Recommendation No. 3/2026 (March 25) of the Magyar Nemzeti Bank

on internal policies, procedures and controls ensuring the implementation of EU and national restrictive measures related to fund transfers and certain crypto-asset transfers

I. Purpose and Scope of the Recommendation

The purpose of this Recommendation is to formulate the expectations of the Magyar Nemzeti Bank (hereinafter: MNB) and thereby increase the predictability of law application, to facilitate the uniform application of relevant legislation by determining the factors that payment service providers and crypto-asset service providers supervised by the MNB must implement in relation to their internal policies, procedures, and control mechanisms when executing fund transfers and crypto-asset transfers in accordance with Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 amending Regulation (EU) 2015/849 on information accompanying transfers of funds, in order to ensure the effective implementation of EU and national restrictive measures.

These policies, procedures, and controls must enable payment service providers and crypto-asset service providers to identify persons subject to restrictive measures, and also to enable payment service providers and crypto-asset service providers to take necessary measures to ensure that they do not make funds or crypto-assets available to the aforementioned persons, do not execute financial transactions or services prohibited by restrictive measures, and manage the risk of circumvention of restrictive measures.

This Recommendation transposes the guidelines published by the European Banking Authority (hereinafter: EBA) on 13 November 2024, titled "Guidelines on internal policies, procedures and controls to ensure implementation of Union and national restrictive measures under Regulation (EU) 2023/1113" (EBA/GL/2024/15; 1 hereinafter: EBA Guidelines). Taking as a basis the expectations formulated in the EBA Guidelines, the MNB defines in this Recommendation the practice to be followed by the service providers included in the target group. By publishing this Recommendation, the MNB ensures compliance with the provisions of the EBA Guidelines.

The addressees of this Recommendation are payment service providers and crypto-asset service providers (hereinafter together: Service Providers) participating in fund transfers or crypto-asset transfers, having their registered office in Hungary, having a branch, or being incorporated or established in another Member State of the European Union and offering services directly to customers through a permanent domestic presence established in Hungary via a permanent establishment, as defined in point 5 of Article 3 of Regulation (EU) 2023/1113 of the European Parliament and of the Council and point 15 of Article 3 of the same Regulation.

1 https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/anti-money-laundering-and-countering-financingterrorism/guidelines-internal-policies-procedures-and-controls-ensure-implementation-union-and-national

This Recommendation does not refer comprehensively to legislative provisions when formulating principles and expectations; however, the addressees of this Recommendation remain, of course, obliged to comply with the relevant legislative requirements. The provisions of this Recommendation are in line with the requirements defining the European framework for the operation of financial organizations.

This Recommendation does not provide guidance on data protection and data processing issues, and the requirements contained herein cannot in any way be interpreted as authorization to process personal data. Data processing in connection with the fulfillment of supervisory expectations established in this Recommendation – taking into account the provisions of Regulation (EU) 2023/1113 of the European Parliament and of the Council – may only be carried out in compliance with the applicable data protection legislation.

II. Interpretative Provisions

1. For the purposes of this Recommendation:

1.1. sectoral restrictive measures: restrictive measures such as embargoes on weapons and related equipment or economic and financial measures (e.g., import and export restrictions, as well as restrictions on the provision of certain services, such as banking services);

1.2. targeted financial sanctions: the freezing of assets and the prohibition of the direct or indirect making available of money or other assets to or for the benefit of persons and organizations listed in Council decisions adopted under Article 29 of the Treaty on European Union and Council regulations adopted under Article 215 of the Treaty on the Functioning of the European Union;

1.3. restrictive measures: financial and asset restrictive measures as defined in point 5 of Section 2 of Act No. LII of 2017 on the implementation of financial and asset restrictive measures ordered by the European Union and the United Nations Security Council (hereinafter: Pvkit.), atypical financial restrictive measures referred to in point 2a of Section 3 of Act No. LIII of 2017 on the prevention and suppression of money laundering and terrorist financing (hereinafter: Pmt.), and national restrictive measures adopted in accordance with Hungarian law, insofar as they relate to financial institutions.

1.4. In addition to the provisions of points 1.1.–1.3., the concepts used in this Recommendation shall be interpreted in accordance with the Pmt. and Regulation (EU) 2023/1113 of the European Parliament and of the Council.

III. Internal policies, procedures and controls ensuring the implementation of EU and national restrictive measures under Regulation (EU) 2023/1113

III.1. General Provisions

2. The MNB expects that Service Providers implement policies, procedures, and controls to comply with restrictive measures. The MNB expects that these policies, procedures, and controls be developed taking into account the provisions of Recommendation No. 1/2026 (February 24) of the MNB on officers ensuring compliance with the fight against money laundering and terrorist financing, their tasks and responsibilities, and the related internal procedures and control mechanisms.

3. It is expected that these policies, procedures, and controls enable the Service Provider to identify persons subject to restrictive measures and to take necessary measures to ensure that they do not make funds or crypto-assets available to the aforementioned persons, do not execute financial transactions or services prohibited by restrictive measures, and manage the risk of circumvention of restrictive measures.

III.2. Screening related to restrictive measures

4. The MNB expects that Service Providers implement an effective screening system for the reliable identification of persons subject to restrictive measures as detailed in point III.4.5.

III.2.1. Selection of the screening system

5. It is expected that the Service Provider uses the assessment of its exposure to restrictive measures to decide which screening system to use, or to validate the screening system it uses for compliance with restrictive measures. It is expected that the Service Provider adapts the screening system to the size, nature, and complexity of its business activities, as well as to its exposure to restrictive measures.

6. The MNB expects that when making the decision regarding the screening system, the Service Provider considers whether it can ensure the resources necessary for the effective use of the selected system.

7. The MNB expects that the Service Provider regularly reviews the performance of its screening systems to ensure that they remain effective and continue to reliably identify the targets of restrictive measures. It is expected that the Service Provider reviews the applied screening system at least once a year, and also immediately if there is reason to believe that the system may not meet the purpose.

8. Taking into account Article 7 of Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EU) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011, the Service Provider must understand and document the capabilities and limitations of the screening system. The MNB expects that the Service Provider can demonstrate, upon the MNB's request, that its screening system is adequate.

III.2.2. List management

9. The MNB expects that the Service Provider refers in its policies and procedures to the restrictive measures it is obliged to apply.

10. The MNB expects that the Service Provider has policies and procedures that
    a) identify when new restrictive measures are adopted, or when existing restrictive measures are updated or abolished; b) based on point III.2.3, the Service Provider updates its data set immediately after the entry into force of new restrictive measures, or after the update or abolition of existing restrictive measures, or, if it uses a screening system from an external provider, selects a screening system that ensures immediate updating of the data set.

III.2.3. Determination of the scope of data to be checked

11. It is expected that the Service Provider defines in its policies and procedures what types of data it will screen for different types of restrictive measures, taking into account the results of the assessment of exposure to restrictive measures and the restrictive measures it applies.

12. The MNB expects that when determining the data set to be screened by the type of restrictive measure, the Service Provider takes into account all data it possesses regarding its customers, including information received
    a) in the application of customer due diligence measures; and b) during compliance with Regulation (EU) 2023/1113 of the European Parliament and of the Council.

13. In accordance with the requirements of Regulation (EU) 2023/1113 of the European Parliament and of the Council, the Service Provider must assess whether the data in its possession are sufficiently accurate, up-to-date, and detailed to enable it to determine whether the party involved in the data transmission, the beneficial owner, or any person acting on their behalf or authorized to do so is subject to restrictive measures.

14. The MNB expects that to avoid repeated false alerts regarding natural or legal persons, organizations, or bodies that are not subject to restrictive measures but are incorrectly identified by the existing screening system, the Service Provider adds these persons to an internal list (whitelisting). It is also expected that the Service Provider documents the reason for the decision to add the person to the whitelist, reviews the list immediately after the entry into force of a new or modified restrictive measure or a change in customer data, and that the Service Provider displays in its general privacy notice the fact of the application of the whitelist and the possibility of data processing related to this listing.

III.2.4. Screening of the customer base

15. The MNB expects that the Service Provider defines in its policies and procedures how it will screen its customer base.

16. It is expected that the Service Provider regularly reviews its entire customer database and determines the frequency of customer screening based on the assessment of exposure to restrictive measures.

17. The MNB expects the Service Provider to determine in its internal procedures when customer screening must always take place, and to keep these decisions up to date. It is expected that the scope of events triggering screening includes at least the following:
    a) any modification of existing listings or restrictive measures, the entry into force of a new designation or new restrictive measure; b) before the transaction order or the establishment of a business relationship; c) if significant changes occur in a customer's customer due diligence data, such as name change, residence, citizenship, or change in business activity; d) if there is reasonable grounds to believe that the customer or a person acting or authorized to act on behalf of the customer attempts to circumvent restrictive measures.

18. It is expected that the Service Provider checks at least the following customer information in accordance with restrictive measures:
    a) in the case of a natural person: first name and surname, in the original and transliterated 2 versions, as well as date of birth; b) in the case of a legal person: the name of the legal person, in the original and transliterated versions; c) in the case of a natural person, legal person, body, or organization: other names, including trade names, wallet addresses, if they are available in lists related to restrictive measures; the MNB expects that the Service Provider sufficiently justifies through the assessment of exposure to restrictive measures why it does not examine such information if it is available.

2A Transliteration is a letter-by-letter writing, a type of transcription in which, in the case of two different letter or syllable writing alphabets, each letter of the source writing corresponds to a one-, two-, or three-letter character, diacritic mark, or combination thereof in the receiving writing. Transcription is a phonetic transcription, in which the letters of one writing system correspond to letters in another writing system according to their sound. (source: https://www.offi.hu/sites/default/files/media/files/8-ugroczky-maria.pdf, p. 142.)

19. It is expected that when screening legal persons, natural persons, bodies, or organizations, the Service Provider – if this information is available – also screens the following:
    a) beneficial owners through ownership interest; b) beneficial owners exercising controlling influence; c) persons intending to act or authorized to act on behalf of the customer.

The MNB also considers it good practice if the Service Provider extends the above screening to owners who do not qualify as beneficial owners.

III.2.5. Screening of fund transfers and crypto-asset transfers

20. The MNB expects that – with the exception of cases falling under Article 5d of Regulation (EU) 260/2012 of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euros and amending Regulation (EU) No 924/2009 – payment service providers review fund transfers before making funds available to the beneficiary, and that crypto-asset service providers review all crypto-asset transfers before making crypto-assets available to the crypto-asset beneficiary, regardless of whether they are executed as part of a business relationship or as a one-off transaction.

21. The MNB expects that the Service Provider screens all parties executing fund transfers or crypto-asset transfers based on the relevant restrictive measures. The MNB expects that the Service Provider pays particular attention during the assessment of exposure to restrictive measures to the adequacy and reliability of the policies and procedures introduced by other Service Providers with whom it has a business relationship to ensure compliance with restrictive measures.

22. The MNB expects that the Service Provider examines all data that may be relevant to assess whether a transaction may be affected by restrictive measures. It is expected that the data to be examined covers at least the following:
    a) data regarding the payer and the payee as defined in Article 4 of Regulation (EU) 2023/1113 of the European Parliament and of the Council; b) information regarding the originator and the payee as defined in Article 14 of Regulation (EU) 2023/1113 of the European Parliament and of the Council; c) the purpose of the transfer of funds or crypto-assets, and – if the information is available and falls within the scope of the assessment of exposure to restrictive measures – other free-text fields that provide additional information about the actual sender or recipient of funds or crypto-assets; d) data of payment service providers and crypto-asset service providers involved in the transfer of funds or crypto-assets, including intermediary institutions, correspondent banks, by screening identification codes such as BIC, SWIFT, and other identification codes; e) other details regarding the transfer of funds or crypto-assets, depending on the nature and type of the operation, the supporting documentation received, if information is available and falls within the scope of the exposure assessment of restrictive measures; f) wallet addresses of the initiator and beneficiary of crypto-asset transfers, if this information is available on official lists of wallet addresses related to restrictive measures.

23. In accordance with the provisions of the MNB Recommendation on data reporting requirements related to fund transfers and certain crypto-asset transfers 3 regarding missing or incomplete data, it is also expected that new information obtained before or after the execution of the transfer is examined later.

24. The MNB considers it good practice if crypto-asset service providers, where appropriate, consider based on the volume and number of crypto-asset transfers whether to incorporate blockchain analysis into their existing operating system for the purpose of monitoring transactions.

III.2.6. Calibration

25. The MNB expects that the Service Provider determines how the settings of the automated screening system should be calibrated to maximize alert quality and lead to clear identification, while simultaneously ensuring compliance with restrictive measures. The MNB expects that, based on the assessment of exposure to restrictive measures and regular testing, the Service Provider determines at least
    a) for each restrictive measure, the appropriate matching parameters that are likely to result in reasonable alerts, enabling the Service Provider to fulfill its obligations related to restrictive measures, by checking the threshold values of true positive results associated with different percentages of matching. The calibration must not be too sensitive, which would cause a large number of false positive hits, nor too coarse, which would result in listed persons, organizations, or bodies not being detected, or free-form information not being used for other restrictive measures; b) applies a screening system that allows the application of an algorithm-based technique capable of comparing a given name or phrase, if the content of the information being examined is not identical, but its spelling, pattern, or sound is close to the content in the data set used for screening ("partial match" techniques), and is capable of calibrating the degree of "partial match" in its screening system.

3 At the time of issuance of this Recommendation: Point III.6 of Recommendation No. 8/2025 (June 26) of the MNB on data reporting requirements related to fund transfers and certain crypto-asset transfers (https://www.mnb.hu/letoltes/8-2025-adatkozlesi-kovetelmenyekrol-ajanlas.pdf).

26. It is expected that the Service Provider decides on calibration both before developing a new screening system and periodically, in accordance with the assessment of exposure to restrictive measures, documenting the decision with justification and making it available to the MNB upon request.

III.2.7. Use of services of external parties and outsourcing

27. The MNB expects that the Service Provider defines in its policies and procedures what steps the Service Provider or the service providers performing the outsourced activities take to ensure compliance with restrictive measures. The MNB expects that regarding the outsourcing of services, the Service Provider – taking into account, where relevant, the MNB Recommendation on the use of external service providers 4 – applies the following main principles:
    a) the ultimate responsibility for compliance with restrictive measures – regardless of whether certain tasks have been outsourced or not – lies with the Service Provider; b) the rights and obligations of the Service Provider and the service provider performing the outsourced activities must be clearly separated and defined in a written agreement; c) the Service Provider relying on the outsourcing agreement must remain accountable for monitoring and supervising the quality of services provided by the service providers performing the outsourced activities; d) the same regulatory framework applies to intra-group outsourcing as to outsourcing to service providers outside the group.

28. The MNB expects that the Service Provider implements and applies the necessary controls to ensure that the use of service providers performing outsourced activities does not expose it to the risk of violating restrictive measures, and that these controls are documented in the outsourcing agreement.

29. If the Service Provider needs to update the data to be used regarding natural persons, legal persons, organizations, and bodies subject to restrictive measures, the MNB expects the Service Provider to ensure that the service agreement minimizes to the greatest extent possible the risk of the Service Provider violating restrictive measures.

30. The MNB expects that during the validity period of the outsourcing agreements, the Service Provider regularly checks whether the service provider performing the outsourced activities complies with the obligations arising from the agreement, evaluates the effectiveness of the services covered by the agreement, and takes necessary risk-reducing measures, including renegotiating the agreement.

31. The expectations set out in points 27–30 do not affect the obligations and tasks of Service Providers regarding digital operational resilience as defined in Regulation (EU) 2022/2554 of the European Parliament and of the Council.

4 At the time of issuance of this Recommendation: Recommendation No. 7/2020 (June 3) of the MNB on the use of external service providers (https://www.mnb.hu/letoltes/7-2020-kulso-szolgaltato-igenybevetele.pdf).

III.3. Screening and Control Measures for Alert Analysis

III.3.1. Policies and Procedures for Handling and Analyzing Alerts

32. The MNB expects the Service Provider to have a policy and procedure for investigating alerts related to restrictive measures, which enables the Service Provider to confirm whether the alert is a true positive and, if so, to determine the measures necessary to comply with the restrictive measure.

33. It is expected that this policy and procedure covers the following:
    a) steps to initiate the prompt investigation of all potential matches for each payment transfer or crypto-asset transfer; b) rules for documenting decisions made regarding alerts, following the Service Provider's general record-keeping policy; c) measures aimed at compliance with Section III.3.2; d) conducting reviews at different levels in line with the assessment of exposure to restrictive measures, including at least a two-person review for higher exposure situations.

III.3.2. Measures to be Applied During Screening for Alert Analysis

34. The MNB expects that the alert generated by the screening system includes the element of the relevant restrictive measure. Good practice is for alerts to be analyzed by employees who possess the necessary expertise and appropriate qualifications 5.

35. The MNB considers it good practice that if doubt arises regarding the authenticity of a match, the Service Provider uses additional information in its possession or obtainable to support the analysis of alerts, provided such information is available and was not used in the screening phase, such as:
    a) identification data of natural persons, legal persons, organizations, or authorities; b) information regarding the residence of natural persons and the registered office or address of legal persons, organizations, or authorities; c) information regarding the citizenship and nationality of natural persons; d) representation, management, and organizational structure data for legal persons; e) contact information.

36. It is expected that the Service Provider defines in its policy and procedure how to handle cases where, after further investigation, it cannot be clearly determined whether the match is a true positive, a false positive, or a case of identical spelling. The MNB expects the Service Provider to refrain from providing financial services to the party involved in the transfer or transfer until a reasoned decision is made.

5 See at the time of issuance of this recommendation: the internal procedure to be defined in point i) of paragraph 5 of Annex 1 of MNB Recommendation 1/2026. (II.24.) on representatives ensuring compliance with the fight against money laundering and terrorist financing, their tasks and responsibilities, and related internal procedures and control mechanisms.

III.3.3. Assessing Whether an Organization is Owned or Controlled by a Listed Person

37. It is expected that the Service Provider defines in its policy and procedure how it will assess whether a legal person or organization is owned or controlled by a listed person or organization.

38. The MNB expects the Service Provider to:
    a) apply the criteria defined in the European Council's guidance on sanctions 6 and Section VIII of its best practices 7 to determine whether a legal entity is owned or controlled by another person or organization; b) apply the criteria used for identifying beneficial owners based on applicable legislation 8; c) use publicly available information sources at its disposal, such as registers of ownership and governance structures of organizations and beneficial ownership registers.

39. If the assessment remains unconvincing, the MNB considers it good practice for the Service Provider to consider contacting the National Tax and Customs Administration Central Directorate Anti-Money Laundering and Counter-Terrorist Financing Office (hereinafter: NAV KI PEI), responsible for the implementation of restrictive measures. The ultimate responsibility for compliance with restrictive measures lies with the Service Provider.

III.3.4. Controls and Screening Necessary for Compliance with Sectoral Restrictive Measures

40. The MNB expects the Service Provider to consider the assessment of exposure to restrictive measures when determining what types of controls it will apply to ensure compliance with restrictive measures. As part of this, the Service Provider should determine what available information it will screen for a given transaction.

41. The MNB expects the Service Provider to pay particular attention to sectoral restrictive measures related to specific jurisdictions or areas. It is expected that in the event of such restrictive measures, the Service Provider reviews all underlying information regarding payment transfers or crypto-asset transfers to or from that jurisdiction or area, or initiated by clients known to conduct business activities in that jurisdiction or area. If available, the MNB expects the Service Provider to review the following:
    a) information regarding country(ies) of citizenship and place of birth; b) information regarding usual place of residence or main place of business via other addresses, in line with the assessment of exposure to restrictive measures; c) information regarding the country to or from which the payment transfer is made, where the payment transfer is executed; d) the purpose of the transfer of funds or crypto-assets and other free-text fields that provide additional information about goods, vessels, destination country, or country of origin of goods to which the payment relates, in line with the assessment of exposure to restrictive measures.

42. If the assessment of exposure to restrictive measures justifies it, the MNB considers it good practice for the Service Provider to consider incorporating geolocation tools and tools for detecting the use of proxy services into its screening system, to identify and prevent access to the Service Provider's website and services by IP addresses originating from countries against which restrictive measures have been taken due to the situation affecting that country, in connection with activities prohibited by the regulatory framework on restrictive measures.

43. The MNB considers it good practice for the Service Provider to consider applying specific controls based on its assessment of exposure to restrictive measures, such as:
    a) requesting additional information from the customer, such as descriptions of dual-use goods or goods subject to sectoral restrictive measures, information on appropriate permits required for handling dual-use goods, country of origin of goods, information on the end-user of goods; b) requesting more detailed information from the customer regarding the purpose of the transfer of funds or crypto-asset transfers; c) using the following data: shipping registers, land registers, and other publicly accessible datasets (if available).

44. If the Service Provider uses functions for automatic reading of information from documents related to payment transfers or crypto-asset transfers, such as optical character recognition algorithms or machine-readable zone checks, it is expected that it takes the necessary steps to ensure that these tools record information accurately and consistently.

III.3.5. Screening for Detecting Attempts to Circumvent Restrictive Measures

45. The MNB expects the Service Provider to stay informed about the typologies and trends of circumvention of restrictive measures. Regarding the scope of relevant information sources, it is expected that the Service Provider always considers reports shared by at least the following:
    a) the MNB, NAV KI PEI, and law enforcement authorities; b) relevant national or EU-level public-private partnerships; c) European Union authorities 9.

46. The MNB expects that the policy and procedure for screening enables the Service Provider to detect possible attempts to circumvent restrictive measures, such as attempts to:
    a) omit, delete, or alter information in payment messages; b) transfer funds through persons associated with clients subject to restrictive measures; c) structure payment transfers or crypto-asset transfers in a way to conceal the involvement of a listed party; d) conceal actual ownership or control over assets; e) use forged or fraudulent background documents for payment transfers or crypto-asset transfers.

47. If the Service Provider is particularly exposed to the risk of being used for the purpose of circumventing restrictive measures, the MNB considers it good practice for the Service Provider to consider conducting a consolidated analysis of payment flows to or from countries subject to restrictive measures and to or from countries known to be used for circumventing restrictive measures.

III.4. Freezing and Measures for Reporting

III.4.1. Suspension of Payment Transfer Execution and Freezing of Funds

48. The MNB expects that payment service providers have a policy and procedure for the immediate suspension of transactions triggering an alert regarding a possible match with a listed person or organization, or a person or organization owned, possessed, or controlled by a listed person or organization, or the beneficial owner of a listed person or organization.

49. If the internal analysis of such an alert by the payment service provider confirms that a possible match exists with a listed person or organization, or a person or organization owned, possessed, or controlled by a listed person or organization, or the beneficial owner of a listed person or organization, it is expected that the payment service provider immediately performs the following tasks:
    a) freezing the related funds; b) stopping the execution of payment transfers that would violate restrictive measures.

III.4.2. Freezing of Crypto-Asset Transfers

50. The MNB expects that crypto-asset service providers have a policy and procedure for the case where an internal analysis of an alert confirms that a possible match exists with a listed person or organization, or a person or organization owned, possessed, or controlled by a listed person or organization, or the beneficial owner of a listed person or organization, in order to immediately freeze and lock the crypto-assets on the suspended crypto-asset account until the NAV KI PEI instructs the crypto-asset service provider on what steps to take regarding the said crypto-assets. The ultimate responsibility for the implementation of restrictive measures lies with the crypto-asset service provider.

III.4.3. Measures for Reporting

51. It is expected that the Service Provider has a clear procedure defined in its policy or procedure to report to the NAV KI PEI without delay or within a specified deadline regarding the following:
    a) any action taken for a specific transfer related to the restrictive measure; b) the discovery of a violation of restrictive measures; and c) the execution of a transfer of funds or crypto-asset transfer that violates the restrictive measure, providing information on the circumstances, such as an incident in the operation of the screening system related to the transfer or transfer.

52. If there is suspicion of possible circumvention of restrictive measures, or an attempt thereof, upon detection, the Service Provider must:
    a) report to the NAV KI PEI if explicitly required by the EU legal act on restrictive measures 10; b) report the suspicious transaction; c) additionally, notify immediately if assets are made available to the subject of the restrictive measure despite the prohibition 12.

III.4.4. Procedures Regarding Exemptions or Lifting of Restrictive Measures

53. The MNB expects the Service Provider to have regulations and procedures to determine whether exemptions or authorization systems apply, and if so, how to proceed to comply with the applicable EU legal act, the Pvkit., and other relevant domestic legislation 13. The Service Provider must define in its policy and procedure what information it will provide to clients who wish to apply for an exemption regarding the use of frozen funds, if the applicable legal framework allows for exemption. The MNB expects that the information regarding the procedure for applying for exemption also contains information on the client's rights in such a situation.

54. It is expected that the Service Provider has regulations and procedures that define the measures to be applied after the lifting of such measures regarding funds or crypto-assets subject to special restrictive measures.

III.4.5. Ensuring the Continuous Effectiveness of Screening Policies, Procedures, and Systems for Restrictive Measures

55. For the sake of effectiveness, the MNB expects that the Service Provider's screening policies, procedures, and systems for restrictive measures enable the Service Provider to:
    a) reliably detect positive matches; b) immediately suspend the execution of payment transfers after confirmation of positive hits, block incoming transfers and place them on a suspension account, immediately freeze funds or crypto-assets, and report these measures to the NAV KI PEI for further instructions; c) immediately or within the deadline specified in the applicable EU legal act report the frozen assets to the NAV KI PEI in accordance with the Pvkit. and applicable legal provisions; d) report suspicion or attempts to circumvent restrictive measures to the NAV KI PEI regarding the implementation of restrictive measures; and e) notify the NAV KI PEI immediately if assets are made available to the subject of the restrictive measure despite the prohibition.

56. The MNB expects the Service Provider to regularly test the settings of its screening system to determine whether the screening system remains appropriate for assessing the Service Provider's exposure to restrictive measures and whether it remains effective. It is also expected that the Service Provider determines the frequency of controls based on its assessment of exposure to restrictive measures and records them in its regulations and procedures.

57. The MNB expects that during the testing of its screening system, the Service Provider:
    a) tests the calibration of the screening system as defined in Section III.2.6; b) evaluates the accuracy of list management by applying applicable and up-to-date restrictive measures; c) evaluates whether all clients, payment transfers, and crypto-asset transfers are screened if necessary; d) evaluates the adequacy and relevance of information fields used in the screening system, such as the scope of payment transfers of funds or crypto-asset transfers checked by the screening system; e) evaluates the timeliness of automatic suspension of operations; f) evaluates whether the processes and resources available for alert analysis allow for the immediate reporting of true positive matches.

58. The MNB expects that the governing body of the Service Provider is informed of significant weaknesses or deficiencies in the screening system and that the Service Provider takes corrective measures immediately.

IV. Final Provisions

59. This recommendation is a regulatory instrument issued without binding force for supervised financial organizations, in accordance with point i) of paragraph (2) of Section 13 of Act CXXXIX of 2013 on the Magyar Nemzeti Bank. The content of the recommendation issued by the MNB expresses the requirements imposed by laws, principles and methods recommended for application based on the MNB's law enforcement practice, market standards and conventions.

60. The MNB monitors and evaluates compliance with this recommendation among the financial organizations it supervises during its control and monitoring activities, in line with general European supervisory practice.

61. The MNB draws attention to the fact that the financial organization may make the content of this recommendation part of its regulations. In this case, the financial organization is entitled to state that the provisions contained in its relevant regulations correspond to the relevant numbered recommendation issued by the MNB. If the financial organization wishes to include only certain parts of the recommendation in its regulations, it should avoid referencing the recommendation and apply it only to the parts transposed from the recommendation.

62. The MNB expects the affected Service Providers to apply this recommendation from March 31, 2026.

Mihály Varga s.
President of the Magyar Nemzeti Bank