Opinion of the European Central Bank of 12 May 2025 on the resilience of critical entities (CON/2025/11)
Date: 2025-05-12
Institutions: European Central Bank
Subjects: legal basis, money

ECB-PUBLIC 

EN 

OPINION OF THE EUROPEAN CENTRAL BANK 

of 12 May 2025 

on the resilience of critical entities 

(CON/2025/11) 

Introduction and legal basis 

On 20 December 2024, Law LXXXIV of 2024 on the resilience of critical entities 1 (hereinafter the ‘Law’) 

was  published  in  the  Hungarian  Official  Gazette,  followed,  on  31  December  2024,  by  an  implementing 

Government decree2 (hereinafter the ‘decree’). The European Central Bank (ECB) has not been consulted 

by the Hungarian authorities on the Law or the decree. 

The ECB has decided to deliver an own initiative opinion on the Law and the decree. 

The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 

Functioning of the European Union and Article 2(1), third indent, of Council Decision 98/415/EC 3, as the 

Law  and  the  decree  relate  to  the  Magyar  Nemzeti  Bank  (MNB).  In  accordance  with  Article  17.5,  first 

sentence, of the Rules of Procedure of the European Central Bank, the Governing Council has adopted 

this opinion. 

1. 

Purpose of the Law and the decree 

1.1  According  to  the  explanatory  memorandum  accompanying  the  Law,  the  Law’s  purpose  is:  (a)  to 

transpose Directive (EU) 2022/2557 of the European Parliament and of the Council4 (hereinafter the 

‘Critical Entities’ Resilience Directive’) into Hungarian law; and (b) to protect life and property in order 

to  (i)  ensure  the  wellbeing  of  citizens  and  the  continuity  of  essential  services,  with  a  view  to 

developing a national resilience system, and (ii) enhance the resilience of the State, society and the 

economy. The decree implements the Law based on a delegation under the Law 5. 

1.2  The Critical Entities’ Resilience Directive 

1.2.1  The Critical Entities’ Resilience Directive, as a minimum harmonisation directive, does not preclude 

Member States from adopting provisions of national law with a view to achieving a higher level of 

resilience  of  critical  entities,  provided  that  such  provisions  are  consistent  with  Member  States’ 

1  

2  

3  

4  

5  

A kritikus szervezetek ellenálló képességéről szóló 2024. évi LXXXIV. törvény, published in Magyar Közlöny 
2024/131. 
A kritikus szervezetek ellenálló képességéről szóló törvény végrehajtásáról szóló 474/2024. (XII. 31.) Korm. 
rendelet, published in Magyar Közlöny 2024/139. 
Council Decision 98/415/EC of 29 June 1998 on the consultation of the European Central Bank by national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42, ELI: 
http://data.europa.eu/eli/dec/1998/415/oj). 

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of 
critical entities and repealing Council Directive 2008/114/EC (OJ L 333, 27.12.2022, p. 164, ELI: 
http://data.europa.eu/eli/dir/2022/2557/oj). 

Article 40 of the Law. 

 
 
 
 
 
 
ECB-PUBLIC 

obligations laid down in Union law6. The purpose of the Critical Entities’ Resilience Directive is to 

ensure the provision of essential services in the internal market, enhance the resilience of critical 

entities, assist them by means of coherent and dedicated support and supervision measures, and 

improve cross-border cooperation between competent authorities 7.  

1.2.2  The Critical Entities’ Resilience Directive covers ‘public administration entities’, which are defined as 

entities recognised as such in a Member State in accordance with national law and complying with 

defined criteria. The judiciary, parliaments and central banks are excluded from the definition of a 

public administration entity 8. 

1.2.3  The Critical Entities’ Resilience Directive outlines obligations for Member States to adopt a strategy 

for enhancing the resilience of critical entities, carry out a risk assessment, identify critical entities, 

designate  or  establish  competent  authorities  and  one  single  point  of  contact  for  the  purpose  of 

ensuring cooperation between Member States, support critical entities in enhancing their resilience, 

and consult one another regarding critical entities, whenever appropriate 9. Additionally, the Directive 

outlines  requirements  for  critical  entities  to  carry  out  a  risk  assessment,  take  appropriate  and 

proportionate resilience measures, notify competent authorities of incidents significantly disrupting 

the  provision  of  essential  services  or  having  the  potential  to  do  so,  and  the  possibility  for  critical 

entities  to  request  background  checks  on  certain  persons10.  The  Directive  also  provides  for  the 

identification of critical entities of particular European significance and advisory missions to assess 

the measures certain critical entities of particular European significance have put in place to meet 

their  obligations  under  the  Directive11.  Furthermore,  the  Directive  establishes  a  Critical  Entities 

Resilience Group to support the Commission and facilitate cooperation among Member States and 

the  exchange  of  information 12.  Finally,  the  Directive  establishes  the  competent  authorities’ 

supervisory and enforcement powers to assess the compliance of critical entities with the obligations 

laid down in the Directive 13. 

1.3  The MNB under the scope of the Law and the decree  

1.3.1  The  Law  designates  the  basic  tasks  of  the  MNB,  with  the  exception  of  monetary  policy, 

macroprudential  policy  and  the  operation  of  the  central  bank  information  system,  as  essential 

services in the financial sector and the financial market infrastructure subsector 14. Therefore, under 

the  Law,  the  MNB’s  essential  services  are:  (a)  the  issuance  of  banknotes  and  coins;  (b)  the 

establishment and management of foreign exchange and gold reserves; (c) the execution of related 

foreign exchange operations; and (d) the oversight of payment and settlement and securities clearing 

and settlement systems 15. On the other hand, the decree specifies that the MNB may be designated 

6  
7  
8  
9  
10  
11  
12  
13  
14  
15  

Article 3 of the Critical Entities’ Resilience Directive. 
Recitals 1 and 7 of the Critical Entities’ Resilience Directive. 

Article 2, point (10), of the Critical Entities’ Resilience Directive. 
Articles 4 to 7 and 9 to 11 of the Critical Entities’ Resilience Directive. 

Articles 12 to 15 of the Critical Entities’ Resilience Directive. 
Articles 17 and 18 of the Critical Entities’ Resilience Directive. 

Article 19 of the Critical Entities’ Resilience Directive. 
Articles 21 and 22 of the Critical Entities’ Resilience Directive. 
Annex 1 to the Law, line 76. 

Article 4(13) of Law CXXXIX of 2013 on the Magyar Nemzeti Bank (hereinafter the ‘Law on the MNB’). 

2 

 
 
ECB-PUBLIC 

as  a  critical  entity  with  respect  to  the  following  tasks:  (a)  the  establishment  and  management  of 

foreign exchange and gold reserves; (b) the execution of related foreign exchange operations; (c) 

the  oversight  of  payment  and  settlement  and  securities  clearing  and  settlement  systems;  and  (d) 

supervision  of  the  financial  intermediary  system16.  The  designating  authority  may  designate  the 

infrastructures relating to the MNB’s essential services as critical infrastructures 17. 

1.3.2  The  Law  assigns  to  the  MNB  the  obligation  to:  (a)  build  and  improve  resilience  in  the  context  of 

essential services and critical infrastructures; (b) conduct risk assessment and risk management; (c) 

prepare  a resilience  plan and a resilience matrix; and (d) conduct resilience exercises and stress 

tests18.  Additionally,  the  MNB  is  to  report  all  incidents  falling  under  the  Law  to  the  authorities 

supervising its compliance with the Law and establish the position of an independent critical entity 

resilience manager (hereinafter ‘critical entity resilience manager’) 19. Finally, to meet the applicable 

resilience  requirements,  security  staff  acting  on  behalf  of  the  MNB  are  authorised  (with  some 

exceptions) to screen, restrict, or prevent, for security purposes, the entry or exit of persons, vehicles 

and objects within and from the area where a critical infrastructure is located 20. 

1.4  Supervision of the MNB under the Law and the decree 

1.4.1  Two  authorities  supervise  the  MNB’s  compliance  with  the  Law  and  the  decree:  (a)  the  National 

Directorate  General  for  Disaster  Management  of  the  Ministry  of  the  Interior  as  the  general 

designating and control authority 21; and (b) the Minister responsible for the regulation of the money, 

capital and insurance markets as the first-level specialist authority (ágazati szakhatóság) in relation 

to the MNB’s critical activities22.  

1.4.2  The general designating authority regularly monitors and assesses the resilience status of sectors, 

subsectors, essential services, potential critical entities and critical infrastructures 23. It decides on the 

designation of critical entities and infrastructures and carries out a procedure to maintain or withdraw 

the  designation  at  the  latest  every  four  years 24.  In  the  context  of  that  procedure,  it  examines 

compliance with horizontal criteria by the MNB or the infrastructure subject to the procedure and, in 

certain cases, with sectoral criteria with the involvement of the first-level specialist authority 25. It also 

classifies critical entities into three levels of resilience based on the impact of the service they provide 

and of an incident, the number of users of their service, the geographical coverage of the service 

provided,  and  the  nature  of  the  sector,  subsector  and  essential  service  concerned26.  Finally,  it 

16  
17  
18  
19  
20  
21  

22  

23  
24  
25  
26  

Article 117(1) of the decree. 
Article 117(2) of the decree. 
Article 17(1) to (2), Articles 18 and 19 and Article 25(1) to (2) of the Law. 

Article 20(1), point (a), and Article 26(1) to (2) of the Law. 
Article 17(4) of the Law. 

Belügyminisztérium Országos Katasztrófavédelmi Főigazgatóság. Articles 2(1) and 19(1) of the decree; Article 2(1) 
of Government decree 234/2011. (XI. 10.) on the implementation of Law CXXVIII of 2011 on disaster management 
and amending certain related laws. 
Pénz-, tőke- és biztosítási piac szabályozásáért felelős miniszter. Annex 1, Table 21, lines 12 and 25, to 
Government decree 531/2017. (XII. 29.) designating certain specialised authorities to act on imperative grounds of 
public interest. 

Article 7(1) of the Law. 
Article 7(4) and Article 9(1) and (3) of the Law. 
Article 6(1) of the Law. 

Article 10(1) of the Law. 

3 

 
 
ECB-PUBLIC 

designates critical infrastructures and determines their level of resilience with the involvement of the 

first-level specialist authority27. 

1.4.3  The  control  authority  carries  out  regular,  periodic  and  ex-post  complex  official  inspections 

(hereinafter  the  ‘complex  control’)  with  the  involvement  of  the  first-level  specialist  authority 28.  It 

monitors, as part of the complex control: (a) the MNB’s compliance with the provisions of the Law 

and related legislation; (b) the MNB’s compliance with the final decision of the designating authority; 

(c) the adequacy of and compliance with the measures taken by the MNB to maintain and improve 

the resilience of the MNB and its critical infrastructures; (d) the adequacy of the MNB’s resilience 

plan and the regularity and adequacy of the MNB’s risk assessment and resilience matrix; (e) the 

adequacy of the activities of the MNB’s management in terms of resilience; (f) the adequacy of the 

activities of the critical entity resilience manager; (g) the adequacy of the MNB’s resilience exercise; 

(h) the adequacy of the cooperation between the MNB and members of the relevant supply chain 

and suppliers; and (i) the MNB’s compliance with the requirements relating to the suitability of the 

critical entity resilience manager 29. 

1.4.4  The  first-level  specialist  authority,  in  addition  to  issuing  a  sector-specific  opinion  in  the  relevant 

designation  procedures,  is  also  involved  in  determining  the  content  of  the  resilience  plan  and 

resilience  matrix,  and  in  the  regular  periodic  inspections  of  the  control  authority.  Under  certain 

conditions, it may carry out a sectoral resilience inspection independently, examining a number of 

compliance obligations 30. 

1.4.5  If  the  MNB  or  the  critical  entity  resilience  manager  fail  to  comply  with  their  legal  obligations,  the 

supervising authorities will impose a time limit for the MNB to remedy the failure and may also impose 

an administrative fine on the MNB31. The amount of the administrative fine depends on the individual 

infringement and ranges from HUF 500 000 to HUF 15 000 000. In the case of several infringements, 

the fines for each infringement are totalled, subject to a maximum total fine of HUF 100 000 00032. 

2. 

General observations 

2.1   The ECB supports the aim of the Critical Entities’ Resilience Directive to ensure that services that 

are essential for the maintenance of vital societal functions or economic activities within the scope of 

Article 114 of the Treaty are provided in an unobstructed manner in the internal market. The ECB 

also supports the objective of the Critical Entities’ Resilience Directive to help achieve a high level of 

resilience of critical entities in order to ensure the provision of essential services within the Union and 

to improve the functioning of the internal market33. 

27  
28  
29  
30  

31  
32  
33  

Article 11(2) to (3) of the Law. 
Article 21(1) of the Law. 

Article 21(2) of the Law. 
Article 3, point (3), Articles 6(1), 11(2) and 19(2) to (3) and Article 21(1), (3) and (5) of the Law and Articles 16(1) and 
19(8) of the decree. 
Article 28(1) of the Law and Article 29 of the decree. 
Article 29(1) of and Annex 3 to the decree. 

Article 1(1) of the Critical Entities’ Resilience Directive. 

4 

 
 
 
ECB-PUBLIC 

2.2   The  ECB  understands  that,  by  including  the  MNB  within  their  scope,  the  Law  and  the  decree  go 

beyond the Critical Entities’ Resilience Directive, which excludes central banks from the definition of 

a ‘public administration entity’34. 

2.3  Under  the  Law  and  the  decree,  the  scope  of  the  tasks  in  the  exercise  of  which  the  MNB  can  be 

designated as a critical entity differ. The ECB understands that in the event of a conflict between the 

Law and the decree, the provisions of the Law take precedence 35. Nevertheless, the ECB suggests 

that the scope of the MNB’s tasks under the Law and the decree should be aligned to ensure legal 

certainty. 

3. 

Impact of the Law and the decree on the independence of the MNB 

3.1  Article 130 of the Treaty provides that, when exercising the powers and carrying out the tasks and 

duties conferred upon them by the Treaties and the Statute of the European System of Central Banks 

and of the European Central Bank (hereinafter the ‘Statute of the ESCB’), neither a national central 

bank (NCB), which includes the MNB, nor any member of its decision-making bodies are to seek or 

take  instructions  from  Union  institutions,  bodies,  offices  or  agencies,  from  any  government  of  a 

Member State or from any other body. The Union institutions, bodies, offices or agencies and the 

governments of the Member States undertake to respect this principle and not to seek to influence 

the members of the decision-making bodies of the NCBs in the performance of their tasks 36. 

3.2  Article  130  of  the  Treaty  also  applies  to  Member  States  with  a  derogation,  such  as  Hungary,  in 

respect  of  which  the  Council  has  not  yet  decided  that  they  fulfil  the  necessary  conditions  for  the 

adoption  of  the  euro37.  Consistent  with  these  Treaty  requirements,  Hungarian  law  enshrines  the 

independence of the MNB, and its concomitant primary objective to maintain price stability 38.  

3.3  Central  bank  independence  is  served  by  providing  the  NCBs  with  the  necessary  means  and 

instruments to conduct an efficient monetary policy and to achieve their primary objective of price 

stability independently of any other authority, reflecting the generally held view that the objective of 

price stability is best served by a fully independent institution39. The recognition that central banks 

have such independence does not, however, have the consequence of exempting them from every 

rule of law or of shielding them from any kind of legislation40. This also applies to national legislative 

measures capable of applying to NCBs in the European System of Central Banks (ESCB)41, such as 

the Law and the decree. 

34  
35  
36  
37  

38  

39  
40  

41  

Article 2(10) of the Critical Entities’ Resilience Directive. 

Article 15(4) of the Fundamental Law of Hungary. 
Article 130 of the Treaty is mirrored in Article 7 of the Statute of the ESCB. 

Article 130 of the Treaty is not referred to in Article 139(2) thereof, which lists exhaustively the Treaty provisions that 
do not apply to Member States with a derogation. 

See Articles 1(2) and 3(1) of the Law on the MNB. Pursuant to Article 139(2) of the Treaty, in conjunction with Article 
42.2 of the Statute of the ESCB, the central banks of Member States with a derogation, which includes the MNB, 
retain their powers in the field of monetary policy according to national law. 
See the ECB’s Convergence Report, 2024, paragraph 2.2.3, available on the ECB’s website at www.ecb.europa.eu. 

See the judgment of the Court of Justice of 10 July 2003, Commission v European Central Bank, C-11/00, 
ECLI:EU:C:2003:395, paragraphs 134 to 136. 
See paragraph 2.2 of Opinion CON/2024/14, paragraph 2.2 of Opinion CON/2024/24 and paragraph 2.2 of Opinion 
CON/2025/2. All ECB opinions are published on EUR-Lex. 

5 

 
 
 
ECB-PUBLIC 

3.4  The  ECB  refers  to  the  stance  it  has  taken  in  the  context  of  assessing  national  legislation  on  the 

resilience of critical infrastructures. The ECB has welcomed the exemption of critical infrastructures 

and payment systems operated, supervised or overseen by ESCB central banks from draft national 

laws' scope of application, as that should help to ensure that national legislation on the protection of 

critical infrastructures does not encroach on the ESCB’s competences, consistent with the principle 

of the primacy of Union law and central bank independence under Article 130 of the Treaty 42. 

3.5  The ECB also refers to the stance it has taken in the context of national emergency planning in the 

case of Member States whose currency is the euro. The ECB has highlighted that, in the area of 

monetary  policy  and  ESCB-related  tasks,  Member  States  whose  currency  is  the  euro  may  not 

unilaterally  adopt  measures  as  it  is  for  the  decision-making  bodies  of  the  ECB  alone  to  take  the 

measures necessary to ensure the performance of the tasks entrusted to the ESCB by the Treaty 

and  the  Statute  of  the  ESCB 43,  including  contingency  planning  in  respect  of  the  continued 

performance of these tasks44. 

3.6  Therefore, Member States which have not adopted the euro may not adopt unilateral measures that 

interfere with the independence of the NCBs as it is for the NCB’s decision-making bodies to ensure 

the performance of the tasks entrusted to the ESCB under the Treaty and the Statute of the ESCB. 

Contingency planning, together with building, improving and managing the resilience of an NCB, are 

integral parts of the  performance of an NCB’s ESCB-related tasks. Since  the MNB’s resilience  is 

inextricably linked with the performance of its tasks, it is for the MNB’s decision-making bodies to 

take decisions concerning its resilience. 

3.7  Contrary  to  the  above,  the  ECB  understands  that,  in  their  current  form,  the  Law  and  the  decree 

impose  a  number  of  obligations  on  the  MNB  and  place  it  under  the  supervision  of  governmental 

bodies with substantial powers. For instance, the MNB is required to build and improve its resilience 

based  on  obligations  such  as  the  preparation  of  a  resilience  plan  and  a  resilience  matrix  with 

predetermined content and form requirements and the establishment of a position of an independent 

critical  entity  resilience  manager  with  the  provision  of  adequate  technical,  human  and  financial 

resources  for  their  activities.  The  supervising  governmental  bodies’  powers  include,  for  example, 

powers to designate a specific MNB infrastructure as a critical infrastructure, to approve or reject the 

MNB’s resilience plan and resilience matrix, and to mandate the MNB to conduct resilience exercises 

and stress tests. The MNB is also subject to inspections during which the supervising governmental 

bodies monitor all the MNB’s actions and lack of action related to its resilience. Finally, if the MNB or 

the  critical  entity  resilience  manager  fail  to  comply  with  their  legal  obligations,  the  supervising 

governmental bodies will impose a time limit for the MNB to remedy the failure and may impose an 

administrative fine on the MNB. These obligations and supervisory powers significantly influence the 

MNB’s preparedness and fundamentally restrict the autonomy of the MNB’s decision-making bodies 

to make decisions that concern the MNB’s resilience. 

3.8  Therefore, the Law and the decree, in their current form, amount to enabling the government to give 

instructions to the MNB and thus interfere with the MNB’s independence under  Article 130 of the 

42  
43  
44  

See paragraph 2.3.1 of Opinion CON/2017/31 and paragraph 3.2.1 of Opinion CON/2018/39. 
See Article 282(2) and (4) of the Treaty and Articles 8 and 12 of the Statute of the ESCB. 

See paragraph 2.1 of Opinion CON/2020/2 and paragraph 2.1 of Opinion CON/2021/35. 

6 

 
 
ECB-PUBLIC 

Treaty.  Against  this  background,  the  ECB  recommends  that  the  Hungarian  legislator  exempt  the 

MNB from any provision that could amount to enabling the government to give such instructions to 

the MNB in light of the need to preserve its independence. 

This opinion will be published on EUR-Lex. 

Done at Frankfurt am Main, 12 May 2025. 

[signed] 

The President of the ECB 

Christine LAGARDE 

7