AML (anti-money-laundering) for Hungarian fintech

DEFINITION

In Hungary, MNB and NAV supervise anti-money-laundering (AML) rules. Every fintech, crypto exchange, lending platform, and certain types of e-commerce must perform KYC (customer identification) on transactions over HUF 4.5M (one-off) or HUF 1M / month cumulative. Reporting to the Hungarian FIU is mandatory for suspicious transactions. Custom AML system: €5-15k. Off-the-shelf provider (Sumsub, Onfido, Ondato): €80-500/month + per-transaction fee.

RELATED TERMS06

Threat model→
A structured exercise that walks the system's actors, attack surface, risks, and controls. Day one of every DField project · before any code.
Penetration test (pentest)→
Manual + tooled attack simulation that reveals what an attacker could achieve. We deliver findings as PRs in your repo, not an 80-page PDF.
DevSecOps→
Security as a continuously-running CI step (SAST, DAST, SCA, IaC scan), not an annual project. Runs against every push; every sprint closes at least one security bug.
MFA (Multi-factor auth)→
Two or more factors (TOTP, WebAuthn, biometric) beyond a password. Table-stakes in SaaS today · enterprise procurement disqualifies you without it.
SOC 2→
A US audit framework for confidentiality, integrity, availability, and privacy controls. For SaaS, the Type II audit (6–12 months of observation) is the standard enterprise baseline.
ISO 27001→
International standard for Information Security Management Systems (ISMS). Often preferred in Europe instead of or alongside SOC 2. 3-year certification cycle.

MENTIONED IN THE BLOG08