Recommendation No. 1/2026 (II.24.) of the Magyar Nemzeti Bank

on Compliance Officers for Combating Money Laundering and Terrorist Financing, Their Duties and Responsibilities, and Related Internal Procedures and Control Mechanisms

I. Purpose and Scope of the Recommendation

In connection with combating money laundering and terrorist financing (hereinafter: AML/CFT), the appropriate, prudent, and careful operation of financial organizations is of paramount importance. The purpose of this Recommendation is to formulate the expectations of the Magyar Nemzeti Bank (hereinafter: MNB) regarding the organizational structure ensuring AML/CFT compliance by financial organizations, the role, tasks, and responsibilities of officers ensuring the performance of AML/CFT duties, as well as related internal procedures, control mechanisms, and processes, thereby increasing the predictability of legal application and facilitating the uniform application of relevant legislation.

The addressees of this Recommendation are credit institutions defined in point 16 of Section 3(1) of Act No. LIII of 2017 on the Prevention and Suppression of Money Laundering and Terrorist Financing (hereinafter: Pmt.), as well as financial service providers defined in point 28 of Section 3 of the Pmt. (hereinafter collectively: financial organizations).

The Recommendation transposes, on the one hand, the guidelines published by the European Banking Authority (hereinafter: EBA) on June 14, 2022, regarding policies and procedures related to compliance with laws, as well as the role and responsibilities of the AML/CFT compliance officer under Article 8 and Chapter VI of Directive (EU) 2015/849 (EBA/GL/2022/05) 1, and the guidelines published by the EBA on November 14, 2024, regarding internal regulations, procedures, and controls ensuring the implementation of EU and national restrictive measures (EBA/GL/2024/14 2; hereinafter: EBA/GL/2024/14 Guidelines). The Recommendation also takes into account:

a) the joint guidelines published by the EBA and the European Securities and Markets Authority (hereinafter: ESMA) on July 2, 2021, on the assessment of the suitability of members of the governing body and key function holders (EBA/GL/2021/06, ESMA35-36-2319) 3, and the Recommendation No. 12/2022. (VIII. 11.) of the MNB [hereinafter: 12/2022. (VIII. 11.) MNB Recommendation], which transposes certain provisions thereof regarding the establishment and operation of internal defense lines and the governance and control functions of financial organizations; b) the Recommendation No. 1/2022. (I. 17.) of the MNB [hereinafter: 1/2022. (I. 17.) MNB Recommendation], which also transposes certain provisions of the joint guidelines of the EBA and ESMA referred to in point a) regarding the assessment of the suitability of members of the governing body and key function holders; c) the Recommendation No. 14/2025. (VI. 16.) of the MNB on the detailed rules for the implementation of certain obligations under the Act on the Prevention and Suppression of Money Laundering and Terrorist Financing for service providers supervised by the Magyar Nemzeti Bank, and on the minimum requirements for the development and operation of the screening system of such service providers under the Act on the Implementation of Financial and Property Restrictive Measures Ordered by the European Union and the UN Security Council (hereinafter: MNB Regulation), specifically point c) of Section 24, which refers to guidelines issued by the EBA or the Authority for Combating Money Laundering and Terrorist Financing addressed to financial organizations for the identification of risk factors of business activities and the determination of necessary measures for risk management 4, and d) the general expectations set forth in the Recommendation No. 7/2020. (VI. 3.) of the MNB regarding the engagement of external service providers, and formulates supplementary expectations in relation to them. Furthermore, in the application of this Recommendation, the MNB considers the officer defined in points a) and g) of point 1, and the senior manager appointed in the absence of a governing body performing the management function defined in point d) of point 1, as a key function holder in accordance with point 85 of the 12/2022 (VIII. 11.) MNB Recommendation.

The Recommendation also takes into account Article 8(4)(a) and Article 46(4) of Directive (EU) 2015/849 of the European Parliament and of the Council of May 20, 2015 on the prevention of the use of the financial system for the purpose of money laundering or terrorist financing, amending Regulation (EU) No 648/2012, and repealing Directives 2005/60/EC and 2006/70/EC (hereinafter: AMLD), regarding the head responsible for compliance with laws and the member of the governing body designated as responsible for the implementation of legislative, regulatory, and administrative provisions necessary for the AMLD-compliant operation of the financial organization.

When formulating principles and expectations, the Recommendation does not refer exhaustively to statutory provisions; however, the addressees of the Recommendation remain obligated to comply with the relevant statutory requirements. The contents of the Recommendation are consistent with the European framework defining the operation of financial organizations.

The Recommendation does not provide guidance on data protection or privacy matters, contains no expectations regarding the processing of personal data, and the requirements contained therein cannot be interpreted in any way as authorization for the processing of personal data. Data processing carried out in connection with the fulfillment of supervisory expectations established in the Recommendation may only be performed in compliance with the applicable data protection laws.

1See: https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Guidelines/2022/EBA-GL-2022-05%20GLs%20on%20AML%20compliance%20officers/Translations/1039070/GL%20on%20AMLCFT%20compliance%20officers%20%28EBA%20GL%202022%2005%29_HU_COR.pdf 2See: https://www.eba.europa.eu/sites/default/files/2025-02/eaeae49d-81a5-4154-8af9-5014f6ee8881/Gls%20on%20restrictive%20measures%20%28EBA%20GL%202024%2014%20and%20EBA%20GL%202024%2015%29_HU_COR.pdf 3See: https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Guidelines/2021/EBA-GL-2021-06%20Joint%20EBA%20and%20ESMA%20GL%20on%20the%20assessment%20of%20sustainability/1022108/Joint%20EBA%20and%20ESMA%20GL%20on%20the%20assessment%20of%20suitability_HU.pdf

4At the time of issuance of this Recommendation, the relevant EBA guidelines on money laundering and terrorist financing risk factors are: EBA/GL/2021/02, EBA/GL/2023/03; EBA/GL/2023/04; EBA/GL/2024/01; and point 4.2 of the EBA/GL/2024/14 guidelines.

II. Interpretative Provisions

1. In the application of this Recommendation:
   a) AML/CFT Compliance Officer: the concept defined in point 23a of Section 3 of the Pmt.; b) Governing Body Performing a Supervisory Function: the governing body that acts in the role of supervising and monitoring managerial decision-making within the financial organization, i.e., it monitors, checks, and oversees managerial decisions made by persons who actually direct the business activities of the respective financial organization; c) Governing Body Performing a Management Function: the governing body that acts in the role of managing the daily operations of the financial organization, through which it is authorized to determine the strategy, objectives, and general direction of the credit institution or financial service provider, as well as to represent the financial organization; d) Restrictive Measures: financial and property restrictive measures defined in point 5 of Section 2 of Act No. LII of 2017 on the Implementation of Financial and Property Restrictive Measures Ordered by the European Union and the UN Security Council (hereinafter: Pvkit.), atypical financial restrictive measures referred to in point 2a of Section 3 of the Pmt., and national restrictive measures accepted in accordance with the Hungarian legal order (insofar as they apply to financial institutions); e) External Service Provider: the concept defined in point l) of point 1 of the Recommendation No. 7/2020. (VI. 3.) of the MNB [hereinafter: 7/2020. (VI. 3.) MNB Recommendation] regarding the engagement of external service providers; f) Financial Intelligence Unit: the body responsible for the implementation of financial and property restrictive measures under the Pvkit., in addition to its duties defined in the Pmt.; g) Sanctions Compliance Officer: a senior employee responsible for performing the functions and tasks related to restrictive measures; h) Governing Body: the governing body performing a management function and the governing body performing a supervisory function of a financial organization.

2. In addition to the concepts defined in point 1, the concepts used in this Recommendation shall be interpreted in accordance with the Pmt., as well as the Act No. LIII of 2017 on the Prevention and Suppression of Money Laundering and Terrorist Financing, and the Regulation No. 21/2017. (VIII. 3.) of the Ministry of Justice on the mandatory content elements of internal regulations to be prepared in accordance with the Act on the Implementation of Financial and Property Restrictive Measures Ordered by the European Union and the UN Security Council (hereinafter: NGM Regulation).

III. Definition of Specific Duties and Responsibilities

III.1. The Role and Responsibilities of the Governing Body in the AML/CFT Framework

3. The governing body is responsible for approving the comprehensive AML/CFT strategy of the financial organization and overseeing its implementation. To this end, in addition to the expectations set forth in the 12/2022. (VIII. 11.) MNB Recommendation, the MNB expects that the governing body, as a collective, possesses adequate knowledge, skills, and experience to understand the money laundering and terrorist financing (ML/TF) risks associated with the activities and business model of the financial organization, including knowledge of the legal and regulatory framework related to the prevention of ML/TF. For this reason, when assessing the collective suitability of the governing body, taking into account the expectations of the 1/2022. (I. 17.) MNB Recommendation, the financial organization should also assess whether the governing body has demonstrated through its decisions that it adequately understands ML/TF risks and how they affect the activities of the financial organization, and whether it adequately manages these risks, including corrective measures if necessary.

4. In implementing point 3, it is also expected that the financial organization establishes a governance framework ensuring that its policies, procedures, and controls regarding the implementation of restrictive measures are appropriate and are actually implemented.

5. The governing body is responsible for approving the strategy of the financial organization regarding compliance with restrictive measures, and for overseeing the implementation of the strategy through policies, procedures, and control mechanisms necessary to ensure the implementation of restrictive measures. For this reason, it is expected that every member of the governing body is aware of the financial organization's exposure to restrictive measures, as well as its exposure to circumvention of restrictive measures.

6. If the business activities of the financial organization are directed by a single person, that person may appoint a senior manager to perform the tasks of the governing body as defined in point 5.

III.2. The Role of the Governing Body Performing a Supervisory Function in the AML/CFT Framework

7. To ensure compliance with the requirements applicable in connection with the prevention of ML/TF, the governing body performing a supervisory function is expected to oversee and monitor the implementation of the internal governance and internal control framework.

8. In addition to the expectations set forth in the 12/2022. (VIII. 11.) MNB Recommendation, the MNB considers it good practice if the governing body performing a supervisory function of the financial organization:
   a) informs itself about the results of the risk assessment covering the entire financial organization regarding ML/TF aspects and exposure to restrictive measures; b) oversees and monitors, taking into account the risks arising from ML/TF and restrictive measures affecting the financial organization, whether the AML/CFT policies and procedures are appropriate and effective, and initiates appropriate steps with the governing body performing a management function to ensure the adoption and implementation of corrective measures if necessary; c) in addition to the general ML/TF tasks defined in point b), oversees and monitors through the internal control function whether the policies and procedures regarding restrictive measures are appropriate and effective, considering the financial organization's exposure to restrictive measures and the risk of circumvention of those restrictive measures to which the financial organization is exposed, and takes appropriate steps to ensure that corrective measures are adopted if necessary; d) reviews the activity reports of the AML/CFT Compliance Officer at least twice a year, or, if the two functions are separated, reviews the activity reports of the Sanctions Compliance Officer at least once a year, and for activities that expose the financial organization to higher ML/TF risks, obtains interim activity reports prepared ad hoc by the AML/CFT Compliance Officer or, in case of separation of functions, the Sanctions Compliance Officer more frequently; e) evaluates the effective operation of the AML/CFT Compliance Function at least once a year, including considering the conclusions of internal and external audits related to AML/CFT, including the adequacy of human and technical resources assigned to the AML/CFT Compliance Officer; f) evaluates the effective operation of the compliance function regarding restrictive measures at least once a year, including the adequacy of internal policies, procedures, and controls, and the adequacy of human and technical resources assigned to compliance with restrictive measures.

9. It is expected that the governing body performing a supervisory function checks whether the designated responsible officer – or the senior manager appointed in the absence of a governing body as described in point 15 – meets the expectations detailed in point 11 of this Recommendation, in accordance with point d) of point 59 of the 1/2022. (I. 17.) MNB Recommendation.

10. It is expected that the governing body performing a supervisory function has access to data and information of appropriate detail and quality, and takes them into account in order to effectively perform its AML/CFT supervisory duties. As a minimum requirement for the performance of these duties, the governing body performing a supervisory function must have timely and direct access to the activity report of the AML/CFT Compliance Officer, the findings of the Sanctions Compliance Officer regarding the assessment of exposure to restrictive measures, the report of the internal control function, if applicable, the findings and comments of the external control function, the findings of the MNB, substantive communication with the Financial Intelligence Unit, and information on supervisory measures or imposed sanctions.

III.3. The Role of the Governing Body Performing a Management Function in the AML/CFT Framework

11. The MNB expects, in connection with the internal procedures, control mechanisms, and processes referred to in Section 27(5) and Section 65 of the Pmt. and Sections 3-6 of the NGM Regulation, that the governing body performing a management function of the financial organization:
    a) introduces an appropriate and effective organizational and operational structure necessary for compliance with the policies approved by the governing body, paying special attention to the appropriate authority assigned to the tasks of the AML/CFT Compliance Officer, as well as the adequacy of human and technical resources, including the necessity of an AML/CFT organizational unit established for this purpose to assist the AML/CFT Compliance Officer; b) ensures the implementation of AML/CFT policies and procedures; c) reviews the activity report of the AML/CFT Compliance Officer at least twice a year, in accordance with Section 63(9) of the Pmt.; d) ensures appropriate, timely, and sufficiently detailed AML/CFT reporting to the MNB, by sending the reports prepared by the AML/CFT Compliance Officer and – if the two functions are separated – the Sanctions Compliance Officer to the MNB, including group-level reports, in accordance with the MNB regulations detailing the data reporting to the MNB at all times; e) if the operational tasks of the AML/CFT Compliance Officer are outsourced, ensures compliance with the 12/2022. (VIII. 11.) MNB Recommendation, and if relevant, the 7/2020. (VI. 3.) MNB Recommendation, and the Recommendation No. 4/2019. (IV. 1.) of the MNB [hereinafter: 4/2019. (IV. 1.) MNB Recommendation] regarding the engagement of community and public cloud services – which formulate supplementary expectations compared to their general expectations – and ensures that it receives regular reports from the external service provider for appropriate information; f) to ensure compliance with restrictive measures:
    fa) receives direct information from the Sanctions Compliance Officer in its report at least once a year on the results of the assessment of exposure to restrictive measures; fb) adopts a risk management framework and internal control system that is sufficiently independent of the business activities it oversees; fc) approves regulations, procedures, and control mechanisms that are proportional to the financial organization's exposure to restrictive measures and appropriate to ensure compliance with restrictive measures; fd) ensures the effective implementation of the processes established for the financial organization's compliance with restrictive measures; fe) ensures the implementation of the organizational and operational structure necessary for compliance with the strategy on restrictive measures approved by the governing body; ff) ensures the adequacy of human and technical resources and their proportionality to the financial organization's exposure to restrictive measures; fg) in case of outsourcing operational tasks related to compliance with restrictive measures, ensures that the outsourcing agreements comply with the MNB recommendations on the engagement of external services 5, and g) informs itself about the efficiency of the performance of outsourced tasks through regular information sent by the external service provider.

III.4. The Role of the Designated Responsible Officer in the AML/CFT Framework

III.4.1. Appointment of the Designated Responsible Officer as a Member of the Governing Body

12. Taking into account Section 63(4a) of the Pmt. and supplementing point 30 of the 12/2022. (VIII. 11.) MNB Recommendation, as referred to in point 9, the MNB expects that the designated responsible officer, selected from among the members of the governing body performing a management function:
    a) possesses adequate knowledge, skills, and experience, in accordance with point d) of point 59 of the 1/2022. (I. 17.) MNB Recommendation, to identify, assess, manage, and mitigate ML/TF risks affecting the financial organization, as well as to implement AML/CFT procedures, control mechanisms, and processes, and is well acquainted with the business model of the financial organization and the industry in which it operates, as well as the extent to which this business model exposes the financial organization to ML/TF risks; b) informs itself in a timely manner about decisions that may affect the risks to which the financial organization is exposed; and c) devotes sufficient time and resources to the effective performance of AML/CFT duties, in accordance with point c) of point 58 of the 12/2022. (VIII. 11.) MNB Recommendation.

13. Without prejudice to the comprehensive and collective responsibility of the governing body performing a management function, it is expected that when selecting the designated responsible officer, the financial organization identifies and considers the potential incompatibility with its other duties and responsibilities, and takes steps to avoid or mitigate such incompatibility.

14. It is expected that the designated responsible officer reports on its duties and, if necessary, regularly and without undue delay informs the governing body performing a supervisory function of all information required for the performance of the duties of the governing body performing a supervisory function as described in Subsection III.2.

III.4.2. Appointment of the Designated Responsible Officer in the Absence of a Governing Body Performing a Management Function

15. In accordance with point 30 of the 12/2022. (VIII. 11.) MNB Recommendation, if there is no governing body performing a management function, the MNB considers it good practice if the financial organization entrusts the tasks to be performed by the designated responsible officer to a senior manager who meets the expectations set forth in point 12 and the compatibility requirements set forth in point 13.

5At the time of issuance of this Recommendation, the Recommendation No. 7/2020. (VI. 3.) of the MNB regarding the engagement of external service providers.

points.
16. In this Recommendation, the tasks and responsibilities described regarding the designated responsible officer apply mutatis mutandis to the senior management in the absence of a governing body, provided that such senior management is appointed in the absence of a governing body. In such cases, the tasks to be performed by the designated responsible officer towards the governing body are performed by the senior management towards the senior management of the financial organization.

III.4.3. Tasks and Role of the Designated Responsible Officer

17. In addition to fulfilling the tasks prescribed by the AML Act, it is expected that the designated responsible officer ensures that the entire management body is aware of the impact of ML/TF risks on the financial organization's risk profile. Regarding the execution of tasks related to the implementation of AML/CFT legal provisions and supervisory expectations, and especially regarding responsibilities related to the implementation of internal procedures, control mechanisms, and processes referred to in Section 27(5) and Section 65 of the AML Act, as well as Sections 3-6 of the NGM Regulation, which serve to mitigate and effectively manage ML/TF risks, it is expected that these encompass at least the following:

a) ensuring that AML/CFT policies, procedures, and internal control measures are appropriate and proportionate, taking into account the characteristics of the financial organization and the ML/TF risks to which it is exposed;

b) jointly with the management body, assessing whether it is advisable to appoint a separate senior AML/CFT compliance officer, as mentioned in Subsection III.5.1;

c) supporting the management body in assessing whether a separate AML/CFT organizational unit is needed to assist the AML/CFT compliance officer in performing their duties, considering the scale and complexity of the financial organization's operations and its exposure to ML/TF risks. It is expected that employees within this organizational unit possess the expertise, skills, and knowledge detailed in Subsection IV to assist the AML/CFT compliance officer, who should be recommended to be involved in the recruitment process;

d) ensuring that the management body receives regular reports on activities performed by the AML/CFT compliance officer, and that the management body receives sufficiently comprehensive and timely information and data on ML/TF risks and AML/CFT compliance, necessary for the management body to fulfill its entrusted role and tasks. Regarding this information – without prejudice to the confidentiality of transaction reports under Section 30(1) of the AML Act – the MNB expects that it covers the financial organization's communication with the MNB and the Financial Intelligence Unit, as well as the MNB's findings regarding the financial organization related to ML/TF, including any measures or sanctions imposed;

e) informing the management body about serious or significant problems and violations related to AML/CFT, and proposing measures to remedy them; and

f) ensuring that the AML/CFT compliance officer:

fa) has direct access to all information necessary to perform their duties;

fb) has sufficient human and technical resources and tools to properly perform the entrusted tasks; and

fc) receives appropriate information about internal control systems, as well as events and deficiencies related to AML/CFT identified by the MNB – and in the case of groups, foreign supervisory authorities.

18. The MNB considers it good practice for the designated responsible officer to act as the main contact person for the AML/CFT compliance officer within the management body. In this context, it is expected that the designated responsible officer ensures that concerns raised by the AML/CFT compliance officer regarding AML/CFT are properly addressed within the financial organization, and if this is not possible, that the governing body or, where applicable, senior management properly considers these concerns. If the governing body or, where applicable, senior management decides not to follow the recommendation of the AML/CFT compliance officer, the MNB expects that the risks and concerns raised by the AML/CFT compliance officer are properly justified and that the decision is recorded.

19. In addition to what is indicated in point 27(c), the MNB expects that the designated responsible officer ensures that the financial organization's internal audit and information systems, internal regulations, internal risk assessment, as well as procedures and records aimed at combating ML/FT are accessible, applicable, effective, and understandable to all affected employees, and generally ensure the fulfillment of provisions stipulated in the AML Act and other laws issued under the authorization of the AML Act, especially Section 65 of the AML Act, including ensuring consistency, continuous monitoring, and auditability.

III.5. The Role of the AML/CFT Compliance Officer and Sanctions Compliance Officer in the AML/CFT Framework

III.5.1. The AML/CFT Compliance Officer

20. In making the decision on who is appointed as the AML/CFT compliance officer in the internal regulations defined in Section 65 of the AML Act, the management body must consider the scale and complexity of the financial organization's operations, as well as its exposure to ML/TF risks and the expectations set out in Section V.5 of Recommendation No. 12/2022 (VIII. 11.) of the MNB, based on the criteria defined in Subsection III.5.3. Since the MNB considers the AML/CFT compliance officer to hold a key position, the supervisory expectations applicable to persons holding key positions also apply to them.

21. The MNB expects that the AML/CFT compliance officer is a senior person within the financial organization and has sufficient authority to propose measures necessary or advisable to ensure the adequacy and effectiveness of internal AML/CFT measures on their own initiative to the supervisory and governing bodies.

22. If the AML/CFT compliance officer is appointed, the management body must also determine whether this role is performed on a full-time basis, or whether a senior employee or officer performs it in addition to their existing tasks within the financial organization.

23. If the tasks of the AML/CFT compliance officer are entrusted to an officer or employee who performs other tasks or functions within the financial organization, the management body must identify and weigh potential conflicts of interest and take steps to avoid them, or if this is not possible, to manage them. The management body must ensure that this person can devote sufficient time to performing the AML/CFT compliance officer's tasks.

24. Since it is expected that the AML/CFT compliance officer is available upon request to the MNB and the Financial Intelligence Unit, if the financial organization's headquarters, branch, or establishment is located in Hungary, it is necessary that the AML/CFT compliance officer is appointed in Hungary and performs their work in Hungary.

25. An AML/CFT compliance officer appointed in Hungary may also be entrusted with work in another jurisdiction, provided this is proportionate to the ML/TF risks affecting the financial organization, and provided that the national law of the host state allows it. In such cases, it is expected that the financial organization has the necessary systems and control mechanisms to ensure that the AML/CFT compliance officer has access to all information and systems necessary to perform their duties, and is available without delay to the domestic Financial Intelligence Unit and the MNB. In such cases, it is expected that the financial organization can demonstrate to the MNB, upon request, that the measures introduced by it in this regard are appropriate and effective.

26. It is expected that the AML/CFT compliance officer is capable of delegating and entrusting their tasks as necessary to other officers and employees acting under their supervision and oversight; however, in such cases, it is also expected that the ultimate responsibility for the actual performance of the tasks remains with the AML/CFT compliance officer.

27. As explained in Subsection III.7.4, the AML/CFT compliance officer forms part of the second line of defense, and as such, is part of an independent function, regarding which the following conditions are expected to be met:

a) the AML/CFT compliance officer is independent of the business lines or units they monitor, and is not subordinate to any person responsible for the management of any of the aforementioned business lines or units;

b) the financial organization has implemented internal procedures in accordance with Section 65 of the AML Act and Sections 3-6 of the NGM Regulation to ensure that the AML/CFT compliance officer always has unlimited and direct access to all information necessary to perform their duties. According to the MNB's view, it is good practice for the AML/CFT compliance officer to decide exclusively on what information they need access to in this regard;

c) as referred to in point 19, it is expected that in the event of a significant incident, the AML/CFT compliance officer is capable of reporting it and must have direct access to the supervisory body, or – if there is no management body – to senior management.

III.5.2. The Sanctions Compliance Officer

28. Taking into account point 37, it is expected that the financial organization appoints a senior employee responsible for performing the financial organization's functions and tasks related to restrictive measures.

29. It is expected that the person performing the tasks of the sanctions compliance officer meets the following criteria:

a) in accordance with point 59(d) of Recommendation No. 1/2022 (I. 17.) of the MNB, possesses the appropriate knowledge, skills, and experience necessary to identify, assess, manage, and mitigate ML/TF or proliferation risks arising from restrictive measures or their circumvention, as well as to implement related procedures, control mechanisms, and processes, and is well acquainted with the financial organization's business model and the industry in which it operates, as well as the extent to which this business model exposes the financial organization to risks arising from restrictive measures or their circumvention;

b) keeps informed in a timely manner about decisions and circumstances that may affect the risks related to restrictive measures to which the financial organization is exposed; and

c) devotes sufficient time and resources to effectively perform their tasks.

30. If the tasks of the sanctions compliance officer are entrusted to a senior employee who already performs other tasks or functions within the financial organization, it is expected that this person meets the expectations set out in point 29.

31. If the tasks of the sanctions compliance officer and the AML/CFT compliance officer are performed by two separate persons, the expectations detailed in points 21, 22, 24, and 25, as well as point 27(c), apply mutatis mutandis to the person performing the tasks of the sanctions compliance officer.

III.5.3. Proportionality Criteria for the Appointment of a Separate AML/CFT Compliance Officer

32. The MNB expects that the financial organization appoints an AML/CFT compliance officer, unless it is a sole trader, or it has very few employees taking into account the size-proportionality criteria referred to in point 10 of Recommendation No. 12/2022 (VIII. 11.) of the MNB, or if the appointment is omitted based on the reasons defined in point 33.

33. If the management body decides not to appoint a separate AML/CFT compliance officer, the reasons must be justified and documented, specifically referring at least to the following criteria:

a) the nature of the financial organization's business activities and the associated ML/TF risks, taking into account its geographical exposure, client base, sales channels, as well as its product and service offerings;

b) the scale of operations conducted from the territory of Hungary, the number of clients, the number and volume of transactions, as well as the number of employees expressed in full-time equivalents;

c) the legal form of the financial organization, including whether the financial organization is part of a group.

34. If a separate AML/CFT compliance officer is not appointed, the MNB expects that the financial organization ensures the performance of the AML/CFT compliance officer's tasks by having the designated responsible officer perform them entirely, or by outsourcing operational functions taking into account Subsection VI, or by having the designated responsible officer perform part of the tasks expected to be performed by the AML/CFT compliance officer according to this Recommendation, and outsourcing other tasks as described in Subsection IV.

35. According to the MNB's expectation, the AML/CFT compliance officer may act simultaneously in the representation of different legal entities only if they are part of the same group.

36. If the AML/CFT compliance officer acts in the name of two or more legal entities within the group, or is entrusted with other tasks, the MNB expects that the financial organization ensures that the AML/CFT compliance officer can effectively perform their tasks despite the multiple appointments.

III.5.4. Proportionality Criteria for the Appointment of a Separate Sanctions Compliance Officer

37. The management body may entrust the tasks of the sanctions compliance officer to a senior employee who already performs other tasks or functions within the financial organization (e.g., the AML/CFT compliance officer or the designated responsible officer), provided that:

a) this is justified by the size and complexity of the financial organization and the results of the assessment of exposure to restrictive measures;

b) this does not affect the ability of the sanctions compliance officer, or the senior employee appointed to the task, to effectively perform their task or function; and

c) this combination of tasks does not cause a conflict of interest (e.g., no conflict arises between operational and monitoring tasks entrusted to the senior employee performing the sanctions compliance officer's tasks).

III.5.5. Suitability Criteria for the AML/CFT Compliance Officer

38. The MNB considers it good practice for the financial organization, in order to meet the expectations of Recommendation No. 1/2022 (I. 17.) of the MNB regarding the assessment of the suitability of persons holding key positions, and taking into account what is written therein, to document an assessment of the following regarding the AML/CFT compliance officer candidate before appointment:

a) suitability for performing the tasks, including the candidate's good business reputation and integrity, knowledge, skills, and experience, as well as the time devoted to performing the function effectively and independently;

b) appropriate AML/CFT skills and expertise, including knowledge of the applicable AML/CFT legal and regulatory framework, as well as the implementation of AML/CFT procedures, control mechanisms, and processes;

c) relevant experience related to the identification, assessment, and management of ML/TF risks; and

d) appropriate knowledge and understanding of ML/TF risks related to the financial organization's business model to effectively perform their tasks.

39. Taking into account what is written in point 34, the MNB considers it good practice for the financial organization to ensure that the AML/CFT compliance function is continuously available and operational as part of general business continuity management. In this context, it is important to prepare for managing the risk if the AML/CFT compliance officer terminates their employment relationship with the institution, is absent for a long time, or their integrity is questioned. It must be ensured that in such cases, a person with appropriate skills and expertise is available who takes over the tasks of the AML/CFT compliance officer.

III.6. Suitability Criteria for the Sanctions Compliance Officer

40. The MNB considers it good practice for the financial organization, in order to meet the expectations of Recommendation No. 1/2022 (I. 17.) of the MNB regarding the assessment of the suitability of persons holding key positions, and taking into account what is defined therein, to document an assessment before appointment whether the sanctions compliance officer candidate possesses knowledge related to restrictive measures and the knowledge necessary to effectively perform their tasks.

III.7. Tasks and Role of the AML/CFT Compliance Officer

41. The MNB expects that the role, tasks, and responsibilities of the AML/CFT compliance officer are clearly defined and documented.

III.7.1. Development of the Risk Assessment Framework

42. The MNB expects that, based on the criteria detailed in Section 27(1) and (2) of the AML Act, the AML/CFT compliance officer develops and maintains an ML/TF risk assessment framework for the entire financial organization, as well as for the assessment of individual ML/TF risks, in accordance with what is contained in 6 of the Guidelines referred to in Section 24(c) of the MNB Regulation.

43. The MNB expects that the AML/CFT compliance officer reports to the management body, through the designated responsible officer, on the results of the risk assessment covering the entire financial organization and individual ML/TF risks. If the AML/CFT compliance officer deems it necessary, they may also submit their report directly to the management body, thereby fulfilling the reporting obligation under this point.

44. The MNB expects that the AML/CFT compliance officer submits a proposal to the management body, as referred to in point 42, regarding measures to mitigate risks identified during the risk assessment. In accordance with point 190(g) of Recommendation No. 12/2022 (VIII. 11.) of the MNB, within the scope of measures aimed at mitigating ML/TF risks, the MNB recommends that the introduction of a new product or service, or significant modification of existing ones, the establishment of a new market, or the launch of new activities should not begin until the resources necessary to understand and manage the related ML/TF risks are available and have been effectively implemented.

III.7.2. Development of Regulations and Procedures

45. In accordance with Section 65 of the AML Act, it is expected that the AML/CFT compliance officer ensures that appropriate policies and procedures are implemented, kept up-to-date, and continuously and effectively executed. It is expected that the policies and procedures are proportionate to the ML/TF risks identified by the financial organization. In this regard, the AML/CFT compliance officer must perform at least the following:

a) determine the AML/CFT policies and procedures to be accepted by the financial organization, as well as control mechanisms and systems in accordance with Section 27(5) of the AML Act, Section 65 of the AML Act, and Sections 3-6 of the NGM Regulation;

b) ensure that the financial organization effectively implements AML/CFT policies and procedures as described in Subsection III.7.4;

c) ensure that the financial organization regularly reviews AML/CFT policies and procedures, and modifies or updates them as necessary;

d) propose measures to handle changes in legal or regulatory requirements or in ML/TF risks, and how to best handle errors or deficiencies found during monitoring or supervisory activities.

46. According to the MNB's view, without prejudice to the provisions of the NGM Regulation, the policies, control mechanisms, and procedures mentioned in Section 27(5) of the AML Act, Section 65 of the AML Act, and Sections 3-6 of the NGM Regulation include at least the following:

a) an ML/TF risk assessment methodology covering the entire financial organization and individual assessments;

b) customer due diligence, including the due diligence specified in the Guidelines referred to in Section 24(c) of the MNB Regulation, as well as the customer onboarding process described in Subsection III.7.3, especially for high-risk clients;

c) internal reporting (analysis of unusual transactions) and submission of reports on transactions defined in Section 30(1) of the AML Act to the Financial Intelligence Unit;

d) keeping records; and

e) provisions regarding the monitoring of AML/CFT compliance as described in Subsection III.7.4.

III.7.3. High-Risk Clients

47. The MNB expects that the management of the financial organization consults with the AML/CFT compliance officer before making a final decision on accepting new high-risk clients or maintaining business relationships with high-risk clients in accordance with the financial organization's risk-based internal AML/CFT policies, and especially in situations where the approval of the designated responsible officer is explicitly required by the AML Act or the MNB Regulation. If the designated responsible officer decides not to follow the advice of the AML/CFT compliance officer, the MNB expects that the financial organization records the decision of the designated responsible officer, also indicating how the risks raised by the AML/CFT compliance officer are proposed to be mitigated.

III.7.4. Monitoring Compliance

48. The MNB expects that, as the second line of defense, the AML/CFT compliance officer monitors whether the measures, policies, control mechanisms, and procedures implemented by the financial organization comply with the financial organization's AML/CFT obligations. In this context, it is expected that the AML/CFT compliance officer monitors the effective application of AML/CFT control mechanisms by business lines and internal units – i.e., the first line of defense.

49. The MNB expects that the AML/CFT compliance officer ensures that the AML/CFT framework is updated as necessary, and updated in every such case,

16/34 if a deficiency is detected, a new risk emerges, or if the relevant legal or regulatory framework has changed.

50. The AML/CFT Compliance Officer is required to propose corrective measures to the governing body to address deficiencies identified in the financial organization's AML/CFT framework, including those identified by the MNB, or by internal or external audit functions.

III.7.5. Reporting to the Governing Body

51. The MNB considers it good practice if the AML/CFT Compliance Officer advises the governing body on taking measures to ensure compliance with applicable laws and supervisory expectations, and evaluates the potential impact of changes in the legal or regulatory environment on the financial organization's activities and compliance framework.

52. The MNB expects the AML/CFT Compliance Officer to bring the following to the attention of the designated responsible executive:
    a) areas where it is justified to introduce or improve AML/CFT control mechanisms; b) appropriate improvements proposed in connection with point (a) above; c) the level of exposure to ML/TF risks, and the current status of measures taken or recommended to reduce and effectively manage these risks - including those aimed at their development or improvement; d) if the human and technical resources allocated to the AML/CFT compliance function are insufficient and need to be strengthened.

53. In the application of Section 63(7) of the Pmt., the MNB expects the AML/CFT Compliance Officer to prepare activity reports not only at least twice a year but also on an ad-hoc basis depending on developments. It is expected that the content and frequency of the activity report be proportional to the scale and nature of the financial organization's activities. If the functions of the AML/CFT Compliance Officer and the Sanctions Compliance Officer are separated, this expectation applies, appropriately adapted, to the ad-hoc reports prepared by the Sanctions Compliance Officer. These activity reports may also be based on information contained in reports submitted to competent authorities. In connection with the application of Section 63(8) of the Pmt., it is expected that the activity report - with regard to relevant points concerning activities related to restrictive measures - includes at least the following:

Regarding the ML/TF risk assessment:
a) a summary of the main findings of the ML/TF risk assessment covering the entire financial organization, and information on whether the MNB has required the submission of the ML/TF risk assessment for the current year; b) a description of all changes to the method used by the financial organization to assess individual customer risk profiles, highlighting how this change fits into the ML/TF risk assessment covering the entire financial organization; c) the classification of customers into risk categories, including the number of customer portfolios by risk category for which customer due diligence review and update as prescribed by the Pmt. have not yet been performed; d) information and statistical data on the following:
da) the number of detected unusual transactions; db) the number of analyzed unusual transactions; dc) the number of transactions or activities reported to the Financial Intelligence Unit in accordance with Sections 30 and 31 of the Pmt. (distinguished by the country of the operation); dd) the number of customer relationships terminated by the financial organization due to AML/CFT concerns; de) the number of information requests received from the Financial Intelligence Unit, courts, and law enforcement agencies; df) the number of information requests received from the Financial Intelligence Unit, courts, and law enforcement agencies answered on time and late; dg) data on feedback provided by the Financial Intelligence Unit;

Regarding resources:
e) a brief description of the AML/CFT organizational structure, and if applicable, significant changes made in it during the previous year and the reasons for them; f) a brief description of the human and technical resources allocated by the financial organization to the AML/CFT compliance function; g) a list of outsourced AML/CFT processes, together with a description of the supervision performed by the financial organization regarding these activities;

7 See also the additional expectations described in point 76 regarding the annual report prepared by the Group's AML/CFT Compliance Officer.

17/34

8 See also the provisions contained in Recommendation No. 15/2022 (IX. 15.) of the MNB.

18/34

regarding policies and procedures:
h) a summary of important measures and procedures adopted during the current year and the relevant reporting period, including a brief description of recommendations, problems, deficiencies, and irregularities identified during the reporting period; i) a description of compliance verification measures carried out to evaluate the application of the financial organization's AML/CFT policies, control mechanisms, and procedures by the financial organization's employees, agents, distributors, and external service providers, as well as the adequacy of tracking tools used by the financial organization for AML/CFT purposes; j) a description of the AML/CFT training activities performed and the training plan for the following year; k) the AML/CFT Compliance Officer's activity plan for the following year; l) findings of internal and external audits relevant from an AML/CFT perspective, as well as the progress made by the financial organization to address these findings; m) supervisory activities carried out by the MNB, including communication with the financial organization, reports submitted, identified violations, and imposed sanctions, along with how the financial organization intends to remedy the identified violations, and the current status of corrective measures, without prejudice to any other periodic reports required in the case of supervisory activities or corrective measures.

It is expected that the financial organization be prepared to share a copy of the activity report mentioned in this point with the MNB.

III.7.6. Reports sent to the Financial Intelligence Unit in accordance with Sections 30 and 31 of the Pmt.

54. The MNB expects the AML/CFT Compliance Officer to ensure that employees who assist in fulfilling the reporting obligation under Sections 30 and 31 of the Pmt. possess the necessary skills, knowledge, and competence to perform this task. In doing so, it is necessary to take into account the sensitivity and confidential nature of information that may be disclosed, as well as the confidentiality obligations to be observed by the financial organization.

55. It is expected that the AML/CFT Compliance Officer ensures that when persons designated in accordance with Section 31 of the Pmt. submit reports to the Financial Intelligence Unit, the information contained in the report is transmitted effectively, in a format and using tools that meet the requirements determined by the Financial Intelligence Unit. In connection with reports submitted by persons designated in accordance with Section 31 of the Pmt., the AML/CFT Compliance Officer is required to:
    a) understand the operation and structure of the transaction monitoring system, including scenarios appropriate to the ML/TF risks affecting the financial organization and internal procedures for handling alerts; b) receive reports from the financial organization's employees, agents, or distributors, or otherwise generated by the financial organization's systems, in which ML/TF or suspicion thereof is reported, or which indicate that a person may have had, has, or may have a connection to ML/TF; c) ensure that these reports are examined immediately to determine whether there is information or suspicion that the funds are proceeds of crime - including ML/TF - or that a person may have had, has, or may have a connection to ML/TF. The AML/CFT Compliance Officer is required to define, document, and oversee the implementation of a prioritization process for internal reports to ensure that internal reports concerning particularly high-risk situations are handled with the necessary urgency; d) keep a record of the assessments performed and feedback received from the Financial Intelligence Unit during the evaluation of incoming reports, so that the financial organization can subsequently improve the detection of future transactions as defined in Section 30(1) of the Pmt.; e) ensure, within the framework of compliance with Sections 30 and 31 of the Pmt., that knowledge of ML/TF or a person's connection to ML/TF, and the data, facts, and circumstances regarding this, are reported immediately to the Financial Intelligence Unit, submitting with the report the facts, events, or information and documentation necessary to substantiate the suspicion of ML/TF or the grounds for the suspicion; f) ensure, in accordance with Section 42 of the Pmt., a prompt and comprehensive response to information requests from the Financial Intelligence Unit, such that responses to such inquiries are prepared, where possible, by the organizational unit that submitted the reports as defined in Section 30 of the Pmt., to ensure efficiency; and g) regularly consider why alerts regarding unusual activities or transactions were not escalated as internal reports, to determine if there are issues that should be addressed to ensure the effective detection of unusual activities or transactions.

56. It is expected that the AML/CFT Compliance Officer ensures that the financial organization's internal control functions enable compliance with the guidelines issued by the Financial Intelligence Unit.

57. The MNB expects the financial organization to draw the attention of executives and employees to the prohibition of disclosure as defined in Sections 54 and 55 of the Pmt., i.e., the obligation not to inform clients or third parties that an ML/TF analysis is being or may be conducted in connection with them. In this context, in accordance with Section 54 of the Pmt., it is the MNB's position that access to this information should be restricted to those persons who absolutely need it to perform their duties. Accordingly, the MNB considers it good practice if the AML/CFT Compliance Officer decides who within the financial organization is informed about reports submitted to the Financial Intelligence Unit or information requests received from the Financial Intelligence Unit. Such reporting procedures must be handled confidentially; to this end, the MNB considers it good practice if the identity of persons involved in preparing and transmitting the report is protected by a data protection regulation.

III.8. Duties of the Sanctions Compliance Officer

58. The MNB expects that the role, duties, and responsibilities of the Sanctions Compliance Officer are clearly defined and documented.

III.8.1. Development of the Sanctions Risk Assessment Framework and Related Regulations and Procedures

59. The MNB expects the Sanctions Compliance Officer to develop, implement, and maintain policies, procedures, and controls suitable to ensure that the financial organization complies with restrictive measures and are proportional to the financial organization's exposure to violating restrictive measures.

60. Detailed expectations regarding the duties of the Sanctions Compliance Officer in developing the sanctions risk assessment framework and related regulations and procedures are contained in Chapter II of Annex 1.

III.8.2. Conducting the Assessment of Exposure to Restrictive Measures

61. It is expected that the financial organization's internal procedures extend to the assessment of exposure to restrictive measures to understand the extent to which certain areas of business activity are exposed to restrictive measures or their circumvention.

62. The expectations regarding the duties of the Sanctions Compliance Officer necessary to implement the provisions of point 61 are defined in Chapter 4.2 of EBA/GL/2024/14 guidelines, which, pursuant to Section 24(c) of the MNB Regulation, constitute an obligation of the financial organization.

III.8.3. Ensuring the Continuous Effectiveness of Policies, Procedures, and Controls Regarding Restrictive Measures

63. In order for the financial organization's policies, procedures, and control measures regarding the implementation of restrictive measures to be effective, it is expected that they enable the financial organization to implement all applicable restrictive measures without delay, comprehensively, and appropriately.

64. The expectations regarding the duties of the Sanctions Compliance Officer necessary to implement the provisions of point 63 are contained in Annex 1.

IV. Training and Awareness

65. In accordance with the obligation set forth in Section 64 of the Pmt. and without prejudice to Section 51 of the MNB Regulation, and in accordance with the expectations set forth in the Guidelines referenced in Section 24(c) of the MNB Regulation, the AML/CFT Compliance Officer is required to appropriately train and inform employees about ML/TF risks affecting the financial organization, including ML/TF methods, trends, and typologies, as well as the risk-based approach introduced by the financial organization to mitigate these risks.

66. The MNB expects that the training provided and information given by the Sanctions Compliance Officer extends to the restrictive measures applicable to the financial organization, the results of the assessment of exposure to restrictive measures, and the policies, procedures, and controls aimed at compliance with applicable restrictive measures.

67. The training and information referred to in points 65 and 66 may take various forms, such as corporate letters, intranet, meetings.

68. The MNB expects the AML/CFT Compliance Officer, and if the two functions are separated, the Sanctions Compliance Officer, to oversee the preparation and implementation of the ongoing AML/CFT training program and the training program regarding restrictive measures, respectively. In cooperation with the financial organization's human resources department, an annual plan for employee training and further training must be documented. It is also expected that the training plan be addressed in the activity report submitted to the governing body in accordance with point 53.

69. The MNB expects that the training and information referred to in point 66 be adapted to the individual duties of employees, and be timely and appropriate to ensure that the financial organization can comply with restrictive measures. Within a group, this activity may be performed, in whole or in part, by the parent company. It is expected that the financial organization document its sanctions training plan and, upon request, demonstrate to the MNB that its sanctions training program is appropriate and effective.

70. It is expected of the AML/CFT Compliance Officer to ensure that all employees become aware of the internal reporting procedures adopted by the financial organization.

71. In addition to the general education referred to in Section 64(1) of the Pmt. and Section 51 of the MNB Regulation, and the guidelines referenced in Section 24(c) of the MNB Regulation, it is expected that the AML/CFT Compliance Officer assess specific training needs within the financial organization and ensure that persons exposed to different levels of ML/TF risks receive appropriate theoretical and practical training, for example:
    a) persons involved with clients or entrusted with processing their transactions (employees, agents, and distributors); b) persons responsible for developing procedures or internal tools applicable to activities sensitive to ML/TF risks.

72. The content of special training programs provided to persons exposed to varying degrees of ML/TF risks must be adjusted based on risk sensitivity, taking into account the guidelines referenced in Section 24(c) of the MNB Regulation as well.

73. It is expected that the AML/CFT Compliance Officer also define evaluation metrics to check the effectiveness of the training provided.

74. If the financial organization implements a training and information program developed abroad (e.g., by the registered office or parent company), the AML/CFT Compliance Officer must ensure that this program is consistent with the laws and supervisory expectations applicable in Hungary, as well as with the financial organization's ML/TF typologies and specific activities.

75. If certain training activities are outsourced to an external service provider in accordance with the expectations of Recommendation No. 7/2020 (VI. 3.) and Recommendation No. 4/2019 (IV. 1.) of the MNB, it is expected that the AML/CFT Compliance Officer also ensures that:
    a) the external service provider possesses the necessary AML/CFT knowledge to guarantee the quality of the training provided; b) the outsourcing contract defines the management conditions of the outsourcing and that they are observed; and c) the content of this training is adapted to the specificities of the financial organization.

V. Relationship between the AML/CFT Compliance Function and Other Functions

76. The independent AML/CFT compliance function is expected to be operated as part of the second line of defense of the financial organization.

77. If the AML/CFT compliance function is not performed within the framework of the general compliance function, the MNB expects that, in addition to the expectations of Recommendation No. 12/2022 (VIII. 11.) of the MNB regarding transparent and documented decision-making processes and the clear distribution of responsibilities and powers within internal control functions, the financial organization also take into account the expectations defined in points 78–80.

78. The MNB expects that the external audit function mentioned in Section 27(5) of the Pmt. not be combined with the AML/CFT compliance function.

79. The MNB expects that the risk control function and the risk management committee - if established - operated taking into account Recommendation No. 12/2022 (VIII. 11.) of the MNB, have access to information and data derived from AML/CFT compliance.

80. It is expected that the head of the risk control function, and if relevant considering point 102 of Recommendation No. 12/2022 (VIII. 11.) of the MNB, the Chief Risk Officer, head of bank security, or head of the fraud unit, and the AML/CFT Compliance Officer work together, especially in the area of information exchange. It is also expected that the AML/CFT Compliance Officer provide support to areas performing the risk control function to determine an AML/CFT methodology consistent with the financial organization's risk management strategy.

VI. Outsourcing of Operational Functions of the AML/CFT Compliance Officer

81. The MNB expects that, taking into account and in addition to the provisions of Recommendation No. 4/2019 (IV.1.) of the MNB, the financial organization consider the following key principles when outsourcing the operational functions of the AML/CFT Compliance Officer:
    a) ultimate responsibility for compliance with legal and regulatory obligations - regardless of whether certain functions have been outsourced or not - lies in all respects with the outsourcing financial organization; b) it is expected that the outsourcing contract defines the management conditions of the outsourcing and that they are observed. To this end, without prejudice to the principle set forth in sub-point (a), the rights and obligations of the outsourcing financial organization and the external service provider should be clearly separated and defined in a written agreement. In defining obligations in this manner, it is expected that the external service provider performing the outsourced tasks have direct access to all information necessary to perform its duties, i.e., the financial organization provides or makes available data and information necessary for the performance of the tasks to the external service provider in a manner that allows the external service provider to provide timely, comprehensive, and high-quality services to the financial organization. Part of this expectation is that the external service provider receives timely and comprehensive information about events and deficiencies related to AML/CFT identified by the financial organization's internal control systems, as well as by the MNB - and in the case of groups, by foreign supervisory authorities; c) the financial organization using the outsourcing agreement remains liable for monitoring and supervising the quality of services provided to its clients, in accordance with Recommendation No. 7/2020 (VI. 3.) of the MNB. For this reason, it is expected that the financial organization perform regular checks at the external service provider to determine whether the external service provider is actually implementing the measures and procedures stipulated in the outsourcing contract. The frequency of such checks should be determined taking into account the nature of the outsourced tasks and the risk profile of the outsourcing financial organization; d) it is expected that the financial organization verify the following before outsourcing:
    da) whether the external service provider possesses the AML/CFT expertise necessary to perform the tasks outsourced to it and specific knowledge regarding the industry of the outsourcing financial organization, based on which it can provide services fully adapted to the operational characteristics of the outsourcing financial organization, taking into account its operational model and risk appetite;

24/34 db) whether the external service provider possesses all the human and technical resources necessary to guarantee the timely provision and high quality of the service, enabling it to provide each financial organization it serves with a service that ensures the commissioning financial organization can comply with the applicable AML/CFT obligations and supervisory expectations as if it were performing the task itself; dc) if the external service provider offers services for AML/CFT compliance to multiple clients simultaneously, whether it has appropriate procedures, organizational, and technical safeguards to ensure that data and information obtained or available during the performance of tasks for different clients do not become known to clients not entitled to access such information; dd) whether the external service provider can ensure a level of data protection compliance at least equivalent to that which the financial organization would provide itself, in consideration of the data protection expectations of Recommendation 7/2020. (VI. 3.) MNB, to protect personal data obtained or available during the performance of AML/CFT compliance services; de) whether the external service provider understands the Hungarian language and can provide the outsourced AML/CFT services to the financial organization in Hungarian, to ensure the ability to correctly interpret and apply applicable legal provisions and the financial organization's internal documents; df) whether the external service provider can personally make itself fully available to the MNB for the exercise of the MNB's tasks and powers, which includes the expectation that the premises used by the external service provider for AML/CFT tasks are easily and quickly accessible, to ensure the MNB can monitor and track whether the financial organization complies with all its obligations; to this end, it is expected that the location of the AML/CFT service provided and the location where data necessary for the performance of AML/CFT tasks are stored, processed, and handled are not in a third country; e) the same expectations apply to outsourcing within the group as to outsourcing outside the group, provided that this is not contrary to relevant local regulations for a group entity, taking into account the provisions of point 5 of Recommendation 7/2020. (VI. 3.) MNB; f) the outsourcing of individual AML/CFT functions must not result in the delegation of the responsibilities of the governing body, i.e., in the opinion of the MNB, strategic decisions related to AML/CFT cannot be outsourced. These decisions include in particular the following:
fa) approval of the ML/TF risk assessment covering the entire financial organization;

25/34 fb) decision on the establishment of business relationships 9; fc) decision on the internal organization of the financial organization's AML/CFT framework; fd) adoption of internal AML/CFT policies and procedures; fe) approval of the methodology used to determine the ML/TF risk posed by a specific business relationship and the assignment of risk profiles; ff) approval of the criteria used by the financial organization to detect suspicious or unusual transactions for the purpose of ongoing monitoring and reporting; fg) the obligation to report suspicious activities, except in the case of outsourcing to a group entity with its registered office in Hungary; fh) the quality assurance control of services provided by the external service provider; g) the outsourcing financial organization bears the ultimate responsibility for the decision to report suspicious transactions to the Financial Intelligence Unit, taking into account the general provisions and expectations regarding outsourcing, including situations where the identification and reporting of suspicious transactions are outsourced.

82. The MNB expects that the financial organization follows the outsourcing process defined in Recommendation 7/2020. (VI.3.) MNB when outsourcing the operational tasks of the AML/CFT compliance officer to an external service provider. This includes identifying and assessing the relevant risks of the outsourcing agreement, justifying the decision to outsource in light of the set objectives (whether ensuring optimal distribution of AML/CFT resources within the group or applying proportionality criteria), conducting due diligence on the prospective external service provider, and formalizing the outsourcing agreement in a written contract.

83. If the financial organization outsources only tasks related to the AML/CFT compliance function, the MNB expects that the AML/CFT compliance officer is tasked with the following:
    a) monitoring the performance of the external service provider to ensure that the outsourcing actually enables the financial organization to comply with all legal and regulatory AML/CFT obligations; b) regular verification of the external service provider's compliance with obligations arising from the outsourcing agreement. In line with the documented analysis, the regular verification must ensure that the AML/CFT compliance function has tools to test and verify the fulfillment of obligations assigned to the outsourcing financial organization both regularly and ad hoc. Regarding customer data, the AML/CFT compliance officer of the outsourcing financial organization and the MNB must be granted access rights to the external service provider's systems/databases; c) reporting on the outsourcing to the governing body as part of the AML/CFT compliance officer's activity report, or in any other case where circumstances require it, particularly with the aim of implementing necessary corrective measures as soon as possible.

9 In accordance with the provisions of Section 24 (2) of the Pmt.

26/34
84. In the opinion of the MNB, within a group, taking into account proportionality considerations, the AML/CFT compliance officer may perform this task for another group entity if the outsourcing financial organization does not have its own officers or employees outside the governing body. In such cases, the MNB considers it good practice to appoint the AML/CFT compliance officer of one of the financial organizations within the group as the AML/CFT compliance officer, provided that person has practical experience or knowledge of the types of activities or transactions performed by the financial organization.

85. In cases where the financial organization applies intra-group outsourcing, the MNB expects that it takes the necessary measures to identify and handle potential conflicts of interest arising from such outsourcing agreements. The parent company of the group must:
    a) ensure that the affected entities prepare an inventory of cases of intra-group AML/CFT outsourcing to determine which function belongs to which entity, and make it regularly accessible for their review; and b) ensure that intra-group outsourcing does not jeopardize the fulfillment of AML/CFT obligations of individual subsidiaries, branches, or other establishments.

86. The MNB expects that the financial organization does not outsource AML/CFT-related tasks and responsibilities to any group entity established in a third country, nor to any external service provider located in such a country.

VII. Organization of AML/CFT Compliance at Group Level
VII.1. General Provisions on AML/CFT Specific to Groups

87. It is expected that the financial organization adapts its internal control framework for AML/CFT risks to its own business activities, their complexity, and the associated risks, taking into account the provisions of Section V.5 of Recommendation 12/2022 (VIII. 11.) MNB.

88. For financial organizations subject to consolidated supervision based on sectoral laws (hereinafter: the parent financial organization), it is expected that the parent financial organization is capable of assessing the ML/TF risk profile of the entire group, in line with the guidelines referenced in point c) of Section 24 of the MNB Regulation.

89. It is expected that the parent financial organization ensures at the group level the flow of relevant information between (i) business lines and the AML/CFT compliance function (including the sanctions compliance function), (ii) the compliance function (if these are separate functions), and (iii) the heads of internal control departments and the governing body of the financial organization at the group level.

90. It is expected that the governing body of the parent financial organization ensures at the group level that every governing body, business line, and internal unit—including every internal control function of the group's subsidiaries—has access to relevant information necessary for compliance with restrictive measures.

91. The general ultimate legal responsibility for compliance with restrictive measures lies individually with each member of the group in respect of all expectations detailed in the organizational operational framework described in Section VII.

92. It is expected that the governing body of the parent financial organization ensures that the group's subsidiaries carry out their independent assessment of compliance with restrictive measures and their exposure to circumvention thereof in a coordinated manner and based on a common methodology reflecting the characteristics of the group.

93. It is expected that the governing body of the parent financial organization ensures that all tasks defined in point f) of point 11 are also performed at the level of the subsidiaries, and that the policies and procedures introduced are aligned with the group's procedures and policies to the extent permitted by applicable national law.

VII.2. Role of the Governing Body in AML/CFT at Group Level

94. It is expected that the governing body of the parent financial organization performs at least the following tasks:
    a) to map ML/TF risks affecting individual group entities, it ensures that group entities carry out their comprehensive ML/TF risk assessments in a coordinated manner and based on a common methodology, while considering their specific characteristics, taking into account Sections 27 (1) and (2) of the Pmt. and the guidelines referenced in point c) of Section 24 of the MNB Regulation; b) when informed by the designated responsible executive of the governing body of the parent financial organization, or by the senior management of the parent financial organization, or directly by the AML/CFT compliance officer of the parent financial organization, about supervisory activities conducted by the competent authority regarding a group entity or identified deficiencies, it ensures that the affected group entity takes necessary corrective measures in a timely and effective manner; c) regarding restrictive measures, the tasks mentioned in points a)–c) and f) of point 8.

28/34
VII.3. Group-Level Organizational Requirements

95. The MNB expects that in the implementation of group-level policies and procedures mentioned in Sections 60-62 of the Pmt., the parent financial organization, as the parent company, and the other members of the group, as well as between individual group entities, conflicts of interest—i.e., business areas generating ML/TF or sanctions risks, such as commercial functions—do not jeopardize compliance with AML/CFT requirements or compliance with restrictive measures, and that any potential conflicts of interest are handled.

96. It is expected that the parent financial organization:
    a) appoints a member of its governing body or a senior executive responsible for the implementation of group-level AML/CFT requirements and expectations by the parent financial organization, as well as the group-level AML/CFT compliance officer who performs the tasks specified in point 100; b) appoints the group-level sanctions compliance officer who performs the tasks specified in Section III.8 at the group level; c) ensures that AML/CFT internal governance and control practices based on identical principles within the group are implemented, provided this is not contrary to applicable local regulations for any group entity, including systems and procedures serving AML/CFT objectives; d) establishes a group-level organizational and operational coordination structure with sufficient decision-making authority to lead the group's AML/CFT activities to effectively manage and prevent ML/TF risks, in line with the principle of proportionality, applicable laws, and supervisory expectations; e) approves group-level AML/CFT policies and procedures with its governing body, ensures they are consistent with the group's structure, as well as the size and characteristics of the financial organizations belonging to the group, and ensures that the AML/CFT policies and procedures of group entities are consistent with the group-level AML/CFT policies and procedures, provided this is not contrary to applicable local regulations for any group entity; f) establishes group-level AML/CFT control mechanisms; and g) regularly evaluates the effectiveness of group-level AML/CFT policies and procedures.

97. It is expected that the group-level AML/CFT compliance officer cooperates fully with the AML/CFT compliance officers of the group entities, and if the two functions are separated, with the group-level sanctions compliance officers.

98. It is expected that the group-level sanctions compliance officer cooperates fully with the sanctions compliance officers of the group entities, and if the two functions are separated, with the group-level AML/CFT compliance officer.

99. It is expected that if the financial institution is a member of a group, the group-level sanctions compliance officer evaluates the effectiveness of policies, procedures, and controls regarding compliance with restrictive measures among branches, subsidiaries, intermediaries, distributors, and agents.

100. It is expected that the group-level AML/CFT compliance officer performs at least the following tasks:
     a) coordinates the comprehensive assessment of ML/TF risks performed by group entities at the local level and organizes the aggregation of results to obtain a proper picture of the nature, intensity, and location of ML/TF risks affecting the entire group; b) develops the ML/TF risk assessment covering the entire group. In this regard, the group-level ML/TF risk management system of the parent financial organization must take into account both the individual risks of group entities and their possible interactions, which may have a significant impact on group-level risk exposure. In this regard, special attention should be paid to risks to which third-country group entities are exposed, particularly if they are located in high ML/TF risk countries; c) defines group-level AML/CFT standards and ensures that the local policies and procedures of group entities comply with the AML/CFT laws and supervisory expectations applicable to them, and that the standards applied by group entities are consistent with group-level standards; d) coordinates the activities of the AML/CFT compliance officers of group entities to ensure they perform their tasks in a consistent manner; e) monitors whether third-country group entities comply with the group-level AML/CFT policies defined by the parent financial organization, particularly in the case of third countries where the requirements for preventing ML/TF risks are less strict than the group-level policy 10; f) develops AML/CFT policies, procedures, and measures applicable to the entire group in accordance with the applicable legal and regulatory framework, with particular regard to data protection and the sharing of information within the group for AML/CFT purposes; and g) ensures that group entities have appropriate procedures for reporting transactions as referred to in Section 30 (1) of the Pmt., and share information without prejudice to applicable confidentiality rules, including information that a report has been submitted to the local financial intelligence unit regarding a transaction.

10 See also Commission Delegated Regulation (EU) 2019/758 of 31 January 2019 supplementing Directive (EU) 2015/849 of the European Parliament and of the Council with regard to regulatory technical standards on minimum measures and additional measures to be taken by credit institutions and financial institutions to mitigate risks of money laundering and terrorist financing in certain third countries, as well as the Joint ESA Regulatory Technical Standards on the application of group-level AML/CFT policies in third countries (JC 2017 25, 6 December 2017).

30/34
101. The MNB expects that the group-level AML/CFT compliance officer prepares an activity report at least twice a year, or if the two functions are separated, the group-level sanctions compliance officer prepares an activity report at least once a year, and presents it to the governing body of the parent financial organization. In addition to what is mentioned in point 52, the report submitted by the group-level AML/CFT compliance officer or the group-level sanctions compliance officer, based on reports submitted by the AML/CFT compliance officers or sanctions compliance officers of the group entities, must contain at least the following information:
a) group-level consolidated statistics, particularly regarding ML/TF or sanctions risk exposure and data, facts, and circumstances serving as the basis for reporting under Section 30 of the Pmt.; b) monitoring of inherent ML/TF risks arising at group entities, and analysis of the potential impact of residual risks; c) supervisory review of group entities, internal or external audits, addressing serious deficiencies in the AML/CFT policies and procedures of group entities, as well as steps or recommendations regarding corrective measures; and d) information regarding the governance and supervision of group entities, with particular regard to group entities operating in high-risk third countries. It is expected that the AML/CFT compliance officer of a group entity can report directly to the group-level AML/CFT compliance officer.

102. Taking into account the principle of proportionality, it is expected that the parent financial organization also establishes a committee competent for group-level AML/CFT and sanctions compliance matters.

VIII. Final Provisions

103. The recommendation is a regulatory instrument issued without binding force for financial organizations, pursuant to point i) of Section 13 (2) of Act CXXXIX of 2013 on the Magyar Nemzeti Bank. The content of the recommendation issued by the MNB expresses the requirements imposed by laws, principles and methods recommended for application based on the MNB's law enforcement practice, market standards, and conventions.

104. The MNB monitors and evaluates compliance with the recommendation during its supervisory and monitoring activities among the financial organizations under its supervision.

105. The MNB draws attention to the fact that a financial organization may incorporate the content of the recommendation into its regulations. In this case, the financial organization is entitled to state that the provisions contained in its relevant regulations comply with the recommendation issued by the MNB. If the financial organization wishes to include only parts of the recommendation in its regulations, it should avoid referring to the recommendation and apply it only with respect to the parts transposed from the recommendation.

106. The MNB expects the affected financial organizations to apply this recommendation from March 31, 2026. The reports contained in Annex 1 to this recommendation must be prepared after all necessary data are fully available, but at the earliest from the second quarter of 2026.

107. Taking into account the provision in point c) of Section 24 of the MNB Regulation, Recommendation 15/2022. (IX.15.) MNB on the assessment of money laundering and terrorist financing risks of financial institutions and the determination of related measures ceases to be effective on the day of publication of this recommendation.

108. Recommendation 3/2024. (V.24.) MNB on compliance officers for combating money laundering and terrorist financing, their duties and responsibilities, and related internal procedures and control mechanisms ceases to be effective on March 31, 2026.

Varga Mihály signed
President of the Magyar Nemzeti Bank

32/34
Annex 1 to Recommendation 1/2026 (II.24.) MNB
Detailed expectations regarding internal policies, procedures, and controls ensuring the implementation of EU and national restrictive measures
I. General Provisions

1. The financial organization must identify and assess which areas of its business activities are particularly sensitive or exposed to restrictive measures and the circumvention of restrictive measures. It is expected that the financial organization designs, implements, and maintains its internal policies, procedures, and controls to ensure compliance with restrictive measures.

2. It is expected that these policies, procedures, and controls are effective and proportional to the size, nature, and complexity of the financial organization, as well as its exposure to restrictive measures.

II. Expectations regarding the tasks of the sanctions compliance officer in developing the sanctions risk assessment framework and related regulations and procedures

3. It is expected that the sanctions compliance officer:
   a) takes the necessary measures in accordance with point 62 to ensure compliance with Chapter 4.2 of the EBA/GL/2024/14 Guidelines on the assessment of exposure to restrictive measures; b) takes the necessary measures to comply with the provisions of Section III.8.3 regarding policies and procedures on effective restrictive measures; c) regularly and appropriately informs the governing body so that it can perform the tasks expected as referred to in Sections III.2 and III.3. The management reports must contain at least the following:
   ca) changes in the financial organization's exposure to restrictive measures and the results of the financial organization's assessment of its exposure to restrictive measures; cb) changes in restrictive measures regimes and their impact on the financial organization; cc) statistics on the following:
   i) the number of alerts generated in screening systems ensuring compliance with restrictive measures; ii) the number of alerts awaiting analysis;

---

iii) the number of reports submitted in connection with the implementation of restrictive measures; iv) the average time elapsed between a positive match and the submission of the report regarding that match; v) the value of frozen funds and frozen economic resources held by the financial institution, as well as the nature of these assets;

cc) information regarding human and technical resources, and the adequacy of these resources in light of the financial organization's exposure to restrictive measures;

dd) identified shortcomings or deficiencies in the financial organization's policies, procedures, and controls regarding restrictive measures, including comments made by the MNB in the context of supervising the policies, procedures, and controls for the implementation of restrictive measures;

ee) instances of violation and circumvention of restrictive measures, as well as the causes of such violations and circumvention;

ff) recommendations on how to handle changes in regulatory requirements or exposure to restrictive measures, as well as identified shortcomings or deficiencies in the financial organization's policies, procedures, or controls regarding restrictive measures, and identified instances of violation and circumvention of restrictive measures;

gg) in accordance with the requirements of applicable laws, reports all violations of restrictive measures to the Financial Intelligence Unit;

hh) in accordance with the requirements of applicable laws, cooperates with the MNB and the Financial Intelligence Unit.

III. Ensuring the Continuous Effectiveness of Policies, Procedures, and Controls Regarding Restrictive Measures

4. In accordance with the provisions of Section III.8.3 of the Recommendation, in order for the financial organization's policies, procedures, and control measures regarding the implementation of restrictive measures to be effective, it is expected that they enable the financial organization to implement all applicable restrictive measures without delay, comprehensively, and appropriately.

5. It is expected that the rules, procedures, and controls to be prepared under the care of the Sanctions Compliance Officer cover at least the following:

a) processes that ensure the financial organization has up-to-date information regarding applicable restrictive measures;

34/34 b) processes that ensure the list and requirements of applicable restrictive measures are updated as they enter into force;

c) processes to ensure that the assessment of exposure to restrictive measures remains relevant and up-to-date;

d) processes that ensure that policies, procedures, and controls are proportional to the exposure to restrictive measures;

e) processes that ensure that policies and procedures regarding restrictive measures:

aa) are reviewed regularly;

bb) are modified and updated regularly when and where necessary;

cc) are implemented effectively; and

dd) are designed to ensure the implementation of necessary measures after the identification of shortcomings;

ff) procedures for the prompt investigation of all possible matches in connection with alert handling;

gg) in the event of a positive match, procedures that ensure follow-up measures for compliance with restrictive measures, including immediate rejection, suspension, or freezing, as well as reporting to the Financial Intelligence Unit in accordance with the Anti-Money Laundering Act;

hh) a documented organizational and operational framework that clearly defines tasks and responsibilities regarding restrictive measures, including in cases of outsourcing;

ii) other detailed aspects specified in the MNB Recommendation on internal policies, procedures, and controls ensuring the implementation of EU and national restrictive measures related to money transfers and certain crypto-asset transfers.

11 At the time of issuance of this Recommendation, Recommendation 3/2026. (III.25.) of the MNB.