DeFi regulation & security
DeFi regulation in Slovakia
NBS readiness guidance shows why the actual customer and asset flow matters more than the service label. Management must understand the business and its controls.
- Sources checked
- Published
- Prepared by
- DeFi Security Alliance
Scope: Slovak CASP service classification, management readiness and technical evidence. This guide does not reproduce a complete filing form, current fee schedule or individual tax analysis.
Classify the service actually delivered
The NBS publication on common CASP application deficiencies warns against describing an activity with the wrong MiCA service category. Its example follows customer money through the provider to an exchange and then custody: the facts can indicate reception and transmission of orders plus custody, rather than an own-account exchange service.
Draw the full customer, order and asset flow before selecting services under MiCA. For a DeFi interface, identify the persons controlling execution, access and customer assets. A product label or a supplier's description cannot replace that factual analysis.
Prepare real management and a suitable applicant
NBS's application preparation guidance describes eligible company forms and excludes a sole-trader application. Check the applicant's legal form against the current requirements before assembling the file.
The readiness guidance examines management competence, available time and resources. Nominee appointments do not substitute for people who understand the business, technology and risks. Document who performs AML, ICT and oversight functions and how those people can challenge failures.
Make the technical description verifiable
NBS discusses technical preparation such as continuity, key arrangements and testing. Treat its practical recommendations according to their stated status, rather than turning every suggested implementation into a universal technology mandate.
Pharos Production's smart contract custody risk guide helps examine signing, recovery and privileged code paths. This DeFiSec worksheet connects those findings to the application. It is not an NBS form.
| Decision | Evidence to prepare | Review question |
|---|---|---|
| Actual transaction path | Customer payment, order routing and custody flow | Does the selected service category match every step? |
| Applicant form | Incorporation record and permission route | Is this entity eligible for the proposed application? |
| Management competence | Responsibilities, experience and available time | Who can explain and challenge the operating controls? |
| Custody technology | Key roles, recovery tests and supplier permissions | Does the policy match the deployed arrangement? |
| Remediation | Known deficiencies, owners and completion evidence | Which issues remain unresolved before submission? |
Review changes against the permission scope
Under MiCA, authorization and eligible-institution notification routes depend on the entity and services. An application or preliminary discussion does not itself permit launch. Keep the relevant permission and the submitted operating description together.
As a release-control measure, compare a new feature with the service map, management responsibilities and technical evidence. Reassess a change from order routing to execution or from technical supply to asset control. The DORA evidence guide covers the supporting continuity and supplier records.
Continue your research
Sources and further reading
Legislation and regulator publications establish the legal basis. Technical resources explain implementation. Source checks cover the passages cited in this guide.
- MiCA — Regulation (EU) 2023/1114European Union ·
- DORA — Regulation (EU) 2022/2554European Union ·
- Smart contract risk in crypto custodyPharos Production ·
- Preparing and submitting a CASP applicationNárodná banka Slovenska ·
- Common readiness deficiencies in CASP applicationsNárodná banka Slovenska ·