# How to open an IT, software or information services company in Moldova

Of every domain in the Moldovan classifier, IT is the one where the state asks least before you start and most afterwards. No licence, no authorisation, no notification to the town hall — but since 23 August 2026 you carry data-protection duties that you no longer report to anyone: you keep them in the company and produce them on inspection. The two divisions the domain is made of start identically and part company at the customer: software and IT consultancy on one side, data, hosting and portals on the other.

## In brief

- **CAEM codes:** Divisions 62 and 63
- **Permits:** None (no licence, no authorisation)
- **Share capital:** No minimum
- **VAT on exported services:** Does not apply (place of supply is the client seat)

## Software and IT consultancy: what you need before the first contract

Division 62 is the project half: you write code to order, sell consultancy, or run infrastructure that belongs to someone else. None of its four classes needs a licence or an authorisation, and all four appear on the list of activities eligible for the IT parks. You can invoice from the day the registration certificate arrives, and for a client outside Moldova there is no VAT to charge.

| Code | Activity | What it means in practice |
| --- | --- | --- |
| 62.01 | Computer programming activities | The base code of any company writing code for a client. No licence, no authorisation. Eligible for the IT park regime — it is the first activity in article 8. |
| 62.02 | Computer consultancy activities | System architecture, technical audit, choosing and implementing solutions. No licence, no authorisation. Eligible for the IT park regime. |
| 62.03 | Computer facilities management activities | Running the client infrastructure, from servers to workstations. No licence, no authorisation. Eligible for the IT park regime. |
| 62.09 | Other information technology and computer service activities | Data recovery, installation, information security, anything that is an IT service without falling into the other three classes. No licence, no authorisation. Eligible for the IT park regime. |

**Permits:** None of classes 62.01, 62.02, 62.03 and 62.09 appears in the licence or authorisation nomenclature, and IT services are not a commercial activity, so nothing is filed with the town hall. The one licence that borders the division belongs to the Security and Intelligence Service, covering interception equipment and technical information protection — hardware and countermeasures, not software.

**Who buys it:** The typical client is a company abroad outsourcing a team or a product, and the contract is signed per person per month rather than per deliverable. At home the buyers are banks, retail chains and the public sector through procurement. What separates the two markets is currency and payment terms: on export you are paid in euro at 30 or 60 days, with the state you are paid after acceptance.

**What is different about the money:** This is the best-paid division in the economy — around 45,700 lei gross a month at the end of 2025, against a national average of 16,400. Payroll is effectively the whole budget: one developer hired at market rate costs more in a month than registration and accounting together cost in a year.

## Data, hosting and portals: where revenue turns recurring and the duties get heavier

Division 63 is the recurring half: you host, process data or run a portal, and the revenue arrives monthly rather than per project. There is no licence here either. Two things set it apart from its neighbour: here you are usually a processor in the sense of the data-protection law, and class 63.99 is the only one in the domain the IT parks do not accept.

| Code | Activity | What it means in practice |
| --- | --- | --- |
| 63.11 | Data processing, hosting and related activities | Hosting, cloud, data processing to order. No permit, but the class with the heaviest data-protection duties, because here you are the processor. Eligible for the IT park regime. |
| 63.12 | Web portals | Portals and platforms earning from aggregated content or from traffic. No licence, no authorisation. Eligible for the IT park regime. |
| 63.99 | Other information service activities n.e.c. | The catch-all of the division. No permit — and, note, no IT park eligibility either, unlike its neighbours 63.11 and 63.12. |

**Permits:** Classes 63.11, 63.12 and 63.99 appear in neither the licence nor the authorisation nomenclature, and none is a commercial activity. What applies instead of a permit are the duties in Law 195/2024: a record of processing activities kept by you as processor, not only by your client, and a data protection officer wherever article 37 requires one.

**Who buys it:** Hosting and data processing sell on subscription, so customers change rarely and revenue is predictable — but the price is compared directly against international providers. Portals live on advertising and commission, which means on traffic. The corporate client asks here what it never asks a software studio: where the servers sit, who has access to the data, and what happens to it when the contract ends.

**What is different about the money:** The division pays around 35,000 lei gross a month — more than double the national average, but some ten thousand below its neighbour in division 62. In exchange the revenue recurs and the marginal cost of one more customer is small, so margin grows with scale in a way that project work never does.

## How the sector got here

- **1 January 2017 — Law 77/2016.** The law creating the information technology parks enters into force and with it a tax regime of its own for a closed list of activities. That list is article 8, and it reads class by class, not division by division.
- **23 August 2024 — Law 195/2024.** The new personal data protection law is published, transposing Regulation (EU) 2016/679. Article 89 gives it 24 months before it takes effect — the longest grace period granted to a law in this field in recent years.
- **23 August 2026 — Law 195/2024.** The law takes effect and repeals Law 133/2011 along with articles 74¹–74³ and 423⁴ of the Contravention Code. Prior notification of processing to the Centre disappears; what remains are records kept inside the company, impact assessment, and a data protection officer where required.

## What the domain pays and how big it is

Someone employed in information technology services earned around 45,700 lei gross a month at the end of 2025, against a national average of roughly 16,400. It is the highest figure of any division the National Bureau of Statistics publishes. The number belongs to division 62, not to the section: the section it sits in, information and communication, shows around 37,100 lei, because it also contains telecommunications and broadcasting, where pay is about half. Division 63 — hosting, data processing, portals — pays 35,000.

The number of companies rose sharply. In division 62, 2,944 economic agents reported for 2025 against 2,478 for 2024, with 17,148 employees and sales revenue of 13.5 billion lei. In division 63, 763 economic agents, 8,943 employees and 5.4 billion lei.

Two things follow for anyone entering now.

First, pay is your largest cost, and if you hire at market rate the payroll of a single developer exceeds everything you would spend on registration, accounting and subscriptions in a whole year. An IT business plan does not break at the paperwork line.

Second, 466 more companies than the year before, in a division that already held almost two and a half thousand, means you are not entering a consolidated market — but nor are you entering one where the client comes looking for you. Most of those companies are small and work for a single foreign customer.

## What the state does not ask for before you start

It is worth saying plainly, because it is unusual: **in divisions 62 and 63 there is no permit to obtain before the first invoice.**

The Moldovan licence nomenclature runs to 22 positions and none covers any class in these two divisions. The authorisation list holds none either. There is no notification to the town hall, because no code in 62 or 63 appears on the list of commercial activities — unlike a shop or a restaurant. There is no requirement as to premises, equipment, seniority or qualifications.

In practice, nothing stands between the day you file at the Public Services Agency and the day you can sign the first contract except the few working days the registration itself takes.

It is worth explaining why the hub card used to carry a licence mention at all. Position 8 of the nomenclature covers **trade in special technical means intended for the covert acquisition of information** and **the supply of technical information protection services**, licensed by the Security and Intelligence Service for five years. It is the position closest to this domain and the only reason the domain ever features in a conversation about licences.

But its subject is not software. The first limb is import, manufacture and trade in interception equipment — activities belonging to other divisions of the classifier. The second means technical protection against covert capture of information: shielding, countermeasures, technical sweeps, not information security in the ordinary sense. Penetration testing, security audit, traffic encryption and firewall administration are not licensed activities in Moldova. If your company genuinely does technical countermeasures or sells that kind of equipment, ask the Service before signing the first contract.

## What the state asks for once you have started

This is where the weight sits, and since 23 August 2026 it sits heavily.

### Notification of processing is gone, the duties are not

Until that date, Law 133/2011 required processing of personal data to be notified to the National Centre for Personal Data Protection. Law 195/2024 repealed it, along with articles 74¹–74³ and 423⁴ of the Contravention Code, and inverted the logic: you no longer ask permission and no longer tell anyone, but you must be able to demonstrate at any moment that you did what was required.

What stays inside the company:

- **The record of processing activities** — article 30. An internal document listing purposes, categories of people and of data, recipients, transfers to other states with the documentation of the safeguards, erasure deadlines and technical security measures. The controller and the processor each keep their own, so an outsourcer keeps its own record rather than sheltering behind the client.
- **The impact assessment**, wherever processing presents a high risk.
- **The data protection officer**, in the cases in article 37: a public authority, regular and systematic monitoring on a large scale, or large-scale processing of special categories of data. They may be an employee or engaged under a services contract, may serve a whole group of undertakings, receive no instructions on how to do the job and cannot be dismissed for doing it. Their contact details are published **and sent to the Centre** — the only notification left standing.

### The fines are large, but not yet at full value

Article 88 sets two ceilings: up to **1,000,000 lei or 1%** of annual turnover for breaches of controller and processor duties, and up to **2,000,000 lei or 2%** for the principles of processing, data subject rights and international transfers. The greater of the sum and the percentage applies.

Article 90(4) adds a ladder few have noticed: in the first year **10%** of the amount set applies, in the second year **40%**, and from the third year **100%**. So a fine calculated today at two million is collected at two hundred thousand, and a company that puts its records in order over the next twelve months does so in the cheapest window it will ever have.

### VAT is decided by where your client sits, not where you do

Article 111(1)(e) of the Fiscal Code places information technology services supplied through electronic communications equipment at the **seat of the beneficiary**. The same rule covers consultancy, transfers of copyright and the supply of information.

The practical consequence: for a client established outside Moldova the supply is treated as made there and falls outside the scope of Moldovan VAT — you put no VAT on the invoice and have none to collect. For a Moldovan client the standard rate applies. A company working exclusively for foreign customers ends up with essentially no output VAT, which changes the shape of the return entirely and is worth telling the accountant in the first month rather than the thirteenth.

## The 7% regime in the IT parks

Six of the seven classes above are eligible for residency in an information technology park: 62.01, 62.02, 62.03, 62.09, 63.11 and 63.12 all appear in article 8 of Law 77/2016. **63.99 does not** — it is the only one in the tables above that stays on the general regime, and it is exactly the kind of detail discovered late, because its neighbours in the same division are eligible.

The article 8 list is written per class, not per division, and it also covers several activities that do not appear above at all: publishing of computer games and of other software, computer training, research and development in named fields, manufacture of microprocessors and integrated circuits, special effects and animation, and specialised design based on high-performance computing equipment.

How to apply, what it costs, how the minimum tax per employee is calculated and what the 7% covers are set out in the [Moldova IT Park guide](/en/blog/moldova-it-park-complete-guide), and the figures can be checked against your own company with the [tax calculator](/en/it-park-calculator). None of that is repeated here.

## Which legal form: SRL, sole trader or joint-stock

For IT the usual answer is an SRL, more firmly than in other domains.

Liability stays limited to the share capital, there is no minimum, the form admits 100% foreign founders, and it is the only one a corporate client in the European Union will accept without argument when it runs due diligence before the first contract. IT park residency is open to any subject of entrepreneurial activity, so the legal form is not what limits you there.

A sole trader looks attractive to a developer working alone, right up to the part where it is not a legal person and the holder is liable without limit, with their entire personal estate. In a field where contracts carry indemnity clauses for data breaches and intellectual property infringement, and where the data protection fine is measured in millions, unlimited liability is a poor bet.

A joint-stock company has no place at the start. It is a form designed for capital raised from several investors, with reporting duties to match, not for a team that grows contract by contract.

## Frequently asked questions

### Do you need a licence for an IT company in Moldova?

No. None of the 22 licences in the Moldovan nomenclature covers any class in divisions 62 and 63, and there is no authorisation either. A company that writes code, runs infrastructure, hosts websites or does security testing can invoice from the day its registration certificate arrives. The nearest licence to the domain is the one held by the Security and Intelligence Service, for interception equipment and technical information protection — hardware and countermeasures, not software.

### What CAEM code does a software company use?

62.01, computer programming activities. Add 62.02 if you also sell consultancy, or 62.03 if you run the client infrastructure. You may declare up to five principal activities at registration, so you are not forced to pick one — but the code you declare matters if you intend to apply for IT park residency, because the list of eligible activities is written per class.

### Do you charge VAT to a client abroad?

No, and the reason is a place-of-supply rule rather than an exemption. Article 111(1)(e) of the Fiscal Code places information technology services supplied through electronic communications equipment at the seat of the beneficiary. If the beneficiary is established in Germany, the supply is treated as made in Germany and falls outside the scope of Moldovan VAT. For a Moldovan client the standard rate applies.

### What changed on 23 August 2026 for personal data?

Law 195/2024 replaced Law 133/2011 and reversed the direction of the duty. You no longer notify anyone before you start processing. Instead you keep a record of processing activities inside the company, run an impact assessment where the risk is high, and in the cases listed in article 37 appoint a data protection officer and send the Centre their contact details. Fines reach 1,000,000 lei or 1% of turnover for controller and processor duties, and 2,000,000 lei or 2% for the principles and data subject rights.

### Does a small outsourcing company need a data protection officer?

It depends on what you do, not on how many of you there are. Article 37 requires one where the core activity consists of regular and systematic monitoring of people on a large scale, or large-scale processing of special categories of data. A ten-person company processing medical data for a foreign client is caught; a fifty-person company building internal applications for a factory probably is not. The duty applies to the processor as well as the controller — so to you as subcontractor, not only to your client. The officer may be an employee or engaged under a services contract.

### How much share capital does an IT company need?

An SRL has no minimum share capital, and the domain adds no threshold of its own — there is no financial standing requirement of the kind road transport carries, and no mandatory equipment. The first-year budget is made up almost entirely of salaries, cloud subscriptions and accounting.

Choosing the CAEM codes, drafting the constitutive documents and filing with the Public Services Agency are part of the registration service.