Vista Bank’s Collaboration with the General Directorate for Personal Registry (D.G.E.P.)

Vista Bank started its collaboration with the General Directorate for Personal Registry (D.G.E.P.) in February 2026, in order to comply with the Bank’s legal obligations regarding the implementation of customer due diligence measures that allow for the identification of clients and the verification of their identity based on documents, data, or information obtained from reliable and independent sources, as well as to fulfil the legitimate interest related to improving the accuracy of data concerning clients and individuals entering into business relationships with the Bank.

The relationship is based on the Framework Cooperation Agreement concluded between the D.G.E.P. and the Romanian Banking Association (A.R.B.), of which Vista Bank is a member, as well as on the Contract regarding the validation and provision of data from the National Register of Persons (R.N.E.P.) concluded between Vista Bank and the D.G.E.P., which you may access here.

What does this collaboration mean?

This collaboration allows us to access, in a secure and lawful manner, up-to-date information from the National Register of Persons (R.N.E.P.), managed by the D.G.E.P., both at the initiation of a business relationship with the Bank and for the periodic updating of data relating to the following individuals, Romanian citizens, residents, aged at least 14 years:

• holders of the Bank’s products/services, including their legal representatives (e.g. guardians, curators) and conventional representatives (empowered persons, delegates, mandate holders, etc.);
• legal or conventional representatives (empowered persons, delegates, mandate holders, etc.), shareholders/real beneficiaries of legal entities, including individuals who have the status of users of the Bank’s products/services held by the legal entity;
• third-party guarantors (signatories to movable or immovable mortgage agreements) for loans granted to individuals or legal entities.

What data are processed?

The Bank, in its capacity as a credit institution, has a legal obligation to collect from its clients/potential clients personal data from identity documents, as well as copies of identity documents, for the purpose of applying customer due diligence measures aimed at preventing and combating money laundering, terrorist financing, and fraudulent behavior. Details regarding the processing by the Bank of personal data for this purpose can be found here. Additionally, the Bank must ensure that such data are always accurate and up to date in its records.

For this purpose, the Bank will transmit to the D.G.E.P. the surname, first name, and personal identification number of the concerned individuals.

The D.G.E.P. will validate this data through automated procedures and will additionally provide the Bank with the following information about these individuals: surname, first name, type, series and number of the identity document, date of issue and date of expiry of the identity document, place of birth, issuing authority of the identity document, domicile address, residence address, photograph, and information regarding the date of death, where applicable, as recorded in the R.N.E.P.

The following information is not subject to updating through the interaction between the Bank and the D.G.E.P.: source and destination of funds, monthly income level, change of employer, occupation, phone number, email address, PEP status (Politically Exposed Persons), tax residency, purpose and nature of the business relationship, as well as other information required in accordance with the applicable General Business Conditions and the specific contracts concluded with the Bank.

Methods for data validation and provision

The validation and provision of data are carried out under conditions ensuring their confidentiality and security, as a result of comparing the information held by the Bank with the personal data recorded in the National Register of Personal Records (N.R.P.R.), through the following methods:

• initial update;
• via a web service;
• periodic update.

Note: The processing activities carried out by the Bank and the exchange of information with the D.G.E.P. through the methods described above do not remove the obligation of the concerned individuals to update their personal data in accordance with the Framework Contract regarding the General Terms and Conditions for Conducting Business and the specific contracts concluded with the Bank. The obligations to update personal data regulated in the contractual documentation remain in force as accepted through the respective contractual documentation.

Personal data protection

In carrying out the processing activities described in the Contract, both Vista Bank and the General Directorate for Personal Registry act independently as data controllers.

Information regarding the processing of personal data in the context of the collaboration between Vista Bank and the General Directorate for Personal Records can be found here.

If you wish to contact us for any reason in order to find out more about how we have handled your personal data or to exercise your rights, please contact the Data Protection Officer at the following email address: protectiadatelorvistabank.ro or in writing at Vista Bank (Romania) S.A., for the attention of the Data Protection Officer, Str. Emanoil Porumbaru 90–92, Sector 1, Bucharest, Romania.