The tax inspection report has a single sentence that matters, and it sounds technical and harmless: “as at 31.12.2025, account 542 ‘Cash advances’ shows a debit balance of 640,000 lei, unsupported by documents”. Four months later, the same sentence reappears in an order opening a criminal investigation in rem, and the figure has become “loss”. Between the two documents, no new evidence was added. Only the reading changed: an accounting balance was read as misappropriation.
Rarely from a direct complaint. There are four typical sources, and they all share a common feature that matters enormously for the defence.
The inspection finds large, long-standing debit balances in accounts 542 “Cash advances”, 455 “Amounts owed to shareholders” or 461 “Sundry debtors”, without supporting documents. If it considers that the facts may amount to the constituent elements of an offence, the tax authority files a criminal complaint, and the tax findings enter the case file as documentary evidence.
In a dispute between shareholders, bank statements and trial balances invariably become the first weapon.
The judicial administrator analyses the causes of the insolvency and, when he identifies sums that left the company's assets without justification, is under an obligation to report it; his report is a document of considerable evidential weight.
Or an audit, in larger structures. Rare as a source, but well documented when it does occur.
The common feature: the case starts from an accounting document, not from a direct finding of a fact. This is also the single most important piece of information for the defence. The full path from inspection to criminal case is described in the analysis on how a tax inspection turns into a criminal case, and the director's withdrawals, in the one on the director who borrows from the company. Once the case is opened, a precautionary seizure (sechestru asigărător) frequently follows.
Sums made available to directors or employees to make payments on the entity's behalf: purchases, business trips, hospitality. They are recorded in account 542 “Cash advances”, in accordance with the accounting rules approved by Ordinul ministrului finanțelor publice nr. 1802/2014.
The mechanism is simple: the money leaves the cash till or the business card, the person spends it, then accounts for it, produces the supporting documents, and the advance becomes an expense. Whatever was not spent is repaid.
Legea contabilității nr. 82/1991 requires that every economic and financial transaction be recorded, at the time it is carried out, in a document underlying the accounting entries, which thereby acquires the status of a supporting document (Article 6(1)). This is the rule on which, in reality, the entire case for the prosecution rests.
The deadline for accounting for an advance is a problem in itself. Current legislation does not set a general deadline for justifying cash advances for trading companies. The deadline is set through internal accounting procedures, approved by the director, and brought to the attention of the persons concerned.
The 4-working-day term from the Cash Operations Regulation approved by Decretul nr. 209/1976 is sometimes relied on. The status of this instrument deserves to be stated precisely: it has not been expressly repealed and appears, on the official legislative portal, as being in force. But it was designed for “socialist units”, and applying it by analogy to today's private companies remains debatable and open to challenge. The practical conclusion for the defence: the accusation that “you did not account for it in time” must be measured against an existing internal procedure, not against a general statutory deadline, which does not exist.
NOTE: A large, old balance in account 542 is not, by itself, an offence. It is an accounting irregularity and an indication. The confusion between an “unsupported balance” and a “loss” is the central error of many indictments, and the first thing to challenge. A balance measures a claim the company has against a person; a loss requires an actual, proven detriment, caused by conduct found to have been committed intentionally. The distinction is developed in the analysis on why a balance is not a loss.
The prosecution's typical reasoning is short: money withdrawn + absence of supporting documents = misappropriation for personal gain, hence embezzlement (delapidare) (Article 295 in conjunction with Article 308 of the Criminal Code).
The reasoning has a structural weakness. There is no statutory presumption that turns the absence of a supporting document into proof of misappropriation. The burden of proof lies entirely with the prosecution, and the presumption of innocence operates in favour of the person under investigation.
What needs to be proved is not the balance, which is undisputed, but the destination of the money and intent. The absence of a document does not, by itself, prove either. It merely shifts the evidential difficulty, which is not the same thing as reversing the burden of proof. The constituent elements that must be met are set out in detail in the analysis on the constituent elements of embezzlement.
The missing accounting document can be replaced with other means of evidence. There are three usual approaches, and each carries a different weight.
If the money reached suppliers, even without a receipt in the accounts, proof can be made through the supplier's own records, statements from its representatives, correspondence, and cross-checking against goods received. A physical flow of goods implies a payment that actually took place.
A frequently overlooked point: Article 5 of Legea nr. 70/2015 exempts from the cash thresholds the payment of business-travel expenses, up to the amounts due for transport, per diem, allowance and accommodation. The reconstruction relies on travel orders, bookings, hotel invoices, location data, correspondence.
If the company's business actually produced the results shown in its financial statements, the money was, to some extent, spent within the company. It is a systemic argument, not a matter of detail, but it carries weight once it is quantified.
The limits are real and must be stated openly: the longer the period and the fewer the documents, the more fragile the reconstruction becomes. Documents contemporaneous with the transaction carry a force that no later explanation can match. The full construction of the defence is described in the analysis on defences in an embezzlement case.
This is the line on which most cases that would otherwise have been defensible are lost. The difference is not one of nuance, it is the difference between a defence and an aggravation.
Reconstructing financial-accounting documents that have been lost, stolen or destroyed is a lawful procedure, governed by Ordinul ministrului finanțelor publice nr. 2634/2015, on financial-accounting documents. The time limits are precise and must be observed as such.
Anyone who discovers the loss, theft or destruction of supporting or accounting documents is required to notify the entity's manager, in writing, within 24 hours of discovery.
Within no more than 3 working days of receiving the notification, the entity's manager directs that minutes of findings be drawn up, containing the identifying details of the missing documents and the name of the person responsible for keeping them.
The procedure must be completed within no more than 30 days of discovery, or, in the case of force majeure, within 90 days of it ending. The reconstructed document bears the notation “DUPLICATE (RECONSTRUCTED)”.
It contains the written notification, the minutes of findings, proof that the criminal investigation authorities were notified or that the person at fault was disciplined, the entity manager's written instruction, and a copy of the reconstructed documents.
Fabricating documents that attest to transactions that never took place is something else entirely. It amounts to forgery of a private document (Article 322 of the Criminal Code) and use of a forged document (Article 323), and Article 43 of Legea nr. 82/1991 characterises as intellectual forgery the knowing making of inaccurate entries or the knowing omission of entries, where the result is a distortion of the revenues, expenses, financial results, or the assets and liabilities shown in the balance sheet. The result: a concurrence of offences, a clear worsening of the situation, and the destruction of the entire defence's credibility. An embezzlement case can be defended; an embezzlement case in which documents were fabricated, much less so.
In these cases, the court-appointed forensic accounting report (expertiză judiciară) is not a secondary matter, it is, as a rule, the central piece of evidence. It can establish the actual flows, separate sums actually used in the business from unjustified ones, and dismantle the equivalence “balance = loss”.
The terms of reference for the report are proposed by the parties, and how they are framed largely decides the outcome. A term framed as “establish whether the balance of account 542 is justified” leads to a predictable answer; one framed as “identify the actual destination of the sums and quantify the company's real loss” opens up the analysis. This is a procedural moment that cannot be recovered later. The technical details are dealt with in the analysis on accounting evidence in an embezzlement case.
Legea nr. 70/2015 sets thresholds that the prosecution often uses as contextual evidence. The current position, according to the ANAF (Romania's national tax administration) information material from January 2026:
A daily threshold of 5,000 lei, set for each person who received advances.
5,000 lei/day from one person (10,000 lei for cash-and-carry shops).
5,000 lei/day/person, but no more than an overall daily ceiling of 10,000 lei.
10,000 lei/day to or from one person, for deliveries, purchases, services, dividends, assignments of claims.
A maximum of 50,000 lei at the end of each day (500,000 lei for cash-and-carry), with any excess to be paid into the bank account within two working days.
50,000 lei/transaction. Splitting receipts or payments in order to get around the thresholds is prohibited.
The penalty: a fine of 25% of the amount received, paid or held above the threshold, but not less than 500 lei, with no option to pay half the minimum within 15 days. Formally, this is an administrative-offence liability, not a criminal one. In practice, a pattern of payments split just below the threshold is read as evidence of intent. It is a corroborating argument, not direct proof, and must be treated as such. The full rules are in the analysis on the cash thresholds in 2026.
When the balance becomes awkward, the temptation of a quick fix appears: the shareholder “lends” the company an equivalent sum. There are three problems, and the last one is new.
The first is a matter of form. Under Article 4(4) of Legea nr. 70/2015, the receipt and repayment of loans or other financing between professionals and individuals must be carried out only through cashless payment instruments. A loan “brought in cash” is an administrative offence, punishable by a fine of 25% of the amount, with a minimum of 500 lei.
The second is more serious: the source of the money. A significant loan to the company, unsupported by declared income, opens the way to a personal tax status review and to taxing income whose source has not been identified, at a rate of 70%. From 2026, the power to carry out personal tax status reviews was extended to the Anti-Fraud Directorate's structures as well. In other words: covering an accounting balance with an unjustified loan can turn one problem into two. The full mechanism is described in the analyses on the personal tax status review and the 70% tax and on the asset declaration.
The third is recent and often overlooked. From 18 December 2025, through Legea nr. 239/2025, Article 67 of Legea nr. 31/1990 prohibits companies whose, according to their approved annual financial statements, net assets have fallen below half of the subscribed share capital, from repaying loans taken from shareholders or affiliated persons (paragraph (24)). And companies that distribute dividends quarterly cannot grant loans to shareholders or affiliated persons until regularisation (paragraph (23)). The penalties: an administrative fine of 10,000 to 200,000 lei and the joint and several liability of the company and the shareholder for outstanding tax liabilities, up to the amounts lent or repaid. In practice: the company in difficulty, precisely the one with large balances, is also the one where repaying the loan becomes unlawful.
The business card is the most thoroughly documented category of transactions. Every transaction has a date, time, amount and merchant, and the data exists at the bank independently of the company's own accounts. ATM withdrawals with the company card, followed by the absence of any expense report, are the hardest to explain retroactively.
“Off the books” payments for wages are the most common real explanation for large balances, and the most dangerous defence. Claiming that the money was used for untaxed payments to employees means answering one accusation by admitting another: undeclared work and, potentially, tax evasion through failing to declare wage income and contributions. This is a strategic decision that should not be made on the spot, in front of the criminal investigation authority.
542, 455 and 461. A balance that keeps rising is the only signal that matters, and the only one you can see coming in time.
Covering cash advances: who receives them, for what purpose, within what term they must be accounted for, and what documents are required. In the absence of a general statutory deadline, the internal procedure is the reference framework, and it protects you.
An expense report drawn up on the date of the expense is worth ten explanations given three years later.
The business card from the personal one. No “temporary” exceptions.
Travel orders, bookings, correspondence, confirmations from suppliers. They become evidence when the accounting document is missing.
An actual repayment by bank transfer, or a dividend distribution with payment of the tax, if there is profit, checking beforehand the restrictions under Legea nr. 239/2025. And document the source of any loan you make to the company, at the time you make it.
No. It is an accounting irregularity and a potential indication. For a charge of embezzlement, the prosecution must prove that the sums were misappropriated or used for personal gain, with intent, not merely that documents are missing. The presumption of innocence remains fully in effect, and a balance measures a claim, not a loss.
Current legislation does not set a general deadline for trading companies. The deadline is set through internal accounting procedures approved by the director. The reference to the 4-working-day term in Decretul nr. 209/1976 is debatable: the instrument has not been expressly repealed and appears as being in force, but it was designed for socialist units, and applying it by analogy to today's private companies is open to challenge.
Reconstructing documents that have been lost, stolen or destroyed is a lawful procedure, with strict formalities and time limits, set out in Ordinul nr. 2634/2015: written notification within 24 hours of discovery, minutes of findings within no more than 3 working days, completion of the reconstruction within 30 days of discovery (90 days from the end of force majeure), bearing the notation “DUPLICATE (RECONSTRUCTED)”. Drawing up documents that attest to transactions that never took place is forgery and attracts a concurrence of offences.
Not by itself: it is an administrative offence, punishable by a fine of 25% of the amount exceeding the threshold, with a minimum of 500 lei. It can, however, be used by the prosecution as corroborating evidence, especially where a pattern of systematic splitting below the threshold appears. It is a contextual argument, not proof of intent.
This is exactly the manoeuvre that turns one problem into two. The loan must be made by bank transfer (Article 4(4) of Legea nr. 70/2015), and the source of the money immediately becomes open to verification, with the risk of a 70% tax on income whose source has not been identified. Moreover, from 18 December 2025, a company whose net assets are below half of the subscribed share capital can no longer repay you the loan, and the breach attracts a fine of 10,000 to 200,000 lei and joint and several liability for outstanding tax liabilities.
Informative material, updated on 18 July 2026. It does not constitute legal or tax advice; individual situations must be assessed on their own facts. Persons under investigation are presumed innocent until a conviction becomes final.
If the matter involves a criminal complaint or an open file, the related analyses are grouped under economic criminal law. For how such charges are handled, see company-law offences defence.
Time limits run from the date of communication. A first conversation clarifies what is being alleged, what you need to substantiate and how the defence is built, before an estimate becomes a tax assessment decision.