There are jurisdictional issues involved here. Contrary to the belief of many in this forum USA law doesn't apply in the rest of the world. The SEC like to claim that they have jurisdiction in other countries where services are sold to USA citizens however there are a lot of steps involved in any extradition process some of which will require a reasonable case to be put forward and that the person will get a fair trial.

In the case of Romania there may also be a requirement that the person did something which constituted an offence in their own country. They would also have to demonstrate that USA persons were targeted in the business offering.

In this case there are also issues about the status of Bitcoin and which regulations it comes under - in both countries.

It is worth considering a different scenario when discussing this.  Suppose a USA person had a homosexual relationship with a Saudi Arabian in Chicago. Do you expect the USA to extradite the citizen to Saudi Arabia to stand trial? There are a lot of differences in these two cases but it should be clear that extradition etc is never a completely predictable or straightforward situation.

Regarding the SEC claim that Mircea Popescu should pass over sensitive information to them about a client.  The EU regulations refer to "natural persons" not EU citizens so without a "safe harbour agreement" or direction from EU law enforcement the correct procedure is to decline and the SEC staff should know that. Their claim that it would be OK is erroneous in fact and makes me wonder what else they are wrong about.

I am not a lawyer but have dealt with data protection on and off for several years.

Andy