Opinion of the European Central Bank of 12 May 2025 on the resilience of critical entities (CON/2025/11)

OPINION OF THE EUROPEAN CENTRAL BANK of 12 May 2025 on the resilience of critical entities (CON/2025/11) Introduction and legal basis

On 20 December 2024, Law LXXXIV of 2024 on the resilience of critical entities (hereinafter the ‘Law’) was published in the Hungarian Official Gazette, followed, on 31 December 2024, by an implementing Government decree (hereinafter the ‘decree’). The European Central Bank (ECB) has not been consulted by the Hungarian authorities on the Law or the decree. The ECB has decided to deliver an own initiative opinion on the Law and the decree. The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and Article 2(1), third indent, of Council Decision 98/415/EC , as the Law and the decree relate to the Magyar Nemzeti Bank (MNB). In accordance with Article 17.5, first sentence, of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the Law and the decree

1.1 According to the explanatory memorandum accompanying the Law, the Law’s purpose is: (a) to transpose Directive (EU) 2022/2557 of the European Parliament and of the Council (hereinafter the ‘Critical Entities’ Resilience Directive’) into Hungarian law; and (b) to protect life and property in order to (i) ensure the wellbeing of citizens and the continuity of essential services, with a view to developing a national resilience system, and (ii) enhance the resilience of the State, society and the economy. The decree implements the Law based on a delegation under the Law . 1.2 The Critical Entities’ Resilience Directive 1.2.1 The Critical Entities’ Resilience Directive, as a minimum harmonisation directive, does not preclude Member States from adopting provisions of national law with a view to achieving a higher level of resilience of critical entities, provided that such provisions are consistent with Member States’

1 A kritikus szervezetek ellenálló képességéről szóló 2024. évi LXXXIV. törvény, published in Magyar Közlöny 2024/131.

2 A kritikus szervezetek ellenálló képességéről szóló törvény végrehajtásáról szóló 474/2024. (XII. 31.) Korm. rendelet, published in Magyar Közlöny 2024/139.

3 Council Decision 98/415/EC of 29 June 1998 on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42, ELI: http://data.europa.eu/eli/dec/1998/415/oj).

4 Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC (OJ L 333, 27.12.2022, p. 164, ELI: http://data.europa.eu/eli/dir/2022/2557/oj).

5 Article 40 of the Law. obligations laid down in Union law . The purpose of the Critical Entities’ Resilience Directive is to ensure the provision of essential services in the internal market, enhance the resilience of critical entities, assist them by means of coherent and dedicated support and supervision measures, and improve cross-border cooperation between competent authorities . 1.2.2 The Critical Entities’ Resilience Directive covers ‘public administration entities’, which are defined as entities recognised as such in a Member State in accordance with national law and complying with defined criteria. The judiciary, parliaments and central banks are excluded from the definition of a 8. public administration entity 1.2.3 The Critical Entities’ Resilience Directive outlines obligations for Member States to adopt a strategy for enhancing the resilience of critical entities, carry out a risk assessment, identify critical entities, designate or establish competent authorities and one single point of contact for the purpose of ensuring cooperation between Member States, support critical entities in enhancing their resilience, and consult one another regarding critical entities, whenever appropriate . Additionally, the Directive outlines requirements for critical entities to carry out a risk assessment, take appropriate and proportionate resilience measures, notify competent authorities of incidents significantly disrupting the provision of essential services or having the potential to do so, and the possibility for critical entities to request background checks on certain persons . The Directive also provides for the identification of critical entities of particular European significance and advisory missions to assess the measures certain critical entities of particular European significance have put in place to meet their obligations under the Directive . Furthermore, the Directive establishes a Critical Entities Resilience Group to support the Commission and facilitate cooperation among Member States and the exchange of information . Finally, the Directive establishes the competent authorities’ supervisory and enforcement powers to assess the compliance of critical entities with the obligations laid down in the Directive . 1.3 The MNB under the scope of the Law and the decree 1.3.1 The Law designates the basic tasks of the MNB, with the exception of monetary policy, macroprudential policy and the operation of the central bank information system, as essential services in the financial sector and the financial market infrastructure subsector . Therefore, under the Law, the MNB’s essential services are: (a) the issuance of banknotes and coins; (b) the establishment and management of foreign exchange and gold reserves; (c) the execution of related foreign exchange operations; and (d) the oversight of payment and settlement and securities clearing and settlement systems . On the other hand, the decree specifies that the MNB may be designated

6 Article 3 of the Critical Entities’ Resilience Directive.

7 Recitals 1 and 7 of the Critical Entities’ Resilience Directive.

8 Article 2, point (10), of the Critical Entities’ Resilience Directive.

9 Articles 4 to 7 and 9 to 11 of the Critical Entities’ Resilience Directive.

10 Articles 12 to 15 of the Critical Entities’ Resilience Directive.

11 Articles 17 and 18 of the Critical Entities’ Resilience Directive.

12 Article 19 of the Critical Entities’ Resilience Directive.

13 Articles 21 and 22 of the Critical Entities’ Resilience Directive.

14 Annex 1 to the Law, line 76. as a critical entity with respect to the following tasks: (a) the establishment and management of foreign exchange and gold reserves; (b) the execution of related foreign exchange operations; (c) the oversight of payment and settlement and securities clearing and settlement systems; and (d) supervision of the financial intermediary system . The designating authority may designate the infrastructures relating to the MNB’s essential services as critical infrastructures . 1.3.2 The Law assigns to the MNB the obligation to: (a) build and improve resilience in the context of essential services and critical infrastructures; (b) conduct risk assessment and risk management; (c) prepare a resilience plan and a resilience matrix; and (d) conduct resilience exercises and stress tests . Additionally, the MNB is to report all incidents falling under the Law to the authorities supervising its compliance with the Law and establish the position of an independent critical entity resilience manager (hereinafter ‘critical entity resilience manager’) . Finally, to meet the applicable resilience requirements, security staff acting on behalf of the MNB are authorised (with some exceptions) to screen, restrict, or prevent, for security purposes, the entry or exit of persons, vehicles and objects within and from the area where a critical infrastructure is located . 1.4 Supervision of the MNB under the Law and the decree 1.4.1 Two authorities supervise the MNB’s compliance with the Law and the decree: (a) the National Directorate General for Disaster Management of the Ministry of the Interior as the general designating and control authority ; and (b) the Minister responsible for the regulation of the money, capital and insurance markets as the first-level specialist authority (ágazati szakhatóság) in relation to the MNB’s critical activities . 1.4.2 The general designating authority regularly monitors and assesses the resilience status of sectors, subsectors, essential services, potential critical entities and critical infrastructures . It decides on the designation of critical entities and infrastructures and carries out a procedure to maintain or withdraw the designation at the latest every four years . In the context of that procedure, it examines compliance with horizontal criteria by the MNB or the infrastructure subject to the procedure and, in certain cases, with sectoral criteria with the involvement of the first-level specialist authority . It also classifies critical entities into three levels of resilience based on the impact of the service they provide and of an incident, the number of users of their service, the geographical coverage of the service provided, and the nature of the sector, subsector and essential service concerned . Finally, it

21 Belügyminisztérium Országos Katasztrófavédelmi Főigazgatóság. Articles 2(1) and 19(1) of the decree; Article 2(1) of Government decree 234/2011. (XI. 10.) on the implementation of Law CXXVIII of 2011 on disaster management and amending certain related laws.

22 Pénz-, tőke- és biztosítási piac szabályozásáért felelős miniszter. Annex 1, Table 21, lines 12 and 25, to Government decree 531/2017. (XII. 29.) designating certain specialised authorities to act on imperative grounds of public interest. designates critical infrastructures and determines their level of resilience with the involvement of the first-level specialist authority . 1.4.3 The control authority carries out regular, periodic and ex-post complex official inspections 28. (hereinafter the ‘complex control’) with the involvement of the first-level specialist authority It monitors, as part of the complex control: (a) the MNB’s compliance with the provisions of the Law and related legislation; (b) the MNB’s compliance with the final decision of the designating authority; (c) the adequacy of and compliance with the measures taken by the MNB to maintain and improve the resilience of the MNB and its critical infrastructures; (d) the adequacy of the MNB’s resilience plan and the regularity and adequacy of the MNB’s risk assessment and resilience matrix; (e) the adequacy of the activities of the MNB’s management in terms of resilience; (f) the adequacy of the activities of the critical entity resilience manager; (g) the adequacy of the MNB’s resilience exercise; (h) the adequacy of the cooperation between the MNB and members of the relevant supply chain and suppliers; and (i) the MNB’s compliance with the requirements relating to the suitability of the critical entity resilience manager . 1.4.4 The first-level specialist authority, in addition to issuing a sector-specific opinion in the relevant designation procedures, is also involved in determining the content of the resilience plan and resilience matrix, and in the regular periodic inspections of the control authority. Under certain conditions, it may carry out a sectoral resilience inspection independently, examining a number of compliance obligations . 1.4.5 If the MNB or the critical entity resilience manager fail to comply with their legal obligations, the supervising authorities will impose a time limit for the MNB to remedy the failure and may also impose an administrative fine on the MNB . The amount of the administrative fine depends on the individual infringement and ranges from HUF 500 000 to HUF 15 000 000. In the case of several infringements, the fines for each infringement are totalled, subject to a maximum total fine of HUF 100 000 000 .

2. General observations

2.1 The ECB supports the aim of the Critical Entities’ Resilience Directive to ensure that services that are essential for the maintenance of vital societal functions or economic activities within the scope of Article 114 of the Treaty are provided in an unobstructed manner in the internal market. The ECB also supports the objective of the Critical Entities’ Resilience Directive to help achieve a high level of resilience of critical entities in order to ensure the provision of essential services within the Union and to improve the functioning of the internal market .

2.2 The ECB understands that, by including the MNB within their scope, the Law and the decree go beyond the Critical Entities’ Resilience Directive, which excludes central banks from the definition of a ‘public administration entity’ . 2.3 Under the Law and the decree, the scope of the tasks in the exercise of which the MNB can be designated as a critical entity differ. The ECB understands that in the event of a conflict between the Law and the decree, the provisions of the Law take precedence . Nevertheless, the ECB suggests that the scope of the MNB’s tasks under the Law and the decree should be aligned to ensure legal certainty.

3. Impact of the Law and the decree on the independence of the MNB

3.1 Article 130 of the Treaty provides that, when exercising the powers and carrying out the tasks and duties conferred upon them by the Treaties and the Statute of the European System of Central Banks and of the European Central Bank (hereinafter the ‘Statute of the ESCB’), neither a national central bank (NCB), which includes the MNB, nor any member of its decision-making bodies are to seek or take instructions from Union institutions, bodies, offices or agencies, from any government of a Member State or from any other body. The Union institutions, bodies, offices or agencies and the governments of the Member States undertake to respect this principle and not to seek to influence the members of the decision-making bodies of the NCBs in the performance of their tasks . 3.2 Article 130 of the Treaty also applies to Member States with a derogation, such as Hungary, in respect of which the Council has not yet decided that they fulfil the necessary conditions for the adoption of the euro . Consistent with these Treaty requirements, Hungarian law enshrines the independence of the MNB, and its concomitant primary objective to maintain price stability . 3.3 Central bank independence is served by providing the NCBs with the necessary means and instruments to conduct an efficient monetary policy and to achieve their primary objective of price stability independently of any other authority, reflecting the generally held view that the objective of price stability is best served by a fully independent institution . The recognition that central banks have such independence does not, however, have the consequence of exempting them from every rule of law or of shielding them from any kind of legislation . This also applies to national legislative measures capable of applying to NCBs in the European System of Central Banks (ESCB) , such as the Law and the decree.

36 Article 130 of the Treaty is mirrored in Article 7 of the Statute of the ESCB.

37 Article 130 of the Treaty is not referred to in Article 139(2) thereof, which lists exhaustively the Treaty provisions that do not apply to Member States with a derogation.

38 See Articles 1(2) and 3(1) of the Law on the MNB. Pursuant to Article 139(2) of the Treaty, in conjunction with Article 42.2 of the Statute of the ESCB, the central banks of Member States with a derogation, which includes the MNB, retain their powers in the field of monetary policy according to national law.

39 See the ECB’s Convergence Report, 2024, paragraph 2.2.3, available on the ECB’s website at www.ecb.europa.eu.

40 See the judgment of the Court of Justice of 10 July 2003, Commission v European Central Bank, C-11/00, ECLI:EU:C:2003:395, paragraphs 134 to 136.

41 See paragraph 2.2 of Opinion CON/2024/14, paragraph 2.2 of Opinion CON/2024/24 and paragraph 2.2 of Opinion CON/2025/2. All ECB opinions are published on EUR-Lex. 3.4 The ECB refers to the stance it has taken in the context of assessing national legislation on the resilience of critical infrastructures. The ECB has welcomed the exemption of critical infrastructures and payment systems operated, supervised or overseen by ESCB central banks from draft national laws' scope of application, as that should help to ensure that national legislation on the protection of critical infrastructures does not encroach on the ESCB’s competences, consistent with the principle of the primacy of Union law and central bank independence under Article 130 of the Treaty . 3.5 The ECB also refers to the stance it has taken in the context of national emergency planning in the case of Member States whose currency is the euro. The ECB has highlighted that, in the area of monetary policy and ESCB-related tasks, Member States whose currency is the euro may not unilaterally adopt measures as it is for the decision-making bodies of the ECB alone to take the measures necessary to ensure the performance of the tasks entrusted to the ESCB by the Treaty and the Statute of the ESCB , including contingency planning in respect of the continued performance of these tasks . 3.6 Therefore, Member States which have not adopted the euro may not adopt unilateral measures that interfere with the independence of the NCBs as it is for the NCB’s decision-making bodies to ensure the performance of the tasks entrusted to the ESCB under the Treaty and the Statute of the ESCB. Contingency planning, together with building, improving and managing the resilience of an NCB, are integral parts of the performance of an NCB’s ESCB-related tasks. Since the MNB’s resilience is inextricably linked with the performance of its tasks, it is for the MNB’s decision-making bodies to take decisions concerning its resilience. 3.7 Contrary to the above, the ECB understands that, in their current form, the Law and the decree impose a number of obligations on the MNB and place it under the supervision of governmental bodies with substantial powers. For instance, the MNB is required to build and improve its resilience based on obligations such as the preparation of a resilience plan and a resilience matrix with predetermined content and form requirements and the establishment of a position of an independent critical entity resilience manager with the provision of adequate technical, human and financial resources for their activities. The supervising governmental bodies’ powers include, for example, powers to designate a specific MNB infrastructure as a critical infrastructure, to approve or reject the MNB’s resilience plan and resilience matrix, and to mandate the MNB to conduct resilience exercises and stress tests. The MNB is also subject to inspections during which the supervising governmental bodies monitor all the MNB’s actions and lack of action related to its resilience. Finally, if the MNB or the critical entity resilience manager fail to comply with their legal obligations, the supervising governmental bodies will impose a time limit for the MNB to remedy the failure and may impose an administrative fine on the MNB. These obligations and supervisory powers significantly influence the MNB’s preparedness and fundamentally restrict the autonomy of the MNB’s decision-making bodies to make decisions that concern the MNB’s resilience. 3.8 Therefore, the Law and the decree, in their current form, amount to enabling the government to give instructions to the MNB and thus interfere with the MNB’s independence under Article 130 of the

42 See paragraph 2.3.1 of Opinion CON/2017/31 and paragraph 3.2.1 of Opinion CON/2018/39.

44 See paragraph 2.1 of Opinion CON/2020/2 and paragraph 2.1 of Opinion CON/2021/35. Treaty. Against this background, the ECB recommends that the Hungarian legislator exempt the MNB from any provision that could amount to enabling the government to give such instructions to the MNB in light of the need to preserve its independence. This opinion will be published on EUR-Lex. Done at Frankfurt am Main, 12 May 2025. [signed] The President of the ECB Christine LAGARDE