Hungarian national bank issues additional AML obligations to crypto-asset service providers

The National Bank of Hungary (MNB) issued a new decree, setting down detailed rules for the implementation of the obligations for service providers subject to MNB supervision under the AML Act and the minimum requirements for the development and operation of a screening system for such service providers pertaining to restriction measures adopted by the EU and the UN Security Council.

From July 2025, each crypto-asset service provider must investigate whether the self-hosted address is owned or otherwise under the actual control of the crypto asset originator or the crypto asset beneficiary. A self-hosted address is defined as a distributed ledger address not linked to either a crypto-asset service provider or an entity established outside of the EU and providing services similar to a crypto-asset service provider. For the purposes of verification, the crypto-asset service provider must apply at least one of the following measures:

• direct or indirect electronic customer due diligence via an audited electronic communication tool, with indication of the address;
• sending an amount predetermined by the crypto-asset service provider from the self-hosted address to the account of the crypto-asset service provider;
• requesting the client to digitally sign a specific message in the account and wallet software with the key corresponding to such address; or
• using a reliable and secure technical means by which the crypto-asset provider can verify that the address is owned or ultimately controlled by the originator or the beneficiary.

The crypto-asset service provider must identify and assess the money laundering and terrorist financing risks associated with crypto-asset transfers to or from the self-hosted addresses and indicate the identified risks in its risk-assessment documents and the measures being taken to mitigate and manage the risks in its internal policies. In line with the identified risks, the crypto-asset service provider must apply one of the following proportional mitigation measures:

•  risk-based measures to identify and verify the identity of the crypto-asset originator or the beneficiary or their beneficial owner in relation to the crypto-asset transfers to or from the self-hosted addresses (including by relying on third parties);
•  requiring the provision of additional information on the origin and destination of the transferred crypto-assets;
• monitoring of transactions under the enhanced procedure;
• any other measures included in its internal policies relating to mitigate and manage the risks of money-laundering and terrorist financing risks.

The payment service provider and the crypto-asset service provider must, within the scope of its data communication obligation relating to the transfer of funds and certain crypto-asset transfers, use infrastructure and services for the transmission and reception of information that are technically capable of transmitting and receiving information without deficiencies or errors. Such service providers must operate a screening system that is able to detect any deficiency or error in the transmission and reception of information and any related transactions below the threshold.

In addition to the payment service providers, crypto-asset service providers are also required to operate automatic screening system.

For more information, contact your CMS client partner or these CMS experts.

The article was co-authored by Emilia Viven Martits.