Recommendation No. 5/2026 (March 25) of the Hungarian National Bank

on certain aspects of suitability requirements under the Regulation on crypto-asset markets and the format of periodic statements for portfolio management activities

I. Purpose and Scope of the Recommendation

The purpose of this Recommendation is to formulate the expectations of the Hungarian National Bank (hereinafter: MNB) regarding the suitability requirements of the European Parliament and Council Regulation (EU) 2023/1114 of 31 May 2023 amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 concerning crypto-asset markets (hereinafter: Regulation), and regarding the format of periodic statements to be provided by crypto-asset service providers performing crypto-asset portfolio management, thereby strengthening investor protection, increasing the predictability of law application, and facilitating the uniform application of relevant legislation.

The scope of the Regulation extends to natural and legal persons, as well as certain other undertakings, who or which participate in the issuance of crypto-assets, public offers relating to them, and their admission to trading, or provide services related to crypto-assets in the European Union.

By publishing this Recommendation, the MNB ensures compliance with the guidelines published by the European Securities and Markets Authority (hereinafter: ESMA) on certain aspects of the suitability requirements under the Regulation and the format of periodic statements related to portfolio management activities (ESMA35-1872330276-2031).

The addressees of this Recommendation are crypto-asset service providers providing advice on crypto-assets or performing portfolio management of crypto-assets, falling under the scope of the Act on Crypto-Asset Markets of 2024 (hereinafter: Crypto Act), as defined in Article 3(1)(15) of the Regulation.

This Recommendation does not refer exhaustively to statutory provisions when formulating principles and expectations; however, the addressees of the Recommendation remain obligated to comply with relevant statutory requirements.

This Recommendation does not provide guidance on data protection or privacy matters, contains no expectations regarding the processing of personal data, and the requirements contained herein cannot be interpreted in any way as authorization for the processing of personal data. Data processing related to the fulfillment of supervisory expectations stipulated in this Recommendation may only be carried out in compliance with the applicable data protection laws in force at all times.

https://www.esma.europa.eu/document/guidelines-certain-aspects-suitability-requirements-and-format-periodic-statement: https://www.esma.europa.eu/sites/default/files/2025-03/ESMA35-1872330276-2031_Guidelines_on_suitability_and_periodic_statement_MiCA_HU.pdf

II. Interpretative Provisions

For the purposes of this Recommendation:

1.1. crypto-asset: the concept defined in Article 3(1)(5) of the Regulation;

1.2. advice on crypto-assets: the concept defined in Article 3(1)(24) of the Regulation;

1.3. portfolio management of crypto-assets: the concept defined in Article 3(1)(25) of the Regulation;

1.4. crypto-asset service provider: the concept defined in Article 3(1)(15) of the Regulation;

1.5. suitability assessment: the entire information collection process regarding the client and a subsequent assessment of the suitability of a specific crypto-asset for the client by a crypto-asset service provider that is well-acquainted with the specific crypto-asset, thus able to recommend it or invest on behalf of the client;

1.6. robo-advisory: advice on crypto-assets or portfolio management of crypto-assets, provided wholly or in part through an automated or semi-automated system used as a tool for interacting with clients.

In the absence of contrary provisions, the concepts used and defined in the Regulation and the Crypto Act shall have the same meaning in this Recommendation as they have in those texts.

III. General Expectations

The MNB expects that the Service Provider shall design its procedures and regulations taking into account the expectations of this Recommendation.

IV. Expectations Regarding Certain Aspects of Suitability Requirements under the Regulation

IV.1. Informing Clients about the Purpose and Scope of the Suitability Assessment 2

The MNB expects that the Service Provider shall inform its clients clearly and simply about the suitability assessment and its purpose, so that the client may act in their best interest. The information expected under this point may be submitted in a uniform format. It is expected that it be clearly stated that the performance of the assessment is the responsibility of the Service Provider, with the aim that clients understand:

a) the reason why they are asked to provide certain information;

b) the importance that this information be up-to-date, accurate, and complete; and

c) that in the absence of this information, the Service Provider may not recommend crypto-asset services or crypto-assets, nor may it begin portfolio management of crypto-assets.

2 Relevant statutory provisions: Article 66(1) and (2), and Article 81(1), (8), (10), and (11) of the Regulation.

Information related to the suitability assessment may assist clients in understanding the purpose of the requirements. This may encourage them to provide up-to-date, accurate, and sufficient information regarding their knowledge, experience, investment objectives—including their risk tolerance—and their financial situation—including their loss-bearing capacity. It is expected that the Service Provider draw the attention of its clients that accurate and comprehensive information is necessary for the Service Provider to recommend a suitable crypto-asset or crypto-asset services to the client. In the absence of this information, the Service Provider may not provide advice on crypto-assets or portfolio management of crypto-assets.
The Service Provider may decide how to inform its clients about the suitability assessment. However, the format used must ensure that the provision of information can be verified.
The Service Provider must clearly establish its responsibility during the assessment of the suitability of crypto-asset services or crypto-assets. In particular, the Service Provider may not state or imply that the client decides on the suitability of the investment or service, or that the client determines which crypto-asset or crypto-asset service suits their risk profile. For example, the Service Provider may not inform the client that the client selected a specific crypto-asset as suitable for them, nor may it ask the client to confirm the suitability of a crypto-asset or crypto-asset service.
Any statement by the Service Provider aimed at limiting or excluding its liability for the suitability assessment does not affect the obligation to characterize the crypto-asset services provided to clients, nor the assessment of the Service Provider's compliance with related obligations. For example, when collecting client data necessary for performing the suitability assessment (such as investment time horizon, holding period, or information related to risk-bearing willingness), the Service Provider may not state that it does not assess suitability.
In order for clients to obtain adequate information regarding crypto-asset services provided via robo-advisory, it is expected that the Service Provider inform clients about the following, in addition to other necessary information:

a) a clear description of the extent and scope of human intervention, as well as whether the client can request human interaction and how;

b) a description of how the answers provided by clients will directly affect the suitability of investment decisions recommended on their behalf or made on their behalf;

c) a description of the information sources used to provide investment advisory or portfolio management services (for example, if an online questionnaire is used, the Service Provider must explain that the answers to the questionnaire may be the sole basis for robo-advisory, or whether the Service Provider has access to other client information or accounts);

d) a description of how and when the client updates their data regarding their situation, personal circumstances, etc.

The MNB expects that the statements of the Service Provider be effective (for example, statements are made directly available to clients, are visible, and understandable). For Service Providers offering robo-advisory, this may specifically include:

a) highlighting relevant information (for example, using design features such as pop-up windows);

b) deciding whether to supplement certain information with interactive text (for example, using design features such as tool tips) or otherwise provide additional information to clients (for example, in the FAQ section).

IV.2. Measures Necessary for Client Understanding 3

When collecting information necessary to perform the suitability assessment for each client, the MNB expects that the Service Provider ensure that questions posed to clients are specific and appropriately interpretable, take into account the elements defined in point IV.3, and design the information collection so as to obtain the information necessary for the suitability assessment.
It is expected that the Service Provider ensure that information collected about clients is evaluated consistently, regardless of the tools used to collect such information.
The Service Provider may use information collected during discussions with clients or other information already collected through the Service Provider's relationship with the client. For example, payment delays regarding other obligations may indicate a difficult financial situation. To this end, the Service Provider may prepare questionnaires, even in digital format.
When designing questionnaires intended to collect information about clients for the purpose of the suitability assessment, the Service Provider is expected to take into account the most common reasons why clients may be unable to fill out questionnaires properly. In particular:

a) attention must be paid to the clarity, completeness, and understandability of the questionnaire, and misleading, confusing, inaccurate language and excessive use of jargon must be avoided;

b) the layout must be carefully designed to avoid influencing client choices (font, line spacing, etc.);

c) it must be avoided to collect information about a series of elements through a single question, particularly when assessing knowledge, experience, and risk tolerance;

3 Relevant statutory provisions: Article 81(1), (8), and (10) of the Regulation.

d) the order of questions must be arranged so that information can be collected effectively;

e) in order to collect the necessary information, questionnaires must not omit the option to decline answering, particularly when collecting information about the client's financial situation.

The MNB expects that the Service Provider also take reasonable steps to assess the extent to which the client is aware of investment risks and the relationship between risks and investment returns, as this is crucial for the Service Provider to act in the best interests of clients when performing the suitability assessment. When presenting questions on this matter, the Service Provider must clearly and simply explain that the purpose of answering is to determine the client's risk-bearing willingness (risk profile) and, based on this, to assess whether crypto-asset services or crypto-assets are suitable for them, and if so, what types and risks are associated with them.
Information must be obtained for the suitability assessment that may affect the analysis of the client's financial situation—including their ability to bear losses—or investment objectives—including risk tolerance. Examples of these elements include:

a) the client's marital status (particularly the client's legal capacity to incur obligations regarding assets co-owned with a partner);

b) family situation (changes in the client's family situation may affect their financial situation, for example, a newborn or a child starting university);

c) age (which is most important for correctly assessing investment objectives, particularly the level of financial risks undertaken by the client, as well as the holding period or investment horizon, which indicates the willingness to hold an investment for a certain period);

d) employment status (the degree of job security or the fact that the client is close to retirement may affect their financial situation or investment objectives);

e) the need for liquidity for certain important investments or the need to finance future financial obligations (e.g., purchasing real estate, tuition fees).

When determining the necessary information, it is expected that the Service Provider keep in mind how significant changes in such information may affect the suitability assessment.
The MNB considers it good practice if the Service Provider, when collecting information regarding the client's investment objectives—beyond the elements listed in point 16—does not consider only financial aspects, but also the client's preferences regarding environmental, social, and governance factors.
It is expected that the Service Provider take all reasonable steps to adequately assess whether clients are aware of the main characteristics of the products offered by the Service Provider and the risks associated with the types of products. The Service Provider must establish mechanisms that avoid excessive reliance on the client's self-assessment and ensure the consistency of the client's answers, particularly when evaluating the client's knowledge and experience. The entirety of information collected by the Service Provider regarding the client's knowledge and experience must be considered in the comprehensive assessment of knowledge related to products and the risks arising from recommended transactions and services or portfolio management.
The MNB expects that the Service Provider evaluate clients' knowledge of fundamental financial concepts, such as investment risk—including concentration risk—and the return-risk principle. To this end, the Service Provider must consider indicative and understandable examples of loss/return levels that may arise depending on the level of risk undertaken, and evaluate the client's response to these scenarios.
As part of evaluating the client's knowledge and experience, it is expected that the Service Provider ensure that the client specifically understands crypto-assets, and particularly the risks associated with the distributed ledger technology underlying crypto-assets (for example, cyber theft, hacks, loss or destruction of private keys).
The Service Provider must design its questionnaires to collect the necessary information about its clients. This is particularly important for Service Providers offering robo-advisory services, given the limited human interaction. In order to ensure compliance with the requirements regarding this assessment, the Service Provider must particularly consider the following factors:

a) whether information collected via online questionnaires allows the Service Provider to conclude that the advice is suitable for its clients based on their knowledge, experience, financial situation, investment objectives, and needs;

b) whether the questions posed in the questionnaire are clear enough, or whether the questionnaire was designed to provide further clarifications or examples to clients if necessary (for example, using design features such as tool descriptions or pop-up windows);

c) whether human interaction—including remote interaction via email or mobile phone—is available to clients when answering the online questionnaire;

d) whether steps have been taken to handle inconsistent answers provided by clients (for example, adding design features to the questionnaire that notify clients when their answers appear internally inconsistent and suggest they reconsider them; or implementing systems that automatically flag information provided by the client that appears inconsistent for review or follow-up by the Service Provider).

IV.3. Scope of Information to be Collected from Clients (Proportionality) 4

Before providing advice on crypto-assets or portfolio management of crypto-assets, it is expected that the Service Provider collect all necessary information—that is, all information necessary to comply with the suitability requirements under the Regulation—regarding the client's knowledge and experience, financial situation, investment objectives, and basic understanding of the risks associated with purchasing crypto-assets, taking sufficient account of the nature and extent of the services provided. The extent of the necessary information mentioned above may vary, and the Service Provider must determine the extent of information to be collected from clients, taking into account all characteristics of the advice on crypto-assets or portfolio management of crypto-assets provided to these clients. Specifically, the Service Provider must consider the characteristics of advice on crypto-assets or portfolio management of crypto-assets, the type and characteristics of crypto-assets, and the characteristics of the clients.
The MNB expects that the Service Provider consider the following information regarding the client's knowledge, experience, financial situation, investment objectives, and basic understanding of the risks associated with purchasing crypto-assets:

a) the type of crypto-asset or transaction that the Service Provider intends to recommend or execute—including complexity and risk level;

b) the nature and extent of the services possibly provided by the Service Provider;

c) the client's needs and circumstances;

d) the client's characteristics [e.g., level of expertise, knowledge related to investments—including information about crypto-assets, financial situation].

It is expected that the Service Provider ensure that information regarding the client's or potential client's knowledge and experience related to investments, including in the field of crypto-assets, is of an appropriate extent for the type of client, and the nature and extent of the services to be provided, and the type of planned crypto-asset or transaction—including their complexity and associated risks—and must include:

a) the types of services, transactions, and financial products known to the client;

b) whether the client understands the distributed ledger technology underlying crypto-assets, as well as the risks associated with it, for example, the risk of transferring crypto-assets to a wrong wallet or address, or the risk of hacking;

c) the nature, scale, and frequency of the client's transactions, including those related to crypto-assets, and the duration for their execution;

d) the education and occupation of the client or potential client, or significant previous occupation.

4 Relevant statutory provisions: Article 81(1), (8), and (10) of the Regulation.

In assessing whether the client is familiar with crypto-assets or a specific type of crypto-asset, the Service Provider must not rely solely on the client's transaction history but must also ensure that the client understands the product.
Although the volume of information to be collected may vary, the standard requirement always applies to ensure that the advice or investment executed on behalf of the client is suitable for the client. The Regulation allows the Service Provider to collect information commensurate with and proportionate to the products or services offered to the client, or regarding which the client requests specific advice or portfolio management on crypto-assets. However, the Regulation does not allow the Service Provider to reduce the level of protection afforded to clients.
Information regarding the investment objectives of the client or potential client must include, where relevant, information on the client's requirement regarding the holding period of the investment, risk-taking preferences, risk profile, and investment goals.
The MNB expects that when providing access to more complex or riskier crypto-assets, the Service Provider collects more detailed information about the client than when dealing with less complex or risky products. This serves the purpose of enabling the Service Provider to assess the extent to which the client is able to understand and financially bear the risks associated with crypto-assets. To ensure that clients understand the risks and potential losses associated with crypto-assets, the Service Provider should, where possible, clearly and understandably present these risks, preferably providing illustrative examples of the magnitude of losses in the case of a poorly performing crypto-asset, and taking due account of Article 81(9) of the Regulation. The MNB expects the Service Provider to conduct a comprehensive assessment, including among others the client's knowledge and experience, such as whether they are able to understand the mechanisms that make the advised or traded crypto-asset risky or potentially complex, whether the client has previously traded crypto-assets, the specific type of crypto-asset (e.g., stable crypto-asset or user token), or how long they have traded them, etc.
In the case of illiquid crypto-assets⁵, the necessary information to be collected must also include data on how long the client is willing to hold the investment.
It is always necessary to collect information on the client's financial situation; however, the scope of information to be collected may be determined in some cases by the type of crypto-assets and services recommended or subscribed to. Since many crypto-assets are considered extremely speculative investments, the necessary information to be collected may extend to all of the following elements listed below, which are necessary to determine whether the client's financial situation allows them to invest in such crypto-assets:

a) the amount of the client's regular and total income; information on whether the income is permanent or temporary; and the source of the income (e.g., salary, pension income, income from investments, rental income);

b) the client's assets, including liquid assets, investments, and real estate ownership, including financial investments owned by the client, personal and investment property, pension funds, or any cash deposits. The Service Provider is expected to collect information, where applicable, on access and other conditions, loans, guarantees, and other restrictions that may apply to the aforementioned assets;

c) the client's regular financial commitments, including financial commitments made or planned by the client (e.g., the client's debts, the total amount of their liabilities, and other periodic commitments).

When determining the information to be collected, it is expected that the Service Provider also takes into account the nature of the service provided. In practice, this means the following:

a) if the Service Provider provides advice on crypto-assets, it is sufficient to collect information to assess the client's ability to understand the nature and risks of the specific crypto-assets and services recommended by the Service Provider;

b) if the Service Provider performs portfolio management on crypto-assets, the Service Provider makes investment decisions on behalf of the client, so the client does not need such detailed knowledge and level of experience regarding all potential crypto-assets in the portfolio as in the case of using crypto-asset advisory services. Nevertheless, in this situation, the client must still have an overview of at least the general risks associated with the portfolio, including risks associated with distributed ledger technology, and must have a comprehensive view of the risks of the potential crypto-asset types forming part of the portfolio in question. The Service Provider must form a very accurate picture of the level of understanding of crypto-assets and the client's investment profile.

Similarly, the scope of services requested by the client may also influence the detail of information collected about the client. It is expected that, for example, the Service Provider collects more information about clients who request advice on their entire financial portfolio than about those who specifically request advice on investing a relatively small part of their total portfolio.
The Service Provider must also take into account the type of client when deciding on the information to be collected. In-depth information is usually required, for example, for potentially vulnerable (e.g., elderly) or inexperienced clients who are using crypto-asset advisory or crypto-asset portfolio management services for the first time.
The information to be collected also depends on the client's needs and circumstances. The Service Provider will likely need more detailed information about the client's financial situation if their investment objectives are diverse or long-term, and less if the client is seeking short-term investment.
Information on the client's financial situation includes information on the client's investments in crypto-assets and other products. This includes the expectation that the Service Provider has information on the clients' financial investments held with the Service Provider, per crypto-asset. Depending on the scope of advice, the Service Provider is also expected to encourage clients to disclose details of their investments with other Service Providers or financial investments at financial institutions, preferably per product.

IV.4. Reliability of Information on Clients ⁶

Clients are expected to provide correct, up-to-date, and complete information for the suitability assessment. However, the MNB expects that the Service Provider takes all reasonable steps and has appropriate tools to ensure that the information collected about clients is reliable, accurate, and consistent without relying unduly on clients' self-assessment. This must include among others:

a) ensuring that clients are aware of the importance of providing accurate and up-to-date information;

b) ensuring that the tools – such as risk assessment and profiling tools used during the suitability assessment process, or tools for assessing client knowledge and experience – are suitable for the purpose and designed for application to clients, and that the Service Provider identifies any limitations and actively mitigates them during the suitability assessment process;

c) ensuring that questions asked during the process are likely to be understandable to clients, accurately reflect the client's goals and needs, and provide the information necessary to understand the suitability assessment; and

d) taking necessary steps, where applicable, to ensure the consistency of client information, such as examining whether the information provided by the client contains obvious inaccuracies.

The Service Provider remains responsible for ensuring that appropriate information is obtained to perform the suitability assessment. In this regard, any agreement signed by the client, or any statement made by the Service Provider, which aims to limit the Service Provider's liability regarding the suitability assessment, does not comply with the relevant requirements of the Regulation.
To avoid the Service Provider relying unduly on the client's self-assessment, every automatic assessment must be balanced with factual information collected based on objective criteria. For example:

a) the Service Provider should not ask the client if they understand the yield-risk principle and the concept of risk diversification, but should present practical examples of cases that may occur in practice, such as using graphs or positive and negative scenarios based on reasonable assumptions;

b) the Service Provider should not ask the client if they have adequate knowledge of the main characteristics and risks of certain types of crypto-assets, but should ask questions, for example, using multiple-choice questions, aimed at assessing the client's actual knowledge regarding specific types of crypto-assets, where the client must provide the correct answer;

c) the Service Provider should not ask the client if they feel sufficiently experienced to invest in certain crypto-assets, but rather what types of crypto-assets they know and what fresh and frequent trading experience they have with them;

d) the Service Provider should not ask the client if they believe they have sufficient funds to invest, but should request factual data on the client's financial situation, such as regular income sources and existing obligations (e.g., bank loans or other debts, which may significantly affect the assessment of the client's ability to financially bear the risks and losses associated with the investment);

e) the Service Provider should not ask the client if they are comfortable taking risks, but rather what magnitude of loss they would be willing to accept over a given time period, regarding either individual investments or the entire portfolio.

When assessing the client's knowledge and experience, the Service Provider must avoid questions that are too broadly interpretable, answerable with yes or no, or broadly formulated multiple-choice questions (the Service Provider should not, for example, ask the client to select from a list of crypto-assets which ones they know). If the Service Provider pre-fills answers based on the client's transactions with that Service Provider (e.g., through another provided crypto-asset service), it must ensure that only fully objective, relevant, and reliable information is used, and that the client has the opportunity to review and, if necessary, correct or supplement the pre-filled answers to ensure the accuracy of the pre-filled information. It is expected that the Service Provider also avoids basing assumptions on the client's experience.
The client's previous investments in crypto-assets alone are not sufficient for the Service Provider to conclude that such a client understands crypto-assets and crypto-asset services, particularly the risks associated with crypto-assets.
When conducting a questionnaire-based assessment of the client's risk tolerance, the Service Provider must not only examine the desired risk/return characteristics of future investments but must also take into account the client's risk assessment. For this purpose, while avoiding self-assessment of risk tolerance, specific questions can be asked about the client's personal decisions in the face of risk uncertainty. Furthermore, the Service Provider may, for example, use graphs, specific percentages, or specific numerical data when asking the client how they would react if the value of their portfolio were to decrease.
If the Service Provider uses tools to be handled by clients (e.g., online questionnaires or risk profile determination software) during the suitability assessment, it is expected that they ensure they have appropriate systems and control measures to ensure that the tools are suitable for the purpose and yield satisfactory results. Risk profile determination software, for example, can examine the coherence of the answers given by the client, thereby pointing out possible contradictions between the various collected information.
The MNB expects that the Service Provider also takes reasonable steps to mitigate potential risks associated with the use of such tools. A potential risk arises, for example, if the client is encouraged to give specific answers in order to access crypto-assets or crypto-asset services that would otherwise not be suitable for them (without adequately reflecting the client's actual circumstances and needs). ⁷
To ensure the consistency of information on clients, the Service Provider must comprehensively review the acquired information. It is expected that the Service Provider is aware of possible contradictions between the collected information and contacts the client to correct any significant inconsistencies or inaccuracies. Such a contradiction may be, for example, if clients with little knowledge or experience relate aggressively to risks, or if cautious risk profiles are associated with ambitious investment objectives.
The MNB expects that the Service Provider adopts mechanisms that reduce the risk that clients are prone to overestimate their knowledge and experience, such as by including questions that help the Service Provider assess the clients' general knowledge of the characteristics and risks of crypto-assets, as well as various types of crypto-assets. Such measures may be particularly important in the case of robo-advisory, as the risk of overestimation by clients may be higher when information is provided through an automated or semi-automated system, particularly in cases where human interaction between clients and the Service Provider is very limited or completely absent.

IV.5. Updating Information on Clients ⁸

If a Service Provider maintains continuous contact with the client (e.g., provides continuous advice on crypto-assets or performs portfolio management on crypto-assets), in order to perform the suitability assessment, the MNB expects that procedures are adopted to determine the following:

a) which part of the collected client information must be updated and with what frequency;

b) how the update is performed, and what the Service Provider must do if they obtain additional or updated information, or if the client refuses to provide the requested information.

It is expected that the Service Provider regularly reviews client information to ensure that it is always up-to-date, accurate, and complete. To this end, the Service Provider must introduce procedures that encourage clients to update the originally provided information if significant changes occur.
The frequency of updates may vary, for example, depending on the client's risk profile and taking into account the type of recommended crypto-assets. In terms of suitability requirements, based on the information collected about the client, the Service Provider usually determines the client's risk profile, i.e., what type of crypto-asset services or crypto-assets are generally suitable for them, taking into account their knowledge and experience, financial situation – including the ability to bear losses – and investment objectives – including risk tolerance. A risk profile that provides access to a wider range of riskier products is an element that is likely to require more frequent updates. Certain events may also trigger the update process: this may happen, for example, for clients reaching retirement age or becoming unemployed.
Since the suitability assessment must be reviewed at least every two years ⁹, updates must be performed at least every two years to ensure that the updated suitability assessment is not based on outdated client information. This also means that the update must be performed before any new suitability assessment performed within the two-year deadline.
The update can be performed, for example, through data update questionnaires sent to clients. The necessary measures may include, among others, modifying the client's profile according to the collected up-to-date information.
It is also expected that the Service Provider takes measures to mitigate the risk that the client is encouraged to update their own profile in order to make an investment product or service appear suitable that would otherwise not be suitable for them, without a real change occurring in the client's situation. ¹⁰ A best practice example for handling such risks is that the Service Provider may adopt procedures to check, before or after transactions, whether the client updates their profile too frequently, or only shortly after the last modification (especially if this change occurred in the days preceding the recommended investment). These situations must therefore be reported to the appropriate internal defense line. These policies and procedures are particularly important in situations where there is a high risk that the Service Provider's interests conflict with the best interests of clients, such as situations where the Service Provider places crypto-assets with its own clients. Another factor to consider is the type of interaction with the client (e.g., telephone conversation vs. through an automated system).
The MNB expects that the Service Provider informs the client if the further provided information results in a modification of their profile: either becoming riskier and therefore possibly a wider range of riskier and more complex crypto-assets may be suitable for them, which could also result in greater losses, or conversely: becoming more conservative and therefore possibly a narrower range of crypto-assets may be suitable for them.

IV.6. Client Information for Legal Entities or Groups ¹¹

If the client is a legal entity or a group consisting of two or more natural persons, or if another natural person represents one or more natural persons, the MNB expects that the Service Provider develops and implements in advance a policy regarding the procedure and criteria to be followed in such situations to comply with the suitability requirements of the Regulation. This includes:

a) who is subject to the suitability assessment;

b) how the suitability assessment must be performed in practice, including from whom information on knowledge and experience, financial situation, and investment objectives must be collected; and

c) what possible impact it may have on relevant clients, in accordance with existing regulations.

If the client is a legal entity or if another natural person represents a natural person, the financial situation and investment objectives must be assessed not by the representative, but in light of the financial situation and investment objectives of the underlying client (the legal entity or the represented natural person). The knowledge and experience must be assessed for the representative, in the framework of which the Service Provider also checks whether the representative is actually authorized to execute transactions on behalf of the client according to relevant national legislation.

⁵ The Service Provider determines in advance which of the crypto-assets offered to investors by them it considers illiquid.

⁶ Relevant legislation: Article 81(1) and (10) of the Regulation.

⁷ In this regard, see point 52 of this Recommendation, which addresses the risk that the Service Provider may convince clients to modify their previously given answers without a real change in their situation.

⁸ Relevant legislation: Article 81(1), (8), (10), and (12) of the Regulation.

⁹ In accordance with Article 81(12) of the Regulation.

¹⁰ Furthermore, in this context, the measures taken by the Service Provider to ensure the reliability of client information as per point 37 of this Recommendation are important.

¹¹ Relevant legislation: Article 81(1), (8), and (10) of the Regulation.

It is expected that the Provider verifies whether the applicable national legal regulations contain specific references that must be taken into account when carrying out the suitability assessment (this may occur, for example, if legislation mandates the appointment of a legal representative: e.g., in the case of minors, incapacitated persons, or legal entities).
It is expected that the rules clearly distinguish between situations where the applicable national laws require the appointment of a representative – such as in the case of legal entities – and situations where the appointment of a representative is not mandatory, and focus on the latter situation. If the rules provide for agreements between clients, they must be informed in writing in detail about how such agreements may affect the protection of their interests. The measures taken by the Provider based on its policy must be documented appropriately to allow for subsequent audits.
If the client consists of two or more natural persons and the applicable national laws do not require the appointment of a representative, it is expected that the Provider’s rules determine from whom the necessary information should be collected and how the suitability assessment should be performed. The Provider must properly inform the clients about the approach applied by it – as defined in the Provider’s rules – as well as the impact of this approach on the practical implementation of the suitability assessment.
The Provider may apply approaches such as the following:

a) calling on the group of two or more natural persons to appoint a representative; or

b) collecting information from each client individually and assessing the suitability of each client.

IV.6.1. Calling on the group of two or more natural persons to appoint a representative

If the group of two or more natural persons appoints a representative, the approach identical to point 55 may be applied: the representative must possess the appropriate knowledge and experience, and the financial situation and investment objectives apply to the underlying client(s). It is expected that the appointment be made in writing, be consistent with the applicable national laws, and be recorded by the Provider. The clients forming part of the group must be informed in writing, accurately, about how the agreement concluded between the clients may affect the protection of their interests.
Despite the appointment of a representative, the Provider’s rules may obligate the underlying client(s) to agree on their investment objectives.
If the parties involved have difficulties in deciding from whom information regarding knowledge and experience should be collected, on what basis the financial situation should be determined for the suitability assessment, or how their investment objectives should be determined, it is expected that the Provider chooses the most prudent approach, taking into account information regarding the person with the least knowledge and experience, the weakest financial situation, or the most conservative investment objectives. As an alternative solution, the Provider’s rules may also determine that in such a situation, it will not be able to provide crypto-asset advice or crypto-asset portfolio management. It is expected that the Provider acts with due care if a significant discrepancy is observed in the level of knowledge and experience or in the financial situation of the different clients in the group.

IV.6.2. Collecting information from individual clients and assessing the suitability of individual clients

If a Provider decides to collect information and assess suitability for each individual client forming part of the group, and if significant discrepancies exist among the characteristics of these individual clients (e.g., the Provider assigns them to different investment profiles), the question arises as to how consistency in providing crypto-asset advice and crypto-asset portfolio management regarding the crypto-assets or portfolio of this client group can be ensured. In such a situation, it may happen that a crypto-asset is suitable for one client member of the group but not for another. The MNB expects that the Provider’s rules precisely define how to resolve such situations. The Provider must also apply the most prudent approach here, taking into account information regarding the client belonging to the group who has the least knowledge and experience, the weakest financial situation, or the most conservative investment objectives. As an alternative solution, the Provider’s rules may also determine that in such a situation, it will not be able to provide crypto-asset advice or crypto-asset portfolio management. In this context, it must be noted that if the Provider collects information from all clients belonging to the group and takes an average level of knowledge into account for the purpose of assessment, this would likely not comply with the general principle of the Regulation, which states that the best interests of the client must be kept in view.

IV.7. Measures necessary for understanding crypto-assets 12

The MNB expects that the Provider develops appropriate policies and procedures to ensure that it understands the characteristics, nature, and features of the crypto-asset services and crypto-assets selected for its clients, including costs and risks, and, taking costs and complexity into account, assesses whether equivalent crypto-asset services or crypto-assets may suit the client’s profile.
The Provider must adopt robust and objective procedures, methods, and tools that enable it to properly take into account various characteristics and relevant risk factors (credit risk, market risk, liquidity risk, operational risk, including the risk of hacking, etc.) for any crypto-asset that it may recommend or in which it may invest on behalf of clients. Regarding liquidity risk, it is particularly important that the identified liquidity risk is not offset by other risk indicators (e.g., indicators accepted for assessing credit/partner risk and market risk). The reason for this is that the liquidity characteristics of crypto-assets must be compared with information regarding whether the client is willing to hold the crypto-assets for a certain period, i.e., the so-called holding period. It is also particularly important to take into account the complexity of the products and to combine this with the client’s data, especially regarding their knowledge and experience.
It is expected that the Provider adopts procedures that ensure that the information used to understand and correctly classify the crypto-assets included in the product offering is reliable, accurate, consistent, and up-to-date. When adopting such procedures, it is expected that the Provider takes into account the various characteristics and nature of crypto-assets.
Furthermore, the MNB expects that the Provider reviews the information used to reflect important changes that may potentially affect the classification of the product. This is particularly important given the continuous development and growth of crypto-asset markets.

IV.8. Measures necessary to ensure the suitability of crypto-assets or crypto-asset services 13

In order to offer appropriate investments and services to its clients, it is expected that the Provider establishes policies and procedures to ensure that it consistently takes into account the following:

a) all information available regarding the client that is necessary to assess the suitability of the crypto-asset or service, including the client’s current investment portfolio and the asset allocation within it, which must not be limited to the allocation of crypto-assets;

b) all essential characteristics of the crypto-assets and services taken into account during the suitability assessment, including all relevant risks and direct or indirect costs incurred by the client.

The MNB draws the Provider’s attention to the fact that the suitability assessment is not limited to recommendations regarding the purchase of crypto-assets. It is expected that every recommendation is appropriate, whether it is a recommendation to buy, hold, sell, or refrain from buying a crypto-asset.
A Provider using tools (e.g., model portfolios, asset allocation software, or risk profile-defining software for potential investments) during the suitability assessment process must have appropriate systems and control measures to ensure that the tools are fit for purpose and yield satisfactory results.

13 Relevant legislation: Article 81(10) of the Regulation.

In this regard, the design of the tools should take into account the important characteristics of all clients or crypto-assets. For example, tools that broadly classify clients or crypto-assets would generally not be suitable for this purpose.
The MNB expects that the Provider develops policies and procedures that help ensure, among other things, the following:

a) that crypto-asset advice and crypto-asset portfolio management provided to the client takes into account an appropriate degree of risk diversification, including regarding the type of assets held in the portfolio (crypto-assets, financial instruments, etc.);

b) that the client is adequately aware of the relationship between risk and return, i.e., that risk-free assets necessarily generate low profits, as well as the impact of duration on this relationship and the costs associated with the investments;

c) that, given the client’s financial situation, they are able to finance the crypto-assets and bear any potential losses arising from them;

d) in the case of illiquid products, that personal advice given or transactions executed during the provision of crypto-asset advice and crypto-asset portfolio management take into account the duration for which the client is willing to maintain the investment; and

e) that no conflict of interest adversely affects the quality of the suitability assessment.

When deciding on the methodology to be adopted for carrying out the suitability assessment, the Provider must take into account the type and characteristics of the crypto-asset services provided and, generally speaking, its business model.
The MNB expects that, when conducting the suitability assessment, the Provider offering crypto-asset portfolio management services evaluates – in accordance with point 32(b) – the client’s knowledge and experience regarding the type of crypto-asset that may potentially enter the portfolio, as well as the type of risks related to the management of the portfolio. Depending on the complexity of the affected crypto-assets, the Provider must evaluate the client’s knowledge and experience more precisely than based solely on the type to which the crypto-asset belongs (e.g., an asset-backed token linked to an emerging market currency basket versus an asset-backed token linked solely to EUR and USD). On the other hand, regarding the client’s financial situation and investment objectives, the suitability assessment concerning the impacts of the crypto-asset(s) and transaction(s) can be performed at the level of the client’s portfolio. In practice, if the portfolio management agreement precisely defines the investment strategy that is appropriate for the client in terms of the suitability criteria defined by the Regulation and to be followed by the Provider, the assessment of the suitability of investment decisions can be performed by comparing it with the investment decision defined in the portfolio management agreement, and this must be reflected in the client’s entire portfolio. If a Provider carries out a suitability assessment taking into account the client’s entire portfolio within the framework of crypto-asset advice, this means, on the one hand, that it must assess the level of clients’ knowledge and experience regarding the risks associated with each crypto-asset and the related transaction. On the other hand, regarding the client’s financial situation and investment objectives, the suitability assessment concerning the impacts of the product and transaction can be performed at the level of the client’s portfolio.
If a Provider carries out a suitability assessment taking into account the client’s entire portfolio, it is expected that it ensures an appropriate degree of diversification in the client’s portfolio, taking into account the exposure of the client’s portfolio to various financial risks (geographic exposure, exposure to foreign currencies, etc.). The Provider must act with particular care regarding credit risks: the exposure of the clients’ portfolio to a single issuer or issuers belonging to the same group must be taken into account especially. The reason for this is that if a client’s portfolio focuses on products issued by a single economic entity or economic entities belonging to the same group, in the event of default by that economic entity or entities, the client may lose the entire investment.
To ensure the consistency of suitability assessments performed with automated tools – even if interaction with clients does not occur through automated systems – the MNB expects that the Provider regularly monitors and tests the algorithms that support the suitability of recommended or transactions undertaken on behalf of clients. When defining such algorithms, the Provider must take into account the nature and features of the crypto-assets and services contained in the recommendations made to clients. The Provider must take the following measures especially:

a) creating appropriate system design documents that clearly define the purpose, scope, and design of the algorithms; decision trees or decision rules must form part of these documents where applicable;

b) creating a documented testing strategy that details the scope of algorithm testing; this must include test plans, test cases, test results, error handling (if relevant), and final test results;

c) having appropriate policies and procedures for handling the modification of a specific algorithm, including tracking and recording these modifications; this includes security measures that ensure monitoring of the algorithm and prevent unauthorized access to it;

d) reviewing and updating algorithms to reflect important changes (e.g., market changes and changes in applicable law) that may affect their efficiency;

e) having policies and procedures that enable the detection and appropriate handling of errors within the algorithm, including, for example, suspending advice if the error is likely to result in inappropriate advice or violate relevant legislation;

f) having appropriate resources – including human and technological resources – to monitor and supervise the performance of algorithms through the appropriate and timely review of available advice; and

g) having an appropriate internal approval procedure to take the measures specified in points a)–f).

If the entirety or part of the crypto-asset advice or crypto-asset portfolio management takes place through an automated or semi-automated system, the responsibility for carrying out the suitability assessment lies with the Provider of the service, and the giving of personal advice or decision-making regarding trading must not be limited to the use of an electronic system.

IV.9. Costs and complexity of equivalent products 14

The MNB expects that policies and procedures regarding suitability ensure that before the Provider makes a decision regarding the crypto-asset(s) it intends to recommend or invest in on behalf of the client, a thorough evaluation of the possible alternatives of the crypto-assets or crypto-asset services takes place, taking into account the costs and complexity of the products.
The Provider is expected to have a procedure that takes into account the nature of the service, the business model, and the type of crypto-asset offered, to evaluate those available crypto-assets that are equivalent in terms of meeting the client’s needs and circumstances, such as regarding crypto-assets with similar target clients and similar risk/return profiles.
When weighing the cost factor, the Provider must take into account those costs and fees that fall under the relevant provisions of Article 81(4) of the Regulation. Regarding complexity, it is expected that the Provider complies with the criteria defined in point IV.7. For Providers with a limited product range or those offering only a single type of product, where the evaluation of equivalent crypto-assets may be limited, it is important that clients are fully aware of these circumstances. In this context, it is expected that clients receive appropriate information that the Provider limits the range of crypto-assets it offers in accordance with Article 81(2)(b) of the Regulation. 15
If a Provider uses common portfolio strategies or investment model recommendations that are to be applied to different clients with the same investment profile – as defined by the Provider – the evaluation of the cost and complexity of equivalent crypto-assets can be performed at a higher level, centrally (e.g., by an investment committee or other committee defining common portfolio strategies or investment model recommendations), although the Provider must still ensure on a client-by-client basis that the selected crypto-assets are suitable and match the client’s profile.
It is expected that the Provider justifies situations in which a more expensive or complex crypto-asset is chosen or recommended over an equivalent crypto-asset, taking into account that additional criteria may be considered in the product selection process in the context of crypto-asset advice or crypto-asset portfolio management (e.g., portfolio diversification, liquidity, or risk level). The Provider must document these decisions and keep records of them, as the internal control department of the Provider must pay special attention to these decisions. It is expected that the Provider reviews the relevant documents. In the course of crypto-asset advice, the Provider may also decide, for well-defined reasons, to recommend to the client that they choose the more expensive and complex crypto-asset.

IV.10. Costs and benefits of switching investments 16

As part of the rules and procedures regarding suitability assessment, the Provider must analyze the costs and benefits of switching investments so that the Provider can reasonably demonstrate that the expected benefits of switching investments are greater than the costs.
In the application of this recommendation, investment decisions such as rebalancing a portfolio under management to track an index – in accordance with the agreement concluded with the client – in the case of a passive strategy, are generally not considered switching investments. Transactions performed without maintaining such thresholds are considered switching investments.
It is expected that the Provider takes into account all necessary information to perform the cost-benefit analysis of switching investments, i.e., the evaluation of the advantages and disadvantages of the new crypto-asset(s). When weighing the cost dimension, the Provider must take into account those costs and fees that fall under the relevant provisions of Article 81(4) of the Regulation. In this context, both monetary and non-monetary cost and benefit factors may be important, which may include, among other things:

a) the expected net return of the proposed alternative transaction – which also takes into account any upfront costs payable by the client(s) – compared to the expected net return of the existing investment; the Provider must also take into account any exit costs that may arise for the client(s) regarding the relinquishment of the crypto-asset(s) already in their portfolio(s);

14 Relevant legislation: Article 81(1), (10), and (12) of the Regulation.

15 In accordance with the Regulation, the Provider is not expected to take into account all existing crypto-asset opportunities on the market in order to comply with the provisions of point IV.7 of this recommendation.

16 Relevant legislation: Article 81(1), (10), and (12) of the Regulation.

b) changes in the client's situation and needs, which may prompt consideration of switching investments, for example due to the need for liquidity in the short term resulting from unexpected and unplanned family events; c) changes in the characteristics of crypto-assets or market conditions, which may justify switching between the client's or clients' portfolios, for example if a crypto asset becomes illiquid due to market trends; d) the benefits arising from the switch of investments for the client's portfolio, such as:
da) increased diversification of the portfolio (by geographic area, type of crypto-asset, type of issuer, etc.); db) enhanced alignment of the portfolio's risk profile with the client's risk objectives; dc) increased liquidity of the portfolio; or de) reduced total credit risk of the portfolio.

In the course of advice on crypto-assets, the Suitability Report provided by the Provider to the client prior to the execution of the transaction must clearly detail whether the benefits of the recommended switch exceed its costs. 17
It is expected that the Provider adopts systems and control measures to monitor the risk of circumventing the obligation to assess the cost and benefit of the recommended investment switch, for example in cases where advice to sell one crypto-asset is followed by advice to purchase another crypto-asset (e.g., days later), but the two transactions were strictly linked from the outset.
If a Provider applies common portfolio strategies or model investment recommendations that apply to different clients within the same investment profile (as determined by the Provider), the cost-benefit analysis of the investment switch may be performed at a higher level than individual clients or individual transactions. Specifically, if a decision to switch investments is made centrally, for example by an investment committee or any other committee defining common portfolio strategies or model investment recommendations, the cost-benefit analysis may be performed at the level of said committee. If the decision to switch is made centrally, the cost-benefit analysis performed at this level would generally apply to all similar client portfolios without requiring a separate assessment for each individual client. In such a situation, the Provider may also determine at the level of the relevant committee why the investment switch does not occur for certain clients. Despite the fact that the cost-benefit analysis can be performed at higher levels in such situations, the MNB expects that the Provider nevertheless appropriately monitors whether certain clients have specific characteristics that may require a separate analysis.
If a Portfolio Management Provider has agreed with a client on a more personalized mandate and investment strategy due to the client's individual investment needs, it is necessary to perform the cost-benefit analysis of the investment switch at the client level.
Contrary to the provisions of the previous point, if a Portfolio Management Provider believes that the composition or parameters of a portfolio should be changed in a manner not permitted by the mandate accepted by the client, it is expected that the Portfolio Management Provider discusses this with the client, reviews the suitability assessment or prepares a new one, and the parties agree on a new mandate.

IV.11. Staff Qualifications 18 19

The MNB expects that the Provider ensures that its employees conducting essential parts of the suitability procedure possess the necessary proficiency, knowledge, and expertise in relation to crypto-assets and crypto-asset services.
It is expected that employees are aware of their role in the suitability assessment procedure and possess the necessary proficiency, knowledge, and expertise to perform their designated responsibilities, including relevant regulatory requirements and procedures.
The MNB further expects that the Provider ensures that employees possess the necessary knowledge and expertise, including knowledge and expertise regarding suitability assessments. It is necessary for the Provider to provide appropriate training to employees for this purpose.
The MNB expects that other employees who do not interact directly with clients but participate in the suitability assessment in any other way also possess the necessary skills, knowledge, and expertise depending on their role in the suitability assessment process. Such tasks may include, for example, the creation of questionnaires, the determination of algorithms necessary to perform the suitability assessment, and the determination of other criteria necessary to perform the suitability assessment and verify compliance with suitability requirements.
Where automated tools – including hybrid tools – are used, the Provider must ensure that its employees involved in activities related to the definition of such tools:
a) possess appropriate knowledge of the technology and algorithms used for digital advice, particularly the logic, risks, and rules of the algorithms underlying digital advice; and b) are able to understand and review the digital and automated advice generated by the algorithms.

18 Relevant legislation: Article 68(5) and Article 81(7) of the Regulation.
19 Pursuant to the authorization under Article 81(15)(a) of the Regulation, see ESMA Guidelines on criteria for assessing knowledge and expertise in accordance with Article 81(7) of the Regulation, and Government Decree No. 294/2024 (X. 9.) on the requirements for the education and professional practice of natural persons providing advice or information on crypto-assets on behalf of crypto-asset service providers.

V. Guidelines on the Format of Regular Reports Related to Portfolio Management of Crypto-Assets 20

V.1. Durable Data Carrier

The MNB expects that the Provider makes the regular report prescribed in Article 81(14) of the Regulation available to all affected clients in an electronic format that also constitutes a durable data carrier.
It is expected that the data carrier specified in point 96 enables the client to:
a) store information addressed personally to them in a manner accessible in the future for a period appropriate to the purpose of the information; and b) display the stored information in its unchanged form.

V.2. Access to Online Systems

For the application of the second subparagraph of Article 81(14) of the Regulation, the Provider must ensure that:
a) the online system to which clients have access qualifies as a durable data carrier; b) the client is notified electronically of where and how the information can be accessed (for example, if the online system is a website, the client must be notified of the website address and the location of the information within the website); c) the client is notified when a new regular report is available; and d) the information remains continuously accessible through the online system as long as the client may have a justified need to view it.

V.3. Content of the Regular Report

To ensure that clients receive a reliable and balanced overview of the activities performed, the portfolio's performance, and how the activities performed comply with preferences, objectives, and up-to-date information regarding the suitability assessment during the reporting period, it is expected that the regular report contains at least the following:
a) a statement on the content and valuation of the portfolio, including details of each crypto-asset, their market value or fair value if market value is not available, and the cash balance at the beginning and end of the period underlying the report (hereinafter: the reporting period); b) the performance of the portfolio during the reporting period, including tokens received free of charge for the continuity of proof-of-work and proof-of-stake blockchain consensus mechanisms (staking rewards); c) the total amount of commissions and fees charged during the reporting period and at least a detailed breakdown of total management fees and execution-related costs, including, where applicable, a statement that more detailed breakdowns are provided upon request; d) a comparison of the performance during the reporting period with the reference value set in the agreement between the Provider and the client, if any; e) the main characteristics of the relevant transaction for every transaction executed during the reporting period; f) an explanation of how the activities or the lack thereof comply with the client's preferences, objectives, and other characteristics.
It is expected that the Provider also provides the date of the last suitability assessment or its review, and, where applicable, the basis on which it was last updated (e.g., new information provided by the client causing a change in the client's profile, or new criteria applied by the Provider).

VI. Final Provisions

The recommendation is a regulatory instrument issued pursuant to Section 13(2)(i) of Act CXXXIX of 2013 on the Magyar Nemzeti Bank, which does not have binding force for supervised financial organizations. The content of the recommendation issued by the MNB expresses the requirements imposed by laws, principles and methods recommended for application based on the MNB's law enforcement practice, as well as market standards and customs.
The MNB monitors and evaluates compliance with the recommendation among the financial organizations under its supervision during its inspection and monitoring activities, in accordance with general European supervisory practice.
The MNB draws attention to the fact that a financial organization may incorporate the content of the recommendation into its regulations. In this case, the financial organization is entitled to state that the provisions contained in its relevant regulation correspond to the relevant recommendation issued by the MNB. If a financial organization wishes to include only certain parts of the recommendation in its regulations, it should avoid referencing the recommendation and apply it only to the parts transposed from the recommendation.
The MNB expects the affected financial organizations to apply this recommendation starting from October 1, 2026.

Varga Mihály signed
President of the Magyar Nemzeti Bank

Recommendation No. 5/2026 (March 25) of the Hungarian National Bank on certain aspects of suitability requirements under the Regulation on crypto-asset markets and the format of periodic statements for portfolio management activities