DeFi regulation in Hungary

Update the regulatory baseline

The SZTFH's current notice reports that Act XXXVIII of 2026, published on 30 July, removed the statutory exchange-validation licensing and registration provisions and related criminal rules. It also describes termination of the relevant proceedings and the loss of effect of earlier validation permits.

The amending Act provides for commencement on the eighth day after publication. By the review date of this guide, the change has taken effect. Do not carry a 2025 validator requirement into a current operating checklist. The repeal does not itself grant a MiCA permission or decide the treatment of a historical transaction.

Use the MNB authorization procedure

The MNB CASP authorization guide directs the relevant electronic applications through ERA, using the prescribed licensing forms and supporting electronic documents. It also identifies the good-business-reputation questionnaire and electronic-signature process. Keep proof of submission and monitor the official delivery channel for requests.

First distinguish an Article 63 CASP authorization from Article 60 eligibility for an existing financial institution. The latter depends on institution type and service equivalence. MNB supervision is separate from the former SZTFH validation permission.

For a DeFi-related service, identify the customer-facing entity, controlled interfaces and signing powers. MiCA Recital 22 does not create an exemption merely because the product uses a permissionless smart contract. Record which person performs or controls each proposed service before selecting a regulatory route.

Keep permissions and technical controls separate

This DeFiSec worksheet helps remove outdated requirements while retaining evidence for the obligations that still apply.

Travel Rule information and customer due diligence require their own controls. Pharos Production's MiCA KYC engineering guide can help connect identity checks to onboarding and transfer handling. Use the EU Travel Rule guide for the legal transfer scenarios, including self-hosted addresses.

Review changes without erasing the audit trail

Keep a record of the old procedure, the source establishing the change and the approved replacement. Removing a validator integration should not remove unrelated transaction records or customer-protection controls. Set retention rules from the applicable obligations and the actual data purpose.

For a CASP within DORA's scope, operational resilience, supplier oversight and incident handling remain continuing responsibilities. A repeal in one national regime is not evidence that an ICT dependency or custody risk disappeared. Validate the revised workflow before exposing it to customers.