Parliament in Budapest just executed a legislative hard fork. Bill T/305 passed. The mandatory third-party verification layer for Hungarian crypto service providers is gone. No grace period. No grandfather clause. Just a delete call at the legislative level.
The ledger never sleeps, only updates. This update rewrites the compliance state machine for an entire EU member state.
Most coverage will frame this as 'Hungary relaxes crypto rules.' That is lazy. What really happened is more surgical: the state removed a broken oracle—a government-approved verification mechanism—and replaced it with MiCA's machine. The difference between those two words is not semantics. It is the difference between a permissioned gate and an algorithm. And in a borderless war, speed is the only moat.
To understand why this bill matters, rewind to Hungary's post-2021 VASP regime. The law created a condition: any firm offering crypto services to Hungarian residents needed a stamp from a state-approved third-party verifier. This was not a normal audit. It was a government-licensed gate. If a service provider lacked the stamp, the operator faced criminal exposure.
The criteria for becoming an approved verifier were opaque. The list of approved verifiers was painfully short. The result was a chokepoint. It did not matter how qualified a foreign VASP was. It did not matter that it already held a license in another EU state. In Hungary, without a state-approved verifier's signature, you were in the same legal category as a drug trafficker using crypto to launder cash.
Finance Minister András Kármán made the argument in plain terms: the old rule forced Revolut, eToro, and CoinCash to suspend or restrict Hungarian operations. The result was a user exodus. PwC counted the damage. 74% of active Hungarian crypto users had used Revolut. Active users fell by roughly 80,000—a 38% collapse. Chaos is just data waiting to be indexed. This was not a bear market blip. It was regulation acting as a circuit breaker, and the circuit breaker was stuck.
eToro and CoinCash were not obscure startups. eToro is a multi-asset platform with a global footprint. CoinCash is a domestic operator. When those names pull out, the message to the market is simple: the jurisdiction's expected value is negative. No amount of 'blockchain friendliness' in speeches can fix that.
Hungary's 2021 law was not written in a vacuum. It came from a global wave of national crypto registration laws that tried to control the industry before the EU got its act together. Most countries created a licensing duty. Hungary went further. It required third-party verification of the service provider, not just registration. That was a deliberate design choice. It gave the state control over who could certify whom.
MiCA is not a maximum harmonization law. It sets a floor. Member states can impose additional rules for national security or public order. But they cannot impose requirements that make the EU passport meaningless. The Commission's infringement procedure said Hungary crossed that line. The third-party verification requirement was effectively a second authorization. It defeated the purpose of a single passport.
What does the bill actually delete? Start with the legal mechanics. The old law created a verification requirement on top of MiCA. In technical terms, it acted like a smart contract modifier. If I were writing a pseudocode audit note, I would write it like this:
function launchCryptoService(address operator) external onlyStateApprovedVerifier { // run a crypto asset service }
onlyStateApprovedVerifier checked a whitelist maintained by the state. If the operator was not on that list, the transaction reverted. Worse, the revert had a criminal downstream.
Carrying out unverified crypto transactions between $15,000 and $150,000 could trigger up to two years in prison. Above that threshold, up to five years. That is not MiCA. That is a criminal code. You can call it regulation, but it functions as a legal denial-of-service attack on the market.
Bill T/305 deletes that modifier. It does not touch the underlying MiCA module. Supporters in the parliament, including the finance ministry, were careful to say that anti-money laundering and KYC obligations remain. Opponents warned about money laundering and terrorist financing. They are not wrong about the risk; they are wrong about the cause. The old verification layer was not preventing those crimes. It was preventing legal market entry.
Let me be precise about what MiCA does and does not do. Under MiCA, crypto-asset service providers need authorization from a national competent authority. They can passport that authorization across member states. They must meet capital requirements, governance requirements, and custody rules. A separate set of EU rules handles transfer-of-funds transparency and AML/KYC controls.
The Hungarian bill is not a repeal of any of those. It removes a national extra gate that sat on top of the EU framework. This distinction matters. In 2026, the European Commission opened an infringement procedure against Hungary, arguing that the old verification requirement conflicted with MiCA. Bill T/305 is the remedy. The member state that loves to fight Brussels just bent to the legal gun. That is the strongest validation of MiCA's centralizing power since its adoption.
Think of the infringement procedure as a governance bug report. The Commission read the Hungarian law, saw a contradiction with the MiCA state transition, and opened a ticket. The parliament's vote merges the fix. That is how the EU is supposed to work, but it rarely looks this clean.
I have spent years reading code that routes value. The lesson is always the same: permission logic is where projects die. In 2020, I audited the Uniswap V2 factory contract before its public launch. The code enabled direct ERC-20-to-ERC-20 swaps without ETH as an intermediate. That was a new path around an old assumption. Bill T/305 is similar. It creates a new path for foreign service providers to enter Hungary without passing through the old state oracle.
In April 2021, when the Bored Ape Yacht Club mint was live, I was one of the people who actually read the token-level IP clause. The community believed they owned the apes outright. The contract did not say that. The market narrative was trading ahead of the code. I get the same feeling with Bill T/305: the market will assume it means full deregulation, but the legal text says something narrower.
From a compliance engineering perspective, the bill is a one-line permit change. The Hungarian criminal code still applies to fraud. The Anti-Money Laundering Act still applies to exchanges. The National Bank of Hungary still has supervisory power. What disappears is the requirement that a government-approved third party bless the service provider before it can operate. This is not 'anyone can do anything.' It is 'anyone with a MiCA license can apply the same rulebook.'
The state-approved verifier is a compliance oracle. In blockchain, an oracle carries off-chain data into the chain. If the oracle is corrupted, all dependent applications are corrupted. In Hungary, the verifier carried the state's approval into the market. The market had to trust the verifier's existence, its fairness, and its speed. All three were unreliable. The bill kills the oracle and moves trust to the MiCA registry.
Economically, the old law created rent extraction. The approved verifiers could charge fees without competitive pressure because the state limited their supply. Service providers could not shop around in a free market. This is not the same as an auditor charging for an audit. It is a regulatory tax. The tax was high enough to drive firms out of the country. The repeal removes the tax, not the market's duty to be honest.
A critical caveat about the PwC numbers. They come from a survey, not from a government registry. We do not know exactly how 'active user' was defined. We do not know whether the survey was weighted to reflect the Hungarian population. But the direction of the trend is consistent with what service providers did. Revolut, eToro, and CoinCash all made observable decisions to suspend or restrict services. Those decisions are on the record, even if they are not on-chain.
This matters because the phrase 'if it isn't on-chain, it didn't happen' is a useful default, but governance data sometimes does not live on a public ledger. The best available proxy is the behavior of regulated firms. When a firm exits, that is a signed transaction in the regulatory ledger.
If you want to avoid another 38% user collapse, you need redundant on-ramps. Revolut was too big. The state-approved verifier was too small. Both are extremes of concentration. Bill T/305 removes one extreme. It does not automatically create the other. Redundancy requires multiple MiCA-licensed providers serving the same market. That takes time.
CoinCash's exit is especially sad. It was a local service with Hungarian-speaking support. It knew the local regulatory culture. It could have been the national champion of compliant crypto. Instead, the law made its operating costs so uncertain that it stopped. Foreign firms can return; local trust cannot be re-minted.
One underappreciated beneficiary of this bill is the regulated stablecoin sector. MiCA's stablecoin rules are already in force. Any issuer that wants to distribute a euro-referenced stablecoin inside Hungary no longer needs a separate Hungarian verifier. It needs a MiCA authorization from one member state and a passport notification to the MNB. That lowers the cost of distribution significantly.
Bitcoin and Ether are not the real trade here. The real trade is the compliance rails that let capital flow into the EU. Hungary's repeal turns the country into a distribution node. That is a mid-cap market structure change, not a retail price event.
The 80,000 user loss might be an undercount. It only counts active users known to PwC. It does not count users who entered the grey market, users who relied on unregulated foreign platforms, or users who simply gave up. The real exodus was probably larger. But the 38% decline is enough to make the point: a national regulatory misconfiguration can destroy demand faster than a market crash.
What if Hungary had kept the old law and the Commission had won? Hungary would face fines, potential suspension of EU funds, and a permanent stamp as an unreliable crypto jurisdiction. The repeal is a cost-benefit decision, not an ideological conversion. Any analysis that misses the fiscal incentive is incomplete.
Do not expect a smooth implementation. The Hungarian National Bank has historically been skeptical of crypto assets. The government can delete a verification layer, but it cannot force the MNB to be fast. The MNB will have to decide how to treat MiCA passport notifications from foreign supervisors. If it drags its feet, the market will still feel friction.
Foreign VASPs should not assume the MNB is a rubber stamp. It will want to see where the passport notification came from. It will test whether the home supervisor is doing its job. If not, expect enforcement actions to come from the Hungarian side.
Self-custody is not covered by the bill. MiCA largely exempts pure software providers and non-custodial wallet developers if they do not control assets. Bill T/305 does not change that. The criminal law repeal may reduce the risk for peer-to-peer traders, but not necessarily. A P2P seller who crosses the old thresholds might still face scrutiny under anti-money laundering rules. The bill removes the verification-based offense, not the fraud offense.
From a technical standpoint, the shift resembles a blockchain network upgrading from a single validator to a federation. Under the old law, Hungary was the only validator. Every transaction needed that validator's signature. Under MiCA, each member state is a validator in a federated consensus. A foreign VASP enters Hungary with a signature from its home validator. Budapest needs to verify that signature. But verification is not the same as trust.
This is an important shift in the authority model. The 'source of truth' for a crypto firm moves from one national registry to a network of national registries. That network can become an attack surface if one validator is weak. The EU's job is to ensure every validator has the same security level. That is harder than it sounds.
Opponents who warn about money laundering are not entirely wrong, but they are aiming at the wrong target. The old law created a tiny verifier cartel. If you control a government-licensed verification list, you can effectively block competition. You can also create a black market of unverified services.
The cartel is gone. Now the question is whether the EU's distributed oversight can do what the cartel failed to do. If the answer is no, the blind spot will be larger than before. The new law does not create the blind spot. It makes it visible.
Adapt or get front-run by your own assumptions. The firms that survive will assume MiCA is the floor, not the ceiling. They will design compliance programs that work in the EU passport network, not for a single national gate.
When BlackRock's IBIT started accumulating Bitcoin in January 2024, I noticed a discrepancy between exchange inflows and ETF creation activity. The aggregation was happening off-exchange. Institutions were building positions without touching visible order books. The same dynamic will appear here. The first signal will not be a Hungarian press release. It will be a Maltese or Lithuanian regulatory filing listing a passport notification for Hungary.
Watch the legal entity registries. Watch the register of crypto-asset service providers maintained by the European Securities and Markets Authority. That is the block height for regulatory flow. The truth is hidden in the block height, not in a finance minister's quote.
Before any service provider can return, the law must be signed by the president and published in the official gazette. The parliament's vote is not the final state. Until publication, the old rule remains the law of the land. This is not a trivial footnote. In crypto, we know that a transaction is not final until it is confirmed in a block. The same logic applies to legislation. The gazette is the block.
Most international coverage will treat this as a Hungarian story. It is actually a MiCA story. The European Commission started the infringement procedure because the old law clashed with EU law. The repeal is a direct response. For the first time, MiCA has forced a member state to restructure its local crypto regime. That sets a precedent. Any other member state with a local overlay on top of MiCA must now be nervous.
Do not assume this bill was purely pro-market. Incumbent financial institutions in Hungary may support it because it shifts compliance burdens to the EU level. That can be a form of regulatory capture. By making it easier for foreign firms to enter, the bill also pressures Hungarian banks to adapt. The old verification layer protected local incumbents as much as it protected users.
If the old law was a vulnerability, Bill T/305 is a patch applied to production without a testnet. There was no pilot phase. There was no gradual migration. The state deleted the verification requirement in one vote. That is a bold move in legacy finance. In crypto, we call that a governance hard fork. It can work, or it can introduce new bugs. The bugs will show up in the first enforcement case.
The real variable is not the law on the books; it is the enforcement budget. A country can have the best MiCA implementation in Europe and still fail if its supervisor lacks resources. Hungary has fewer than ten million people. Its crypto regulator is small. The bill reduces one regulatory burden, but it does not automatically increase the supervisor's budget. That is the gap to watch.
The approved verifiers themselves are the big losers of this bill. They built a business model around a government-created monopoly. When the state deletes the requirement, their revenue stream ends. Do not expect them to remain silent. They will lobby for a delay, for transitional provisions, or for a new role under MiCA. Watch the committee amendments after the vote.
One of the old verifier's jobs was to verify wallet ownership. That is a cryptographic problem, not a legal problem. A service provider cannot prove wallet ownership without a signature. The Hungarian law was asking a third party to do something that the wallet itself could prove. That was unnecessary friction. The repeal does not force anyone to abandon wallet-level proof. It just removes the government intermediary.
The old verification requirement also collected sensitive client data for a state-adjacent verifier. That data was a honeypot. Removing the requirement reduces the central storage of Hungarian crypto users' identity data. That is a privacy win, though not an intentional one. The bill does not contain a data-deletion clause. It just stops new data from flowing into the old system.
Two scenarios dominate. In scenario one, Hungary becomes a quiet compliance testbed. Foreign VASPs use the MiCA passport to enter. MNB focuses on enforcement. User numbers slowly recover. In that world, Bill T/305 is a patch that works.
In scenario two, old legal uncertainty is replaced by MiCA enforcement uncertainty. Providers pass through, but nobody supervises the local market deeply. Money laundering risks migrate from the verification layer to the distribution layer. In that world, Bill T/305 is a patch that moves the bug to a different module.
Back in 2017, I watched Ethereum's mempool fill with CryptoKitties transactions during the gas war. The network was not broken; it was congested by a single application. Hungary's old verification layer was the same: a single national queue clogged by an approval process. MiCA does not remove queues. It distributes them. In a borderless war, the congestion just moves.
The market narrative is already shifting toward 'Hungary is open for crypto.' That may be directionally true, but the timing is wrong. There are still several steps before a foreign VASP can legally target Hungarian customers. The official gazette is one signal. The regulator's playbook is another. The Commission's decision to close the infringement file is a third. None of these steps are formalities.
Each step is a potential delay. The compliance stack is not a single switch; it is a state machine. Bill T/305 changes one state, not all states.
The key question is not whether Hungary was 'right' to delete its verifier layer. The key question is whether MiCA can actually police the new passporting flow. The old gate was bad. The new gate is distributed. Distributed does not mean reliable.
This is not the end of Hungarian crypto regulation. It is the beginning of the serious test. The test will be measured in enforcement actions, not in parliament votes. The ledger never sleeps, only updates. The next update will be written by the European supervisors.
Will this be the Eurozone's compliance playbook or its cautionary tale? The answer is in the pending official text, the passport registry, and the first cross-border enforcement case. Watch the block height.