence whose authenticity was rarely contested, evidence on which we could rely without question. However, in this surreal context where: we can create an omniscient person—who appears in multiple places simultaneously in surveillance footage or photographs; we can portray an individual in a place, circumstance, or context in which they have never been; we can generate false testimonies, confessions, and statements—attributed to a person who never made them; we can manipulate or generate/fabricate evidence—e., alter the content of surveillance footage or images from searches; we can create events through photos or videos that simulate an event that never happened—which is important for linking persons of interest to an alleged event; We can defame and discredit any individual by spreading deepfake content that depicts them engaging in illegal, scandalous, defamatory, and—most likely—false behavior, ultimately damaging their reputation; We can discredit witnesses, either by creating content that contradicts their statements or by placing them in other locations in time and space that would make it impossible for them to have been present as witnesses to the events they are testifying about; we can easily clone and steal identities for the purpose of committing fraud (cyber, banking, financial) by impersonating a real person whom people trust and to whom they will provide personal data; we can easily violate people’s privacy and harass them online by creating fake profiles with deepfake content that portrays the person in question in unrealistic situations capable of damaging their reputation; we can forge documents by cloning logos and stamps, artificially imitating handwriting styles, or simply making credible alterations to only certain parts of documents, which can ultimately have financial or even criminal implications. Although such content could be generated in the past, it was far more rudimentary than content developed by artificial intelligence—which is constantly refining its work to perfectly mimic the human element—and the programs were not readily accessible to the general public. Now, with a single Google search—accessible to anyone (including minors)—we can find dozens of software programs available for free or at a minimal cost, where even the most basic and accessible software can generate credible content. The proliferation of deepfake content is constantly on the rise; the software already available is becoming increasingly sophisticated and user-friendly, making it easy for anyone to generate, in under 30 minutes, content capable of causing serious reputational damage to the chosen victim. Furthermore, unlike news platforms or traditional media, social media platforms do not filter their content through human verification, but rather through bots that are, unfortunately, far too easy to fool. Social media algorithms can quickly spread (sometimes in a matter of a few hours) deepfake material to tens or hundreds of thousands of users, and the support provided by these platforms is slow, with minimal chance of reaching a human representative beyond the support bots. Thus, although the content may be removed after numerous appeals and reports—a process that can take days or even weeks—the deepfake has time to circulate, linger, cause outrage, and quietly poison public opinion, without the pressure of a ticking clock. Finally, in the context of generative artificial intelligence, which floats freely online and is accessible to anyone who wants it, in the complete absence of a legal framework governing AI tools that would impose limitations or clarify who is actually liable for the harm caused by such content (especially when the author cannot be identified), data protection is expanding its scope to include databases that can access your personal images (such as Facebook, Instagram, TikTok, Twitter, WhatsApp, etc.). [1] Deepfakes from the Gaza War Fuel Fears About AI's Ability to Mislead | AP News [2] TikTok Struggles to Remove Deepfake Videos of Hamas Victims (bloomberglaw.com) “They follow a similar pattern: a tragic death appears in the news, and within a few days or even hours, users post videos featuring a lookalike of that person, recounting how they died. The format of this trend typically includes an introduction from that person’s perspective and a doctored image of them on screen, telling the story of how they died.” [3] Iranian Hackers Interrupt UAE Broadcasts With Deepfake News (voanews.com) [4] OECD AI Policy Observatory Portal [5] Taylor Swift deepfakes nudge the EU to get real about AI – POLITICO [6] EU AI Law: The First Regulation on Artificial Intelligence | Topics | European Parliament (europa.eu)   [7] Iohannis: Do You Want to Be a Billionaire? [deepfake] (youtube.com)

Authored by Noemi Cădariu, Managing Associate and Roman Bradu, Managing Partner In practice, the analysis of risks posed by international sanctions is often reduced to a seemingly simple question: Can a transaction be conducted with a specific person, or not? In most cases, the verification process begins with the OFAC lists and, at times, ends there as well. However, such an approach overlooks the fact that exposure to sanctions does not arise exclusively from direct dealings with a designated person but, more often than not, results as an indirect consequence of an insufficiently verified chain of ownership. The mere fact that a person does not directly participate in a transaction is not sufficient to rule out the risk of sanctions. The risk may arise even when a person does not carry out the prohibited transaction themselves but contributes to its execution by another party through financing, approval, guarantee, coordination, advice, or intermediation. This is the scope of the concept of facilitation, a central notion in the architecture of U.S. sanctions, but one that remains insufficiently analyzed in local practice and, consequently, is frequently underestimated by companies. Conduct that, viewed in isolation, may seem incidental—such as approving a transaction, providing advice, processing a payment, or assuming a guarantee—may, under certain circumstances, constitute a form of prohibited participation under the regulations administered by OFAC. For practitioners and companies in non-U.S. jurisdictions, the analysis must be conducted on two distinct levels. On the one hand, it is necessary to understand the facilitation prohibition applicable to U.S. persons, and on the other hand, it is necessary to identify the legally distinct mechanisms through which a non-U.S. person may incur its own exposure to U.S. sanctions.  i.    What Does “Facilitation” Really Mean in OFAC Regulations? The classic formulation of the prohibition is found in the Iranian sanctions regime. According to this regime, no U.S. person, wherever located, may approve, finance, facilitate, or guarantee a transaction by a foreign person when that transaction would be prohibited if it were conducted by a U.S. person or within the United States.[1] The central idea is deceptively simple: a U.S. person is prohibited from doing indirectly what they cannot do directly. This provision is not unique to the Iranian program. OFAC treats facilitation as a cross-cutting principle of IEEPA-based embargo programs. Where the text expressly provides for it, the prohibition is explicit; where the text is silent, OFAC considers it implicit, based on the premise that facilitating a transaction by a foreign person is prohibited whenever that transaction would be prohibited if it were carried out directly by a U.S. person.[2] In practice, the absence of an express mention does not equate to authorization. The range of covered conduct is broad, and the most detailed interpretive provision—which remains from the Sudanese regime even though it was formally removed from the regulations in 2018—describes facilitation as any unlicensed action by a U.S. person that assists or supports the targeted commercial activity. The same provision also sets the lower threshold, namely that purely clerical or reporting activities that do not in themselves support the transaction are not prohibited. Reporting the results of a subsidiary’s trade is permitted; financing or insuring that trade constitutes facilitation.[3] The line extends to actions that a practitioner might consider mere business courtesies. Referring a business opportunity to a foreign person, when the referred transaction would be prohibited if carried out by the U.S. person, is itself prohibited.[4] Consequently, the very concept of facilitation becomes an elastic notion that can, in principle, encompass almost any associated action—no matter how indirect or through how many layers—linked to a sanctioned target. ii.    Counterfactual Analysis and Implicit Facilitation Precisely because it is so broad, the prohibition also has a limiting mechanism that, however, functions counterintuitively, in the opposite direction. A transaction constitutes prohibited facilitation only if it is a transaction in which the U.S. person could not have engaged on its own without a license. In other words, the question is not merely what the U.S. person did, but what they would have been permitted to do had they been the contracting party. When the underlying transaction would have been permitted to a U.S. person—either because it is exempt or because it is authorized by a general license—facilitating it is not prohibited.[5] Simply put, if you can do it on your own behalf, you can also act as an intermediary. The practical consequence is that, in some cases, the legal characterization depends on a counterfactual analysis: not of the transaction that actually takes place, but of the hypothetical one in which the U.S. person would have been directly involved. This nuance is essential when drafting legal opinions. A conclusion regarding prohibited facilitation cannot be reached without first reconstructing the regime applicable to the transaction had it been conducted directly, including the relevant general licenses and their purpose. iii.    The U.S. Nexus: When Jurisdiction Applies The facilitation prohibition revolves around the concept of a U.S. person. This includes any U.S. citizen, lawful permanent resident, entity organized under U.S. law—including its foreign branches (hence the potential difficulties arising within the European Union and Romania)—as well as any person physically present in the United States.[6] Around this core lies the U.S. nexus—that is, the set of connecting factors that trigger the application of OFAC sanctions: the involvement of a U.S. person, the conduct of part of the transaction on U.S. territory, the use of U.S.-origin goods or technology, and—of overwhelming practical importance—the clearing of dollar payments through the U.S. banking system. Since nearly all dollar transfers are settled through banks located in the United States, a payment in dollars to or from a sanctioned party may trigger the application of U.S. sanctions even in the absence of any other connection to the United States.[7] The currency of payment, a detail often treated as a commercial matter, thus becomes a veritable jurisdictional trigger. iv.    How do non-U.S. persons create exposure? This is where one of the most common misunderstandings arises, including in Romanian practice. The prohibition on facilitation, strictly speaking, applies to U.S. persons; thus, a Romanian company or its client will not, as a rule, be directly subject to this prohibition, as long as they are not U.S. persons. However, this does not preclude a non-U.S. person from being subject to the sanctions regime. Such exposure may result from other legal rules and mechanisms, distinct from facilitation, but which are often improperly grouped together in practice under the same term. The first avenue is the facilitation of a violation: non-U.S. persons are prohibited from inducing or conspiring to induce U.S. persons to violate sanctions, as well as from engaging in conduct that circumvents or avoids a violation.[8] The typical scenario, as recognized by OFAC, BIS, and the DOJ in their joint compliance guidance specifically addressed to non-U.S. persons in March 2024, involves routing a prohibited payment through the U.S. financial system, thereby inducing a U.S. bank—whether knowingly or unknowingly—to process a blocked transaction. This also includes obscuring or omitting references to a sanctioned party in order to induce a U.S. bank to execute a transaction that it would otherwise have rejected.[9] The second avenue is the anti-evasion clause in the executive orders themselves: in the case of Russia, Executive Order 14024 prohibits any transaction that evades, circumvents, is intended to evade or circumvent, results in a violation of, or attempts to violate the order’s prohibitions, as well as any conspiracy formed for th .[10] Unlike the classic facilitation provision, this clause is not expressly limited to U.S. persons, and its broad wording also captures non-U.S. conduct aimed at undermining the regime. The third avenue—and the one most relevant to institutions—is secondary sanctions: these affect non-U.S. persons even in the absence of any U.S. nexus. For example, Executive Order 14114 of December 2023 amended Executive Order 14024 and authorized OFAC to impose sanctions on foreign financial institutions that have conducted or facilitated significant transactions for designated persons in the targeted sectors, or involving Russia’s military-industrial complex, with sanctions ranging from restrictions on correspondent accounts to complete freezing.[11] However, OFAC does not treat as circumvention or evasion the efforts of non-U.S. persons to comply by replacing sanctioned suppliers, service providers, or financial institutions with non-sanctioned partners.[12] The legitimate restructuring of a supply chain for compliance purposes is therefore not prohibited conduct. The distinction between evading sanctions and complying with them by bypassing the sanctioned party is subtle but crucial, and must be explicitly upheld when a company selects its contractual partners. v.    The Distinction from Direct Transactions Understanding the concept depends on a clear distinction: a direct transaction is one in which the U.S. person, or an operation with a U.S. nexus, is itself a party to the prohibited relationship. Facilitation covers the situation in which the U.S. person is not a party but facilitates the transaction: by approving, financing, guaranteeing, or supporting it. The very rationale for the concept is to close the loophole whereby one could argue, “I did not transact with the sanctioned party; rather, it was my foreign subsidiary, my consultant, or the bank through which the payment passed.” For this reason, for a non-U.S. person, the risk becomes real the moment a U.S. element appears in the structure: an employee or officer with U.S. citizenship or residency who approves the transaction, a U.S. subsidiary or parent company, a U.S. consultant providing guidance, or a payment in dollars. At that point, two worlds that seemed separate—that of the prohibition on facilitation and that of non-U.S. exposure—intersect, and the seemingly neutral action of a U.S. person within the structure can turn an otherwise peripheral transaction into a violation. vi.    Case Studies: Lawyers and Consultants, Banks, Freight Forwarders/Shipping Companies Enforcement practice shows how little professional title matters and how much the role played in the operation matters. Banks: The archetypal case remains BNP Paribas. In 2014, the French bank reached a global settlement of approximately $8.9 billion, of which the OFAC component was $963 million—at the time, the largest OFAC settlement. The sanctioned conduct consisted of concealing, removing, omitting, or obscuring references to sanctioned parties in 3,897 transactions routed to or through U.S. banks between 2005 and 2012.[13] The lesson for a non-U.S. bank is clear: no connection to the United States beyond settlement in U.S. dollars was necessary for U.S. regulations to apply, and the technique of concealing the parties transformed the bank from a mere payment channel into a participant in the violation. Consultants: The Schlumberger Oilfield Holdings case, settled in 2015 with a $232 million agreement, was explicitly built on the theory of facilitation. The alleged conduct was not a direct transaction with Iran or Sudan, but rather the approval of expense reports and the provision of consulting and business guidance for operations conducted in those jurisdictions.[14] In other words, internal support and expert advice, provided from a U.S.-linked position, were sufficient to trigger liability. Lawyers/gatekeepers: In 2025, OFAC reached a settlement of $215,988,868 with GVA Capital, a San Francisco-based venture capital fund that had managed the assets of a Russian oligarch designated as an SDN. The significance of the case, beyond the amount involved, lies in the message it conveys: in its press release, OFAC emphasized the role of gatekeepers, citing as examples investment professionals, accountants, lawyers, and providers of company and trust formation services, and warned them to remain vigilant against the risk that sanctioned parties or their representatives might use professional services to conceal a financial interest or to evade sanctions.[15] For the legal profession, the warning is hard to ignore: structuring, representing, or managing assets for the benefit of a sanctioned party can result in personal liability. The logistics sector offers two recent examples. In 2022, the Australian freight forwarding company Toll Holdings was sanctioned by OFAC for deficiencies in its compliance program regarding complex international transactions, in an action viewed at the time as a warning to foreign corporations.[16] In 2025, the Houston-based freight forwarder Fracht FWO Inc. agreed to a settlement of $1,610,775 for its involvement with a Venezuelan government- d airline subject to sanctions and an aircraft operated by Iran’s Mahan Air, in connection with the Venezuela, Iran, proliferation, and global terrorism programs; The conduct was characterized as serious and not voluntarily disclosed.[17] The common message from these two cases is that a transportation service provider cannot hide behind its operational role: arranging, subcontracting, or settling a shipment involving a sanctioned party is, in OFAC’s view, a form of support for a prohibited transaction. vii.    Relevance for Practice in Romania For a Romanian company and its clients, the risk map looks different from that of a U.S. person, but it is no less complex. The classic prohibition on facilitation affects us indirectly, to the extent that the client’s structure includes a U.S. element. The main avenues of exposure remain the determination of a violation by a U.S. person—particularly through payments in U.S. dollars—the anti-circumvention clause in applicable executive orders, and, for financial institutions, the strict secondary sanctions introduced in the Russian context. In the context of designations in the critical energy sector under Executive Order 14024, this means that the analysis cannot stop at the question of whether the client is transacting directly with a designated entity. One must also examine the currency and payment channel, the presence of any U.S. person in the decision-making structure, whether the entity is a financial institution exposed to secondary sanctions, and the sometimes fine line between a permissible compliance restructuring and a restructuring that could be construed as circumvention. The concept of facilitation is therefore not a mere curiosity of U.S. law, but rather the framework through which every transaction must be analyzed when a sanctioned party is present anywhere—no matter how distant—in the transaction chain. If there is one conclusion to take away, it is that distance from the sanctioned party does not, in and of itself, equate to legal certainty. Between transacting directly and having no connection at all lies a vast territory, in which approving, financing, advising, transporting, or settling payments may be sufficient. Under this umbrella, merely refraining from action—in the sense of not being a direct party—is not enough. [1]31 C.F.R. § 560.208 (Iranian Transactions and Sanctions Regulations); 64 FR 20171, April 26, 1999. [2]OFAC’s position, as applied across the board to embargo programs based on the IEEPA: facilitating a transaction by a foreign person is prohibited if that transaction would be prohibited when conducted directly by a U.S. person; this prohibition is explicit in the embargo programs and implied where it is not expressly stated. See The OFAC/Export Control Evasion and Facilitation Prohibitions, ACC Docket, April 8, 2021. [3]31 C.F.R. § 538.407 (Sudanese Sanctions Regulations, provision removed from the C.F.R. in 2018, which remained OFAC’s most detailed explanation of the concept of facilitation): purely clerical or reporting activities that do not support the commercial or financial transaction do not constitute prohibited facilitation; reporting the results of a subsidiary’s trade is not prohibited, whereas financing or insuring that trade is. [4]31 C.F.R. § 560.417(b): A U.S. person may not refer a business opportunity to a foreign person if the referred transaction would be prohibited if conducted by the U.S. person. [5]A transaction constitutes prohibited facilitation only if it is a transaction in which U.S. persons could not engage without a license, which in some cases requires a counterfactual analysis of the transaction. See the OFAC interpretive note associated with the facilitation provisions (e.g., 31 C.F.R. § 542.210, Syria, and equivalents). [6]31 C.F.R. § 560.314: The term “United States person” means any U.S. citizen, lawful permanent resident, entity organized under the laws of the United States (including foreign branches), or any person located in the United States. [7]Watson Farley & Williams, US Sanctions 101: Since nearly all transfers in U.S. dollars are cleared through U.S. banks, a payment in dollars to or from an SDN or a sanctioned jurisdiction may trigger sanctions even in the absence of any other U.S. nexus. [8]OFAC, Frequently Asked Question 1029: Non-U.S. persons are prohibited from inducing or conspiring to induce U.S. persons to violate sanctions, as well as from engaging in conduct that circumvents or evades a violation of OFAC sanctions. [9]Tri-Seal Compliance Note, jointly issued by OFAC, BIS, and the DOJ on March 6, 2024, specifically addressed to non-U.S. persons; the scenarios cited include routing a prohibited payment through the U.S. financial system, causing a U.S. bank to process it, and obscuring or omitting references to a sanctioned party. [10]Executive Order 14024 of April 15, 2021, Secs. 4(a) and 4(b): Any transaction that circumvents, evades, is intended to circumvent or evade, results in a violation of, or attempts to violate any of the prohibitions of the order is prohibited, as is any conspiracy formed for that purpose. Reenacted in 31 C.F.R. Part 587 (Russian Harmful Foreign Activities Sanctions Regulations). [11]Executive Order 14114 of December 22, 2023, which amends E.O. 14024 by introducing a new Sec. 11(a), authorizing OFAC to impose secondary sanctions on foreign financial institutions that have conducted or facilitated significant transactions for persons designated under E.O. 14024 in the technology, defense, construction, aerospace, or manufacturing sectors, or involving Russia’s military-industrial base. Sanctions may consist of CAPTA restrictions or a complete freeze. See FAQs 1146–1151. [12]OFAC does not consider efforts by non-U.S. persons to comply with the sanctions by replacing sanctioned suppliers or service providers (including financial institutions) with unsanctioned persons to be circumvention or evasion. See OFAC’s FAQs on Russian Harmful Foreign Activities Sanctions. [13]U.S. Department of the Treasury, OFAC, Settlement Agreement with BNP Paribas SA, June 30, 2014, press release jl2447: $963 million OFAC component of a global settlement of approximately $8.9 billion; the conduct consisted of concealing, removing, omitting, or obscuring references to sanctioned parties in 3,897 transactions routed to or through U.S. banks between 2005 and 2012. BNP Paribas pleaded guilty before the DOJ. [14]Schlumberger Oilfield Holdings Ltd., settlement with the DOJ in 2015, $232 million, based on the theory of facilitation: approving expense reports and providing business advice and guidance for operations in Iran and Sudan. [15]OFAC, settlement with GVA Capital Ltd., 2025, $215,988,868: a San Francisco-based venture capital fund that managed the assets of Russian oligarch Suleiman Kerimov, designated as an SDN. In its press release, OFAC emphasized the role of gatekeepers, citing investment professionals, accountants, lawyers, and providers of company and trust formation services as examples. [16]OFAC, settlement with Toll Holdings Limited, April 25, 2022: an Australian freight forwarding and logistics company sanctioned for deficiencies in its compliance program regarding complex international transactions. [17]OFAC, settlement with Fracht FWO Inc., September 3, 2025, $1,610,775: a Houston-based freight forwarder sanctioned for involving a blocked Venezuelan state-owned airline and an aircraft operated by Mahan Air (Iran) in programs related to Venezuela, Iran, WMD proliferation, and global terrorism; conduct classified as serious and not voluntarily disclosed.