Question 1

Is there one standard compliance programme for every company?

Accepted Answer

No. Duties and risks depend on the sector, products, countries, customers, third parties and company size. Some requirements apply only to regulated entities or specified transactions. A proportionate system starts with the legal perimeter and the company's actual decisions.

Question 2

Is approving and circulating a policy enough?

Accepted Answer

No. The policy needs an operating process: who checks, who approves, how an exception is escalated and what evidence remains. Training helps, but performance appears in actual files and decisions, including the way deficiencies are corrected.

Question 3

Must every supplier and customer undergo the same checks?

Accepted Answer

Usually not. The level of review follows the risk and applicable legal duties. A success-fee intermediary, a counterparty with unclear ownership or a transaction in a sensitive jurisdiction may call for more information. An ordinary low-risk supplier may follow a simpler process.

Question 4

Can the company examine an anonymous report?

Accepted Answer

Yes, if it contains indications of a breach of law. Romanian Law no. 361/2022 requires examination and resolution of an anonymous report that contains such indications. The team should verify the facts without trying unnecessarily to identify the whistleblower and without presuming the subject of the report is guilty.

Question 5

Does an internal investigation allow access to every email or document?

Accepted Answer

Not automatically. Access needs a defined purpose, a legal basis and proportionate limits. The rules communicated to employees, the nature of the account or device, data protection, employment law and defence rights all matter. The investigation plan should be settled before broad collection begins.

Question 6

What should we do when sanctions screening produces a name match?

Accepted Answer

Do not treat a technical match as a conclusion. Pause the relevant step while checking identity, aliases, ownership and control, the sanctions measure and the specific transaction. Depending on the result, you may need more information, an authorisation, contact with the competent authority or refusal of the transaction.

Question 7

Does a compliance programme prevent company liability?

Accepted Answer

No. The Romanian Criminal Code sets the conditions for corporate criminal liability for offences committed in pursuit of the company's corporate purpose or in its interest or name. Documents do not provide immunity. Applied controls, the response to warning signs and remediation may be relevant to the facts, but the competent authorities and courts determine the outcome.

Question 8

What information is useful for the first discussion?

Accepted Answer

Send a short account of the issue, the known deadline, sector and countries, the people or transaction concerned and documents already available. For a regulatory request, send the full text and attachments. For an investigation, preserve evidence sources and limit unnecessary circulation of allegations.