Custodial wallet / SaaS in Hungary

VASP Registration: Under the transposition of the EU's 5th and 6th Anti-Money Laundering Directives (AMLD5/AMLD6), custodial wallet providers are classified as Virtual Asset Service Providers (VASPs).

Obligation: VASPs, including those offering custodial services, are required to register with, or be licensed by, the Hungarian Financial Supervisory Authority (primarily the Magyar Nemzeti Bank - MNB, the Central Bank of Hungary, which oversees financial market supervision) for AML/CTF purposes.

Purpose of Registration: This registration primarily obliges the entity to comply with AML/CTF requirements, such as customer due diligence (KYC), transaction monitoring, and suspicious activity reporting, rather than specific operational custody rules.

Act CXXXVI of 2013 on the prevention and combating of money laundering and terrorist financing (Pmtv.) – This is Hungary's primary AML law, amended to include virtual asset service providers.

There are no specific, explicit statutory rules under current Hungarian law specifically for the segregation of client crypto assets from the custodian's own assets.

However, general civil law principles, fiduciary duties, and good business practices would strongly suggest and often require such segregation to protect client interests in case of insolvency or operational issues.

No specific, explicit statutory insurance/bonding requirements for crypto custodians beyond general business insurance that any company would hold.

No specific, explicit mandates for the use of cold storage (offline storage of private keys) under current Hungarian law.

However, industry best practices and general requirements for secure IT systems and risk management would naturally lead reputable custodians to employ cold storage or a hybrid approach.

No formal legal definition of a "qualified custodian" specifically for crypto assets under current Hungarian law.

The designation of a VASP for AML purposes doesn't equate to a "qualified custodian" in the sense of stringent operational and prudential requirements.

Authorization as a CASP: Under MiCA, any entity providing "custody and administration of crypto-assets on behalf of third parties" will be classified as a Crypto-Asset Service Provider (CASP) and will require prior authorization by a national competent authority (in Hungary, this will be the MNB).

Scope: This authorization is comprehensive and covers specific operational, organizational, and prudential requirements, going far beyond mere AML registration.

Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (MiCA).

Explicit Mandate: MiCA explicitly requires CASPs providing custody services to make adequate arrangements to safeguard the ownership rights of clients, particularly in the event of the CASP's insolvency.

Keep client crypto-assets and funds separate from their own crypto-assets and funds.

Maintain records and accounts that allow for the immediate segregation of client crypto-assets and funds from own assets and from those of other clients.

Return client crypto-assets and funds without undue delay upon their request.

Issuing warnings against unlicensed service providers (often foreign entities).

Entity Targeted: Xifra Lifestyle (also known as Xifra Global, Xifra LLC). Violation Type: Unlicensed financial service provision (offering investment services related to cryptocurrency trading without the necessary MNB authorization) and operating a scheme with characteristics of a pyramid scheme. Penalty Amount: The MNB issued a public warning and a cease-and-desist order. While no specific administrative fine amount was publicly disclosed by the MNB in its initial announcement, the action effectively prohibited the entity from operating in Hungary and referred the case to law enforcement for potential criminal proceedings.

Tax Authority (NAV): The National Tax and Customs Administration (NAV) enforces tax laws on crypto income and transactions, but these are typically individual or corporate audits and assessments rather than publicly announced "enforcement actions" against specific crypto platforms with a universal "penalty."