Executive Circular on the Maintenance of Systems and Security Access Protocols by Offerors of Crypto-Assets Other Than Asset-Referenced Tokens and Electronic Money Tokens and Persons Applying for Their Admission to Trading

163603-2/2026
Executive Circular on the Maintenance of Systems and Security Access Protocols by Offerors of Crypto-Assets Other Than Asset-Referenced Tokens and Electronic Money Tokens and Persons Applying for Their Admission to Trading

The Hungarian National Bank (hereinafter: MNB) exercises supervision over organizations, persons, and activities falling under the scope of the Act on Crypto-Asset Markets of 2024 (hereinafter: Crypto Act) within the financial intermediary system, including the implementation of the Regulation on Crypto-Asset Markets, based on the provisions of the Act on the Hungarian National Bank of 2013. This is done to ensure the stability, uninterrupted, transparent, and efficient operation of the financial intermediary system, as well as the protection of all participants in the financial intermediary system.

The recipients of this executive circular are offerors of crypto-assets other than asset-referenced tokens and electronic money tokens – as defined in point 13 of paragraph (1) of Article 3 of the Regulation and falling under the scope of the Crypto Act – and persons applying for the admission of such crypto-assets to trading, who have their registered office or branch in Hungary, or are registered or established in another Member State of the European Union and offer services directly to customers in Hungary through a permanent business unit established in Hungary in the form of a permanent domestic presence (hereinafter together: offeror and person applying for admission to trading).

The European Securities and Markets Authority (hereinafter: ESMA) published guidelines (ESMA75-223375936-6132) on the determination of Union standards for the maintenance of systems and security access protocols for offerors of crypto-assets other than asset-referenced tokens and electronic money tokens and persons applying for their admission to trading, pursuant to point (d) of paragraph (1) of Article 14 of the Regulation (hereinafter: ESMA Guidelines).

The purpose of this executive circular is to formulate the MNB's expectations regarding the maintenance of systems and security access protocols by offerors of crypto-assets other than asset-referenced tokens and electronic money tokens and persons applying for their admission to trading, taking into account the ESMA Guidelines, thereby increasing the predictability of law application and facilitating the uniform application of relevant legislation.

For the purposes of this executive circular:
1.1. Network and Information System: The concept defined in point 24 of Section 4 of the Act on Cybersecurity of Hungary of 2024.
1.2. Access Control: Checks aimed at ensuring that the authorization and restriction of physical and logical access to information and communication technology (hereinafter: ICT) tools are carried out based on business and information security requirements. 3
1.3. ICT Tool: The concept defined in point 7 of Article 3 of the European Parliament and Council Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (hereinafter: DORA Regulation). 3
1.4. ICT Risk: The concept defined in point 5 of Article 3 of the DORA Regulation.

In the absence of contrary provisions, the concepts used and defined in the Regulation and the Crypto Act also have the same meaning in this executive circular.

The MNB expects that the procedures and regulations of the offeror and the person applying for admission to trading be developed taking into account the expectations set out in this executive circular.

Expectations Regarding the Maintenance of Systems and Security Access Protocols

1. The General Principle of Proportionality

It is expected that the offeror and the person applying for admission to trading make every effort to comply with the expectations set out in this executive circular in a manner proportional to the size of the organization, its overall risk profile, and the nature, scope, and complexity of its activities or operations, taking these into account.

2. Administrative Provisions Regarding Systems and Security Access Protocols

Administrative Provisions

It is expected that the offeror or the person applying for admission to trading ensures the operation of an adequate internal governance and internal control framework for the maintenance of their network and information systems and the reduction of ICT risks. The offeror or the person applying for admission to trading must also clearly define roles and responsibilities for functions responsible for managing ICT risks.

The offeror or the person applying for admission to trading must ensure that the skills and budgetary resources of its staff are adequate for the continuous support of provisions aimed at managing ICT risks, with particular attention to staff responsible for the maintenance of network and information systems and access control. Furthermore, the offeror or the person applying for admission to trading must ensure that members of the affected staff, including those holding particularly important positions, receive appropriate training on ICT risks at regular intervals.

The MNB expects that the governing body of the offeror or the person applying for admission to trading is accountable for the determination, approval, and supervision of the implementation of organizational provisions aimed at managing ICT risks, including those regarding network and information systems and access controls.

Roles and Responsibilities

It is expected that the offeror or the person applying for admission to trading entrusts the identification, management, and supervision of ICT risks to the staff within the organization. It must ensure that staff responsible for the management of ICT risks and security operations have adequate tools for the identification, monitoring, assessment, and reporting of the relevant ICT risks.

The offeror or the person applying for admission to trading must ensure that staff responsible for managing ICT risks related to network and information systems and access controls monitor, assess, and report identified ICT risks to the governing body.

The MNB expects that the offeror or the person applying for admission to trading defines and designates particularly important powers and responsibilities for the development of provisions regarding:
a) the identification and assessment of ICT risks affecting the organization, including risks related to ICT services provided by third-party providers; b) the determination of risk reduction measures, including controls aimed at reducing ICT risks originating from third parties; c) the monitoring of the effectiveness of the measures mentioned in point (b) and, if necessary, action to improve the measures; d) reporting to the governing body on ICT risks and risk reduction measures; e) the determination and assessment of whether ICT risks arise due to any significant change in network and information systems or ICT services (including those provided by third parties) or following any significant operational or security event; f) the management of cryptographic keys throughout their entire lifecycle.

3. Physical Security Access Protocols

It is expected that the offeror or the person applying for admission to trading defines, documents, and implements physical security measures to protect its premises, data centers, and sensitive areas from unauthorized access and environmental hazards.

The offeror or the person applying for admission to trading must keep a record of every entry into rooms associated with access rights.

Physical access to network and information systems must be permitted only to authorized persons based on the principle of need-to-know and least privilege, and on an ad-hoc basis. Access rights must be assigned according to the tasks and responsibilities of the authorized person and limited to appropriately trained and monitored personnel. Physical access must be reviewed at regular intervals and revoked if its maintenance is no longer justified.

It is expected that measures aimed at protection against environmental hazards are proportional to the significance of the buildings and the critical nature of the operations and network and information systems located in the buildings.

4. Security Access Protocols for Network and Information Systems

Logical access to network and information systems must be restricted to the circle of authorized persons designated by the offeror or the person applying for admission to trading. Access rights must be assigned according to the tasks and responsibilities of the staff and limited to persons who have appropriate qualifications and whose access to the systems is monitored. It is expected that the offeror or the person applying for admission to trading introduces controls that reliably restrict access to network and information systems to persons with legitimate business requirements. Electronic access of applications to data and systems must be limited to the minimum necessary for the provision of required services.

The MNB expects that the offeror and the person applying for admission to trading introduce strict controls for privileged system access, specifically through the strict limitation and close supervision of staff with high-level system access rights. Controls to be implemented include, for example: role-based access, logging and review of activities performed by privileged users on network and information systems, strong authentication, and monitoring of anomalies. The offeror or the person applying for admission to trading must manage access rights to information assets and the systems supporting them based on the principle of need-to-know and least privilege. Logical access rights must be reviewed at regular intervals and revoked if no longer needed.

Access logs must be retained for a period proportional to the critical nature of the identified business functions, supporting processes, and information assets, without prejudice to retention requirements defined in Union and national law. It is expected that the offeror and the person applying for admission to trading use this information to facilitate the identification and investigation of abnormal activities detected during the provision of their services.

Remote administrative access to critical ICT tools may only be provided based on the principle of need-to-know and least privilege, and exclusively if strong authentication solutions are available.

The operation of products, tools, and procedures related to access control processes must be protected against the compromise or circumvention of the respective access control processes. This includes the registration, handover, recall, and revocation of appropriate products, tools, and procedures.

5. Management of Cryptographic Keys

The offeror or the person applying for admission to trading is responsible for the management of cryptographic keys as part of the powers and responsibilities assigned to staff particularly important in terms of ICT risk. The staff of the offeror or the person applying for admission to trading particularly important in terms of ICT risk is responsible for the management of cryptographic keys throughout their entire lifecycle, including the generation, renewal, storage, backup, archiving, restoration, transmission, revocation, withdrawal, and destruction of keys.

It is expected that the offeror and the person applying for admission to trading identify and implement controls that provide protection against loss, unauthorized access, unintended disclosure, and modification of cryptographic keys throughout their entire lifecycle.

The offeror and the person applying for admission to trading must develop and implement methods for replacing lost, compromised, or damaged cryptographic keys.

The MNB expects that the offeror and the person applying for admission to trading create and maintain a register for all certificates and certificate storage devices of critical ICT tools at a minimum. The register must be kept up to date.

The offeror and the person applying for admission to trading must ensure the immediate renewal of certificates before their expiration.

*
This executive circular is a supervisory regulatory instrument that does not have binding force on supervised institutions; however, the MNB continuously monitors and evaluates compliance with the expectations set out in the executive circular and, based on experience, examines the need for the application of further regulatory instruments. The MNB publishes this executive circular on its website.

Thank you for your kind cooperation.

Budapest, 22 April 2026

Dr. Levente Sipos-Tompa
Deputy Governor of the Hungarian National Bank Responsible for the Supervision of Financial Institutions and Consumer Protection

ELECTRONICALLY SIGNED DOCUMENT
[<<szollosian>>]