Hungary clarifies regime for validating crypto-asset conversions

On 27 October 2025, Hungary’s Supervisory Authority of Regulated Activities (SARA) issued Decree 10/2025. (X.27.), which sets out the detailed rules on the authorisation and registration of crypto-asset conversion validation service providers.

This Decree was issued in response to a rule introduced in July 2025 whereby exchanging crypto-assets for funds or other crypto-assets can only be conducted on the basis of a certificate of compliance issued by a crypto-asset conversion validation service provider. Exchanges undertaken without this certificate constitute a criminal offence (see CMS | Law-Now | Hungary to criminalise crypto-asset exchange violations with restrictive validation obligation for service providers and clients).

Because the July measure did not specify the licensing conditions for validation service providers nor the scope of any exemptions from the certification requirement, SARA responded with Decree 10/2025.

Becoming a validation service provider

Under the Decree, any entity wishing to provide crypto-asset conversion validation services must obtain prior authorisation from SARA and meet stringent organisational, prudential and compliance standards, including:

• Corporate form and governance: incorporation as a legal entity with both a board of directors and a supervisory board.
• Audit: appointment of a permanent auditor as required by the Civil Code.
• Capitalisation: minimum registered capital of HUF 80 million.
• Qualified personnel: employment of staff in specified numbers holding degrees in economics, law enforcement, IT or law, supported by a documented staff selection policy.
• Information security: an information security policy and a certified information security management system.
• Secure infrastructure: secure communications tools and software ensuring the confidentiality, integrity and authenticity of data used in validation.
• Conflicts management: a conflict-of-interest policy as required by the Crypto Act.
• Operational policies: a methodology for collecting data on the participants in past transactions involving the relevant wallets and crypto-assets; a complaints-handling policy; and a business continuity plan.
• Insurance and site security: professional liability insurance with a minimum annual limit of HUF 250 million, and possession of a simplified site security certificate.
• Risk-assessment capability: the capability to identify, assess and interpret money-laundering and terrorist-financing risks affecting payment service providers, intermediary payment service providers, crypto-asset service providers and intermediary crypto-asset service providers.

When providers successfully complete authorisation and registration, SARA will publish the name and company registration number of each provider on its website.

When validation and a certificate are not required

A central feature of the Decree is the obligation for providers to issue a declaration of conformity for each validated conversion, as stated in Section 9/A of the Hungarian Crypto Act. This declaration confirms that the conversion complies with all applicable legal and regulatory requirements.

The Decree also identifies specific exemptions under which validation (and a declaration of conformity) is not required. Transactions within the following categories remain lawful without certification:

• conversions lacking consideration or not conducted on a regular basis;
• transactions carried out by authorised authorities for covert intelligence purposes;
• conversions where a natural person exchanges their own crypto-assets for other crypto-assets; and
• decentralised exchanges as defined in MiCA (Article 3, point 16(c)–(d)).

Practical impact

For market participants, the Decree turns a previously uncertain criminal-law risk into an operational compliance project with clear milestones. Prospective validation providers should immediately begin a gap analysis against the authorisation criteria (i.e. governance, capital, staffing, ISMS certification, insurance) and engage auditors and insurers early since these are likely bottlenecks. Payment institutions, VASPs/crypto-asset service providers and intermediaries should update onboarding and transaction flows to the following:

• route in-scope conversions to an authorised validator and obtain a declaration of conformity;
• document when an exemption applies (e.g. own-account swaps, decentralised execution, no consideration); and
• reflect the new controls in AML/CTF risk assessments, customer disclosures and incident/complaints procedures.

Banks and PSPs servicing exchanges should refresh vendor due diligence to confirm counterparties’ validation status and liability coverage. Finally, firms should monitor SARA’s public register for authorised entities, supervisory guidance and MiCA-related developments in order to align product design, geofencing and record-keeping with the regime in Hungary.

For more information on the Decree and crypto-currency regulations in Hungary, contact your CMS client partner or the CMS experts who wrote this article.

The article was co-authored by Péter Virányi.